CrowdStrike and Incydr vs. external threat and insider risk

Tim Briggs, Director of Incident Response at CrowdStrike, described a case where a Falcon alert flagged torrent activity on an employee's device, the kind of signal that could mean serious IP exfiltration or simple misuse of company assets. Using Mimecast, his team pulled the employee's file and download history and found he was just downloading movies, letting them report back to leadership with clear, verified context instead of guesswork.

Briggs sums up the division of labor simply: Falcon alerts on external threats and risky exfiltration events, while Mimecast provides proof of the files involved. That clarity, paired with how easy both tools are to use, lets his team move fast, whether that's adding a departing employee to Mimecast's Departing Employee Lens or jumping into Falcon to block USB ports the moment something looks suspicious.