CrowdStrike Falcon Prevent next-gen antivirus

What is Falcon Prevent?

Falcon Prevent is CrowdStrike's next-generation antivirus (NGAV), the module that blocks threats on a device before they run or as soon as they start behaving maliciously. It is delivered by the single, lightweight Falcon sensor, the same agent CrowdStrike uses for all its endpoint modules, and managed from CrowdStrike's cloud console.

In practical terms, Falcon Prevent is the part of CrowdStrike that replaces your existing antivirus. Everything else in the Falcon range, such as EDR, threat hunting and managed detection and response, builds on top of it using the same sensor. For a plain-English answer to whether CrowdStrike counts as antivirus, see CrowdStrike antivirus for business.

What Falcon Prevent protects against

CrowdStrike describes Falcon Prevent as combining AI, threat intelligence, behavioural analysis, memory scanning and exploit mitigation. Those layers map to the threats a business actually sees:

• Known and new malware: AI-based detection looks at what a file is and does, so it is not limited to a list of known signatures.
• Ransomware: CrowdStrike says Falcon Prevent stops ransomware, including when the device is offline.
• Trusted-tool abuse: indicators of attack look at attacker behaviour, such as legitimate admin tools or scripts being misused, rather than only at files.
• Exploits: exploit mitigation blocks techniques used to take over browsers, Office applications and other common software.
• Attacks in memory: memory scanning finds malicious code that does not write an obvious file to disk.
• Supply chain risks: CrowdStrike says Falcon Prevent can block malicious open-source packages at download on Windows, macOS and Linux.

Because the decisions happen on the sensor, protection does not depend on a constant connection to the cloud. Our next-generation antivirus guide explains how these techniques compare with signature-based antivirus across vendors.

What Device Control and Firewall Management add

Falcon Prevent is usually bought with two companion modules that run on the same sensor:

• Falcon Device Control gives visibility and control of USB storage and other removable media, so you can allow approved devices, make others read-only or block them. That helps with data leaving the business on memory sticks as well as malware arriving on them.
• Falcon Firewall Management lets you create and enforce host firewall rules centrally across Windows, macOS and Linux devices, rather than relying on each device's local settings.

Both are included in the Falcon Defend bundles we supply. On CrowdStrike's own store, its pricing page describes firewall management from the Falcon Pro bundle upwards.

Falcon Prevent vs Falcon Insight XDR

Falcon Prevent is prevention: it decides whether something may run and stops it if not. Falcon Insight XDR is CrowdStrike's EDR and XDR module: it records activity on each device so that incidents can be investigated, hunted for and responded to. Many organisations start with Prevent and add detection and response later on the same sensor. Our EPP vs EDR page explains when antivirus alone is reasonable, and our EDR, XDR and MDR guidance on endpointsecurity.uk goes further into detection and response.

Which bundles include Falcon Prevent

Every Falcon endpoint bundle includes Falcon Prevent. What changes is what sits around it:

CrowdStrike changes its store bundle contents from time to time, so confirm the current inclusions on its pricing page before comparing quotes. We confirm exactly what each line of our quote includes.

Falcon Go vs Falcon Pro

Falcon Go is the entry point on CrowdStrike's own store, which CrowdStrike describes as installing AI-powered antivirus to protect your business, and purchases are limited to 100 devices. Falcon Pro sits above it, and CrowdStrike's pricing page describes host firewall management at that level. Falcon Enterprise is where CrowdStrike describes EDR and threat hunting.

If you want Falcon Prevent through a provider that also deploys and looks after it, the bundle you will be offered is Falcon Defend: Falcon Prevent with USB device control and firewall management, licensed per endpoint and billed monthly, with the quantities confirmed at quote. Small businesses comparing options should also read our antivirus for small business guide.

Deploying Falcon Prevent

Falcon Prevent arrives with the Falcon sensor, so deployment is the same as for any CrowdStrike module:

1. Check the estate against CrowdStrike's supported operating system list, including servers and virtual machines.
2. Deploy the sensor with the tools you already use, such as Microsoft Intune, group policy, an RMM platform or a manual installer for a handful of machines.
3. Start with detection-focused policies on a pilot group, check line-of-business software for conflicts and agree any exclusions.
4. Remove or reconfigure the old antivirus, and confirm how Microsoft Defender Antivirus behaves on Windows Server, where it does not switch mode automatically.
5. Tighten prevention policies, then introduce device control and firewall rules in stages so nothing staff rely on is suddenly blocked.

Server workloads such as SQL Server need particular care with exclusions; our server antivirus guide covers the general approach.

How we help

We can recommend the right Falcon bundle for your devices, arrange a trial of Falcon Defend or Advanced Defend, deploy and tune Falcon Prevent, and look after licence changes on one Forever Systems account. Licensing is per endpoint, billed monthly; ask us for a quote. Our licensing site explains CrowdStrike pricing in more detail.

Contact us with your device count and what you run today.