CrowdStrike launches Falcon IQ to automate AI defence

CrowdStrike has launched Falcon IQ and expanded the Project QuiltWorks coalition, adding automation and new data integrations to its effort to secure AI deployments.

Falcon IQ is designed to bring Project QuiltWorks into day-to-day use for partners including security vendors, cloud providers and systems integrators. The product uses more than 50 agents to automate assessment, prioritisation and remediation workflows, and lets partners build custom agents for specific customer requirements.

Project QuiltWorks now includes Abnormal AI, Artemis Security, AttackIQ, ExtraHop, HackerOne, Horizon3, Netskope, Picus Security, Rubrik, SafeBreach, Terra Security and Zscaler. Their data will be integrated into Falcon Next-Gen SIEM, broadening the information available for attack path analysis and remediation planning.

Both announcements focus on the growing use of AI in cyber defence and cyber attacks. Falcon IQ is built on Falcon Foundry and Charlotte AI AgentWorks, CrowdStrike's no-code agent development platform, and uses open Nemotron models from NVIDIA alongside models from OpenAI and Anthropic.

According to CrowdStrike, Falcon IQ brings the QuiltWorks assessment process into the Falcon platform by correlating customer telemetry, CrowdStrike threat intelligence and Falcon OverWatch findings. Partners can load their services catalogues into the platform, where agents generate playbooks that map findings to partner services, investment priorities and remediation roadmaps.

The product also includes a customer-facing dashboard that partners can co-brand. Customers can view findings, recommended actions and progress against remediation plans in real time.

Partner model

Project QuiltWorks is positioned as a coalition model that combines CrowdStrike's vulnerability discovery and prioritisation with partner services, cloud infrastructure and cyber insurance. Falcon IQ extends that model by reducing the manual work required from partners when assessing and addressing AI-related security risks.

Daniel Bernard, Chief Business Officer at CrowdStrike, described Falcon IQ as a shift in how those tasks are carried out.

"Falcon IQ changes the economics of securing frontier AI risk. Agents do the heavy lifting, partners scale delivery, and organisations gain protection in a fraction of the time and cost. QuiltWorks proved the model; Falcon IQ advances it from manual to the speed of AI across the Falcon platform," Bernard said.

NVIDIA is supplying the open Nemotron models behind the agentic system in Falcon IQ. CrowdStrike said the models are used to validate and prioritise code vulnerabilities, then support remediation during runtime.

Justin Boitano, Vice President of Enterprise AI at NVIDIA, said the companies expect specialised AI agents to play a more central role in cyber defence.

"In the age of AI, cybersecurity will be fuelled by fleets of specialised AI agents reasoning faster than adversaries can act. With open NVIDIA Nemotron models powering Falcon IQ, CrowdStrike and its partners can build and tune defence agents that evolve according to the unique needs of every customer," Boitano said.

Data expansion

The coalition expansion is intended to increase the range of real-time signals flowing into Falcon Next-Gen SIEM. CrowdStrike said the broader data set should improve visibility across customer environments, particularly where risks span email, identity, networking, applications and data protection tools.

Falcon Onum real-time data pipelines are intended to reduce the work needed to onboard third-party data. Data from software vendors flows directly into the Falcon platform, where it is filtered and analysed before storage, with Charlotte AI agents handling onboarding and exposure prioritisation.

Bernard said the expanded coalition reflects the central role of data in identifying risk.

"Cybersecurity has always been a data problem. Frontier models' ability to discover, chain and exploit vulnerabilities at machine speed makes the problem harder and the clock shorter. Visibility is the answer. QuiltWorks now has an even broader data picture, the coalition to act on it, and the automation to operationalise the response faster and at a fraction of the cost," Bernard said.

Several partners linked their participation to specific parts of the attack chain. Abnormal AI pointed to behavioural signals in email and identity. Artemis Security said it focuses on detections and mitigations between vulnerability disclosure and patching. Horizon3 described its role as bringing an attacker's perspective, while Netskope said its telemetry would add insight across users, AI, applications and data.

Picus Security said its role is to validate whether controls can block, detect and contain real-world attack behaviour. Rubrik said its data will help connect risk discovery with recovery planning, particularly around enterprise data.

The additions suggest CrowdStrike is trying to make Project QuiltWorks broader than a single-vendor product set by linking telemetry, prioritisation and remediation across a wider security ecosystem. The coalition now spans exposure management, network detection, cloud and SaaS security, attack simulation, bug bounty and data resilience vendors.

CrowdStrike said the combination of Falcon IQ and the added SIEM integrations is intended to give partners a faster path from risk detection to recommended actions and remediation tracking inside the Falcon platform.