CrowdStrike Spotlight
CrowdStrike's AI-powered vulnerability management module that prioritizes CVEs by real-world exploit risk.
What it does
CrowdStrike Falcon Spotlight is the vulnerability management module within the CrowdStrike Falcon platform - providing continuous, agent-based vulnerability assessment across endpoints without the performance impact of traditional scheduled scans. Its AI capabilities include ExPRT.AI, a risk prioritization engine that combines CVE severity with real-world threat intelligence - active exploitation data, adversary targeting patterns, and environmental context - to score each vulnerability's actual exploitability rather than relying on CVSS scores alone. This means security teams prioritize the 2-5% of vulnerabilities that are actively being exploited in the wild rather than chasing thousands of theoretical high-severity CVEs. Spotlight integrates natively with the Falcon agent already deployed for endpoint security, eliminating separate vulnerability scanning infrastructure.
Why AI-ENHANCED
CrowdStrike Spotlight is an established vulnerability management module that has integrated AI exploit probability scoring through ExPRT.AI - combining threat intelligence with environmental context to deliver risk-prioritized vulnerability findings rather than raw CVSS severity.
Best for
Mid-market security teams use Spotlight for continuous vulnerability management - AI prioritization directing limited remediation capacity toward the vulnerabilities attackers are actually using.
Large enterprises use Spotlight for enterprise-wide vulnerability intelligence - AI-prioritized CVE lists feeding patch management workflows and risk-based remediation programs without additional scanning agents.
Limitations
Spotlight runs on the Falcon agent — organizations not already deploying CrowdStrike for endpoint security must commit to the full Falcon platform to access Spotlight's vulnerability management.
Spotlight's agent-based model excels at endpoint vulnerability assessment but has less coverage for network devices, OT systems, and cloud-native workloads compared to agentless scanning tools like Wiz.
Spotlight identifies and prioritizes vulnerabilities but does not execute patches — organizations need separate patch management tools and workflows to act on Spotlight's prioritized findings.
Alternatives by segment
CrowdStrike Spotlight is an add-on module to Falcon. Per-endpoint pricing bundled with Falcon licenses. Enterprise pricing negotiated. Annual contracts.
