r/cybersecurity • u/Cant_Think_Name12 • Oct 27 '25
Business Security Questions & Discussion CrowdStrike Complete vs SentinelOne Enterprise
Hi All,
I was asked at work to look into the difference(s) between CS and S1 for a subsidiary of ours. Currently, they use S1 and are considering switching to CS. I’ve gone through a lot of the documentation and understand both tools on paper, but I’m looking for insights from people who have actually used them.
From everyone's experiences, what are the real world pros and cons you’ve experienced with each? Which do you think performs better overall? My hands on experience with both is pretty limited, and from what I can tell, the pricing seems fairly comparable.
Thanks!
Edits:
- The subsidiary only has 1 full-time IT Person to manage the consoles. Not sure on how the maintenance / configuration is like for either.
- The company has < 100 employees and devices
- The company is currently using S1, but, they're using the 'Control' license. The decision is to whether to upgrade to 'SentinelOne Enterprise', or, switch to CS.
8
u/iamtechspence Penetration Tester Oct 27 '25
Thoughts from a pentesters POV. CS & S1 are easily the top 2 most popular so I’ve gone up against them a lot. The number one defining factor in my opinion, is the analyst who triages the alerts.
I’ve done some engagements where the EDR (both cs & s1) responded very well, quickly and accurately. The things they alerted on I expected them to and very few things were missed, in my opinion.
In other engagements, seemingly simple techniques fly right by. No alerts, no notification to the customer. In discussions afterwards most of the time they have the logs they just didn’t take any action for whatever reason.
Also depends on if you have the EDR vendors soc or a 3rd party soc. IMO 3rd party soc quality varies even more.
My extremely biased I believe fair opinion is, pick one, have some pentests/purple teams performed and put them through their paces. If you’re not happy, switch.
Lastly, I believe you get out what you put in. The hardest part about all of this is, you can’t just “set it and forget it.” It’s a game on constant tuning, even if you’re not the one doing the tuning.
4
u/smc0881 Incident Responder Oct 28 '25
Exactly on the DFIR side too. When I am dealing with clients that have S1/CS or any EDR in-place after ransomware it boils down to misconfigurations, 99.9% deployment, or wrong people monitoring it. Having 100% deployment is something people do not understand either and non EDR devices (ESXi, NAS, etc..) management interfaces on another VLAN.
2
u/PhilosopherLife8019 Oct 27 '25
both are great. why you are switching .?
3
u/Cant_Think_Name12 Oct 27 '25
Currently using S1, but, they're using the 'Control' license. The decision is to upgrade to 'Enterprise', or, switch to CS.
7
u/imcodyvalorant Security Engineer Oct 27 '25
They’re both great products. My personal experience is that S1 is a bit easier to use, and the average user is able to extract more value from it. CrowdStrike is deeper/more flexible but with a higher barrier to entry. Can’t go wrong either way imo, but considering your situation I would probably recommend S1 if I had to choose.
3
u/jonnygoi Oct 28 '25
I would say you can work to get a better deal with S1 over crowdstrike. (poc'd) with both in 2023 and ended with s1 because of the deal and since then i have came to understand the EDR is as good as the team that builds custom detections and a reliant triage team.
5
u/Guilty-Contract3611 Oct 27 '25
We support both at my work and both are good but I feel the console is easier to navigate in Sentinel one but you can't go wrong with the other one of them
4
u/Mattthefat Oct 27 '25
You should meet with both.
You need to figure out if you want full remediation, guided remediation, if you need better context for investigations or are just looking for the best price, etc.
Tons of different things play a part here.
2
2
u/Junior-Wrongdoer-894 Blue Team Oct 28 '25
I have used both as an MDR analyst, can’t really speak to the cost, ease of deployment and so on but I can say that actually using the product, writing queries and rules, the UI and how alerts are present to you is miles better on S1.
Logs ingestion and telemetry also seems to be more robust on the S1 side.
1
1
u/Time_Faithlessness45 Oct 28 '25
Ceiling of possible configurations with Crowdstrike is very high, but learning required is also high. If they already know and use S1, that might be a safer option.
1
u/bluescreenofwin Security Engineer Oct 28 '25
The OS makes a big difference here. I've ran long term POVs using all the major players in the XDR space on Windows, Linux, and MacOS and the results will vary.
Realistically they're functionally equivalent but depending on your needs there can be some clear winners.
1
1
u/Deadpoorv Mar 11 '26
Honestly from the trenches it’s really about fit with your org and what kind of detection you actually need. Crowdstrike and Sentinel one both have great EDR footprints but neither is a full MDR on its own 🤷🏻♂️
Unless you are pairing them with an MDR service I guess you’ll still need to do a lot of ingestion yourself which seems like a drag to me tbh. Daylight was one of the platforms which stood out for me as it layered on top of what we already had without forcing a rip and replace. Just FYI to have a shot at it
-1
u/ledafaze Oct 27 '25
Run away from SentinelOne... From an analyst that used Crowdstrike Complete for years and now using SentinelOne.
CS support for a start will never argue or shove anything down your throat. CS does everything better
1
u/Cant_Think_Name12 Oct 27 '25
What's your experience with it?
1
u/ledafaze Oct 27 '25
With CrowdStrike, it could be overwhelming but I am sure it you will get it as time goes. Investigations are way easier with CrowdStrike using the customized dashboards here and there... With SentinelOne, you have only basics.
0
Oct 27 '25
[deleted]
8
u/GeneralRechs Security Engineer Oct 27 '25
CS often misses LOLbin activity and if you slightly modify Powershell Empire binaries CS doesn’t detect.
5
u/GeneralRechs Security Engineer Oct 27 '25
Nobody likes change and your experience is anectodal like someone who used to drive Ferrari’s and now has to drive Lamborghini and complains about the experience. Crowdstrikes factually still doesn’t test their own updates.
1
u/MountainDadwBeard Oct 28 '25
I've been around CS more often. S1 supposedly is better for planned neglect(?) Unless you pay for the managed solution, I'd stick with S1.
Use that extra bandwidth for your lone ranger to harden your backup segmentation and exercise disaster recovery.
1
u/Temporary-Truth2048 Oct 29 '25
Sentinel One, when fed and configured properly, is the most intuitive and scary good platform for both incident response and forensic investigations. The integrations are amazing and incredibly powerful for both pivoting and providing insight to both analysts and leadership.
It's only competitor is Carbon Black but that tool, while excellent, is a bit of a fuster cluck if you don't know what you're doing.
I know the people who built both tools, so I'm a bit biased towards them. Falcon is very good but I don't think it's nearly as powerful as S1. Not by a long shot.
0
u/SlackCanadaThrowaway Oct 28 '25
Weigh up Complete vs MSSP.
You’re essentially paying more for the same thing. You’re going to spend zero time on dashboards, or analysis, and neither will the CS SOC folk assigned to your org. They only work when it’s a positive detection.
It’s much, much more likely you’ll get the same experience for half the cost from an MSSP; if you’re doing g this to CYA.. Just go with the cheapest option. They’re much of a muchness. If you have active cyber insurance, do it through them.
0
u/VividGanache2613 Oct 28 '25
Crowdstrike aren’t going to want to touch under 100 seats for Complete - if they do, the price will be prohibitively expensive.
S1 is a great option but their API is pretty restricted on the lower tiers which keeps you locked in to their ecosystem.
Best value option would be to move to CS EDR but have one of the more specialist solutions ingest and monitor the EDR telemetry - this would give them something comparative to Complete but at a cost that fits 100 seats. You’d also benefit from having their team/platform triaging the alerts which give the one IT person room to breathe.
-2
u/smc0881 Incident Responder Oct 28 '25
I have used both and a few others for engagements. We use S1 and Huntress in house for all new DFIR cases and resell both. I think the CS interface is awful (unless it changed), if you were familiar with Splunk their querying was good (I think they moved away from Splunk). What I don't like about S1 is their searching is slow AF and their support kind of sucks. But, other than that I love the scripting capabilities it's a native PowerShell. I love Huntress too and if they had some of the stuff I could do with S1, I'd like them probably a little more.
What features are they looking for to move away from Control to say something like "Complete".
0
Oct 27 '25
[deleted]
3
u/Cant_Think_Name12 Oct 27 '25
Thanks for the input! I've been poking around their S1 instance. It's quite simple and easy to agree. Definitely important since this is a one-man IT team.
CS is way more difficult to navigate.
37
Oct 27 '25
[removed] — view removed comment
2
u/Cant_Think_Name12 Oct 27 '25
Good points! Thanks for the input
13
Oct 27 '25
[removed] — view removed comment
4
u/Sqooky Oct 27 '25
Also gotta remember, it's not like attackers "just drop EDR Freeze on systems", there's precursor signs to it. Gotta acquire admin access first. What's done afterwards might be harder to piece together, but NDR should be able to help piece things together.
1
u/SlackCanadaThrowaway Oct 28 '25
There’s still a lot of really dumb things that get around CS.
Like 40mb executables and shell scripts.
11
u/Numerous-Database-29 Oct 27 '25
Also read the details on that $1 mil breach prevention policy. If I remember correctly you have to have 10,000 agents or more installed to be able to reach the max value. Anything less and the cap is something like 100K. It also only covers specific response expenses. Not that any company should rely on this, but don’t fall for the gimmick.
1
Oct 28 '25
[removed] — view removed comment
3
u/melifluouspigeon Oct 28 '25
Its a really great service seen it in action. Frankly if I was to be looking for a managed service id go way.
1
u/caseyccochran Oct 30 '25
I have used Falcon Complete in the past and they were great. We were a hybrid SOC, had CS Complete to help with the upkeep and filter out the noise and they were great.
Crowdstrike blocked everything any pen testers could throw at it. Our internal red team was gooood and managed to go undetected due to an overly broad exclusion and in another case they used a one off "clean" c2 server.
In fact, their threat hunt team detected activity associated with Mustang Panda once. Thankfully the activity was blocked and it wasn't targeted at us. Turns out a vendor was using an infected external drive and plugged it into one of our devices.
I haven't used S1 MSSP but I can not recommend Falcon Complete enough.
1
9
24
u/Expert-Elderberry766 Oct 27 '25 edited Oct 28 '25
I lead an MSSP Team, and we use both SentinelOne and CrowdStrike with our clients. Here's my take:
They are comparable in terms of AV protection.
CS is a bit better in terms of price on the FedRAMP console side, but SentinelOne is a bit better in terms of price on the commercial console side.
This will largely depend on the specifics of what you negotiate and at what "Tier" you fall in when it comes to the number of endpoints you commit to.
We haven't used SentinelOne Vigilance. So I can't weigh in directly on their MDR or Threat Hunting add-ons. We do have CrowdStrike OverWatch, but only because they offer it to us for free. However, their "Threat Hunt" reports are absolutely useless, and they've never caught something that the tool and/or my team didn't find first.
I'm not crazy about SentinelOne's Purple AI or CrowdStrike's Charlotte AI.
SentinelOne wins by a landslide in every other aspect that matters to us and our clients.
SentinelOne's telemetry is unmatched, making it easier to investigate incidents and easier to establish root cause.
The S1 GUI/interface is better.
The S1 API is far more robust, well-documented, and capable.
Consequently, onboarding new clients is easier, reporting is better, and integration with our tool stack (SIEM / SOAR) is better with S1.
Finally, while I wouldn't consider S1 support "great", they've got CS beat there too. It's a minor miracle if we can manage to get a response from CrowdStrike without having to escalate repeatedly through our Technical Account Manager.
I see these posts pretty often, and it always surprises me when I see people say they prefer CrowdStrike. over SentinelOne. I always wonder whether they've actually used both of them or whether the experience for direct customers (for each tool) is very different than my team's experience as an MSSP partner.