[Discuss] Crowdstrike

[Rich Pieri]

On Wed, 29 Jul 2026 11:42:11 -0400
"Dale R. Worley" <Dale.Worley at comcast.net> wrote:

"Crowdstrike? More like CLOWNstrike, amirite?" :)

> But Crowdstrike is still in businesses under that name.  Its latest
> reported market cap is $182G.  I wouldn't be surprised if there's a
> Harvard Business School case study on their "crisis management" of the
> situation.

But seriously, Crowdstrike have almost no competition in the enterprise
EDR space. It's Falcon (Crowdstrike), Cortex (PaloAlto) and SentinelOne.
I have direct experience with Cortex and S1, though my S1 experience is
not recent.

S1 is hot garbage. It's a horrible RAM pig. However much RAM the
machine has, figure S1 will consume at least half of it. I saw it
gobble up 500+ GB on a 1TB server. We dropped S1 less than a year after
adopting it so there likely are deeper problems at corporate or support
levels. Maybe these problems have been addressed? I don't know.

Cortex may or may not be better than S1 for RAM. Most of the time it is
better than S1 but sometimes it just goes haywire eating up RAM and
triggering the OOM killer. Cortex's false positive rate is sky-high.
PaloAlto have been consistently evasive about questions regarding WSL
v2. Their support "team" has been rubbish for me.

I have no direct experience with Falcon. I figure it's more or less the
same as Cortex and S1, give or take some particulars here and there.

Two things all three do equally well is buzzword compliance and check
marks on feature lists. Despite the Crowdstrike debacle, Falcon still
looks just as good as S1 and Cortex on paper and at Gartner.

-- 
\m/ (--) \m/