The first installment in this series looked at how adversaries in the CrowdStrike 2026 Threat Hunting Report exploit the seams between endpoint, identity, cloud, and perimeter, and why network telemetry stays visible across those seams. This installment looks at a narrower gap: the places where an endpoint agent cannot observe what happens.
There are two kinds. The first is timing. An agent can only observe a device after the operating system boots and the agent starts, so anything done to the device before then goes unseen. The second is coverage: the printers, cameras, controllers, appliances, and unmanaged laptops where no agent will ever be installed. The report documents a striking example of the first. The second is far more common, and it is where most organizations carry the larger gap.
A Compromise Written Before the Agent Starts
The report describes a China-nexus adversary CrowdStrike tracks as OVERCAST PANDA, conducting close-access operations against business travelers. In the campaign VentureBeat detailed from the report and an interview with CrowdStrike, operators entered hotel rooms at an agricultural industry conference on Hainan Island between March and May 2026, while the executives were at dinner. They booted the laptops from USB media, wrote the FlowCloud backdoor directly to storage, rebooted the machines, and left. No phishing email, no network exploit, no stolen login.
The detail that matters here is timing. CrowdStrike’s sensor detected FlowCloud once it started after the next boot, and OverWatch disrupted the intrusions. The exposure was the window in between: the hours after the USB write and before the laptop was powered on again, when nothing on the device was running to observe anything.
It is worth being precise about the lesson. The primary defenses for this attack are firmware and policy: disable external boot, protect the BIOS with an administrator password, require pre-boot authentication, and issue travel-only devices for high-risk trips. Network telemetry does not stop a hotel-room USB write. CrowdStrike also points out that physical-access operations do not scale; each one compromises a single device belonging to a specific target.
What the case illustrates is broader than hotel rooms. Once FlowCloud ran, it collected keystrokes, screenshots, files, and credentials. Collected data has value to an operator only after it leaves the device, and leaving the device means network traffic. Whenever activity on a device goes unobserved, for whatever reason, its conversations with the outside world remain a separate line of evidence.
The Larger Gap: Devices That Never Run an Agent
Hotel-room access is rare and targeted. Devices that cannot run an agent are everywhere. Every enterprise network carries traffic from endpoints that will never host an EDR sensor: printers and multifunction copiers, IP cameras, badge readers, building management systems, conference-room displays, lab and medical instruments, industrial controllers, contractor and personal devices, and the network appliances themselves.
These devices share a property with the laptop in the hotel room during those unobserved hours: whatever happens on them produces no agent telemetry. That is also what makes them attractive footholds. A compromised camera or controller can host scanning, relay command-and-control traffic, or stage data, and the only record of that activity is the traffic it generates. We covered the operational technology version of this problem in Agentless Security for OT/ICS Networks. The same reasoning applies across the rest of the unmanaged estate.
An agent sees what happens on the device it runs on, once it is running. The network sees every device that talks, whether or not anything is installed on it.
The Network as a Second Witness
Routers, switches, firewalls, and wireless controllers export flow records for the traffic crossing them, regardless of what is or is not installed on the endpoints at either end. That makes flow telemetry an independent witness. It records which device talked to which destination, when, over what protocol, and how much data moved, for managed and unmanaged devices alike.
Raw flow is not ready for a hunter, though. It arrives as binary NetFlow, IPFIX, sFlow, or J-Flow, in volumes that are impractical to index, carrying IP addresses rather than context. NetFlow Optimizer (NFO) closes that gap. It parses the binary formats, enriches each record with user identity where an identity mapping exists, application, threat intelligence, and GeoIP/ASN context, and reduces volume by 80 to 90 percent, primarily through aggregation. Its SNMP-based auto-discovery builds an inventory of the network devices carrying that traffic. NFO then delivers the result, CIM-compliant, to Splunk.
That evidence lets a hunter ask useful questions about devices where no agent is reporting:
| Hunting question (asked in Splunk) | What enriched flow contributes |
| Is a device that should never reach the internet, such as an OT controller, badge reader, or building management system, connecting to external destinations? | Source, destination, direction, and application for every conversation, including outbound traffic from internal segments |
| Is a cloud-connected device, such as an IP camera, talking to destinations other than its vendor’s service? | Destination GeoIP/ASN context on each record, showing whether traffic goes to the expected provider or somewhere else |
| Is any device talking to infrastructure on a threat intelligence list? | Threat intelligence enrichment on each record, ready to match against in the SIEM |
| Did a laptop start reaching new destinations after its owner returned from travel? | User identity attribution where available, plus destination context to compare over time |
| Is a device holding recurring connections to the same external destination for days? | Per-conversation byte counts, timing, and destination context, at a volume the SIEM can retain for long lookbacks |
| Is an unmanaged device moving data across a segment boundary it should not cross? | Device-to-device flow records between segments, where internal infrastructure exports flow |
Where the Hunt Happens
NFO does not detect, alert, or decide which of those patterns is malicious. It collects, enriches, reduces, and delivers. The questions in the table are asked in Splunk, by hunters and the detection content they build, against data that arrives already carrying the context those questions require.
That division of labor matters because hunting time is scarce. In Splunk’s CISO Report 2026, CISOs named threat hunting as the skill set most lacking in their security programs. When hunters are the bottleneck, the evidence they work from has to be complete and immediately usable, including for the devices that never report on themselves.
The Bottom Line
Endpoint agents provide deep evidence where they run, and the CrowdStrike 2026 Threat Hunting Report shows how much that evidence matters. But there are places an agent cannot be: the window before it starts, and the large population of devices where it is never installed. Network flow covers both, because every device that communicates produces traffic. NFO turns that traffic into enriched, CIM-compliant evidence in Splunk, so hunters can see the devices that cannot speak for themselves.
Protect the endpoint with agents and firmware controls. Watch everything else through the network.
This is the second post in our series on the CrowdStrike 2026 Threat Hunting Report. Read part one: The Evasive Adversary and the Network Layer.
Want enriched visibility into every device on your network, including the ones that cannot run an agent? Start a free 60-day trial of NetFlow Optimizer or schedule a technical demo with a NetFlow Logic engineer.
Start Free Trial | Schedule a Demo | Splunk Integration | NFO Documentation