Skip to Main Content

UCLA Transitioning from Trellix to CrowdStrike for Endpoint Security

Protecting UCLA's systems, information and digital environment is essential to supporting our university's teaching, research and service missions.

As part of a University of California-wide initiative, the UC Office of the President (UCOP) is replacing the current systemwide endpoint security solution, Trellix HX (formerly known as FireEye), with CrowdStrike Falcon, a modern cybersecurity platform providing antivirus and other detection and prevention capabilities designed to protect computers and university information from evolving threats.

In alignment with UC expectations, UCLA will retire Trellix by the end of May 2027, making a timely transition to CrowdStrike essential to maintaining supported endpoint protection. While the security software is changing, the cybersecurity requirements established by UC in 2024 remain in effect. UCLA is committed to making this transition in consultation with both campus academic and administrative governance to develop the detailed rollout plan and necessary adjustments.

No action is required at this time, as your local IT team will provide instructions as the project gets underway.

What Is CrowdStrike?

CrowdStrike is an Endpoint Detection and Response solution designed to detect, prevent and respond to cybersecurity threats, including malware, ransomware and unauthorized access.

Compared with Trellix, CrowdStrike is designed to provide enhanced protection, support a broader range of devices and operate more efficiently in the background, minimizing the impact on everyday device use.

CrowdStrike is not intended to monitor your work, research or productivity. Its purpose is cybersecurity threat detection and response, and UCLA's use of the technology remains subject to UC privacy and data-use policies. This includes any use of CrowdStrike for remote cyber threat remediation in alignment with university consent procedures. As part of the governance process, a formal academic committee dedicated to cyber transparency has been requested to ensure ongoing alignment with these policies and to review activity.

What Should I Expect?

UCLA has begun deploying CrowdStrike through a pilot with select campus units to test and refine the installation process. The broader rollout will occur in phases, in conjunction with ongoing IT and academic governance review:

  • October 2026 – January 2027: Campus IT teams will prioritize installing CrowdStrike on servers and administrative staff computers.
  • January 2027 – May 2027: Deployment will tentatively expand to faculty, researchers, and other applicable devices across campus following consultation with the Academic Senate.
  • Beginning June 1, 2027: Duo Desktop will no longer recognize Trellix as an approved endpoint security solution. Devices without CrowdStrike may be unable to access certain high-risk UCLA applications and services.

Depending on your device, CrowdStrike may be installed automatically by your IT team or require you to complete additional installation steps. Your local IT team will communicate the timing, instructions, and support available if action is needed.

What Happens Next?

As UCLA prepares for the transition, your local IT team will share additional details about timing, expectations, and any steps you may need to take. Again, no action is required at this time. Please wait for further instructions from your local IT team before installing CrowdStrike or removing Trellix from your computer.

For more information, including frequently asked questions about deployment, device compatibility, privacy and upcoming access requirements, visit the OCISO CrowdStrike website.

Sincerely,

Darnell Hunt
Executive Vice Chancellor and Provost

Michael J. Beck
Administrative Vice Chancellor