In short: CrowdStrike is a cyber security company whose cloud-delivered Falcon platform protects endpoints, identities, data and AI use from one lightweight sensor and one console. Endpoint protection comes in Defend, Advanced Defend and Complete Defend bundles, licensed per endpoint, with add-ons licensed per endpoint, user or gigabyte. Forever Systems supplies CrowdStrike on monthly billing.
What CrowdStrike does
CrowdStrike is a cyber security vendor best known for cloud-native endpoint protection. Its Falcon platform uses a single lightweight sensor on each device, feeding a cloud console where prevention, detection, investigation and response all happen in one place. Because the heavy analysis runs in CrowdStrike's cloud rather than on the device, the sensor is small and needs no signature updates or reboots to stay current.
The platform started with next-generation antivirus (Falcon Prevent) and EDR, and now spans: USB device control and host firewall management, the Adversary OverWatch managed threat hunting service, Falcon Complete managed detection and response, asset discovery and vulnerability management, identity threat detection and response, data loss prevention, mobile threat defence, Falcon Next-Gen SIEM, and Falcon Guardian for securing staff use of AI tools and AI agents.
Most modules use the same sensor and console, so adding one is usually a licence and policy change, not another agent.
The CrowdStrike products we supply
| Product | What it does | Licensed by |
|---|---|---|
| Falcon Defend and Advanced Defend | Next-gen antivirus, device control and firewall management; Advanced Defend adds OverWatch threat hunting and the Data Replicator event feed | Endpoint |
| Falcon Complete Defend | Everything above plus Falcon Discover and Falcon Complete 24/7 managed detection and response | Endpoint |
| Falcon Discover | Inventory of devices, applications and account use, including unmanaged devices | Endpoint |
| Falcon Spotlight | Scanless, sensor-based vulnerability assessment and prioritisation | Endpoint |
| Falcon Identity Threat Protection | Identity threat detection and response for Active Directory and Entra ID | User |
| Falcon Data Protection | Data loss prevention for endpoints and cloud | Endpoint |
| Falcon for Mobile | Threat detection for iOS and Android devices | Mobile device |
| Falcon Next-Gen SIEM | Log management, detection and investigation with a year of retention | Gigabyte of data |
| Falcon Guardian | AI detection and response: shadow AI discovery, AI usage policy and AI agent protection | Endpoint |
Most organisations start with a Defend bundle on every device and add modules as needs grow. Those without an out-of-hours security team often go straight to Complete Defend.
How CrowdStrike is licensed
CrowdStrike licensing is built in layers:
- An endpoint bundle for every protected workstation and server: Falcon Defend, Falcon Advanced Defend or Falcon Complete Defend. These are the bundles CrowdStrike makes available to managed service providers, which is why the names differ from the Falcon Go, Pro and Enterprise bundles on CrowdStrike's own online store
- Endpoint add-ons on top of the bundle: Falcon Discover, Falcon Spotlight, Falcon Data Protection and Falcon Guardian, plus Falcon for Mobile counted per mobile device
- Identity add-ons, counted per user, in a standard and a Complete (managed) version
- SIEM data, counted by the gigabyte, again with a standard and a Complete version
We supply CrowdStrike on monthly billing, so you can adjust device, user and data quantities as staff join and leave or your estate changes. Trials are available on the Defend and Advanced Defend bundles, not on Complete Defend or the add-ons. Pricing depends on bundle, add-ons, quantity and term, so ask us for a quote. For background, see monthly vs annual licences and per-user vs per-device licensing.
Choosing a CrowdStrike bundle
| Falcon Defend | Falcon Advanced Defend | Falcon Complete Defend | |
|---|---|---|---|
| Falcon Prevent next-gen antivirus | Yes | Yes | Yes |
| Falcon Device Control (USB) | Yes | Yes | Yes |
| Falcon Firewall Management | Yes | Yes | Yes |
| OverWatch managed threat hunting | No | Yes | Yes |
| Falcon Data Replicator event feed | No | Yes | Yes |
| Falcon Discover asset inventory | Add-on | Add-on | Yes |
| Falcon Complete 24/7 MDR and remediation | No | No | Yes |
Defend suits organisations that want strong prevention and device control and have an IT team to act on alerts. Advanced Defend adds CrowdStrike's own threat hunters looking for hands-on-keyboard attackers that automated prevention can miss. Complete Defend hands day-to-day detection, investigation and remediation to CrowdStrike's MDR team. Compare approaches in EDR, XDR and MDR.
Who CrowdStrike suits
CrowdStrike fits organisations that want an established cloud endpoint platform without running their own security operations centre:
- businesses replacing traditional antivirus, often prompted by a cyber insurer's questionnaire
- mixed Windows, macOS and Linux estates managed from one cloud console
- organisations with a small IT team that want managed threat hunting or full MDR behind them
- schools, charities and multi-site organisations with laptops often off the corporate network
Good endpoint protection also supports the malware protection control in Cyber Essentials. See other options in endpoint protection.
Buying CrowdStrike through Forever Systems
- Scope: we count the workstations, servers, mobile devices and users you need to cover and check what you run today.
- Recommend: we suggest the right CrowdStrike bundle and only the add-ons you will use, and set out the monthly quantities for each line.
- Deploy: we set up your Falcon console, build prevention policies, roll out the Falcon sensor and remove the product it replaces.
- Look after it: licence changes, renewals and add-ons sit on one Forever Systems account and one invoice, with UK engineers on hand when you need them.
Ask about a trial if you want to see Falcon on a few devices before you commit. See every vendor we supply on our vendors A to Z.
Explore CrowdStrike
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Can I buy CrowdStrike without going direct?
Yes. Forever Systems supplies CrowdStrike Falcon bundles and add-ons on one UK account, with setup, licence changes and renewals handled for you, so you do not need a separate contract with CrowdStrike.
What is the difference between Falcon Defend, Advanced Defend and Complete Defend?
Defend covers next-gen antivirus, USB device control and firewall management. Advanced Defend adds OverWatch managed threat hunting and the Falcon Data Replicator event feed. Complete Defend adds Falcon Discover and Falcon Complete 24/7 managed detection and response with hands-on remediation.
Is CrowdStrike licensed per user or per device?
Endpoint bundles and most add-ons are licensed per endpoint, meaning each workstation or server running the Falcon sensor. Identity Threat Protection is licensed per user and Next-Gen SIEM by the gigabyte of data.
Can I pay for CrowdStrike monthly?
Yes. We supply CrowdStrike bundles and add-ons on monthly billing, so the number of endpoints, users or gigabytes can be adjusted as your organisation changes. We confirm the quantities and any minimums when we quote.
Does CrowdStrike replace Microsoft Defender?
Falcon Prevent takes over the antivirus role on each Windows device: once the sensor is installed and prevention is switched on, Falcon registers with Windows Security as the active antivirus and Microsoft Defender Antivirus steps back. Some organisations keep other Microsoft security tools alongside it. If Microsoft licensing is part of the picture, see our Microsoft licensing team.