CrowdStrike Falcon vs. Ivanti Endpoint Manager

CrowdStrike Falcon is ideal for large, cloud-native enterprises that prioritize advanced behavioral detection and have a mature SOC to manage their intelligence. However, its cloud-reliant architecture makes it a poor fit for air-gapped or offline networks. Additionally, small organizations with limited staffing may find it difficult to manage, while teams that require integrated SOAR and vulnerability management might be discouraged by the need for additional licensing to unlock those capabilities.

Incentivized

You need to push O365 or some product out to your institution. If you need to build out a reboot before and after and maybe something else, [Ivanti Unified Endpoint Manager (formerly LANDESK Management Suite)] can easily do that for you. It then can also use a query to determine who needs that product in your environment and then continue using that query to watch for the machines you targeted to show up once your push succeeded. If you need to, you can use the task scheduler and schedule your software distribution for a specific not in normal business hours or on a weekend.

• The Log analysis is very detailed and easy to use.
• Prevent and block all type of malwares.
• Great threat intelligence which is very up-to-date with the recent cyber attacks
• very user friendly in access and management
• Automated feature of detecting, taking action and closing incidents using fusion workflow.

Incentivized

• Software distribution - the ability to sit and provide software when a machine calls home works phenomenally well. You may also target based on certain conditions, ranging from LDAP queries down to hardware revisions of individual components.
• Operating system provisioning - the range of choice in sequential execution is second to none. We migrated from MDT to Ivanti's providing with relative ease.
• Patching and compliance - you're able to get extremely granular, and the rollout project templates make rolling it a particular patch from QA to Production an automated breeze

Incentivized

• The Dashboard can become overwhelming at times, too much information to absorb
• Computers that may have made it out into the field without the endpoint sensor are very difficult to find
• As with all systems that rely on machine learning false positives occurr

Incentivized

• Mac support - While it's the best I've seen with cross platform support, that doesn't mean they don't have a long way to go to catch up with the functionality of other tools that focus on one specific platform.
• Product coherence - Their core product, the management suite, is great but with every new acquisition the company makes, it seems like there's another product that gets shoehorned into the picture. Making all those disparate pieces work smoothly together is something they're still working on.
• Documentation - They come out with a lot of great features but some are so complicated I couldn't begin to understand the various facets of it all. I realize the days of published manual are long gone but even a PDF covering the major components in detail would be better than having to bump around in the dark until you have to call support for help.
• Software Licensing Management - Every major release seems to completely rewrite this tool but they keep seeming to miss the mark. Lately it's a Microsoft Silverlight program that's very slow and has way too much data to be useful.
• Web Console - The web console is all but unusable. The only way to really work on administration is to use the 32bit console which is great if you're running Windows but a fully featured web console would be much preferred.

Incentivized

Crowdstrike has a large suite of tools built for helping the engineers triage and respond to security event whenever identified. The ability to customize the security policies and implement more granular policies to different devices based on the functionality is unmatched. Crowdstrike provides so much of ability in a decent budget which ascertains the value for money or ROI.

Incentivized

As Microsoft evolves Intune, SCCM, MECM and combines their features into the MS EULA, Ivanti seems to be going the opposite where they are stripping out core products in favor of an EULA + A la cart pricing model that simply is more expensive than Microsoft's pricing. A few years ago, the gap was large enough to justify the extra cost of Ivanti, today the gap has closed significantly enough that the value add just isn't there for us.

Incentivized

I think it is a complete and very trustful XDR platform, with very few False Positives. It is very well supported by highly skilled professionals on all levels: from pre-sales engineers, Customer Account Managers and support engineers.

Incentivized

Items are logically laid out and most are easy to find. The more advanced stuff can be trickier, but it is still not hard to find. There are a lot of options though, so remembering where some settings are, especially if you do not alter them often, can take a minute, but you will get to them fairly qiickly.

Support is generally pretty fast and gets right to the issue. We haven't had to use them much, fortunately, but the issues and questions we've had are usually answered quickly. The customer success manager/account manager you're assigned will also follow up with you on a regular cadence to ensure you're getting the most out of the subscription. There's not a whole lot of room to improve, other than the general confusion about what is/what is not covered in custom packages you're subscribed to. The initial purchase took much longer because of a package name changes and realignments of different modules into those packages.

Incentivized

TRM\TAM support has been generally very good. Getting reported bug fixes, design changes, UX problems resolved has been a pain. It is often difficult to get problems escalated beyond the TRM\TAM level. Support is fantastic when you can get it, getting it can often require more work than it should, and that is probably our biggest issue.

There is limited amount of learning that can be completed in an in-person training available. In my opinion, the self-paced learning provided by Falcon portal is more useful over in-person training. The support from Falcon is great and useful to overcome difficulties, if any.

Incentivized

The training provided by Crowdstrike Falcon is complete in terms of the depth of technical knowledge and teaches the users about going through with the platform. There are lots of jargons for different tools that Crowdstrike Falcon has and this training teaches them all which helps in managing the platform better. Plus, the regular knowledge checks are also very helpful for the end user.

Incentivized

Read the documentation

Incentivized

I have evaluated Cortex XDR and SentinelOne Singularity alongside CrowdStrike Falcon, and while all three are capable enterprise-grade solutions, Falcon ultimately stood out due to its cloud-native architecture, broader modular coverage, and stronger identity-focused detection. Cortex XDR performs very well in environments already heavily invested in the Palo Alto ecosystem, particularly for network-to-endpoint correlation, but it introduces additional complexity and infrastructure overhead. SentinelOne excels in autonomous remediation and offline protection, especially with ransomware rollback, but is more endpoint-centric and comparatively limited in native identity and exposure-risk context. CrowdStrike Falcon provided the best overall balance by combining NGAV, EDR, identity protection, exposure management, threat intelligence, and managed hunting within a single lightweight agent and unified console, enabling better scalability, faster investigations, reduced tool sprawl, and stronger protection against modern identity-driven attacks, making it the most aligned choice for our security and operational objectives.

Incentivized

Better in most all categories. On-prem was not an issue for my organization. MS SCCM was lacking features. Airwatch required increasing tiers of service in order to match [Ivanti Unified Endpoint Manager (formerly LANDESK Management Suite)] features, and lacked the robust inventory data we needed. Meraki was very simple to use, but did not meet our needs. I would say that most Airwatch customers aren't using all the features they are paying for, and could save lots of money by using Meraki instead.

• Due to some of the difficulties with Support and Sales, we are likely looking to change to another vendor. We sometimes don't feel like customers.
• When the bluescreen incident occurred (worldwide outage) in July 2024, we were unable to contact support due to the high volume of calls at the same time. We had to figure out how to remediate it ourselves, which we did, and recovered before the vendor's official release of fixes. It shook my confidence in them.
• The product itself performed well over the last 2 years, which has kept us safe and productive. The product is good.

Incentivized

• Centralized IT - all in one solution that is better in some areas than traditional niche software applications. You'll probably still spend the same amount of time with users on the HD line, but you'll be able to reduce the amount of time it takes for auxiliary Help Desk tasks (ticketing, reporting, background deployment, etc.)
• Cost - This is a negative of course ;) But at some point you can save some money if you ditch SCCM or your other CRM

Incentivized