CrowdStrike and Deloitte Spain Expand Cybersecurity Alliance With AI-Powered Threat Detection

CrowdStrike and Deloitte Spain announced an expanded cybersecurity alliance. This new phase of their collaboration focuses on AI-powered risk advisory.

The partnership integrates executive security strategy with the implementation and day-to-day operations of the Security Operations Center (SOC), using Falcon IQ to turn exploitable risks into prioritized actions.

This expansion combines CrowdStrike’s Falcon platform with Deloitte’s expertise in advisory, implementation, and managed security services.

The EMEA Cybersphere Center in Madrid will support operational delivery, ensuring alignment between boardroom investment decisions and real-time threat monitoring, investigation, and response.

CrowdStrike and Deloitte Spain Expand Cybersecurity Alliance

At the center of the agreement is Falcon IQ, CrowdStrike’s AI-powered assessment and workflow automation offering. Introduced in August 2026, it correlates customer telemetry, CrowdStrike threat intelligence, and Falcon OverWatch findings to build a contextual view of enterprise exposure.

CrowdStrike says Falcon IQ uses more than 50 agents, built on Falcon Foundry and Charlotte AI AgentWorks, to automate assessment, prioritization, and remediation workflows. NVIDIA Nemotron models power its agentic engine, while partners can develop customized agents for individual customer environments.

The platform also maps findings to partner services, producing attack narratives, investment priorities, and remediation roadmaps. This makes prioritization the connection between identifying weaknesses and selecting the technical services needed to address them.

The approach complements broader developments in agentic cybersecurity, although Falcon IQ’s role here centers on assessment and service delivery. The expanded collaboration follows Deloitte’s Advise, Implement, and Operate model.

During the advisory stage, Falcon IQ supplies a quantitative view of exploitable risk. Deloitte combines these findings with executive Innovation Workshops to develop short-, medium-, and long-term security roadmaps aligned with business objectives and regulatory requirements.

Implementation focuses on modernizing complex environments through the Falcon platform, including migrations to Falcon Next-Gen SIEM. For organizations evaluating SIEM platforms, the migration component connects security architecture decisions with the detection, investigation, and response workflows analysts use daily.

The operational stage builds on Falcon Next-Gen SIEM’s integration into MXDR by Deloitte. Delivered through the Madrid center, the service combines CrowdStrike’s detection and response technology with Deloitte’s managed security expertise, reflecting the integration of AI-assisted analytics and human investigation across managed detection and response services.

CrowdStrike chief business officer Daniel Bernard emphasized that discovering risk is only part of the challenge; organizations must act on findings and adapt their strategies. Deloitte Spain cybersecurity partner Edward James Moore similarly framed the expansion around connecting risk management, technology, and business priorities.

The announcement does not provide deployment timelines, pricing, or independently verified performance measurements. Its significance is organizational: connecting risk assessments, modernization projects, and ongoing security operations within a single delivery framework.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.