CrowdStrike Expands the Agentic Security Workforce, Trained on the Knowledge of Elite Analysts

New mission-ready agents work in concert with custom-built and third-party agents to automate high-impact workflows across the full security lifecycle

AUSTIN, Texas--(BUSINESS WIRE)--Fal.Con Europe, Barcelona – CrowdStrike (NASDAQ: CRWD) today expanded its Agentic Security Workforce, introducing new mission-ready agents that extend the Falcon® platform and drive the evolution of the agentic SOC. Building on the first wave of agents introduced at Fal.Con 2025, new agents bring agentic automation to common Falcon platform tasks such as app creation and data onboarding, accelerating outcomes and liberating analysts to focus on the strategic decisions that strengthen security.

“If agents are expected to think, reason, and act like an expert analyst, they must be trained on expert experience, not legacy playbooks,” said George Kurtz, CEO and founder of CrowdStrike. “That’s the difference between static automation and true intelligence – playbooks train automation, people train intelligence. CrowdStrike’s agents learn from the world’s best SOC operators, giving them the judgment to act autonomously and the discipline to stay under defender command.”

Expanding the Agentic Security Workforce

Delivered through Falcon platform modules, the Agentic Security Workforce unites existing agents trained on millions of Falcon® Complete SOC decisions across prevention, detection, investigation, and response, with new agents that streamline common tasks based on real-world platform usage and expertise. Unlike automation platforms trained on machine-generated playbook data, CrowdStrike agents inherit expert human judgment to reason over massive datasets and take autonomous action as an elite analyst would. New and updated agents include:

• Foundry App Creation Agent (Falcon Foundry): Empowers teams to build and deploy custom security applications without code. Using natural language, analysts describe what they need, and the agent plans, designs, and accelerates the path from idea to application.
• Data Onboarding Agent (Falcon Next-Gen SIEM): Accelerates data onboarding into Falcon® Next-Gen SIEM by streamlining data pipeline creation – from ingestion and configuration to real-time validation and troubleshooting.
• Updated Exposure Prioritization Agent (Falcon Exposure Management): Includes newly added authenticated scanning and continuous visibility from Falcon® Exposure Management. Powered by ExPRT.AI, it prioritizes action, showing teams exactly what to fix first and automatically remediate with risk-based patching through Falcon® for IT.

Orchestrating the Agentic SOC

Charlotte AI AgentWorks and Charlotte Agentic SOAR extend the power of the Agentic Security Workforce into a fully connected defense system spanning the agentic ecosystem and the full security lifecycle. AgentWorks enables organizations to build no-code, custom agents. Charlotte Agentic SOAR serves as the orchestration layer that allows analysts to unify and command CrowdStrike, custom-built, and third-party agents to reason over shared context and execute coordinated workflows. Together, these innovations accelerate the agentic SOC to life, giving defenders the AI advantage to outthink and outpace AI-accelerated threats.

To learn more about CrowdStrike’s expanded Agentic Security Workforce, read our blog and visit here.

About CrowdStrike

CrowdStrike (NASDAQ: CRWD), a global cybersecurity leader, has redefined modern security with the world’s most advanced cloud-native platform for protecting critical areas of enterprise risk – endpoints and cloud workloads, identity and data.

Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon® platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft and enriched telemetry from across the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting and prioritized observability of vulnerabilities.

Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity and immediate time-to-value.

CrowdStrike: We stop breaches.

Learn more: https://www.crowdstrike.com/
Follow us: Blog | X | LinkedIn | Instagram
Start a free trial today: https://www.crowdstrike.com/trial

© 2025 CrowdStrike, Inc. All rights reserved. CrowdStrike and CrowdStrike Falcon are marks owned by CrowdStrike, Inc. and are registered in the United States and other countries. CrowdStrike owns other trademarks and service marks and may use the brands of third parties to identify their products and services.

Forward-Looking Statements

This press release includes descriptions of products, features, or functionality which may not currently be generally available. Any such references are provided for informational purposes only. The development, release, and timing of all features or functionality remain at our sole discretion and may change without notice. These statements are subject to risks, uncertainties, and assumptions that may cause actual results to differ materially from those expressed or implied. Customers should make purchasing decisions based only on services and features that are currently generally available. For more information on our existing offerings please talk to your CrowdStrike representative.