Just rolled out CrowdStrike Falcon across our entire fleet. The hype is real, but so are the gotchas.
Performance hit was negligible, which was a genuine surprise. The agent is lean. But the console? Slower than a Monday morning. Their threat graph is cool until you need to trace something across 50 hops and the UI gives up. Also, their "cloud-native" architecture means you're utterly dependent on their portal being up. No offline containment for critical air-gapped systems—big miss. The pricing model feels designed to confuse, and good luck predicting your spend once you turn on all the modules they upsell you every quarter.
It works, and it works well for the basics. Just don't believe the marketing that it solves every security problem. It's a very sharp sensor, not a silver bullet. 😏
Just my two cents.