Facing this exact choice last quarter. 200-person SaaS shop, fully k8s/ArgoCD. Needed MDR, not just EDR. Ran both in POC for 60 days.
CrowdStrike Falcon Complete: The agents are lighter, console is faster. Their MDR team is sharp, but they treat your k8s like a black box. Got alerts like `"malicious process in container"` with zero context about the pod/deployment it came from. Had to manually map everything. Their automation is good if you live in VMs.
```yaml
# Falcon's k8s sensor just gives you this:
container_id: abc123
# ...cool. Which helm release is that?
```
Cortex MDR: Heavier, but the integration with our pipeline was the win. Their XQL engine could query cloud audit logs, k8s events, and container runtime in one shot. Built a correlation rule that tied a weird process to a specific ArgoCD Application and git commit. Rollback was instant. Their team understood our GitOps flow.
Pricing was a wash. CrowdStrike felt like a better generic OS defender. Cortex felt like it actually understood modern infra. Went with Cortex. No regrets, but you pay for it in brain cycles to set up right.