{"id":26225,"date":"2026-09-21T15:43:59","date_gmt":"2026-09-21T23:43:59","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/crowdstrike-accelerates-real-time-data-classification-with-on-device-ai\/"},"modified":"2026-09-21T15:57:16","modified_gmt":"2026-09-21T23:57:16","slug":"crowdstrike-accelerates-real-time-data-classification-with-on-device-ai","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/crowdstrike-accelerates-real-time-data-classification-with-on-device-ai\/","title":{"rendered":"CrowdStrike Accelerates Real-Time Data Classification with On-Device AI"},"content":{"rendered":"
\n
\n
\n
\n
\n

CrowdStrike Accelerates Real-Time Data Classification with On-Device AI<\/h1>\n
\n

September 16, 2026<\/p>\n

\u2022<\/span>
\n
\n Lior Ribak<\/a>
\n\u2022<\/span>
\nData Security<\/a>\n<\/p>\n<\/div>\n

\n\"\"\n<\/div>\n<\/div>\n
\n<\/div>\n<\/div>\n
\n
\n
\n
\n<\/p>\n

Modern data security depends on understanding sensitive data as it is created, accessed, and moved in real time directly on the endpoint.<\/p>\n

In addition to identifying predefined patterns such as credit card numbers or Social Security numbers, organizations must protect unstructured information including documents, chat logs, support tickets, AI prompts, medical records, and free-text fields. When protecting this data, understanding the meaning and context of the content is just as important as recognizing patterns.<\/p>\n

Consider the below message:<\/p>\n

\n

\u201cHey, I set up the environment for you \u2013 the login is j.harrison and the passphrase we agreed on is Sunrise@2026\u201d<\/p>\n<\/blockquote>\n

There is no structured pattern to match; no username field, password label, or predefined format. A rule-based system would need to anticipate every possible way a person might share credentials in natural language, which would be impossible. Yet the meaning of this message is unambiguous: Someone is sharing account credentials in plain conversation.<\/p>\n

Language models understand the meaning and context of content, enabling accurate classification across a broader range of sensitive data. However, delivering accurate AI-powered classification locally introduces a difficult challenge: balancing model efficacy and computational feasibility.<\/p>\n

To address this challenge, CrowdStrike worked closely with Intel to introduce a new capability in CrowdStrike Falcon\u00ae Data Security that classifies sensitive data using language models that run on-device using dedicated hardware for AI. This is the first step in a broader strategy to extend our existing rule-based engines with AI-based classifications across a range of AI acceleration hardware, starting with Intel\u2019s NPU.<\/p>\n

The Challenge: Powerful AI Running on the Device<\/h2>\n

The most capable language models contain billions of parameters and demand massive, GPU-backed cloud infrastructure to run. Cloud-based inference wasn\u2019t an option for endpoint security: Cloud latency introduces delays, and sending sensitive customer data off the device creates privacy considerations that Falcon Data Security strives to avoid.<\/p>\n

The most secure way to run these language models directly is on the device. However, running them on a traditional laptop CPU alone wasn\u2019t fast enough for real-time protection. Even the smallest relevant language model took too long to process large inputs, exceeding our strict real-time latency requirements for AI-based classification.<\/p>\n

Solving this challenge required rethinking the hardware story. Rather than accepting the tradeoffs of cloud inference or CPU-based processing, CrowdStrike saw an opportunity to get ahead of an emerging shift in enterprise hardware: the rise of dedicated, on-device AI acceleration. Our goal was to future-proof it for data security.<\/p>\n

Using Dedicated AI Hardware<\/h2>\n

Modern processors offer dedicated hardware built for AI workloads: the integrated GPU and the neural processing unit (NPU)<\/a>, a dedicated AI accelerator optimized for AI inference.<\/p>\n

Recognizing the potential of dedicated AI acceleration, CrowdStrike worked closely with Intel to release first-to-market support for AI-enhanced data protection on Intel\u00ae Core\u2122 Ultra-powered AI PCs. CrowdStrike developed OpenVINO-supported, NPU-optimized models to get the best performance on Intel hardware. Through joint engineering and early access to Intel\u2019s AI PC architecture, we worked together to optimize inference on the NPU and validate that real-world enterprise security that workloads could execute with the latency, efficiency, and consistency required for always-on protection.\n<\/p>\n

This work builds on CrowdStrike and Intel\u2019s broader focus on securing the next generation of AI PCs. We combined Falcon Data Security\u2019s on-device AI-powered classification with Intel\u2019s AI acceleration to help organizations protect sensitive data without sacrificing performance or privacy.\u00a0<\/p>\n

To understand the value of AI-accelerated hardware, we benchmarked inference latency on common documents across all three compute options on Intel Core Ultra 7 (Series 2) hardware:<\/p>\n<\/p>\n

<\/span>\n<\/div>\n<\/div>\n

\n
\n\"Figure
\n\n<\/use>\n<\/svg>
\n*differs according to input size
Figure 1. Average inference latency measured on the NPU, GPU, and CPU<\/span>\n<\/div>\n
\n<\/div>\n<\/div>\n
\n
\n<\/p>\n

The improvement was dramatic. Dedicated AI hardware made this additional on-device AI-based classification feature possible.<\/p>\n

Why the NPU Over the GPU<\/h2>\n

While benchmarks show the integrated GPU delivers the fastest raw inference speed, raw performance wasn\u2019t our only goal. Because Falcon Data Security runs continuously in the background, two other factors were equally important:<\/p>\n