What does any of SCCM and Intune has to do with Crowdstrike? Intune is already outdated btw.

CrowdStrike included some basic SCCM/fleet management "compliance checkboxes". That is one of the reasons companies were paying for CrowdStrike is "fleet management" of AV.

> Intune is already outdated btw.

I do know that part of Microsoft loves to change brand names every quarter for fun and the "parent" organization has changed a few times from different parts of Office and Windows Server to now "Microsoft 365", but as far as I can tell (and I don't keep up with it) Intune is still the active brand name: https://en.wikipedia.org/wiki/Microsoft_Intune

It's because of the merger into Microsoft 365 that I feel confident that most big Enterprises are already paying for Intune even if they aren't using the most up-to-date version and don't know what compliance "checkboxes" it solves versus something like CrowdStrike.

The Microsoft competitor to CrowdStrike is Microsoft Defender XDR (specifically Defender for Endpoint), an enterprise product that is pretty good (in my opinion) but not one that Microsoft just throws in as a sweetener with Office 365 or whatever. You will pay specifically for it. It also runs in the kernel, as most effective EDR does, so until eBPF for Windows is done you are taking the same chance with it as with CrowdStrike. It's just a matter of which company you trust more not to BSOD you.

One of those two companies also makes the OS, the other one piggybacks on it. So it seems updates to Defender XDR would be less likely to brick the OS like this.

I've never worked for Microsoft so I'm speculating, but I doubt their org structure supports that. The Windows team isn't going to be the same as the EDR team.

The EDR team might have more info about Windows internals than CrowdStrike does, but then again, maybe not; CrowdStrike already has to work pretty closely with Microsoft to get into the kernel in the first place, and Microsoft is (sometimes) pretty careful about 'bundling' antitrust concerns.

I think the feeling is that Microsoft as the company that has to field the blame for any problems in Windows has more incentive structures in place internally to "never further tarnish the Windows brand". CrowdStrike doesn't care if people blame Windows (and partially benefited in some parts of this news cycle from people blaming Windows for being the messenger), but Microsoft has nothing but skin in that game, and even if the team was in a terribly remote part of the org structure from the Windows team would still be incentivized to avoid making Windows (any more) the bad brand even if for no other reason than "shareholder value" and the equity stakes in their total compensation. (But Microsoft will have other internal incentives in place, especially the closer the team gets to Windows.)

> until eBPF for Windows is done

Red Hat says CrowdStrike themselves have sent out eBPF files that have caused all sorts of kernel panics. Any sufficiently advanced kernel scripting language is still kernel-level code. I'm not sure eBPF is exactly the savior people are hoping for, though I do still think it remains something of a general improvement if Microsoft can actually get AV vendors and others to use eBPF rather than bespoke kernel drivers.

I'm pretty sure those were actual kernel modules, not eBPF. eBPF for their Linux agent is on their roadmap but not something they are actually doing yet. eBPF should be sandboxed and unable to crash the kernel. Could be I'm missing something, though.

The price is no joke. Microsoft has a lot of really good security products locked behind a paywall that security vendors know they can beat. We were looking the price for sentinel the other day and holy shit it’s costly.

There should be a law that you can’t offer security at a premium. It’s too important.

Paying less to reduce security is a baffling business model.