In short: CrowdStrike Falcon Data Protection is data loss prevention on the Falcon platform. It classifies sensitive data as it is created and used, tracks it across endpoints, browsers, SaaS and cloud, and flags or blocks risky movement such as web uploads, USB copies, printing and uploads to generative AI tools. It is licensed per endpoint.
What Falcon Data Protection is
Falcon Data Protection is CrowdStrike's data loss prevention (DLP) module. Many DLP projects stall on separate agents and long rule-writing exercises. CrowdStrike's approach is to deliver DLP through the same Falcon sensor you already run for endpoint protection, managed from the same console, with no separate agent or appliance.
It discovers and classifies sensitive data as it is created, accessed and used, follows it as it moves, and applies policy at the point of egress: allow, warn the user, or block.
CrowdStrike's website now presents this capability as Falcon Data Security. The add-on we supply is listed as Falcon Data Protection and covers sensitive data at rest and in motion across endpoints and cloud.
What it covers
| Area | What Falcon Data Protection does |
|---|---|
| Classification | AI-assisted classification of sensitive data, reducing manual tagging |
| Web uploads | Detects and blocks uploads of sensitive data to unapproved websites |
| Removable media | Controls copying of sensitive data to USB and other removable storage |
| Printers | Controls printing of sensitive documents |
| SaaS and GenAI | Monitors and controls uploads of sensitive data to SaaS and generative AI tools |
| Cloud | Visibility of sensitive data and data flows in cloud environments |
| Insider risk | Links identity and data activity to flag high-risk users and unusual transfers |
Out-of-the-box configurations for common sensitive data types mean you can start in monitoring mode quickly, see where data is really going, and then decide which flows to block.
How it is licensed
Falcon Data Protection is an add-on licensed per endpoint, on top of any Falcon bundle: Falcon Defend or Advanced Defend, or Falcon Complete Defend. It is billed monthly.
You can license it for every device or only for the teams that handle the most sensitive data, such as finance, HR or legal. Ask us for a quote.
Deployment and requirements
Because it runs on the existing Falcon sensor, deployment is a licence and policy change rather than a software rollout. We start by agreeing which data matters: personal data covered by UK GDPR, payment card data, client files, intellectual property. Then we run in monitor-only mode to see real data flows before introducing warnings and blocks.
Good DLP depends on clear policy, so we involve your data protection lead early and document what each rule is for. Staff also need to understand why a transfer was blocked; pairing DLP with security awareness training makes the warnings far more effective.
Who it suits and how we help
Falcon Data Protection suits organisations that hold personal or commercially sensitive data and already run, or are moving to, CrowdStrike Falcon: professional services firms, healthcare and education providers, and businesses worried about staff pasting confidential data into AI tools.
We license it on your Forever Systems account, design the policies with you, tune them to cut false positives and report on what is being caught. If AI use is the main concern, look at Falcon Guardian too, and compare other approaches in endpoint protection and our software licensing guide.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Falcon Data Protection need a separate agent?
No. It is delivered through the same Falcon sensor used for endpoint protection and managed from the same console.
Can Falcon Data Protection stop data being uploaded to AI tools?
Yes. CrowdStrike lists monitoring and control of sensitive data uploads to generative AI tools as part of the product, alongside web uploads, removable media and printing. Policies can allow, warn or block.
Is Falcon Data Protection the same as Falcon Data Security?
Effectively, yes. CrowdStrike's website now uses Falcon Data Security as the name for its data protection capability across endpoints, browsers, SaaS, GenAI and cloud. The add-on we supply is still listed as Falcon Data Protection.
Do I need to license every device?
No. It is licensed per endpoint, so you can cover every device or only the teams handling the most sensitive data.