endpoint security

CrowdStrike

CrowdStrike Falcon is an endpoint detection and response platform. This profile covers what it does, how it is priced, and where it stops being the right choice.

What the product actually does

Falcon installs a lightweight agent that watches process behaviour, network connections and file activity on endpoints, and streams the telemetry to a cloud backend that runs detection logic across the fleet rather than on each machine.

The single-agent architecture is the differentiator. One sensor covers endpoint protection, threat intelligence, device control and identity protection, which means one deployment and one console rather than four agents from four vendors.

How pricing works once you are inside

Per endpoint, per year, with the modules bundled into tiers. The quoting is negotiated rather than published, and the range between a small deployment and a large one is wide.

The cost driver is the module selection rather than the endpoint count alone. A deployment that adds identity protection and exposure management is priced materially above one that only takes endpoint protection.

Where it breaks down

The cloud dependency is absolute. The agent is a sensor; detection happens in the backend. An organisation with air-gapped or connectivity-constrained environments cannot use the platform as designed.

Tuning is ongoing work. Out-of-the-box detections generate volume, and a security team without capacity to triage will accumulate alerts rather than resolve them.

What switching costs

High. The detection history, the exclusion tuning and the response playbooks are all platform-specific, and the agent has to be replaced on every endpoint.

Sources

CrowdStrike public documentation, read October 2026. Pricing is negotiated; the structure described is from public procurement commentary.