Extending Threat Hunting and MDR to AI
Together, Falcon Adversary OverWatch and Falcon Complete bring proactive threat hunting and expert-led response to the AI attack surface.
These attacks can be difficult to uncover because adversaries often blend malicious activity with legitimate administrative operations. Threat hunters need access to detailed cloud telemetry, an understanding of adversary techniques, and the context to connect suspicious events.
As organizations increasingly connect AI systems to sensitive data, applications, and infrastructure, adversaries have new opportunities to exploit trusted access and legitimate AI capabilities. According to the CrowdStrike 2026 Threat Hunting Report, AI agents triggered 2.5 times more detection leads than human activity, underscoring how AI-driven activity is increasing the volume and velocity of signals threat hunters must assess.
In addition to proactive threat hunting for AI applications and agents, CrowdStrike Falcon® Complete for Falcon Guardian extends 24/7 expert-led managed detection and response (MDR) to AI coding assistants and agents monitored by Falcon Guardian. Specialized analysts investigate malicious prompts, suspicious agent behavior, and threats involving AI tools and skills. Using CrowdStrike Agent Graph, analysts connect AI agent activity with downstream endpoint execution to assess the scope of threats and rapidly contain and remediate confirmed attacks.
Going Deeper in Google Cloud
Cloud environments remain a critical part of the modern attack surface. eCrime cloud-conscious activity surged 171% year-over-year as adversaries increasingly used stolen credentials, misconfigurations, and legitimate tools to operate across cloud infrastructure, the CrowdStrike 2026 Threat Hunting Report found.
With this expansion, Falcon Adversary OverWatch now delivers consistent, telemetry-driven managed threat hunting across AWS, Azure, and Google Cloud. This helps security teams uncover sophisticated threats across multi-cloud environments without managing separate hunting operations for each cloud.
Falcon Adversary OverWatch Cross-Domain now extends 24/7 proactive threat hunting to AI applications and autonomous agent activity monitored by CrowdStrike Falcon Guardian. By combining Falcon Guardian’s runtime context with telemetry across the Falcon platform and frontline adversary intelligence, CrowdStrike OverWatch hunters can uncover manipulation, abuse, and emerging adversary tradecraft that automated detections may miss. This broader context helps hunters connect suspicious AI activity to larger intrusions spanning identities, applications, and infrastructure.
With proactive AI threat hunting and deeper Google Cloud coverage, CrowdStrike is extending Falcon Adversary OverWatch’s visibility across the modern attack surface and connecting suspicious activity across domains to uncover and stop adversaries before they achieve their objectives.
Broader Hunting Coverage in a Single Offering
CrowdStrike is extending Falcon Adversary OverWatch’s advanced threat hunting capabilities to Google Cloud, delivering the same depth and precision of telemetry-driven hunting available in Amazon Web Services (AWS) and Microsoft Azure. By hunting directly on underlying cloud telemetry rather than relying solely on product-generated detections, CrowdStrike OverWatch hunters can identify suspicious activity earlier in the attack chain, including service account misuse, privilege escalation, and signs of lateral movement.
Falcon Adversary OverWatch analyzes 7 trillion events daily, surfaces more than 14 million detection leads, and delivers over 36,000 high-fidelity customer notifications each year. Backed by CrowdStrike intelligence on more than 290 tracked adversaries across nation-state, eCrime, and hacktivist groups, CrowdStrike OverWatch hunters know how adversaries operate, the techniques they use, and where to find them.
