With the expansion of Project QuiltWorks to MSPs and other partners through distribution, CrowdStrike has ‘put the partner at the front of the conversation’ around risk from AI-powered vulnerability discovery, CrowdStrike’s Daniel Danielli tells CRN.
CrowdStrike is expanding its frontier AI security initiative, Project QuiltWorks, to a broad set of MSPs and other partners with the aim of democratizing protection against AI-discovered vulnerabilities to the SMB level, the company told CRN exclusively.
The move expands Project QuiltWorks to more channel partners through distribution and enables them to take the lead in addressing the surging cyber risk from increased discovery of vulnerabilities and exploits—as demonstrated by frontier AI models such as Anthropic’s Claude Mythos and OpenAI’s Daybreak models, according to the company.
[Related: Patching Is ‘Just Phase One’ Of AI’s Disruption To Cybersecurity: CrowdStrike’s Daniel Bernard]
With the QuiltWorks expansion, CrowdStrike can now ultimately bring SMBs access to the same protection against AI-discovered vulnerabilities as large enterprises, according to Daniel Danielli, vice president of global scale partnerships at CrowdStrike.
“We wanted to ensure that access to the best cybersecurity technology wasn’t just the domain of the largest enterprises who were able to digest the Falcon platform,” Danielli said in an interview with CRN. “[It] should mean a lot to the SMB customers, that they’re able to stand up to the most sophisticated cyberthreats that exist in the market.”
Distributors and marketplaces that are part of this latest expansion of QuiltWorks include Pax8, TD Synnex, Arrow Electronics, Ignition Technology, Nord Security, Westcon-Comstor and Zip Security, CrowdStrike announced Thursday.
Rather than providing direct access to frontier models, QuiltWorks applies capabilities from Anthropic and OpenAI around the Falcon platform, according to CrowdStrike. That means partners can combine advanced AI-driven vulnerability discovery with their own services such as prioritization and remediation, the company said.
The bottom line is that “we’re able to democratize the access to CrowdStrike and to the Falcon platform [and provide] the outcomes that all customers needed,” Danielli said. “We’re able to do that through our incredible ecosystem and bringing in these large aggregators who are servicing thousands of MSPs for us globally.”
‘Deeply Embedded’ In Frontier AI Labs
CrowdStrike was an original member of both Anthropic’s Project Glasswing and OpenAI’s Daybreak Access (formerly Trusted Access for Cyber), which provide access to frontier AI models for vulnerability discovery with the aim of shoring up software against exploitation.
For partners that participate in Project QuiltWorks, “what they are doing is working with a partner, in CrowdStrike, who is deeply embedded in both of the frontier AI labs,” Danielli said.
“We’ve got the harnesses built within and around the Falcon platform to be able to drive the assessment of vulnerabilities, the assessment of exposure that customers have—and drive the outcomes in a simple, digestible way,” he said. “I think that’s the key value for these downmarket MSPs.”
The process begins with an assessment of a customer’s security environment, which partners enrolled in CrowdStrike’s Engagement Licensing Program—or distributors that hold the credentials—can perform.
From there, service providers can address the vulnerabilities identified in the assessment and help customers to harden their software and systems against exploitation by threat actors, according to CrowdStrike.
Putting Partners At The Front
In April, just weeks after Anthropic disclosed details about its Claude Mythos model, CrowdStrike launched its Project QuiltWorks initiative and has increasingly been expanding it to more partners.
With the latest expansion to a wider array of partners including MSPs, “what we’ve done with the QuiltWorks framework very purposefully is put the partner at the front of the conversation,” Danielli said.
“This isn’t about CrowdStrike leading the conversation. We know that it’s not a single technology, a single partner, a single organization that’s going to solve this frontier AI problem. We needed to bring the crowd together,” he said. “And at the front of that, leading the conversation with customers, is the partner, the managed service provider or the reseller with some services capabilities.”
Ultimately, to truly protect all organizations against intensifying cyber risk related to the advancement of AI, “we have to leverage the power of the channel, the power of the crowd,” Danielli said.
What follows is more of CRN’s interview with Danielli.
How are you expanding QuiltWorks and what does it mean for CrowdStrike channel partners?
In this next release, we’re expanding the QuiltWorks coalition so that we can reach every customer in every corner of the globe, in every market. And there’s a real emphasis on how we go further and further downmarket. It ties in with how we’re going to market from a channel standpoint. We can’t be in every single one of those conversations ourselves. CrowdStrike would love to replicate ourselves and be in a million different conversations. But the reality is, we have to leverage the power of the channel, the power of the crowd. And so we’re doing the same thing here with the coalition. Our entry point into that is to bring the likes of Pax8, Arrow, TD Synnex and Ignition into the coalition. What we’ve been doing, quietly behind the scenes with them over the last number of quarters, is setting up some new models for us to be able to transact with them, so that they can make the CrowdStrike platform a lot more digestible for SMB customers. We see that route to market coming together through our MSP channel and the small downmarket MSPs.
Turning up at XChange Security and hearing from some of these small MSPs, they do need a heightened degree of enterprise-grade security. Because the attacks that they’re seeing their customers face now—with the advent of frontier AI—are as complex as what a large enterprise is facing. So we’re making the platform accessible to those partners through our large distributors and aggregators—who are buying volumes of Flex pool and then multi-tenanting that out to thousands of small MSPs—which is making that accessible to millions of small customers across the globe.
What should partners know about qualifications for participating in QuiltWorks?
There are two things that are important in the QuiltWorks framework. What we’ve done with the QuiltWorks framework very purposefully is put the partner at the front of the conversation. This isn’t about CrowdStrike leading the conversation. We know that it’s not a single technology, a single partner, a single organization that’s going to solve this frontier AI problem. We needed to bring the crowd together. And at the front of that, leading the conversation with customers, is the partner, the managed service provider or the reseller with some services capabilities. So there’s two prerequisites. We need our partners engaged in our ELP program, our Engagement Licensing Program. And that’s important because chapter one of the QuiltWorks framework is delivering the assessment, so that we can understand what the customer’s state is and what sort of remediation, mitigation and transformation we need to take them through. So the ELP program gives our partners access to the Falcon platform for 60 days and allows them to run templated assessments. We’ve built a whole battery of these assessments, very focused on the QuiltWorks outcomes that customers are looking for. So the ability to go and drive that is key. If a partner doesn’t have an ELP designation, that’s fine [because] we’ve stood up all of our distributors so that they have ELP credentials and capabilities, and they can go and execute these assessments on behalf of the partner.
The second thing that I think is important for a partner coming in and wanting to execute is a services capability. Because once we find all of these vulnerabilities through the assessments that we’re running, we need to go and drive remediation and mitigation strategies. And that typically boils down to the partner being able to deliver services around this. Frankly, I think this is one of the most exciting opportunities with the Falcon platform. The dollars that a partner could earn today off selling the platform are exceeded by the dollars that they could earn from the services that they deliver.
How are partners using the Falcon platform to tackle frontier AI-related risk as part of QuiltWorks?
The Falcon platform, which the largest enterprises are using, is where we’re building our own harnesses and leveraging that for how we’re approaching this complex frontier AI cybersecurity challenge that we have. The downmarket MSPs are essentially leveraging that same platform. What we’re doing within the QuiltWorks framework is, we’re bringing a greater degree of enablement through the aggregators down to these small MSPs. They’ve been using legacy technology for a long period of time. And so we’ve equipped and skilled the aggregators, the distributors with technical resources, with programs like our APEX channel development program. We’ve equipped them with training and certification access—so that we can help these small MSPs migrate from the services that they were delivering to customers of legacy AV, legacy SIEM, legacy security technologies—and actually stitch together solutions. When I spent some time talking with a lot of these downmarket MSPs, they’re using dozens of small technologies stitched together, which puts a lot of pressure on the SOCs that these MSPs are running and delivering their services to customers. So being able to consolidate multiple sensors into one, being able to consolidate multiple consoles into one, being able to leverage what we’re doing from a cloud security standpoint—[that] is really helping them accelerate the outcomes that they need most.
For partners that are wondering how this helps in terms of leveraging frontier AI models for vulnerability discovery, what can you tell them?
It’s not really giving them access to the models directly. It’s very tightly contained. But what they are doing is working with a partner, in CrowdStrike, who is deeply embedded in both of the frontier AI labs. We were the first partner to be invited into both from a security standpoint. We continue to be actively involved. And we’re also expanding our horizons—like our partnership with Nvidia and some of the work that we do with them—to ensure that we’ve got all of the capability. [And] we’ve got the harnesses built within and around the Falcon platform to be able to drive the assessment of vulnerabilities, the assessment of exposure that customers have—and drive the outcomes in a simple, digestible way. I think that’s the key value for these downmarket MSPs. When they’re choosing one of our big QuiltWorks partners to go and buy their CrowdStrike from, they’re getting access indirectly to all of that capability.
For all the MSPs that are being asked by their customers about these exact questions, how are you providing a way for them to grow their businesses through bringing them into this initiative?
I think that’s probably the most exciting part of the conversation that we’re injected in now. Security isn’t just this back-of-office governance, risk and compliance discussion. It’s a key enabler of how customers go and enable this capability across organizations. Again, chatting with some of the small managed service providers, they were sharing stories that there are likely to be less guardrails in smaller businesses around how some of these technologies come in and get adopted. They were sharing stories of how some of their small customers were vibe coding and leveraging AI, and getting a tremendous amount of operational benefit. It’s driving growth efficiencies across their organization. But they’re completely oblivious to the threat vector that it starts to open up and the exposure that they’re creating. So on the one hand, you’ve got this incredibly powerful tool that’s creating growth opportunity for organizations. But on the other hand, you’re exposing yourself in ways that we’ve never exposed ourselves before. For a QuiltWorks member through one of our large distributors and aggregators, [the first step is] to take customers through the QuiltWorks framework and shine a spotlight on what it is that they might not see in terms of vulnerabilities across their environment. Chapter two [is], go and deliver remediation and mitigation strategies. And we’re constantly building reference architectures and approaches where managed service providers can deliver the outcome through services—as opposed to a customer having to go and figure all that out. And then finally, the most important part in the QuiltWorks framework is, how do we help customers drive transformation, move off legacy [products], modernize the identity stack, protect the proliferation of these AI agents that are moving across the enterprise with AIDR—and then finally start to bring in some automation. The automation through Charlotte and AgentWorks doesn’t necessarily hit the SMB customer directly. But we’re seeing our MSPs take on those toolsets, so that they’re starting to drive down their cost of delivering cybersecurity to these customers. So all of these elements coming together through the QuiltWorks framework, for me, unlocks an elevated security posture. But more importantly, it unlocks the ability for these SMBs to go and adopt AI across their enterprise safely, and get all of the strategic benefit that they’re looking to get from it.
So a major emphasis here is that with CrowdStrike, it’s not just the most well-off organizations that will be protected against this new world of attacks, but you’re trying to democratize the protection?
I was going to go exactly to that word, democratizing. The adversaries are not discriminating anymore. Once it was like, well, I’ve got to go after the highest target—a large enterprise, a big bank, a hospital network—where I can cause mass disruption and extract maximum dollars for my effort. Now, an adversary can just send a swarm of agents out—and whatever comes back, if they get $10, but they do it a million times, it’s a big win for them. So we wanted to ensure that access to the best cybersecurity technology wasn’t just the domain of the largest enterprises who were able to digest the Falcon platform. We wanted to make sure that we’re able to democratize the access to CrowdStrike and to the Falcon platform [and provide] the outcomes that all customers needed. We’re able to do that through our incredible ecosystem and bringing in these large aggregators who are servicing thousands of MSPs for us globally. I think it’s a really exciting thing and should mean a lot to the SMB customers, that they’re able to stand up to the most sophisticated cyberthreats that exist in the market.
In terms of CrowdStrike’s efforts around MSP and SMB overall, how does this fit into those and extend those further?
We look at all customers through an equal lens. We firmly believe that all customers deserve access to the operating system of cybersecurity, and we want to make sure that it’s accessible. We continue to mature how we go to market in these segments, to make sure that the platform is, a) accessible and, b) digestible for SMB customers. What we’re seeing is that we had a tremendous uptake in Falcon Go. But again, [with] the sophistication of attacks, SMBs are asking more from us. They’re asking more from the expanse of the modules that we have. And so our program is adapting to that. The message out to SMBs is, we’re here. There is a partner ecosystem that is ready, willing, able and eager to support you.
To the MSPs and resellers who service the SMB market who are not working with CrowdStrike today, talk to us. We’ve got increased investments in teams who are servicing that segment of the market. For the first time, SMB is an alliances-led sales motion. So for 250 seats and below, we don’t have any sales reps covering it. We’ve got a team of what we call partner account executives that we’ve stood up globally, because we truly believe that this segment is won and is owned by the channel ecosystem. So we’re building programs to support that. We’ve set up our go-to-market sales teams to support that and make sure that it’s an alliance-led sales motion. We’ve got operational infrastructure that we’re putting in place that is bringing automation and self-service capabilities to the table, so that the ecosystem can move at speed in taking the Falcon platform to market. We’re excited to continue working with partners on all of these opportunities and make sure that we get Falcon into more hands and more SMBs.
