May 2026 Summaries

CrowdStrike has been recognized as a leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection for the seventh consecutive time, emphasizing its pioneering vision and execution in cybersecurity. The company's AI-native platform is highlighted for its ability to tackle sophisticated threats by maintaining deep runtime visibility and control across endpoints, which are critical as agentic applications become more prevalent. CrowdStrike's approach to endpoint security involves enforcing dynamic, risk-aware access controls and securing AI systems and data across various environments. Their Falcon platform has received high customer satisfaction, with a 97% recommendation rate, and achieved 100% detection and protection in MITRE ATT&CK® Enterprise Evaluations, reinforcing its status as a leader in the industry.

CrowdStrike's blog highlights the growing risks and challenges associated with "shadow AI," as enterprises rapidly adopt AI tools often without adequate security measures. It emphasizes the emergence of AI-specific threats like prompt injection, which can manipulate AI systems into unintended actions, and highlights the inadequacy of traditional security tools that were not designed to handle the complexities of AI interactions. The blog advocates for a purpose-built approach to security, such as the CrowdStrike Falcon® AI Detection and Response (AIDR), which provides comprehensive visibility, control, and protection across endpoints, identities, cloud, and AI environments. It urges organizations to assess their exposure to shadow AI, establish governance with clear policies, and integrate controls to manage AI-related risks effectively, ensuring that AI's business value is harnessed without expanding the attack surface.

CrowdStrike has been recognized as a leader in the Identity Threat Detection and Response (ITDR) market by Frost & Sullivan and GigaOm, highlighting its significant role in advancing continuous identity security systems. Frost & Sullivan named CrowdStrike its Company of the Year for ITDR, emphasizing the importance of providing identity security through a unified, real-time control system that integrates cloud-native architecture, thereby enabling comprehensive visibility and automated responses across human, non-human, and AI identities. GigaOm's evaluation praises CrowdStrike's execution and momentum, noting its high scores in key features, emerging features, and business criteria. The CrowdStrike Falcon® platform is acclaimed for its seamless integration, operational efficiency, and capacity to manage identity threats across various environments, including cloud and SaaS applications. The platform's AI-enhanced capabilities, such as Charlotte AI and Falcon Fusion SOAR, allow for efficient automation of threat detection and response, making CrowdStrike well-positioned to lead the market shift towards a continuous identity security model.

CrowdStrike executed a coordinated takedown of the Glassworm botnet on May 26, 2026, which had been targeting software developers through the open-source supply chain. This global operation, conducted in collaboration with Google and the Shadowserver Foundation, simultaneously disrupted all four of Glassworm's command-and-control channels, effectively preventing the botnet from delivering new malicious payloads. Glassworm's sophisticated infrastructure relied on resilient channels, including blockchain and peer-to-peer networks, to avoid traditional takedown efforts, highlighting a significant shift in the threat landscape where adversaries target developers rather than just products. The campaign underscored the vulnerabilities in software supply chains, as attackers leveraged compromised developer tools and credentials to execute supply-chain compromises affecting numerous organizations. The operation sets a precedent for proactive and collaborative disruption of cyber threats, emphasizing the need for ongoing vigilance and collaboration among security vendors, law enforcement, and tech companies to mitigate the risks posed by such sophisticated cyber threats.

Organizations are increasingly incorporating AI into their operations, which necessitates a shift in governance practices to ensure secure, efficient, and innovative use of these technologies. Leaders are encouraged to create "paved roads," or secure, pre-approved pathways that integrate security controls and automated protections into AI workflows, thus enabling rapid innovation within safe parameters. To effectively measure AI-enabled success, three key performance indicators (KPIs) are recommended: the time from idea to production deployment, employee adoption rates of approved AI tools, and the number and severity of security incidents prevented. These KPIs collectively ensure that as deployment speed increases, employee adoption rises, and security incidents decrease, organizations can successfully balance speed and security, transforming potential bottlenecks into competitive advantages. Establishing baselines, implementing secure pathways, and continuously optimizing based on real data are crucial steps for organizations seeking to win with AI by aligning security and innovation efforts.

CrowdStrike has integrated the Claude Compliance API into its Falcon platform, enhancing real-time visibility and automated response capabilities for AI-driven activities. This integration aims to address the challenges posed by the increasing use of AI, which expands the attack surface due to shadow AI, unmonitored data flows, and over-permissioned access. By incorporating Claude activity with existing security telemetry through Falcon Next-Gen SIEM, security teams can correlate AI usage data with other signals to form a comprehensive threat landscape. The integration allows for automated responses using the Charlotte Agentic SOAR, enabling immediate action on AI-driven risks by triggering investigation and response workflows without human intervention. This advancement is part of CrowdStrike's broader strategy to secure AI across various environments, thus allowing organizations to adopt AI securely while minimizing risks.

Infostealers are a prominent and stealthy type of malware that infiltrates devices to steal sensitive information such as login credentials, session tokens, financial data, and browser-stored details, often going undetected while transmitting this data to cybercriminals. These malicious programs pose significant risks, including identity theft through session hijacking, where attackers impersonate users without needing passwords or multifactor authentication, leading to potential data breaches, financial losses, and long-term reputational damage for organizations. Traditional security solutions, including extension-based tools, often fall short in countering these advanced threats due to their limited access and reactive nature. CrowdStrike offers a proactive solution by integrating directly into the browser environment, enabling real-time monitoring and protection of session tokens and browser-stored data, providing comprehensive identity security, and preventing unauthorized data exfiltration through advanced behavioral analytics and machine learning.

CrowdStrike's 2026 Financial Services Threat Landscape Report reveals a complex threat environment for financial services, marked by increased eCrime and nation-state adversary activities. The report indicates that the financial sector is the fourth most-targeted globally, accounting for 12% of observed cyber activities, with eCrime actors like MUTANT SPIDER and nation-state groups, particularly from North Korea, intensifying their operations. North Korean groups stole $2.02 billion in digital assets in 2025, and China-nexus adversaries focused on intelligence collection in South and Southeast Asia. The report highlights a 43% global increase in hands-on-keyboard intrusions against financial institutions, emphasizing the need for intelligence-led visibility and rapid response capabilities. CrowdStrike's Counter Adversary Operations leverages threat intelligence and the AI-powered Falcon platform to detect and disrupt sophisticated threats, underscoring the evolving threat landscape and the importance of proactive defense strategies.

CrowdStrike has introduced Falcon AI Detection and Response (AIDR) to address the emerging class of AI-specific threats, particularly prompt injection attacks in Kubernetes-hosted AI applications, which traditional security tools struggle to detect. These attacks exploit the prompt layer—where AI applications interact with large language models (LLMs)—as a new attack surface, bypassing conventional detection methods due to their operation through natural language and context. Falcon AIDR provides runtime visibility and detection by analyzing prompts and LLM responses without the need for proxies or architectural changes, thereby identifying malicious intent within natural language interactions and securing AI workloads against data breaches and policy violations. This capability integrates seamlessly with CrowdStrike's Falcon Container Sensor and Next-Gen SIEM, correlating AI detections with identity, endpoint, and container telemetry to offer comprehensive attack context.

In May 2026, Microsoft's Patch Tuesday addressed 130 vulnerabilities, with 30 classified as critical, which is a notable decrease from April's 164 vulnerabilities. Key risk types include elevation of privilege, remote code execution, and information disclosure, with the majority of patches applied to Microsoft Windows, Office, and Azure. Critical vulnerabilities identified include issues in Azure DevOps, Azure Managed Instance for Apache Cassandra, Microsoft Dynamics 365, Windows Netlogon, and Windows DNS Client, among others. Microsoft has proactively addressed several vulnerabilities within its cloud infrastructure, often not requiring customer intervention, though some, like those affecting Microsoft Dynamics 365 and Windows Netlogon, require customers to deploy official fixes. The importance of having a robust cybersecurity strategy is underscored, as not all significant vulnerabilities can be quickly patched, and mitigation strategies may be necessary when immediate patches are unavailable. The CrowdStrike Falcon platform provides tools for exposure management and cybersecurity improvement, offering visibility and prioritization of vulnerabilities.

CrowdStrike's Automated Leads feature, part of its Falcon platform, represents a significant advancement in threat detection by utilizing self-learning AI models to identify subtle attack indicators that traditional alert systems might miss. This innovative approach focuses on entity-based scoring, assigning scores to detection events and correlating them by entity, such as an endpoint, to prioritize potential threats without overwhelming analysts with noise. The system excels at detecting unusual behaviors, like anomalous remote monitoring tool usage, by scoring and correlating multiple indicators across hosts, thereby surfacing malicious activity as a collective cluster of behaviors. Additionally, the new "Investigate Unusual Processes" capability enhances this by flagging only the most atypical process creations, streamlining the investigation of suspicious activities. This solution offers continuous intelligence, simplifying the identification of genuine threats in a sea of routine data across multiple operating systems, thus empowering security teams to focus on critical activities without sifting through benign events.

CrowdStrike has been recognized as a leader in the first-ever Gartner Magic Quadrant for Cyberthreat Intelligence Technologies, credited for its comprehensive vision and innovative approach in threat intelligence. This accolade underscores the company's commitment to providing advanced cybersecurity solutions through its AI-native CrowdStrike Falcon platform, which offers tailored adversary intelligence to enhance detection and response capabilities. The company's Threat AI system, designed to counter AI-powered adversaries, automates complex security tasks and delivers intelligence at decision-making points, helping organizations to quickly identify and mitigate threats. CrowdStrike's intelligence is extensively validated, sourced from a vast array of daily events and external data, ensuring high fidelity and reliability. This recognition by Gartner highlights CrowdStrike's ongoing leadership in threat intelligence, further establishing it as a trusted partner for organizations worldwide aiming to understand and disrupt cyber threats effectively.

CrowdStrike recently launched Falcon OverWatch for Defender, a new threat hunting service designed to enhance Microsoft Defender environments by providing continuous, expert-led threat detection and response. This initiative addresses the growing challenge of detecting sophisticated, often malware-free intrusions that exploit AI and other advanced techniques. The service leverages CrowdStrike's AI-native Falcon platform to identify subtle, novel threats that traditional automated systems might miss, focusing on post-exploit activities that occur after adversaries gain initial access. It combines real-time intelligence, human expertise, and AI at scale to analyze vast amounts of data, uncovering stealthy attacker behavior and escalating high-confidence threats before they can escalate into serious breaches. By integrating with existing Microsoft Defender deployments, Falcon OverWatch offers enhanced visibility and detection capabilities without disrupting current security frameworks, aiming to deliver stronger security outcomes for its users.

CrowdStrike's Technical Risk Assessments highlight the challenges organizations face in securing their digital environments, emphasizing the need for operational discipline over mere tool acquisition. The assessments reveal common vulnerabilities, such as unmanaged assets and overlooked credential paths, which adversaries exploit at machine speed. Additionally, the proliferation of shadow AI, which operates outside sanctioned channels, poses significant risks including uncontrolled data exposure and unmonitored behavior. The assessments consistently identify a larger-than-expected external attack surface, exacerbated by shadow IT and misconfigured cloud services, offering adversaries easy access points. Furthermore, critical vulnerabilities often remain unaddressed due to ineffective remediation practices, while identity hygiene issues, particularly with remote access and Active Directory configurations, create additional risks. CrowdStrike recommends a proactive approach, leveraging Falcon Exposure Management to continuously map and manage these vulnerabilities, ensuring a comprehensive understanding of an organization's risk landscape.

The blog post highlights the future of AI-powered vulnerability discovery, emphasizing the rapid pace at which AI is transforming the field of vulnerability research and its implications for cybersecurity. CrowdStrike's Adversary Universe podcast discusses how advanced AI models are significantly outpacing traditional methods in identifying vulnerabilities, creating a surge of potential security threats that organizations may struggle to address promptly. Despite this, experts suggest that while the increase in vulnerabilities, particularly zero-days, is concerning, they are manageable with the right strategies. This involves prioritizing patching based on active exploitation, leveraging AI for proactive vulnerability scanning, and employing continuous red-team exercises to preemptively identify weaknesses. The post underscores the importance of adapting to AI's evolving role in both adversarial tactics and defensive measures, with CrowdStrike actively participating in initiatives like Project Glasswing to enhance cybersecurity resilience.