What the CrowdStrike Falcon platform includes
Falcon brings endpoint, identity and other security capabilities into a shared platform. Modules, integrations and the managed service have different roles.
The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.
CrowdStrike Falcon is a security platform with separately scoped capabilities for endpoints, identities, cloud systems and other areas. Its shared console and data can support investigations across those areas when the required modules and integrations are in place.
The endpoint sensor is an important part of the architecture. It is not a promise that one installation automatically connects every data source or enables every product.
The main roles
| Capability | Role |
|---|---|
| Falcon Prevent | Endpoint prevention, including next-generation antivirus |
| Falcon Insight XDR | Endpoint detection, investigation and response |
| Falcon Identity Protection | Identity threat protection in supported environments |
| Falcon Guardian | Protection for AI use and agents, evolving from Falcon AIDR |
| Charlotte AI | AI-assisted security workflows |
| Falcon Complete | Managed detection and response service |
Product names describe capabilities, not a universal bundle. Verify what the subscription includes and what the environment supports.
Plan deployment by coverage
Start with the devices, accounts and services you need to protect. Check operating-system support, installation requirements and how existing security tools will coexist during a transition.
Then verify collection and policy application. A device appearing in the console does not by itself establish that the intended prevention policy or response capability is active.
For identity, cloud and AI workflows, review the required permissions and integrations separately. The Guardian article explains why AI discovery and enforcement need to be mapped to actual use cases.
Separate the platform from the people operating it
Falcon Complete is CrowdStrike’s managed service. In that offering, CrowdStrike’s team provides the contracted monitoring and response, while FM supports onboarding, tuning and local escalation.
FM’s Secured offering uses its own agentic SOC built on CrowdStrike. It is a different operating arrangement; the common technology does not make the services interchangeable.
Before selecting either, agree covered systems, response permissions, customer contacts and exclusions. The EDR and antivirus guide explains the endpoint functions, while FM’s MDR service describes the managed-service side.
