CrowdStrike expands Falcon Cloud Security from CI/CD to runtime defense
CrowdStrike announced a set of generally available updates to Falcon Cloud Security on Nov. 4, 2026, positioning the changes as a way to connect software supply-chain checks, cloud exposure management and runtime detection. The additions cover container images, Kubernetes, major cloud platforms, AI workloads and specialized infrastructure.
The company says the updates are intended to help security teams assess risks before deployment and use that context when investigating activity in production. The announcement describes capabilities within CrowdStrike’s platform; it does not provide independent performance benchmarks or customer deployment results.
Checks for compromised packages and container images
A central change extends Supply Chain Security for Cloud to container images. CrowdStrike says Falcon Cloud Security can identify compromised npm and PyPI packages during CI/CD and registry scanning, reassess images already scanned when new threats are confirmed, and identify affected running containers. Its Falcon Kubernetes Admission Controller can apply image assessment policies to alert on or block compromised images before they enter production.
The company’s case for package-focused detection is that a malicious dependency may not have a CVE, so vulnerability scanning alone may not identify it. CrowdStrike cites its observation that the threat group ALTERED SPIDER compromised more than 300 software dependencies in one day. The announcement does not provide further incident details alongside that figure.
For enterprise teams, the described workflow links package assessment to container deployment and runtime visibility. Organizations will still need to determine how the controls fit their build pipelines, image registries, admission policies and response procedures.
Broader cloud risk and application context
Cloud Risks coverage now extends to Microsoft Azure and Google Cloud, according to CrowdStrike. The feature brings together exposure, effective permissions, vulnerabilities and sensitive-data context to help identify combinations of risk. Separately, agentless vulnerability scanning for Google Cloud adds vulnerability and malware discovery for Linux-based Google Compute Engine instances without requiring additional sensor deployment. Expanded Oracle Cloud Infrastructure inventory adds infrastructure, identities and secrets to the platform’s view.
Application Security Posture Management updates add containerized applications to Application Explorer, with workload and cloud context. CrowdStrike says this lets teams assess application risks alongside other cloud resources—for example, an internet-exposed Kubernetes workload running code with a remote code execution vulnerability. Package exports also map vulnerable dependencies to associated applications, supporting impact assessment and remediation planning. Enhanced third-party API findings identify external payment-service integrations and operations used by applications, which can help teams review dependencies on providers and spot unauthorized integrations.
Detection and response across cloud environments
CrowdStrike is extending its Real-Time Cloud Detection and Response coverage to Microsoft Azure and Kubernetes, adding to existing AWS and Google Cloud coverage. The company says the service analyzes cloud audit activity as it streams and uses adversary-informed detection logic to surface detections in seconds. Analysts can use identity, asset, workload, endpoint and adversary context in the Falcon console, and can deny credentials or shut down compromised instances. CrowdStrike says those actions can also be automated with Charlotte Agentic SOAR.
New detections combine Cloud Indicators of Attack with posture information, including dormant identities, elevated privileges, public exposure and sensitive data. The stated aim is to help analysts judge suspicious activity in light of the conditions that could increase its impact. Anomaly Detection, which CrowdStrike says uses a customer-specific machine-learning baseline to evaluate deviations across identities, APIs and resources, is now available for AWS CloudTrail. It is designed to help identify behavior such as account takeover and API misuse that predefined rules may miss.
AI workloads, government clouds and specialized systems
For supported AI workloads, Falcon Container Sensor and Falcon Guardian now support Anthropic APIs, extending runtime detection to the prompt layer, according to the company. Other additions include workload protection for Google Cloud Workstations and expanded AWS Bedrock AgentCore inventory to provide visibility into infrastructure supporting AI applications.
Falcon Cloud Security capabilities have also expanded in the US-GOV-1 and US-GOV-2 environments. CrowdStrike says those additions include cloud detections, detection-rule management and Falcon Next-Gen SIEM workflows, including Kubernetes audit-log detections for Amazon EKS, Azure AKS and Google GKE. Amazon S3 scanning in Merlin extends sensitive-data discovery in that environment. DaemonSet support for Red Hat OpenShift on IBM Z and IBM LinuxONE, and sensor support for Ubuntu Kairos, extend coverage to additional infrastructure.
The breadth of the release reflects a practical challenge for cloud security teams: risks can originate in dependencies, identities or exposed workloads, while investigations happen across different services and environments. The announced integrations aim to bring more of those signals into a shared workflow. Organizations evaluating the changes should verify which capabilities apply to their cloud accounts and workload types, and test how prevention policies and response actions affect existing deployment and incident-handling processes.
