In an aggressive push to curb the escalating fallout from identity-based cyberattacks, cybersecurity heavyweights Rubrik and CrowdStrike have announced a major expansion of their technological partnership. The newly unveiled integration marries CrowdStrike’s real-time threat intelligence and automated orchestration with Rubrik’s specialized data resilience and identity protection frameworks. Designed to drastically shrink the timeline between initial compromise and full recovery, the collaborative workflow aims to condense what historically took organizations days of painstaking manual labor into mere hours.
The announcement builds upon a foundational partnership forged late last year, introducing advanced, agentic automation to the complex ecosystem of enterprise identity management. By leveraging CrowdStrike’s recently introduced Charlotte Agentic SOAR (Security Orchestration, Automation, and Response) layer alongside Rubrik Identity Resilience, the companies are offering a closed-loop security response designed to detect, contain, investigate, and remediate attacks with minimal human intervention.
The Modern Threat Landscape and the Identity Crisis
To understand the gravity of the Rubrik and CrowdStrike integration, one must examine the shifting paradigms of modern enterprise security. For decades, perimeter defenses—such as next-generation firewalls, secure email gateways, and endpoint protection platforms—formed the bedrock of corporate cybersecurity strategies. However, the mass migration to cloud computing, hybrid work environments, and software-as-a-service (SaaS) applications has fundamentally decentralized the corporate network.
Today, identity is the new enterprise perimeter. Threat actors have correspondingly adapted their tactics, shifting away from noisy malware campaigns that trigger immediate endpoint alarms and moving toward sophisticated identity-based compromises. Cybercriminals increasingly target core directory services like Microsoft Active Directory (AD) and Azure Active Directory (now Entra ID). By acquiring legitimate administrative credentials through phishing, credential stuffing, or token theft, attackers can traverse enterprise networks silently, blending in with legitimate user traffic and evading traditional security detection tools.
Once inside an identity environment, adversaries routinely create backdoor accounts, modify group policies, elevate privileges, and embed persistence mechanisms. When an attack of this magnitude is discovered, security operations center (SOC) teams face a grueling dilemma. Traditional disaster recovery methods often rely on blunt-force restore operations, such as rolling back entire domain controllers to a point in time prior to the attack. This approach frequently results in significant data loss, business downtime, and the inadvertent wiping of legitimate administrative changes made after the backup was captured.
Alternatively, attempting to surgically clean a compromised Active Directory environment manually is an excruciatingly slow process. Security engineers must manually comb through thousands of audit logs, identify malicious modifications, purge rogue accounts, and verify directory integrity. In the crucible of an active ransomware attack or nation-state intrusion, every hour of delay costs organizations millions of dollars in downtime, reputational damage, and lost revenue. The Rubrik-CrowdStrike integration seeks to directly solve this operational bottleneck by automating the detective, analytical, and restorative phases of an identity incident.
Chronology of the Partnership
The evolution of the Rubrik-CrowdStrike alliance reflects a calculated, step-by-step integration of complementary technologies designed to bridge the historic gap between security operations and data backup teams.
The groundwork for the current collaboration was laid in December 2025, when Rubrik formally announced general availability for an initial integration linking its Identity Resilience platform with CrowdStrike Falcon Next-Gen Identity Security. That foundational release focused heavily on identity-event correlation and surgical rollback capabilities. By polling CrowdStrike’s telemetry APIs, Rubrik’s platform could ingest identity-based threat events and cross-reference them against historical activity logs captured from the enterprise directory. This allowed security administrators to select specific compromised user accounts or malicious directory changes and initiate targeted reversions rather than resorting to a wholesale directory restore.
However, while December’s release provided the technical mechanics for surgical rollback, executing the recovery workflow still required a notable degree of human oversight, script initiation, and cross-departmental coordination between SOC analysts and IT infrastructure teams.
The landscape shifted again in November 2025, when CrowdStrike debuted Charlotte Agentic SOAR as a premier orchestration component of its broader Falcon Agentic Security Platform. Designed to move beyond rigid, rule-based automation, Charlotte Agentic SOAR introduced artificial intelligence-driven agents capable of autonomous reasoning, cross-product collaboration, and structured decision-making while remaining under the strict supervision of human analysts.
Recognizing the potential of this new orchestration layer, Rubrik and CrowdStrike engineers moved quickly to integrate Charlotte Agentic SOAR into their shared ecosystem. The newly announced expansion bridges the gap between CrowdStrike’s threat containment and Rubrik’s data recovery infrastructure, culminating in a fully automated, closed-loop incident response pipeline that debuted to the market in early 2026.
Anatomy of the Closed-Loop Workflow
The mechanics of the expanded Rubrik and CrowdStrike integration rely on a sophisticated handoff of telemetry, contextual analysis, and automated remediation commands. The workflow operates continuously across four distinct phases: detection, containment, investigation, and recovery.
In the initial detection and containment phase, CrowdStrike Falcon Next-Gen Identity Security acts as the frontline sentinel. It monitors real-time authentication requests, session tokens, and identity behaviors across the enterprise, flagging anomalous activities such as impossible travel, credential harvesting, or unauthorized privilege escalation. Upon identifying a malicious entity, CrowdStrike initiates immediate containment protocols, isolating the compromised endpoint or disabling the fraudulent session token to halt the attacker’s lateral movement.
Simultaneously, the platform triggers the investigation phase. Rubrik Identity Resilience ingests the telemetry data provided by CrowdStrike and correlates it against comprehensive historical activity logs extracted from the enterprise directory. To provide deeper context, the system can also scan auxiliary data sources—including Human Resources Information Systems (HRIS) and Identity Governance and Administration (IGA) platforms—cross-referencing them against backup data to determine whether the attacker has established persistence within stored enterprise assets or employee records.
Once the scope of the compromise is fully mapped, the workflow transitions to the recovery phase, where the true innovation of the partnership manifests. Rather than forcing IT teams to execute a broad, disruptive system restore, the integrated platform utilizes granular remediation pathways. Security personnel can direct the system to surgically reverse malicious Active Directory modifications, purge unauthorized files, or—in scenarios involving widespread structural corruption—automatically initiate pre-configured Active Directory forest recovery plans.
Under the hood, these reversions are executed via automated API calls. Rubrik Identity Resilience polls the CrowdStrike Falcon APIs, translates the threat intelligence into actionable recovery commands, and invokes the Rubrik Backup Service. This service then communicates directly with Active Directory via Lightweight Directory Access Protocol (LDAP) calls, executing precise rollbacks of the altered directory attributes. Throughout this process, Charlotte Agentic SOAR coordinates the sequence of events across both vendor platforms, ensuring that actions are executed in the correct dependency order without requiring manual intervention from overwhelmed security analysts.
The Role of Charlotte Agentic SOAR in Modern Automation
At the heart of the newly expanded workflow lies CrowdStrike’s Charlotte Agentic SOAR, a technology that represents a generational leap beyond traditional security orchestration tools. Standard SOAR platforms have long relied on rigid, playbook-driven automation. While effective for predictable, repetitive tasks, traditional playbooks often fail when confronted with novel, multi-stage attacks that do not neatly fit predefined conditional logic branches. Furthermore, building and maintaining these complex scripts typically requires specialized coding skills and constant manual updates.
Charlotte Agentic SOAR aims to dismantle these limitations by combining structured automation with advanced agentic reasoning. Within this architecture, AI-powered agents are deployed to handle specific cognitive and operational workloads across native, custom, and third-party security tools. These agents are not merely passive script-runners; they possess the capability to reason, collaborate, and execute complex workflows in real time.
According to technical documentation provided by CrowdStrike, security teams interact with Charlotte Agentic SOAR through natural language interfaces powered by Charlotte AI AgentWorks. Analysts can define high-level operational intent and establish strict guardrails, allowing the autonomous agents to design, test, and deploy customized response workflows across the Falcon platform and connected third-party integrations like Rubrik.
In the context of identity recovery, Charlotte Agentic SOAR serves as the neural conductor. When CrowdStrike detects an identity-based intrusion, the SOAR layer interprets the natural-language intent of the security policy, communicates with Rubrik’s APIs to assess backup integrity, evaluates the collateral impact of a potential directory rollback, and orchestrates the surgical remediation plan. Throughout this entire autonomous lifecycle, human analysts retain ultimate authority, retaining the ability to review, approve, or override agent-driven actions via a centralized dashboard.
Industry Implications and Strategic Analysis
The expansion of the Rubrik-CrowdStrike partnership carries significant implications for the broader cybersecurity industry, reflecting a broader trend toward platform consolidation, ecosystem interoperability, and the operationalization of artificial intelligence.
For enterprise security and IT leaders, the integration addresses a persistent cultural and operational friction point: the traditional silo between security operations (SecOps) and data protection (Backup and Recovery) teams. Historically, SecOps personnel focused on threat detection, endpoint isolation, and incident containment, often lacking direct visibility into or control over enterprise backup systems. Conversely, IT infrastructure and backup teams managed disaster recovery and business continuity plans, frequently operating in the dark regarding active cyber threats until a catastrophic failure occurred.
By unifying CrowdStrike’s real-time threat telemetry with Rubrik’s data protection and identity resilience infrastructure, the two companies are helping organizations break down these historical silos. The joint offering aligns the incentives of both departments: security teams gain the power of rapid, data-backed recovery, while IT infrastructure teams gain automated protection mechanisms that prevent threat actors from weaponizing backups or re-infecting restored systems.
From a market perspective, the partnership underscores the growing importance of identity-centric resilience. As cyber insurance underwriters increasingly demand robust recoverability guarantees and demonstrable incident response capabilities, tools that can slash the mean-time-to-recovery (MTTR) for identity environments will become critical differentiators. Organizations that can recover from sophisticated Active Directory attacks in hours rather than weeks will minimize regulatory penalties, preserve customer trust, and avoid the catastrophic financial drain associated with extended operational outages.
However, industry analysts also point out that increased reliance on autonomous, agentic orchestration introduces new governance challenges. As AI agents are granted the autonomy to execute high-impact remediation actions—such as rolling back directory changes or initiating forest recoveries—enterprises must establish rigorous auditing frameworks and clear guardrails to prevent algorithmic errors or malicious prompt-injection attacks from compromising core infrastructure. Both Rubrik and CrowdStrike have emphasized that human-in-the-loop oversight remains central to their architectural design, mitigating these risks by ensuring that analysts retain veto power over automated workflows.
Looking ahead, the collaboration between Rubrik and CrowdStrike signals a maturation of the cybersecurity marketplace. As adversaries continue to weaponize automation, artificial intelligence, and stolen credentials, defenders must respond with equally sophisticated, tightly integrated ecosystems. By wedding real-time threat intelligence with immutable data resilience and agentic orchestration, the two vendors have established a compelling blueprint for how the enterprise of tomorrow will defend its most critical asset: its identity.
