Vali Cyber today at Fal.Con 2026 announced a new integration with CrowdStrike that enables security data from ZeroLock® to flow into CrowdStrike Falcon® Next-Gen SIEM. The integration enables security teams to correlate ZeroLock hypervisor security data with endpoint, identity, cloud, threat intelligence, and other security telemetry during investigations, providing additional context and faster response to threat activity.

This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260902891127/en/

As virtualization becomes the backbone of private AI and sensitive workloads, hypervisors have become an increasingly attractive target for adversaries. Compromised credentials, exploited vulnerabilities, and misconfigurations can provide attackers access to the virtualization layer for lateral movement, persistence, and ransomware. ZeroLock provides runtime protection at the hypervisor layer, enforcing behavior in real time to block malicious activity as it happens. By making ZeroLock security data available within Falcon Next-Gen SIEM, security teams can incorporate hypervisor activity into broader investigations and security operations workflows.

Falcon Next-Gen SIEM delivers more capabilities and up to 150x faster search performance than legacy SIEMs and solutions positioned as SIEM alternatives, at an 80% lower total cost of ownership.

The integration enables organizations to:

  • Bring hypervisor security data into Falcon Next-Gen SIEM. A certified Push Data Connector and parser send ZeroLock data into Falcon Next-Gen SIEM over a standard HEC endpoint, with no middleware or additional agents required.

  • Correlate hypervisor activity with broader security telemetry. ZeroLock events are normalized to the CrowdStrike Parsing Standard and ECS, enabling security teams to correlate detections with endpoint, identity, cloud, and other security data during investigations.

  • Investigate and hunt hypervisor threats. Ransomware, tampering, unauthorized file and configuration access, and credential-abuse alerts are available as events in Falcon Next-Gen SIEM, enabling teams to build dashboards, create correlation rules, and hunt threats, with pivots back to the source alert for additional context.

“The hypervisor has become one of the most targeted and least visible layers in the modern data center. As attackers increasingly target this critical layer, security teams need real-time protection and visibility into hypervisor activity,” said Austin Gadient, CTO and co-founder of Vali Cyber. “We’re excited about this integration with CrowdStrike because it brings ZeroLock security data into Falcon Next-Gen SIEM, where teams can correlate it with security telemetry from across their environment. This is what real infrastructure security looks like: preemptive protection at the source, with the visibility to act on it at scale.”

To learn more about the integration, visit https://valicyber.com/resources/hypervisor-protection-in-crowdstrike-falcon-next-gen-siem/.

To learn more about the Vali Cyber and CrowdStrike partnership, visit https://marketplace.crowdstrike.com/listings/vali-cyber-zerolock/.

About Vali Cyber

Vali Cyber® secures where attacks have the most impact: mission critical systems. While most defenses focus on endpoints, Vali Cyber identified Linux and hypervisors as critical yet under protected. Built for this reality, ZeroLock delivers preemptive security with command line native MFA, exploit prevention, deep hypervisor visibility, and AI-driven behavioral detection. By operating at the hypervisor layer, ZeroLock stops threats in real time without performance impact or added overhead. If incidents occur, automated rollback restores workloads in seconds, ensuring uptime. Recognized by Gartner as a Key Startup in Security Software, Vali Cyber leads by protecting the foundation of modern infrastructure others overlook.

Media gallery

About The Author
Business Wire