In short: CrowdStrike Falcon Complete Defend is an endpoint bundle that adds Falcon Complete Next-Gen MDR to Falcon Prevent, device control, firewall management, Adversary OverWatch threat hunting, the Data Replicator feed and Falcon Discover. CrowdStrike's team monitors, investigates and remediates threats 24/7. It is licensed per endpoint on monthly billing.
What Falcon Complete is
Falcon Complete is CrowdStrike's managed detection and response (MDR) service. Instead of your IT team triaging every alert, CrowdStrike's own analysts watch your Falcon environment around the clock, investigate detections, and take action on the affected devices to contain and remove the threat, for example by stopping malicious processes, quarantining files and removing persistence.
CrowdStrike pairs its analysts with the AI and automation built into the Falcon platform. The service is centred on endpoints, and its visibility extends to identity, cloud and third-party data where you license the matching Falcon modules.
Falcon Complete Defend is the bundle that packages this service with the full set of Falcon endpoint modules, so a single per-endpoint licence covers both the technology and the people running it.
What is included in Complete Defend
| Component | What it does |
|---|---|
| Falcon Prevent | Next-generation antivirus against malware, ransomware and fileless attacks |
| Falcon Device Control | Visibility and control of USB and removable media |
| Falcon Firewall Management | Central host firewall policy |
| Adversary OverWatch | 24/7 managed threat hunting |
| Falcon Data Replicator | Near real-time event data feed |
| Falcon Discover | Inventory of devices, applications and account use |
| Falcon Complete Next-Gen MDR | 24/7 detection, investigation and hands-on remediation by CrowdStrike |
Compared with Falcon Defend and Advanced Defend, the difference is who acts. With Advanced Defend, OverWatch tells you about an intrusion and your team responds. With Complete Defend, CrowdStrike's team responds for you and tells you what they did.
How Falcon Complete Defend is licensed
Complete Defend is licensed per endpoint: one licence for each workstation, laptop or server running the Falcon sensor. It is available on monthly billing. Unlike Defend and Advanced Defend, there is no trial option on this bundle, so we usually suggest trialling Advanced Defend first if you want to see the sensor in action.
Managed identity protection and managed SIEM are licensed separately: see Falcon Identity Threat Protection and Falcon Next-Gen SIEM, both of which have a Complete version for organisations that want CrowdStrike to manage those areas too.
Pricing depends on quantity and term, so ask us for a quote.
Onboarding and requirements
The Falcon sensor runs on Windows, macOS and Linux. Onboarding follows a familiar pattern: we deploy the sensor through your device management or remote monitoring tools, remove the product it replaces, and agree with you how CrowdStrike's team should act, for example whether they may isolate a server from the network without asking first, and who they should contact during an incident.
You stay in control of policy and can see every action the Falcon Complete team takes in the console. It is worth agreeing internal escalation contacts and out-of-hours arrangements before go-live so that response is never held up waiting for approval.
Who Falcon Complete suits
Complete Defend suits organisations that need 24/7 response but do not have, or do not want to build, their own security operations centre:
- small and mid-sized businesses with a lean IT team
- organisations whose cyber insurer or customers expect round-the-clock monitoring and response
- multi-site organisations, schools and charities where incidents often happen outside office hours
We scope your devices, deploy and tune Falcon, handle licence changes and renewals, and stay your UK point of contact alongside CrowdStrike's analysts. Compare other managed services in EDR, XDR and MDR.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does Falcon Complete actually do when it finds a threat?
CrowdStrike's analysts investigate the detection and act on the affected device, for example killing malicious processes, quarantining files, removing persistence and, where agreed, isolating the device from the network, then report what they did. You can see every action in the Falcon console.
Is Falcon Complete the same as Falcon Complete Next-Gen MDR?
Yes. Falcon Complete Next-Gen MDR is the current name for CrowdStrike's Falcon Complete managed detection and response service, which is often shortened to Falcon Complete or Falcon Complete MDR. Complete Defend is the endpoint bundle that includes it.
Can I trial Falcon Complete Defend?
There is no trial on the Complete Defend bundle itself. You can trial Falcon Advanced Defend to see the sensor and OverWatch threat hunting, then move up to Complete Defend.
Does Falcon Complete cover identity and SIEM?
Complete Defend covers endpoints. Managed identity protection and managed SIEM are separate Complete add-ons, licensed per user and per gigabyte respectively.