As more organizations move to software-as-a-service (SaaS), remote access to applications and data is concentrated among a smaller set of identity providers. These identity providers, such as Okta, must absorb growing volumes of credential-based attacks. Okta consistently reports high volumes of credential stuffing, password spraying and phishing attacks against its customers. Additionally, red teams are discovering new patterns of abuse relevant to Okta products.

CrowdStrike recently announced FedRAMP authorization for CrowdStrike Falcon Data Protection, now available to government entities requiring Federal Risk and Authorization Management Program (FedRAMP) Moderate authorization, enabling them to secure assets through the CrowdStrike Falcon Platform in GovCloud. This advancement supports compliance efforts and adoption of Zero Trust frameworks across government environments.

Identity-based attacks are surging across today’s threat landscape as adversaries target identities in on-premises, cloud and SaaS applications. They aren’t breaking in — they’re logging in. Organizations must respond to these threats in real time to stop breaches, but traditional security approaches consisting of siloed tools often create visibility gaps and hinder efficiency.

Many organizations across critical industries such as healthcare, manufacturing and energy rely on legacy Windows operating systems to run essential equipment. These systems, while operationally vital, are notoriously difficult and costly to upgrade — leaving them vulnerable to modern cyber threats. CrowdStrike is addressing this challenge by expanding our legacy support with the general availability of CrowdStrike Falcon for Legacy Systems.

Insider threats are among the most elusive and damaging forms of cybersecurity risk. According to the Ponemon Institute, 71% of organizations experienced between 21 and 41 insider incidents in 2023, up 67% over the previous year. The average annual cost of insider threats also climbed to $16.2 million per organization, the report found.

Cloud security has reached an inflection point. Organizations have accelerated their cloud adoption and must navigate a complex threat landscape where workloads spin up and down in seconds, applications deploy continuously and identities span multiple services and providers.

Organizations of all sizes require security tools to meet their complex hybrid cloud needs. As their cloud environments and workloads evolve, this includes solutions that can scan for vulnerabilities in container images regardless of their location across public and private cloud environments. The problem is, most organizations lack this capability. Many use tools that don’t allow the flexibility to move quickly and scan their full breadth of cloud assets.

On January 7, 2025, CrowdStrike identified a phishing campaign exploiting its recruitment branding to deliver malware disguised as an "employee CRM application." The attack begins with a phishing email impersonating CrowdStrike recruitment, directing recipients to a malicious website. Victims are prompted to download and run a fake application, which serves as a downloader for the cryptominer XMRig.

Adversaries are taking aim at cloud environments, as evidenced by the 75% increase in cloud intrusions in 2023. Organizations are under growing pressure to ensure they have measures in place to effectively detect, investigate and respond to cloud-focused attacks. Cloud detection and response (CDR) is uniquely challenging for SOC teams due to their limited visibility into the cloud control plane, resource configurations and application deployments.

There are rare moments when technology doesn’t just improve — it leaps forward, leaving behind everything we once thought was enough. The launch of CrowdStrike Falcon Next-Gen SIEM was one of those moments. It’s a game-changer that alters the way security teams think, operate and stop breaches.