CrowdStrike, the U.S. cybersecurity giant, has taken a strategic investment stake in Above, an Israeli startup that uses network-layer analysis to surface insider threats, unauthorized devices, and anomalous traffic patterns before they escalate into breaches. The deal, reported by Calcalist Tech, underscores growing enterprise demand for security tools that look inward as well as outward, at a moment when credential misuse and rogue insiders are climbing the priority list for corporate security teams worldwide.
The investment adds CrowdStrike to Above’s roster of backers and represents a vote of confidence in the Tel Aviv-based company’s approach to a problem that traditional endpoint tools have historically struggled to address. Above’s platform monitors network traffic at the protocol level, generating a continuously updated map of device behavior that security teams can query in real time. The backing also reflects a broader surge of institutional capital flowing into Israeli cybersecurity, a trend tracked in recent coverage of tech funding rounds through mid-2026.
Why Network Visibility Is Gaining Ground
The case for network-based detection tools has strengthened considerably over the past two years. Analysts estimate that insider-related incidents — encompassing deliberate data exfiltration, accidental misconfiguration, and compromised employee credentials used by external actors — now account for between 25 and 30 percent of material security events at large organizations. That share has risen as remote and hybrid working arrangements expanded the attack surface and made it harder for security operations centers to distinguish legitimate employee behavior from abuse.
Above’s architecture addresses this by sitting passively on the network rather than requiring an agent installed on each device. That design choice matters in environments with unmanaged endpoints, operational technology hardware, or contractor-owned machines — precisely the segments where coverage gaps tend to appear. The company maps relationships between devices, users, and services, flagging deviations from established baselines rather than relying solely on signature-based detection, which is inherently backward-looking. For CrowdStrike, whose Falcon platform is heavily agent-centric, the Above investment fills a visibility gap in network segments where agent deployment is impractical.
Strategic Fit for CrowdStrike’s Platform Ambitions
CrowdStrike has been expanding its platform beyond its endpoint detection roots for several years, adding identity protection, cloud workload security, and threat intelligence capabilities in an effort to consolidate what it calls a unified security operations workflow. The Above investment fits that pattern: rather than acquiring a point solution outright, CrowdStrike takes a position that allows for integration experimentation and potential deeper collaboration without the immediate overhead of a full acquisition.
The Israeli cybersecurity ecosystem has become a reliable pipeline of such opportunities. Decades of investment in military signals intelligence have produced a dense concentration of network and protocol expertise in the private sector, and Above’s founding team draws on that background. The startup is targeting enterprises in financial services, critical infrastructure, and healthcare — verticals where regulatory pressure around insider threat programs has intensified, particularly in the United States and European Union, following a series of high-profile incidents involving privileged account abuse.
Financial terms of the CrowdStrike investment in Above were not disclosed. The deal structure appears to be a minority strategic round rather than a valuation-setting primary raise, meaning no headline figure has been confirmed. What is clear is that the backing from one of the world’s most recognized cybersecurity brands provides Above with both capital access and a potential route to enterprise customers already operating within the CrowdStrike ecosystem — a distribution advantage that, for an early-stage security vendor, can be more valuable than the check itself.