What I like best is detection quality combined with ease of deployment. The single lightweight agent installs quickly, needs no reboots or on-premises infrastructure, and has minimal impact on endpoint performance, even on demanding engineering workstations. Behavioral detection consistently catches suspicious activity that signature-based tools would miss, and alerts come with a clear process tree that speeds up investigation. Real-time response and one-click host isolation let us contain threats remotely at any site within minutes. I also value the integration ecosystem, especially the posture sharing with Zscaler, which lets endpoint health directly influence access decisions in our zero trust architecture. Review collected by and hosted on G2.com.

The biggest drawback is cost. The modular licensing means capabilities like threat hunting, identity protection or extended log retention each require extra add-ons, which makes budgeting and renewals complicated. The console is powerful but has a steep learning curve, and building custom reports or dashboards is less intuitive than it should be. We also had to tune exclusions early on to reduce false positives on engineering and CAD workstations. Review collected by and hosted on G2.com.

CrowdStrike's falcon EDR is one of best EDRs I have worked with, really good coverage of overall protection multiple threat landscapes.

Product functionality and performance

Product roadmap and future vision

Strong consulting partnership

Strong services expertise

Strong user community Review collected by and hosted on G2.com.

Licensing costs., sometime some of the modules are comes as additional ad-on with high costs. Review collected by and hosted on G2.com.

The onboarding of agents is very versatile: it does not overload servers or endpoints and does not affect user operations or activities, as it consumes very few system resources, providing optimal solution performance.

The Threat Graph function does not facilitate visibility of anomalous behaviors.

The almost automatic response capability of the RTR helps us isolate equipment in extraordinary cases, as well as execute scripts for remediation without the need to physically interact with the equipment. Review collected by and hosted on G2.com.

The initial adjustment to avoid false positives in internal integrations requires the intervention of a specialist, not only in the solution but also with business knowledge.

The solution can become costly as more functionalities are added, especially if a return on investment exercise is not conducted. Review collected by and hosted on G2.com.

What I appreciate most about CrowdStrike Falcon is its excellent threat detection capabilities, centralized management, and overall reliability. The platform provides great visibility into endpoint activity and makes investigating security incidents much easier.

Features such as Real Time Response, automated workflows, and detailed detection information significantly improve daily security operations. Managing a large number of endpoints from a single console is extremely convenient.

I also appreciate the continuous development of the platform and the integration of additional security capabilities, such as Identity Protection and Charlotte AI. Review collected by and hosted on G2.com.

Although I am very satisfied with CrowdStrike Falcon, there are a few areas that could be improved.

Some advanced configurations and features require time to learn, and navigating certain sections of the console could be more intuitive.

Occasionally, troubleshooting sensor-related issues, particularly on Linux systems, can be time-consuming.

Additionally, licensing costs for some advanced modules can be relatively high. However, these are minor drawbacks compared to the overall value and security the platform provides. Review collected by and hosted on G2.com.

One of my favourite aspects of CrowdStrike Falcon is how intuitive and comprehensive the platform is from an investigative perspective. It provides analysts a centralised environment to review detections, identify potentially associated campaigns, and investigate suspicious activity without constantly switching between different tools.

I also really appreciate the ability to pivot between investigative features, examine detailed process trees, understand parent-child process relationships, and identify other potentially affected hosts. This makes it significantly easier to establish the context surrounding a detection and assess the potential scope of an incident.

Another major strength is the depth of telemetry available. From file hashes and IP addresses to command-line activity, process execution details, and the specific indicators responsible for triggering a detection, Falcon provides a wealth of information to support accurate triage and investigation.

Overall, I find CrowdStrike Falcon to be an extremely effective, all-in-one EDR solution that streamlines investigations, reduces the time spent gathering evidence, and enables analysts to make informed decisions regarding potential threats. Review collected by and hosted on G2.com.

There are very few aspects of CrowdStrike Falcon that I dislike, although I have encountered a couple of minor inconveniences during investigations.

Firstly, the process tree can occasionally take some time to load when reviewing a detection. While this could potentially be attributed to local device performance or network connectivity, it can be slightly frustrating when trying to investigate alerts efficiently.

Another minor inconvenience relates to navigating between multiple Customer IDs (CIDs). When investigating several detections simultaneously across different CIDs, switching the active CID in one browser tab can affect other open Falcon tabs, requiring additional navigation to return to the intended environment. This can occasionally interrupt the investigative workflow, particularly when managing multiple alerts.

However, I appreciate that maintaining a consistent active CID across browser tabs may be an intentional design decision to reduce confusion and ensure analysts are aware of the environment they're working within.

Ultimately, these are relatively minor usability considerations and do not significantly detract from what I consider to be an excellent EDR platform. Review collected by and hosted on G2.com.

Detection quality is what sets it apart. As an MSSP running a SOC across our client base, we need tools we can trust, and Falcon consistently picks up threats other products miss while keeping false positives low. That means my analysts spend their time on real incidents rather than chasing noise.

The single lightweight agent is quick to deploy and users don't notice it's there. When something does happen, the console makes it easy to investigate, see the full picture and isolate a device in seconds, which has made a real difference to our response times. Having threat intelligence built into the detections also saves us jumping between tools to understand what we're dealing with. Review collected by and hosted on G2.com.

Honestly, not much. The names of the products and the licensing can be confusing. Review collected by and hosted on G2.com.

What I like most about CrowdStrike Falcon is its powerful threat detection capabilities combined with a lightweight agent that has minimal impact on endpoint performance. The centralized management console is intuitive and provides excellent visibility across the entire environment. Its real-time monitoring, behavioral analysis, and automated response capabilities make it much easier to identify and respond to potential threats. Overall, it's a reliable and effective solution that simplifies endpoint security management. Review collected by and hosted on G2.com.

One of the main drawbacks of CrowdStrike Falcon is its relatively high pricing, especially when adding advanced features and additional modules. The platform also has a learning curve, as some configurations and investigation workflows can be complex for new users. Additionally, the large number of alerts can sometimes require extra tuning to reduce false positives. However, these are relatively minor drawbacks compared to the overall effectiveness and reliability of the solution. Review collected by and hosted on G2.com.

I work hands-on with Falcon across endpoint protection, host firewall, OpenShift, Azure AKS and image assessment. Its main strengths are threat detection, investigation telemetry and centralised policy management. Custom IOAs, response capabilities and APIs provide useful flexibility. Our security testing has produced actionable detections and helped validate protection policies and incident-response workflows before wider deployment. Review collected by and hosted on G2.com.

My concerns come from practical deployment and troubleshooting across endpoint protection and the additional Falcon firewall and cloud workload modules:

1. Host Firewall visibility: Firewall Activity centres on rule matches and logging settings. Getting a clear picture of endpoint communication required too much configuration and manual investigation. I would like a simpler way to establish a traffic baseline before defining rules, and clearer diagnostics when expected firewall events are missing.

2. Network Location Awareness: We lacked a clear central view of network-location changes and related diagnostics. Troubleshooting depended on local endpoint logs and additional log collection.

3. Kubernetes visibility: Cluster and workload context was inconsistent between Host Management and Cloud Security. Linking a node detection to the relevant cluster and workload required manual correlation.

4. Prevention and exceptions: In our node-sensor deployments, runtime policy and exception scope did not meet namespace-level requirements on shared clusters. Admission-controller controls did not address this runtime requirement.

5. Image assessment: Some alerts lacked the vulnerability details needed for investigation and exclusions. The scope of exceptions across images and environments also needed clearer explanation.

6. Release readiness: Image Analyzer compatibility issues and repository changes complicated deployment planning. Better release validation, compatibility guidance and advance communication would help.

7. Support and delivery: Progress too often required repeated follow-up. I expect clearer technical ownership, concrete next steps and realistic delivery dates. Several improvement requests remained open at our last validation; announced changes still needed verification in our environment.

These gaps add engineering effort and slow troubleshooting. More complete telemetry and stronger follow-through would make a meaningful difference. Review collected by and hosted on G2.com.

We use Falcon daily in our SOC to protect several client environments. The single lightweight agent deploys quickly and has very little impact on endpoints, which makes onboarding new clients straightforward. Detection quality is consistently high, with a good balance between visibility and false positives. Real Time Response and network containment let us act within minutes during incidents. Fusion SOAR has also allowed us to automate recurring tasks, such as reporting and part of the triage workflow. Review collected by and hosted on G2.com.

Licensing is split across many modules, which makes scoping and pricing harder to explain to clients. Some advanced capabilities need time and expertise to configure well, and certain reporting needs still require custom work through the API or Fusion. Review collected by and hosted on G2.com.

The single lightweight agent is the big win. We rolled it out across a large hybrid Windows/Linux fleet with almost no user impact and no reboot headaches. Detection quality is excellent: the process tree and threat graph make investigations fast, and the out-of-the-box detections catch real attacker behavior (hands-on-keyboard activity, credential dumping, LOLBins) with a low false positive rate once tuned. Real Time Response is a lifesaver during incidents, we can isolate a host and pull artifacts in minutes. Being able to add modules like Identity, Data Protection or Next-Gen SIEM on the same agent and console keeps the whole stack consistent. Review collected by and hosted on G2.com.

The licensing model per module can get confusing and expensive, and you sometimes need a call with sales to understand what is included in which bundle. The console has grown a lot with all the new modules, so navigation is less intuitive than it used to be and new analysts need time to find their way. Some advanced features (Fusion SOAR workflows, custom IOAs, NG-SIEM queries) have a real learning curve and the documentation could use more concrete examples. Nothing blocking, but worth knowing before you commit. Review collected by and hosted on G2.com.