CrowdStrike Falcon Pricing in 2026: Every Plan, Real Costs, and Hidden Fees

Falcon Go is $59.99 per device per year ($7.99 a month) and stops at 100 devices in 2026, Pro is $99.99 ($14.99 a month), and Enterprise is $184.99 ($19.99 a month). Buy annual Enterprise when your analysts will hunt on Falcon. Complete, the managed service, has no public USD price.

Those rates were verified on 23 September 2026 on CrowdStrike's pricing page, which marks the three bundles in US dollars. Toolradar data: Toolradar, the software directory we run, evaluated 816 security tools for its September 2026 security ranking. The Falcon profile is CrowdStrike.

Falcon is CrowdStrike's single-sensor platform, and detection or a managed SOC shows up only on higher bundles. Pay the printed device rate when the job is already on that card. Ask for a quote when you need identity, a SIEM, cloud hours, or a night shift.

At a glance

What you are buying	Best for a security team	USD price, September 2026	What that price leaves out
Falcon Go	Prevention on a fleet of 100 devices or fewer	$59.99/device/yr, or $7.99/device/mo	Firewall management, EDR, hunting, and anything past 100 devices
Falcon Pro	Go, plus a host firewall	$99.99/device/yr, or $14.99/device/mo	Insight XDR and Adversary OverWatch
Falcon Enterprise	A SOC that will detect and hunt on Falcon	$184.99/device/yr, or $19.99/device/mo	Identity, Next-Gen SIEM, cloud workloads, and a managed SOC
Falcon Complete	CrowdStrike's analysts on the same sensor	Not published in USD. The chart says contact sales	Express Support, sold as an add-on on this tier
Defender for Business	A Microsoft shop under 300 users	$3/user/mo, paid yearly	Servers, and any user past 300
Singularity Complete	EDR with a printed rate for 5 to 100 workstations	$179.99/endpoint/yr	14 days of retention. A partner quote can replace this sticker
Huntress Managed EDR	A published SOC rate at 100 endpoints	$7.99/endpoint/mo in the 100-endpoint USD example	The per-endpoint rate falls as the commit grows

A device price that ignores phones, servers, identity accounts, and the renewal is not a budget you can defend. The endpoint protection guide compares the products, and this page prices the invoice the three cards never print.

Falcon Go is prevention, and it stops at 100 devices

The annual Go card buys prevention, and it is the wrong checkout once you need a firewall, detection, or a hunt. The Go page includes Falcon Prevent, Device Control, Falcon for Mobile on Android and iOS, and Express Support. Firewall management, detection, and hunting sit on higher bundles.

One hundred devices is a hard purchase cap, not a discount tier you outgrow in the console. The pricing page footnote limits Falcon Go purchases to a maximum of 100 devices. An upgrade goes through [email protected] rather than a self-serve slider, so price Pro or Enterprise before the order if you will pass that count this year. A shop that only needs managed antivirus, and will stay under the cap, can compare suites on the business antivirus list.

The 15-day trial is Prevent and Device Control, not a full console you keep. CrowdStrike's pricing FAQ includes Falcon Prevent, Device Control, and Express Support, with access within 24 hours, three test detections, and a chance to try more modules during those 15 days. There is no permanent free plan, and the same pages offer a full refund if you cancel within 30 days of an annual term.

Falcon Pro adds the host firewall and stops short of Insight XDR

Pro is the bundle for a team that will manage host firewall policy and still investigate somewhere else. The Pro page names Prevent, Device Control, Falcon for Mobile, Firewall Management, and Express Support. Firewall policy on that page covers Windows and macOS. Linux can take a sensor, but host firewall on Linux is not a feature that page describes, so do not assume a Linux estate is covered.

Pro customers can open detection details for up to 90 days, with process-tree context and remote response actions. Insight XDR and Adversary OverWatch are named on Enterprise, not on Pro's module list. Confirm in the trial whether that 90-day view is the record your incident plan needs. If you need the named detection module, budget Enterprise, because this card does not grow into it.

Twelve months on the monthly Pro card cost more than the annual rate. Dividing the annual Pro price by 12 comes to $8.33 per device per month, against the $14.99 monthly card. Pay annually when the sensor will stay installed, and skip Pro when the gap is a SOC rather than firewall policy.

Falcon Enterprise is the first card with detection and hunting

Enterprise is the published bundle that names Insight XDR and Adversary OverWatch, so it is the card for a SOC working its own queue. The Enterprise page includes everything in Pro, plus endpoint detection and response and threat intelligence and hunting. OverWatch is described there as 24/7 hunting across the platform.

Express Support is included, as it is on Go and Pro, while identity protection, IT hygiene, and Next-Gen SIEM stay off this card, so those gaps are a second purchase.

The monthly Enterprise card is a different year from the annual price. The monthly card is $19.99 per device, twelve of those months is $239.88 per device, and that is $23,988 for 100 devices. Dividing the annual price by 12 comes to $15.42 per device per month. Order the annual term when the sensor will stay in, then read the renewal clause before the first anniversary.

A queue your own analysts will staff belongs on this card. A night shift you will not staff belongs on Complete, because this bundle does not include CrowdStrike's analysts. The product verdict, separate from this bill, is the CrowdStrike review.

Complete, Flex, and the modules the card does not price

Falcon Complete is a managed detection service with no USD list price, so a night shift waits on sales. The pricing chart says contact sales, and CrowdStrike describes 24/7 expert-led managed detection and response, with a Breach Prevention Warranty. Modules such as Next-Gen Identity Security and Next-Gen SIEM can be added on that quote.

Express Support is included on Go, Pro, and Enterprise, and it is an add-on for Falcon Elite and Falcon Complete. Elite has no row on the public price chart. If you are buying the night shift, compare the MDR services list, and keep your own queue on the incident response list.

Falcon Flex swaps modules once a year, and it has no printed USD rate. CrowdStrike says Flex covers the portfolio and charges for what you deploy. Financial Services, on the same page, is financing without a rate, so write the module list before either conversation.

Identity is billed by account, on top of the laptops you already counted. The licensing FAQ counts human accounts and service accounts that authenticated in the last 90 days, with no average, and a hybrid on-prem and cloud account counts once. You cannot license a subset of accounts where the product is deployed, and that page prints no USD price.

Next-Gen SIEM is an ingest bill, not a device count from the card. The same FAQ licenses Next-Gen SIEM and LogScale by data volume and, for some SKUs, by retention, with no USD rate per gigabyte. Platform customers get up to 10 GB of daily CrowdStream data at no additional cost. Price retention on what a SIEM costs and the SIEM tools list until that rate is on the order.

Cloud sensors are licensed by the hour, not like the annual laptop card. Reserved and on-demand licenses count active sensors by the clock-hour, and the FAQ prints no hourly USD rate, so the footprint is not a number you can multiply yet. A posture tool you already run can stay on the cloud security list.

Charlotte AI and Falcon Plus Bundle A are unpriced add-ons with fixed allowances. A fleet of 1 to 149 endpoints gets 40 Charlotte AI credits a month. Unused credits expire, Insight detection triage consumes no credits, and extra credits come in packs of 350 with no public price. Past that allowance, the pack price is whatever sales names.

Commercial Bundle A includes 100 endpoints of Prevent, Insight, device control, firewall management, and OverWatch, plus 30 server endpoints, 125 identity accounts, 25 cloud endpoints, and 10 GB/day of Next-Gen SIEM, with no USD price printed. Exposure management is its own unpriced per-endpoint license, so a scanner you already pay for can stay on the vulnerability scanner list, including the Tenable review.

A device is a sensor that checked in, averaged over four weeks

CrowdStrike's licensing FAQ defines an endpoint as any physical or virtual device. The list includes a computer, server, laptop, desktop, mobile or cellular device, container, pod, or virtual machine image. The sensor counts once it has an agent ID and has contacted the platform in the measurement window. A phone with Falcon for Mobile can count on top of the laptop, so enroll it on the MDM list and recount before you sign.

The subscription sensor license is a four-week average, bought for at least a year. CrowdStrike adds four weekly counts and divides by four. A sensor that checks in during a week counts for that week, and a sensor silent for an entire week drops out of that week only. Unused pre-paid volume is non-refundable unless the order terms say otherwise.

Crossing the quantity means a co-terminous purchase at the then-current list price. The online order terms make overages additional licenses for the rest of the term, pro-rated, at CrowdStrike's then-standard price.

Go cannot absorb device 101, so the cap is a new order, not an overage on the same card. A server on Go, Pro, or Enterprise uses the same published device rate, because those cards print no server surcharge. Microsoft, by contrast, licenses servers outside the user allowance.

What 100 units cost when the vendor prints a rate

These totals are our multiplication of September 2026 list prices, for 100 units, before tax. They are not a CrowdStrike quote, and they exclude add-on modules. SentinelOne's page prices US dollars for 5 to 100 workstations, taxes may be extra, and a partner's price controls if it differs. Huntress shows US dollar pricing at 100 units, and the per-unit rate falls as volume grows.

100 units, license only	What the 100 counts	Year, our arithmetic
Falcon Go, annual	100 devices, at the cap	$5,999
Falcon Pro, annual	100 devices	$9,999
Falcon Enterprise, annual	100 devices	$18,499
Falcon Enterprise, twelve monthly cards	100 devices	$23,988
Defender for Business, paid yearly	100 users, not 100 devices	$3,600
Microsoft Defender Suite, paid yearly	100 users, before the required base suite	$14,400
Singularity Core, displayed annual rate	100 workstations in the 5 to 100 band	$6,999
Singularity Control, displayed annual rate	100 workstations in that same band	$7,999
Singularity Complete, displayed annual rate	100 workstations in that same band	$17,999
Singularity Commercial, displayed annual rate	100 workstations in that same band	$22,999
Huntress Managed EDR, 100-endpoint example	100 endpoints at the printed example	$9,588

Defender for Business is a user price, and one user covers five devices, so the same headcount is not a Falcon device bill. Microsoft lists $3 per user per month, paid yearly, up to 300 users, tax excluded, with servers as an unpriced add-on. One hundred users can cover more laptops than a 100-device Falcon order, which is why that $3,600 year is a different shape of bill.

Past 300 users, Microsoft points to Defender for Endpoint. Its public pricing pages do not print a standalone Plan 1 or Plan 2 USD price.

Microsoft Defender Suite is $12 per user per month, paid yearly, includes Plan 2, and requires Microsoft 365 E3 or Office 365 E3 plus Enterprise Mobility + Security E3. That $14,400 is the suite seat only, before the base suite the page requires, and the directory entry is Microsoft 365.

SentinelOne prints an EDR rate only inside a 5 to 100 workstation band. Singularity Complete is $179.99 per endpoint per year, with 14 days of retention. Commercial is $229.99 and adds identity detection, 90-day retention, and managed threat hunting. Core at $69.99 is the NGAV tier, Control at $79.99 adds suite management, and Singularity Enterprise is contact sales.

Open the SentinelOne profile before a proof of concept, and do not stretch that sticker across a 1,000-seat fleet. A partner's price replaces the displayed rate when the two differ.

Huntress is the SOC with a number beside an unpriced Falcon Complete. At 100 endpoints, twelve months of monthly Falcon Go and twelve months of the Huntress example are each $9,588. Go is prevention, while Huntress includes 24/7 detection and response, remediation, incident reporting, and managed antivirus. Read the Huntress profile when the requirement is a priced SOC.

Cyberpresso sends a daily brief on the threats a SOC has to price before a renewal lands. Subscribe here.

Renewal, refunds, and the fees that sit beside the card

An annual order auto-renews at the list price in force on the renewal date, so year two is not the number you approved. For a term of 12 months or more, CrowdStrike emails at least 60 days before renewal and again at least 30 days before. Either party can cancel the upcoming renewal before it starts, by email to [email protected] or Manage Subscription in the Falcon console.

The renewal uses the quantities on the expiring term, including licenses added mid-term, at CrowdStrike's then-standard price, which the terms say might differ. If the product has been renamed or replaced, CrowdStrike may move the order onto the new offering at that new price.

The 30-day refund applies at the start of an annual term, and it excludes month-to-month orders. Cancel within 30 days of the start and the fees for that term are refunded in full, while month-to-month subscriptions are never refunded. After 30 days, an annual term is not refunded either.

The pricing FAQ says there are no fees beyond the annual subscription, and the next sentence says optional bundle add-ons cost extra. Read both before you treat the card as all-in. Taxes sit on top of the order form, including VAT where it applies. A failed ACH debit can add a fee where the law allows.

Monthly billing on Go, Pro, and Enterprise is not a free look at the year. The sensor-license FAQ sets a one-year minimum on a sensor subscription. Month-to-month orders get no refund, so read the term on the form before you use monthly billing as a sample, because the 15-day trial is the test that ends.

Who should take which card

Take annual Enterprise when your analysts will work the Falcon queue, because Insight XDR and OverWatch are not on the cheaper cards. Stay on annual Pro when the gap is host firewall policy and someone else already holds detection. Stay on annual Go when the fleet stays under the device cap and the job is prevention, USB control, and mobile. Use the antivirus list if you will never open a detection.

Take a quote, and write the module list first, when the card cannot see the attack. Identity accounts, SIEM ingest, cloud hours, exposure management, and Falcon Complete sit outside the three published rates. Falcon Flex is how CrowdStrike sells the right to swap those modules later. Ask for Express Support as its own line on Complete or Elite, where the FAQ makes it an add-on.

Take Defender for Business when the tenant is already Microsoft and the company is under 300 users. The user price and the five-device allowance beat a per-device Falcon card for a laptop-and-phone staff, until a server add-on or user 301 changes the math. Take SentinelOne Complete when you want a printed EDR rate for 5 to 100 workstations and can accept 14-day retention plus a partner's final price. Take Huntress when you need a SOC with a number you can budget this week.

How we priced this

We read CrowdStrike's pricing page, the Go, Pro, and Enterprise pages, the sensor licensing FAQ, and the online order terms on 23 September 2026. Competitor rates come from Microsoft's Defender for Business page, Microsoft's enterprise security plans page, SentinelOne's platform packages page, and Huntress's pricing page.

The 100-unit totals are our multiplication of those published rates and are not vendor quotes. Falcon Complete, Falcon Flex, identity, Next-Gen SIEM, cloud hourly licenses, and Falcon Plus bundles have no public USD price, so they stay unpriced here.

Louis Corneloup, founder of Toolradar and Dupple, edited the piece. Re-check the order form before a signature. The CrowdStrike review is the product verdict, and this page is only the bill.

FAQ

How much does CrowdStrike Falcon cost per device in 2026?

Go is $59.99 per device per year, or $7.99 per device per month, and purchases stop at 100 devices. Pro is $99.99 per year, or $14.99 per month, which buys the host firewall rather than detection. Enterprise is $184.99 per year, or $19.99 per month, for a SOC that hunts on its own sensors. Those are US dollar list prices on CrowdStrike's pricing page as of September 2026, and Falcon Complete is not published in USD.

Does Falcon Go or Falcon Pro include EDR?

Go's named modules are next-gen antivirus, device control, mobile protection, and Express Support. Pro adds host firewall management and does not name the detection module. Insight XDR and Adversary OverWatch are named on Enterprise, so that module means an Enterprise order. The Pro page says detection details can be opened for up to 90 days, so confirm that view in the 15-day trial if your incident plan depends on it.

Is there a free CrowdStrike Falcon plan?

There is no ongoing free tier, and the public offer is a 15-day trial of Falcon Prevent, Device Control, and Express Support, with access within 24 hours, plus a chance to try more modules. An annual subscription can be refunded in full if you cancel within 30 days of the start, and a month-to-month order is not refunded.

What do 100 devices cost on Enterprise, Defender for Business, and SentinelOne?

On September 2026 list prices, 100 devices on annual Falcon Enterprise are $18,499. The same 100 on twelve monthly Enterprise cards are $23,988. Defender for Business for 100 users is $3,600 a year, and each user can cover up to five devices, servers excluded. SentinelOne Singularity Complete displays at $17,999 for 100 workstations in its 5 to 100 band, before a partner changes the price, and none of these figures includes Falcon add-on modules.

Does CrowdStrike charge separately for phones and servers?

A phone can count as its own endpoint, on top of the laptop, once Falcon for Mobile is installed. The licensing FAQ includes mobile devices, servers, containers, and virtual machines, counted when the sensor has checked in. Usage is a four-week average, and the sensor subscription minimum is one year. Go, Pro, and Enterprise do not print a higher server rate. Microsoft's user license covers up to five devices and excludes servers.

What happens when a Falcon subscription renews?

It renews automatically at CrowdStrike's then-standard price, which can differ from the expiring term, using quantities already licensed, including licenses added mid-term. For a term of 12 months or longer, CrowdStrike emails at least 60 days ahead and again at least 30 days ahead. Cancel before it starts by emailing [email protected] or using Manage Subscription. A renamed product can be substituted at renewal at the new list price.

How much is Falcon Complete, and what is still extra?

CrowdStrike does not publish a USD price for Falcon Complete, and the chart says contact sales. The service is 24/7 managed detection and response plus a Breach Prevention Warranty, and identity and Next-Gen SIEM are further add-ons. Express Support, included on Go, Pro, and Enterprise, is an add-on on Complete and on Falcon Elite. For a SOC rate you can read without a call, Huntress prints a 100-endpoint USD example on its pricing page.

Cite this: Cyberpresso, "CrowdStrike Falcon Pricing in 2026: Every Plan, Real Costs, and Hidden Fees", September 2026.

Cyberpresso covers the endpoint bills and the threats a SOC has to price, in one daily brief. Join at cyberpresso.com.

Some offers on this page may be paid placements or contain affiliate links.