CrowdStrike Adds Supply-Chain and AI Workload Protections to Falcon Cloud Security
Summary
CrowdStrike says generally available Falcon Cloud Security updates add supply-chain scanning, expanded cloud-risk visibility, real-time detections across Azure and Kubernetes, AI anomaly detection, and protection for AI and specialized workloads.
Key points
- Supply Chain Security for Cloud scans npm and PyPI packages in CI/CD pipelines and registries, reassesses images as threats are confirmed, and identifies affected running containers.
- The Falcon Kubernetes Admission Controller can alert on or block compromised images before deployment.
- Cloud Risks coverage expands to Azure and Google Cloud; other updates add agentless vulnerability scanning for Google Compute Engine and expanded OCI inventory.
- Real-Time CDR extends to Azure and Kubernetes, analyzing streaming cloud audit activity; responders can deny credentials or shut down instances.
- AI-based Anomaly Detection learns customer baselines and evaluates deviations involving identities, APIs, and resources; it is available for AWS CloudTrail.
- Falcon Container Sensor and Falcon Guardian support for Anthropic APIs adds prompt-layer detection for supported AI workloads; other updates cover Google Cloud Workstations and AWS Bedrock AgentCore inventory.
Article Details
- Event Type
- General availability announcement for new and expanded cloud security capabilities.
- Impact
- The announced Falcon Cloud Security capabilities span software supply-chain scanning, cloud risk and asset visibility, real-time cloud detection and response, AI workload protection, and government and specialized environments. They are intended to help organizations identify compromised dependencies and cloud threats, assess exposure, and respond faster. CrowdStrike says all the announced innovations are generally available.
Threat Actors
Vendors
Amazon Web ServicesCrowdStrike is extending Real-Time CDR to Microsoft Azure and Kubernetes, building on existing coverage for AWS and Google Cloud.AnthropicFalcon Container Sensor and Falcon Guardian support for Anthropic APIs extends runtime detection to the prompt layer for supported AI workloads to help teams identify threats in AI interactions while maintaining aCrowdStrikeCrowdStrike Falcon® Cloud Security is built for this.GoogleCloud Risks coverage in Falcon Cloud Security now extends to Microsoft Azure and Google Cloud, where it connects exposure, effective permissions, vulnerabilities, and sensitive data context to identify high-riskIBMDaemonSet support for Red Hat OpenShift on IBM Z and IBM LinuxONE, along with DaemonSet sensor support for Ubuntu Kairos, extends workload protection to specialized infrastructure.MicrosoftCloud Risks coverage in Falcon Cloud Security now extends to Microsoft Azure and Google Cloud, where it connects exposure, effective permissions, vulnerabilities, and sensitive data context to identify high-riskRed HatDaemonSet support for Red Hat OpenShift on IBM Z and IBM LinuxONE, along with DaemonSet sensor support for Ubuntu Kairos, extends workload protection to specialized infrastructure.
Products
Amazon Bedrock AgentCoreExpanded AWS Bedrock AgentCore inventory complements that protection with visibility into the managed infrastructure supporting AI applications.Amazon Elastic Kubernetes ServiceFalcon® Next-Gen SIEM workflows to GovCloud, including Kubernetes audit-log detections across Amazon EKS, Azure AKS, and Google GKE.Azure Kubernetes ServiceNext-Gen SIEM workflows to GovCloud, including Kubernetes audit-log detections across Amazon EKS, Azure AKS, and Google GKE.CrowdStrike Falcon GuardianFalcon Container Sensor and Falcon Guardian support for Anthropic APIs extends runtime detection to the prompt layer for supported AI workloads to help teams identify threats in AI interactions while maintaining aCrowdStrike Falcon platformIt runs on the same CrowdStrike Falcon platform that connects endpoint and identity protection with SOC operations, extending protection from developer endpoints and software supply chains to cloud workloads.Falcon Cloud SecurityThe latest Falcon Cloud Security innovations, all now generally available, put this advantage to work from build to runtime.Falcon Container SensorFalcon Container Sensor and Falcon Guardian support for Anthropic APIs extends runtime detection to the prompt layer for supported AI workloads to help teams identify threats in AI interactions while maintaining aFalcon Kubernetes Admission ControllerAt deployment, the Falcon Kubernetes Admission Controller uses image assessment policies to alert on or block compromised images before they reach production.Google CloudCloud Risks coverage in Falcon Cloud Security now extends to Microsoft Azure and Google Cloud, where it connects exposure, effective permissions, vulnerabilities, and sensitive data context to identify high-riskGoogle Cloud WorkstationsWorkload protection for Google Cloud Workstations brings cloud development environments into Falcon Cloud Security visibility, detection, and response workflows.Google GKESIEM workflows to GovCloud, including Kubernetes audit-log detections across Amazon EKS, Azure AKS, and Google GKE.Microsoft AzureCloud Risks coverage in Falcon Cloud Security now extends to Microsoft Azure and Google Cloud, where it connects exposure, effective permissions, vulnerabilities, and sensitive data context to identify high-risk