CrowdStrike unveils Charlotte AI upgrade to boost security ops

CrowdStrike has introduced several new artificial intelligence capabilities aimed at advancing security operations centres by automating the processes of triage, investigation and response.

The newly announced features focus on Charlotte AI, which unites intelligent automation capabilities with human cybersecurity expertise to accelerate detection and response across AI-driven security operations environments.

CrowdStrike has presented Charlotte AI Agentic Response and Charlotte AI Agentic Workflows as part of its latest enhancements for security teams.

According to the company, these new offerings, when combined with the existing Charlotte AI Agentic Detection Triage, allow the AI to go beyond simple responses, enabling a level of autonomous reasoning and action on both internal and third-party data.

The AI-native Falcon platform underpins these advancements, and is described by CrowdStrike as an intelligent reasoning AI platform capable of drawing conclusions and initiating actions within established boundaries, eliminating the need for direct human prompting.

In connection with these technological developments, CrowdStrike has also expanded its managed detection and response (MDR) services through Falcon Complete Next-Gen MDR, which now utilises Charlotte AI. This integration is intended to accelerate investigations by leveraging the combined experience of CrowdStrike's analysts and AI automation, creating what the company says is a feedback loop that enhances both human and AI performance across security operations.

CrowdStrike's founder and Chief Executive Officer, George Kurtz, commented on the impact of these new AI capabilities.

"There's a profound difference between adding AI features and fundamentally transforming how cybersecurity works. Charlotte AI goes beyond augmenting humans with suggestions – it actively investigates, reasons and responds autonomously within expert-defined guardrails," said Kurtz. "Our agentic AI innovation represents a fundamental shift from reactive to proactive security – furthering CrowdStrike's mission of stopping breaches."

The Charlotte AI Agentic Response is designed to increase analyst productivity by automatically asking and answering investigative questions typically considered by experienced security analysts. This functionality aims to accelerate tasks such as root cause analysis and lateral movement mapping, offering time savings on repetitive investigations each week.

Another key addition is Charlotte AI Agentic Workflows, available through Falcon Fusion SOAR, which enables analysts to incorporate generative AI prompts directly within automated response playbooks.

The company states these workflows can, for example, assess whether devices should be isolated according to company policy, and automatically generate tailored communications for various audiences, including executives and customers, with support for multiple languages.

Falcon Complete with Charlotte AI now allows analysts to triage alerts and speed up analysis, integrating human oversight and intelligent automation to improve effectiveness in stopping breaches.

Charlotte AI Agentic Detection Triage has also been extended to Falcon Identity Protection, giving analysts the ability to prioritise and respond to high-risk identity threats alongside endpoint and cloud alerts.

This, according to CrowdStrike, assists in reducing alert noise and focusing on genuine threats more rapidly.

In addition to advancements in AI-driven operations, CrowdStrike has announced new capabilities aimed at broader protection across digital infrastructure. Falcon for XIoT, validated by over a dozen industrial control system vendors, provides real-time, adversary-driven risk insights and helps organisations focus on exploited vulnerabilities to secure operational technology and IoT assets with minimal disruption.

CrowdStrike Pulse Services were also introduced as part of the update, providing expert-led support to help security teams deploy agentic AI through engagements that assess readiness, align workflows, and fine-tune security policies.