Autoleague Secures Rapid Growth and AI Adoption with CrowdStrike

Autoleague is one of Australia’s largest automotive retailers, with more than 50 dealerships, 2,000 employees, and 25 automotive brand partners. The company sells more than 65,000 vehicles annually, while its MyMoto digital retail platform enables customers to find, finance, and purchase vehicles online.

As Autoleague grew through acquisition and expanded its digital operations, its security challenge grew with it. More dealerships, applications, and partners meant more identities, endpoints, and sensitive customer data to protect — without a large internal security operation.

Autoleague turned to the CrowdStrike Falcon® platform to standardize protection across the business, progressively expanding from endpoint security and managed detection and response (MDR) into identity, recon, SaaS security, and SIEM.

As acquisitions expanded Autoleague nationally, Head of Security & IT Operations Ian Melton inherited an environment with different technologies, aging infrastructure, and inconsistent security practices. The company deployed CrowdStrike Falcon® Complete to provide 24/7 MDR without building its own SOC.

“Falcon Complete provides an expert, fully resourced service with access to cutting-edge AI and all the latest CrowdStrike tools available. Setting up our own SOC would be costly and inefficient in comparison,” said Melton.

That decision proved its value when a newly acquired business unit joined Autoleague’s Microsoft 365 environment. Melton required the unit to deploy Falcon Complete first. Two weeks later, CrowdStrike detected suspicious activity associated with a North Korean IP address on a laptop containing keys used to manage cloud infrastructure. Falcon Complete isolated the device and stopped the activity.

“Only two weeks before that, it would never have been found,” said Melton.

CrowdStrike also helps Autoleague manage a challenge particular to automotive retail: software required by vehicle manufacturers. When one manufacturer required proprietary software to access its systems, Autoleague tested it before deployment. Within minutes, CrowdStrike detected concerning behavior and isolated the endpoint. The resulting investigation gave Melton evidence to take back to the manufacturer, which provided a browser-based alternative.

“We hold vendors to account because they want to interface into our systems,” said Melton. “By having a better security posture, you have time to look at what you want to connect and then do it the proper way and actually monitor it.”

As Autoleague’s environment evolved, the company expanded CrowdStrike protection into identity. CrowdStrike Falcon® Next-Gen Identity Security exposed overprivileged users and endpoints, legacy configurations, and other risks that had accumulated as the business grew. Combined with CrowdStrike’s dark web monitoring capability, Autoleague also identified approximately 200 users with compromised passwords.

“One of the biggest surprises was compromised passwords,” said Melton. “There were service accounts with compromised passwords. There were 200 users with compromised passwords.”

Autoleague had a similar experience with SaaS security. Despite achieving a security score above 95% for its Microsoft 365 environment with another vendor, a CrowdStrike Falcon® Shield proof of concept returned a score in the low 50s based on a broader set of security practices. Among the findings were approximately 150 users relying on an outdated MFA method.

Autoleague addressed the highest-risk findings and expanded Falcon Shield across its SaaS environment. Today, the company uses it to continuously monitor configuration drift as users, domains, and applications change.

“It’s changed us from the ‘department of no’ to ‘no-as-a-service,’” said Melton. “CrowdStrike has made it very easy to explain to the business why we said ‘no’ and how we can change that to ‘yes’ in the future.”

As Autoleague adopts AI across the business, it’s confronting a new security challenge: understanding where and how AI is actually being used. While Copilot Chat is the company’s only approved employee AI tool, an AI usage report in CrowdStrike Falcon® Next-Gen SIEM showed 487 different AI applications being used across the organization in a single week.

For Melton, the finding illustrates the gap between AI policy and AI reality. Employees can share information with public AI services, while business teams increasingly want to connect AI applications to systems containing sensitive customer information.

“It’s a real blind spot,” said Melton. “We want to hook our DMS up to this tool over here, but hang on — your DMS has probably got 10,000 customer records in it. What’s the API doing? Has it got read-write? Where’s the off switch? Who’s the application owner?”

Autoleague recently added Falcon Next-Gen SIEM to bring more security data together. The deployment is still in its early stages, but Autoleague is building a foundation for broader visibility, investigation, and automation, while using CrowdStrike® Charlotte AI™ to query security data with natural language.

For Melton, visibility is ultimately what allows a lean team to stay ahead of an increasingly complex environment.

“We have made significant progress in strengthening our security posture,“ concluded Melton. “The improved visibility helps us identify potential issues earlier and respond more effectively while continuing to adapt as risks evolve.”