CrowdStrike
US-based CrowdStrike sells cloud-delivered EDR on its Falcon platform. Its edge is human threat hunting (OverWatch) and Falcon Complete, where CrowdStrike's own team handles incidents for you. Ready-made bundles, Falcon Go, Falcon Pro and Falcon Enterprise, package the modules by level.
- Headquarters
- United States
- Positioning
- Mid-marketEnterprise
- Official website
- www.crowdstrike.com
Who it suits
Financial institutions and multi-branch companies with nobody watching systems at night that want an outside team handling incidents 24/7.
Overview
Who CrowdStrike is
CrowdStrike is headquartered in Austin, Texas, in the United States. It built cloud-native EDR from the start: each device runs one small sensor, and the analysis and console live on the Falcon platform. There is no management server to install in your own room.
The name became known worldwide on 19 July 2024, when a faulty content update crashed about 8.5 million Windows machines with a blue screen. Since then CrowdStrike has moved to staged rollouts and lets customers choose whether content updates reach them early or later. That event does not make the product bad, but it is a lesson that any kernel-level agent needs a recovery plan.
How the products fit together
- Falcon Prevent: next-generation antivirus (NGAV) that does not rely on signatures alone.
- Falcon Insight XDR: full EDR that records processes and connections for investigation and response.
- Falcon OverWatch: CrowdStrike's own people hunting threats in your environment 24/7.
- Falcon Complete: the MDR service, where CrowdStrike's team does not just alert you but isolates machines and removes the threat.
- Falcon Identity Protection for Active Directory and Entra ID, and Falcon Next-Gen SIEM for log collection.
Ready-made bundles, Falcon Go, Falcon Pro and Falcon Enterprise, package these modules by level. Large organizations can buy Falcon Flex, a single committed budget they spread across whichever modules they need.
Who it suits
CrowdStrike fits best where an organization knows it has nobody watching systems at night and wants an outside team to do it, such as financial institutions and companies with many branches.
Strengths
- Falcon Complete has CrowdStrike's team respond to incidents for you 24/7, something most organizations in Laos cannot build in-house.
- One sensor and a cloud console: no management server to maintain, and laptops outside the office stay protected and keep reporting.
- You can extend from endpoint to identity, cloud and SIEM on the same sensor, without installing extra agents.
- Detailed process recording lets you answer which machine an incident started on, when, and how far it spread.
Things to know before choosing
- Cost per device is far above ordinary antivirus, especially with Falcon Complete. Compare it with staffing your own SOC, not with antivirus.
- The July 2024 incident showed a faulty kernel-level agent can take every machine down at once. Set a staged update policy, keep BitLocker recovery keys somewhere reachable, and have a recovery plan.
- Everything lives in CrowdStrike's cloud. Organizations that require an on-site console and data will not be able to use it.
- There are many module and bundle names. Make the quotation state whether Insight XDR, OverWatch or Complete are included, because that is the real difference between levels.
Using it in Laos
In Laos, CrowdStrike shows up mainly in financial institutions and multinationals whose head office chose it. Licences are bought through Thai distributors; there is no hardware and no spare parts.
What to prepare:
- Internet: the sensor protects offline, but analysis and response by CrowdStrike's team need connectivity. Branches on a single line should have a backup link such as 4G.
- Recovery plan: keep BitLocker recovery keys off the machines, and have a technician who can reach provincial branches if PCs ever need fixing by hand.
- Language and hours: the Falcon Complete team works in English. Decide clearly who in Laos answers the phone at night and has authority to approve isolating a server.
Few engineers in Laos have used Falcon, but the console is easy to read and most of the heavy work is done by CrowdStrike's team.
Compared with alternatives
Trend Micro fits better when you have many old servers and need virtual patching. Sophos offers a similar MDR service that works with its own firewalls, usually at a lower budget. If you already have Microsoft 365 E5 or Business Premium, Microsoft Defender may be enough, especially if someone in-house watches the alerts.
Product lines
- Falcon Prevent
- Falcon Insight XDR
- Falcon Complete
- Falcon OverWatch
- Falcon Identity Protection
- Falcon Next-Gen SIEM
Solutions that use this brand
FAQ
After the 2024 outage, is CrowdStrike safe to use?
The cause was a faulty content file, not an attack, and the company has since moved to staged rollouts with customer control over update timing. What you should do is put a test group on early updates and keep a recovery plan. That advice applies to every EDR brand.
Is CrowdStrike worth it for a 100-PC organization?
It depends on who will watch the alerts. If nobody in IT is watching and your data is valuable, a bundle with Falcon Complete is better value than hiring staff. If you only need good antivirus, there are much cheaper options.
Do we remove the old antivirus before installing Falcon?
Normally yes. Two agents scanning at once slow PCs down or conflict. Our approach is to install Falcon in detect-only mode first, review the results, then remove the old antivirus and switch on full prevention.
All brand names and trademarks belong to their respective owners. Mention does not imply official partnership unless explicitly stated. Products are sourced through legitimate distribution channels.
Send us a floor plan or a few photos of the site
We’ll come back with a few questions, then a first design. The first consultation is free, in Lao, Thai or English, on WhatsApp or our Facebook page.