CrowdStrike Extends the Agentic SOC to Detect and Stop the Agent Insider Threat

CrowdStrike Extends the Agentic SOC to Detect and Stop the Agent Insider Threat AUSTIN, Texas & BARCELONA, Spain--( BUSINESS WIRE)--Fal.Con Europe 2026 -- CrowdStrike (NASDAQ: CRWD) today introduced agentic SOC innovations to detect the new insider threat: enterprise AI agents that act faster than any human can respond. Agent Insider Threat Detection exposes abnormal agent behavior and routes deviations into coordinated, multi-agent investigations that run across every domain at the same time. The verdict lands in seconds, and the new Falcon Guardian AI Kill Switch terminates the agent immediately.

“AI agents can be both an insider threat and an adversary,” said Michael Sentonas, president of CrowdStrike. “One acts without authorization from inside your walls. The other is weaponized against you from outside. Stopping the insider means knowing the moment an agent turns, investigating across every domain, and shutting it down at machine speed. That's the next evolution of the agentic SOC.”

The Threat on Your Payroll

Organizations are deploying thousands of AI agents, each with system-level access to sensitive data and the autonomy to act on it. You pay this insider in tokens. Every day, we see agents take actions they were never authorized to take. The hardest case is the agent that is manipulated or drifts from its intended behavior and never breaks a rule. Policy and log-based tools miss it because there is no violation to catch, and they can’t tell a rogue agent from the person running it.

Agent Insider Threat Detection in Falcon Next-Gen SIEM learns the normal behavior of every AI agent and the person who runs it and flags deviations even when no policy is violated. The detection routes directly into coordinated investigations where expert-trained agents work simultaneously across endpoint, identity, SaaS, cloud, and network. Shared context across every domain and agents trained on years of stopping breaches separate real threats from noise, turning a deviation into a verdict defenders can trust at machine speed. Unveiled at Fal.Con U.S. in September 2026, coordinated multi-agent investigations are now generally available, with new innovations coming soon.

Available Today

Introducing Agent Insider Threat Detection and New Innovations

The Next Evolution of the Agentic SOC

The agent is the insider threat, the adversary, and the defender. The agentic SOC detects it, investigates it, and stops it at machine speed.

To learn more about Agent Insider Threat Detection and CrowdStrike’s agentic SOC innovations, visit here.

About CrowdStrike

CrowdStrike (NASDAQ: CRWD), a global cybersecurity leader, has redefined modern security with the world’s most advanced cloud-native platform for protecting critical areas of enterprise risk – endpoints and cloud workloads, identity and data.

Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon® platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft, and enriched telemetry from across the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting, and prioritized observability of vulnerabilities.

Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity, and immediate time-to-value.

CrowdStrike: We stop breaches.

Learn more: https://www.crowdstrike.com/

Start a free trial today: https://www.crowdstrike.com/trial

© 2026 CrowdStrike, Inc. All rights reserved. CrowdStrike and CrowdStrike Falcon are marks owned by CrowdStrike, Inc. and are registered in the United States and other countries. CrowdStrike owns other trademarks and service marks and may use the brands of third parties to identify their products and services.

Forward-Looking Statements

This release includes discussion of unreleased services or features. Any unreleased services or features referenced here are still in development and subject to change. Customers should make their purchase decisions based upon features that are currently available.