CrowdStrike recommends starting withPhase 1: Initial deploymentwhen an environment already haspre- existing Host Intrusion Prevention Systems (HIPS)or similar legacy security controls in place. This guidance is based on the need to carefully evaluate compatibility, performance impact, and policy overlap before enabling more advanced protections.
Phase 1 focuses on sensor deployment, baseline visibility, and detection-only monitoring. This approach allows security teams to observe system behavior, identify potential conflicts, and fine-tune policies without immediately enforcing blocking or prevention actions. When legacy HIPS solutions are already active, enabling stronger protections too quickly can lead to false positives, application disruptions, or system instability.
Phase 2: Interim protection is better suited for environments that are cloud-native, highly ephemeral, or already aligned with modern endpoint security practices. However, environments with existing HIPS suites require a more cautious rollout to avoid overlapping controls and duplicated enforcement.
CrowdStrike's phased deployment model ensures a smooth transition by prioritizing stability and operational awareness. Therefore, whenpre-existing HIPS suitesare present, CrowdStrike documentation and deployment best practices clearly recommend beginning withPhase 1: Initial deploymentbefore progressing to stronger enforcement phases.