CrowdStrike Extends the Agentic SOC to Detect and Stop the Agent Insider Threat
Business Wire•04/11/2026•04:00 ET
3
Key Highlights
- ➤CrowdStrike introduced Agent Insider Threat Detection for Falcon Next-Gen SIEM.
- ➤Coordinated multi-agent investigations are now generally available across endpoint, identity, SaaS, cloud, and network.
- ➤Falcon Guardian AI Kill Switch terminates rogue agents immediately.
- ➤Q4 innovations add AI ecosystem detections, expanded triage, approval controls, and AI credit visibility.
- ➤Federated search connectors expand to GovCloud, Dynatrace, Databricks, and Snowflake with no re-ingestion.
Expert Statements
Michael Sentonas, President of CrowdStrike
“AI agents can be both an insider threat and an adversary. One acts without authorization from inside your walls. The other is weaponized against you from outside. Stopping the insider means knowing the moment an agent turns, investigating across every domain, and shutting it down at machine speed. That's the next evolution of the agentic SOC.”
CrowdStrike Extends the Agentic SOC to Detect and Stop the Agent Insider Threat
New Agent Insider Threat Detection recognizes abnormal agent behavior even when no rule is broken; coordinated multi-agent investigations now generally available
Get started
Create a free account to read the full story.