First unveiled in 2024, CrowdStrike Signal uses self-learning models tailored to each host, analyzing normal behavior across users, systems and time to identify subtle deviations.
According to the company, these low-signal anomalies often mark the beginning of modern cyberattacks but are usually ignored by rule-based systems due to lack of context to tell what’s suspicious or benign.
“Security teams don’t need more alerts. They need the ability to detect what others miss,” according to a Wednesday CrowdStrike blog post.
The company said Signal continuously learns what’s normal for each user, host and process, then updates its understanding as conditions change. It identifies unusual behavior in real time, linking seemingly benign actions — such as running apps from temporary directories — that may indicate a stealth attack when analyzed over time.
“The longer CrowdStrike Signal observes an environment, the more accurate its detection becomes,” according to the blog post. “This leads to fewer false positives and a greater chance of catching subtle or emerging threats before they escalate.”
Advertisement: Scroll to Continue
Signal’s detection capabilities are driven by a new family of statistical time series models that process billions of events daily within each customer environment. The platform condenses a high volume of behavioral data into a small set of more relevant leads, helping to reduce false positives and streamline responses.
“It surfaces early indicators of compromise, reduces false positives, and groups related activity into a single starting point to eliminate manual triage and speed investigation, hunting, and response,” the company said in the release.
Last year, a software update from CrowdStrike took down Microsoft Windows and snarled millions of PCs across the globe. It grounded flights, took broadcasters offline and disrupted banking, logistics and health care services.
“CrowdStrike pioneered AI-native cybersecurity, and continues to deliver the innovation driving the industry forward. Signal is our latest breakthrough, built to detect how modern adversaries actually operate,” said CrowdStrike CTO Elia Zaitsev in a Wednesday statement. “Today’s attackers spread subtle signals over time to stay under the radar. Signal is designed to catch what others overlook, connecting the dots across systems and time to paint the full picture.”
CrowdStrike Signal is now generally available.
