CrowdStrike Falcon Insight XDR

Name: CrowdStrike Falcon Insight XDR
Brand: CrowdStrike
Rating: 4.6 (696 reviews)

CrowdStrike Falcon Insight XDR is an endpoint detection and response platform extended with XDR capabilities that collects endpoint telemetry via a single agent, correlates detections across endpoints and adjacent domains (identity, cloud, mobile, data), and ingests third-party telemetry for cross-domain investigation and response.

Est 2011|Valuation $255.3B|Raised $2B

LinkedIn 1.1M|Website|Web traffic 2.0M|FTEs 11,706|HQ Austin, TX

MarketsSecurity Information and Event Management (SIEM)Endpoint Security (EPP/EDR)

CrowdStrike Falcon Insight XDR screenshot

01Competitive Landscape

Narrative analysis: where competitors can excel

Microsoft Defender XDR: - Frequently offers an economic advantage where Microsoft 365 licensing (such as E5) is already in place; integration with Entra ID/Azure and Defender for Office 365 can reduce the number of vendors. - Trade-off: heterogeneous estates that depend on non-Microsoft identity/email systems may find end-to-end visibility less comprehensive. SentinelOne Singularity: - Some buyers prefer SentinelOne’s published package approach for pricing transparency and the vendor’s emphasis on autonomous remediation. - Trade-off: enterprises seeking broader identity and cloud consolidation may require additional vendor integrations or services. Palo Alto Cortex XDR: - Attractive to organizations standardized on Palo Alto network and cloud security products due to ecosystem integration. - Trade-off: Cortex Data Lake and associated components can introduce architectural complexity and different procurement considerations compared to CrowdStrike’s managed services options.

Adoption trends (interpretation caution)

PeerSpot reports engagement-based "mindshare" metrics that show changes in activity; such metrics are proxies of user engagement and are not equivalent to market share. Treat engagement metrics with caution and corroborate with other market data.

	Falcon Insight XDR	Microsoft Defender XDR	SentinelOne Singularity (Complete/Commercial)
Starting Price	Public procurement examples vary; published per-endpoint pricing examples exist under specific assumptions. In practice, pricing is quote-based and module-driven.	Often included or discounted by organizations that already license Microsoft 365 E5 or Defender SKUs; licensing model favors Microsoft-centric estates.	SentinelOne publishes package pricing examples; published per-endpoint pricing examples are available though final pricing is partner-negotiated.
Typical Fit	Organizations seeking an extensible EDR/XDR platform with the option to add identity, cloud, and managed services, and which can manage a modular licensing model.	Organizations with a Microsoft-centric environment seeking consolidation via existing Microsoft licensing and tight identity/email integrations.	Organizations seeking an endpoint-first solution with autonomous remediation capabilities and relatively transparent published packages.
Key Strengths	Investigation context and cross-domain correlation when modules are enabled; wide integration ecosystem and available managed services.	Cost advantages in Microsoft-heavy estates due to bundled licensing; deep integration with Microsoft identity and productivity services.	Emphasis on autonomous remediation and rollback; published package structures may simplify initial procurement.
Key Weaknesses	Module-driven pricing and licensing complexity; support/onboarding can vary with tier; learning curve for new teams.	May be less optimal in highly heterogeneous environments that are not Microsoft-centric.	May require additional integrations or services for organizations seeking broad identity/cloud consolidation under one vendor.

01Competitive Landscape

Narrative analysis: where competitors can excel

Microsoft Defender XDR:

Frequently offers an economic advantage where Microsoft 365 licensing (such as E5) is already in place; integration with Entra ID/Azure and Defender for Office 365 can reduce the number of vendors.
Trade-off: heterogeneous estates that depend on non-Microsoft identity/email systems may find end-to-end visibility less comprehensive.

SentinelOne Singularity:

Some buyers prefer SentinelOne’s published package approach for pricing transparency and the vendor’s emphasis on autonomous remediation.
Trade-off: enterprises seeking broader identity and cloud consolidation may require additional vendor integrations or services.

Palo Alto Cortex XDR:

Attractive to organizations standardized on Palo Alto network and cloud security products due to ecosystem integration.
Trade-off: Cortex Data Lake and associated components can introduce architectural complexity and different procurement considerations compared to CrowdStrike’s managed services options.

Adoption trends (interpretation caution)

	Falcon Insight XDR	Microsoft Defender XDR	SentinelOne Singularity (Complete/Commercial)
Starting Price	Public procurement examples vary; published per-endpoint pricing examples exist under specific assumptions. In practice, pricing is quote-based and module-driven.	Often included or discounted by organizations that already license Microsoft 365 E5 or Defender SKUs; licensing model favors Microsoft-centric estates.	SentinelOne publishes package pricing examples; published per-endpoint pricing examples are available though final pricing is partner-negotiated.
Typical Fit	Organizations seeking an extensible EDR/XDR platform with the option to add identity, cloud, and managed services, and which can manage a modular licensing model.	Organizations with a Microsoft-centric environment seeking consolidation via existing Microsoft licensing and tight identity/email integrations.	Organizations seeking an endpoint-first solution with autonomous remediation capabilities and relatively transparent published packages.
Key Strengths	Investigation context and cross-domain correlation when modules are enabled; wide integration ecosystem and available managed services.	Cost advantages in Microsoft-heavy estates due to bundled licensing; deep integration with Microsoft identity and productivity services.	Emphasis on autonomous remediation and rollback; published package structures may simplify initial procurement.
Key Weaknesses	Module-driven pricing and licensing complexity; support/onboarding can vary with tier; learning curve for new teams.	May be less optimal in highly heterogeneous environments that are not Microsoft-centric.	May require additional integrations or services for organizations seeking broad identity/cloud consolidation under one vendor.