CrowdStrike launches multi-agent AI investigation system for security teams

Customizing Autonomy Levels for Enterprise Needs

CrowdStrike has introduced a new capability allowing coordinated multi-agent investigations across five distinct security domains. This system operates on a shared context layer, enabling artificial intelligence agents to work together seamlessly. The announcement highlights a shift toward greater automation in threat detection and response workflows for enterprise customers.

The core feature allows organizations to define the level of autonomy for their security operations. Customers can configure the system to range from full human-in-the-loop approval to completely autonomous execution. This flexibility addresses varying organizational risk appetites and operational maturity levels. By sharing context among agents, the platform reduces redundant data processing and speeds up decision-making processes during active incidents.

The new framework gives security leaders precise control over how much trust they place in automated systems. Instead of a one-size-fits-all approach, administrators can set specific thresholds for agent behavior. For example, high-risk actions might require human sign-off, while routine triage tasks proceed without interruption. This granular control helps teams integrate AI into existing workflows without disrupting established protocols. The shared context layer ensures that all agents access the same real-time data, preventing information silos that often slow down manual investigations.

How Does Shared Context Improve Incident Response?

By unifying data across multiple domains, the system eliminates the need for agents to repeatedly request or process the same information. This efficiency is critical when responding to complex threats that span network, endpoint, and cloud environments. The coordination mechanism allows specialized agents to hand off tasks smoothly, maintaining a continuous narrative of the incident. This approach aims to reduce mean time to resolution by providing a holistic view of the attack surface.

NIS2 regulations now require companies to report significant incidents within 24 hours of becoming aware of them. Management bodies face liability if they fail to meet this deadline. CrowdStrike’s tooling supports compliance by accelerating the identification and documentation phases of incident response. Faster automated analysis provides the necessary evidence for timely reporting to regulators. This alignment with regulatory requirements adds another layer of value for European enterprises subject to the new directive.

The introduction of coordinated multi-agent systems signals a broader trend in cybersecurity toward intelligent automation. As threats become more sophisticated, manual monitoring becomes increasingly difficult to sustain. Organizations must balance speed with oversight to avoid false positives or missed alerts. The ability to dial in autonomy levels allows teams to start conservatively and expand trust in the system over time. This phased adoption strategy mitigates the risks associated with deploying advanced AI tools in critical infrastructure.

Frequently Asked Questions

What does the shared context layer do? It allows multiple AI agents to access and utilize the same real-time data simultaneously. This prevents redundant processing and ensures consistent decision-making across different security domains.

Can customers choose how autonomous the system is? Yes, users can set the autonomy level from full human approval to fully autonomous execution. This allows organizations to match the system's behavior to their specific risk tolerance and operational readiness.

How does this relate to NIS2 compliance? The tool helps meet the 24-hour reporting requirement by speeding up incident awareness and documentation. It supports management bodies in demonstrating timely response to significant security events.