CrowdStrike’s AI SOC vision evolves as agentic uncertainty adds new twist
CSO Online ·
“The software we use has become an actor,” declared CrowdStrike President Michael Sentonas in his address on the dangers and opportunity of agentic AI at the company’s Fal.Con conference in September. It’s an idea that until recently would have been dismissed as absurd, yet across cybersecurity it’s now taken as a given. For decades, the adversary has been nuisance hackers, professional cybercriminals, or well-resourced teams working for nation states. The arrival of rogue agents — underlined by real-world incidents such as OpenAI’s infamous assault on Hugging Face — has demolished this. Agents still work on behalf of humans, but they don’t always reason or act like them. They are entities with capabilities and an unpredictability unlike any threat businesses have ever faced. “I believe we just crossed a line. Agents have escaped evaluation environments and compromised infrastructure they were never supposed to touch,” Sentonas told the crowd in Las Vegas in early September. “For decades, software did what we programmed it to. It has moved from execution to agency.” Sentonas’ point wasn’t simply that malicious agents are a threat. The arrival of agentic AI also raises larger questions for security operations centers (SOCs), which will deploy agents on a scale that matches or even exceeds attackers. That makes agents a threat from both the outside and inside the enterprise perimeter. “What happens when millions of AI agents act at machine speed on both sides?” Behind the confident marketing pitches from CrowdStrike and a growing cast of rivals, the honest answer right now is that nobody can be sure. Coming from a cyber vendor, Sentonas’ reference to “millions” of agents might sound like a number meant to hype the threat. But it is likely no exaggeration, with Gartner forecasting that the number of agents used inside a single Fortune 500 company will expand from 15 in 2025 to 150,000 by 2028. “As CIOs and IT leaders see an explosion of AI agents across their organizations, many are contending with an ungoverned sprawl of agents that expose their organizations to a range of risks, including misinformation, oversharing, and data loss,” says Matt Goss, a senior director analyst at Gartner. Taking up the agent challenge For years, Fal.Con was about persuading enterprise SOCs to consolidate capabilities under CrowdStrike’s do-it-all Falcon platform, comprising nearly three dozen modules. In 2023, with its “Raptor” release, Falcon and the company’s flagship event took a hard turn toward AI . In this changed world, AI wasn’t simply a Falcon capability; increasingly it was Falcon, influencing everything it did. The AI theme dominated Falcon’s 2026 Fall release , bringing the company’s growing portfolio of AI SOC capabilities under the Falcon umbrella with the launch of the Agentic Security Platform. Most individual components — Charlotte AI AgentWorks, Model Context Protocol (MCP) Integration, the AI-enabled Enterprise Graph — were announced in 2025 as part of the company’s Agentic Security Workforce plan but a closer look reveals important new features. Currently, agents investigate alerts using pre-built Falcon agents or custom agents built using the no-code AgentWorks solution. Charlotte AI now gives these agents a shared memory layer in Enterprise Graph that enables them to coordinate with one another across multiple endpoints, identities, and cloud services simultaneously (aided by the company’s 2025 acquisition of Onum , which accelerated the speed with which agents can ingest data). On paper, the effect is to dramatically speed up alert triage while expanding the scope and capacity of worker agents in a way that relieves human SOC teams of a lot of basic grunt work, including some Level 2 investigation and Level 3 remediation and hunting workflows. Also new is SafeMind , a frontier red-teaming system based on Nvidia’s Nemotron open-weight LLM, comprising offense (Red Tempest) and defense (Blue Solano). This agentic framework continuously tests an isolated mirror of the live environment for weaknesses, feeding the results back into detection at the agent level. CrowdStrike didn’t invent the concept, but it does appear to be the first to integrate an autonomous testing model into a SOC platform. Speed is not enough This might look brand new, but the early incarnations of the agent-powered SOC are as much evolution as revolution. Everything inside a traditional CrowdStrike-powered SOC — from its Falcon EDR sensor, Enterprise Graph data, and cloud-native management — remains in place. Humans are still essential to decision-making, albeit at a higher level than before. What agents add to this SOC paradigm is a new abstraction layer separating SOC teams from the mass of telemetry they have increasingly struggled with. This should be good news for defenders because it means they have some hope of matching the speed and scale of agentic attacks. But speed is only the beginning, points out James Patrick, CTO for the FIOR Group, which develops an AI policy and security gateway. “Attackers and defenders can both operate at machine speed, so simply making SOCs faster isn’t enough. We need to move beyond reactive detection towards continuous testing of our defenses.” SOCs must work out how much they delegate to agents and what constraints are set around this. “Enterprises already struggle with fragmented telemetry, overlapping security products and inconsistent policies. Adding autonomous systems introduces another problem: establishing who or what has authority to act, and how to verify that authority,” says Patrick. According to Chris Cochran, field CISO and VP of AI security for the SANS Institute, that’s why “for most organizations, agentic AI will be augmentative rather than a replacement for analysts, at least for the next few years.” Agent platforms, including CrowdStrike’s, still have work to do proving themselves in terms of oversight and governance. “The core problem is that we’re applying a probabilistic technology to a discipline that usually requires determinism,” Cochran adds. “A SOC needs to know that the same input will produce the same action, and that the action can be explained to an auditor or an incident review board.” For that reason, Cochran believes that while agentic-powered SOCs will remove a huge amount of alert handling and correlation effort, the workload will shift to processes such as verification. “Teams should continuously evaluate agents against known-good and known-bad cases, the same way you’d regression test detection content,” he says. “None of this is exotic, but it takes engineering time that many SOCs haven’t budgeted for.” Enemy within One deeply unfamiliar problem is that agents themselves are an emerging attack surface within the enterprise and must be constantly assessed. Traditionally, security tools defend the environment, and the idea that an agent system doing the same job could itself become a direct threat is new. But what makes agentic AI unsettlingly is its non-deterministic nature, which means that, unlike a traditional security tool, it has the potential to do things you didn’t tell it to and haven’t planned for. “Organizations are deploying autonomous systems that access sensitive data, use privileged identities, interact with applications, and execute actions. Those agents can be compromised, manipulated, or behave unexpectedly,” says Tom Findling, CEO and cofounder at AI SOC startup Conifers.ai. “Security operations will need visibility into agent identities, permissions, actions, and decision-making processes, and the ability to detect and contain dangerous behavior.” CrowdStrike’s answer, relaunched at this year’s Fal.Con, is Falcon Guardian, an AI detection and response (AIDR) solution featuring runtime enforcement, agent discovery, execution graph mapping prompts, and quarantining for misbehaving agents. Similar capabilities will be needed for any agent platform but the mere fact that security systems now need their own security systems underscores what CrowdStrike’s Sentonas was referring to with his software-as-actor remark at Fal.Con. Human SOCs need to protect their enterprises from their AI SOC helpers. To that end, CrowdStrike yesterday announced the roughly $400 million acquisition of Fiddler AI , an AI agent monitoring and governance vendor from the emerging, burgeoning, and somewhat confusing agentic AI tools ecosystem . Fiddler’s platform tracks AI models’ behavior, attempting to provide explanations for their actions as a means for establishing a control plane for governing and securing them. Its 100-plus metrics track hallucinations, toxicity, personally identifiable information (PII) leakage, and drift, enforcing policies to protect against jailbreaks, prompt injections, and bias. Enterprises deploy tools like Fiddler to make model drift visible and actionable before it becomes systemic risk . CrowdStrike intends to bundle Fiddler into its flagship platform as Falcon Observe in Q4 FY2027, approximately six months from now, as a means for “proving businesses can safely use AI agents every day,” according to Sentonas’ post announcing the acquisition . CrowdStrike has invested heavily in agentic AI, building an impressive stack of capabilities that extend the Enterprise Graph that made it a dominant player capable of surviving the occasional embarrassing global hiccup . It has even embraced a degree of openness, allowing data ingestion, API connectors, and partnership gateways to enrich the data going into its Falcon AIDR. However, there’s no getting away from Falcon as the single control plane. “CrowdStrike starts with endpoint security and an established enterprise security platform. Other vendors approach the problem through identity, networks, cloud, or security analytics. They all have an incentive to bring customers further into their own platforms,” observes FIOR Group’s Patrick. “The challenge for CrowdStrike, and for every vendor, is that a platform can’t independently verify itself,” he adds. “What’s needed is control that is genuinely independent of any single platform and works across those boundaries.” According to Patrick, a critical feature will be the ability not simply to deploy a security layer but to continuously assess its security and performance. As the traditional detection and remediation stack of cybersecurity is pushed out of shape, the growth in new layers and processes could make this task almost as demanding as the main job of cyber defense that agents were supposed to simplify.