# New Falcon Cloud Security Innovations Secure the Cloud AI Runs On

> Source: <https://www.crowdstrike.com/en-us/blog/falcon-cloud-security-innovations-secure-cloud-ai-runs-on/>
> Published: 2026-11-04 09:50:39.016788+00:00

AI is accelerating both sides of cloud security. Developers and coding agents are writing more code, pulling in more open source packages, and launching more cloud and AI workloads than security teams can review by hand. Adversaries use AI to move faster, and they are targeting everything organizations build and run, from the packages in automated pipelines, to the identities that control cloud resources, to the infrastructure powering AI applications.

Security teams must keep pace on both fronts to defend against this acceleration and secure the cloud their AI runs on. CrowdStrike Falcon® Cloud Security is built for this. It is powered by adversary intelligence tracking 290+ adversaries, so detections and risk prioritization reflect how attackers operate in the cloud. It runs on the same CrowdStrike Falcon platform that connects endpoint and identity protection with SOC operations, extending protection from developer endpoints and software supply chains to cloud workloads. Because proactive security and real-time cloud detection and response (CDR) share one platform, the exposure and attack path context teams build before an attack becomes the context analysts use to stop one.

The latest Falcon Cloud Security innovations, all now generally available, put this advantage to work from build to runtime. They help organizations stop compromised software before production, protect AI workloads and the infrastructure supporting them, and detect cloud attacks in seconds. Proactive security informs runtime defense by giving teams the context to understand risks and when to act on them. This connected defense spans business and mission-critical environments, including some of the hardest to secure.

## Reduce Risk and Stop Threats Before Production

Securing the cloud that AI runs on starts with understanding where organizations are exposed and whether software entering production can be trusted. Falcon Cloud Security connects cloud risk, application context, and adversary intelligence to help teams close exposures before software is deployed.

### Stop Supply Chain Threats

AI coding agents are pulling open source packages into automated builds faster than teams can review them. Adversaries can exploit that trust by compromising otherwise legitimate software. CrowdStrike observed ALTERED SPIDER compromise more than 300 software dependencies in a single day.<sup>1</sup> A compromised dependency does not need a CVE to be dangerous, which means vulnerability scanning alone can miss the threat.

**Supply Chain Security for Cloud** extends the adversary intelligence CrowdStrike uses to detect and quarantine malicious packages on endpoints into container images. Falcon Cloud Security identifies compromised npm and PyPI packages during CI/CD and registry scanning, automatically reassesses previously scanned images as new threats are confirmed, and identifies affected running containers.

At deployment, the Falcon Kubernetes Admission Controller uses image assessment policies to alert on or block compromised images before they reach production. Together, endpoint and cloud protection connect the defense from package download through deployment to help teams stop compromised software.

### Expand Cloud Risk and Asset Visibility

Security teams need to understand how exposures combine into opportunities for an adversary. **Cloud Risks coverage in Falcon Cloud Security now extends to Microsoft Azure and Google Cloud**, where it connects exposure, effective permissions, vulnerabilities, and sensitive data context to identify high-risk combinations that isolated assessments can miss.

Supporting coverage expansions help teams assess more of their environment. **Agentless Vulnerability Scanning for Google Cloud** adds vulnerability and malware discovery for Linux-based Google Compute Engine instances without requiring additional sensor deployment. **Expanded OCI inventory** brings additional infrastructure, identities, and secrets into view. Together, these updates help teams account for more cloud assets and assess workloads where they cannot install an additional sensor.

### Understand Applications and What Exposes Them

Cloud risk becomes more actionable when teams can connect it to the applications their business depends on. Expanded **Application Security Posture Management (ASPM) brings containerized applications into Application Explorer** with workload and cloud context, allowing Cloud Risks to evaluate them alongside other resources. Teams can identify combinations such as an internet-exposed Kubernetes workload running code with a remote code execution vulnerability.

New **package exports** map vulnerable dependencies to their associated applications, which helps teams assess blast radius and plan remediation across the application fleet. Enhanced **third-party API integration** findings identify external payment-service integrations and the operations applications invoke, helping teams assess exposure when a provider is compromised and uncover unauthorized integrations. The result is a clearer picture of which applications are affected and where remediation is needed.

## Stop Cloud Attacks and Protect AI Workloads at Runtime

When an adversary gains access, security teams need to recognize malicious behavior, understand what is at risk, and respond while the attack is in progress. Falcon Cloud Security connects real-time detection with workload, identity, and exposure context to help defenders interrupt attacks across cloud environments.

### Connect Cloud Exposure with Real-Time Detection and Response

CrowdStrike is extending **Real-Time CDR to Microsoft Azure and Kubernetes**, building on existing coverage for AWS and Google Cloud. Falcon Cloud Security continuously analyzes cloud audit activity as it streams, applies adversary-informed detection logic, and surfaces high-fidelity detections in seconds. Identity, asset, workload, endpoint, and adversary context helps analysts investigate and act while the attack is still in progress. All within the Falcon console, they can deny credentials or shut down compromised instances, or automate those actions with CrowdStrike® Charlotte Agentic SOAR to contain the intrusion before it spreads.

**New detections combining Cloud Indicators of Attack (IOAs) with posture insights** bring exposure context directly into threat detection. Suspicious behavior is evaluated alongside conditions such as dormant identities, elevated privileges, public exposure, and sensitive data so analysts can understand its potential consequences and prioritize response. A privileged action from a long-inactive identity, for example, takes on different significance when viewed alongside the conditions that could make it dangerous. 

**AI-based Anomaly Detection** strengthens this defense by identifying suspicious behavior that predefined rules may miss. A dedicated machine learning model learns each customer’s baseline and evaluates deviations involving identities, APIs, and resources across multiple events to help uncover threats such as account takeover and API misuse. It is now available for AWS CloudTrail. 

Together, these innovations connect attack behavior with exposure to help teams identify affected identities and workloads, assess potential impact, and focus response.

### Protect AI Workloads and the Cloud They Run On

Securing AI requires protection for both AI interactions and the environments supporting them. **Falcon Container Sensor and Falcon Guardian support for Anthropic APIs** extends runtime detection to the prompt layer for supported AI workloads to help teams identify threats in AI interactions while maintaining a unified view of their environment.

**Workload protection for Google Cloud Workstations** brings cloud development environments into Falcon Cloud Security visibility, detection, and response workflows. Expanded **AWS Bedrock AgentCore inventory** complements that protection with visibility into the managed infrastructure supporting AI applications. These capabilities address distinct needs: detecting threats in supported AI interactions, protecting development workloads, and accounting for the resources behind AI applications. 

### Extend Protection to Regulated and Specialized Environments

Government agencies and regulated enterprises need cloud protection that reaches the environments their missions depend on. Expanded Falcon Cloud Security capabilities in **US-GOV-1 and US-GOV-2** bring cloud detections, detection-rule management, and CrowdStrike Falcon® Next-Gen SIEM workflows to GovCloud, including Kubernetes audit-log detections across Amazon EKS, Azure AKS, and Google GKE. Amazon S3 scanning in Merlin also extends sensitive-data discovery to customers in that environment.

**DaemonSet support for Red Hat OpenShift on IBM Z and IBM LinuxONE**, along with DaemonSet sensor support for Ubuntu Kairos, extends workload protection to specialized infrastructure. Teams can bring more of their environment into Falcon platform protection workflows without introducing separate tools, consoles, and investigation processes for each workload type. This helps close coverage gaps while reducing operational overhead.

## Cloud Defense Built Around How Attacks Unfold

Securing the cloud AI runs on means understanding the software entering a build, the identities accessing cloud services, the data applications handle, and the behavior of workloads in production. Adversaries do not separate the software supply chain from the cloud identities, workloads, and data they want to reach, and defenders cannot either.

Falcon Cloud Security is built for this reality, combining CrowdStrike’s adversary intelligence with endpoint, identity, and cloud context to unite proactive security and real-time detection and response on one platform. That connection matters at every critical decision: whether to allow software into production, which exposures to fix first, and how to contain an attack already underway. Proactive context makes every real-time detection more precise and every response faster.

Expanded protection for government clouds and specialized infrastructure brings more of that connected defense to government agencies and regulated enterprises, helping protect the environments their businesses and missions depend on.

AI will keep accelerating the cloud. Falcon Cloud Security makes sure defenders accelerate with it.

#### Additional Resources

- *Watch the Falcon Cloud Security [product demo](https://www.youtube.com/watch?v=1S28SmZ7iag) to see these capabilities in action.*
- *Start an unlimited [15-day free trial](https://www.crowdstrike.com/en-us/products/trials/try-falcon-cloud-security/) of Falcon Cloud Security.*
- *Missed Fal.Con 2026? Register for [Fal.Con Digital](https://www.crowdstrike.com/en-us/events/fal-con/las-vegas/?utm_medium=evt&utm_source=blog&utm_campaign=fal-con-26&utm_term=crwdblogs&utm_language=en-us) to watch the cloud security videos on demand.*