CrowdStrike Falcon Prevent
Cloud-native Next-Generation Antivirus (NGAV)

State-of-the-art prevention

Falcon Prevent protects endpoints against all types of attacks, from commodity malware to sophisticated attacks - even when offline.

• Machine learning and artificial intelligence prevent known and unknown malware, adware and potentially unwanted programs (PUPs)


• Behavior-based indicators of attack (IOAs) prevent sophisticated attacks, including ransomware and fileless and malware-free attacks


• Exploit blocking stops the execution and spread of threats via unpatched vulnerabilities


• Detect and quarantine on write stops and isolates malicious files when they first appear on a host


• Threat intelligence prevention blocks activities known to be malicious


• Custom IOAs enable you to define unique behaviors to block


• Quarantine captures blocked files and allows access for investigation


• Script-based execution monitoring inspects and blocks malicious Microsoft Office macros


• Sensor tampering protection stops user or process attempts to manipulate or disable the CrowdStrike Falcon sensor

Full attack visibility at a glance

For unparalleled alert context and visibility, Falcon Prevent:

• Provides details, context and history for every alert


• Unravels an entire attack in one easy-tograsp process tree enriched with contextual and threat intelligence data


• Maps alerts to the MITRE Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) framework for quick understanding of even the most complex detections


• Keeps detection details for 90 days

Protection everywhere

• Purpose-built in the cloud to eliminate complexity and simplify deployment across an organization's entire estate of endpoints


• Broad platform support including Windows, Windows Server, macOS and Linux


• Lightweight Falcon agent running on each endpoint includes all the prevention technologies required to protect the endpoint, whether it is online or offline


• Covers the numerous gaps that are often left by legacy AV solutions

Simple, fast and lightweight

The cloud-native CrowdStrike Falcon platform and lightweight Falcon agent eliminate complexity and simplify endpoint security operations.

• Falcon operates without constant signature updates, complex integrations or on-premises equipment


• The lightweight agent bears little impact on endpoints, from initial install to day-to-day use - no reboot is required after installation


• Minimal CPU overhead restores system performance and end-user productivity


• It works on Day One, deploys in minutes and is immediately operational


• It is automatically kept up to date with cloudnative architecture and SaaS delivery


• Falcon provides broad platform support including Windows, Windows Server, macOS and Linux


• Automated IOA remediation streamlines the removal of artifacts that may lead to reinfection