In short: CrowdStrike Falcon Spotlight is a vulnerability management add-on that uses the existing Falcon sensor to assess operating system and application vulnerabilities in real time, without network scans. It ranks them with CrowdStrike's ExPRT risk rating and recommends patches. It is licensed per endpoint on top of a Falcon bundle, on monthly billing.
What Falcon Spotlight is
Falcon Spotlight is CrowdStrike's scanless vulnerability management module. Traditional vulnerability scanners probe devices across the network on a schedule, which misses laptops that are off site and produces a snapshot that is out of date almost immediately. Spotlight works differently: the Falcon sensor already knows what operating system and software each device is running, so Spotlight compares that against vulnerability data continuously and updates the picture as things change.
The result is a live view of exposure across every device with the sensor installed, whether it is in the office, at home or on the road, with no scanning infrastructure, credentials or scan windows to manage.
CrowdStrike also sells a broader exposure management product, Falcon Exposure Management, for organisations that want attack surface and network asset coverage beyond the endpoint. The add-on we supply is Falcon Spotlight, which focuses on vulnerabilities on sensor-equipped devices.
What Falcon Spotlight includes
| Capability | What it gives you |
|---|---|
| Real-time vulnerability assessment | OS and application vulnerabilities on every sensor-equipped device, updated continuously |
| ExPRT rating | CrowdStrike's risk rating, combining vulnerability data with threat intelligence about what attackers are actually exploiting |
| Patch recommendations | Which updates remove the most risk across the estate |
| Installed patch visibility | Which patches are active, and which are installed but waiting for a reboot |
| Dashboards and reports | Custom views for IT, security and management |
| Patching integrations | On-demand vulnerability data and native Falcon integrations to start emergency patching with your IT tools |
The ExPRT rating changes how you work through findings: rather than sorting by severity score alone, you focus first on the vulnerabilities most likely to be exploited in your environment.
How Falcon Spotlight is licensed
Spotlight is an add-on licensed per endpoint, on top of a Falcon Defend, Advanced Defend or Complete Defend bundle. It is not included in any of the three bundles, so it is always a separate line.
It is billed monthly and is normally licensed for the same number of endpoints as your bundle. Ask us for a quote.
Requirements and deployment
There is nothing extra to install. Once the licence is applied, vulnerability data appears in the Falcon console from your existing sensors on Windows, macOS and Linux devices. Coverage is only as complete as your sensor deployment, which is why Spotlight is often paired with Falcon Discover to find devices that are missing the sensor.
Spotlight identifies and prioritises vulnerabilities and recommends patches; the patches themselves are deployed by your patching or device management tools. We connect it to the patching process you already have, or help you put one in place.
Who Falcon Spotlight suits and how we help
Spotlight suits organisations that need to keep on top of patching across a mobile workforce, and those working towards Cyber Essentials, which requires high-risk and critical updates to be applied within 14 days of release. A live view of what is missing makes that much easier to evidence.
We license Spotlight alongside your Falcon bundle on one Forever Systems account, set up dashboards and reports, and help you build a prioritised patching routine around the ExPRT rating. Compare other tools in vulnerability management and penetration testing.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Falcon Spotlight scan the network?
No. Spotlight is scanless: it uses information the Falcon sensor already collects on each device, so there are no scan windows, scanner appliances or credentials to manage.
What is the ExPRT rating?
ExPRT is CrowdStrike's vulnerability risk rating. It combines vulnerability data with CrowdStrike threat intelligence to predict which vulnerabilities are most likely to affect your organisation, so you can fix those first.
Does Falcon Spotlight install patches?
No. It tells you which vulnerabilities exist and recommends the highest-impact patches. Patches are deployed with your existing patching or device management tools, which Spotlight can feed through its integrations.
Is Falcon Spotlight included in Falcon Complete?
No. Spotlight is a separate per-endpoint add-on for all three bundles, including Falcon Complete Defend.