CrowdStrike Extends OverWatch Threat Hunting to AI Agents and Google Cloud
CrowdStrike has added two capabilities to its Falcon Adversary OverWatch managed threat hunting service: 24/7 hunting for AI applications and autonomous agent activity through Falcon Guardian, and deeper, telemetry-driven hunting for Google Cloud. The company says the aim is to keep detection coverage in step with adversaries who operate across cloud, identity, SaaS and AI systems.
- CrowdStrike added 24/7 managed hunting for AI applications and autonomous agent activity via Falcon Guardian to Falcon Adversary OverWatch.
- The update also brings deeper, telemetry-driven threat hunting for Google Cloud.
- It builds on Falcon Adversary OverWatch Cross-Domain, which spans identity, cloud, AI agent activity, SaaS and third-party data.
- CrowdStrike says customers no longer need separate threat hunting SKUs for each eligible module or domain.
- The CrowdStrike 2026 Threat Hunting Report found AI agents triggered 2.5 times more detection leads than human activity.
What CrowdStrike added
According to CrowdStrike, the expansion brings two key capabilities to Falcon Adversary OverWatch. The first is round-the-clock managed hunting for AI applications and autonomous agent activity, delivered through CrowdStrike Falcon Guardian. The second is deeper hunting for Google Cloud that is driven by telemetry.
The update builds on the recent launch of Falcon Adversary OverWatch Cross-Domain. CrowdStrike says that offering extends 24/7 managed threat hunting across identity, cloud, AI agent activity, SaaS applications and third-party data. It gives OverWatch threat hunters broader visibility across the CrowdStrike Falcon platform and, the company says, removes the need for customers to buy separate threat hunting SKUs for each eligible module or domain.
How an AI-enabled intrusion could unfold
CrowdStrike illustrates the problem with a hypothetical scenario. An intrusion starts with a compromised identity provider session after a phishing attack. The adversary could register a rogue Quick Emulator (QEMU) device with the organization's multifactor authentication (MFA) solution, gain persistent access and move into connected SaaS applications.
From there, the adversary could reach Claude through the compromised identity. CrowdStrike describes how the attacker could use the LLM to enumerate connected applications and local files, generate scripts to collect credentials, and scan skill repositories and agentic infrastructure. The intrusion could end with a command-and-control (C2) backdoor linking a compromised endpoint to adversary infrastructure.
CrowdStrike's point is that the identity compromise, the suspicious AI interactions and the endpoint execution may look unrelated when viewed on their own. Together they show an intrusion spanning several environments, which is why, in the company's words, OverWatch hunters need cross-domain visibility.
Why AI activity matters to threat hunters
CrowdStrike notes that organizations are increasingly connecting AI systems to sensitive data, applications and infrastructure, which gives adversaries new chances to exploit trusted access and legitimate AI capabilities.
The company cites its 2026 Threat Hunting Report, which found that AI agents triggered 2.5 times more detection leads than human activity. CrowdStrike says this shows how AI-driven activity is raising both the volume and the velocity of signals that threat hunters have to assess.
The source text, which was truncated, states that Falcon Adversary OverWatch Cross-Domain now extends 24/7 proactive threat hunting to AI applications and autonomous agent activity monitored by CrowdStrike's tooling.
What it means for customers
For security teams, the change is mainly about coverage and packaging. Hunting that spans identity, cloud, SaaS, AI agent activity and third-party data under one cross-domain offering means signals from different parts of the attack surface can be connected by the same team of hunters. According to CrowdStrike, customers also do not need to purchase a separate threat hunting SKU for each eligible module or domain.
The Google Cloud addition targets organizations running workloads there, while the Falcon Guardian-based hunting is aimed at those deploying AI applications and autonomous agents. The source does not give pricing or availability details.
