rootpwn

Advisories

CrowdStrike Launches On-Device AI for Real-Time Data Classification in Falcon Data Security

CrowdStrike has added on-device AI language models to its Falcon Data Security platform, enabling real-time classification of sensitive data without sending payloads to the cloud. The update leverages dedicated AI hardware to keep processing local, reducing latency and preserving privacy. Defenders should enable the new classification engine, review policy rules, and monitor classification accuracy across endpoints.

What Happened

CrowdStrike released an update to Falcon Data Security that embeds language‑model inference on the endpoint, allowing the agent to classify sensitive data in real time.

Impact

Organizations using Falcon Data Security now benefit from local, low‑latency data classification and reduced data exposure to the cloud. The feature is available to all customers with the latest agent version and can be enabled via the Falcon console.

What to Do

  • Verify that your Falcon agent is at version 7.10 or later, which includes the on‑device AI engine.
  • Enable the “Real‑Time Data Classification” setting in the Data Security policy pane.
  • Review existing data‑classification rules and adjust thresholds to match the new model’s output.
  • Monitor the classification logs for false positives/negatives and fine‑tune policies accordingly.

Technical Details

The on‑device model runs on Intel’s dedicated AI accelerator, keeping all inference local. It supports classification of PII, PHI, PCI, and other regulatory categories, and can be integrated with Falcon XDR for automated response.

Future Outlook

CrowdStrike plans to expand the model to support additional data types and to expose an API for custom policy integration.

CrowdStrike Falcon Data Security on-device AI data classification language models security operations

← All news