CrowdStrike invests in Above Security, adds insider risk investigations to Falcon

CrowdStrike has made a strategic investment in Above Security through the CrowdStrike Falcon Fund and is integrating Above’s managed insider risk platform with the Falcon platform. Announced at Black Hat USA 2026, the deal expands an existing partnership and gives CrowdStrike customers a way to investigate insider risk using data already collected across their security environment.

Above uses AI agents to analyze activity across identities, applications, data movement and business workflows. The platform connects related behavior into investigation timelines, explains why an activity was classified as risky, and recommends next steps. The approach is designed to reduce the manual work involved in reviewing isolated alerts and determining whether employee or contractor activity represents a genuine threat.

The integration will use endpoint, identity, and third-party telemetry from CrowdStrike Falcon Next-Gen SIEM to create investigation-ready insider risk cases. Above will then send completed investigations back into Falcon, allowing security teams to manage the findings inside the platform they already use. For CrowdStrike, the integration adds an insider risk layer to its SIEM and security operations portfolio without requiring customers to build a separate investigation process.

The Falcon Fund investment follows Above’s participation in the CrowdStrike Cybersecurity Startup Accelerator and a recent $50 million funding round. The partnership gives Above access to CrowdStrike’s technology ecosystem and customer base, while CrowdStrike gains a specialized insider risk capability built around continuous investigation.