CrowdStrike unveiled its new generative AI cybersecurity analyst tool, dubbed Charlotte AI, which enables Falcon platform users with varying levels of security expertise to ask questions using natural language prompts. Built on its own security data and human-validated content, this artificial intelligence (AI) tool was created to help close the security talent gap and accelerate threat detection, response and remediation time.

Charlotte AI allows CrowdStrike Falcon platform users to make queries using English or several other dozens of languages. The tool is now in private customer preview and initially addresses three use cases:

1. Using this generative AI tool, every user from the IT help desk to C-level executives can ask security questions such as “What is our risk level against the latest Microsoft vulnerability?” to better understand the threats and risks their organizations are facing.
2. Charlotte AI's simple queries can assist less experienced security professionals, including tier-one security operations center (SOC) analysts, with operating the CrowdStrike Falcon platform like more advanced analysts.
3. It enables experienced security experts to automate repetitive tasks such as data collection, extraction, and basic threat search and detection using natural language prompts.

CrowdStrike President Michael Sentonas noted in a blog post that the security vendor first introduced its AI-powered tool to replace signature-based antivirus over 10 years ago and has gradually integrated AI into the core of its Falcon platform for analytics, prioritizing critical vulnerabilities, and generating and validating new indicators of attacks.

The new generative AI service “is the first offering built using our Charlotte AI engine and will help users of all skill levels improve their ability to stop breaches while reducing security operations complexity,” Sentonas wrote, adding it “is continuously improved by a tight feedback loop with CrowdStrike’s industry-leading threat hunters, managed detection and response operators and incident response experts.”

CrowdStrike claims Charlotte AI is trained on data that includes trillions of security events captured by the vendor’s Threat Graph; asset telemetry data from across users, devices, identities and cloud workloads; and data from its threat intelligence services.

Among those, Sentonas touted, “the most critical set of data — and one that no other vendor in the world can match — is CrowdStrike’s human-validated content.”

This dataset comes from CrowdStrike Falcon OverWatch threat hunters, Falcon Complete managed detection and response (MDR), CrowdStrike Services for breach investigations, risk assessments and advisory services, and its intelligence team.

“We believe the future of cybersecurity requires tight human-machine collaboration to deal with the speed, volume and advancing sophistication of the adversary,” he wrote. “When done correctly, AI can rapidly surface hidden threats, accelerate the decision-making of less experienced security analysts and simplify a multitude of complex tasks.”

Sentonas argues threat actors are constantly looking for new ways to infiltrate systems, break existing security rules and change their tactics, which makes it hard for AI to respond without the right training data. “AI alone isn’t designed to identify these novel problems — human expertise is required to outthink and outmaneuver the adversary.”

That’s why human-validated content is key for generative AI tools in security use cases. “CrowdStrike has always believed that the combination of human intelligence and expertise with AI will transform the industry and keep security practitioners ahead of the adversary,” he said.