Advisories
CrowdStrike Introduces On‑Device AI Data Classification in Falcon Data Security
CrowdStrike has added on‑device AI‑powered data classification to Falcon Data Security, leveraging Intel‑based dedicated AI hardware. The feature classifies sensitive data in real time without sending payloads to the cloud. Security teams should update to the latest Falcon agent, enable the new classification policy, and monitor classification logs for anomalies.
What happened
CrowdStrike, in partnership with Intel, released a new capability for Falcon Data Security that uses on‑device language models to classify sensitive data in real time. The models run on dedicated AI hardware integrated into the Falcon agent, eliminating the need to transmit data to external servers for analysis.
Impact
All organizations using Falcon Data Security—especially those with strict data‑privacy requirements—will benefit from faster, in‑place classification of PII, PHI, and other regulated content. The change does not alter existing data‑at‑rest or in‑transit protections but adds a new layer of real‑time insight.
What to do
- Verify that your Falcon agent version is 6.15.0 or newer; the feature is available only in recent releases.
- Enable the “On‑Device AI Classification” policy in the Falcon console under Data Security settings.
- Review classification logs in the Falcon console to confirm that sensitive data is being flagged correctly.
- Adjust alerting thresholds to trigger on high‑risk classifications, and integrate alerts with your SIEM or SOAR platform.
- Document the new data classification workflow in your security playbooks and train analysts on interpreting the AI‑generated labels.