It auto updates so they can roll out things in near real time. Crowdstrike’s value prop is that they have telemetry from thousands of environments globally, they see shit before anyone else so they can remediate before customers even know there might be a problem. When you come from something like carbon black (which bluescreens shit everyday of the week) this is a win for security at scale.

Obviously there is a tradeoff but people didn’t seem to consider it, until it materialised..