CrowdStrike unleashes new agentic, outcome-driven AI Innovations to power the next evolution of the SOC

CrowdStrike unveiled Charlotte AI Agentic Response and Charlotte AI Agentic Workflows, marking a leap forward in modern SOC operations. Combined with the previously announced Charlotte AI Agentic Detection Triage, Charlotte AI transcends “ask-and-respond” copilots, delivering autonomous reasoning and action on first- and third-party data. The AI-native CrowdStrike Falcon® platform is now cybersecurity’s intelligent reasoning AI platform, drawing conclusions without human prompts and taking action with bounded autonomy.

Building on Charlotte AI innovation, CrowdStrike extends the power of agentic AI to cybersecurity services. Falcon® Complete Next-Gen MDR with Charlotte AI utilises the triage decisions of CrowdStrike’s elite analysts to accelerate investigations, creating a powerful, one-of-a-kind feedback loop that supercharges human and AI performance. The winning combination of CrowdStrike’s Charlotte AI agentic model, Next-Gen MDR and CDR, and the underlying Falcon platform delivers the industry’s most advanced AI-native SOC. For the first time, security teams can combine AI-powered real-time detection, expert-informed investigation, and automated response within one native architecture. From analyst productivity to full-cycle response, CrowdStrike is redefining how AI protects the modern enterprise. 

 “There’s a profound difference between adding AI features and fundamentally transforming cybersecurity. Charlotte AI goes beyond augmenting humans with suggestions – it actively investigates, reasons, and responds autonomously within expert-defined guardrails,” said George Kurtz, founder and CEO of CrowdStrike. “Our agentic AI innovation represents a fundamental shift from reactive to proactive security, furthering CrowdStrike’s mission of stopping breaches.”

New Innovations: 

• Charlotte AI Agentic Response: Exponentially increases analyst productivity by automatically asking and answering the investigative questions a seasoned security analyst would pose, accelerating root cause analysis, mapping lateral movement, and guiding next steps. This translates to hours saved weekly across repetitive alert investigations.

• Charlotte AI Agentic Workflows: Delivered through Falcon Fusion SOAR, these drag-and-drop, LLM-powered workflows enable analysts to insert and activate AI reasoning directly within automated playbooks. For example, a workflow can automatically determine whether a device should be contained based on company policies, then generate appropriate communications for different audiences – executive summaries, technical updates, or customer advisories – with automatic translation for global teams.

• Falcon Complete with Charlotte AI: Falcon Complete Next-Gen MDR analysts now leverage Charlotte AI to triage alerts and accelerate analysis, combining expert human oversight with intelligent automation to stop breaches more efficiently.

• Charlotte AI Agentic Detection Triage for Identity: Now extended to Falcon® Identity Protection, allowing analysts to prioritise and act on high-risk identity threats alongside endpoint and cloud alerts, reducing noise and surfacing real attacks faster.

Expanded Protection Across the Digital Estate

CrowdStrike also announced new Falcon platform capabilities that extend protection across critical infrastructure and enhance organisational resilience:

• Falcon® for XIoT with ExPRT.AI: Now validated by 12+ leading ICS vendors, this solution delivers real-time, adversary-driven risk insights, enabling organisations to focus on actively exploited vulnerabilities to protect operational technology and IoT systems without disruption.

• CrowdStrike Pulse Services: New expert-led services help security teams operationalise agentic AI through modular engagements that assess readiness, align workflows and fine-tune policies, accelerating security maturity with targeted guidance.