CrowdStrike Extends Managed Threat Hunting to AI Tools and Google Cloud

CrowdStrike has added two capabilities to its Falcon Adversary OverWatch managed threat hunting service. The first is 24/7 hunting for AI applications and autonomous agent activity through CrowdStrike Falcon Guardian. The second is deeper, telemetry-driven hunting for Google Cloud. CrowdStrike says the change responds to attackers widening their operations across cloud environments, identities, SaaS applications and AI systems.

The update builds on the recent launch of OverWatch Cross-Domain, which extends managed hunting across identity, cloud, AI agent activity, SaaS applications and third-party data. CrowdStrike says this gives its hunters broader visibility and removes the need for customers to buy separate threat hunting products for each eligible module or domain.

To show why this matters, CrowdStrike describes a hypothetical intrusion. It starts with a phishing attack that compromises an identity provider session. The attacker registers a rogue device with the organisation's multifactor authentication, keeps persistent access and moves into connected SaaS applications. From there, the attacker could use an AI assistant reached through the stolen identity to list connected applications and files, generate scripts to collect credentials, and scan agentic infrastructure, before installing a backdoor on an endpoint. CrowdStrike notes that each step may look unrelated on its own, but together they reveal one intrusion spanning several environments.