It could be argued that the hardest part of security was always finding the problems and deciding which ones to fix, ahead of actually getting that fix made. Frontier AI has flipped this script, making the first part trivial and the second part not just urgent, but overwhelming. Here is how Project QuiltWorks, through Falcon IQ, turns a flood of findings into something a security team can work from on Monday morning.
If you ask a security engineer about their vulnerability backlog you might find the response worrying. Verizon’s 2026 Data Breach Investigations Report counted the vulnerability instances it observed across its data set at roughly 68.7 million in 2022 and 527.3 million in 2025, close to an eightfold rise in three years. Over the same period the share of organizations fully remediating the flaws on CISA’s Known Exploited Vulnerabilities list, the ones attackers are known to be using, fell from 38% to 26% (Verizon DBIR 2026, as reported by SC Media, May 20, 2026).
That is before frontier AI. The models now being used under Project QuiltWorks find a different class of flaw, the logic errors and design weaknesses that scanners never caught, and they find them in volume. Pointed at 43 open-source products, one of them surfaced more than 2,400 findings in a matter of days (CrowdStrike, July 20, 2026). Imagine that landing on a team that is already losing ground on the list it has.
Here is the problem that creates. A security team can only fix a certain number of things a month. When a tool hands them thousands of findings, most of which they cannot get to, they have to choose what to work on, and the only guide they have is the severity score the tool attached. Those scores are often wrong for their environment. A flaw rated critical may sit on a system nothing can reach. A flaw rated medium may be the one an attacker would use. So the team either patches by score and wastes effort on the wrong things, or they ignore the list and rely on their own judgment, which means the findings they most needed never get looked at. Either way, frontier AI has produced a longer list, and nothing has been made safer. Something has to sit between the discovery and the people doing the fixing.
Why Raw Findings Are Not Enough
It is worth being honest about what frontier-model output looks like before anyone has worked on it. In CrowdStrike’s own testing, a generic approach to AI vulnerability discovery produced false-positive rates approaching 80%. With tuning and human oversight that fell to around 20% (CrowdStrike, July 20, 2026). Cloudflare, working with Anthropic’s Mythos under Project Glasswing, reported a false-positive rate its team considered better than human testers, but that was after serious engineering effort by one of the most capable security teams in the industry (Anthropic, May 22, 2026).
Two lessons follow. First, the model is the beginning of the work, not the end of it. Second, the value lies in what happens to a finding after it is found: is it real, is it reachable, does it chain with something else, and what would it cost us if someone used it. Those are questions a severity score cannot answer. They need context about your environment and judgment about your adversaries.
What Falcon IQ Does
Falcon IQ is the layer of QuiltWorks that does that work at scale. CrowdStrike describes it as operationalizing QuiltWorks findings through partner services, generating attack narratives, investment priorities, and remediation roadmaps (CrowdStrike, September 10, 2026). In practice it reads an organization’s security telemetry across endpoint, identity, cloud, data protection, and exposure, correlates what it finds, and produces a risk picture in about an hour that would once have taken a bench of consultants days to assemble. Three outputs matter to the team on the receiving end.
Attack Narratives Rather Than Scores
Instead of a finding with a number attached, the team gets the story of how an adversary would chain this flaw with that misconfiguration to reach something that matters. Narratives are persuasive in a way scores are not. They tell the engineer why this one is real, and they tell the executive what is at stake in words they already understand. Falcon IQ also distinguishes between paths that are confirmed, grounded in observed detections and actual misconfigurations, and paths that are probable, plausible scenarios built from posture gaps. Both matter, and the probable ones are often the highest risk, but you are always told which is which.
Investment Priorities Rather Than a To-Do List
Not every gap is closed with a patch. Some need an architectural change, some a new control, some a decision to accept the risk. Framing findings as choices about where to put money and effort is the conversation that gets remediation funded, which in most organizations is the real bottleneck.
A Roadmap With Playbooks
The findings become a sequence: what to fix first, what follows, what can wait. Every item carries what to do, why, how, and the outcome to expect. That is the artifact a team runs its quarter against, and the one a board can track progress on.
Why It Runs Through a Partner
CrowdStrike’s believes Falcon IQ enables partners to scale expertise across customer environments, and the design is deliberate. An attack narrative is only as good as the understanding of the environment behind it. A roadmap is only useful if someone executes it. The partner applies what it knows about your estate to what the discovery engine has found, validates every finding before it reaches you, and then does the work the roadmap describes. The customer gets a method that has been run many times, applied to findings that are specific to them.
The engagement does not end with a report, either. Alongside the consultant’s findings, the customer gets a scorecard that runs in their own environment and tracks risk reduction over time, so the question “are we getting better?” has a line on a chart for an answer. The first run sets the baseline. Every run after it shows the trend.
What It Means for You
The backlog problem has been with security teams for as long as there have been scanners, and frontier AI could have made it hopeless. The bet behind Falcon IQ is that it can instead become tractable, provided findings arrive as narratives, choices, and a plan rather than as a list. For the engineers who have to do the work, that is the difference between a tool they resent and a program they can run. For the leaders who fund it, it is the difference between being told the number of vulnerabilities and being told what to do about them.
Falcon IQ is delivered through Project QuiltWorks partners – a small group of partners CrowdStrike selected for its North American cohort, and NETbuilder is among them.
Learn More
Ready to turn findings into a plan? For more information, or to arrange a free consultation, contact the NETbuilder team.
This completes the series. Start with what Project QuiltWorks is and why it exists, or read about FAIRR and what the board gets from it.
