CrowdStrike Hackathon Showcases Practical AI Agents for Security Teams
CrowdStrike's AgentWorks hackathon highlights how security teams can build custom AI agents to tackle specific operational challenges, demonstrating real-world applications beyond theoretical concepts.
In an era where artificial intelligence is rapidly transforming cybersecurity, many organizations struggle to translate the potential of AI into tangible security improvements. CrowdStrike's recent AgentWorks hackathon aimed to bridge this gap by showcasing practical, AI-powered security agents developed by security teams themselves. The event, held in collaboration with NVIDIA, invited participants to build custom agents on the CrowdStrike Falcon platform to address persistent bottlenecks and unique operational challenges faced by their respective organizations.
The hackathon's premise was rooted in the belief that collective ingenuity is a powerful defense against evolving threats. As adversaries increasingly leverage AI, defenders must adapt by sharing knowledge and building robust tools together. The AgentWorks initiative provided a platform for this collaborative spirit, allowing teams to transform complex problems into functional agents that can be learned from and adapted by the wider community.
One of the standout winners, "Agent Smith," demonstrated a critical capability: identifying unapproved Managed Code Platform (MCP) servers running on endpoints. These servers, often deployed by developers, can pose significant risks if not properly managed or approved. Agent Smith successfully detected 1,710 such servers in a single day, including instances with revoked configurations or insecure settings like disabled TLS verification. This agent's success stemmed from a sophisticated architecture that divided labor between AI models and deterministic tools, such as queries and workflows, enhancing accuracy and cost-efficiency.
Before the agent even processed command-line data, an upstream query within CrowdStrike Falcon Next-Gen SIEM performed initial heavy lifting. This query incorporated organizational context, such as approved tool lists and noise filters, and redacted sensitive information. The agent then analyzed the cleaned data, identified risky configurations, and recommended appropriate next steps based on the team's existing approval processes, seamlessly integrating with Charlotte Agentic SOAR for case management.
Another winning agent, "Help Desk Takeover Defender," tackled the pervasive threat of multi-factor authentication (MFA) reset abuse. Attackers often exploit help desk procedures to reset an employee's MFA, gain account access, and move laterally. This agent automates the detection of such abuse within approximately 70 seconds by analyzing Entra ID logs and Falcon telemetry for suspicious reset patterns. This dramatically reduces investigation and containment times from hours to minutes.
The Help Desk Takeover Defender agent achieved its speed and accuracy by balancing trust and speed through deterministic scoring computed by a CrowdStrike Falcon Foundry function, rather than relying solely on the AI model. The AI then compared resets against user history and knowledge files encoding the team's playbook for normal behavior and appropriate containment actions. Crucially, all containment actions require explicit human approval, ensuring a human remains in the loop.
A third notable agent, "Exclusion Adversary," addressed the challenge of managing security tool exclusions. While necessary to prevent false positives, poorly configured exclusions can become significant blind spots. This agent automates the creation of narrowly defined exclusions by analyzing live detection data and then proactively tests its own rules by attempting to bypass them with crafted strings. This adversarial approach ensures that exclusions remain effective without creating new vulnerabilities.
The AgentWorks hackathon underscored that effective AI security agents are not just about sophisticated prompts but also about deliberate design, clear governance, and integration with existing security workflows. The winning agents demonstrated how custom-built solutions can provide immediate, measurable value by addressing specific organizational needs, improving threat detection, and enhancing response efficiency for SOC teams.