CrowdStrike Is Trying to Own the Security Layer of the AI Era

At Fal.Con in Las Vegas this week, CrowdStrike named a pile of new ecosystem partners for Project QuiltWorks — its coalition for securing "frontier AI risk" — and rolled out the product that turns the coalition into software. On the surface this is a partnership-news story about cybersecurity. Read through the AI cycle, it is something bigger: a deliberate bet that the next contested value layer in computing is not more training compute, but security over a multiplying fleet of AI agents deployed inside the enterprise.

This is the phase shift that matters. The first AI cycle was about building frontier models, and the chokepoint there ran through Nvidia's training silicon. The cycle has now moved to putting those models to work — inference, then agents that act across corporate infrastructure. And a crowded, agent-filled attack surface is a layer no one owns yet. CrowdStrike, the software company that made its name in endpoint security and has since pushed into identity, cloud, and next-generation SIEM, is trying to become the default security architecture for that era. The question for an investor is whether that's a widening moat and a new market, or positioning that monetizes slowly against a rival with the same idea.

Why AI flips the security economics

QuiltWorks starts from a concrete, uncomfortable observation: frontier AI collapsed the window between a vulnerability being discovered and it being exploited from weeks to minutes. A model can scan production code faster than any human team and find flaws that automated scanners miss — and so can an adversary. CrowdStrike's own framing is that in 2025 more than 48,000 vulnerabilities were documented as CVEs, up 20% from the year before, with a growing share hiding in code that legacy tools never reach.

The opening proof point came from partner EY, which says a Fortune 100 customer using QuiltWorks identified nearly 45 million vulnerabilities within hours of deployment, many undetected for years. That number is either a nightmare for whoever owns that code or a business Christmas tree for whoever sells the remediation — or both. Either way, it is the wedge CrowdStrike is using to argue that periodic security checks are obsolete and continuous, AI-driven discovery is the only defense.

A coalition instead of a product

CrowdStrike's distinctive move is that it is not building all of this itself. Launched in April, QuiltWorks is an assembly of frontier AI labs, systems integrators, hyperscalers, cyber insurers, and — most recently — regional resellers and channel partners. OpenAI and Anthropic supply the models that find the vulnerabilities; Accenture, EY, IBM Cybersecurity Services, and Kroll bring the roughly 10,000 certified professionals who remediate them; AWS hardens the cloud surface; Coalition, Liberty Mutual, and Marsh bring underwriting that turns a technical fix into a financial guarantee. In August the coalition moved down-market through distributors like Arrow and TD SYNNEX to small and midsize businesses that have no security team at all.

The latest Fal.Con additions carry the "regional partner expertise" angle: CrowdStrike named 12 new technology partners — Zscaler, Rubrik, Netskope, and others — whose data now flows into its Falcon next-generation SIEM, and it called out reseller Optiv, which CrowdStrike's chief business officer Daniel Bernard said has surpassed $2 billion in cumulative CrowdStrike sales. The pattern is clear: CrowdStrike wants its platform to be the coordination point, the place where data, detection, and dollars all route.

Falcon IQ: where the economics attach

The productization arrived this week in Falcon IQ, an "agentic" layer that runs the QuiltWorks assessment process inside the Falcon platform. Powered by NVIDIA's open Nemotron models plus OpenAI and Anthropic frontier models, it uses more than 50 pre-built agents to automate the assess-prioritize-remediate cycle, and it lets partners build their own agents on CrowdStrike's no-code platform and deliver findings through a co-branded dashboard. The pitch to partners is economics: run more engagements at lower cost, scale their own AI-security practices on CrowdStrike's rail.

Now the honesty test, because this is where many AI stories fail the trace to revenue. QuiltWorks itself does not yet appear as a reported revenue line, and the company has not disclosed how much of its growth it drives. Treat it as what it is: early optionality and competitive positioning, not delivered economics.

What is delivered and on the books is the rail it plugs into. CrowdStrike's Falcon Flex consumption model — where customers buy a pool of dollars and draw modules and services against it — passed $2.29 billion in ARR as of July 31, up 101% year over year. Total ARR reached $5.84 billion, up 25%. And the momentum metric that had flagged for a year and a half is re-accelerating: record net-new ARR of $333 million in the quarter, up 51% year over year, which led management to raise full-year net-new-ARR growth guidance to 34% at the midpoint.

What the price already assumes

That acceleration is why the stock is up roughly 82% year to date, near $213, at a market value around $218 billion — roughly 40 times trailing sales. For contrast, rival Palo Alto Networks, which is making a comparable "precision AI" security pitch, trades near 24 times. The market has already handed CrowdStrike a premium for the AI-security story, which means the bull case is largely priced in: free cash flow margin around 28%, a net cash balance sheet, and a pipeline that management calls record. None of that is cheap.

The real risk is not the flagship assumptions. It's that the AI-security layer CrowdStrike is trying to own is genuinely contested — Palo Alto wants it, cloud providers want it, and the "agents proliferate, security must follow" logic could just as easily funnel spend to whoever already owns the environment, not to the vendor with the best partner list. CrowdStrike's answer is distribution: be present wherever the customer is, so that when the AI-security budget appears, CrowdStrike is already in the room.

That is a credible strategy and a real TAM expansion. But the judgment now is allocation, not enthusiasm. CrowdStrike is a strong company with re-accelerating numbers buying a potentially large new market through a coalition it coordinates — and investors are paying ~40x sales for a QuiltWorks contribution that is still a claim about future revenue rather than a line in the financials. The thesis to hold would be that the agent era widens CrowdStrike's moat faster than competitors close it. It is a reasonable long-term bet, carried by the core operating results — but the AI-security upside is costed at full price today, and that is exactly the kind of fully digested story where the discipline is to keep looking for the next gap before it gets crowded.