Crowdstrike is hot fucking garbage, and it's purchased by pointy-haired managers that don't pay attention to the disconnect between the marketing and real-world. The UI blows, management of it is a nightmare compared to the other industry leaders- but it does have lots of pretty charts an a nifty-looking threat-hunting interface that gets annoying after 5 minutes trying to get any practical work done.

In the real world, they have nearly the same efficacy as (free) Microsoft Defender (!) but with more false positives, must always be connected to the Internet (even to install it, which is something you totally want to do on a compromised machine), and 99% of its findings are done by people running manual tools on customer submissions (if you pay extra for Falcon Overwatch, Complete or the new Falcon Recon package).

They like to act like they're great by putting out a lot of press about a threat "discovered by crowdstrike first!" and attributing it to a specific hacker group or country based on network info. In reality, they're third or fourth to the party, but good cybersecurity researchers do responsible disclosure to the affected parties, and almost never do attribution, unless it's by behavior- not by IP address.

Crowdstrike is hot fucking garbage, and it's purchased by pointy-haired managers that don't pay attention to the disconnect between the marketing and real-world. The UI blows, management of it is a nightmare compared to the other industry leaders- but it does have lots of pretty charts an a nifty-looking threat-hunting interface that gets annoying after 5 minutes trying to get any practical work done.

In the real world, they have nearly the same efficacy as (free) Microsoft Defender (!) but with more false positives, must always be connected to the Internet (even to install it, which is something you totally want to do on a compromised machine), and 99% of its findings are done by people running manual tools on customer submissions (if you pay extra for Falcon Complete or the new Falcon Recon package).

They like to act like they're great by putting out a lot of press about a threat "discovered by crowdstrike first!" and attributing it to a specific hacker group or country based on network info. In reality, they're third or fourth to the party, but good cybersecurity researchers do responsible disclosure to the affected parties, and almost never do attribution, unless it's by behavior- not by IP address.