CrowdStrike has introduced Falcon IQ, a new platform that uses more than 50 specialized artificial intelligence agents to automate vulnerability assessment, prioritization, and remediation. The technology draws on open NVIDIA Nemotron models and Charlotte AI AgentWorks, turning Project QuiltWorks — until now focused on coordinating security services among different partners — into automated workflows built directly into the Falcon platform.
CrowdStrike Falcon IQ in 30 seconds
- Falcon IQ uses more than 50 AI agents to automate assessment, prioritization, and remediation tasks.
- NVIDIA Nemotron provides the open models behind the platform’s agentic component.
- The agents combine customer telemetry, threat intelligence, and Falcon OverWatch findings.
- Partners can build and fine-tune their own agents through Charlotte AI AgentWorks.
- CrowdStrike is turning Project QuiltWorks into processes that run directly inside Falcon.
The announcement came at Fal.Con 2026 in Las Vegas and marks a new stage for Project QuiltWorks, CrowdStrike’s initiative to coordinate technology and services from different companies to assess risks tied to advanced AI systems.
What sets Falcon IQ apart is pushing part of that work into the realm of autonomous or semi-autonomous agents. Instead of just generating a report on vulnerabilities, the platform aims to correlate available data, set priorities, and propose or carry out specific remediation steps.
CrowdStrike presents the shift as a way to speed up tasks that traditionally require significant work from analysts and consultants. The real-world scope will depend on the agents configured, each organization’s policies, and which functions are actually available in production.
More Than 50 Agents to Divide Up the Security Work
Falcon IQ doesn’t rely on a single model to handle the whole process.
CrowdStrike has built an architecture with more than 50 specialized agents that split up the different phases of assessment, prioritization, and remediation.
The idea resembles how a human team works: different components handle specific tasks, and their outputs are later combined into a shared process.
The agents can analyze vulnerabilities, tie them to real threat information, and determine which ones should get priority attention.
That last point matters a lot.
A large organization can accumulate thousands of known vulnerabilities. Treating them purely by their theoretical score can mean spending resources on flaws with little chance of being exploited while others that are actively being used by attackers stay unaddressed.
Falcon IQ tries to add context to that decision.
The platform correlates customer telemetry, CrowdStrike threat intelligence, and findings from Falcon OverWatch, the company’s managed threat-hunting service.
Based on that information, the agents can put together recommendations and courses of action.
Automation doesn’t mean every vulnerability found gets fixed automatically with no oversight. CrowdStrike describes agents capable of validating, prioritizing, and carrying out remediation tasks, but the actions available depend on the workflows, permissions, and policies configured.
NVIDIA Nemotron Powers Falcon IQ’s Engine
NVIDIA holds an important place within the architecture.
The open NVIDIA Nemotron models power the agentic component CrowdStrike uses to validate and prioritize code vulnerabilities and later take part in fixing them during execution.
Nemotron isn’t a single model. NVIDIA uses that name for a family of models and technologies for building AI agents, with different sizes and specializations.
CrowdStrike combines these models with Falcon Foundry and Charlotte AI AgentWorks.
Charlotte AI AgentWorks is CrowdStrike’s no-code platform for building agents aimed at security operations. Partners can use it to develop and fine-tune their own agents for each customer’s needs.
This capability is an important part of Falcon IQ’s commercial approach.
CrowdStrike doesn’t want the more than 50 included agents to be the system’s limit. Integrators and service providers can add their own procedures and adapt existing ones to different industries, infrastructures, or internal policies.
| Component | Role within Falcon IQ |
|---|---|
| NVIDIA Nemotron | Open models used by the agentic engine |
| Charlotte AI AgentWorks | Building and fine-tuning security agents |
| Falcon Foundry | Foundation for building applications on Falcon |
| Falcon OverWatch | Findings from threat hunting |
| CrowdStrike Threat Intelligence | Context on attackers and techniques |
| Falcon IQ | Orchestration of assessment, prioritization, and actions |
The combination shows how so-called agentic AI is moving from conversational assistants to operational processes with access to enterprise tools and data.
And that also raises the need to set clear limits on what each agent can do.
From Finding a Vulnerability to Deciding What to Do About It
One of the distinctions CrowdStrike wants to introduce with Falcon IQ sits between spotting a problem and turning it into a concrete action.
A traditional assessment can end up as dozens or hundreds of pages describing vulnerabilities, exposure, and recommendations.
Then another part of the work begins: deciding what to fix first, assigning owners, bringing in services when needed, and later checking whether the risk has actually gone down.
Falcon IQ tries to keep that process inside the platform.
The agents correlate the findings and generate recommended actions. These can include adjustments within the Falcon platform itself, activating additional modules, or services provided by Project QuiltWorks partners.
Providers can upload their service catalog and tie it to the issues found.
The system can then generate playbooks that connect findings to possible actions, attack narratives, and investment priorities.
This feature also turns Falcon IQ into a tool for CrowdStrike’s channel, not just for internal security teams.
Partners can deliver results through a custom, white-labeled dashboard, where the customer can check findings, recommendations, and how the remediation plan is progressing.
Project QuiltWorks Brings Together Technology, Services, Cloud, and Insurance
Falcon IQ comes out of Project QuiltWorks, but the two names aren’t exactly interchangeable.
QuiltWorks lays out a broader model for tackling risks tied to so-called frontier AI, a term used for advanced AI systems whose capabilities and exposure can grow quickly.
The initiative combines AI models from different providers, CrowdStrike technology, integrator services, cloud infrastructure, and cyber-insurance companies.
CrowdStrike says Project QuiltWorks uses models from OpenAI and Anthropic, in addition to NVIDIA Nemotron.
Hardened infrastructure from Amazon Web Services (AWS) and services from various integrators are also part of the initiative. CrowdStrike has already built cyberattack-recovery actions directly into its Charlotte Agentic SOAR together with Commvault, another example of that same partner ecosystem in action.
Falcon IQ now turns part of that model into an operational product inside Falcon.
The distinction matters because not all of Project QuiltWorks automatically runs on Nemotron, and not all of its components are autonomous agents.
NVIDIA provides the open models used in Falcon IQ’s agentic engine, while other models and providers remain part of QuiltWorks’ broader environment.
Cybersecurity Starts Organizing Around Teams of Agents
Using more than 50 agents is probably more interesting than the number itself.
Until recently, much of the way generative AI made its way into security tools followed the copilot model: an analyst asked a question, and the system explained an alert, generated a query, or summarized an investigation.
Agents bring a different approach.
Instead of constantly waiting for individual instructions, they receive a goal, use tools, pull information, run intermediate steps, and coordinate their results.
One agent might classify a vulnerability. Another might check its ties to techniques used by specific attackers. A third might analyze the asset’s exposure, and another might prepare a remediation action.
The analyst goes from manually working through each step to overseeing a workflow made up of different specialized agents.
It’s an evolution with clear advantages for repetitive tasks, but it also introduces new risks.
A mistake in a chatbot can produce a wrong answer. A mistake in an agent with operational permissions can trigger the wrong action on a real system.
That’s why model quality is only part of the problem. The permissions granted, the traceability of decisions, human approval, defined limits, and the ability to undo actions all matter too.
Falcon IQ will have to prove how that balance works in real enterprise deployments.
Attackers Are Using Automation Too
The push to bring agents into security operations centers doesn’t come only from a desire to cut costs.
Attackers can also use artificial intelligence to speed up reconnaissance, content creation, target analysis, and adapting their operations.
That shortens the time available to respond to certain threats.
CrowdStrike argues that defenders will need fleets of specialized agents capable of reasoning and acting at a comparable speed. NVIDIA shares that view, though it remains a vendor forecast about how security operations will evolve — CrowdStrike previously took a similar tack when it turned to Cerebras’ inference infrastructure to speed up Falcon AIDR, its other AI-driven detection platform.
The current reality is more gradual.
Security teams still need human analysts, escalation procedures, and controls over sensitive actions. Automation can eliminate repetitive work and speed up investigations, but it doesn’t turn every incident into a problem that can be resolved without human involvement.
Falcon IQ represents exactly that transition.
CrowdStrike is trying to move from an assistant that helps the analyst to a set of agents that takes a direct part in the operational process, from initial assessment through certain remediation actions.
The fact that the system launches with more than 50 agents also shows where this market may be heading: less emphasis on building a single model that knows all of cybersecurity, and more on coordinating numerous agents with defined roles and permissions.
It remains to be seen how much work they can reliably take on and how much will keep needing human oversight.
CrowdStrike also includes a disclaimer in its own announcement: some features or services mentioned haven’t launched yet and remain in development, so they may change. Organizations should base their purchasing decisions on capabilities that are currently available.
That caveat matters especially in a space where the pace of AI announcements can outrun the actual availability of all the promised features.
Frequently Asked Questions
What is CrowdStrike Falcon IQ?
Falcon IQ is a platform CrowdStrike introduced to automate vulnerability assessment, prioritization, and remediation using artificial intelligence agents within the Falcon environment.
How many AI agents does Falcon IQ use?
CrowdStrike says Falcon IQ uses more than 50 specialized agents to automate different parts of the assessment, prioritization, and remediation process.
What role does NVIDIA play in Falcon IQ?
The open NVIDIA Nemotron models power the agentic engine used by Falcon IQ. CrowdStrike combines these models with Falcon Foundry and Charlotte AI AgentWorks to build and customize agents.
Does Falcon IQ also use models from OpenAI and Anthropic?
CrowdStrike says the broader Project QuiltWorks initiative uses models from OpenAI and Anthropic, in addition to open NVIDIA Nemotron models. Within Falcon IQ, NVIDIA Nemotron is the provider specifically identified for the agentic engine described in the announcement.
