Cloud Security
CrowdStrike Deploys On-Device AI for Real-Time Data Classification in Falcon Data Security
CrowdStrike has added on-device language‑model classification to Falcon Data Security, enabling instant detection of sensitive data without cloud latency. The update targets organizations using Falcon to protect endpoints and cloud workloads. Defenders should enable the new feature, review classification rules, and monitor for false positives.
What Happened
CrowdStrike released an enhancement to Falcon Data Security that embeds language‑model inference on dedicated AI hardware within the Falcon agent. The on‑device model classifies sensitive data in real time, eliminating the need to transmit raw data to the cloud for analysis.
Impact
Organizations that rely on Falcon for endpoint and cloud data protection now gain faster, privacy‑preserving classification. The change reduces network bandwidth usage and lowers exposure to data exfiltration during classification. It also improves compliance with regulations that restrict cloud data movement.
What to Do
- Verify that your Falcon agents are running the latest version that includes the on‑device classification feature.
- Enable the new data‑classification policy in the Falcon console and map it to the appropriate data categories (PII, PHI, PCI, etc.).
- Review the classification output logs for false positives and adjust thresholds as needed.
- Integrate the classification results with your XDR or SIEM to trigger alerts or automated remediation when sensitive data is detected.
- Document the change in your security policy and train relevant staff on the new workflow.
“By moving language‑model inference to the device, we provide instant, privacy‑respecting data classification without compromising performance.” – CrowdStrike Engineering Lead