|
By Michael Devins
As organizations deploy increasingly autonomous and interconnected agents, the potential agentic blast radius grows. A single compromised or misaligned agent can trigger a chain of actions spanning credentials, applications, files, and enterprise systems that create consequences extending far beyond its original task. Traditional security approaches weren't designed to understand these behaviors, much less intervene at the speed agents operate. Security teams need more than alerts and investigations.
|
By Michael Sentonas
I am delighted to announce CrowdStrike’s intent to acquire Fiddler at Fal.Con EU 2026. Fiddler, a leader in AI observability, will help ensure enterprise AI agents act as intended with pre-deployment evaluation and continuous behavioral monitoring as part of the CrowdStrike Falcon platform. Every business deploying AI agents asks the same questions: What are our agents doing? Are they staying on task? Are they acting in a way that could put the business at risk?
|
By Michael Devins
When Claude Cowork executes code locally, it runs inside an isolated virtual machine on the user's computer. On the host, that VM runs as a single opaque process: The agent's activity inside the VM, including the processes it spawns, the packages it installs, and the network connections it makes, is not visible to the host's endpoint security sensor. Because host folders can be mounted into the VM, sensitive data can sit within the agent's reach.
|
By Lucia Stanham
Every security team is being told to adopt AI. Far fewer have been shown what "good" looks like in practice. Turnkey agents handle common, well-defined security tasks, but no two security teams operate the same way. Each has its own data, playbooks, escalation paths, and risk tolerances; unique context that no vendor can anticipate in a packaged solution.
|
By Vanessa Villa
AI agents don't just answer questions anymore. They open files, use credentials, run code, install software, and run models locally, all at machine speed. Every one of those actions happens on the operating system. This is where attacks land, and where CrowdStrike Falcon Guardian excels: on the endpoint, at runtime.
|
By Paola Miranda
Every organization has a different threat profile. Industry, geography, infrastructure, business operations, and the broader technology ecosystem all influence which adversaries and threats matter most. The challenge is putting threat intelligence to work at scale to identify the greatest threats to each business. The intelligence that security teams rely on is as varied as the threats they face.
|
By Thuy Nguyen
As adversaries broaden their operations across cloud environments, identities, SaaS applications, and AI systems, security teams need threat hunting that can keep up. Suspicious activity in one environment may be part of a larger intrusion spanning multiple domains, making it increasingly important to connect signals across the attack surface. To expand detection coverage across the widening attack surface, CrowdStrike Falcon Adversary OverWatch threat hunting has added two key capabilities.
CrowdStrike OverWatch identified a VAPOR PANDA campaign using ARTEX alongside the Chinese-developed DeepSeek large language model (LLM) and a second commercial LLM to conduct intrusions against multiple high-value targets in parallel.
Prompt injection started as a simple idea during its initial chatbot phase: Tell the model to ignore its instructions and return information in violation of its guardrails. Now, prompt injection attacks can aim at something harder to see: how an agent plans, and how a model reasons and decides which rules apply.
CrowdStrike researchers asked a frontier AI model to explain a function in a small C web server. While it had previously explained every other function in the codebase without hesitation, it refused to explain this one. The request was routine. We'd only asked what the code does; we hadn't asked about security, exploits, or vulnerabilities. But a single token in the code had changed: a max swapped for a min; a one-character logic inversion that creates an out-of-bounds write.
|
By CrowdStrike
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) introduces two critical remote code execution vulnerabilities affecting PHP, making it important for security teams to identify affected systems, understand their exposure, and investigate potential exploitation.
|
By CrowdStrike
How is the threat landscape looking these days? “A lot is going on,” as Adam puts it. “The speed and the volume of the activity, everything is on fire.” To illustrate, he shares the Falcon Adversary OverWatch team is now clocking a new agentic adversary every two hours.
|
By CrowdStrike
As frontier AI accelerates exploit development, security teams need more than vulnerability severity scores to determine what demands attention. They need evidence of what can actually be exploited. In this demo, see how the CrowdStrike Exposure Validation Agent uses frontier AI to generate exploits for supported CVEs and test them in a controlled lab environment. Explore how Falcon Exposure Management evaluates exploitability conditions, documents attack prerequisites and potential impact, and provides evidence of successful exploitation.
|
By CrowdStrike
AI agents don't stop at the answer. They read files, install packages, and run commands on the endpoint, with the user's access. AI security that only watches prompts never sees that part. This demo shows how CrowdStrike Agent Graph in CrowdStrike Falcon Guardian connects AI telemetry with Falcon endpoint telemetry to trace what agents actually do, from prompt to impact. Follow a coding agent from a routine-looking setup note to the tool call that triggered a blocked detection, see the adversary it is linked to, and catch the risky prompt in the same session.
|
By CrowdStrike
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) introduces two critical remote code execution vulnerabilities affecting PHP, making it important for security teams to identify affected systems, understand their exposure, and investigate potential exploitation.
|
By CrowdStrike
Bartley Richardson, Chief AI and Autonomous Systems Officer at CrowdStrike, recently took the stage at Fal.Con 2026 to announce CrowdStrike’s Cyber Superintelligence Lab. The lab brings together our AI researchers, offensive operators, and incident responders to build defensive model and harness capabilities for the agentic era. How are they doing it? “To build the best defense, you have to understand the best offense,” Bartley says.
|
By CrowdStrike
Claude Code reads your developers' files and runs commands in their shell. A Social Security number pasted into a prompt or an API key in a.env file can reach the model, and a single force push can overwrite a shared branch. This demo shows how to secure Claude Code with CrowdStrike Falcon Guardian. Claude Code Hooks run a check at set points, such as when a developer submits a prompt or before a tool runs. Falcon Guardian uses those hooks to check prompts and tool calls against a central policy, deployed through Claude Code's managed settings file so developers can't override it.
|
By CrowdStrike
Claude Code reads your developers' files and runs commands in their shell. A Social Security number pasted into a prompt or an API key in a.env file can reach the model, and a single force push can overwrite a shared branch. This demo shows how to secure Claude Code with CrowdStrike Falcon Guardian. Claude Code Hooks run a check at set points, such as when a developer submits a prompt or before a tool runs. Falcon Guardian uses those hooks to check prompts and tool calls against a central policy, deployed through Claude Code's managed settings file so developers can't override it.
|
By CrowdStrike
With Charlotte AI AgentWorks, bring your preferred model, connect trusted tools and data through Model Context Protocol (MCP), and govern the entire agent experience from one place.
|
By CrowdStrike
See how the Falcon Next-Gen SIEM Data Onboarding Agent simplifies the process of connecting and validating third-party security data. Using natural language, teams can identify the right connector, understand setup requirements, configure credentials, and create connections through a guided workflow.
|
By CrowdStrike
Visibility in the cloud is an important but difficult problem to tackle. It differs among cloud providers, and each one has its own positive and negative aspects. This guide covers some of the logging and visibility options that Amazon Web Services (AWS) and Google Cloud Platform (GCP) offer, and highlights their blind spots and how to eliminate them.
|
By CrowdStrike
Since a majority of the breaches are credential based, securing your multi-directory identity store - Microsoft Active Directory (AD) and Azure AD - is critical to protecting your organization from adversaries launching ransomware and supply chain attacks. Your security and IAM teams are concerned about securing AD and maintaining AD hygiene - and they need to be in sync, for example, to ensure that legacy and deprecated protocols like NTLMv1 are not being used and that the right security controls are in place to prevent breaches in real time.
|
By CrowdStrike
You have to secure your workforce identities immediately, to protect your organization from modern attacks like ransomware and supply chain threats. Your environment could be just Microsoft Active Directory (AD), or a hybrid identity store with AD and Azure AD, and it's important to have a holistic view of the directories and a frictionless approach to securing them. If you're considering Microsoft to secure your identities and identity store (AD and Azure Active Directory), you should ask these five questions.
|
By CrowdStrike
Learn about how to strengthen and modernize your agency's security protection, detection and remediation with Zero Trust. This white paper explains the unique risk factors federal agencies face, what a superior Zero Trust framework includes, and how cloud and endpoint security can help modernize federal security from the endpoint to the application.
|
By CrowdStrike
Cloud adoption remains a key driver for digital transformation and growth for today's businesses, helping them deliver applications and services to customers with the speed and scalability that only the cloud can provide. Enabling them to do so safely is a critical objective for any enterprise IT security team.
|
By CrowdStrike
Network segmentation has been around for a while and is one of the core elements in the NIST SP 800-207 Zero Trust framework. Although network segmentation reduces the attack surface, this strategy does not protect against adversary techniques and tactics in the identity phases in the kill chain. The method of segmentation that provides the most risk reduction, at reduced cost and operational complexity, is identity segmentation.
- November 2026 (4)
- October 2026 (35)
- September 2026 (22)
- August 2026 (12)
- July 2026 (22)
- June 2026 (27)
- May 2026 (34)
- April 2026 (47)
- March 2026 (32)
- February 2026 (33)
- January 2026 (18)
- December 2025 (25)
- November 2025 (17)
- October 2025 (21)
- September 2025 (23)
- August 2025 (27)
- July 2025 (34)
- June 2025 (20)
- May 2025 (20)
- April 2025 (24)
- March 2025 (31)
- February 2025 (18)
- January 2025 (14)
- December 2024 (25)
- November 2024 (8)
- October 2024 (26)
- September 2024 (8)
- August 2024 (6)
- July 2024 (17)
- June 2024 (20)
- May 2024 (17)
- April 2024 (17)
- March 2024 (16)
- February 2024 (21)
- January 2024 (11)
- December 2023 (11)
- November 2023 (21)
- October 2023 (19)
- September 2023 (18)
- August 2023 (21)
- July 2023 (7)
- June 2023 (15)
- May 2023 (14)
- April 2023 (15)
- March 2023 (16)
- February 2023 (13)
- January 2023 (19)
- December 2022 (29)
- November 2022 (19)
- October 2022 (26)
- September 2022 (22)
- August 2022 (14)
- July 2022 (8)
- June 2022 (23)
- May 2022 (17)
- April 2022 (20)
- March 2022 (34)
- February 2022 (20)
- January 2022 (18)
- December 2021 (27)
- November 2021 (5)
- September 2021 (1)
- August 2021 (6)
- July 2021 (5)
CrowdStrike protects the people, processes and technologies that drive modern enterprise. A single agent solution to stop breaches, ransomware, and cyber attacks—powered by world-class security expertise and deep industry experience.
Many of the world’s largest organizations already put their trust in CrowdStrike, including three of the 10 largest global companies by revenue, five of the 10 largest financial institutions, three of the top 10 health care providers, and three of the top 10 energy companies.
A Radical New Approach Proven To Stop Breaches:
- Cloud Native: Eliminates complexity and simplifies deployment to drive down operational costs.
- AI Powered: Harnesses the power of big data and artificial intelligence to empower your team with instant visibility.
- Single Agent: Delivers everything you need to stop breaches — providing maximum effectiveness on day one.
One platform. Every industry. Superior protection.