Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Outpacing Modern Adversaries with the CrowdStrike Agentic SOC

Adversaries are weaponizing AI, accelerating tradecraft and moving from access to impact at machine speed. As breakout times collapse to seconds, security teams cannot rely on manual processes or static automation to keep up. Meet the CrowdStrike Agentic SOC, a new operating model built for the AI era.

Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse

CVE-2026-20929, a vulnerability with a CVSS of 7.5 that was patched in the January 2026 Patch Tuesday update, enables attackers to exploit Kerberos authentication relay through DNS CNAME record abuse. This blog focuses on detecting one particularly impactful attack vector: relaying authentication to Active Directory Certificate Services (AD CS) to enroll certificates for user accounts, as detailed in recent research.

The Future of Cybersecurity in the Agentic World | George Kurtz and Dan Ives

In his conversation with Dan Ives, Wedbush’s Global Head of Technology Research, CrowdStrike CEO and founder George Kurtz explains why security, visibility and guardrails are the key to unlocking enterprise AI adoption - and why customers are looking to CrowdStrike to help them move faster. Subscribe and stay updated!

How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem

The era of human-speed defense is over. With eCrime breakout times collapsing to as fast as 27 seconds and attacks from AI-powered adversaries increasing 89% year-over-year, the traditional SOC has reached a breaking point. Manual processes, fragmented tools, and rule-based playbooks were built for a different era. Today, if your defense depends on human reaction time, you’re not just behind — you’re at risk.

CrowdStrike Advances CNAPP with Industry-First Adversary-Informed Risk Prioritization

Interest in cloud-native application protection platforms (CNAPPs) has exploded over the recent years, partly due to their ability to reduce alert noise by translating siloed misconfigurations into correlated, theoretical attack paths and exposures. While many organizations have adopted these solutions in pursuit of outcomes like zero critical issues, cloud breaches continue to rise.

Falcon Data Security Secures Data Wherever It Lives and Moves

In modern organizations, sensitive data lives everywhere and is constantly moving. It is created, accessed, transformed, and shared across endpoints, browsers, SaaS applications, cloud services, GenAI tools, and agentic workflows. CrowdStrike is introducing CrowdStrike Falcon Data Security to protect data across constantly evolving business environments.

New CrowdStrike Innovations Secure AI Agents and Govern Shadow AI Across Endpoints, SaaS, and Cloud

As organizations race to adopt new AI tools, deploy AI agents, and build AI-powered software, they create new attack surfaces that traditional security controls were never designed to protect. A key example is the prompt and agentic interaction layer, which faces novel threats like indirect prompt injection and agentic tool chain attacks.

Falcon Next-Gen SIEM Supports Third-Party EDR Tools, Starting with Microsoft Defender

CrowdStrike is expanding CrowdStrike Falcon Next-Gen SIEM to support third-party endpoint detection and response (EDR) solutions — beginning with Microsoft Defender — with no Falcon sensor required. This evolution will enable organizations to modernize their SOC without replacing existing endpoint agents. Adversaries are moving faster than ever, exploiting cross-domain gaps across endpoint, identity, network, and cloud.

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

While investigating a spike in script execution detections across several CrowdStrike Falcon platform customers, CrowdStrike’s Engineering team traced the activity to a compromised GitHub Action named aquasecurity/trivy-action. This popular open-source vulnerability scanner is frequently used in CI/CD pipelines.

Secure Homegrown AI Agents with CrowdStrike Falcon AIDR and NVIDIA NeMo Guardrails

The biggest challenge for developers building AI applications is no longer the translation of user intent into action, but rather limiting its scope to stay within stated business goals and prevent abuse. This challenge has moved from theoretical to mission-critical as AI agents transition from experimental projects to mainstream business tools, where a single compromised agent can expose customer data, execute unauthorized transactions, or violate compliance requirements across thousands of interactions.

CrowdStrike Innovates to Modernize National Security and Protect Critical Systems

At Fal.Con Gov 2026, CrowdStrike is introducing new innovations to accelerate modernization and strengthen cyber defense of government systems, while helping agencies meet some of the most rigorous compliance standards within a FedRAMP-authorized environment. Cybersecurity is national security. Ransomware threatens public safety and continuity of operations. Supply chain compromise multiplies impact. Nation-state actors target critical infrastructure for strategic disruption.

Falcon Platform for Government Now Offers Falcon for XIoT to Secure Connected Assets

CrowdStrike Falcon Platform for Government, our FedRAMP High authorized offering, has expanded to include CrowdStrike Falcon for XIoT. This addition delivers native XIoT visibility and protection through the CrowdStrike Falcon platform so government agencies can protect connected assets and critical infrastructure.

Identity Enrichment with the Falcon Browser Extension and Next-Gen Identity Security

Falcon Next-Gen Identity Security enriches cloud authentication with verified endpoint context using the Falcon sensor and Browser Extension. Watch the demo to see how CrowdStrike eliminates blind spots between endpoint and cloud to accelerate investigations and stop identity-based attacks.

Stop Local App Data Leakage | Falcon Data Protection Demo

CrowdStrike Falcon Data Protection enforces content-aware controls on local thick-client applications to prevent sensitive data from leaving the environment. Real-world exfiltration attempts across common desktop applications including chat tools, note-keeping apps, and email clients are identified and blocked beyond the browser. Custom Local Application groups, Classification Rules, and Data Security Policies give defenders flexible, precise control over how sensitive data is handled across the endpoint.

4 Ways Businesses Use CrowdStrike Charlotte AI to Transform Security Operations

Security teams are being asked to do more than ever, often with fewer people and less time. As alert volumes continue to rise and adversaries automate their attacks, even mature SOCs struggle to keep pace. Legacy tools surface signals, but they still leave analysts responsible for triage, investigation, and response decisions that take time and experience to execute well. CrowdStrike Charlotte AI was built to change that model.

Enhanced Network Visibility: A Dive into the Falcon macOS Sensor's New Capabilities

The much-anticipated Enhanced Network Visibility feature for macOS is now generally available in sensor version 7.29 or later. This new capability provides insight and improved visibility into network traffic occurring on macOS endpoints, creating a more sophisticated and comprehensive model of process behavior. In this blog, we provide an in-depth overview of this new capability.

Falcon for XIoT Extends Asset Protection to Healthcare Environments

CrowdStrike Falcon for XIoT is extending its industry-leading protections to medical devices in healthcare environments. This will provide comprehensive security for patient care at a time when healthcare organizations are a key target for threat actors. As of January 2026, the HHS listed over 750 reported breaches within healthcare environments that were under investigation.

Falcon Next-Gen SIEM Simplifies Onboarding with Sensor-Native Log Collection

As organizations expand their SIEM footprint, data onboarding often becomes a bottleneck. Deploying log collectors at scale typically requires coordination across multiple teams, external software distribution systems, packaging workflows, and change-control approvals. All of this impedes visibility when speed is critical. Adversaries are breaking out to move laterally across environments in as little as 27 seconds, according to the CrowdStrike 2026 Global Threat Report.

Your AI Just Became the Insider Threat | CrowdStrike Global Threat Report 2026

Hackers can reach your critical systems in just 27 seconds. In 2025, AI-powered cyberattacks surged 89% as adversaries weaponized the same AI tools organizations use every day. From eCrime groups to China-nexus actors, North Korean operatives, and Russian intelligence, AI is accelerating and reshaping global threat activity. In this video, you’ll learn: Adversaries are not just using AI. They are weaponizing your AI against you.

Falcon Exposure Management Browser Extension Control: Demo Drill Down

Browser extensions are a growing and often unmanaged attack surface, with many requesting access to credentials, cookies, and sensitive browsing data. Most organizations rely on fragmented tools that lack centralized visibility and consistent enforcement. In this demo, see how Falcon Exposure Management introduces Browser Extension Control to define rule groups, configure allowlist or blacklist policies, and assign enforcement to host groups—all from the Falcon platform.

Turning Cloud Detections into Cross-Domain Defense

Modern breaches rarely stay confined to a single domain. Viewed in isolation, each step of an attack can appear routine. But connected, they reveal a coordinated attack in progress. This is where many existing security strategies fall short. Posture tools confirm configurations are correct. Traditional security information and event management (SIEM) solutions collect logs. But when an adversary uses valid credentials and native cloud capabilities, the challenge shifts from risk visibility to detecting and stopping active abuse across domains.

CrowdStrike Achieves NCSC CIR Assurance for Incident Response

CrowdStrike has been independently assessed and assured against the National Cyber Security Centre (NCSC) Cyber Incident Response (CIR) Standard, a UK government-backed standard designed to help organizations identify incident response providers with the capability, governance, and technical competence to manage serious cyber incidents.

CrowdStrike Falcon AI Detection and Response

Cyber threats are evolving faster than ever — and security teams need AI that doesn’t just detect threats, but understands and responds to them in real time. In this video, we explore CrowdStrike Falcon AI Detection and Response (AIDR) and how it transforms modern security operations. Powered by the CrowdStrike Falcon platform, AIDR leverages advanced artificial intelligence to automatically identify, categorize, and prioritize threats with speed and precision — helping SOC teams cut through alert noise and focus on what truly matters.