The Pulse
CrowdStrike Adds AI Workload Protection to Falcon Cloud Security
CrowdStrike’s latest Falcon Cloud Security innovations cover software supply chains, cloud detection and AI workloads. The updates connect security from development through runtime, combining cloud risk and application context with real-tim
AI.info Team · Written with AI · fact-checked ·
CrowdStrike says its latest Falcon Cloud Security innovations, all generally available as of November 4, 2026, cover software supply chains, cloud detection and AI workloads. The company says the features connect security from development through runtime, using cloud risk and application context alongside real-time threat detection. Falcon Cloud Security is powered by adversary intelligence tracking more than 290 adversaries and runs on the Falcon platform, which connects endpoint and identity protection with security operations. The company says that context built before an attack can also help analysts respond to one.
Screening software before it reaches production
The announcement highlights compromised open-source dependencies as a risk in automated builds, where AI coding agents can pull packages into projects faster than security teams can review them. CrowdStrike says it observed ALTERED SPIDER compromise more than 300 software dependencies in a single day. As CrowdStrike author Brett Shaw writes:
A compromised dependency does not need a CVE to be dangerous, which means vulnerability scanning alone can miss the threat.
— Brett Shaw, author of the CrowdStrike post
Supply Chain Security for Cloud scans container images for compromised npm and PyPI packages during CI/CD and registry checks. It reassesses previously scanned images when new threats are confirmed and identifies affected containers already running. At deployment, the Falcon Kubernetes Admission Controller can alert on or block compromised images under image-assessment policies. Together, endpoint and cloud protection connect the defense from package download through deployment.
More cloud assets, tied to application risk
Falcon Cloud Security’s Cloud Risks coverage now includes Microsoft Azure and Google Cloud, connecting exposures with effective permissions, vulnerabilities and sensitive-data context. Agentless Vulnerability Scanning for Google Cloud adds vulnerability and malware discovery for Linux-based Google Compute Engine instances without an additional sensor. Expanded OCI inventory adds infrastructure, identities and secrets to the environment Falcon Cloud Security can assess.
Expanded Application Security Posture Management brings containerized applications into Application Explorer with workload and cloud context. CrowdStrike says that lets teams evaluate an application alongside risks such as an internet-exposed Kubernetes workload running code with a remote code-execution vulnerability. New package exports link vulnerable dependencies to associated applications, helping teams assess the potential impact and plan remediation across the application fleet. Enhanced third-party API findings identify external payment-service integrations and the operations applications invoke, helping teams assess exposure if a provider is compromised and uncover unauthorized integrations.
Cloud detection expands to Azure and Kubernetes
Real-Time Cloud Detection and Response now extends to Microsoft Azure and Kubernetes, adding to existing AWS and Google Cloud coverage. Falcon Cloud Security analyzes cloud audit activity as it streams and applies detection logic informed by CrowdStrike’s adversary intelligence. The company says detections can appear in seconds, with identity, asset, workload, endpoint and adversary context available to analysts in the Falcon console.
Analysts can deny credentials or shut down compromised instances from that console, or automate those actions with CrowdStrike Charlotte Agentic SOAR. New detections combine Cloud Indicators of Attack with posture insights, including dormant identities, elevated privileges, public exposure and sensitive data. AI-based Anomaly Detection uses a customer-specific machine-learning model to assess deviations involving identities, APIs and resources across multiple events; the feature is now available for AWS CloudTrail.
AI protection reaches prompts and development environments
Falcon Container Sensor and Falcon Guardian support for Anthropic APIs extends runtime detection to the prompt layer for supported AI workloads. CrowdStrike describes the capability as a way to identify threats in AI interactions while maintaining a unified view of the environment. Separate additions bring Google Cloud Workstations into Falcon Cloud Security’s visibility, detection and response workflows, and expand AWS Bedrock AgentCore inventory to cover managed infrastructure supporting AI applications.
The announcement also describes extensions for regulated and specialized cloud environments. In US-GOV-1 and US-GOV-2, Falcon Cloud Security adds cloud detections, detection-rule management and Falcon Next-Gen SIEM workflows, including Kubernetes audit-log detections for Amazon EKS, Azure AKS and Google GKE.