We just raised a $30M Series A: Read our story
MK
Dy General Manager at a real estate/law firm with 501-1,000 employees
Real User
Top 5Leaderboard
Great user experience, very little maintenance required, and easy to set up

Pros and Cons

  • "There's almost no maintenance required. It's very low if there's any at all."
  • "The solution needs to have integration with on-premises security devices and security facilities. That means all the security products, including the perimeter firewall, the DMZ."

What is our primary use case?

The solution is primarily being used at our endpoint, which includes roaming users with laptops. It is being used in all of our servers at our data center. Our security team can monitor everything centrally using the Falcon dashboard. If there is an incident, our team can actually go to the root cause of the incident to try to solve it there. 

What is most valuable?

The overall user experience is good. As of today, there have been no incidents that we've had to deal with and we've been using it for years. 

The solution has a very good graphical interface. It makes it easy to use. The central monitoring is excellent.

There's almost no maintenance required. It's very low if there's any at all.

The solution is an AI and ML-enabled tool for protecting our endpoints. We're still able to use Symantec as an endpoint as well.

What needs improvement?

The solution needs to have integration with on-premises security devices and security facilities. That means all the security products, including the perimeter firewall, the DMZ. 

I'd really like to have a complete solution. Right now most of the incidents happen on our endpoints. It is visible at the endpoint, the end server. If this can have a correlation tool that could actually give us a comprehensive dashboard, that would be useful. It could give us top-down visibility and could be from the firewall or any kind of security protection tool. It could be part of the DNS protection suite. However, that's why it's so important to have better integration capabilities.

If this endpoint is trying to get at this particular website and it is identified as DNS level protection, that also comes to this dashboard. Around 80% to 90% view of whatever it is happening with this endpoint, whatever action it is doing, can be inspected on the dashboard.

 If the endpoint is protected by CrowdStrike. I am only to access this application through a CrowdStrike protected device. 

For how long have I used the solution?

We have been using CrowdStrike as a tool now for the last three months.

What do I think about the stability of the solution?

The stability may be too early to judge, as we are still in a POC. However, when we see the product, it is very, very stable.

What do I think about the scalability of the solution?

We didn't go with the Basic version. We went with Superior. Even the insurance companies are also sold on this product. 

We find that the solution is very, very scalable as a tool and it can completely manage and protect the endpoint. It offers around 99.99% of your protection and assurance and can scale up however much you like.

We have implemented it for approximately 200 users as a POC. We are ready to have a contract with CrowdStrike and we will be implementing it for 700 users in the end, so we will scale it from the POC when we begin to officially use it.

How are customer service and technical support?

Due to the fact that we are still running a POC, we have direct access to the principal on the contract. They have given us a lot of confidence in the product and they are always available alongside the system integrator. We basically have two layers of support.

At this initial stage, if there is any troubleshooting needed, or any type of support is required, the system integrator will provide this to us. If we need to escalate to support for some reason, we have agreed to have CrowdStrike themselves look into any issues.

So far, it's been an effective system and we are satisfied with the level of support we've received.

Which solution did I use previously and why did I switch?

We were using Symantec products, which were Symantec EndPoint Four and Five. We found that the latest modules needed additional tools to protect us. There were multiple tools needed at various levels. There was complexity in increasing users on this platform. It also took a more traditional approach to security, and we were looking for something more advanced that had advanced AI and ML capability.

We evaluated CrowdStrike and we found it satisfactory in our environment. Therefore, we decided to change to it from Symantec.

How was the initial setup?

The initial setup is very, very straightforward, and very easy to use. So far, we've found it very easy to drill down to the root cause.

This is a new area and product for us, so we decided to start using it as a POC. We started in March, or the end of February, of this year, and we have done a POC for some of our users. We'll be going forward with a full implementation and increasing our usage.

In terms of maintenance, I don't find there's much of a requirement for it. It is very easy to maintain. For monitoring and reporting purpose, we have access to a dashboard. Our security can take a look at everything themselves. We also have team members that are capable of configuring this product. That will help us to reduce the requirement of manpower in the long run.

What about the implementation team?

We had a system integrator partner that assisted us with the POC.

What's my experience with pricing, setup cost, and licensing?

I'm not sure what the exact cost of the solution is.

What other advice do I have?

We're a customer. We don't have a business partnership with this solution.

I'm not sure which version of the solution we're using right now. It is the latest, as far as I know. We're currently running a POC with it.

In today's environment, it's very crucial to protect a company from ransomware, and malware. We focus mainly on avoiding these types of attacks. We're always interested in the latest tools that have the latest techniques and are effective in our environment.  

On top of that. we've noticed during the pandemic, there are even more threats happening. We need to focus most of our energy on the endpoints which are basically connected to an unprotected network.

The focus on the endpoints has to be increased at this point in time to ensure we have maximum protection. We prefer to have a cloud-based product rather than an on-premise-based product to protect our data and our endpoints. Therefore, we may need to move to a cloud-based protection suite. Other companies should also consider this. Whether they choose a product like CrowdStrike, Cortex, or Cylance is up to them.

I'd rate the solution eight out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Stephen Hand
Director, IT & Systems Security at Tilson Technology Management
Real User
Top 20
Good visibility helps us make educated decisions, easy to scale, helpful threat-response support

Pros and Cons

  • "The Protect functionality on the laptops provides great visibility into what's occurring, and the cloud management of the platform is what we needed."
  • "The console is a little cluttered and at times, finding what you're looking for is not intuitive."

What is our primary use case?

We implemented CrowdStrike because we needed to identify a new solution to address a 100% remote workforce, both because of COVID, but in general, our workforce is very distributed around the country.

How has it helped my organization?

The primary way that CrowdStrike has improved the way our organization functions is visibility. When we do have an issue, the ability to see what was happening before, during, and after the issue on the target laptop or server is far better than what we were used to.

Having the updates happening automatically, with a third-party defining those updates and pushing those in, also providing us visibility into the current status of all of our endpoints, is critical.

We use Falcon's endpoint and cloud workload protection, which is deployed on our Azure cloud servers. It is definitely one of the top options available to any organization. We had reviewed 10 different applications in the EDR space and Falcon was one of the top three that we had identified.

In terms of preventing breaches, so far, it's doing great. Definitely, in our testing that we do every month, it is identifying issues that arise with more certainty. Simply, the team has more confidence in what they're utilizing as a tool and it has freed them up to work on things that are a more efficient use of their time.

What is most valuable?

The Protect functionality on the laptops provides great visibility into what's occurring, and the cloud management of the platform is what we needed.

It is important to us that this cloud-native solution provides us with flexibility and always-on protection because we have a 100% distributed workforce, in place even before COVID. To manage 600 remotely-deployed laptops requires a cloud-managed solution.

What needs improvement?

The console is a little cluttered and at times, finding what you're looking for is not intuitive. Once you find it, it's great, but it's not always very intuitive as to how to find exactly what you're looking for sometimes.

For how long have I used the solution?

I have been using CrowdStrike Falcon for six months.

What do I think about the stability of the solution?

We have had no issues at all with stability, and no conflicts on any of our endpoints or servers.

What do I think about the scalability of the solution?

It seems to be limitless from a scalability standpoint. Definitely, there would be no impact on our end, and we haven't noticed or run into any issues as we scaled from our initial 10 systems to 600. There was no difference in speed or reporting, et cetera.

So, scalability does not seem to be an issue.

How are customer service and technical support?

Technical support is an area for improvement. If you have an actual issue, such as an identified threat, then they are very good. However, if you're struggling to figure out what might have occurred, we're still trying to figure out how to get our best support from CrowdStrike in those situations.

Which solution did I use previously and why did I switch?

Prior to Falcon, we were using Webroot.

The primary improvement that we have seen is visibility. We had no visibility into what happened before, during, and after a situation with Webroot, but with CrowdStrike, we have that visibility, which allows our team to make educated decisions. In terms of detection and prevention, I believe it's all experiential so far. Falcon has been very good at both detection and remediation for any issue that has come up.

How was the initial setup?

The sensor setup and deployment were extremely easy. We were able to deploy a hundred percent of our endpoints within 60 days. We found it to be very smooth.

It was a very simple deployment strategy to get the agent out to the end-users. It was so smooth that we didn't even have to notify the end-users that it was being done. It just happened automatically. 

There was no conflict between CrowdStrike and our existing EDR that we were going to get rid of. After the installation, we were able to have the old EDR totally removed within 30 days.

What about the implementation team?

We had two people for deployment and we have one for maintenance. Their roles are in information security.

What was our ROI?

We have seen ROI in that our team is freed up to work on things that are more important.

What's my experience with pricing, setup cost, and licensing?

We took advantage of Falcon's free trial before purchasing it, and it was very easy to get it. We were on the phone with a representative discussing our next steps and they offered the free trial, and we were set up and functional with it the next morning. Having a free trial period is something that is expected. If anybody wants our business in this space then it's necessary because we aren't going to purchase something without trying it first.

The pricing is not bad. It's on the higher end of the market, but you get what you pay for. It's a little on the confusing side because the name of the item they're selling doesn't match what you see when you log into the product.

If you buy "Protect" and you log into the product, you don't see "Protect". You see something else, like "Identify" or whatever. So, they need to do a better job of aligning product names from the sale to within the product.

There are add-on fees for different packages that you can buy, and we are looking at adding on some feature functionality as we go forward.

Which other solutions did I evaluate?

We evaluated 10 different solutions in the EDR space. The top three included CrowdStrike Falcon, Carbon Black, and Microsoft's ATP.

CrowdStrike was a little better, cost-wise, than the other two. Also, I felt that the console for managing the platform was easier for my team.

What other advice do I have?

My advice for anybody who is looking into implementing this product is that every organization is slightly different in its needs, and CrowdStrike may or may not be the right solution. Once you can do a trial and a bake-off of multiple options, you'll find if CrowdStrike is the right solution or not.

I would rate this solution a nine out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Flag as inappropriate
Learn what your peers think about CrowdStrike Falcon. Get advice and tips from experienced pros sharing their opinions. Updated: December 2021.
554,586 professionals have used our research since 2012.
JS
Director of IT at a tech services company with 51-200 employees
Real User
Top 20
Responsive and fast support, easy to deploy, well-tuned to ignore false positives

Pros and Cons

  • "We have a small IT Team, and this allows us to get sleep at night, knowing that someone else is taking care of any incidents that occur."
  • "It would be nice if the dashboard had some more information upfront, and looked a little better."

What is our primary use case?

We use this product for endpoint security and threat remediation.

How has it helped my organization?

The fact that this is a cloud-native solution that provides us with flexibility and always-on protection is absolutely important, especially with a good majority of our staff working remotely, now.

We've had security incidents that occurred and within a matter of just a couple of minutes, they were completely remediated and fixed and we didn't even have to think about it. We just got the report after the fact.

Falcon's ability to prevent breaches is excellent. It's affected us in that we haven't had any downtime as a result of breaches or any malware or anything like that. Ultimately, it's given us a lot of our time back. On the IT side, this is at least five to ten hours per week. On the user side, it is probably more.

What is most valuable?

The most valuable feature is threat remediation. We have a small IT Team, and this allows us to get sleep at night, knowing that someone else is taking care of any incidents that occur.

CrowdStrike takes care of all of the updates, so we don't even think about it or see it. This is great because we definitely spent a lot of time doing that kind of thing with our previous solution. Now that we haven't had to do it in four months, it's not even something we consider anymore.

We use both the endpoint and cloud workload protection and the detection and prevention it provides are excellent. It's tuned well to the fact that there can be a lot of false positives, so there's not a lot of potential issues that we're getting alerted about that aren't real. This means that when we do get alerts, we know that they're real and they're already being remediated for us.

What needs improvement?

It would be nice if the dashboard had some more information upfront, and looked a little better. Having a cooler dashboard is nice to have, although it is not as important as the functionality, which is very good.

For how long have I used the solution?

I have been using CrowdStrike Falcon for approximately four months.

What do I think about the stability of the solution?

The stability is great and we haven't had a single issue.

What do I think about the scalability of the solution?

It was originally deployed to 200 users and we haven't really grown since we started, so I can't speak to scalability. This represents 100% adoption in our organization, and there are no current plans to grow. As we hire more people, our usage will increase.

There are two people who work with it on a daily basis. There is the director of IT and a network administrator.

How are customer service and technical support?

The technical support is excellent. I've only used it a couple of times and they were extremely responsive and very fast.

Which solution did I use previously and why did I switch?

Prior to implementing CrowdStrike, we used BlackBerry Cylance. We switched for the ability to have full remediation so that we didn't have to do it ourselves. Also, this product is pretty much best-in-class for endpoint protection.

The only real difference that we have found with CrowdStrike, compared to Cylance, is that we no longer have to spend time remediating our issues. The detection and prevention capabilities are similar, although, with CrowdStrike, we have fewer false positives.

How was the initial setup?

The initial setup is extremely easy. It took me about five minutes to deploy it to my entire organization of about 200 users. The single-center process is extremely important because it's something that we were worried about, but it turned out to be a non-issue because it only took five minutes and we haven't had to think about it again.

We initially had a plan for deployment but once we found out how easy it really turned out to be, it was basically a one-step plan.

What was our ROI?

Our return on investment comes from the fact that there is less downtime for people that do get malware and other such problems. That is something that can be quantified.

What's my experience with pricing, setup cost, and licensing?

We made use of the free trial and the process for getting set up was extremely easy. We spoke to our sales rep and in our discussions and demos, they offered the free trial. We accepted, they sent me a link and I downloaded the agent. I was then able to install it and login in less than five minutes.

Having the free trial was very important in making our decision to implement CrowdStrike because without being able to test it, it's not something that we would have chosen.

The pricing is definitely high but you get what you pay for, and it's not so high that it prices itself out of the market. That said, it's definitely one of the highest. There are no costs in addition to the standard licensing fees and the fact that it's keeping us safe, and it's proven that it works, is worth it.

Which other solutions did I evaluate?

We evaluated solutions from several vendors including Sophos, Trend Micro, McAfee, Kaspersky, and perhaps another one. A lot of these other endpoint solutions don't offer a full remediation option, and that was a big deal for us.

Also, reputation was important. We had used a couple of others in the past and there were issues where they would make an update that would negatively affect all of our computers. For example, our users could no longer access certain important websites. We haven't had that problem with CrowdStrike.

In terms of ease of use, CrowdStrike is extremely easy. Comparatively, we've had less time in the administration console than we have previously.

What other advice do I have?

My advice for anybody who is looking into implementing CrowdStrike is to go ahead and do it. There is nothing to worry about and they deliver as promised.

I would rate this solution a nine out of ten.

Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Flag as inappropriate
DA
Sr. IT Support Executive at a hospitality company with 1,001-5,000 employees
Real User
Top 20
Great online learning and flawless endpoints but takes a while to scan

Pros and Cons

  • "Their endpoint is pretty flawless. There is no lag on the machines at all. Even though I have a good overview of all the machines, that's pretty much the most valuable feature of CrowdStrike Falcon."
  • "It does take more time to scan than other solutions."

What is our primary use case?

We primarily use the product as a security solution.

What is most valuable?

Their endpoint is pretty flawless. There is no lag on the machines at all. Even though I have a good overview of all the machines, that's pretty much the most valuable feature of CrowdStrike Falcon. 

The machines are flawless. They don't have any issues. There I don't even recognize the machines which are on endpoints. Even when I go to the console to check these machines, they are working on a very good level, even though the wireless migration should detect those aspects. 

The AI features are pretty good.

They've recently introduced more webinars that make remote learning of the solution very easy. For people such as myself, or even a company looking to develop their skillsets and interested in better understanding the cloud, providing good web courses is really helpful.

What needs improvement?

I'm new to the solution. Currently, I'm comparing it to other EDR solutions to see if anything is missing, however, I'm still learning the ins and outs of the product.

It may be due to the fact that I am new, however, I'm having trouble understanding their licensing.

It does take more time to scan than other solutions.

The solution should continue to make the learning curve as short as possible by providing even more training and documentation.

For how long have I used the solution?

I've been working with the solution for two months. I recently joined my company and they mostly prefer using CrowdStrike Falcon. The solution is pretty new to me.

What do I think about the stability of the solution?

The stability of the solution is excellent, especially in a market like India.

What do I think about the scalability of the solution?

The product is very scalable. The solution can scale well, especially for small setups looking to expand out in the future.

How are customer service and technical support?

If they're having an issue, we tend to stick to the team and occasionally reach out to the support team of Falcon CrowdStrike.

I've never directly been in contact with the technical support team, however, my colleagues have. I'd say that overall we are satisfied with their level of service. Typically, their technical support team will give us direct intel and then our internal team with resolve the issue, so it's a true partnership.

Also, during the pandemic, they've provided everyone with lots of webinars to help their clients understand the solution better. For me especially, being anew user, I'm benefitting from this new level of service.

Which solution did I use previously and why did I switch?

We've used different solutions in the past. It really depends on the environment. That typically dictates which solution we would implement. We use, for example, McAfee as well. I personally have worked with Amnesia.

When it comes to Amnesia, initially I was able to employ them on my on-premise machine. I have installed Falcon on the cloud and infrastructure, however, I haven't dealt with the on-premise deployment. 

You can use Amnesia with McAfee. Apart from that you also have a provision for signing with McAfee and using their host software and the server software and their media solution and placing those onto an on-premise machine or onto a particular server and you would have the ability to administrate from there. That's more for a company that is into privacy and doesn't want to share their data on a cloud.

How was the initial setup?

The solution isn't complex in terms of setup. It's very straightforward, actually.

I'm sure that for small environments or a company that may scale up, the installation would be minimal. It wouldn't be a standard installation, however, we're able to implement rather easily in small environments.

What's my experience with pricing, setup cost, and licensing?

The solution is much more costly than other cloud or on-premises solutions. However, it offers good stability, so if a client can afford it, we tend to recommend it as an option.

Which other solutions did I evaluate?

I'm currently checking other EDR solutions to see what is on offer. Clients are asking about McAfee and Symantec, so I am looking at those as options.

What other advice do I have?

I'm unsure which version of the solution we are using.

I'm currently practicing my skills on this EDR solution. I have worked with this software and I've already collaborated with my seniors who are currently experts on this particular product. I'm getting pretty good help. 

Most of our clients have their own infrastructure which is mostly on the cloud. They have their own solid, robust infrastructure. When it comes to small environments that are currently adapting to the cloud, CrowdStrike could be a great opportunity. The solution, for example, doesn't require a minimum installation. It can work well for very small companies as well as larger organizations.

If a company has the financial means, we tend to recommend this product. There are great security features on offer that are much better than other options in India at this time.

I'd advise companies considering this solution to check their resources. They have to choose the option between being on-premise and the cloud option. They need to try and run it before adopting any solution. It's important also to consider security and monitoring for threats.

Overall, I'd recommend companies study their environment and check and compile an e-solutions calendar. There's a lot of them. Microsoft has provided a 99GB advanced dataset collection and it is on the cloud.

I'd rate this product seven out of ten overall. While I've never had any problems with it, there are just so many other options on the market.

Which deployment model are you using for this solution?

Public Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Microsoft Azure
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
Tom Smolinsky
Executive Technology Advisor at Vitso
Real User
Top 20
Good UI, performance, integration, and alerting

Pros and Cons

  • "The feature that I find to be the most valuable, is being able to look at the system analysis and being able to baseline what is installed on the system."
  • "I think there's an opportunity to enhance the AI or at least the traps to say, if something changes from this baseline, let us know and flag it."

What is our primary use case?

We are using this solution for advanced threat protection, over and above any antivirus for approximately 1200 end-users, or endpoints. It is able to identify any anomalies and alert on that using the AI engine. That way, there's a small security team to make them more effective, to be able to get an alert, go in and look at what's going on. 

Since I have been here, I have been keying into when people fall for phishing attacks and they either get blocked going to a website or their credentials get compromised, and somebody logs in to their Office 365 account. We were able to forensically identify that in two of the cases. Most recently, since I've been here looking at the more active response, to be able to identify and act a little bit more quickly.

How has it helped my organization?

I was able to look through some rapid analysis when bad things happen. More so than having to get, especially in the distributed world of post-COVID, being able to have a central place to be able to see what's going on, on the landscape of endpoints at any given time.

What is most valuable?

The feature that I find to be the most valuable, is being able to look at the system analysis and being able to baseline what is installed on the system. What does it usually do, and is it doing anything differently?

The UI is great, and the performance was great. The way it gathers and presents the information was very good and it integrates well with things with a central log aggregator, such as Splunk. You can do more big data analytics that includes security. It seems to be fully featured in all of those areas.

What needs improvement?

I think there's an opportunity to enhance the AI or at least the traps to say, if something changes from this baseline, let us know and flag it. It's got a pretty good engine to do that on its own but it's one of the things that are important to us, so I'm just trying to increase the time-to-issue identification.

By comparison to buying into the Microsoft suite, it was definitely less costly. CrowdStrike can be costly.

For how long have I used the solution?

I have had this solution for approximately three years.

What do I think about the stability of the solution?

It seems stable. The performance is good.

What do I think about the scalability of the solution?

It's a scalable solution. They are running 1400 endpoints on it right now, and it seems to be fine.

There is only one person working at it right now and they are the security engineer/operator.

If you look at how they spend their day, a tool like that does a lot with a little and can make a one man band pretty effective or much more effective. It makes the response to an issue right when it happens way more possible with such small security. 

How are customer service and technical support?

We haven't used technical support.

How was the initial setup?

The initial setup was already completed before I started with this company.

What's my experience with pricing, setup cost, and licensing?

When comparing to Microsoft, CrowdStrike Falcon is more expensive.

I'm going by the client and some of the things that are driving their decisions. 

It's typical when Microsoft throws things in and it seems really cheap, even though you're spending a million and a half dollars with them. You may as well increase the value of that million and a half.

My guess is that CrowdStrike is going to maintain parity or stay ahead of Microsoft.

What other advice do I have?

As I came into this organization, they were moving away from CrowdStrike. 

They upgraded their license to E5 with the security bundle from Microsoft. The goal is to start to move things. 

They are paying twice for things right now, but that will be expiring. CrowdStrike comes up for renewal next year, and they want to be off of it by then.

I haven't gone into critiquing it. Since they've already made the decision and made the investment to go to defender ATP. I'm more concerned with, are we losing anything? Do we have parity when we go from one platform to another? And if any gaps emerge, what needs to be filled?

When we did go into it and walked through it with one of the security engineers, it was snappy, and it had a nice UI. 

I had never been inside the product. I think I got a demo years ago in my CSO role, but I had never delved into a practical use case. The practical use case looked pretty cool.

For anyone who is interested in implementing this solution, I would say don't look for the cost compared to smaller applications. Look at what you're trying to do, and what you're trying to accomplish. The typical first cardinal sin of IT is buying a product and then figuring out how to use it as opposed to having a set of requirements, placing a value on that set of requirements, and then pursuing a solution that covers them the best. 

I think they probably said we've got a gap here because something bad happened to my CrowdStrike. It's an industry leader. Three years after the issue that they were treating was over, and the pain was gone, suddenly, it seems really expensive. That is an IT 101 mistake that I've found in organizations, where it's a means to an end and then it turns this to just an eyesore on the balance sheet.

I would rate this solution an eight out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
BH
Service at Four-U Office Inc
Real User
Top 20
Inexpensive, doesn't slow down devices, and an easy initial setup

Pros and Cons

  • "The initial setup is very simple."
  • "They don't really have anything when it comes to scanning attachments."

What is our primary use case?

We primarily use the solution for real-time ransomware protection.

What is most valuable?

The solution hasn't picked up a virus yet, so I don't know if I'm able to really discuss the most valuable aspect of the solution just yet. It's very new. 

It's not costly, and it's not constantly running, it's only looking for suspicious items when it starts to take action. There's nothing constantly scanning your device, so it's not slowing anything down in that respect. That's what I liked about it the most. 

It's not your traditional antivirus that just sits there constantly scanning your computer for Trojans and malware, etc. This doesn't take any action until it sees something actually going on.

The initial setup is very simple.

What needs improvement?

The solution doesn't have a whole lot of email security on offer. We did know that going into the purchase, however. We decided to get a different solution for that aspect of security.

They have a sandbox feature, but it's all they do. They have different grades. There's the Socket Pro and then there's an ADR. Then there's another one where they pretty much watch your system for you. And it's all different. It's all based on the price you want to spend. I wasn't going to drop a large amount of money.

They don't really have anything when it comes to scanning attachments. That would be something I would like.

For how long have I used the solution?

I've only been using the solution for one month. It's still a relatively new product for us.

How are customer service and technical support?

The technical support so far has just been helping with the setup via the initial webinar. The technician was very knowledgeable. He knew what each feature meant. If I had a question about it, he went into great depth. I've been quite satisfied with technical support so far. As a whole, they are very easy to work with.

Which solution did I use previously and why did I switch?

I had Bitdefender for three years before switching to this solution.

They were fine. I didn't have a lot of problems, but I'd been hit with ransomware four times while I had Bitdefender. I considered that as kind of a sign that maybe we should change things up.

The malware, as far as uninstalling, wasn't triggering the antivirus. I wanted something a little more advanced, due to the fact that the Ransomware protection just really wasn't there. The anti-virus aspect was pretty good. The email protection was pretty good, as well.

How was the initial setup?

The initial setup is pretty easy. It's very simple to work with. It's been really easy to install.

What about the implementation team?

I did one webinar with a support engineer. He showed me how to set it up, and to run with it. 

We just did a screen share. He gave me insights into the best possible way to set it up and that's how I rolled it out. It was a helpful experience.

What's my experience with pricing, setup cost, and licensing?

The pricing on CrowdStrike is per license. It was about $42 per seat yearly.

Which other solutions did I evaluate?

I looked at Komodo, a Gen One antivirus. I liked their product. It was pretty good. They have what is called a sandbox feature where you could take a file or the endpoint security will take the file and dump it into like a virtual sandbox and run it to test its safety. It turned out the file was malware, the solution would remove it. 

We decided not to go with it, however, due to the fact that it didn't have many reviews. Komodo is actually cheaper than CrowdStrike. I've been down the road before with bad antiviruses and had some bad experiences. Since they didn't have a whole ton of notoriety out there, you didn't see a lot on it, which kind of scared me away from it, even though I liked what they had.

CrowdStrike, it's new, however, Amazon uses it. My thoughts are if it's good enough for them, I assume it's good enough for me.

We looked at Sophos as well, however, it was very expensive. Sophos offers everything, and they are a great product, however, for us, the price was just too much.

What other advice do I have?

We're just a customer. We don't have a special relationship with CrowdStrike.

We're using the most up to date version of the solution right now.

So far, I've had good luck with this solution. That said, it hasn't hit anything. I won't get a true test until I actually get somebody that sends up malware. In the meantime, no news is good news.

I would rate the solution nine out of ten right now. They're pretty good. I haven't done anything super-advanced or to spec. There's a lot there to work with if I want to, however, I keep it pretty basic. I only have a couple of policies. It's not a huge company, so it's not real hard.

Which deployment model are you using for this solution?

Private Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
ITCS user
Senior Cyber Security Analyst with 1,001-5,000 employees
Real User
Top 20
Detailed incident reporting, stable, and the technical support team is well trained

Pros and Cons

  • "The most valuable feature is the indicator of compromise, which show you what file was either quarantined or removed."
  • "Any kind of integration that you want to do, such as using the API to connect to a SIEM, is complex and it will be expensive to do."

What is our primary use case?

The primary use case is digital security investigations using the dashboard.

How has it helped my organization?

Every week, a manager would look at a detailed report to see what kind of CrowdStrike incidents we had.

What is most valuable?

The most valuable feature is the indicator of compromise, which shows you what file was either quarantined or removed. It shows you the malicious files in question, as well as the exact time, the machine, the endpoint, and the host IP address. Everything you need to know is right there in a single dashboard.

What needs improvement?

Any kind of integration that you want to do, such as using the API to connect to a SIEM, is complex and it will be expensive to do. It is quite a pricey product.

For how long have I used the solution?

I used CrowdStrike Falcon in my last two cybersecurity jobs, over a period of at least two years.

What do I think about the stability of the solution?

The product is stable as a rock. I have never seen any crashes. When it came to patching updates, we were always notified. It is not Windows-based, but rather Linux or Unix-based. It was more stable than any Windows product.

What do I think about the scalability of the solution?

We had a small shop, so we never had any reason to scale.

How are customer service and technical support?

The technical support is pretty good. They're trained in their product and they have a system in place where if the first line of support does not resolve the issue, they are emailing us directly back and forth, and they'll hand over the problem from one shift to the next.

It is not very difficult to get in touch with the support team, although it does require clearance from whoever handles the money aspect. You have to be really careful because they will charge you fees for any kind of solution that they provide.

I have used them twice, once for each company that I was working for. The first time, we used the CrowdStrike service to do the investigation so that we could focus our time on other products. They have teams that will act like a managed service provider to take care of incidents. We handled major incidents in-house but we let them handle the minor ones.

With the second company, we had to do the investigations as the incidents came in, so it was two totally separate vantage points. Both worked extremely well in both manners and forms.

Which solution did I use previously and why did I switch?

CrowdStrike was already in place before I arrived, at both places where I have used it.

We were also using Carbon Black, as well as other tools, but they were not being used to the same degree. I think that we were using Carbon Black for white-listing applications.

I also spent a lot of time using Nessus, which is a vulnerability scanner. I would look at scans to see what kind of vulnerabilities were present, and patch management updates with other teams.

How was the initial setup?

I was not there for the initial setup, but what I did learn was that the implementation team came in and worked with our engineering team. They set it up and then our team verified that all of the endpoints where there and that we had the visibility we needed for all of the subnets in all of the locations.

When I spoke with my teammate, I was told that it was pretty much straightforward and out of the box. The fact that it is a cloud-based deployment made it easier, too.

What's my experience with pricing, setup cost, and licensing?

Our licensing fees were between $50,000 and $60,000 per year, which was pretty expensive for a small business. It is not a one-time payment. Any upgrades that you want to do, you're going to have to pay multiple times.

What other advice do I have?

My advice for anybody who is implementing CrowdStrike Falcon is to get in touch with the vendor and then follow best practices. They have a lot of documentation and everything is there. For the most part, I would suggest looking at the technical support documentation first and then contacting a representative at the vendor to continue the process.

Most companies have it integrated with the SIEM and with their ticketing system, although I did not use it in that capacity because it costs more money.

Most of the time, you're not going to have to lay a finger. Once it finds an infected file, you might have to reboot the computer if it can't immediately remove it, or other such minor stuff. In general, however, it's never given me any issues and it's never given me a headache. Overall, it's very straightforward and just one tool out of the whole.

I would rate this solution a nine out of ten.

Which deployment model are you using for this solution?

Public Cloud
Disclosure: I am a real user, and this review is based on my own experience and opinions.
JT
Director - IT Security Operations at a manufacturing company with 10,001+ employees
Real User
Allows us to stay in business by keeping our systems up

Pros and Cons

  • "CrowdStrike Falcon has done an excellent job at detecting breaches. It has allowed us to stay in business and keep our systems up."
  • "CrowdStrike Suites and the way that it bundles things can be a bit challenging. It should be easier to integrate with the other stuff that they sell or be included with what they sell. We have one piece, then they are talking about another piece on vulnerability management all of the sudden, and we don't own that piece. We can see it in the console, but nothing shows up. It simply appears within the tool as an option, but we can't use it without purchasing it."

What is our primary use case?

It blocks all the stuff bad actors are trying to do to our users.

All our end user systems and servers are on-prem and cloud workstations desktops everywhere.

We are using the latest version minus one release (N-1).

How has it helped my organization?

It provided us visibility into our endpoints that we did not have before. The telemetry and data that it collects allows us to respond to possible incidents much faster, containing the host as well as jump on the host for remediation.

CrowdStrike Falcon has done an excellent job at detecting breaches. It has allowed us to stay in business and kept our systems up.

What is most valuable?

CrowdStrike endpoint detection and response (EDR) is excellent. It blocks the bad stuff without user interaction, allowing us to stay in business. For example, one of our service providers has been down for five days now with ransomware. Also, four of our partners have been down over the past two months with cyberattacks, and we can't do business with our partners.

What needs improvement?

CrowdStrike Suites and the way that it bundles things can be a bit challenging. It should be easier to integrate with the other stuff that they sell or be included with what they sell. We have one piece, then they are talking about another piece on vulnerability management all of the sudden, and we don't own that piece. We can see it in the console, but nothing shows up. It simply appears within the tool as an option, but we can't use it without purchasing it.

For how long have I used the solution?

I have been using it for a little over three years.

What do I think about the stability of the solution?

The stability is very stable. There have been no issues.

We have automated all our CrowdStrike Falcon updates.

What do I think about the scalability of the solution?

It is very scalable. There have been no issues at all.

How are customer service and technical support?

CrowdStrike's technical support is excellent:

  • Quick to respond
  • Quick to help
  • Very responsive
  • They have always been able to solve the issue.

Which solution did I use previously and why did I switch?

I was a McAfee customer for 20 years before switching. It was like night and day, where McAfee is old technology, and CrowdStrike Falcon is new technology. On a scale of one to 10, McAfee is at one and CrowdStrike Falcon is at 10. There is a really big difference.

We came from an on-premises solution. With more people working remotely, that became an issue. The fact that this is a cloud-native solution provides us with flexibility and always-on protection.

How was the initial setup?

It was very easy to deploy the solution’s single sensor. We used our deployment tools to push it out. Because it is a single agent, it is very lightweight, easy to install, and updates itself. We came from a competitor who had multiple agents, upgrades, and DAT files, where you could have very few of these with 100 percent working. However, since there were six different modules, they all had to be kept updated, which was a nightmare. 

This solution was a simple, easy push. Once it is on there, it updates automatically and we don't have any issues.

For deployment, we use a tool called Quest KACE. We also use SCCM.

We did about 10,000 hosts in around two months. We have had growth through acquisition. Now, we have 12,000 hosts.

What about the implementation team?

We did it ourselves.

For the deployment, there was one FTE (a Level 2 PC technician) for eight weeks. For maintenance, it is pretty much set and forget it. There is very minimal maintenance and zero dedicated staff.

What's my experience with pricing, setup cost, and licensing?

We bought a very small number of licenses, then ran it for a year. We bought a 100 licenses for a year, so we didn't actually do a proof of concept. We just bought them. Then, the next year, we bought 10,000 licenses.

We received a quote three years ago, and it was almost seven figures. CrowdStrike got money from investors to displace competitors, like Symantec and McAfee. Then, our quote was very low, which is why we were able to do this. The first year, the quote was almost a million dollars. The second year, it was a little over $100,000.

Which other solutions did I evaluate?

We also evaluated Cylance and Carbon Black. We went with CrowdStrike Falcon because of the single agent and price. The other solutions required multiple agents, and I did not like that at all.

Compared to the other solutions that we evaluated, CrowdStrike Falcon has a similar ease of use.

What other advice do I have?

We are a very happy CrowdStrike Falcon customer. I highly recommended it. It works.

I would rate this solution as 10 out of 10.

Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Flag as inappropriate
Buyer's Guide
Download our free CrowdStrike Falcon Report and get advice and tips from experienced pros sharing their opinions.