CrowdStrike Falcon

CrowdStrike Falcon is endpoint protection and EDR software for businesses, from next-gen antivirus to managed threat hunting, sold per device in bundles.

CrowdStrike Falcon blocks known and unknown malware on company devices and traces each attack it sees, so a security team can stop it and follow what happened. It replaces signature-based antivirus with prevention that runs without constant signature updates. CrowdStrike, a Nasdaq-listed company, builds and sells it, and every module works through the same Falcon sensor on each device. Coverage spans Windows, macOS and Linux computers as well as Android and iOS phones. In Falcon Prevent, machine learning stops malware before it runs, exploit blocking guards unpatched vulnerabilities, and script control catches malicious Office macros and fileless attacks. Protection holds when a device is offline, the sensor resists attempts to disable it, and each attack is unravelled as one process tree. Falcon Device Control governs USB drives and SD card readers, Falcon for Mobile uncovers malware on phones, and Falcon Firewall Management sets host firewall policies centrally. Falcon Insight XDR adds detection and response, with alerts mapped to MITRE ATT&CK, host isolation, Real Time Response for remote commands and automated remediation. Falcon OverWatch puts CrowdStrike analysts on threat hunting around the clock. Falcon fits organisations replacing legacy antivirus, from small businesses to enterprise security teams that want CrowdStrike's hunters behind their own analysts. Falcon Go, Falcon Pro and Falcon Enterprise each add modules to the one before, and Falcon Complete is the top bundle. The first three are ordered online per device, while Falcon Complete and add-on modules such as Next-Gen Identity Security are arranged with CrowdStrike sales. Managed security providers run their clients through Falcon Flight Control, where each child account keeps its own policies and cannot see the others' data. In a security operations team, Falcon is where an alert gets worked from the first signal to the cleanup. An analyst follows the process tree, isolates the affected laptop, runs a script through Real Time Response and lets automated remediation remove the malware. Partnerships with Okta and Zscaler carry the device posture Falcon assesses into their access checks, so the state of a laptop counts when its user signs in. For an IT team without dedicated security staff, the same console blocks unapproved USB drives and keeps firewall rules consistent on every machine.