1. Your IT department shouldn't buy a product that let a third party change files on your system remotely. This one is the basis of computer security.

2. Your IT department shouldn't buy a product that doesn't give you control on when updates are applied.

These are 2 huge security failures from your IT department.

Automatic security updates are widely touted as the gold standard in IT security, at least for anything that is not a life-support system.

I am talking about control, I am not talking about disabling automatisation of updates.

You can have automatic security updates with delay between non prod and prod environments so that you can detect failures or possibly intrusions.

My understanding is that customers believed they had control as Crowdstrike gave them configuration options to delay updates / stagger them. Apparently many of them were surprised that Crowdstrike had the ability to bypass all these configuration options and force the update. I think that is where Crowdstrike's liability skyrockets through the roof.