CrowdStrike Holdings Inc. today launched Falcon IQ, software that hands the assessment and remediation work behind its Project QuiltWorks coalition to a fleet of more than 50 artificial intelligence agents.
The launch is one of four announcements the company made at the opening of its Fal.Con 2026 conference in Las Vegas. QuiltWorks also picked up a dozen new data sources, with telemetry from vendors including Zscaler Inc. and Rubrik Inc. now flowing into Falcon Next-Gen SIEM. The Falcon platform is heading to Snowflake Marketplace, where Snowflake Inc. customers will be able to pay for it out of capacity they have already committed to. And Falcon now runs on Google Cloud.
Project QuiltWorks launched in April. CrowdStrike built the coalition around the software flaws that frontier AI models are surfacing faster than security teams can patch, with the discovery work running on models from OpenAI Group PBC and Anthropic PBC. Accenture PLC, Ernst & Young Global Ltd., IBM Corp. and Kroll LLC signed up to handle remediation. Amazon Web Services Inc. joined in the July quarter to cover the cloud infrastructure layer, and cyber insurers cover the financial side. The assessment work behind all of it has been manual until now, done as an expert-led services engagement sold on a 12-month subscription.
Falcon IQ runs on Falcon Foundry and Charlotte AI AgentWorks, the no-code agent-building tool CrowdStrike introduced at last year’s Fal.Con. Open Nemotron models from Nvidia Corp. sit underneath, validating and ranking code vulnerabilities before remediating them in runtime. The prebuilt agents cover the slowest parts of an engagement, meaning assessment, prioritization and remediation, and partners can build and tune their own on top for individual customers. CrowdStrike’s pitch to those partners is volume: more engagements at lower cost.
The assessment itself moves inside the Falcon platform. Falcon IQ correlates customer telemetry with CrowdStrike threat intelligence and findings from Falcon OverWatch, the company’s managed threat hunting service, then maps what it turns up against a services catalog the partner has loaded in. Out comes an attack narrative, a set of investment priorities and a remediation roadmap.
Recommendations run in two directions. Agents surface Falcon platform tuning and additional modules that could be switched on, and they point at services from the partner’s own catalog that match the exposure found. The customer-facing dashboard is co-branded. The partner’s name sits on the findings, and remediation progress is tracked there as it happens.
“Falcon IQ changes the economics of securing frontier AI risk,” said Daniel Bernard, chief business officer at CrowdStrike. “QuiltWorks proved the model, Falcon IQ advances it from manual to the speed of AI across the Falcon platform.”
Nvidia has been supplying the AI infrastructure under Falcon since a partnership was struck at its GTC conference in March 2024. Justin Boitano, vice president of enterprise AI at the chipmaker, said security in the AI era will be run by “fleets of specialized AI agents reasoning faster than adversaries can act.”
The second announcement widens QuiltWorks on the data side. Twelve security vendors are now feeding Falcon Next-Gen SIEM, spanning email, network, cloud, identity, data protection and adversary simulation. Abnormal AI Inc., Netskope Inc., Zscaler, Rubrik and HackerOne Inc. are among them. The rest are Artemis Security, AttackIQ Inc., ExtraHop Networks Inc., Horizon3.ai Inc., Picus Security Inc., SafeBreach Inc. and Terra Security.
Falcon Onum, the real-time pipeline layer inside Next-Gen SIEM, does the ingestion. CrowdStrike said filtering in the pipeline cuts storage costs by as much as 50% and analyzes data before it lands in the platform, which surfaces attack paths and vulnerabilities earlier. Onboarding a new source is itself handled by native Charlotte AI agents, as is the exposure prioritization that follows.
Bernard tied the expansion to the shrinking window between disclosure and exploitation, saying frontier models’ ability to “discover, chain and exploit vulnerabilities at machine speed” has made the clock shorter and visibility the answer.
Announcement three is a route to market. The Falcon platform will be sold through Snowflake Marketplace, and customers will be able to draw down pre-committed Snowflake capacity to pay for it under the Marketplace Capacity Drawdown program. Procurement is the point, since the arrangement lets a buyer deploy Falcon without opening a fresh purchasing cycle.
Data moves in both directions once it’s in place. Analysts working an investigation in Falcon will be able to query Snowflake tables through federated search, leaving the records where they are. Those tables can also feed Next-Gen SIEM for correlation against CrowdStrike telemetry and outside feeds. Onum will handle the reverse trip, routing security telemetry out to Snowflake and other destinations.
“Enterprises already bring their most critical data to Snowflake, and that broader enterprise context is what makes security decisions better,” Mayank Upadhyay, chief security and trust officer at Snowflake, said in the announcement. He added that the collaboration will let security teams run investigations against data they already trust, without moving it.
The fourth piece of news is infrastructure. Falcon is now available on Google Cloud, starting with U.S. regions, and CrowdStrike said it plans to add more so customers can keep data processing in-country to meet localization rules. Protection across AI agents, endpoints, identities, cloud and data still runs through a single sensor, console and data layer regardless of which cloud the platform sits on.
Brian Goldstein, vice president of strategic AI and ISV at Google Cloud, said data sovereignty and cybersecurity “remain critical components of every enterprise’s multi-cloud and AI strategy.” CrowdStrike extended its Cloud Detection and Response service to Google Cloud in April. Amazon Web Services and Microsoft Azure were already covered.
CrowdStrike reported its fiscal second quarter on Aug. 26, and the stock rose more than 10% in late trading that day. Earnings and revenue both beat expectations. Net new annual recurring revenue climbed 51% in the quarter, to $332.8 million, well clear of the company’s own guidance. Founder and Chief Executive George Kurtz called it the best quarter in CrowdStrike’s history.
