CrowdStrike antivirus for business

Is CrowdStrike an antivirus?

Yes. CrowdStrike's antivirus product is Falcon Prevent, which CrowdStrike describes as AI-powered next-generation antivirus (NGAV). It takes over the job your current antivirus does: stopping malware, ransomware and malicious behaviour on each laptop, desktop and server before it causes damage.

The confusion comes from everything else CrowdStrike sells. The same Falcon sensor that runs Falcon Prevent can also run CrowdStrike's EDR and XDR module (Falcon Insight XDR), its Adversary OverWatch threat hunting service and its Falcon Complete Next-Gen MDR service, plus add-ons for device control, firewall management, asset discovery, vulnerability management, identity and mobile. So CrowdStrike is an antivirus, and also much more than one. Which parts you get depends on the bundle.

If you are trying to work out whether you need the antivirus layer alone or detection and response too, our EPP vs EDR guide sets out the difference from a buyer's point of view.

How CrowdStrike's antivirus works

Traditional antivirus compares files against a list of known bad ones. Falcon Prevent works differently, which is why it is called next-generation antivirus:

• AI and machine learning look at files and activity for signs of malice, so new and changed malware can be stopped without waiting for a signature.
• Indicators of attack focus on what an attacker is trying to do, such as abusing a trusted tool or injecting code into another process, rather than on a specific file.
• Behavioural analysis, memory scanning and exploit mitigation catch attacks that do not write an obvious malicious file to disk.
• Offline protection: CrowdStrike says Falcon Prevent stops ransomware, supply chain attacks and trusted-tool abuse even when a device is offline.

Everything is managed from CrowdStrike's cloud console, so there is no on-premises server to maintain, and the sensor reports to the console wherever the device is. For more detail on the prevention engine itself, see CrowdStrike Falcon Prevent. For the wider category, see our guide to next-generation antivirus.

CrowdStrike's own bundles and the bundles we supply

CrowdStrike sells through two routes, and the bundle names differ between them. That causes a lot of confusion when people compare quotes.

The three bundles we supply build on each other:

For a business that simply wants to replace its antivirus with CrowdStrike, Falcon Defend is the usual starting point: Falcon Prevent plus USB control and central firewall management. Advanced Defend adds CrowdStrike's own threat hunters. Complete Defend hands detection, investigation and remediation to CrowdStrike's MDR team. If you have been quoted a store bundle such as Falcon Go or Falcon Pro, send it to us and we will map it to the equivalent MSP bundle and add-ons.

Platforms and devices CrowdStrike protects

The Falcon sensor supports Windows, macOS and Linux, including servers and virtual machines, and every workstation or server counts as one endpoint. Supported operating system versions are listed in CrowdStrike's documentation; we check your estate against them before quoting.

Phones and tablets are covered by a separate add-on, Falcon for Mobile, for iOS and Android, licensed per mobile device and managed in the same console.

• Mixed estates with Macs: see antivirus for Macs in business.
• Windows and Linux servers: see server antivirus and Linux antivirus.
• Phones and tablets: see mobile antivirus for business.

CrowdStrike and Microsoft Defender

Most Windows computers already run Microsoft Defender Antivirus, so a common question is what happens when CrowdStrike goes on. Microsoft documents that on Windows 10 and 11 devices not onboarded to Defender for Endpoint, Defender Antivirus moves to disabled mode automatically when another antivirus product is active. On Windows Server it does not change mode automatically, so we set it as part of the rollout.

Some organisations keep other Microsoft security tools alongside CrowdStrike, for example if they already pay for them through Microsoft 365. If you are weighing up whether the built-in protection is enough on its own, read is Windows Defender enough for a business? To compare CrowdStrike, SentinelOne and Microsoft directly, our sister site sets out CrowdStrike vs SentinelOne vs Defender for Endpoint.

Where EDR and managed detection fit

Falcon Prevent stops threats automatically. It does not, by itself, give you the searchable activity history and investigation tools of EDR, and it does not put people on the end of your alerts. CrowdStrike offers both: the Falcon Insight XDR module and Adversary OverWatch threat hunting, and Falcon Complete Next-Gen MDR, in which CrowdStrike's own analysts monitor, investigate and remediate around the clock. That 24/7 service is CrowdStrike's, included in Complete Defend.

For a deeper look at detection, response and managed services across vendors, see our EDR, XDR and MDR guidance on endpointsecurity.uk. If you would rather we deployed and looked after the antivirus layer for you, see managed antivirus.

How CrowdStrike is licensed and priced

Through Forever Systems, CrowdStrike endpoint bundles are licensed per endpoint and billed monthly, so you can add and remove devices as staff join and leave. Add-ons are counted per endpoint, per mobile device, per user (identity) or per gigabyte (SIEM). Trials are available on Falcon Defend and Advanced Defend. CrowdStrike also offers a 15-day free trial on its own website, which covers Falcon Prevent, USB device control and CrowdStrike's Express Support.

We do not publish prices: the cost depends on the bundle, the add-ons, the number of devices and the term, so ask us for a quote. Our licensing site explains CrowdStrike pricing and the bundle structure in more depth, and our business antivirus cost guide covers what drives the price across vendors.

How we help

We start with a device count and what you run today, then recommend the bundle and only the add-ons you will use. We can set up your Falcon console, build prevention policies, roll the sensor out through the tools you already use (such as Microsoft Intune, group policy or an RMM platform), remove the product it replaces and look after licence changes on one Forever Systems account.

Still comparing vendors? See our endpoint protection vendors page, or our sister site's overview of CrowdStrike Falcon as a platform. When you are ready, contact us for a quote or a trial.