Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CrowdStrike is expanding CrowdStrike Falcon Next-Gen SIEM to support third-party endpoint detection and response (EDR) solutions — beginning with Microsoft Defender — with no Falcon sensor required. This evolution will enable organizations to modernize their SOC without replacing existing endpoint agents. Adversaries are moving faster than ever, exploiting cross-domain gaps across endpoint, identity, network, and cloud.

While investigating a spike in script execution detections across several CrowdStrike Falcon platform customers, CrowdStrike’s Engineering team traced the activity to a compromised GitHub Action named aquasecurity/trivy-action. This popular open-source vulnerability scanner is frequently used in CI/CD pipelines.

The biggest challenge for developers building AI applications is no longer the translation of user intent into action, but rather limiting its scope to stay within stated business goals and prevent abuse. This challenge has moved from theoretical to mission-critical as AI agents transition from experimental projects to mainstream business tools, where a single compromised agent can expose customer data, execute unauthorized transactions, or violate compliance requirements across thousands of interactions.

At Fal.Con Gov 2026, CrowdStrike is introducing new innovations to accelerate modernization and strengthen cyber defense of government systems, while helping agencies meet some of the most rigorous compliance standards within a FedRAMP-authorized environment. Cybersecurity is national security. Ransomware threatens public safety and continuity of operations. Supply chain compromise multiplies impact. Nation-state actors target critical infrastructure for strategic disruption.

CrowdStrike Falcon Platform for Government, our FedRAMP High authorized offering, has expanded to include CrowdStrike Falcon for XIoT. This addition delivers native XIoT visibility and protection through the CrowdStrike Falcon platform so government agencies can protect connected assets and critical infrastructure.

Security teams are being asked to do more than ever, often with fewer people and less time. As alert volumes continue to rise and adversaries automate their attacks, even mature SOCs struggle to keep pace. Legacy tools surface signals, but they still leave analysts responsible for triage, investigation, and response decisions that take time and experience to execute well. CrowdStrike Charlotte AI was built to change that model.

The much-anticipated Enhanced Network Visibility feature for macOS is now generally available in sensor version 7.29 or later. This new capability provides insight and improved visibility into network traffic occurring on macOS endpoints, creating a more sophisticated and comprehensive model of process behavior. In this blog, we provide an in-depth overview of this new capability.

CrowdStrike Falcon for XIoT is extending its industry-leading protections to medical devices in healthcare environments. This will provide comprehensive security for patient care at a time when healthcare organizations are a key target for threat actors. As of January 2026, the HHS listed over 750 reported breaches within healthcare environments that were under investigation.

As organizations expand their SIEM footprint, data onboarding often becomes a bottleneck. Deploying log collectors at scale typically requires coordination across multiple teams, external software distribution systems, packaging workflows, and change-control approvals. All of this impedes visibility when speed is critical. Adversaries are breaking out to move laterally across environments in as little as 27 seconds, according to the CrowdStrike 2026 Global Threat Report.

CrowdStrike has been independently assessed and assured against the National Cyber Security Centre (NCSC) Cyber Incident Response (CIR) Standard, a UK government-backed standard designed to help organizations identify incident response providers with the capability, governance, and technical competence to manage serious cyber incidents.