CrowdStrike Extends the Agentic SOC to Detect and Stop Agent Insider Threats

The most dangerous agent in your environment may be one you already approved. It runs under a real employee's identity, connects to tools their team signed off on, and has the access it needs to do its job. But when something upstream changes, like a tampered tool or an instruction that shouldn't be there, it can drift without tripping an alarm. This is the new insider threat: not an employee, but a trusted agent acting on their behalf. AI agents touch the SOC in two ways: They’re the new operating unit of the SOC and a new identity to secure. Two categories of tools are being sold against these realities, but they fall short in different ways. Most agentic SOC tools run a single LLM serially through detections, with no memory of prior investigations or identity,…