CrowdStrike adds supply chain attack protection to Falcon sensor

CrowdStrike has introduced Real-Time Supply Chain Attack Protection, a capability embedded in its Falcon sensor that detects and blocks malicious open-source software packages as they reach the endpoint, before any code can execute. The feature requires no new sensor deployment or changes to developer workflows.

The move responds to the growing threat of software supply chain attacks, which the company’s 2026 Threat Hunting Report says increasingly involve poisoned packages on public registries. CrowdStrike notes that AI agents and agentic applications have expanded the attack surface beyond developer machines to potentially every company endpoint.

The capability also provides a global inventory of installed packages across the organisation via Falcon Exposure Management. Proactive policy controls, including minimum package age requirements, are planned for release in Q4, with the global package inventory due in Q3.