CrowdStrike launches Falcon IQ as Falcon lands on Google Cloud and Snowflake

The announcements came at the opening of the company's Fal.Con 2026 conference in Las Vegas. QuiltWorks, which launched in April, was built around software flaws that frontier AI models are surfacing faster than security teams can patch. Discovery work runs on models from OpenAI and Anthropic, while Accenture, Ernst & Young, IBM and Kroll handle remediation. Amazon Web Services joined in July for cloud infrastructure, and cyber insurers cover the financial side. Until now, assessment has been manual, done as an expert-led services engagement sold on a 12-month subscription.

Falcon IQ runs on Falcon Foundry and Charlotte AI AgentWorks, and uses Nvidia Corp.'s Open Nemotron models to validate and rank code vulnerabilities before remediating them. The prebuilt agents cover the slowest parts of an engagement, including assessment, prioritization and remediation, and partners can build and tune their own agents for individual customers. CrowdStrike's pitch to partners is volume: more engagements at lower cost.

The assessment itself moves inside the Falcon platform. Falcon IQ correlates customer telemetry with CrowdStrike threat intelligence and findings from Falcon OverWatch, then maps results against a services catalog the partner has loaded. It produces an attack narrative, investment priorities and a remediation roadmap. Recommendations run in two directions: agents surface platform tuning and additional modules, and they point at services from the partner's own catalog. The customer-facing dashboard is co-branded, with the partner's name on findings and remediation progress tracked.

"Falcon IQ changes the economics of securing frontier AI risk," said Daniel Bernard, chief business officer at CrowdStrike. "QuiltWorks proved the model, Falcon IQ advances it from manual to the speed of AI across the Falcon platform." Nvidia has been supplying AI infrastructure under Falcon since a partnership struck in March 2024. Justin Boitano, vice president of enterprise AI at Nvidia, said security in the AI era will be run by "fleets of specialized AI agents reasoning faster than adversaries can act."

The second announcement widens QuiltWorks on the data side. Twelve security vendors are now feeding Falcon Next-Gen SIEM, spanning email, network, cloud, identity, data protection and adversary simulation, including Abnormal AI, Netskope, Zscaler, Rubrik and HackerOne. Others are Artemis Security, AttackIQ, ExtraHop Networks, Horizon3.ai, Picus Security, SafeBreach and Terra Security. Falcon Onum, the real-time pipeline layer inside Next-Gen SIEM, handles ingestion. CrowdStrike said filtering in the pipeline cuts storage costs by as much as 50% and analyzes data before it lands in the platform, surfacing attack paths earlier. Onboarding a new source is handled by native Charlotte AI agents, as is exposure prioritization.

The third announcement is a route to market. The Falcon platform will be sold through Snowflake Marketplace, and customers can draw down pre-committed Snowflake capacity to pay for it under the Marketplace Capacity Drawdown program. This lets buyers deploy Falcon without opening a fresh purchasing cycle. Data moves in both directions: analysts can query Snowflake tables through federated search, and tables can feed Next-Gen SIEM for correlation. Onum handles the reverse trip.

In the fourth announcement, CrowdStrike said Falcon now runs on Google Cloud.