Cybersecurity
CrowdStrike Enhances Falcon Data Security with On-Device AI for Real-Time Sensitive Data Classification
CrowdStrike has added an on-device AI capability to Falcon Data Security that classifies sensitive data in real time, reducing latency and exposure. The update is available to all Falcon customers and can be enabled via the Falcon console. SecOps teams should enable the feature, review classification logs, and adjust DLP policies accordingly.
What happened
New On-Device AI Classification
CrowdStrike released a feature that runs language‑model classification directly on Falcon agents using dedicated AI hardware. The capability classifies files, emails, and other data streams as they arrive, tagging them as PII, PCI, or other sensitive categories.
Impact on Defenders
- Real‑time labeling eliminates the need to ship data to a central server for analysis.
- Reduced network traffic and lower risk of interception.
- Classification accuracy comparable to cloud‑based models, with a 95%+ precision on common data types.
What to Do
- Ensure Falcon agents are at least version 6.5, which includes the new on‑device model.
- Enable the “Sensitive Data Classification” toggle in the Falcon console under Data Security.
- Verify that classification logs appear in the Data Security dashboard and cross‑reference with existing DLP rules.
- Adjust DLP or access controls to block or quarantine data that is flagged as high‑risk.
Next Steps
Monitor the impact on alert volume and false positives. If needed, fine‑tune the model thresholds via the console or contact CrowdStrike support for guidance.