CrowdStrike and Deloitte Expand AI Security Partnership to Transform How Enterprises Detect Cyber Threats

CrowdStrike and Deloitte have expanded their cybersecurity partnership to connect business risk decisions with threat detection and response. Announced on November 2, 2026, at Fal.Con Europe in Barcelona, the agreement brings Falcon IQ into Deloitte Spain’s advisory services, linking security planning with implementation and managed operations.

The expanded alliance focuses on a practical problem: identifying security weaknesses does not automatically lead to fixing them. CrowdStrike supplies its Falcon platform and AI tools, while Deloitte turns findings into investment plans, technology changes, and ongoing security work.

“Finding risk is only half the battle. What matters is how quickly you can act on it and evolve strategy for the future,” said Daniel Bernard, CrowdStrike’s chief business officer.

Falcon IQ Connects Risk Findings

At the center of the expansion is Falcon IQ, which gives Deloitte a measurable view of exploitable risk. Deloitte will use those findings alongside executive Innovation Workshops to build security plans covering immediate fixes, medium-term improvements, and longer-term goals tied to business needs and regulatory priorities.

CrowdStrike introduced Falcon IQ on August 31, 2026, to automate assessment and repair workflows under Project QuiltWorks. The platform combines customer security data, CrowdStrike threat intelligence, and findings from Falcon OverWatch threat hunters to help partners understand exposure and recommend action.

Built on Falcon Foundry and Charlotte AI AgentWorks, Falcon IQ uses more than 50 AI agents across assessment, prioritization, and remediation tasks. NVIDIA’s open Nemotron models power its agent engine. Partners can also map findings to their own services, producing action plans and tracking progress through a customer dashboard.

This work sits alongside broader concerns about AI systems. Cyber Security News previously covered CrowdStrike’s research into prompt injection techniques, showing how malicious instructions can target agents that browse websites, access data, and execute commands.

The implementation stage includes moving customers to Falcon Next-Gen SIEM. SIEM, short for security information and event management, brings security data together for analysis. CrowdStrike’s platform combines that data with AI-based detection, investigation tools, threat intelligence, and automated response workflows.

For analysts, the intended benefit is clearer context across connected systems rather than isolated alerts. Falcon Next-Gen SIEM supports third-party security and IT data, while licensed Falcon modules can contribute endpoint, identity, and cloud activity without additional ingestion charges.

Data handling is also part of this shift. Cyber Security News previously reported on CrowdStrike’s planned acquisition of Onum, whose technology filters and routes security data before analysis. Falcon’s current SIEM offering includes Onum data pipelines.

The operational stage builds on Deloitte’s November 2025 integration of Falcon Next-Gen SIEM into its Managed Extended Detection and Response service, known as MXDR. That service combines continuous monitoring with human investigation, threat intelligence, and response support.

Deloitte’s EMEA Cybersphere Center in Madrid will support delivery under the expanded agreement. Edward James Moore, cybersecurity partner at Deloitte Spain, said the collaboration helps clients connect risk insights with security investments and carry those priorities into implementation and daily operations.

The announcement sets out a service model, not measured customer results. It provides no deployment timelines, pricing, or evidence showing how much the expanded arrangement improves detection or response times.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.