Summary

• CoreWeave is expanding its relationship with CrowdStrike to offer Falcon protection across AI cloud workloads, containers, and GPU clusters.
• The arrangement includes Falcon Cloud Security, Adversary OverWatch, Falcon Complete Cloud Security, and CrowdStrike Elite Support.
• CoreWeave also supplies computing infrastructure for the training and inference of CrowdStrike's SafeMind security models, creating a two-way technology relationship.

CoreWeave is expanding its partnership with CrowdStrike to provide integrated security services for organisations operating production AI workloads, bringing threat detection, managed response, and specialist support into the infrastructure used to train and run advanced computing applications.

The expanded arrangement, unveiled at Fal.Con Europe in Barcelona on 2 November, introduces CrowdStrike Falcon protection and continuous security services into CoreWeave’s specialist cloud offering. The companies are combining workload monitoring, threat hunting, managed detection and response, and technical support for customers operating demanding AI systems.

The agreement extends an existing relationship through which CoreWeave supplies computing infrastructure for CrowdStrike’s SafeMind cybersecurity models. CoreWeave will incorporate security capabilities developed by CrowdStrike into its customer services, while CrowdStrike continues using CoreWeave resources to train and operate specialist AI models.

The expansion reflects the operational requirements of AI systems as they move from development environments into applications that businesses depend on. Training models, running inference services, and maintaining associated data infrastructure can involve substantial computing resources, sensitive information, and connections to other enterprise systems that require protection.

Security across specialised computing infrastructure

CoreWeave operates cloud infrastructure designed for accelerated computing, including workloads using large numbers of graphics processing units. These processors support the mathematical operations required to train and run modern AI models, while the surrounding infrastructure provides storage, networking, workload management, and access to computing resources.

AI training jobs can operate for extended periods and involve valuable datasets, model parameters, and specialist software. Production inference systems have different requirements because they must respond to ongoing requests from applications, users, and business processes.

Both environments depend on conventional computing components as well as specialised accelerators. An attacker may seek access to cloud credentials, storage systems, software dependencies, or management interfaces without directly compromising the mathematical operation of an AI model.

Unauthorised access can expose training data or intellectual property, allow computing resources to be misused, or interrupt services that rely on the affected infrastructure. The consequences may be particularly costly where an organisation must restart a lengthy computing task or suspend a production application while security teams investigate.

The partnership includes Falcon Cloud Security, which is intended to provide visibility and protection across workloads, containers, and GPU clusters. These environments can change rapidly as computing jobs begin, scale, and terminate, making continuous monitoring important for identifying which resources exist and how they are being accessed.

Security teams must be able to distinguish expected activity from behaviour indicating a possible compromise. That requires information about workloads, permissions, network connections, and the systems responsible for deploying and managing computing resources.

CoreWeave is bringing CrowdStrike’s security capabilities into its AI cloud offering, although the companies have not published independent performance measurements demonstrating how the combined service operates across different customer deployments.

Managed response becomes part of the service

The agreement also includes CrowdStrike Adversary OverWatch, a continuous threat hunting service that uses specialist analysts to investigate potentially malicious activity. Such work can identify patterns that require examination beyond automated security alerts, particularly where an attacker attempts to operate through legitimate tools or authorised accounts.

Falcon Complete Cloud Security adds managed detection and response, covering investigation, containment, and remediation. This provides an option for organisations that want access to security specialists without maintaining every associated capability within their own teams.

Managed services can help organisations coordinate investigations, but they do not remove the need to establish who is responsible for authorising changes to production systems. Restricting network access, suspending a workload, or isolating an affected component may reduce an immediate security risk while interrupting an important application.

Those decisions can be particularly consequential in computing environments where customers pay for substantial processing capacity or depend on applications that must remain available. Response arrangements therefore need to account for the operational effects of containment alongside the urgency of addressing suspected malicious activity.

CrowdStrike Elite Support provides specialist technical assistance, completing the four components of the expanded offering. The companies have not disclosed a universal customer price, measured reduction in incident response times, or detailed adoption figures for the new service.

Customers will need to examine how security responsibilities are divided between the cloud provider, the security services provider, and their own operational teams. Protection for infrastructure and workloads may need to operate alongside application security, model access controls, identity management, and governance arrangements maintained by the customer.

Cloud security becomes part of infrastructure choice

Specialist AI cloud providers compete on the computing capacity available to customers, but the complete service involves considerably more than access to powerful processors. Networking, storage performance, workload orchestration, technical support, and operational resilience all influence whether an organisation can run demanding applications effectively.

Security also becomes a procurement consideration when businesses place commercially important models, customer information, or proprietary datasets within external infrastructure. A company choosing a provider must understand how information is protected, who can access its computing environment, and how incidents affecting the underlying systems will be handled.

Integrating security capabilities into the cloud offering may reduce some of the work associated with combining separate technology products. However, customers still need to determine which protections are included, whether additional services are required, and how security information will be handled.

Those decisions become more complicated where workloads cross jurisdictions. European organisations may face requirements concerning the location of data, the identity of subcontractors, access to sensitive systems, and the resilience of services supporting regulated activities.

CoreWeave has been extending its European infrastructure presence, including AI computing capacity at an atNorth facility in Denmark. Its wider international operations create opportunities to support customers across several markets, while individual deployments must still be assessed against applicable contractual and regulatory requirements.

The CrowdStrike agreement does not establish that every component of the integrated security service operates within a particular European jurisdiction. Customers will need to examine the location of processing, access arrangements, and service responsibilities when deciding whether the offering meets their requirements.

CoreWeave also powers CrowdStrike’s security AI

The partnership operates in both directions because CoreWeave supplies high-performance computing infrastructure for CrowdStrike SafeMind, a family of purpose-built cybersecurity models and supporting systems.

CrowdStrike introduced SafeMind in September 2026, describing technology intended to support activities such as analysing attack paths and developing defensive responses. Training and operating specialist models require access to substantial computing resources, creating a commercial relationship in which CoreWeave supplies infrastructure to a company whose security services it is also incorporating into its own offering.

Those arrangements concern separate products and functions. SafeMind provides AI capabilities for cybersecurity work, while the expanded Falcon offering is intended to protect CoreWeave customer workloads through monitoring, investigation, and managed security services.

The relationship illustrates the growing connection between AI infrastructure and the software used to secure it. Cybersecurity providers need computing resources to develop more capable tools, while organisations supplying that computing capacity must protect systems on which customers increasingly depend.

CoreWeave and CrowdStrike have not disclosed the financial terms of their expanded agreement or published customer-level results demonstrating the security performance of the combined offering. The services described in the partnership provide a framework for protecting production workloads, with their effectiveness depending on implementation, operational procedures, and the information available during investigations.

The expansion brings CrowdStrike’s cloud protection and managed security capabilities into CoreWeave’s specialist infrastructure business, while continuing the computing relationship supporting SafeMind. Customers deploying the service will be able to assess how those capabilities operate alongside their existing security controls as AI workloads become a more permanent part of enterprise computing.