What CrowdStrike's team does
On the Complete plan, alerts do not wait in a console for someone to notice them. CrowdStrike's analysts, who do this full time for organisations around the world, take each detection and work it through:
- Triage: decide whether a detection is a real threat or harmless.
- Investigate: work out what happened, which devices are involved and how the attacker got in.
- Contain: isolate affected devices from the network so the problem cannot spread.
- Remove: clear out malicious files, processes and persistence, remotely.
- Report: tell you what happened and what they did, in plain language.
CrowdStrike's managed detection and response service was named a Leader in The Forrester Wave for MDR Services in Europe, Q3 2025.[1]
A night, on each plan
An example to show the difference between plans. It is not a promise of response times.
| When | Defend | Defend Plus | Complete |
|---|---|---|---|
| 02:14 Something starts encrypting files | Falcon blocks it and logs a detection | Falcon blocks it and logs a detection | Falcon blocks it and logs a detection |
| 02:30 The attacker tries another route | Nobody sees it until the console is checked | CrowdStrike's hunters spot the activity and write it up for you | CrowdStrike's team investigates and isolates the device |
| 09:00 Morning | You investigate and decide what to do | You act on the hunters' findings | You read what happened and what was done |
What you still do
Complete takes the security work off your hands, but a few things stay with you:
- Make sure every device has the agent installed. We help with this.
- Keep your contact details up to date so CrowdStrike can reach you when they need a decision.
- Decide on business matters, such as telling customers or your insurer, after an incident.
Who the analysts are. The 24/7 team on Complete is CrowdStrike's, not ours. We are a small UK team providing set-up, billing and first-line support. We think it matters that you know exactly who is doing what.
Sources
- CrowdStrike, Leader in The Forrester Wave: MDR Services in Europe, Q3 2025. www.crowdstrike.com