CrowdStrike Reveals What Happened, Why—And What’s Changed

Nearly three weeks after a botched CrowdStrike update caused one of the biggest IT outages in history, the firm has published its in-depth investigation into what happened and why. CrowdStrike’s Root Cause Analysis report elaborates on the information previously shared in its preliminary Post Incident Review.

In its new post mortem report, CrowdStrike delves deeper into the root causes of the error that led Windows machines to display blue screen of death—and admits its testing process left a lot to be desired.

The firm has certainly faced a tough time in the weeks since the outage, after it was sued by investors last week. CrowdStrike and the CEO of Delta are also exchanging words after the airline blamed the security company for $500 million of losses.

What Happened

In its RCA, the firm describes how its CrowdStrike Falcon sensor “delivers AI and machine learning to protect customer systems by identifying and remediating the latest advanced threats.”

The problem that led to the outage stems from a new feature that was added to its sensor in February, “to enable visibility into possible novel attack techniques that may abuse certain Windows mechanisms.”