Rubrik (NYSE: RBRK) and CrowdStrike announced an integration aimed at automating recovery from identity-based cyberattacks, combining CrowdStrike's Falcon Next-Gen Identity Security with Rubrik Identity Resilience through CrowdStrike's Charlotte Agentic SOAR platform.

The companies said the integration creates a closed-loop workflow in which CrowdStrike detects and contains malicious activity while Rubrik correlates detection data with identity activity logs. The system can reverse unauthorized Active Directory changes, remove malicious files, and trigger automated forest recovery plans with minimal manual intervention. According to the companies, the goal is to reduce recovery time from days to hours.

The announcement was made at CrowdStrike's Fal.Con 2026 conference in Las Vegas.

Data cited from Rubrik Zero Labs found that 90% of IT and security leaders consider identity-based attacks the single largest threat to their organizations.

"As adversaries weaponize AI and a breach unfolds in milliseconds, relying on human reaction time is risky and obsolete," said Anneka Gupta, Chief Product Officer at Rubrik. "We integrated Rubrik and CrowdStrike because you can't fight rapid AI threats with manual workflows."

Daniel Bernard, Chief Business Officer at CrowdStrike, said the integration represents the next phase of the companies' existing partnership. "By bringing CrowdStrike and Rubrik together via agentic workflows, we're empowering organizations to contain and recover from identity-based attacks faster than ever," he said.

The integration builds on existing connections between the two companies, including Falcon Next-Gen SIEM, Falcon Next-Gen Identity Security, and Threat Intelligence. The combined workflow is designed to scan Human Resources Information Systems and identity governance and administration solutions for threats across backup data.