Falcon
CrowdStrike Falcon is a macOS endpoint security app that helps organizations protect Macs from malware, suspicious activity, and other attacks.
What is Falcon?
CrowdStrike Falcon is a macOS endpoint security app used by businesses, schools, and IT teams to protect managed Mac computers. It is designed to prevent malware, detect suspicious behavior, and give security staff visibility into threats affecting a device. On Mac, Falcon typically works as part of an organization’s broader CrowdStrike deployment, with alerts and response actions managed through the CrowdStrike platform rather than through a consumer-style desktop interface. Common uses include enterprise antivirus replacement, endpoint detection and response, device monitoring, and incident investigation. Administrators can use it to monitor security events, contain affected systems, and support response workflows across fleets of Macs. It is primarily installed on work or school devices, though some users may also encounter it on personally owned Macs enrolled in an employer’s security program.
Key features
- Block malware and other known threats on managed Macs
- Detect suspicious behavior and security events on endpoints
- Send alerts and device telemetry to centralized security teams
- Support incident investigation and response workflows
- Help administrators isolate or contain affected devices remotely
- Work across supported macOS versions with a lightweight endpoint agent
Review app leftovers with diCleaner
Inspect caches, support files, containers, and login items before cleaning.
Safety overview
Status: Mostly safe
This is legitimate security software commonly deployed by organizations to protect managed Macs. It may run continuously in the background, monitor security-related activity, and request system-level permissions that are normal for endpoint protection tools. Because it can affect network access, threat response, and device monitoring on a work or school Mac, removing or disabling it may reduce protection or conflict with your organization’s security requirements. If the Mac is employer-managed, follow your organization’s IT guidance before making changes.
Recommendation: Keep CrowdStrike Falcon if this Mac is managed by your workplace, school, or IT provider, or if you rely on it for endpoint protection. Remove it only if you intentionally no longer use that security setup and you understand that uninstalling it can stop monitoring and policy-based protection on the Mac.
Common paths
/Applications/Falcon.app
Share your experience
Be the first to share your experience.