How attacks usually unfold
Ransomware is rarely the first step. Attackers usually get in through a phishing email or stolen password, look around quietly, take what they can, and only then encrypt. Phishing remains the most common attack UK businesses report, experienced by 38% of businesses in the last year.[1]
That gap between getting in and encrypting is where endpoint detection and response earns its keep. Each step leaves traces on your devices, and Falcon watches for them.
What Falcon does at each stage
| Stage | What Falcon does |
|---|---|
| Malicious attachment or download | Blocks known and unknown malware using machine learning, not just signatures |
| Credential theft | Detects tools and techniques used to steal passwords from memory |
| Moving between machines | Flags suspicious remote commands and lets you isolate a device in one click |
| Encryption starts | Recognises ransomware behaviour and stops the process |
Where the plans differ
On every plan, Falcon blocks what it recognises automatically. The difference is what happens with the quieter signs that come before encryption:
- Defend: detections appear in your console for you or your IT provider to investigate.
- Defend Plus: CrowdStrike's threat hunters look for attackers who are trying to stay hidden and tell you what they find.
- Complete: CrowdStrike's team investigates, isolates affected devices and removes the threat, at any hour.
Backups still matter. No security product removes the need for good, tested backups kept separate from your network. Falcon reduces the chance you need them. It does not replace them.
- DSIT, Cyber Security Breaches Survey 2025/2026 (April 2026). www.gov.uk