CrowdStrike Accelerates Real-Time Data Classification with On-Device AI

Modern data security depends on understanding sensitive data as it is created, accessed, and moved in real time directly on the endpoint.

In addition to identifying predefined patterns such as credit card numbers or Social Security numbers, organizations must protect unstructured information including documents, chat logs, support tickets, AI prompts, medical records, and free-text fields. When protecting this data, understanding the meaning and context of the content is just as important as recognizing patterns.

Consider the below message:

"Hey, I set up the environment for you - the login is j.harrison and the passphrase we agreed on is Sunrise@2026"

There is no structured pattern to match; no username field, password label, or predefined format. A rule-based system would need to anticipate every possible way a person might share credentials in natural language, which would be impossible. Yet the meaning of this message is unambiguous: Someone is sharing account credentials in plain conversation.

Language models understand the meaning and context of content, enabling accurate classification across a broader range of sensitive data. However, delivering accurate AI-powered classification locally introduces a difficult challenge: balancing model efficacy and computational feasibility.

To address this challenge, CrowdStrike worked closely with Intel to introduce a new capability in CrowdStrike Falcon® Data Security that classifies sensitive data using language models that run on-device using dedicated hardware for AI. This is the first step in a broader strategy to extend our existing rule-based engines with AI-based classifications across a range of AI acceleration hardware, starting with Intel’s NPU.

The Challenge: Powerful AI Running on the Device

The most capable language models contain billions of parameters and demand massive, GPU-backed cloud infrastructure to run. Cloud-based inference wasn't an option for endpoint security: Cloud latency introduces delays, and sending sensitive customer data off the device creates privacy considerations that Falcon Data Security strives to avoid.

The most secure way to run these language models directly is on the device. However, running them on a traditional laptop CPU alone wasn't fast enough for real-time protection. Even the smallest relevant language model took too long to process large inputs, exceeding our strict real-time latency requirements for AI-based classification.

Solving this challenge required rethinking the hardware story. Rather than accepting the tradeoffs of cloud inference or CPU-based processing, CrowdStrike saw an opportunity to get ahead of an emerging shift in enterprise hardware: the rise of dedicated, on-device AI acceleration. Our goal was to future-proof it for data security.

Using Dedicated AI Hardware

Modern processors offer dedicated hardware built for AI workloads: the integrated GPU and the neural processing unit (NPU), a dedicated AI accelerator optimized for AI inference.

Recognizing the potential of dedicated AI acceleration, CrowdStrike worked closely with Intel to release first-to-market support for AI-enhanced data protection on Intel® Core™ Ultra-powered AI PCs. CrowdStrike developed OpenVINO-supported, NPU-optimized models to get the best performance on Intel hardware. Through joint engineering and early access to Intel’s AI PC architecture, we worked together to optimize inference on the NPU and validate that real-world enterprise security that workloads could execute with the latency, efficiency, and consistency required for always-on protection.

This work builds on CrowdStrike and Intel’s broader focus on securing the next generation of AI PCs. We combined Falcon Data Security’s on-device AI-powered classification with Intel’s AI acceleration to help organizations protect sensitive data without sacrificing performance or privacy. 

To understand the value of AI-accelerated hardware, we benchmarked inference latency on common documents across all three compute options on Intel Core Ultra 7 (Series 2) hardware:

The improvement was dramatic. Dedicated AI hardware made this additional on-device AI-based classification feature possible.

Why the NPU Over the GPU

While benchmarks show the integrated GPU delivers the fastest raw inference speed, raw performance wasn't our only goal. Because Falcon Data Security runs continuously in the background, two other factors were equally important:

• The NPU is designed for low power consumption. Running intensive inference on a GPU while a laptop is unplugged can rapidly drain the battery.
• The NPU is built for sustained AI workloads. The GPU can be heavily utilized for graphics rendering, making it an unreliable and potentially disruptive resource.

The NPU provides consistent performance while minimizing power consumption and avoiding competition with graphics workloads. It helps ensure security runs seamlessly in the background while users maintain productivity across multiple applications and workflows. 

Deploying AI to the Endpoint

Falcon Data Security language models are built and trained in Python using PyTorch, the industry standard for research and experimentation. However, the CrowdStrike Falcon® sensor doesn't carry a Python runtime, and bundling one is impractical given the size and resource constraints of endpoint deployment.

To solve this problem, we integrated with ONNX Runtime, a widely used open-source framework for fast, cross-platform inference that runs directly on the endpoint without any Python dependency.

ONNX Runtime's Execution Provider architecture also means customers aren't locked into a single hardware story. This pluggable layer maps the same model to different hardware backends. As enterprise hardware evolves and new AI accelerators emerge, the provider can be swapped without retraining the model, changing the pipeline, or creating gaps in coverage.

We integrated the OpenVINO Execution Provider to interface directly with Intel's NPU.

The model itself travels as a single ONNX artifact, which is a portable, self-contained representation of the entire computation graph, operations and weights alike, converted directly from PyTorch. This single model is validated once and runs across supported enterprise environments. 

Optimizing Models for the Endpoint

Beyond hardware selection, deploying capable AI on endpoint devices meant the models themselves needed to be carefully optimized.

We started by training a large, high-efficacy classification model on a carefully curated dataset of both real-world and synthetic data. Then, we trained several candidate student models using teacher-student knowledge distillation of the larger model. Each candidate model varied in key architectural attributes such as the number of hidden layers and activation functions. We then applied FP16 quantization to all candidates to further reduce their footprint.

Each model was then benchmarked across two dimensions: runtime performance and classification efficacy. The winning architecture best balanced both, and the results exceeded our expectations.

Our final on-device model uses less than 5% of the teacher's parameters yet achieves remarkably close classification efficacy. This demonstrated that with the right distillation strategy and architecture search, the gap between cloud-scale AI and edge AI can be made surprisingly small.

One Model, Multiple Environments

What we built on top of Intel’s hardware doesn't stop there. The same foundation extends across every major platform and AI accelerator.

The same model powers Falcon Data Security for Cloud on Linux-based EC2 instances with NVIDIA GPUs. One Execution Provider swap separates an on-device NPU deployment from a cloud-scale GPU deployment.

We are bringing the same experience to macOS through CoreML, Apple's native AI inference framework, targeting the Apple Neural Engine (ANE) directly. The result is identical: real-time classification, on-device, with no data leaving the machine.

By bringing context-aware AI directly to the endpoint, Falcon Data Security extends protection to a broader range of sensitive data modern organizations create and share, with this capability set to grow as AI acceleration hardware becomes more widely adopted.

Additional Resources

• Learn more about Falcon Data Security: See how CrowdStrike secures sensitive data across endpoint, SaaS, GenAI, browser, and cloud environments.
• Schedule a demo: Talk with CrowdStrike about securing sensitive data wherever it lives and moves.