Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

LABYRINTH CHOLLIMA, which is among the most prolific DPRK-nexus adversaries that CrowdStrike tracks, has evolved into three separate threat actors: GOLDEN CHOLLIMA, PRESSURE CHOLLIMA, and LABYRINTH CHOLLIMA.

CTEM promises a better way to manage exposure but only if it can be operationalized. In this lightboard session, we break down the CTEM framework and show how Falcon Exposure Management turns it into a continuous, actionable program—helping teams reduce noise, validate real risk, and drive measurable exposure reduction.

Modern security automation depends on clean, consistent data. The Data Transformation Agent in Falcon Fusion SOAR makes it simple to shape and interpret security data with natural language prompts. Teams can describe how data should be transformed in plain English, automatically generate expressions with full transparency, and reuse transformations across workflows. By embedding data normalization directly into automation, Fusion SOAR reduces complexity and helps teams act on signals faster.

Modern security teams need complete visibility across every asset to reduce exposure and stop threats before they escalate. Gaps in visibility, unmanaged devices, and delayed remediation increase risk and give adversaries more opportunity to operate. Falcon for IT empowers SecOps with the visibility and context needed to take decisive action.

CrowdStrike Falcon Adversary Overwatch: ► Detect adversaries hiding in your blind spots. Falcon Adversary Overwatch exposes threats targeting network edge devices—firewalls, routers, and infrastructure traditional security tools can’t see. Watch the demo to see how CrowdStrike detects OPERATOR PANDA in real time and stops edge-driven intrusions that quickly turn into credential theft and identity abuse before they escalate.

How do you take down a cybercriminal? Last month, we explored that question through the lens of Operation Endgame. Today, we ask Shawn Henry, former Executive Assistant Director of the FBI and current Executive Advisor to the Founder and CEO of CrowdStrike.

This was a busy year for the Adversary Universe podcast. We covered the emergence of new adversaries, the weaponization of AI, critical CrowdStrike research, and how cyberattacks look in different regions of the world.

In November 2025, a major public-private sector collaboration took down three significant malware networks. Operation Endgame involved law enforcement agencies from six EU countries, Australia, Canada, the U.K., and the U.S., along with Europol and 30 private sector partners, including CrowdStrike. The dismantled infrastructure consisted of hundreds of thousands of infected computers containing several million stolen credentials.

The results of the 2025 MITRE ATT&CK Enterprise Evaluations are in and CrowdStrike excelled, achieving 100% detection, 100% protection, and zero false positives. The MITRE ATT&CK evaluation is an independent assessment that tests how cybersecurity products detect and stop real-world adversary behavior. The 2025 round was the most challenging cross-domain evaluation to date, a true platform test. For the first time, MITRE tested defenses across endpoint, identity, and cloud.

See how CrowdStrike Falcon Fusion SOAR Test Mode lets security teams validate workflows instantly—without live alerts or production risk. You’ll learn how to run playbooks end-to-end using past events or mock data, safely test high-cost actions like LLM analysis, and debug logic with full visibility. With built-in transform testing and mock inputs, Test Mode speeds up automation and reduces errors for faster, safer deployment.