Endpoint Security & CrowdStrike Falcon

Why an offensive shop does endpoint work

Because we spend the other half of the week trying to get past exactly this. When we tune a Falcon policy we are tuning against the tooling and the tradecraft we would use on your network next month, not against a vendor slide about what the product theoretically catches.

The gap between "the agent is installed" and "the agent would have stopped that" is where most EDR deployments quietly live. Closing it is the job.

Where engagements usually start

Migration off legacy antivirus

Signature-based products are still running in a lot of places, usually because the migration looked risky. Done in rings, with coexistence during the overlap and reporting on which hosts have which agent, it is not risky. It is a scheduling problem. The part people underestimate is the tail: the 5% of machines that are off the network, reimaged, or owned by someone who ignores every email.

Policy tuning

Out of the box, Falcon is conservative. Left alone it stays that way, and a year later you are paying for an expensive audit log. We move prevention up deliberately, ring by ring, watching for false positives and writing every exclusion down with a reason and a review date.

Detection validation

This is the part that separates a real deployment from a purchase. We run credential dumping, lateral movement, persistence and defence-evasion techniques on a controlled host and check what your console actually shows: whether it fired, what severity, whether anyone would notice at 2am, and whether the telemetry would let you reconstruct events afterwards. You get a matrix of what was blocked, what was detected, and what went by unseen.

Nobody scores 100%, and a vendor telling you otherwise is selling. The point is knowing which gaps you have, so they are decisions instead of surprises.

Beyond the base agent

Identity Protection catches the Active Directory attacks the endpoint sensor cannot see on its own, which matters given how much internal testing ends in Kerberos abuse rather than malware. Exposure management ties into the vulnerability work and cloud modules into cloud posture. We will tell you which of these you need and which you can skip.

Handover, not dependency

You get runbooks: how to triage a detection, how to add an exclusion and who signs off, what to do when a host is contained, and the escalation path when something is real. Written for whoever is actually on call, not for a security team you do not have. We would rather be your annual testing partner than your permanent console babysitter.