Install CrowdStrike Falcon on macOS (Students)


CrowdStrike Falcon is the University provided antivirus and required to be installed on all student computers in order to connect to the University network. Please make sure to uninstall any current antivirus that you may have running on your computer to prevent installation issues and system performance problems prior to installing CrowdStrike Falcon. The license for Sophos Antivirus, our previous antivirus client, will expire June 30, 2020. 

If your Mac currently has Sophos Antivirus installed, installing CrowdStrike Falcon via the directions shown below will automatically remove Sophos from your Mac. 


  1. Navigate to the Software Download page and login with your netID and password

    login to software download

  2. Once logged in, click on Falcon Antivirus for macOS. Please note, Falcon Antivirus for macOS is only available for active students to download. If you are a faculty or staff member, the software will not be available for you to download. 

    falcon antivirus download

  3. Click on Download File to start downloading the installer
  4. Once the installer is downloaded, click on CSFalcon.pkg to open and launch the installation
  5. Review the license terms and press Continue to proceed through the installation wizard
    license terms
  6. Click Install
  7. Enter the password for your computer. Click Install Software

    enter password and hit install

  8. On macOS 10.14 or newer, you will see a message that a System Extension is blocked. Click on Open Security Preferences.
  9. Inside Security Preferences, click Allow. You may need to unlock the padlock in the lower left-hand corner to make changes. 
  10. If you do not allow the System (kernel) Extension to be loaded, you will see the message shown below and the installer will not complete. To finalize installation, please follow steps 8-9 and allow the system extension. 
    kernel extension warning
  11. For macOS 10.15 or later, to have full protection with CrowdStrike Falcon, you will need to grant full disk access to the Falcon process. To do this, follow the steps below:
    1. Open System Preferences and navigate to Security & Privacy
    2. Choose the Privacy tab, and if needed, click the locked padlock icon in the bottom left-hand corner and unlock with the password for your computer
    3. Scroll down on the left-hand side until you see Full Disk Access. If you see "falcond" on the right-hand side, you can check the box next to it and skip the additional steps listed below.
    4. If you do not see "falcond" listed, click on the "+" button and then on your keyboard press CMD + Shift + G
    5. In the "Go to the folder:" window that appears, type /Library/CS/falcond and then click Go
    6. Select falcond and then click Open
    7. Confirm the box is checked next to falcond and exit the Secuity & Privacy pane
      full disk access
  12. CrowdStrike Falcon is now installed and loaded and will automatically update and protect your Mac. Please note, CrowdStrike Falcon does not have an app or icon to see the presence of the agent. To confirm it is running, you can open Activity Monitor on your Mac and search for CSDaemon

See Also

Wired/Ethernet Network

University of Richmond Software Download

Antivirus and Endpoint Detection