CrowdStrike introduces a new cloud threat hunting service 

Maintaining visibility over complex cloud environments is one of the most pressing challenges that security teams face on a daily basis. Modern organizations have a sprawling attack surface of internet-facing assets in the cloud that require niche expertise to secure consistently.

Unfortunately, as the cyberskills gap continues, few organizations have the expertise they need to secure their environments. In fact, 80% of organizations last year reported they suffered one or more breaches last year that they could attribute to a lack of cybersecurity skills and/or awareness.

In response to these challenges, today, endpoint and cloud protection provider CrowdStrike announced the launch of Falcon OverWatch Cloud Threat Hunting, “the industry’s first standalone threat hunting service.”

Falcon Overwatch Cloud Threat Hunting provides security teams with a tool they can use to continuously uncover hidden and advanced threats that originate and persist in cloud environments. This helps onsite analysts identify vulnerabilities that put sensitive data at risk. 

Responding to the cloud skills shortage

The launch comes amid an ongoing shortage of cloud security skills, with a 2022 IDC survey finding that 33% of security leaders cite cloud security skills as their largest skills gap, followed by data management (23%) and analytics and intelligence (22%).

For years now, the cyberskills shortage and growing complexity of cloud native environments have made it difficult for enterprises to fully protect themselves against the sophisticated attacks waged by skilled cybercriminals. 

“Modern attacks make the most of today’s vast cloud attack surface — serverless workload vulnerabilities, misconfigured services and container registry dependencies are just a few of the issues ripe for adversary compromise and weaponization,” said VP of OverWatch, Param Singh. 

“Making matters worse, as adversaries shift their operations to the cloud, security teams struggle to keep pace and don’t have the requisite skills or resources to monitor, manage and protect their critical and rapidly expanding cloud estates,” Singh said.

Falcon OverWatch Cloud confronts these challenges by continuously scanning for suspicious behaviors and threats in the cloud.

These include control pane and serverless workload vulnerabilities, misconfigurations, application behavior anomalies, container escapes, API privilege escalations, worker node compromise, and more. 

The solution operates based on a cloud sensor network that’s used to protect over 1.5 billion containers every day, and provides deep visibility into cloud-based threats in real-time. 

A look at the cloud security market, cloud threat hunting and CNAPP 

CrowdStrike’s new offering is entering into the global cloud security market, which researchers valued at $40.8 billion in 2021 and anticipate will reach $77.5 billion by 2026, growing at a compound annual growth rate (CAGR) of 13.7%. 

While Singh says that Falcon OverWatch has no direct competitors, as a solution enterprises can use to secure cloud environments, it’s indirectly competing against cloud-native application protection platforms (CNAPPs) like Palo Alto Networks Prisma Cloud.

Prisma Cloud provides a solution to secure cloud configurations and scan code, alongside detection and response capabilities, to help users secure their environments end-to-end. Palo Alto Networks recently announced raising total revenue of $1.4 billion for the third quarter of 2022. 

Another competitor is Check Point, with CloudGuard, a CNAPP platform that offers threat-prevention capabilities for assets and workloads with machine learning that can detect anomalies that indicate malicious behavior, alongside features like auto-provisioning to help simplify cloud management.  

Check Point also generated $599 million in revenue last year. 

However, Singh argues that Falcon OverWatch is differentiated from existing cloud security solutions due to the telemetry it provides from CrowdStrike Security Cloud. 

“Falcon OverWatch is a truly unique and differentiated proactive service, spearheaded by its highly skilled, human-led operations and unmatched telemetry and visibility into the CrowdStrike Security Cloud, which processes more than one trillion events every day,” Singh said.