Global – October 31, 2026 -- CrowdStrike has extended Falcon Adversary OverWatch managed threat hunting to AI applications and autonomous agents monitored by Falcon Guardian, and added telemetry-driven hunting for Google Cloud, bringing its coverage of the three major public clouds in line.
OverWatch Cross-Domain now covers AI agent activity around the clock
Falcon Adversary OverWatch Cross-Domain now provides 24/7 proactive hunting across AI applications and agent activity monitored by Falcon Guardian. Hunters combine Guardian's runtime context with Falcon platform telemetry and frontline adversary intelligence to find manipulation, abuse and emerging tradecraft that automated detections may miss.
The move follows the recent launch of OverWatch Cross-Domain, which covers identity, cloud, AI agent activity, SaaS applications and third-party data. CrowdStrike says customers no longer need to buy separate threat hunting SKUs for each eligible module or domain.
The company cites its 2026 Threat Hunting Report, which found that AI agents triggered 2.5 times more detection leads than human activity.
Falcon Complete adds managed response for AI coding assistants
CrowdStrike Falcon Complete for Falcon Guardian extends 24/7 managed detection and response to AI coding assistants and agents. Specialized analysts investigate malicious prompts, suspicious agent behavior and threats involving AI tools and skills. Using CrowdStrike Agent Graph, they link AI agent activity to downstream endpoint execution to assess scope, then contain and remediate confirmed attacks.
Attack scenario shows how AI can link identity, SaaS and endpoint compromise
CrowdStrike describes a hypothetical intrusion that starts with a compromised identity provider session after phishing. The adversary registers a rogue QEMU device with the organization's MFA solution, gains persistent access and pivots into SaaS applications. The attacker could then use Claude to enumerate connected applications and local files, generate credential-collection scripts and scan skill repositories and agentic infrastructure, before installing a command-and-control backdoor on an endpoint. Each stage can look unrelated when viewed alone.
Google Cloud hunting matches AWS and Azure depth
OverWatch hunters now work directly on underlying Google Cloud telemetry rather than relying only on product-generated detections. CrowdStrike says this surfaces activity earlier in the attack chain, including service account misuse, privilege escalation and signs of lateral movement.
Falcon Adversary OverWatch now offers consistent, telemetry-driven managed hunting across AWS, Azure and Google Cloud. Security teams in multi-cloud environments do not need to run separate hunting operations for each cloud.
The 2026 Threat Hunting Report found that eCrime cloud-conscious activity rose 171% year over year. Adversaries increasingly used stolen credentials, misconfigurations and legitimate tools, and blended malicious actions with routine administrative operations.
OverWatch operates at 7 trillion events a day
Falcon Adversary OverWatch analyzes 7 trillion events daily, surfaces more than 14 million detection leads and issues over 36,000 high-fidelity customer notifications each year. Its hunters draw on intelligence covering more than 290 tracked nation-state, eCrime and hacktivist adversaries.