Description
Charlotte AI is CrowdStrike's agentic AI analyst, built into the Falcon platform for security operations center (SOC) teams. CrowdStrike positions it as a way to close three gaps it says legacy security tools leave open: fragmented context across security domains, an alert volume that outpaces available analysts, and attacks that unfold faster than manual investigation.
Read More
Charlotte AI assembles cross-domain context, endpoint, identity, cloud, and network data, before an investigation starts, then dispatches specialized agents to investigate in parallel across those domains while sharing one memory of the environment. The agents converge on a single verdict rather than separate, conflicting alerts, and CrowdStrike says the underlying models are trained on the frontline decisions of its own analysts. Investigations and responses can be handed to Charlotte Agentic SOAR, which unites agentic reasoning with deterministic, rule-based workflows in one governed workspace where a team defines the triggers, data, rules, agents, and allowed actions.
Teams can also build their own agents in AgentWorks without writing code, defining an agent's mission, connecting its data, and choosing what runs automatically versus what needs analyst approval, on the model of their choice. Charlotte AI connects to other tools and third-party agents through bidirectional MCP, and CrowdStrike reports, in its own published figures, more than 98% decision accuracy on agentic detection triage, a 70% reduction in manual investigation effort, and a 90% reduction in incident response time. The platform is ISO 42001-certified for AI governance, with every action logged, bounded, and restricted to what the requesting user is already permitted to see.
Charlotte AI is sold as part of the CrowdStrike Falcon platform rather than as a standalone, separately priced product. CrowdStrike's public pricing page lists bundle pricing for other Falcon modules but not a standalone Charlotte AI price, so prospective buyers request a demo or quote.
It is built for SOC analysts and security leaders already on or evaluating the CrowdStrike Falcon platform, not as a standalone tool for teams outside that ecosystem. The accuracy and time-savings figures CrowdStrike publishes are the vendor's own reported numbers rather than independently audited results.
- CategoryAI Cybersecurity Tools
- Pricing ModelFlexible
- DeploymentCloud
- PlatformsWindows, macOS, Linux, Android, iOS
CrowdStrike Charlotte AI's Core Features
Assembles unified cross-domain context (endpoint, identity, cloud, network) before an investigation begins
Coordinates specialized agents working in parallel to converge on a single verdict
Charlotte Agentic SOAR combines agentic reasoning with governed, rule-based response workflows
AgentWorks lets teams build custom, no-code security agents on the model of their choice
Connects to other tools and third-party agents through bidirectional MCP
Automates tasks such as exposure prioritization, malware analysis, reconnaissance, and query writing
ISO 42001-certified AI governance with logged, permission-bounded actions
Trained on CrowdStrike's own frontline analyst decisions and threat data
How to use CrowdStrike Charlotte AI?
Get access: Be on or request access to the CrowdStrike Falcon platform with Charlotte AI enabled
Review assembled context: Open an alert to see the cross-domain context Charlotte AI has already gathered
Let agents investigate: Allow Charlotte AI's agents to work the case in parallel across domains
Automate response: Configure triggers, rules, and actions in Charlotte Agentic SOAR for governed automation
Build custom agents: Use AgentWorks to encode a team's own playbooks into agents, with approval gates where needed
CrowdStrike Charlotte AI's Use Cases
- Cross-domain incident investigation
- SOC alert triage
- Governed automated response
