Protect Your Weakest Link: New Account Linking Capabilities Use AI to Thwart Identity-Based Attacks

This document highlights the rise of identity-focused attacks (e.g., Kerberoasting) and introduces CrowdStrike’s algorithmic account linking for Active Directory in Falcon Identity Protection, which uses NLP to associate multiple enterprise accounts with a single user. By providing broader identity context, adjusting detection severity across linked accounts, and illuminating identity-based attack paths, the feature aims to mitigate risks created by privilege bifurcation and shared device usage.