CrowdStrike Vulnerability Management: Spotlight, ExPRT.AI and Pricing Explained

CrowdStrike sells vulnerability management as a module on the Falcon sensor you already run, which is why the buying question is never "is it good?" but "how much of it do I already have, and what does the rest cost?" This guide decodes Falcon Spotlight, Falcon Exposure Management and the ExPRT.AI ranking engine, shows what each Falcon bundle includes, and marks the point where finding a vulnerability stops and patching it begins. Prices, ratings and figures are dated as of November 2026.

TL;DR

Falcon Spotlight reads vulnerabilities from the sensor you already run, with no scan and no second agent, and now ships inside Falcon Exposure Management alongside Surface, network assessment and ExPRT.AI. ExPRT.AI orders the queue by exploitation likelihood instead of CVSS, which practitioners rate as the part that works; false positives and Linux coverage are the recurring caveats. None of it is on the public price list: Go, Pro and Enterprise run $59.99 to $184.99 per device per year (November 2026), and Exposure Management is a quoted add-on on top, with patching a second quoted line through Falcon for IT. Buy it when the sensor is everywhere and a patch engine is ready to take the Critical tier; keep a scanner where large parts of the estate carry no sensor.

What CrowdStrike Sells for Vulnerability Management

Three names appear on quotes, and they describe one product line at different ages. Falcon Spotlight is the original module: it reads vulnerability data from the Falcon sensor's telemetry, so there is no scan window, no scanner appliance and no second agent. Falcon Discover is the IT hygiene module that inventories applications, accounts and unmanaged assets from the same sensor. Falcon Exposure Management is the umbrella CrowdStrike now sells, folding Spotlight and Discover together with external attack surface management (sold as Falcon Surface), network vulnerability assessment, security configuration assessment, attack path analysis and the ExPRT.AI prioritisation engine.

The vendor's own FAQ draws the line between this module and the patching one. Exposure Management "prioritizes vulnerabilities, misconfigurations, and AI-related risks", while Falcon for IT "operationalizes endpoint remediation, configuration enforcement, and patching workflows". Read that twice before the renewal call: the module this guide covers finds and ranks. It does not install the fix.

Analyst coverage has followed the rename. CrowdStrike was named a Leader in the IDC MarketScape for Worldwide Exposure Management in 2025 and in The Forrester Wave for Proactive Security Platforms in Q3 2026, and Gartner Peer Insights made it a Customers' Choice for external attack surface management in 2025. Those placements rate the umbrella, not Spotlight alone, which matters when a reseller quotes you the old name.

How ExPRT.AI Ranks the Queue

The queue is the problem. CrowdStrike's own Patch Tuesday analyses counted 415 CVEs in August 2026, 972 in September and 1,413 in October, the last with three zero-days and 75 rated critical. Nobody patches 1,413 things in a month, so the value of a vulnerability tool is the order it puts them in.

ExPRT.AI is CrowdStrike's answer, and it replaces CVSS as the sort key. The model predicts which vulnerabilities are likely to be exploited from observed adversary activity, threat intelligence and, since the June 2025 release, cloud snapshots, container image scans and third-party vulnerability feeds. Each finding lands in one of four tiers, Low, Medium, High or Critical, and the same release added AI-powered Asset Criticality, which sorts hosts into Critical, High and Non-Critical using firmographic and peer telemetry, plus client-side attack path analysis that traces how a browser exploit on one laptop reaches the data you care about. The motivation CrowdStrike gives is a figure from its 2025 Global Threat Report: 52% of the exploited vulnerabilities it observed in 2024 were used for initial access.

Practitioners rate the ranking as the part that works. In a March 2026 r/crowdstrike thread, an admin running Spotlight on about 15,000 workstations and 4,000 servers described detection as quick and the ExPRT scores as the thing that ended monthly "whack-a-mole", and another commenter put the telemetry refresh at roughly every 15 minutes. The same thread is where the caveats live: a commenter who had run Rapid7 alongside Falcon reported a lower false-positive rate and a wider check library on the Rapid7 side, and a third said the module's Linux coverage trailed its Windows coverage.

The practical read: treat the ExPRT.AI Critical tier as your emergency list and keep a second opinion on the false positives, because every team in that thread had built its own verification step before pushing a patch.

Scanless Assessment, and Where NVA Fills the Gap

Spotlight's design choice is to never scan. The sensor already knows which binaries, packages and drivers are on the host, so the vulnerability list is a lookup against that inventory, refreshed continuously rather than on a Tuesday night. That is why a CrowdStrike customer, Avalon Healthcare, is quoted on the product page saying admins used to wait days for the next scan and now see in minutes that a fix worked. It also means a host with no sensor is invisible, which is the limit every scanner vendor will raise in the bake-off.

CrowdStrike closed part of that gap in March 2025 with Network Vulnerability Assessment, which turns existing Falcon sensors into scanners for routers, switches, firewalls and other devices that cannot run an agent. No appliance is needed, results are scored by ExPRT.AI like endpoint findings, and Exposure Management customers can assess up to 10% of their assets at no extra cost before paying for the rest. One practitioner in the Spotlight thread counted the network check library at about 25 checks focused on high-profile network device CVEs, so compare that number against the Tenable or Qualys plugin count for your environment before you retire the old scanner.

The external side is Falcon Surface, the EASM product CrowdStrike acquired with Reposify. It maps internet-facing assets you may not know you own, which is the view our attack surface explainer describes as the one most SMB security programs skip. Inside Exposure Management it feeds the same prioritisation engine as the endpoint data.

A Worked Example: PHP2Shell, October 2026

On 21 October 2026 two critical remote code execution flaws in core PHP, CVE-2026-109618 and CVE-2026-109619, were disclosed under the name PHP2Shell, both scored 9.2 on CVSS 4.0. CrowdStrike's same-day write-up shows the module doing the job it is built for: Exposure Management's network scanning and Falcon Surface were used to find exposed PHP builds, the Falcon sensor's indicators of attack covered post-exploitation behaviour, and Next-Gen SIEM shipped an Emerging Threat Response dashboard.

Notice what the write-up does not claim. Nothing in Exposure Management patched PHP. The module produced a ranked list of affected hosts within hours; the fix went through whatever patch engine each customer runs, or through Falcon for IT patching where they had bought it. That split, find fast here and fix elsewhere, is the shape of every CrowdStrike vulnerability workflow, and it is the reason the pricing section below has two lines rather than one.

What You Get per Bundle, and What It Costs

CrowdStrike's public price list, read on 9 November 2026, carries three online bundles: Falcon Go at $59.99 per device per year ($7.99 monthly, capped at 100 devices), Falcon Pro at $99.99 ($14.99 monthly) and Falcon Enterprise at $184.99 ($19.99 monthly). Falcon Complete, the managed tier, is quoted. The feature lists on that page cover next-gen antivirus, device control, firewall management, EDR, identity protection and IT hygiene. Exposure Management and Spotlight are not on it. They are quoted as an add-on per endpoint, or inside a Falcon Flex commitment, the consumption contract that lets larger accounts swap modules annually.

Two budget notes from outside CrowdStrike's pages. First, the CrowdStrike Falcon review for MSPs covers how those bundle prices and the quote-only tiers behave across a book of small clients, where the enterprise-first buying model is the friction. Second, a Spotlight user in the March 2026 thread noted that pushing Spotlight findings into Tenable costs half a Tenable licence per asset, so a two-tool setup is not free on either side. Get the Exposure Management line itemised separately from the EDR renewal, with the NVA asset count and the Falcon for IT line each on their own row.

Spotlight Against Tenable, Rapid7 and Qualys

The comparison buyers draw is agent-based telemetry against a dedicated scanner, and the trade is depth of coverage against speed and overhead. Tenable, Rapid7 and Qualys carry larger plugin libraries, authenticated and unauthenticated network scans, and reporting shaped by two decades of audit requests. Spotlight carries the sensor's view of every managed host, updated continuously, with the ExPRT.AI ranking and attack path context that the scanner vendors have been adding in their own ways. Our vulnerability management software roundup scores all four against the needs of MSPs and IT teams, including per-endpoint cost.

The public reviews track that trade. On G2, Falcon Exposure Management holds 4.6/5 across 16 reviews as of November 2026. A September 2026 enterprise reviewer gave it 5/5 for context and prioritisation and still noted that tuning the views and filters so the important exposures stand out takes time, and that the console feels complex at first. CrowdStrike's own case study figure, a 98% reduction in critical vulnerabilities in Intermex's DMZ, sits above a footnote saying the page's headline numbers are projected estimates from pre-sale comparisons. Treat it as a customer's claim, not a benchmark.

The sharpest practitioner account of the trade-off is a large Windows fleet that runs Spotlight for finding and ManageEngine for fixing. The team receives a Jira ticket with a CrowdStrike CSV, runs a script to confirm the vulnerable version and the missing patch because of false positives, filters to confirmed hosts, then deploys. That is four steps where the brochure shows one arrow.

If you already run Falcon Insight on every host, Spotlight's marginal cost is a quote line and its marginal effort is near zero, which is why it wins so many evaluations against a scanner that needs its own agent or appliance. If a quarter of your estate has no sensor, or your auditor wants the scanner's report format, the dedicated tool keeps its seat.

Where It Hands Off to Patching

Everything Exposure Management produces is an input to someone else's change process. Three handoffs are in use today. The first is the export, the CSV or API pull into Jira, ManageEngine, Intune or an RMM, which is what the ManageEngine team above runs by hand. The second is an integration partner: Exposure Management connects to more than 180 tools, and one practitioner described an Adaptiva integration that can trigger patching from an ExPRT.AI score change. The third is CrowdStrike's own Falcon for IT, whose risk-based patching, announced at Fal.Con on 17 September 2025, reads the same ExPRT.AI ranking, adds a Patch Safety Score and rolls updates out in rings.

Which handoff you choose decides the second line of the budget. A team with a mature RMM patch engine keeps it and feeds it the Critical tier as a filter rule; our patch management software comparison ranks those engines by fleet size and third-party catalog depth. A security team with no patch tool of its own, or one tired of waiting on IT's monthly window for exploited findings, is the buyer Falcon for IT was built for. In both cases, verification comes back through Spotlight: the finding disappears from the list when the sensor sees the fixed version, which is the one place a scanless tool beats a scanner outright.

Who It Fits

Falcon Exposure Management fits an organisation that already runs the Falcon sensor on nearly every host, wants its vulnerability list ordered by what adversaries are exploiting this week rather than by CVSS, and has a patch engine or a Falcon for IT licence to act on the top of that list. It fits security teams that report to executives, because the continuous view and the asset criticality tiers turn a scan report into a risk trend. It fits compliance programmes that can accept sensor-based evidence in place of a scanner's PDF.

It is a weaker fit where a large share of the estate carries no sensor, where network device coverage is the main requirement and 25 checks will not satisfy the auditor, or where the budget cannot carry a quoted add-on on top of a quoted EDR renewal. MSPs with many small tenants should price it beside a scanner with native multi-tenancy, and read how the module behaves across a book of clients before signing. Teams building an open, AI-native stack can run Exposure Management for the ranking and OpenFrame for the patching, ticketing and remediation side, with the ExPRT.AI Critical tier as the trigger. Flamingo builds OpenFrame, which competes with some of the tools covered here.

The short answer: if the sensor is already everywhere, Spotlight inside Exposure Management is the cheapest vulnerability list you will ever run and the best-ordered one, and the money question is the second quote line for patching. Ask for Exposure Management, NVA and Falcon for IT itemised separately, run the Critical tier against your current patch tool for one cycle, and count how many of the four steps that ManageEngine team runs you can delete.