Who is CrowdStrike?
CrowdStrike is a cybersecurity company that provides cloud-delivered endpoint, workload, identity, and data protection for enterprises.
- Cloud-native security platform for endpoints, cloud workloads, identities, and data
- Threat detection, prevention, and response across on-premises (on-prem), cloud, and hybrid environments
- Managed Detection and Response (MDR) and threat hunting services
- Threat intelligence, attack surface management, and digital risk protection
- Security Operations (SecOps) center (SOC) tooling, automation, and observability for incident response
Show more
More About CrowdStrike
CrowdStrike focuses on enterprise cybersecurity with a cloud-native architecture that delivers endpoint security, cloud workload protection, identity security, and data protection as a unified platform (endpoint security, cloud security, identity security, data security). Its offerings are used by SecOps teams, incident responders, IT operations, and compliance functions to secure devices, servers, containers, and user accounts across distributed infrastructures.
The company’s core platform (endpoint security) is delivered from the cloud and uses a lightweight agent on endpoints and workloads to collect telemetry, enforce policies, and execute detections and responses in real time. This architecture allows centralized analytics, threat correlation, and policy management while keeping most processing off the endpoint. The platform typically integrates with enterprise identity providers, Security Information and Event Management (SIEM) tools (security analytics), IT service management systems, and cloud-native security services from major public cloud providers.
CrowdStrike’s detection and response capabilities (XDR / EDR) aggregate telemetry from endpoints, cloud workloads, identities, and sometimes third-party sources to build attack timelines, detect lateral movement, and support incident investigation. Security teams use these capabilities to perform alert triage, Root Cause Analysis (RCA), and remediation via remote containment, process killing, and policy updates. These functions are aligned with common SecOps frameworks such as MITRE ATT&CK, which the company references extensively in its public materials.
MDR services (managed security services) extend the platform with 24/7 monitoring, threat hunting, and incident analysis performed by CrowdStrike analysts. These services are used by organizations that want continuous coverage without staffing a large in-house SOC, or that augment existing teams with external expertise. Threat intelligence offerings (threat intelligence) provide adversary profiling, Indicators of Compromise (IOC), and context on tactics, techniques, and procedures, which feed into both automated detections and analyst workflows.
For cloud and DevOps teams, CrowdStrike provides workload and container security (cloud security) that monitors virtual machines, containers, and Kubernetes environments, helping enforce runtime protections and configuration baselines. Identity security (identity security) focuses on detecting misuse of credentials, privilege escalation, and anomalous authentication patterns within environments such as Active Directory and cloud identity platforms.
In enterprise directories and marketplaces, CrowdStrike is typically categorized under endpoint security, Extended detection and response (XDR) (XDR / EDR), MDR, cloud workload protection, identity security, and threat intelligence. Its tooling is often deployed as a foundational layer in security architectures, integrating with SIEM, Security Orchestration Automation Response (SOAR) (security orchestration, automation, and response), ticketing, and collaboration platforms to support end-to-end detection, investigation, and response processes.
Our description of CrowdStrike. Updated December 2025.
