How Cogentrix Secures AI and Scales Security with CrowdStrike

Cogentrix operates 10 power plants across eight U.S. states, supplying energy to the grid through an environment spanning IT, OT, and energy trading. Protecting that critical infrastructure — while governing the company's rapidly expanding use of AI — falls to a security team of just two people.

“We need to automate to survive,” said Jim Boyer, Director of Cybersecurity and AI at Cogentrix.

When Boyer joined Cogentrix, he conducted a 30-day assessment of the company's security maturity. With nation-state and eCrime adversaries targeting the energy sector, he wanted a security architecture built for the threats the company actually faces.

Cogentrix selected the CrowdStrike Falcon® platform, bringing together endpoint, identity, SIEM, and managed detection and response (MDR) before expanding into cloud, data, AI security, and automation.

That foundation is now helping Cogentrix solve two challenges that could otherwise overwhelm such a small team: securing enterprise AI as adoption accelerates and transforming security operations through AI and automation.

As Cogentrix employees embraced generative AI, the company sought visibility into what AI tools were being used and controls to protect company data.

“We want to allow AI usage, but appropriate AI usage,” noted Boyer.

Cogentrix deployed CrowdStrike Falcon® Guardian™ (formerly Falcon AI Detection and Response) to discover AI activity and establish governance. Boyer evaluates new security investments according to their “day one, week one, month one” value, and Guardian delivered quickly.

On Day One, Cogentrix gained visibility into AI use across its environment. By Week One, Boyer could show leadership what employees were using and recommend which platforms the company should approve.

Cogentrix ultimately standardized on ChatGPT, Claude, and Copilot. Falcon Guardian blocks other AI platforms and prevents employees from accessing approved enterprise AI services using personal email accounts.

But discovery and access control are only part of the challenge. Cogentrix also needs to understand what employees and their agents are doing inside AI platforms, and what company data is moving into them.

Falcon Guardian and CrowdStrike Falcon® Data Security provide complementary views. Falcon Guardian provides visibility into prompt and agent activity, while Falcon Data Security tracks data movement into and out of AI platforms.

That combination has already expanded Cogentrix's investigative capabilities. In one employee investigation, the company needed to preserve email and chat activity. Falcon Guardian and Falcon Data Security allowed the team to extend the investigation into AI, preserving prompt history and data movement involving AI platforms.

“We can combine those two elements to get a more holistic view as to what that individual's up to,” Boyer said.

Cogentrix faced a related speed problem inside its SOC. Nation-state and eCrime adversaries are moving faster, while its security team isn't getting larger.

Falcon Complete provides 24/7 managed protection and threat hunting, while CrowdStrike Falcon® Next-Gen SIEM and CrowdStrike® Charlotte Agentic SOAR provide a foundation for orchestration and automation. Today, Cogentrix has approximately 32 SOAR workflows for tasks including responding to unauthorized remote-access tools, unwanted applications, and malicious browser extensions.

At one point, Boyer operated the security program alone for four months. “The only way I survived was via the automations and workflows I had in place,” he said.

Cogentrix is also building custom AI agents that use Falcon platform data and capabilities to automate recurring security work. The team now runs nine agents, including workflows that use Falcon Next-Gen SIEM and Falcon MCP Server to automate threat intelligence analysis.

One workflow starts with threat intelligence. Previously, Cogentrix spent up to two hours each day querying Falcon Next-Gen SIEM for threat actors targeting its environment. Additional time went toward weekly analysis of adversary tactics, techniques, and procedures (TTPs).

Boyer automated that process. Agents now query Falcon, process and deduplicate indicators, and prepare updates to an internal repository that Cogentrix's firewalls check every 10 minutes. A weekly workflow uses Falcon MCP Server and CrowdStrike threat intelligence to analyze the adversaries targeting Cogentrix and narrow roughly 100 TTPs to the handful that deserve the team's attention.

The result: About three hours of development automated approximately seven hours of work every week.

Cogentrix deliberately keeps humans in control of consequential actions. An agent can prepare a firewall update, for example, but a person approves it. “Agents are like teenagers,” Boyer said. “They have guidance and guardrails, but they don't always adhere to them.”

For Cogentrix, expanding security coverage hasn't meant adding complexity. “Every module we add compounds value, makes things easier, and saves us time,” Boyer said.

That platform approach is also producing measurable business value. After strengthening its security program with CrowdStrike, Cogentrix reduced cyber insurance costs by 45%, saving approximately $300,000 over three years. Boyer said those savings nearly offset the company's entire CrowdStrike investment.

More importantly for a two-person team, the unified Falcon platform plus Falcon Complete create capacity to focus on emerging challenges instead of constantly reacting to noise.

“If my team and I can protect us from threat actors while getting a little breathing room, I consider that a success,” concluded Boyer.