CrowdStrike Spotlight

What it does

CrowdStrike Falcon Spotlight is the vulnerability management module within the CrowdStrike Falcon platform - providing continuous, agent-based vulnerability assessment across endpoints without the performance impact of traditional scheduled scans. Its AI capabilities include ExPRT.AI, a risk prioritization engine that combines CVE severity with real-world threat intelligence - active exploitation data, adversary targeting patterns, and environmental context - to score each vulnerability's actual exploitability rather than relying on CVSS scores alone. This means security teams prioritize the 2-5% of vulnerabilities that are actively being exploited in the wild rather than chasing thousands of theoretical high-severity CVEs. Spotlight integrates natively with the Falcon agent already deployed for endpoint security, eliminating separate vulnerability scanning infrastructure.

Strengths

• Mid-market security teams use Spotlight for continuous vulnerability management - AI prioritization directing limited remediation capacity toward the vulnerabilities attackers are actually using.
• Large enterprises use Spotlight for enterprise-wide vulnerability intelligence - AI-prioritized CVE lists feeding patch management workflows and risk-based remediation programs without additional scanning agents.
• CrowdStrike Falcon Spotlight is the vulnerability management module within the CrowdStrike Falcon platform - providing continuous, agent-based vulnerability assessment across endpoints without the performance impact of traditional scheduled scans.

Watch-outs

• Requires CrowdStrike Falcon deployment: Spotlight runs on the Falcon agent — organizations not already deploying CrowdStrike for endpoint security must commit to the full Falcon platform to access Spotlight's vulnerability management.
• Network device and cloud-native coverage is limited: Spotlight's agent-based model excels at endpoint vulnerability assessment but has less coverage for network devices, OT systems, and cloud-native workloads compared to agentless scanning tools like Wiz.
• Remediation execution requires separate tooling: Spotlight identifies and prioritizes vulnerabilities but does not execute patches — organizations need separate patch management tools and workflows to act on Spotlight's prioritized findings.

Pricing

CrowdStrike Spotlight is an add-on module to Falcon. Per-endpoint pricing bundled with Falcon licenses. Enterprise pricing negotiated. Annual contracts.