Kroll Standardizes Global MDR on CrowdStrike Falcon Complete to Scale Security Services

When Kroll set out to transform its global managed detection and response (MDR) business, it made a decisive choice to standardize on CrowdStrike Falcon® Complete for Service Providers. Drawing on experience from thousands of cyber incidents each year, Kroll selected CrowdStrike to support a simpler, more scalable MDR model built to address today’s threats and support the services it plans to deliver next.

Today, nearly 300 Kroll customers use Falcon Complete, representing 340,000 endpoints protected. As Kroll looked to expand those customers across the CrowdStrike Falcon® platform and build a broader managed services portfolio, it evaluated which provider could best support that growth over the long term.

“We looked at who was leading the MDR market, where their technology roadmaps were going, and who had the broadest capabilities,” said Robb Mayeski, Global Head of Engineered Defense at Kroll. “CrowdStrike was the clear winner for us.”

Kroll’s previous MDR model required its experts to operate across multiple endpoint and SIEM technologies. As threats accelerated, maintaining those separate environments meant spreading engineering expertise across different platforms instead of concentrating it on improving security outcomes.

What set CrowdStrike apart was the breadth and integration of the Falcon platform. Kroll saw an architecture designed to evolve with adversary behavior while bringing endpoint, identity, SIEM, exposure management, and other capabilities together in one platform.

“CrowdStrike’s technology ecosystem is threat-centric,” Mayeski explained. “The Falcon platform evolves based on threat intelligence and how adversaries are actually operating. That was a major factor in choosing CrowdStrike as our cybersecurity partner.”

Standardizing on Falcon Complete gave Kroll a more consistent operating model and allowed its practitioners to build deeper expertise around a single platform rather than maintaining parallel capabilities across multiple technologies.

Falcon Complete for Service Providers gives Kroll access to 24/7 managed detection and response capabilities to supplement its global incident response and cyber advisory expertise.

The operating model brings CrowdStrike and Kroll teams together throughout the response process. Falcon Complete analysts monitor customer environments, investigate threats, and take action. When an incident requires deeper analysis, Kroll’s response operations and digital forensics teams work alongside CrowdStrike to investigate the root cause, contain the threat, and identify additional countermeasures.

This combination allows Kroll to focus its expertise on complex incident response, forensic investigation, advisory, security transformation, and other high-value services rather than recreating the underlying MDR infrastructure at scale.

Asked what it would take for Kroll to deliver the same level of protection without Falcon Complete, Mayeski was unequivocal. “We wouldn’t be able to, period. It’s how we deliver 24/7 protection at the scale our customers need.”

What began largely as an endpoint-focused MDR customer base has now expanded across the Falcon platform. Today, all of Kroll’s MDR customers use CrowdStrike Falcon® Next-Gen SIEM, while one in four use at least five Falcon platform modules.

This broader adoption is helping Kroll deepen customer relationships while delivering greater value through consolidation. Kroll has helped some customers reduce total cost of ownership by as much as 30% by standardizing security operations on the Falcon platform.

“They can standardize, they can get the telemetry, they don’t have to stitch things together, they don’t need extra resources,” Mayeski said. “Falcon Complete operationalizes all of it.”

The same model is extending into identity security. Kroll says approximately 78% of the incidents it handled during the first half of 2026 involved identity, leading its incident response teams to deploy CrowdStrike Falcon® Identity Threat Protection alongside endpoint protection during engagements.

For one Kroll customer, the value of the new model became clear while it was still migrating to CrowdStrike. The organization was halfway through replacing its previous endpoint security product when ransomware struck. According to Kroll, the attack bypassed the incumbent EDR and spread through the portion of the environment still running the legacy technology. The endpoints already protected by CrowdStrike stopped the attack, with no impact to business operations on that side of the environment.

“That was the ‘aha’ moment,” Mayeski said. “That client said, ‘Okay, I understand. I get it now why you made this switch.’”

The incident reinforced why Kroll chose to standardize: not simply to reduce complexity, but to give every MDR customer access to the security architecture Kroll trusted based on its own frontline incident response experience.

With Falcon Complete at the core of its MDR business, Kroll is now building additional services across the Falcon platform.

Using CrowdStrike Falcon® Foundry, Kroll is developing custom applications that help customers understand their security posture and create roadmaps for expanding into capabilities such as Falcon Next-Gen SIEM. Kroll is also using its APEX framework to help customers identify opportunities for AI and automation, prioritize agentic workflows, and measure the resulting business and security value.

Kroll is a founding member of the CrowdStrike QuiltWorks coalition, bringing insights from its frontline incident response work to help customers identify exposure, close attack paths, and use AI and automation to reduce risk at machine speed.

For Mayeski, that ability to continually expand and innovate is the broader value of the relationship.

“When you go all in and form a truly committed partnership, that’s when success happens,” he concluded. “You see innovation, you see new IP being built, you see co-development … and ultimately you give customers protection that can keep evolving as the threats evolve.”