Gonna tear into the criticism of the product for a moment. >Falcon is a product typically installed on corporate machines so that the security team can detect

Gonna tear into the criticism of the product for a moment. >Falcon is a product typically installed on corporate machines so that the security team can detect and mitigate threats in real time (while monitoring the actions of their employees). Infosec here. Some of the proposed "real time behavioral analytics" tools I have heard about are creepy and draconian, but this is a malware detection software. "Monitoring actions of employees" is not what I understand the tool to be used for. Second, the privacy absolutists on HN have yelled at me before for defending MITM devices like web proxies and DNS filters for "degrading the security of TLS". If we don't do security on the network, then the only place to do it is on the host. Which means, in a perfect (security) world, the endpoint has some kind of intercept layer looking at all incoming/outgoing traffic, anyway. In other words: This product AFAICT isn't human-behavior analytics, and endpoint security is the future of infosec as TLS gets better so it isn't "whether this is good software for companies to have" it's "is this version of the software reliable and functional".