CrowdStrike and Rubrik Launch Agentic Identity Attack Recovery

CrowdStrike and Rubrik have integrated their platforms to create automated workflows that detect and remediate identity-based cyberattacks without manual intervention, addressing what security leaders identify as their top threat vector.

The partnership combines CrowdStrike's Falcon Next-Gen Identity Security for real-time threat detection with Rubrik Identity Resilience for automated data and identity protection. The integration orchestrates through Charlotte Agentic SOAR, creating what the companies describe as a closed-loop response system that moves from detection to clean recovery in hours rather than days.

How the integration works

When CrowdStrike detects malicious identity activity, the system automatically contains the threat while Rubrik correlates detection data with identity activity logs. The platform can scan backup data across Human Resources Information Systems and Identity Governance and Administration solutions for threats.

Security teams can then surgically reverse unauthorized Active Directory changes, trigger automated forest recovery plans, or remove malicious files—all with minimal manual intervention. The workflow closes incidents automatically once recovery is complete.

"By bringing CrowdStrike and Rubrik together via agentic workflows, we're empowering organizations to contain and recover from identity-based attacks faster than ever," said Daniel Bernard, Chief Business Officer at CrowdStrike.

Why it matters

Identity-based attacks have become the dominant threat vector in enterprise security. Research from Rubrik Zero Labs found that 90% of IT and security leaders consider identity-based attacks the single largest threat to their organizations. As adversaries increasingly weaponize AI to accelerate attacks, the gap between detection and recovery has become a critical vulnerability. Manual response workflows cannot match the speed of automated threats, making machine-speed remediation essential for containing damage and preventing attacker persistence.

Key capabilities

The integration delivers unified incident response that consolidates detection, containment, investigation, and recovery into a single workflow. This eliminates the need for security teams to switch between multiple consoles and tools during active incidents.

The system performs surgical remediation by reversing specific unauthorized changes to Active Directory or executing complete forest recoveries when necessary. It removes malicious files while preserving legitimate data and configurations.

According to Rubrik Chief Product Officer Anneka Gupta, traditional manual workflows cannot keep pace with AI-enabled threats. "You can't fight rapid AI threats with manual workflows," Gupta said. "You need automated, intelligent defense to shut down active attacks instantly and guarantee a clean, fast recovery."

The integration aims to reduce recovery time objectives from days to hours by automating identity provider recovery and eliminating attacker persistence mechanisms. This ensures identity incidents are fully resolved rather than simply managed or contained.

The announcement was made at CrowdStrike's Fal.Con 2026 conference in Las Vegas. Details were first reported in a press release distributed through Business Wire.