CrowdStrike Falcon Endpoint Protection Platform Reviews & Product Details

What I like best is detection quality combined with ease of deployment. The single lightweight agent installs quickly, needs no reboots or on-premises infrastructure, and has minimal impact on endpoint performance, even on demanding engineering workstations. Behavioral detection consistently catches suspicious activity that signature-based tools would miss, and alerts come with a clear process tree that speeds up investigation. Real-time response and one-click host isolation let us contain threats remotely at any site within minutes. I also value the integration ecosystem, especially the posture sharing with Zscaler, which lets endpoint health directly influence access decisions in our zero trust architecture. Review collected by and hosted on G2.com.

The biggest drawback is cost. The modular licensing means capabilities like threat hunting, identity protection or extended log retention each require extra add-ons, which makes budgeting and renewals complicated. The console is powerful but has a steep learning curve, and building custom reports or dashboards is less intuitive than it should be. We also had to tune exclusions early on to reduce false positives on engineering and CAD workstations. Review collected by and hosted on G2.com.

CrowdStrike's falcon EDR is one of best EDRs I have worked with, really good coverage of overall protection multiple threat landscapes.

Product functionality and performance

Product roadmap and future vision

Strong consulting partnership

Strong services expertise

Strong user community Review collected by and hosted on G2.com.

Licensing costs., sometime some of the modules are comes as additional ad-on with high costs. Review collected by and hosted on G2.com.

El onboarding de los agentes es muy versátil: no satura los servidores ni los endpoints y no afecta la operación ni las actividades del usuario, ya que consume muy pocos recursos del sistema, dando un rendimiento de la solución optimo.

La función de Threat Graph no facilita tener visibilidad de los comportamientos anómalos.

La capacidad de respuesta casi automática del RTR nos ayuda a aislar equipos en casos extraordinarios, así como a ejecutar scripts para la remediación sin necesidad de interactuar físicamente con el equipo. Review collected by and hosted on G2.com.

El ajuste inicial para evitar falsos positivos en integraciones internas requiere la intervención de un especialista, no solo en la solución, sino también con conocimientos del negocio.

La solución puede llegar a considerarse costosa a medida que se agregan más funcionalidades, especialmente si no se realiza un ejercicio de retorno de inversión. Review collected by and hosted on G2.com.

One of my favourite aspects of CrowdStrike Falcon is how intuitive and comprehensive the platform is from an investigative perspective. It provides analysts a centralised environment to review detections, identify potentially associated campaigns, and investigate suspicious activity without constantly switching between different tools.

I also really appreciate the ability to pivot between investigative features, examine detailed process trees, understand parent-child process relationships, and identify other potentially affected hosts. This makes it significantly easier to establish the context surrounding a detection and assess the potential scope of an incident.

Another major strength is the depth of telemetry available. From file hashes and IP addresses to command-line activity, process execution details, and the specific indicators responsible for triggering a detection, Falcon provides a wealth of information to support accurate triage and investigation.

Overall, I find CrowdStrike Falcon to be an extremely effective, all-in-one EDR solution that streamlines investigations, reduces the time spent gathering evidence, and enables analysts to make informed decisions regarding potential threats. Review collected by and hosted on G2.com.

There are very few aspects of CrowdStrike Falcon that I dislike, although I have encountered a couple of minor inconveniences during investigations.

Firstly, the process tree can occasionally take some time to load when reviewing a detection. While this could potentially be attributed to local device performance or network connectivity, it can be slightly frustrating when trying to investigate alerts efficiently.

Another minor inconvenience relates to navigating between multiple Customer IDs (CIDs). When investigating several detections simultaneously across different CIDs, switching the active CID in one browser tab can affect other open Falcon tabs, requiring additional navigation to return to the intended environment. This can occasionally interrupt the investigative workflow, particularly when managing multiple alerts.

However, I appreciate that maintaining a consistent active CID across browser tabs may be an intentional design decision to reduce confusion and ensure analysts are aware of the environment they're working within.

Ultimately, these are relatively minor usability considerations and do not significantly detract from what I consider to be an excellent EDR platform. Review collected by and hosted on G2.com.

Detection quality is what sets it apart. As an MSSP running a SOC across our client base, we need tools we can trust, and Falcon consistently picks up threats other products miss while keeping false positives low. That means my analysts spend their time on real incidents rather than chasing noise.

The single lightweight agent is quick to deploy and users don't notice it's there. When something does happen, the console makes it easy to investigate, see the full picture and isolate a device in seconds, which has made a real difference to our response times. Having threat intelligence built into the detections also saves us jumping between tools to understand what we're dealing with. Review collected by and hosted on G2.com.

Honestly, not much. The names of the products and the licensing can be confusing. Review collected by and hosted on G2.com.

What I like most about CrowdStrike Falcon is its powerful threat detection capabilities combined with a lightweight agent that has minimal impact on endpoint performance. The centralized management console is intuitive and provides excellent visibility across the entire environment. Its real-time monitoring, behavioral analysis, and automated response capabilities make it much easier to identify and respond to potential threats. Overall, it's a reliable and effective solution that simplifies endpoint security management. Review collected by and hosted on G2.com.

One of the main drawbacks of CrowdStrike Falcon is its relatively high pricing, especially when adding advanced features and additional modules. The platform also has a learning curve, as some configurations and investigation workflows can be complex for new users. Additionally, the large number of alerts can sometimes require extra tuning to reduce false positives. However, these are relatively minor drawbacks compared to the overall effectiveness and reliability of the solution. Review collected by and hosted on G2.com.

I work hands-on with Falcon across endpoint protection, host firewall, OpenShift, Azure AKS and image assessment. Its main strengths are threat detection, investigation telemetry and centralised policy management. Custom IOAs, response capabilities and APIs provide useful flexibility. Our security testing has produced actionable detections and helped validate protection policies and incident-response workflows before wider deployment. Review collected by and hosted on G2.com.

My concerns come from practical deployment and troubleshooting across endpoint protection and the additional Falcon firewall and cloud workload modules:

1. Host Firewall visibility: Firewall Activity centres on rule matches and logging settings. Getting a clear picture of endpoint communication required too much configuration and manual investigation. I would like a simpler way to establish a traffic baseline before defining rules, and clearer diagnostics when expected firewall events are missing.

2. Network Location Awareness: We lacked a clear central view of network-location changes and related diagnostics. Troubleshooting depended on local endpoint logs and additional log collection.

3. Kubernetes visibility: Cluster and workload context was inconsistent between Host Management and Cloud Security. Linking a node detection to the relevant cluster and workload required manual correlation.

4. Prevention and exceptions: In our node-sensor deployments, runtime policy and exception scope did not meet namespace-level requirements on shared clusters. Admission-controller controls did not address this runtime requirement.

5. Image assessment: Some alerts lacked the vulnerability details needed for investigation and exclusions. The scope of exceptions across images and environments also needed clearer explanation.

6. Release readiness: Image Analyzer compatibility issues and repository changes complicated deployment planning. Better release validation, compatibility guidance and advance communication would help.

7. Support and delivery: Progress too often required repeated follow-up. I expect clearer technical ownership, concrete next steps and realistic delivery dates. Several improvement requests remained open at our last validation; announced changes still needed verification in our environment.

These gaps add engineering effort and slow troubleshooting. More complete telemetry and stronger follow-through would make a meaningful difference. Review collected by and hosted on G2.com.

We use Falcon daily in our SOC to protect several client environments. The single lightweight agent deploys quickly and has very little impact on endpoints, which makes onboarding new clients straightforward. Detection quality is consistently high, with a good balance between visibility and false positives. Real Time Response and network containment let us act within minutes during incidents. Fusion SOAR has also allowed us to automate recurring tasks, such as reporting and part of the triage workflow. Review collected by and hosted on G2.com.

Licensing is split across many modules, which makes scoping and pricing harder to explain to clients. Some advanced capabilities need time and expertise to configure well, and certain reporting needs still require custom work through the API or Fusion. Review collected by and hosted on G2.com.

The single lightweight agent is the big win. We rolled it out across a large hybrid Windows/Linux fleet with almost no user impact and no reboot headaches. Detection quality is excellent: the process tree and threat graph make investigations fast, and the out-of-the-box detections catch real attacker behavior (hands-on-keyboard activity, credential dumping, LOLBins) with a low false positive rate once tuned. Real Time Response is a lifesaver during incidents, we can isolate a host and pull artifacts in minutes. Being able to add modules like Identity, Data Protection or Next-Gen SIEM on the same agent and console keeps the whole stack consistent. Review collected by and hosted on G2.com.

The licensing model per module can get confusing and expensive, and you sometimes need a call with sales to understand what is included in which bundle. The console has grown a lot with all the new modules, so navigation is less intuitive than it used to be and new analysts need time to find their way. Some advanced features (Fusion SOAR workflows, custom IOAs, NG-SIEM queries) have a real learning curve and the documentation could use more concrete examples. Nothing blocking, but worth knowing before you commit. Review collected by and hosted on G2.com.

What I like best about falcon endpoint protection is how easy it was to set-up and how quickly I was able to see important information, vulnerabilities and details I'm yet to see from some of its competition. The onboarding team was fantastic at showing us the essentials to start getting results immediately. The UI is fairly easy to navigate and the filtering/searching really helps narrow down your results. The menus categorise the important areas which makes it easy to find what you need, and moving between views (e.g. Inventory, to Device Management, to Vulnerabilities etc) is easy. On each endpoint, I had zero complaints from users (even software developers) as it sat unobtrusively and sipped along without bogging down the machine. We used the included log ingestion quota to pull in data from several integrations and this allowed us a better window into our resources from within a single pane of glass. In terms of deployment, it was reasonably simple to deploy using Intune (or any other software management / MDM solution. With great help topics to assist you, it was easy to create configuration profiles to ensure it had the appropriate permissions and configuration set on all devices. We were able to get rich data and actionable details from both Crowdstrike Falcon and the integration with our GRC tracking integration. I didn't get to use the AI intelligence components but I think they would be amazing at analysing and recommending remediations and improvements based on a really good base of data. Price wise, this was one of the most expensive products out there, but I could not find a comparable product that had the performance, features, integrations and ease of use of Crowdstrike. Review collected by and hosted on G2.com.

There not much to dislike - I enjoyed using it on a daily basis. I wish it was a little lighter on pricing and/or offered some more basic features for smaller businesses with fewer numbers of endpoints. Review collected by and hosted on G2.com.