Please note, as part of the UCOP May 28, 2025, mandate, 100% of university-owned devices and any personal devices connected to trusted UCLA networks and/or trusted applications must have an approved Endpoint Detection and Response (EDR) system installed. For additional information, please visit the UC Information Security Investment Plan & UCLA Requirements page.

UCLA is transitioning from Trellix HX to CrowdStrike Falcon as its endpoint security solution. This change is part of a University of California-wide initiative to strengthen cybersecurity protection while continuing to meet existing UC security requirements. UCLA will retire Trellix by end of May 2027, with CrowdStrike deployment taking place across campus from now through spring 2027.

Beginning June 1, 2027, Duo Desktop will no longer recognize Trellix as an approved endpoint security solution. Devices without CrowdStrike may be unable to access certain UCLA applications and services.

About CrowdStrike

CrowdStrike Falcon is a modern Endpoint Detection and Response (EDR) cybersecurity solution designed to identify, prevent, and respond to digital threats, including malware, ransomware, and unauthorized access.

The software operates in the background, helping protect UCLA computers, university systems, and sensitive information from potential cyberattacks.

CrowdStrike is the endpoint security solution provided through the UC Office of the President (UCOP) and supports UCLA's continued compliance with the cybersecurity requirements established in 2024.

With CrowdStrike, UCLA aims to:

• Protect Bruin community information, including personal, student, and institutional data.
• Safeguard teaching and research, reducing the risk of data loss, unauthorized access, and disruption.
• Protect critical university systems and services from cybersecurity-related threats.
• Strengthen threat detection and response, enabling authorized security teams to identify and respond to potential incidents.

CrowdStrike supports applicable Windows, macOS, and Linux devices, with compatibility depending on the operating system and configuration.

Transitioning from Trellix to CrowdStrike

As part of a UC-wide cybersecurity initiative, UCOP is replacing Trellix with CrowdStrike as the centrally provided endpoint security solution.

To support a coordinated transition, UCLA is working with campus IT teams to deploy CrowdStrike in phases.

Deployment Timeline

• October 2026 – January 2027: Campus IT teams will prioritize deploying CrowdStrike to servers and administrative staff computers.
• January 2027 – May 2027: Deployment will expand to faculty, researchers, and other applicable computers across campus.
• Beginning June 1, 2027: Duo Desktop will no longer recognize Trellix as an approved endpoint security solution. Devices without CrowdStrike may be unable to access certain UCLA applications and services.

What Should I Expect?

Depending on your computer administrative rights, CrowdStrike may be installed automatically by your local IT team or require you to complete additional installation steps.

Your local IT team will communicate deployment timing, instructions, and available support if action is needed. Please follow their guidance before making changes to your existing endpoint security software.

Benefits

CrowdStrike offers several cybersecurity and operational benefits:

• Identifies and responds to known and emerging cybersecurity threats, including malware, ransomware, and suspicious system activity.
• Designed to operate efficiently in the background, with less impact on everyday device use compared with Trellix.
• Supports a wider range of operating systems and device platforms, including supported Windows ARM devices.
• Provides security teams with capabilities to identify, investigate, and contain potential threats.
• Enables authorized UCLA IT administrators to monitor endpoint security coverage and respond to potential security issues.

Getting Started

CrowdStrike deployment is being coordinated through DTS and local IT teams across UCLA.

• For UCLA centrally managed devices: CrowdStrike may be installed automatically through existing device management tools.
• For self-managed or personally owned computers: Manual installation may be required.

Your local IT team will provide guidance based on your device and deployment environment.

Pricing

Licensing for CrowdStrike Falcon is provided at no cost to campus. 

Eligibility

All Campus Units can deploy CrowdStrike within their environment(s).

Requirements

Under the cybersecurity requirements established by UC in 2024, applicable UCLA devices are required to have an approved endpoint security solution installed.

These requirements include:

• UCLA-owned laptops, desktops, and servers, including devices purchased using university grant funds.
• Applicable personally owned computers accessing trusted UCLA networks and/or applications.

Beginning June 1, 2027, Duo Desktop will no longer recognize Trellix as an approved endpoint security solution. Devices without CrowdStrike may be unable to access certain UCLA applications and services.

For more information about the existing requirements, visit the UC Information Security Investment Plan & UCLA Requirements page.

Get Help

For questions about CrowdStrike installation, device compatibility, or your deployment schedule, please contact your local IT team.

For general questions about CrowdStrike and endpoint security at UCLA, contact the Information Security Office at security@ucla.edu.