Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CrowdStrike Expands Falcon Adversary OverWatch Threat Hunting Across AI and Google Cloud

As adversaries broaden their operations across cloud environments, identities, SaaS applications, and AI systems, security teams need threat hunting that can keep up. Suspicious activity in one environment may be part of a larger intrusion spanning multiple domains, making it increasingly important to connect signals across the attack surface. To expand detection coverage across the widening attack surface, CrowdStrike Falcon Adversary OverWatch threat hunting has added two key capabilities.

New Prompt Injection Techniques Cover Agent-Planning Attacks

Prompt injection started as a simple idea during its initial chatbot phase: Tell the model to ignore its instructions and return information in violation of its guardrails. Now, prompt injection attacks can aim at something harder to see: how an agent plans, and how a model reasons and decides which rules apply.

Falcon Exposure Management Validation Agent: Demo Drill Down

As frontier AI accelerates exploit development, security teams need more than vulnerability severity scores to determine what demands attention. They need evidence of what can actually be exploited. In this demo, see how the CrowdStrike Exposure Validation Agent uses frontier AI to generate exploits for supported CVEs and test them in a controlled lab environment. Explore how Falcon Exposure Management evaluates exploitability conditions, documents attack prerequisites and potential impact, and provides evidence of successful exploitation.

When AI Guardrails Expose Vulnerabilities

CrowdStrike researchers asked a frontier AI model to explain a function in a small C web server. While it had previously explained every other function in the codebase without hesitation, it refused to explain this one. The request was routine. We'd only asked what the code does; we hadn't asked about security, exploits, or vulnerabilities. But a single token in the code had changed: a max swapped for a min; a one-character logic inversion that creates an out-of-bounds write.

CrowdStrike 2026 Legal Threat Landscape Report: eCrime Leads Attacks, China Activity Intensifies

Cyber intrusions targeting the legal sector nearly doubled between 2023 and 2026, reflecting the value of legal entities to both eCrime and nation-state adversaries. Legal entities hold privileged communications, corporate transactions, intellectual property, government matters, and financial records that make them valuable targets for threat actors seeking financial gain or long-term strategic intelligence.

Falcon Guardian: CrowdStrike Agent Graph

AI agents don't stop at the answer. They read files, install packages, and run commands on the endpoint, with the user's access. AI security that only watches prompts never sees that part. This demo shows how CrowdStrike Agent Graph in CrowdStrike Falcon Guardian connects AI telemetry with Falcon endpoint telemetry to trace what agents actually do, from prompt to impact. Follow a coding agent from a routine-looking setup note to the tool call that triggered a blocked detection, see the adversary it is linked to, and catch the risky prompt in the same session.

PHP2Shell: Exposure and Response with the CrowdStrike Falcon Platform

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) introduces two critical remote code execution vulnerabilities affecting PHP, making it important for security teams to identify affected systems, understand their exposure, and investigate potential exploitation.