CrowdStrike is expanding its Falcon platform with Falcon IQ, which deploys more than fifty AI agents for security tasks. At the same time, the company is adding new data sources to Project QuiltWorks, bringing Falcon to Google Cloud, and integrating the platform with Snowflake.
Falcon IQ builds on Project QuiltWorks, the partnership through which CrowdStrike aims to detect and address risks associated with AI systems. Until now, the assessments within QuiltWorks were performed as manual services, according to SiliconANGLE. With Falcon IQ, CrowdStrike is moving a large portion of that work to the Falcon platform and having AI agents perform the analysis.
From assessment to remediation
Falcon IQ uses more than fifty specialized agents for tasks including assessment, prioritization, and remediation. They can analyze vulnerabilities, determine which issues are most critical, and propose mitigation measures. Partners can also develop their own agents or customize existing ones for a client’s environment.
The system is built on Falcon Foundry and Charlotte AI AgentWorks and utilizes, among other things, NVIDIA’s open Nemotron models. Within QuiltWorks, models from OpenAI and Anthropic are also used to identify vulnerabilities.
For assessments, Falcon IQ combines customer telemetry with threat intelligence from CrowdStrike and findings from Falcon OverWatch. This can result in, among other things, priorities and a remediation roadmap. In this way, CrowdStrike aims to use AI agents not only for analysis but also for the entire process from detection to remediation.
At the same time, CrowdStrike is expanding the volume of data on which these analyses can be based. Twelve security vendors will provide telemetry to Falcon Next-Gen SIEM. These include Zscaler, Rubrik, Netskope, and HackerOne. Falcon Onum handles the processing of these data streams.
Integration with Snowflake
Snowflake is also becoming more closely integrated with Falcon. Security teams can use federated search within Falcon to directly search data stored in Snowflake without first having to move it. Falcon Next-Gen SIEM can then correlate that data with CrowdStrike telemetry and other security data.
The connection also works in the other direction. Falcon Onum can route security telemetry to Snowflake and other destinations. It will also be available via the Snowflake Marketplace, allowing customers to use their existing Snowflake capacity toward the purchase.
Finally, CrowdStrike is making the Falcon platform available on Google Cloud. The rollout will begin in U.S. regions and is expected to expand later. This gives organizations more choice regarding where Falcon and its associated data are hosted, in part due to data residency requirements.
These announcements are part of the same platform strategy. With Falcon IQ, CrowdStrike automates more security tasks, while simultaneously increasing the amount of available security and enterprise data and offering more choice regarding the infrastructure on which Falcon itself runs.