CrowdStrike gives AI agents an identity provider, parallel SOC investigations and package blocking

CrowdStrike has unveiled enhancements to its Falcon platform, focusing on AI agents, investigations, and supply chain security.

First, the company introduced the CrowdStrike Agentic Identity Provider (Agentic IdP), a new identity provider tailored for AI agents. This identity provider will serve as the authoritative source for all subsequent security decisions, eliminating the need for traditional service accounts, API keys, and workload identities. According to Scott Kriz, general manager of Continuous Identity at CrowdStrike, Agentic IdP is crucial for modernizing identity security in the "agentic era."

Next, CrowdStrike revamped its investigation process with Charlotte AI. The new system allows multiple AI agents to investigate security incidents across various domains simultaneously, significantly reducing investigation time. Michael Sentonas, president of CrowdStrike, explained that this approach turns what previously took hours into mere minutes. This is achieved through a shared context layer that enables agents to access and build upon one another's findings, removing the need for handoffs between agents.

Finally, CrowdStrike addressed the issue of supply chain attacks with Real-Time Supply Chain Attack Protection. This feature intercepts malicious open-source packages at the command line, preventing them from running their embedded code before any potential harm can be done. This protection applies to all endpoints where agentic applications run, not just developer workstations.

Security teams can set granular controls over package requirements, such as a minimum age for packages, to help prevent the spread of compromised packages.