Yes, security incidents resulting from a customer allowlisting an endpoint, altering configurations to fall below the measured security posture, failing to follow CrowdStrike’s prevention or remediation instructions, and altering the Falcon Complete product are excluded. Other exclusions include customer’s fraudulent, criminal or malicious acts, violations of the law and other physical and force majeure events.