Two budgets have to meet for this to work. A security lead wants a couple more Falcon modules switched on and has no line to put them on. Elsewhere in the same company, someone owns a Snowflake commitment that will lapse before the contract year ends. Selling Falcon through Snowflake Marketplace, with payment drawn from capacity the customer has already committed [4], lets the second problem pay for the first.
The approval path is what changes in that transaction, not the product. A proposal that used to compete with other security proposals now competes with whatever else the platform team was going to draw that capacity down for, and it arrives with the finance question half-answered. The thing worth pinning down before signing is price. A drawdown at list can cost more than a discounted direct quote, and committed money is money someone in the building already handed over.
Then the agents. Falcon IQ takes the assessment and remediation work behind Project QuiltWorks and gives it to more than 50 prebuilt agents [1], running on Falcon Foundry and Charlotte AI AgentWorks with Nvidia's open Nemotron models validating and ranking code vulnerabilities [10]. The coalition was built around flaws that frontier models surface faster than teams can patch, with Accenture, EY, IBM and Kroll handling remediation and AWS covering cloud infrastructure since the July quarter [7][8]. Until now the assessment was a human engagement, expert-led and sold on a 12-month subscription [9]. QuiltWorks launched in April [6]; about four months later its slowest and most expensive tier is software [19]. CrowdStrike chief business officer Daniel Bernard said Falcon IQ "changes the economics of securing frontier AI risk" [15], and for partners that is the pitch in plain terms: more engagements at lower cost [11].
Watch what the assessment actually emits. Falcon IQ correlates customer telemetry with CrowdStrike intelligence and OverWatch findings, maps the result against a services catalog the partner has loaded in, and returns an attack narrative, a set of investment priorities and a remediation roadmap [12]. Recommendations run in two directions, toward Falcon tuning and additional Falcon modules that could be switched on, and toward services from the partner's own catalog [13]. The dashboard is co-branded, with the partner's name sitting on the findings [14]. The document does two jobs. The buyer has to read it both ways.
The SIEM expansion carries its own number. Twelve more vendors now feed Falcon Next-Gen SIEM [16], onboarded by Charlotte AI agents rather than by hand [18], and CrowdStrike says pipeline filtering in Falcon Onum cuts storage costs by as much as 50% [17]. That is a vendor figure about a vendor's own pipeline, and it is the kind of figure a pilot settles in a fortnight.
Run two tests. Authorship first: ask for the assessment with the partner catalog emptied, and see which findings survive. What disappears is inventory; what remains is exposure. Funding second: write down what you would have paid from the security budget, then compare it with the marketplace price. If the drawdown is the only reason the purchase clears, the commitment is paying for a price that was never negotiated.
