Sold by
CrowdStrike Falcon Platform
The AI-native CrowdStrike Falcon Platform provides comprehensive protection across all areas of enterprise risk - devices, identities, data, endpoints and cloud. Powered by a single agent, crowdsourced data, expert threat intelligence, and advanced AI, the Falcon Platform simplifies security operations and stops breaches.
Reviews (792)
Katie J.
Falcon: An Intuitive and Comprehensive EDR Solution which provides excellent Endpoint Visibility
Reviewed on Nov 04, 2026
Review provided by G2
What do you like best about the product?
One of my favourite aspects of CrowdStrike Falcon is how intuitive and comprehensive the platform is from an investigative perspective. It provides analysts a centralised environment to review detections, identify potentially associated campaigns, and investigate suspicious activity without constantly switching between different tools.
I also really appreciate the ability to pivot between investigative features, examine detailed process trees, understand parent-child process relationships, and identify other potentially affected hosts. This makes it significantly easier to establish the context surrounding a detection and assess the potential scope of an incident.
Another major strength is the depth of telemetry available. From file hashes and IP addresses to command-line activity, process execution details, and the specific indicators responsible for triggering a detection, Falcon provides a wealth of information to support accurate triage and investigation.
Overall, I find CrowdStrike Falcon to be an extremely effective, all-in-one EDR solution that streamlines investigations, reduces the time spent gathering evidence, and enables analysts to make informed decisions regarding potential threats.
I also really appreciate the ability to pivot between investigative features, examine detailed process trees, understand parent-child process relationships, and identify other potentially affected hosts. This makes it significantly easier to establish the context surrounding a detection and assess the potential scope of an incident.
Another major strength is the depth of telemetry available. From file hashes and IP addresses to command-line activity, process execution details, and the specific indicators responsible for triggering a detection, Falcon provides a wealth of information to support accurate triage and investigation.
Overall, I find CrowdStrike Falcon to be an extremely effective, all-in-one EDR solution that streamlines investigations, reduces the time spent gathering evidence, and enables analysts to make informed decisions regarding potential threats.
What do you dislike about the product?
There are very few aspects of CrowdStrike Falcon that I dislike, although I have encountered a couple of minor inconveniences during investigations.
Firstly, the process tree can occasionally take some time to load when reviewing a detection. While this could potentially be attributed to local device performance or network connectivity, it can be slightly frustrating when trying to investigate alerts efficiently.
Another minor inconvenience relates to navigating between multiple Customer IDs (CIDs). When investigating several detections simultaneously across different CIDs, switching the active CID in one browser tab can affect other open Falcon tabs, requiring additional navigation to return to the intended environment. This can occasionally interrupt the investigative workflow, particularly when managing multiple alerts.
However, I appreciate that maintaining a consistent active CID across browser tabs may be an intentional design decision to reduce confusion and ensure analysts are aware of the environment they're working within.
Ultimately, these are relatively minor usability considerations and do not significantly detract from what I consider to be an excellent EDR platform.
Firstly, the process tree can occasionally take some time to load when reviewing a detection. While this could potentially be attributed to local device performance or network connectivity, it can be slightly frustrating when trying to investigate alerts efficiently.
Another minor inconvenience relates to navigating between multiple Customer IDs (CIDs). When investigating several detections simultaneously across different CIDs, switching the active CID in one browser tab can affect other open Falcon tabs, requiring additional navigation to return to the intended environment. This can occasionally interrupt the investigative workflow, particularly when managing multiple alerts.
However, I appreciate that maintaining a consistent active CID across browser tabs may be an intentional design decision to reduce confusion and ensure analysts are aware of the environment they're working within.
Ultimately, these are relatively minor usability considerations and do not significantly detract from what I consider to be an excellent EDR platform.
What problems is the product solving and how is that benefiting you?
I primarily use CrowdStrike Falcon for endpoint detection and response, particularly for identifying, investigating, and responding to potentially malicious activity across our environment.
The Falcon sensors deployed across endpoints provide excellent visibility into running processes, their associated behaviours, and any suspicious activity that may indicate a potential security threat.
This level of visibility allows me to review detections, analyse process execution and relationships, identify potentially malicious indicators, and determine whether an alert represents a genuine threat or a false positive.
Overall, CrowdStrike's detection capabilities and comprehensive endpoint telemetry are invaluable for maintaining visibility across the environment and supporting effective security monitoring and incident response.
The Falcon sensors deployed across endpoints provide excellent visibility into running processes, their associated behaviours, and any suspicious activity that may indicate a potential security threat.
This level of visibility allows me to review detections, analyse process execution and relationships, identify potentially malicious indicators, and determine whether an alert represents a genuine threat or a false positive.
Overall, CrowdStrike's detection capabilities and comprehensive endpoint telemetry are invaluable for maintaining visibility across the environment and supporting effective security monitoring and incident response.
Computer & Network Security
Get Maximum Protection
Reviewed on Nov 04, 2026
Review provided by G2
What do you like best about the product?
CrowdStrike is one of the best platforms I ever had for endpoint security. Easy to use, maximum protection and quick reaction.
What do you dislike about the product?
I have not experienced any issue so far for us.
What problems is the product solving and how is that benefiting you?
It has been protecting the endpoints and the infrastructure.
Mhaydari Unknown
Centralized endpoint visibility has strengthened threat detection and accelerated incident response
Reviewed on Nov 04, 2026
Review from a verified AWS customer
What is our primary use case?
My main use case for CrowdStrike Falcon is endpoint detection. I want to ensure that all of our endpoints are protected and detect any malicious activity or any unauthorized activity on our endpoints for endpoint detection in my day-to-day work.
We have recently started using Identity Protection next to CrowdStrike Falcon EDR, We also use the next-gen SIEM a little bit, primarily during incidents to look for evidence on CrowdStrike.
We are not using AI much within CrowdStrike Falcon, apart from a little bit of Charlotte, but I am planning to explore that avenue further.
My use of CrowdStrike Falcon has expanded since the initial deployment with additions such as Identity Protection and firewalls.
How has it helped my organization?
Since implementing CrowdStrike Falcon, we do feel safer, as we detect unauthorized activities and can react quickly.
Although I do not have the numbers, I can say that when we have an incident, we see the processes, the graph, the timelines, and the adversary's actions, allowing us to make quick decisions and contain the device then and there.
Using CrowdStrike Falcon made our life much easier because we now have one place for the endpoints where we can go and find all the answers that we need.
We had an incident involving aphishing ; we looked at the files and discovered it was a Microsoft OneDrive link and users download the malicious file and executing a script. CrowdStrike Falcon not only prevented it but also helped us trace it back to that link, enabling us to understand where it came from, stopping access at that level, and preventing the script from running saved us massively.
We are a very small team, and CrowdStrike Falcon is a real help, with automation being a key factor that helps us leverage our limited resources to take more action despite having fewer people.
What is most valuable?
CrowdStrike Falcon offers very good protection, and I will see all the information in one place, which is quite handy and reliable.
When I say all the information is in one place, it helps us in practice because we see all the processes and activities on the endpoints related to an event or incident, and we can pivot to see more data by going deep into the data available and exported from the endpoint.
The detection capabilities are really good, as it understands the behavior of Windows machines, although it is not as great on Mac OS and Linux.
I really appreciate the identity part, which fits nicely with our endpoint detection using CrowdStrike Falcon EDR, and I see some benefits already from deploying it recently, allowing me to trace back from one identity to one endpoint and back again.
What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that it understands detection and response exceptionally well, proven by its good telemetry collection and actionable insights, so I do not have to worry about creating detection rules, with fewer false positives than other platforms.
What needs improvement?
I think CrowdStrike Falcon UI is a little bit slow to react and they keep moving the options and modules. we have to jump from one module to another this is a real painn requiring multiple tabs open for investigations. It would be easier if it consolidated the information on one page instead of opening new tabs in the browser.
Session timeout bothers us because investigations sometimes take time, and when we jump to another platform to continue, our session expires and all of tabs are time out. If I have not tagged or saved them, I have to redo that work, which occurs quite often.
So far, I have mix feeling about Charlotte AI, sometimes makes mistakes and misses context, however it never forget to consume tokens, which affects its reliability.
CrowdStrike has expanded far beyond what we were used to in traditional securitydetection and response now it needs to be more easily accessible, and we should not have to jump into so many modules and hopes to complete an investigation
CrowdStrike Falcon itself does not pose a problem regarding endpoint performance; it reliable and doesn't spike the device performance. However, the device control related to USB blocking is a significant challenge for us, it defiantly requiring improvement, as it mistakenly disables usb cameras and is difficult to track in logs. CrowdStrike claims it has not blocked anything, yet the USB and camera non-functionality persists until removal of CrowdStrike.
For how long have I used the solution?
I have used CrowdStrike Falcon since three years ago in my recent job, although I have used CrowdStrike Falcon well from my previous roles since 2018.
What do I think about the stability of the solution?
CrowdStrike Falcon is stable in my experience, with only one significant glitch and the persistent USB issue, but otherwise it works well.
What do I think about the scalability of the solution?
CrowdStrike Falcon's scalability allows for easy scaling without issues.
How are customer service and support?
Customer support with CrowdStrike is very poor; they often respond with scripted answers, as it has become an AI chat support system made it even worse. Overall, it does not provide a great experience, especially with sales and support staff not being attentive,
When you have issue take time to explain it to them and then they say ohh it's over 7 days we don't have logs. That usb issues, every time they ask for logs but nothing comes out of it. I have stopped raising issues it to them unless if we are really need them
Which solution did I use previously and why did I switch?
We previously used another ePO EDR, ; it was challenging with detections and due to false positives. managing exclusions was time-consuming This inefficiency is why we made the switch.
How was the initial setup?
CrowdStrike Falcon is deployed in our organization on a public cloud, where we have our own tenants.
What about the implementation team?
No you can do it yourself, but spend time configuring all policies, integration and automation before leave it to run on it own
What was our ROI?
Although I cannot provide solid metrics on return on investment, I can say that I have a small team and definitely need CrowdStrike Falcon, so I cannot get away from it.
What's my experience with pricing, setup cost, and licensing?
We have an enterprise contract, as the parent company purchased CrowdStrike.
It is really good to have multiple capabilities on a single platform, but when they are fragmented into different modules and sold at a very expensive rate, people end up having one or two modules and miss out on the holistic approach that CrowdStrike Falcon offers. I think an endpoint should be an endpoint, regardless of being in the cloud or on-prem, Crowdstrike consider a container a different cost, so is the cloud, and endpoints, and mobile; this approach makes it difficult as we have to pick and choose. That's not included other modules,
I believe those that are related to security operation and detection and reaponse all should be part of same package, although I understand some modules such as AI, cloud config posture, and vulnerability can be different
Licensing is a real challenge with CrowdStrike Falcon, as it is the main reason that makes us reconsider moving further with it new capabilities.
Which other solutions did I evaluate?
Defender was another option we considered. We found Crowdstrike was much easier to work with and navigate and information were presented much clearer.
What other advice do I have?
I rate it an eight because, it's a very high and respectable number, in terms of technology, CrowdStrike Falcon focus primarily at endpoints, believing everything evolves from there. However, we do have network activities that CrowdStrike Falcon does not account for, which makes it a bit difficult to rate it a ten; it is not all-encompassing, but it is really good.
The AI capabilities of CrowdStrike Falcon are new, so I need to use this to get more insight. From what I have seen, it is interesting, but I will see how it evolves.
I have not consolidated or replaced other security tools with CrowdStrike Falcon, as not much has been done in that area.
My advice for others looking into using CrowdStrike Falcon is to invest time and money to customise the platform so that it can work cohesively across different modules, ensuring it is not just a single alerting tool but rather an integrated system that correlates data and reaponse across the enterprise.
Nikhilkumar M
Unified visibility has transformed threat detection and response efficiency for our analysts
Reviewed on Nov 04, 2026
Review from a verified AWS customer
What is our primary use case?
My main use case for CrowdStrike Falcon is endpoint detection, including endpoint telemetry, network detection, and cloud security.
In my day-to-day activities, CrowdStrike Falcon helps me detect any endpoint-related threats, such as suspicious execution, network data exfiltration, and lateral movements. As a SOC analyst, I investigate these detection types and alerts to remediate, triage, and investigate them.
How has it helped my organization?
Since we moved to CrowdStrike Falcon, we have been able to make a significant reduction in false positives and tune our true positive detection, and our response time has increased substantially. This has been a really great impact on our work and we have been able to make good progress. From an analyst's perspective, it has had a positive impact on our team.
The response time has been excellent. Previously, we used to have a high increased number of mean time to detect. However, since we moved to CrowdStrike Falcon, the mean time to detect has been significantly reduced, which is a great improvement. Our response time has increased due to the AI workflow included and the investigation process has become much easier with simpler querying. Overall, the impact is really great.
Since we moved to CrowdStrike Falcon, the response time and the way we investigate and triage has significantly changed for the better. I believe this is one of the best ways a team can improve their detection and response time when it comes to threat detection.
For example, consider someone trying to execute a PowerShell script connecting to a malicious website. Even though it is an internal user, they are trying to execute a command that is from the internet or from a Reddit or GitHub portal, which may not always be legitimate. CrowdStrike Falcon detects these executions, reads the command line, identifies the domain and IOCs, and has made a significant impact by preventing the execution before something harmful happens.
Having one visibility into SIEM, cloud, and endpoint really makes it more convenient. We do not want to be navigating into multiple platforms. Having everything in one place has been excellent. An expert at all of this could really improve significant time and response time, so I would say this has been great for our work.
It has significantly reduced the workload due to the visibility we have. I would say that CrowdStrike Falcon is a great tool for us to save time and be productive.
Improving our response capabilities and being good at detection has had a big impact on the company. Trying to save us from attacks and being one step ahead of all these threat actors is a great impact on our organization.
We have been using different applications for different purposes, but CrowdStrike Falcon has helped us to be so accurate at endpoint detection and cloud security, which is really great.
What is most valuable?
The best features CrowdStrike Falcon offers, in my opinion, are the visibility into everything that is happening. The process tree is really great and provides complete visibility into the process executions. The query language is pretty useful and efficient because it resembles SQL and is convenient for beginners. The querying is not challenging and I appreciate how user-friendly it is, as it gives complete visibility of a detection and the next actions that should be taken.
Although I am not an expert at SQL, the query language that CrowdStrike Falcon uses, I use AI to make my own queries with whatever knowledge I have. I use the event names and the detection logic use cases that I need for my investigation and make sure that it suits my needs before applying it into my investigations. This approach is actually helping me triage and investigate faster than before.
Something that stands out is the clear picture of an incident or an alert, which includes host details, asset details, user information, command lines, and process trees. This is something I think lacks in other endpoint applications, but CrowdStrike Falcon stands out on all of these aspects.
We are still in the era of improving AI, so I would say the AI capabilities are good, though I would not say they are 100% accurate. The summaries and recommended next steps actually help a lot for an analyst. It is like AI agent workflows plus SOC, and it is really great.
The scale at which CrowdStrike Falcon can ingest data and integrate with other systems is highly commendable. However, I would also highlight visibility and convenience over other applications, and it is more efficient.
What needs improvement?
CrowdStrike Falcon could be made a little more user-friendly. Someone who is trying to explore CrowdStrike Falcon for the first time might feel overwhelmed because of the multiple features. Although it is a good thing, it is not really convenient or efficient for a beginner. Otherwise, I think it has everything that it needs, including AI, agentic workflows, Guardian in place, and automatic actions.
For how long have I used the solution?
We have been using CrowdStrike Falcon for almost eight months now and we just started transitioning from Carbon Black to CrowdStrike Falcon.
What do I think about the stability of the solution?
I have experienced stability issues.
What do I think about the scalability of the solution?
The scalability is pretty good. Considering its unique features, it is pretty good.
How are customer service and support?
The customer service has been excellent. We have a dedicated customer relationship with the CrowdStrike team, which is one of the excellent features that we see. I would rate the customer service 10 out of 10.
Which solution did I use previously and why did I switch?
We were previously using Carbon Black, and we switched from Carbon Black to CrowdStrike Falcon due to its heavy noise and lack of AI workflows. We moved to CrowdStrike Falcon to address these issues.
What was our ROI?
There is absolutely a return on investment. There is time saving and efficiency improvement as a team, and as a SOC team, it is a great return on investment.
What other advice do I have?
I would rate CrowdStrike Falcon 10 out of 10 because of its convenience and the complete visibility into endpoints.
The visibility and the convenience of getting used to the endpoint logs stand out to me. The navigation is much easier and the UI is user-friendly. It may be a little complicated for a beginner, but as an analyst, I have been getting used to it. This is why it stands out to me compared to other endpoint platforms.
I would definitely recommend that organizations go ahead with CrowdStrike Falcon. It is an excellent platform to explore.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Julian Perez
Unified endpoint visibility has transformed how our team detects, investigates, and responds
Reviewed on Nov 04, 2026
Review from a verified AWS customer
What is our primary use case?
CrowdStrike Falcon serves as our primary endpoint detection and response solution. We needed this module the most since we were not satisfied with our previous EDR.
We primarily needed an EDR for security, so we have a sensor installed on all of our endpoints. The deployment of it was fairly easy compared to the previous EDR. The advantage of CrowdStrike Falcon lies in the UI and overall management, which allows us to utilize it effectively to detect detections, contain if required, and automate processes easily.
Overall, we are satisfied with our main use case of using CrowdStrike Falcon day-to-day, particularly for endpoint detection and cases. The UI is quite easy to use, and all the information and detections shown on a daily basis remain the main focus. The detections themselves are well executed, and we manage all different detections that CrowdStrike Falcon identifies which is excellent due to its extensive telemetry. Additionally, the threat hunting queries are well set up to detect almost everything, and investigation capabilities within the logs to find potential attack events are outstanding.
Currently, we are not using AI within CrowdStrike Falcon, but we aim to incorporate it in the future.
How has it helped my organization?
CrowdStrike Falcon has positively impacted our organization by addressing our dissatisfaction with the previous EDR, which limited us and caused daily issues. With CrowdStrike Falcon, we do not feel constrained, and although we might not utilize it to its full potential, that relates more to our technical limitations than to the tool itself. Overall, the experience has been positive.
CrowdStrike Falcon has improved our team and organization's performance by providing better visibility of endpoints through its detection capabilities, automating workflows, and allowing for correlation and investigation through various modules.
Using CrowdStrike Falcon has changed the way our security team detects, investigates, and responds to threats by consolidating everything into one tool, enhancing detection accuracy through extensive telemetry, while the flexibility has made investigations easier and deeper. The SOAR aspects with workflows and playbooks have accelerated our response processes.
Although I cannot recall a specific incident, there have been numerous occasions in our SOC where vague telemetry has been clarified through the CrowdStrike Falcon sensor, allowing us to delve deeper and address threats more effectively than we could without it.
Having multiple security capabilities on a single platform like CrowdStrike Falcon simplifies learning, as we only have to master one UI, facilitating transitions between modules. The combined console allows for queries across the same platform, which streamlines work.
Having endpoint identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform results in easier management and less hassle.
Since the tool is highly effective and the service has been excellent, it has sped up our productivity, allowing us to accomplish more with less.
What is most valuable?
Some of the best features that CrowdStrike Falcon offers include the agents, Charlotte, and the advanced hunting feature for comprehensive investigations.
The advanced hunting feature for investigations helps my team by providing a lot of details and information available in the detections. In my case, we benefit the most through the additional detections from our other SIEM, which allows us to have a complete image and conduct investigations on incidents more easily. The ability to build queries or dashboards to gain visibility into additional cases enhances our investigation capabilities significantly.
Regarding the accuracy and reliability of output from CrowdStrike Falcon's AI capabilities, my usage of Charlotte is limited to detections and the summaries or guidance provided, which have been positive and made interactions easier.
What differentiates CrowdStrike Falcon from other cybersecurity platforms I have evaluated are its many modules, the effectiveness of the sensor, the ease of management, superior performance, and versatility without limitations.
What needs improvement?
The initial challenge was getting used to the UI, which can feel overwhelming with many windows, especially when contracting more than one module at the same time. While CrowdStrike University helps ease this process, I have heard that plans are in place to improve the UI, which would enhance the overall experience. Navigating through the UIs can make one feel as though they might miss useful features.
For how long have I used the solution?
I have been using CrowdStrike Falcon for about one year and a half.
What do I think about the stability of the solution?
CrowdStrike Falcon is stable.
What do I think about the scalability of the solution?
The scalability of CrowdStrike Falcon is high.
How are customer service and support?
CrowdStrike Falcon's customer support has been positive, with excellent service provided and the contact managers helping maintain a good relationship with CrowdStrike Falcon.
I would rate the customer support an eight, as we initially experienced dissatisfaction with one representative, but after switching, we received good service.
Which solution did I use previously and why did I switch?
CrowdStrike Falcon has allowed us to consolidate and replace other security tools, particularly the EDR Cybereason, which we switched from due to dissatisfaction, and the additional modules provided have enabled us to incorporate tools that we previously did not consider.
In the past, I used Cybereason at the two companies I worked for before, but the experience was not good, and we felt limited in what it offered.
How was the initial setup?
While I am primarily a cybersecurity analyst and was not directly involved in the deployment, I do know that the CrowdStrike Falcon sensor deployment was straightforward and did not pose significant issues post-initial deployment.
Which other solutions did I evaluate?
Before choosing CrowdStrike Falcon, I evaluated Palo Alto, although I was not part of the selection team.
What other advice do I have?
Given my successful experience with CrowdStrike Falcon, I would rate it a 10.
I usually do not give 10s, but the overall positive experience across all aspects stands out. We have not faced any disappointments, and after discussions with various team members, we all express the same surprise and satisfaction with the quality of service.
I contacted CrowdStrike directly to acquire CrowdStrike Falcon.
Since the initial deployment of CrowdStrike Falcon, my use has expanded significantly through CrowdStrike University videos and courses, leading to increased comfort and proficiency with the platform.
My advice for others considering CrowdStrike Falcon is to thoroughly review all documentation and offerings to ensure they align with their needs, as I believe it is a tool that will satisfy most users.
Which deployment model are you using for this solution?
Private Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
reviewer2921985
Platform has improved endpoint detection accuracy and simplifies deep-dive threat investigations
Reviewed on Nov 04, 2026
Review provided by PeerSpot
What is our primary use case?
My main use case for CrowdStrike Falcon is for endpoint detection and EDR.
A quick specific example of how I use CrowdStrike Falcon for endpoint detection is that data from Falcon comes to SecOps as an alert, and then I go back to CrowdStrike to search for whatever detection it has made, and I use containment or remediation methods or conduct further deep dive searches.
How has it helped my organization?
CrowdStrike Falcon has positively impacted my organization by helping me achieve more true positive detections, reducing false positives, and making it much easier and quicker to take containment and remediation steps.
I would say false positives have reduced by about 30%, and my team is able to respond much quicker now.
Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by making navigation easier and helping me reduce true positives and the number of alerts.
CrowdStrike Falcon has reduced the workload of my security team overall, although some deployments are still ongoing.
What is most valuable?
The best features that CrowdStrike Falcon offers include the search feature, which is really nice, and the global search, where I can search anything, along with the advanced hunting feature that allows me to deep dive into anything at all.
When I mention the global search and advanced hunting features, they help me in my work because, for example, when I get an IP and have no idea which host that IP belongs to, I go to the global search, find the IP, and from there I can navigate to either host management, IP management, or further.
Regarding the advanced hunting feature, it also allows me to deep dive into searches even if I am not sure what I am looking for, which means I do not have to scroll through a lot of dashboards; I can get everything summarized.
I think CrowdStrike Falcon's accuracy and reliability of output are really good, as I have been getting the data and output I need.
Having multiple security capabilities on a single platform becomes much easier to navigate through, allowing me to correlate data and deploy it easily within the environment.
CrowdStrike Falcon differentiates itself from other cybersecurity platforms I have used because there is so much data consolidated into one tool, along with various features and additional tools I can integrate.
What needs improvement?
CrowdStrike Falcon can be improved as I have the Agent DKAI, the new feature that I would like to explore more; however, sometimes there is so much data that it becomes difficult to navigate through it and find the exact information I am looking for.
For how long have I used the solution?
I have been using CrowdStrike Falcon for almost six months.
What do I think about the stability of the solution?
CrowdStrike Falcon is stable.
How are customer service and support?
Customer support for CrowdStrike Falcon is good; they are very handy, help me expand, and are always available whenever help is needed.
I would rate customer support an eight on a scale of one to ten.
Which solution did I use previously and why did I switch?
I replaced Carbon Black with CrowdStrike Falcon for EDR, which has helped me reduce false positive rates and other issues.
I used to use Carbon Black, but the switch was management's decision.
What was our ROI?
I would definitely say I have saved time since my group consists of only four people.
What other advice do I have?
I rate CrowdStrike Falcon an eight out of ten.
I chose eight out of ten because there are still a few things that can be improved.
My recommendation to others reading reviews on PeerSpot is to explore more than just EDR; they can also look into the Agent DKAI, the new tool, and the Guardian feature as well.
Information Technology and Services
Performant EDR
Reviewed on Nov 04, 2026
Review provided by G2
What do you like best about the product?
The UI, graphs, especially Process Explorer. The integration with other CrowdStrike products.
What do you dislike about the product?
The exclusion mechanism which doesn’t allow refined tailoring for specific needs.
What problems is the product solving and how is that benefiting you?
Managing endpoint security over 100k+ endpoints.
Antonio Cesar C.
One Sensor Delivers a Powerful, Consolidated Overview
Reviewed on Nov 04, 2026
Review provided by G2
What do you like best about the product?
Just one sensor can enable all features of the consolidated overview
What do you dislike about the product?
No possibility of local deployment, just cloud
What problems is the product solving and how is that benefiting you?
Better visibility and protection
Logistics and Supply Chain
Strong detection confidence
Reviewed on Nov 04, 2026
Review provided by G2
What do you like best about the product?
Combination of high safety efficiency and minimum load on the system
What do you dislike about the product?
Licensing fees are high compared to competitors. Many core features or add-ons require separate module pricing, meaning costs scale up quickly as you expand.
What problems is the product solving and how is that benefiting you?
It solves alert fatigue and slow response times. A lightweight sensor that deploys quickly without impacting system performance or user productivity.
Cristian M.
Easy to deploy, easy to manage, it just works
Reviewed on Nov 04, 2026
Review provided by G2
What do you like best about the product?
Constant improvement of the platform and expanded capabilities that are added very frequently
What do you dislike about the product?
Sometimes the UI could load better or be more user friendly
What problems is the product solving and how is that benefiting you?
Keeping our assets secure