What happened
On Nov 4, 2026 CrowdStrike detailed agentic-SOC coverage for rogue agents: Multi-Agent Triage and Investigation and the Unified Agentic SOAR Experience are GA (from Fal.Con US), and new in Q4 are AI Ecosystem Detections (LLM API abuse, stolen API keys, compromise of coding assistants/MCP servers/agent frameworks), Dynamic Risk Scoring (agent risk folded into the owner/host 0-100 score), and Policy-Drift Agent Guardrails (Beta, powered by Falcon Guardian), plus new GovCloud/Dynatrace/Databricks/Snowflake connectors.
Why it matters
It targets the 'did the owner do it or did the agent run rogue' problem by unifying agent, owner and host risk, and extends detection into the AI-tooling supply chain (MCP servers, coding assistants) — a distinct attack surface from traditional insider detection.
Applicability
CrowdStrike Falcon customers building agentic SOC operations should track Q4 AI Ecosystem Detections and Dynamic Risk Scoring; evaluate Multi-Agent Triage to separate agent-caused vs owner-caused actions.