CrowdStrike launches AI-powered risk-based patching for Falcon

CrowdStrike has introduced Falcon for IT Risk-based Patching, a new feature on its Falcon platform designed to consolidate cybersecurity and IT workflows and accelerate vulnerability remediation.

The new capability brings together the identification, prioritisation, and resolution of software vulnerabilities under a single unified platform. This aims to address the challenges organisations face in coordinating between security and IT teams, which often leads to delays exposing systems to exploitation by cyber attackers.

Patching priorities

Risk-based Patching leverages artificial intelligence technology and CrowdStrike's adversary intelligence to assess the likelihood that specific vulnerabilities will be exploited in real-world scenarios. According to the company, this insight enables IT and security teams to focus on the most critical patches, reducing potential exposure and streamlining operations.

"Adversaries exploit known vulnerabilities within minutes, yet most organizations are slowed by silos between security and IT that delay fixes and leave dangerous gaps," said Elia Zaitsev, Chief Technology Officer at CrowdStrike. "With Falcon for IT Risk-based Patching, we unify teams and processes with a shared, risk-prioritized view so they know what to fix first – and can actually fix it. This is the last mile of risk reduction, closing gaps that adversaries exploit by eliminating the silos that have slowed organizations for too long. With built-in safety controls we give teams the confidence to patch both quickly and safely at scale."

This approach aims to eliminate the fragmentation that often exists between the tools and processes used by IT and security functions. Traditionally, security teams utilise their own set of tools to detect vulnerabilities, while IT teams are responsible for deploying patches using different platforms, leading to slow mitigation, handoff issues, and overlapping software agents.

Unified workflows

CrowdStrike's Falcon Exposure Management module identifies and prioritises vulnerabilities according to adversary activity and observed attack patterns. Falcon for IT Risk-based Patching then leverages this information, using AI-driven patching with Patch Safety Scores and sensor data to guide safe and rapid remediation.

The vendor states that the unified approach closes the gap between vulnerability detection and patch deployment. Both IT and security teams operate within a single console and workflow, supporting faster and more accurate remediation while minimising operational complexity and risk.

Customer benefits

According to CrowdStrike, customers deploying Falcon for IT Risk-based Patching can expect several advantages, including AI-driven patch prioritisation through the ExPRT.AI scoring system, which focuses resources on vulnerabilities deemed most likely to be leveraged by attackers based on threat intelligence.

The system provides Patch Safety Scores and sensor intelligence, designed to give IT and security teams the assurance required to update important systems without incurring downtime. The company says the platform's unified nature reduces the number of required tools and agents, encouraging more cohesive team collaboration and reducing both time to remediation and associated cost.

The integration of IT and security patching functions through a single-agent and console is designed to support organisational efforts to streamline technology stacks, a priority for many enterprises coping with digital transformation and cyber risk management.

The Falcon platform, according to company materials, is built for cloud environments and employs a lightweight agent architecture. This infrastructure is intended to support rapid scaling while reducing resource requirements compared to more fragmented or legacy approaches to enterprise security.

CrowdStrike's announcement of Falcon for IT Risk-based Patching marks its latest effort to unify and automate the process of vulnerability management, with the stated goal of reducing organisational exposure to cyber threats by addressing both the identification and remediation of risks within a single operational workflow.