Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesCrowdStrike’s Onum acquisition is best understood as a data-infrastructure purchase that supports its agentic-AI strategy—not as the purchase of an AI chatbot or autonomous-agent company. Onum manages the real-time collection, filtering, transformation, and routing of security and IT telemetry. That data layer is intended to strengthen Falcon Next-Gen SIEM, Charlotte AI, custom security agents, and managed detection-and-response workflows.
CrowdStrike announced the deal on August 27, 2025, and said in its fiscal-2026 filing that it closed on September 12, 2025. The transaction was widely reported as worth $290 million, although CrowdStrike’s SEC filing records $252.7 million in cash consideration net of cash acquired, plus $2.0 million in replacement equity awards. The figures should not be treated as identical without a company reconciliation. CrowdStrike announced the acquisition; the SEC filing describes its accounting treatment.
As an Amazon Associate I earn from qualifying purchases.
What CrowdStrike actually bought
Onum is a real-time telemetry-pipeline and data-management platform. It helps organizations collect data from heterogeneous security and IT systems, filter unnecessary events, normalize formats, transform records, and route the resulting data to security analytics and response systems.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →That makes Onum different from Charlotte AI, a large language model, an endpoint sensor, or a chatbot. Its strategic role is closer to the plumbing beneath an AI-assisted security operations center.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
The intended architecture is:
- Data sources and sensors generate endpoint, identity, cloud, network, SaaS, and other security events.
- Falcon Onum filters, transforms, and routes those events.
- Falcon Next-Gen SIEM searches, correlates, and analyzes the data.
- Charlotte AI and security agents investigate, summarize, query, and recommend or perform actions.
- Fusion, MDR, identity, and response controls execute or supervise those actions.
CrowdStrike says Onum can improve data quality and reduce unnecessary ingestion and retention. The potential economic benefit is important: sending every raw event into a SIEM can be expensive. But Onum does not automatically make CrowdStrike cheaper. Actual savings depend on data volume, filtering rules, retention requirements, contract terms, and whether an organization continues running another SIEM in parallel. CrowdStrike’s explanation of the integration describes the data-layer rationale.
Why telemetry is central to agentic security
An AI agent can only investigate what it can access. If telemetry is incomplete, delayed, duplicated, poorly normalized, or missing identity context, an agent may produce a confident but unsupported conclusion.
Better pipelines can help reduce false positives, improve cross-source correlation, shorten investigations, and control ingestion costs. They can also make automation safer by supplying the agent with fresher and more consistent evidence.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
But data quality is not the same as intelligence. Filtering too aggressively can remove information needed for later forensic analysis. A buyer should decide which raw events must be retained before applying cost-reduction policies.
The offerings CrowdStrike is building around Onum
Charlotte AI
Charlotte AI is CrowdStrike’s analyst-facing AI layer inside Falcon. It is positioned for natural-language investigation, alert triage, response assistance, and workflow automation. In practical terms, Charlotte AI is the part users interact with; Onum is part of the infrastructure that can supply the evidence.
Those capabilities should not be confused with proof that every response action is unsupervised. AI products can range from natural-language search and summaries to recommendations, human-approved workflows, bounded autonomous actions, and multistep autonomous response. Public announcements do not establish that every CrowdStrike offering operates at the most autonomous end of that spectrum.
Charlotte AI AgentWorks
Announced in September 2025 and expanded through a March 2026 ecosystem launch, AgentWorks is CrowdStrike’s no-code environment for building, testing, orchestrating, and deploying custom security agents within Falcon.
Potential use cases include investigating a particular alert class, enriching indicators with internal systems, checking asset ownership, updating tickets, translating queries, and running approved remediation sequences. CrowdStrike says the ecosystem includes technologies and partners such as Accenture, AWS, Anthropic, Deloitte, Kroll, NVIDIA, OpenAI, Salesforce, and Telefónica Tech. The AgentWorks announcement describes the no-code and partner model.
AgentWorks should not be assumed to be universally available to every Falcon customer. Eligibility, entitlements, credits, model access, geography, and feature activation may depend on the customer’s contract and Falcon modules.
Mission-ready security agents
CrowdStrike has also described prebuilt agents for defined SOC workflows, including detection triage, response, data transformation, and query translation. These are different from AgentWorks: prebuilt agents address specified tasks, while AgentWorks is the customization and orchestration layer.
Rank #3
- equipped with atom n2600 d2700 processor, compatible with many freebsd based router systems, linux distros, or win.os supported, easy configuration and management
- Please note, this is a barebone only. A system memory, a storage drive and an operating system are needed to complete this system
- 13-19 inches 1u, 50w power, with power cord, make sure to use a big brand memory and ssd/hdd with quality assurance
- Designed with console, 2 x usb, 4 x lan, vga, power switch, size at 290 x 180 x 44mm
- There are 2 inside reserved fans on chassis, which could be removed freely or be turned on in a high temperature environment to ensure the best function of the product
Falcon Next-Gen SIEM and Falcon Onum
At RSA 2026, CrowdStrike announced native Falcon Onum real-time data pipelines, federated search across third-party data stores, third-party intelligence integration, and a Query Translation Agent. It also announced support for Microsoft Defender for Endpoint telemetry without requiring an additional CrowdStrike sensor.
This mixed-estate support matters because many enterprises cannot replace every endpoint, identity, or security tool at once. However, ingesting and correlating Microsoft Defender telemetry is not the same as providing identical Falcon sensor-level prevention and response controls. CrowdStrike’s RSA announcement details the third-party telemetry features.
Agentic MDR
Agentic MDR combines CrowdStrike’s managed security analysts with intelligent agents to automate repetitive or high-friction work. That could give customers a managed service rather than merely a software tool, but buyers should clarify which tasks are automated, which decisions stay with analysts, how actions are approved, and how activity is logged and audited.
“Agentic” does not mean every customer receives an unsupervised autonomous responder. CrowdStrike’s public material supports human-and-agent workflow automation, not a blanket claim that all response actions run independently in every environment. CrowdStrike’s fiscal-2027 first-quarter release discusses the company’s managed and agentic-security positioning.
AI-security controls beyond the SOC
CrowdStrike’s broader 2026 strategy extends into AI-application discovery, shadow-AI governance, runtime protection, browser protection, data security, cloud detection and response, and identity controls for AI and other non-human identities.
CrowdStrike said its sensors detected more than 1,800 distinct AI applications and nearly 160 million unique application instances across its customer base. Those are company-reported figures, not independently audited market measurements. The company’s AI-security announcement provides the figures and scope.
Continuous Identity for AI Agents
Continuous Identity for AI Agents is powered by technology from SGNL, which CrowdStrike agreed to acquire in January 2026. Announced in June 2026, the capability is designed to replace static, standing privileges with risk-aware authorization that can grant, deny, or revoke access dynamically.
Factors may include the agent’s owner, calling identity, device or environment risk, and Falcon or third-party signals. This is strategically adjacent to Onum but technically separate: Onum governs data movement and quality; SGNL technology governs identity and authorization. CrowdStrike’s announcement describes the identity product.
What the strategy means for investors and buyers
Potential strengths
- Unified security context: Falcon can connect endpoint, identity, cloud, vulnerability, threat-intelligence, SIEM, and response signals.
- Lower migration friction: third-party telemetry support lets customers evaluate Falcon SIEM without immediately replacing every existing sensor.
- Potential data economics: filtering and transforming events before expensive ingestion or retention may reduce waste.
- Custom automation: AgentWorks could let security teams build workflows around their own systems and processes.
- Managed augmentation: Agentic MDR combines automation with human analysts rather than requiring every customer to build an internal AI-operations team.
Risks and limitations
- Marketing ambiguity: “agentic,” “autonomous,” and “machine speed” can describe very different levels of human involvement.
- Model and data risk: bad normalization, conflicting identities, missing context, or stale telemetry can make automated decisions worse.
- Over-automation: an incorrect action could disable the wrong account, quarantine a critical host, alter a firewall rule, or close a real incident.
- Entitlement complexity: the total product may involve Falcon modules, SIEM ingestion, retention, credits, managed services, and add-ons.
- Vendor concentration: a unified platform can reduce integration work while increasing lock-in and switching costs.
- Acquisition execution: goodwill and expected synergies in an SEC filing reflect management’s acquisition rationale, not proof that the promised benefits have already been realized.
Pricing is not the same as the cost of an agentic SOC
CrowdStrike’s public pricing page lists Falcon Go at $59.99 per device annually, Falcon Pro at $99.99, and Falcon Enterprise at $184.99. Monthly prices shown are $7.99, $14.99, and $19.99 respectively. Falcon Complete is listed as contact-sales.
Those are endpoint-bundle prices, not complete prices for Falcon Next-Gen SIEM, Onum pipeline usage, AgentWorks, Agentic SOAR, MDR, credits, retention, implementation, or all AI features. Charlotte Agentic SOAR may be sold standalone or included with Falcon Next-Gen SIEM, with credit allotments tied to data ingestion; CrowdStrike does not publish one universal dollar price on the referenced page. See CrowdStrike’s public pricing and its Charlotte Agentic SOAR pricing page for the current commercial structure.
Best Value
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
How CrowdStrike compares with major alternatives
| Platform | Potential fit | Key comparison |
|---|---|---|
| Microsoft Sentinel and Defender XDR | Organizations centered on Microsoft 365, Azure, Entra ID, and Defender | Microsoft offers deep identity, productivity, endpoint, and cloud integration; CrowdStrike emphasizes Falcon-native security context and enforcement. |
| Splunk Enterprise Security | Mature search, analytics, observability, and data-engineering teams | Splunk emphasizes broad data and analytics flexibility; CrowdStrike emphasizes native security context and agent workflows. |
| Google Security Operations | Organizations seeking large-scale analytics, cloud integration, and threat intelligence | Google’s proposition centers on data analytics and security operations; CrowdStrike’s differentiator is Falcon-native endpoint and enforcement context. |
| Cortex XSIAM and Cortex XSOAR | Customers invested in Palo Alto Networks or seeking integrated automation | Palo Alto emphasizes its network, cloud, and security portfolio; CrowdStrike emphasizes Falcon, endpoint context, threat intelligence, and Onum-backed pipelines. |
Separate telemetry-routing and observability tools can preserve more vendor neutrality. Their trade-off is additional integration, policy management, and operational ownership compared with a native Falcon implementation.
A practical proof-of-value checklist
Organizations evaluating CrowdStrike’s agentic strategy should test the system rather than judge it by product labels.
- Reproduce known incidents. Measure investigation time, evidence quality, false positives, and analyst effort.
- Remove data deliberately. Test what happens when cloud, identity, SaaS, or network telemetry is incomplete.
- Measure ingestion changes. Compare raw volume, filtered volume, retention requirements, and total contract cost.
- Test action controls. Require approval gates, least-privilege permissions, detailed logs, allowlists, rollback, and human override.
- Test hostile inputs. Include prompt injection and attacker-controlled text in emails, tickets, URLs, logs, and documents.
- Test outages. Disconnect the model, a connector, the ticketing system, or an identity provider and verify safe fallback behavior.
- Check third-party depth. Confirm what Falcon can correlate from Defender or other tools and which controls still require native sensors.
- Clarify commercial terms. Ask which exact license includes each agent, how credits are calculated, what retention costs, and whether MDR is separate.
- Check governance. Confirm where prompts, outputs, tool calls, and investigation data are stored, and whether model choice and data residency can be controlled.
What to ask CrowdStrike before signing
- Is AgentWorks generally available for this edition, geography, and contract?
- Which actions require human approval, and which can run automatically?
- Are prompts, outputs, tool calls, and agent decisions retained for audit?
- What happens if an agent makes an incorrect change?
- Can raw telemetry be retained for later forensics after filtering?
- Can the customer continue using its existing SIEM during migration?
- How are Onum, SIEM ingestion, retention, AI credits, MDR, and implementation priced?
- Does Agentic MDR augment the internal SOC, replace a defined service, or duplicate existing analyst coverage?
Bottom line
CrowdStrike is building a credible agentic-security platform story, but Onum is the foundation rather than the headline intelligence. Its value is in making security telemetry more usable, timely, and potentially less expensive before that data reaches Falcon Next-Gen SIEM and Charlotte AI.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe strongest interpretation is not that CrowdStrike suddenly bought an autonomous SOC. It is consolidating the ingredients of one: telemetry pipelines, SIEM analytics, analyst-facing AI, custom agents, managed services, and dynamic identity controls. Whether that becomes a genuinely differentiated platform will depend on measurable investigation gains, transparent permissions, reliable rollback, mixed-environment support, and a total cost that holds up after ingestion, retention, credits, and services are included.
Frequently Asked Questions
Did CrowdStrike pay exactly $290 million for Onum?
$290 million is the widely reported or announced transaction value. CrowdStrike’s fiscal-2026 SEC filing records $252.7 million in cash consideration net of cash acquired, plus $2.0 million in replacement equity awards, so the figures should not be treated as identical without a reconciliation.
Does Onum itself provide CrowdStrike’s AI agents?
No. Onum is primarily a telemetry-pipeline and data-management technology. Charlotte AI and AgentWorks provide the analyst-facing and custom-agent layers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
