What Is CrowdStrike Falcon? Platform, Modules and Bundles Explained

CrowdStrike Falcon is a cloud-delivered security platform that runs from a single agent on each device and sells its capabilities as modules and bundles. This explainer covers the company, how the platform is put together, what the module families do, what Go, Pro, Enterprise, Complete and Flex include, and what Falcon does not do. Every price and figure is as of November 2026, with the source linked.

TL;DR

• One sensor, one console. A lightweight agent streams telemetry to CrowdStrike's cloud, which correlates detections across every customer into one console.
• Modules, not editions. Sixteen product families in November 2026, from endpoint and identity to SIEM and IT automation, all on the same sensor.
• Three self-serve bundles. Go, Pro and Enterprise are priced per device publicly; Complete and Flex are quoted.
• Not an RMM. Falcon prevents, detects and responds; remote control, software deployment and ticketing stay elsewhere.

The Company Behind Falcon

CrowdStrike Holdings was founded in 2011 by George Kurtz, Dmitri Alperovitch and Gregg Marston, moved its headquarters to Austin, Texas in December 2021 and has traded on Nasdaq as CRWD since its June 2019 listing. Its fiscal year 2026, which ended 31 January 2026, closed with $4.81 billion in revenue and 10,698 employees, and the company completed a four-for-one stock split on 1 July 2026.

The most recent quarter sets the scale. For the quarter ended 31 July 2026, CrowdStrike reported revenue of $1.47 billion, up 26% year on year, and ending annual recurring revenue of $5.84 billion, per its second-quarter release of 26 August 2026. The same release says 51% of subscription customers run six or more modules, 35% run seven or more and 26% run eight or more, excluding Falcon Go customers, whom CrowdStrike defines as organisations with 100 endpoints or fewer. That adoption pattern is the reason the platform is best understood as a set of modules rather than as one product.

The name covers two things. "CrowdStrike" is the company, and "Falcon" is the platform it sells, so "CrowdStrike Falcon" in a quote, a job description or a Reddit thread means the agent, the cloud and whichever modules that customer has switched on. Nearly everything CrowdStrike ships, from antivirus to SIEM to the Charlotte AI assistant, carries the Falcon name.

How the Falcon Platform Works

Falcon has three parts: a sensor on each device, a cloud that does the analysis, and a console where people work. Understanding the split explains both why the agent is small and why the platform can add modules without adding agents.

The Falcon sensor is one agent per device, available for Windows, macOS and Linux, with Falcon for Mobile covering Android and iOS. On Windows it runs with kernel-level access so it can see process, file, registry and network events as they happen; on macOS it uses Apple's system extension framework; and on Linux CrowdStrike offers an eBPF-based user-mode option alongside the kernel module. Our kernel explainer covers why that access level matters for both protection and stability. On 19 July 2024 a faulty content update for the Windows sensor crashed about 8.5 million devices worldwide, after which CrowdStrike moved its rapid-response content to staged rollouts with customer-controlled deployment rings.

Everything the sensor sees streams to CrowdStrike's cloud, where a graph database the company calls the Threat Graph links events across all of its customers. A process chain that looks ordinary on one laptop becomes a detection when the same chain has appeared in an intrusion elsewhere, and CrowdStrike's threat intelligence team feeds adversary tradecraft into the same engine. Because the analysis happens in the cloud, the sensor stays small and detection logic updates arrive without a reinstall.

The Falcon console is one web interface for every module. Charlotte AI, the generative assistant CrowdStrike introduced in 2023 and has since extended with agentic workflows, sits inside it and answers questions about the fleet in plain language. Service providers manage many customers from a parent console through Falcon Flight Control, and every module, from antivirus policy to SIEM search, lives in the same place.

The Module Families

CrowdStrike's platform navigation lists 16 product families in November 2026, per its platform overview. Each family is one or more modules licensed on the same sensor, so adding capability means switching on a licence rather than installing another agent. The families group into four jobs.

Protecting devices and identities. Endpoint Security is the original family and holds Falcon Prevent (next-gen antivirus), Falcon Insight XDR (endpoint detection and response), Device Control, Firewall Management and Falcon for Mobile. Next-Gen Identity Security watches Active Directory and Entra ID for credential misuse, XIoT Security extends coverage to operational and medical devices, and Seraphic Enterprise Browser, announced for the platform in November 2026, brings a managed browser into the family. If the EDR and XDR labels blur together, our EDR vs XDR explainer separates them.

Protecting cloud, SaaS, data and AI. Cloud Security covers workloads, containers and cloud posture, SaaS Security watches the configuration and identities of applications such as Microsoft 365 and Salesforce, and Data Security tracks sensitive data moving across endpoints and cloud. AI Detection & Response and AI Observability are the 2026 additions, built for companies that run their own AI agents and models and need to see what those agents touch.

Running the security operations centre. Next-Gen SIEM, built on the LogScale engine CrowdStrike acquired with Humio in 2021, ingests logs from any source. Agentic SOAR, the successor to Falcon Fusion, automates response workflows; Data Pipeline Management routes and filters telemetry before it is stored; Threat Intelligence & Hunting pairs adversary reporting with the OverWatch team's human hunting; and Charlotte AI ties the set together as the assistant layer.

Reducing exposure and running IT. Exposure Management combines vulnerability scanning, attack surface discovery and, once the acquisition announced in August 2026 closes, XM Cyber's attack-path analysis. IT Automation is the Falcon for IT module, which runs osquery-based fleet queries, scripts and risk-based patching on the same sensor. That module has its own Falcon for IT review on this blog, because it is where Falcon starts to overlap with the tools IT teams already run.

CrowdStrike's own walkthrough from 8 October 2026, "Proactive Security in Action Across the CrowdStrike Falcon Platform", shows how the families hand off to each other in a single incident, from exposure finding to detection to automated response:

The practical consequence of the module model is that two companies "on CrowdStrike" can have very different platforms. One may run Prevent and Insight on laptops; another may run twelve modules across endpoints, identity, cloud and a SIEM. When someone asks whether CrowdStrike does something, the answer is usually "yes, in a module", and the follow-up question is whether that module is in the licence.

Bundles: Go, Pro, Enterprise, Complete and Flex

Most buyers meet Falcon through one of three self-serve bundles on CrowdStrike's public pricing page, which in November 2026 lists Go at $59.99, Pro at $99.99 and Enterprise at $184.99 per device a year, or $7.99, $14.99 and $19.99 per device billed monthly. The table below is drawn from that page.

Two details on the same page change the picture for small teams, per the pricing FAQ. Falcon Go purchases are capped at 100 devices, so a company that crosses that line moves to Pro or Enterprise, and every self-serve bundle includes Express Support and a 15-day free trial covering Falcon Prevent and Device Control. The page also lists a Black Friday and Cyber Monday promotion on Go, Pro and Enterprise from 23 November to 4 December 2026, without a published percentage.

Falcon Complete is the managed tier. The platform is the same, but CrowdStrike's analysts watch the console around the clock, investigate detections, and remediate confirmed intrusions on the customer's behalf, backed by a breach prevention warranty. It is the right comparison point for any team weighing a managed service, and our MDR explainer sets out what to expect from that model in general. Complete is quoted, not listed.

Falcon Flex is the licensing model CrowdStrike pushes for larger estates: a pool of committed spend that can be deployed against any module and rebalanced each year as needs change. It is how a customer goes from three modules to eight without renegotiating every time, and the company reported Flex ending annual recurring revenue above $2.29 billion at 31 July 2026, up 101% year on year, in the same quarterly release. Anything beyond the three self-serve bundles, including Falcon for IT, identity protection, cloud security and the SIEM, is quoted through sales or a partner.

What CrowdStrike Falcon Is Not

Falcon is not a remote monitoring and management tool. There is no remote control session, no published software deployment catalog for third-party applications, no ticketing and no client billing, and CrowdStrike itself says Falcon for IT "complements existing UEM and MDM investments". The tools that do that work are covered in our endpoint management software roundup, and in practice Falcon runs beside one of them rather than instead of it.

Falcon is not a network security product either. Firewall Management configures the host firewall built into Windows and macOS; it does not replace a perimeter firewall, a secure web gateway or a VPN, and the enterprise browser and XIoT families are the closest the platform gets to the network edge.

Buying Enterprise does not give you a SIEM. Next-Gen SIEM is its own family with its own ingest-based licensing, and until it or another module pulls in logs from firewalls, cloud services and applications, the detections in Falcon Insight are built from endpoint and identity telemetry. For many teams that is exactly the scope they want, but it is worth knowing before the first renewal conversation.

Falcon is also not a one-time purchase or a free tool. Every bundle is a subscription, the public page offers annual or monthly billing with no perpetual licence, and the only no-cost access is the 15-day trial. Our broader endpoint security explainer covers where a platform like Falcon sits among the categories a buyer will hear named.

Who Uses CrowdStrike Falcon

The customer base runs from enterprises with tens of thousands of endpoints to businesses buying Go with a credit card. The module adoption figures above describe the top end: more than half of subscription customers above 100 endpoints run six or more modules, which means Falcon is most often an enterprise security platform with the antivirus as one piece. Intel is the reference customer on the pricing page, quoted as replacing its previous endpoint tools within three weeks.

A June 2026 r/sysadmin thread shows how the platform looks to a buyer in the middle of that range. The poster, the only person with security experience on a small team managing about 2,500 endpoints and 4,000 users, was weighing EDR, MDR and XDR options after a reportable breach, and the 121 replies work as a buyer's guide. The highest-voted replies came from people who had already bought it: a security VP who started with Falcon four and a half years earlier and kept adding modules so a small team could, in his words, punch above its weight; a two-person security team running Falcon Complete across 1,500 seats; and several commenters telling a one-person security function at that scale to go straight to Complete rather than work the console alone. The one recurring caveat was the July 2024 update, which a government contractor said they caught early enough to pause before it reached every server.

At the small end, the question is usually whether Falcon is reachable at all. A December 2025 r/sysadmin thread from someone helping a 50-endpoint local government office asked for a rough idea of CrowdStrike's cost before contacting sales, having found only "contact sales" online, and the replies covered both the self-serve bundles and the alternatives public-sector buyers compare. Replies ranged from one organisation's five-figure annual bill for the full platform to state-contract and MS-ISAC programmes that commenters said bring the per-device cost well under the public list price, with a Minnesota administrator pointing to that state's whole-of-state programme and two non-profit commenters saying SentinelOne had quoted them more flexibly. The practical advice was consistent: for public sector or non-profit budgets, go through a reseller or a state programme rather than the website.

Managed service providers are the third group, and they buy differently. An MSP licenses Falcon through CrowdStrike's partner programme, manages every client from Flight Control and usually pairs Enterprise with its own analysts or with Complete. Our CrowdStrike review for MSPs covers the multi-tenant side, the partner terms and what the platform costs across a client book. Falcon Endpoint Protection Platform holds a 4.6 out of 5 rating across 680 reviews on G2 as of November 2026.

Where Falcon Sits in the Rest of the Stack

Falcon covers prevention, detection and response, and with Falcon for IT it reaches into fleet queries and patching. The day-to-day operations around a fleet, patching every third-party application, remote sessions, scripting, inventory, documentation and tickets, still need a management layer, and in most environments the two run side by side with Falcon's detections feeding the operations tool's work queue. Our IT automation software guide covers what that layer should do.

Teams building that layer around an open, AI-native core run OpenFrame beside Falcon for the RMM, PSA and remediation work, at $1 per device a month with 10 million AI tokens included, per the OpenFrame pricing page. Flamingo builds OpenFrame, which competes with some of the tools covered here.

Where to Go Next

• If the question is what the module that overlaps with IT tools does, read the Falcon for IT review.
• If the question is how an MSP licenses and runs Falcon across clients, read the CrowdStrike review for MSPs.
• If the acronyms are the problem, start with EDR vs XDR and what MDR is.
• If the question is cost, read the CrowdStrike pricing guide.
• If the question is what the agent does on a device, read the Falcon sensor guide.
• If you want CrowdStrike to run the platform for you, read the Falcon Complete review.
• If you want to know what plugs into Falcon, read the Marketplace and integrations guide.
• If you are assembling a security stack for an MSP, the MSP security stack guide places Falcon among the other layers.

The short answer: CrowdStrike Falcon is one sensor, one cloud and one console, sold as modules, with three self-serve bundles for teams that want to start small and quoted tiers for everything else. Know which modules are in the licence, keep a management layer beside it for the work it does not do, and read the public pricing page before the first sales call.

Keywords: what is crowdstrike falcon, crowdstrike falcon, what is crowdstrike, crowdstrike falcon platform, what does crowdstrike do, crowdstrike falcon modules, crowdstrike falcon bundles, falcon go pro enterprise, crowdstrike falcon explained, crowdstrike falcon sensor, crowdstrike falcon complete, falcon flex