CrowdStrike Expands Managed Threat Hunting to AI Agents and Google Cloud
Summary
CrowdStrike announced 24/7 threat hunting for AI applications and agents, plus telemetry-driven hunting for Google Cloud. Its Falcon Complete service also adds expert-led detection and response for AI-related threats.
Key points
- Falcon Adversary OverWatch now provides 24/7 proactive hunting for AI applications and autonomous agent activity monitored by Falcon Guardian.
- CrowdStrike says OverWatch hunters combine Falcon Guardian runtime context with platform telemetry and threat intelligence to investigate AI manipulation, abuse, and suspicious activity.
- Falcon Complete for Falcon Guardian extends expert-led managed detection and response to AI coding assistants and agents; analysts investigate suspicious behavior and can contain and remediate confirmed attacks.
- CrowdStrike Agent Graph connects AI agent activity with downstream endpoint execution to help assess threat scope.
- OverWatch now hunts directly on Google Cloud telemetry, including for service-account misuse, privilege escalation, and signs of lateral movement.
- CrowdStrike says the expanded service provides managed threat hunting across AWS, Azure, and Google Cloud without separate hunting operations for each cloud.
Article Details
- Event Type
- CrowdStrike announced expanded managed threat hunting and detection-and-response coverage for AI applications and autonomous agents, plus telemetry-driven hunting for Google Cloud.
- Impact
- The announcement extends Falcon Adversary OverWatch hunting across AI activity and Google Cloud, and extends Falcon Complete for Falcon Guardian managed detection and response to AI coding assistants and agents monitored by Falcon Guardian. CrowdStrike says the expanded coverage is intended to help connect suspicious activity across identities, applications, endpoints, and cloud infrastructure. The article cites the CrowdStrike 2026 Threat Hunting Report as finding that AI agents triggered 2.5 times more detection leads than human activity and that eCrime cloud-conscious activity rose 171% year over year.
Vendors
Products
AWSdelivering the same depth and precision of telemetry-driven hunting available in Amazon Web Services (AWS) and Microsoft Azure.Azuresame depth and precision of telemetry-driven hunting available in Amazon Web Services (AWS) and Microsoft Azure.CrowdStrike Agent GraphUsing CrowdStrike Agent Graph, analysts connect AI agent activity with downstream endpoint execution to assess the scope of threats and rapidly contain and remediate confirmed attacks.CrowdStrike Falcon GuardianFalcon Adversary OverWatch Cross-Domain now extends 24/7 proactive threat hunting to AI applications and autonomous agent activity monitored by CrowdStrike Falcon Guardian.Falcon Adversary OverWatchThis expansion builds on our recent launch of Falcon Adversary OverWatch Cross-Domain, which extends 24/7 managed threat hunting across identity, cloud, AI agent activity, SaaS applications, and third-party data.Google Cloudagent activity through CrowdStrike Falcon® Guardian, and deeper, telemetry-driven hunting for Google Cloud.