CrowdStrike launches agentic AI platform to automate security tasks

From execution to agency

CrowdStrike is shifting its security strategy toward 'agentic' AI, where software moves from simply following programmed instructions to acting with a level of autonomy. During the Fal.Con conference, CrowdStrike President Michael Sentonas noted that software has moved from execution to agency. This shift means AI entities can now reason and act on behalf of humans, though they may not always behave in predictable ways.

This evolution is driven by the need to counter increasingly sophisticated threats. While hackers have traditionally been human-led, the rise of rogue agents has created a landscape where threats can act at machine speed. Enterprises are now facing a situation where AI agents could be used by both attackers and defenders simultaneously across the entire network perimeter.

The scale of this shift is significant for large organizations. Gartner analysts suggest that the number of AI agents used within a single Fortune 500 company could expand from 15 in 2025 to 150,000 by 2028. This rapid growth creates a risk of an ungoverned sprawl, where agents might cause data loss, misinformation, or oversharing of sensitive information.

How the platform works

The new Agentic Security Platform integrates several components to automate Security Operations Center (SOC) activities. It allows agents to investigate alerts using pre-built tools or custom ones created with a no-code solution. These agents use a shared memory layer to coordinate across different endpoints, identities, and cloud services at the same time.

To improve the speed of data ingestion, CrowdStrike utilized its 2025 acquisition of Onum. This allows worker agents to perform 'grunt work' like basic triage, as well as more complex Level 2 and Level 3 investigation and remediation workflows. By handling these repetitive tasks, the system aims to relieve human teams of the most tedious parts of their jobs.

The platform also includes a system called SafeMind for continuous testing. Based on Nvidia’s Nemotron open-weight model, it creates an isolated mirror of a live environment to test for weaknesses. This framework feeds results back into the detection level, allowing the system to autonomously identify and address vulnerabilities before they can be exploited.

The challenge of oversight

While these tools offer speed, experts argue that faster detection is not enough on its own. Because AI is probabilistic, it can produce different results for the same input, which conflicts with the deterministic requirements of security auditing. Security leaders must figure out how to verify that an autonomous action was both authorized and correct.

For many organizations, these agents will likely serve as an augmentation to human analysts rather than a total replacement. The workload for human teams will shift toward verification processes. Analysts will need to spend time evaluating agents against known-good and known-bad cases, similar to how they currently test detection content.

This transition requires significant engineering time that many security teams have not yet budgeted for. Organizations must establish clear rules for who or what has the authority to act within the network. Without these constraints, the very tools meant to simplify security could introduce new problems regarding inconsistent policies and fragmented telemetry.

Securing the AI helpers

A new risk is emerging where the agents themselves become an attack surface. Because these systems have privileged identities and access to sensitive data, they can be manipulated or behave unexpectedly if compromised. This creates a paradox where security operations must now build systems to protect their AI helpers from becoming internal threats.

CrowdStrike addressed this by launching Falcon Guardian, a solution for detecting and responding to misbehaving agents. It includes features like runtime enforcement, agent discovery, and the ability to quarantine agents that act dangerously. This ensures that the autonomous systems have their own layer of oversight to prevent them from causing harm to the infrastructure they are meant to protect.

To further manage this, CrowdStrike acquired Fiddler AI for roughly $400 million to provide a governance control plane. Fiddler tracks over 100 metrics, including hallucinations, toxicity, and personally identifiable information (PII) leakage. The company intends to bundle this into its platform in Q4 FY2027 to help businesses prove they can use AI agents safely on a daily basis.