I don't know if there's a way to outsource ongoing endpoint security to a third party like Crowdstrike without giving them RCE (and ring 0 too) on all endpoints

I don't know if there's a way to outsource ongoing endpoint security to a third party like Crowdstrike without giving them RCE (and ring 0 too) on all endpoints to be secured. Having Crowdstrike automate that part is kind of the point of their product.