CrowdStrike is excited to announce Falcon OverWatch for Defender, a new offering that extends our elite managed threat hunting to Microsoft Defender environments.

The need for proactive threat hunting is increasingly urgent as adversary operations evolve: 82% of intrusions observed in 2025 were malware-free, the CrowdStrike 2026 Global Threat Report revealed, and the fastest eCrime breakout time was a mere 27 seconds. Adversaries using AI increased their attacks 89% year-over-year. 

Security tools remain essential, but not every sophisticated intrusion can be reliably detected through automation alone. Techniques including credential abuse, hands-on-keyboard activity, misuse of legitimate tools, and in-memory tradecraft are too subtle, novel, or context-dependent to automate high-fidelity detections for them without generating too much noise.

This is where Falcon OverWatch for Defender comes in. Powered by the AI-native CrowdStrike Falcon® platform, Falcon OverWatch for Defender adds continuous, expert-led threat hunting to Microsoft Defender environments. It helps organizations uncover stealthy attacker behavior, escalate high-confidence threats, and guide response before an intrusion becomes a breach. 

Threat Hunting In the Era of Frontier AI

Frontier AI models are poised to accelerate vulnerability discovery and exploitation, sparking concerns of a surge in vulnerabilities adversaries can target. But exploits shouldn’t be the extent of their concerns — after all, they’re only one step in the attack chain.

Adversaries using an exploit to gain initial access must take additional steps, such as privilege escalation or lateral movement, to achieve their goals. This is why post-exploit threat hunting is essential: It focuses on the critical window after entry, when attackers are in the environment but haven’t yet made an impact. In the frontier AI era, stopping a vulnerability exploit is ideal, but stopping post-exploitation activity is vital.

The problem is, adversaries are becoming harder to catch. Many blend into legitimate business activity by abusing trusted identities, admin tools, remote access software, and native system processes. They’re using AI to scale phishing attacks, automate reconnaissance, and quickly generate malicious scripts. In this environment, important signals are often new, too subtle, or lack key context to convert into reliable detections right away.

This is why continuous, intelligence-driven hunting is indispensable. The Falcon OverWatch team is built for this mission. Our combination of real-time intelligence, expert human hunters, and AI at scale uncovers post-exploit activity to stop attackers before an intrusion becomes a breach.

Extending CrowdStrike’s Open Approach to Microsoft Environments

Falcon OverWatch for Defender builds on CrowdStrike’s open approach to Microsoft environments. With the lightweight Falcon sensor running alongside Microsoft Defender, organizations can strengthen security outcomes without disrupting existing protections or operations.

This added visibility enables Falcon OverWatch hunters to uncover subtle patterns of attack that might otherwise remain hidden, validate suspicious activity, and escalate high-confidence threats. The result is a stronger security outcome for Microsoft Defender customers without requiring them to replace their endpoint deployment.

Below are the differentiated capabilities it provides: 

• Threat hunting informed by deep adversary intelligence: CrowdStrike tracks more than 280 sophisticated nation-state, eCrime, and hacktivist adversaries. Falcon OverWatch hunters use this intelligence to identify threat actor behavior, investigate subtle indicators, and deliver high-confidence escalations. 
• AI-powered hunting at machine speed and scale: Falcon OverWatch uses AI, proprietary hunting patterns, and adversary expertise to analyze up to 6.2 trillion events per day and uncover stealthy and novel threats. 
• Visibility across millions of endpoints: With visibility across CrowdStrike’s broad global customer base and millions of endpoints, Falcon OverWatch can identify uncommon activity at scale and quickly operationalize new discoveries. When hunters identify a new technique in one environment, that knowledge is turned into new hunting patterns and applied across others. This improves detection posture and helps customers find evidence of both current and prior adversary activity. 

Real Outcomes, Proven at Scale

Falcon OverWatch operationalizes the latest threat intelligence to improve detection, analyzes 14 million detection leads annually, adds more than 1,800 new hunting patterns each year, and detects 100 high- to critical-severity intrusions every day.

With Falcon OverWatch for Defender, CrowdStrike extends our proven hunting model to Microsoft Defender customers to deliver the expertise, scale, and intelligence required to identify and stop sophisticated threats earlier.

 Additional Resources

• Dive deeper into topics like this at Fal.Con 2026 with expert-led sessions, hands-on training, and real-world insights.
• Read the CrowdStrike 2026 Global Threat Report for the latest insights on adversaries, tradecraft, and activity.
• Visit the Counter Adversary Operations webpage to learn about CrowdStrike’s threat intelligence and hunting solutions.