In short: CrowdStrike Falcon Defend is an endpoint protection bundle combining Falcon Prevent next-gen antivirus, Falcon Device Control for USB and Falcon Firewall Management in one sensor. Falcon Advanced Defend adds Adversary OverWatch managed threat hunting and the Falcon Data Replicator event feed. Both are licensed per endpoint on monthly billing, with trials available.
What Falcon Defend is
Falcon Defend is CrowdStrike's core endpoint protection bundle for organisations buying through a managed service provider. It puts three Falcon modules on one lightweight sensor, all managed from the cloud-based Falcon console:
- Falcon Prevent, CrowdStrike's next-generation antivirus, which uses machine learning and indicators of attack to stop malware, ransomware, malicious scripts and fileless techniques, rather than relying only on known file signatures
- Falcon Device Control, which gives visibility of and control over USB storage and other removable media, so you can allow approved devices, make others read-only or block them
- Falcon Firewall Management, which lets you create and enforce host firewall policies centrally across Windows, macOS and Linux devices from the same console
Behind them sits CrowdStrike's Threat Graph, the cloud analytics service that correlates event data from Falcon sensors with threat intelligence to spot and block attack behaviour. The sensor needs no reboot to install and no signature downloads to stay current.
Defend and Advanced Defend compared
| Capability | Falcon Defend | Falcon Advanced Defend |
|---|---|---|
| Falcon Prevent next-gen antivirus | Yes | Yes |
| Falcon Device Control | Yes | Yes |
| Falcon Firewall Management | Yes | Yes |
| Threat Graph cloud analytics | Yes | Yes |
| Adversary OverWatch managed threat hunting, 24/7 | No | Yes |
| Falcon Data Replicator near real-time event feed | No | Yes |
| Trial available | Yes | Yes |
Adversary OverWatch is CrowdStrike's own team of threat hunters, working around the clock to look for hands-on-keyboard intrusions and attacker tradecraft that automated prevention can miss, and alerting you when they find something. Falcon Data Replicator streams raw event data from your sensors in near real time so you can keep it in your own storage or feed it into another analytics tool.
If you want CrowdStrike to investigate and remediate incidents for you, not just alert you, look at Falcon Complete Defend.
How Falcon Defend is licensed
Both bundles are licensed per endpoint: each workstation, laptop or server running the Falcon sensor needs one licence. Add-ons such as Falcon Discover, Falcon Spotlight and Falcon Data Protection are also counted per endpoint and stack on top.
| Option | Billing |
|---|---|
| Falcon Defend | Monthly, per endpoint |
| Falcon Advanced Defend | Monthly, per endpoint |
| Trial | Available on both bundles before you buy |
Monthly billing lets you adjust device numbers as people join and leave. Pricing depends on bundle, quantity and term, so ask us for a quote. See per-user vs per-device licensing for how device-based licences compare.
Requirements and deployment
The Falcon sensor supports Windows, macOS and Linux, including servers and virtual machines. It is deployed with the tools you already use: Microsoft Intune or another device management platform, group policy, a remote monitoring and management tool, or a manual installer for a handful of machines. Supported operating system versions are listed in CrowdStrike's documentation and we check your estate against them before rollout.
We normally start with prevention policies in a detection-focused mode, check for conflicts with line-of-business software, agree exclusions, then tighten policies once everything is stable. Device control and firewall rules are introduced in stages so nothing your staff rely on is suddenly blocked.
Who Falcon Defend suits
Falcon Defend suits organisations with an IT team that can act on alerts and want modern prevention plus USB control, for example to support the malware protection control in Cyber Essentials. Advanced Defend suits organisations that want specialist eyes on their estate around the clock without paying for full managed response.
We scope your devices, recommend the bundle and add-ons, deploy the sensor, remove the product it replaces and look after licence changes and renewals on one Forever Systems account. Compare other options in endpoint protection and anti-ransomware.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Falcon Defend include EDR?
Not as a separate module. Falcon Defend is made up of Falcon Prevent next-gen antivirus, device control, firewall management and Threat Graph analytics; Falcon Insight EDR is not listed in the bundle. Advanced Defend adds OverWatch threat hunting and the Data Replicator event feed, and Complete Defend adds CrowdStrike's 24/7 managed detection and response.
What is Falcon OverWatch?
OverWatch, now called Adversary OverWatch, is CrowdStrike's 24/7 managed threat hunting service. Its analysts search for attacker activity across customer environments and alert you to intrusions that automated prevention may miss. It is included in Advanced Defend and Complete Defend.
Can I try Falcon Defend before buying?
Yes. Trials are available for both Falcon Defend and Falcon Advanced Defend, so you can run the sensor on a few devices before committing.
Does Falcon Defend protect Linux servers?
Yes. The Falcon sensor supports Windows, macOS and Linux, and servers are licensed per endpoint in the same way as workstations.