We are already using multiple modules of Crowdstrike Falcon. Have you used CS Falcon for IT in production and, if yes, what are your experiences?

Threat & Vulnerability ManagementVendor/Product Assessment
291 viewscircle icon2 Comments
Sort by:
Associate Director, Information Security Managementa year ago

Yes, we are and have been for some time. On servers it’s a lightweight deployment:

Fast and easy
In almost all cases, no reboot required
Low resource consumption on the local OS
Low Network usage

We also find it’s quite effective at the behavioural side of blocking attackers when they get hands-on-keyboards (vs. scripted/automated) attacks. It’s an effective heterogeneous solution applying and performing quite well across Linux, Windows and macOS. Not all EDR/XDR tools are effective heterogeneous solutions.

Director of Information Security in Healthcare and Biotecha year ago

Overall, we've had a great experience. It works well across platforms (Windows, Mac, Linux). The GUI can be a little cumbersome to navigate as not all the web pages are consistently laid out and they are constantly adding and renaming things so you have to keep up with it. Easy to deploy. Some extra steps to uninstall an agent on a device that stopped report in. And still supports some legacy OSes, albeit with a limited feature set.

Content you might like

What percentage of your IT budget currently goes to cloud services? According to Gartner, the proportion of IT spending that is shifting to cloud will accelerate in the aftermath of the COVID-19 crisis, with cloud projected to make up 14.2% of the total global enterprise IT spending market in 2024, up from 9.1% in 2020.

0-5%7%

5-10%30%

10-15%27%

15-20%16%

20-25%9%

25-30%2%

Above 30%6%

View Results

How do you manage risk with contractors in your supply chain?

Keep hard copies and file paperwork13%

Update spreadsheets to create reports44%

Use a digital supply chain management solution27%

Partner with a third-party vendor11%

Other (comment below)3%

View Results

What sorts of failsafe processes/controls, etc, do you rely on to make sure terminated or suspended employees’ access credentials are revoked immediately? Does your org generally rely on direct communications from HR or do you have an HRM or similar system to automate this?

Excluding CVE, what other vulnerability databases/info sources do you use currently? Have you developed any contingency plans to lean on in case the CVE program loses funding?

What are you working on to improve your threat hunting program (whether near- or long-term)?