Detection is excellent, the commercial conversation is not
What happened
Rolled Falcon across 4,200 endpoints in eight weeks, mostly because the sensor deploys without a reboot and the console does not need a week of training. Detection quality is the best I have run: the process tree alone has closed arguments that used to take a day of log archaeology. Where it hurts is renewal. The module list grows every year and the discount you negotiated is quietly assumed into the next quote, so budget for a real negotiation rather than an uplift conversation.
Worked well
Sensor deployment is genuinely painless. Threat graph context saves hours per investigation. Overwatch caught something our own SOC did not, twice.
Did not
Modular pricing means the useful features are rarely in the tier you bought. Support tiering is real: standard support is slow if you are not on the top plan.