Summary

• CrowdStrike has expanded Project QuiltWorks through partnerships with Atos, Computacenter, Deutsche Telekom Security, Orange Cyberdefense, Telefónica, and others.
• The programme combines frontier AI models, threat intelligence, Falcon IQ automation, and services delivered by security partners.
• The European expansion focuses on moving from identifying vulnerabilities to carrying out and validating remediation within customer environments.

CrowdStrike has expanded its Project QuiltWorks security programme across Europe, bringing major technology services companies into an effort to shorten the time between discovering software vulnerabilities and completing the work needed to address them.

Atos, Computacenter, Deutsche Telekom Security, Orange Cyberdefense, Telefónica, and BT are among the partners joining the programme, alongside regional cybersecurity specialists and distributors. The expansion was unveiled at Fal.Con Europe in Barcelona on 2 November, extending a project introduced earlier this year to address the growing use of advanced AI in vulnerability discovery.

Project QuiltWorks combines frontier AI models, CrowdStrike threat intelligence, and automated assessment tools with services delivered by specialist partners. Its objective is to help organisations identify weaknesses, understand which present the greatest operational exposure, and direct resources towards remediation before attackers exploit them.

The programme uses models from OpenAI and Anthropic, NVIDIA’s Nemotron family, AWS infrastructure, and CrowdStrike’s Falcon IQ technology. European partners will gain access to Falcon IQ, which turns security findings into attack narratives, investment priorities, and remediation plans that can be used to coordinate work within customer environments.

Vulnerability discovery outpaces remediation

Security researchers and automated testing systems can identify weaknesses more quickly as their tools improve. For organisations operating substantial technology estates, however, discovering a vulnerability is only the beginning of a process that may involve application owners, network engineers, suppliers, and business managers.

A newly identified weakness may affect software installed across hundreds of systems, although the practical risk can differ considerably between individual installations. Internet exposure, the sensitivity of information, existing safeguards, and the role of a system in supporting operations all influence the urgency of corrective work.

Prioritisation must therefore account for the actual environment rather than treating every software vulnerability as equally dangerous. A weakness in an isolated test system can present a different exposure from one affecting remote access to a production service or a supplier’s privileged account.

Falcon IQ is intended to combine technical findings with security data and threat intelligence, helping organisations understand how particular weaknesses could be exploited and which actions would reduce exposure most effectively. This approach can assist teams that otherwise spend considerable time reviewing individual findings and translating them into work orders.

Although automated assessment can accelerate those decisions, remediation often requires controlled changes to operational systems. Installing software updates, changing access permissions, disabling services, or modifying network connections may interrupt applications if the work is not tested and scheduled appropriately.

Security teams must consequently coordinate with the employees and contractors responsible for the affected infrastructure. Some changes can be introduced quickly, while others require maintenance windows, testing, replacement equipment, or temporary safeguards until a permanent correction becomes practical.

Service providers supply delivery capacity

The European expansion adds organisations with established customer relationships and experience managing complex infrastructure. Atos, Computacenter, Deutsche Telekom Security, Orange Cyberdefense, and Telefónica bring capabilities spanning managed security, enterprise technology services, network operations, and specialist engineering.

Other participants include Almaviva Group, Grant Thornton UK, Intrinsec, Kudelski Security, Serviceware, Stoïk, Strong-IT, and several additional organisations. Their involvement broadens the technical and geographical resources available through the programme, although individual service arrangements will depend on each partner’s capabilities and customer contracts.

CrowdStrike is also introducing a QuiltWorks Sales Pioneer accreditation for participating partners that complete specified training. The accreditation supports commercial and technical familiarity with the programme rather than establishing that a particular customer vulnerability has been resolved.

Daniel Bernard, chief business officer at CrowdStrike, connected the expansion with the increasing speed at which attackers may exploit discovered weaknesses.

“AI is changing the economics of vulnerability exploitation. The industry has to disrupt the economics of remediation,” he said.

The programme’s design reflects that concern by combining software analysis with the capacity to act on its findings. Partners can use the results to plan work, but customers must still determine whether proposed changes are appropriate and ensure that implementation is completed safely.

Regulated environments require local arrangements

European customers may place particular requirements on the handling of security information, the location of computing services, and the access granted to external contractors. Those considerations can affect how vulnerability assessments are conducted and which remediation tasks a service provider is authorised to perform.

A financial institution, for example, may need to maintain records of changes to regulated systems and verify that contractors follow established access procedures. An industrial operator may need to test software updates against equipment used in production before allowing them to be installed.

Established regional providers can help manage those requirements through existing service relationships and knowledge of customer infrastructure. The use of a European partner, however, does not independently establish the location of every data processing component or the compliance status of an individual deployment.

Customers will need to assess the actual architecture and contractual arrangements, including how security information is transferred and how recommendations are authorised. The programme also includes financial protection involving cyber insurers, with any available cover governed by the relevant terms and conditions.

Security measured by completed work

Project QuiltWorks was launched in April 2026, followed by the introduction of Falcon IQ in August. Its European expansion increases the number of organisations available to help apply that technology, while retaining the focus on vulnerability assessment, prioritisation, and remediation.

The approach differs from CrowdStrike’s separate integration with Dynatrace, which concerns security investigations and operational telemetry, and its expanded relationship with CoreWeave, which concerns protection for hosted AI workloads. QuiltWorks is directed at the process of finding and addressing exploitable weaknesses across customer environments.

As AI systems accelerate vulnerability discovery, the volume of findings requiring attention may place greater pressure on security teams. The effectiveness of the European partner network will be reflected in the remediation work completed, the time taken to address exploitable weaknesses, and the ability of organisations to maintain secure operations while implementing changes.