EY builds an AI-native managed security practice on Falcon and is implementing CrowdStrike SafeMind with Xcel Energy, a U.S. utility

CrowdStrike (with EY and Xcel Energy) · Energy utility and critical infrastructure; managed security services · United States and global (20+ EY member firms)

CrowdStrike

Publisher: CrowdStrike press release
Original publication: November 3, 2026
Source retrieved: 2026-11-10
Event date: 2026-11-03

Read original source

What happened

CrowdStrike says EY is building its frontier AI and cyber resilience business on the Falcon platform across more than 20 member firms through a significant Falcon Flex commitment, a services design partnership to bring SafeMind (CrowdStrike's purpose-built security models and harnesses) to market, and a plan to train its cyber services workforce on Falcon and Project QuiltWorks over the next year. EY and CrowdStrike are working with Xcel Energy to implement SafeMind. The release says an unnamed EY Fortune 100 client identified nearly 45 million vulnerabilities within hours of using QuiltWorks. No Xcel scope, timeline, cost or results are given. It is newly relevant because Channel Insider's Nov 9 roundup put the EY and Xcel items in front of channel and MSP buyers, and the archive had not yet carried this release.

Why it matters

Xcel Energy is an investor-owned utility, not a public agency, but it is the first named U.S. critical-infrastructure implementation of SafeMind. Municipal utilities, public power districts and state utility regulators will hear about it, and many smaller public utilities buy security through large integrators such as EY rather than directly.

Evidence and measured results

Opened the full CrowdStrike press release (dated Nov 3, modified Nov 6). All statements are vendor and partner claims; the 45 million figure is unverified and refers to an unnamed private client.

Limitations and uncertainty

Vendor press release; no Xcel deployment details or measured outcomes; vulnerability count lacks context on severity or duplicates; private utility, so public-sector transferability is limited.

Put this evidence to work

Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-10; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.

Sales

Role takeaway

Customer problem: Public utilities face AI-accelerated attacks with small security teams and often depend on integrators for advanced testing.
Stakeholders: Utility CISO or IT director
OT or SCADA engineering lead
General manager or utility board
Integrator account lead
Discovery questions: Do you buy security services through a large integrator today?
How do you currently test detection coverage across IT and OT?
What approval is required before any automated change touches operational systems?
Value hypothesis: Integrator-delivered AI testing may expand detection coverage for utilities that cannot staff continuous red teaming; no outcomes are published.
Potential engagement: An IT-only readiness and governance review for AI-driven vulnerability testing, scoped before any OT involvement.
Unsupported claims: Measured results at Xcel Energy
That 45 million findings indicate real risk reduction
Applicability to OT environments without separate validation

Pre-sales engineering

Role takeaway

Fit: Utilities and infrastructure operators already on Falcon or working with EY managed services.
Architecture and integration: SafeMind models and harnesses accessed through QuiltWorks partners, with findings feeding Falcon detection and remediation workflows.
Prerequisites: Asset inventory spanning IT and OT
Defined test environment or mirror
Change-control process for AI-generated fixes
Constraints: NERC CIP and state utility rules
OT systems intolerant of active probing
Integrator data-handling terms
Security: Restrict and log integrator harness access, separate tenants, and prevent offensive models from reaching production OT.
Proof of value: Compare validated findings against an existing pen-test baseline
Measure share of AI findings confirmed by human review
Verify no testing traffic reaches OT segments

Delivery

Role takeaway

Work: Governance design, scoped IT pilot, and findings validation workflow.
Dependencies: Integrator contract terms
Falcon Flex entitlement
Utility change-control board
Ownership: Utility CISO owns risk acceptance; integrator operates testing.
Skills and adoption: Utility staff trained to review and approve AI-generated findings and fixes.
Governance checkpoints: Testing scope approved by operations
Data-handling terms reviewed
Pilot results reviewed before expansion
Acceptance criteria: Proposed: every AI-generated change passes existing change control
Proposed: validated-finding rate reported for the pilot
Risks: Disruption from active testing
Expertise held by integrator only
Overstated outcomes in board briefings

Implementation considerations

Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.

Architecture and integration

What must connect, and where does the AI sit in the workflow?

SafeMind is delivered as models and harnesses accessible through QuiltWorks partners, so a utility's exposure depends on where those models run, what telemetry they see and how findings reach operational technology owners.

Governance

Who approves, reviews and stays accountable for outcomes?

Any AI-driven vulnerability discovery and remediation in utility environments needs defined approval for changes to operational systems and alignment with sector rules such as NERC CIP for bulk electric assets.

Security and privacy

What data, permissions and controls need testing?

Offensive-capable AI testing models raise questions of tenant separation, data handling and who can run them against production or mirrored environments.

Accessibility and workforce

Who is affected, and what skills or accommodations follow?

EY's training commitment signals that AI-security delivery will rest on integrator staff, which may concentrate expertise outside the public utility.

Procurement

What should contracts, pricing and exit terms secure?

Public utilities considering SafeMind may encounter it bundled in integrator managed-service contracts and Falcon Flex terms rather than as a separately priced product.

Operating model

Which teams own the service once it runs?

Managed-service delivery shifts day-to-day AI security operation to the integrator; the utility still owns risk acceptance.

Publication history

2026-11-09CrowdStrike · Issue 122 resources

Read preserved resource versions (JSON)

Stable resource ID: crowdstrike-ey-safemind-xcel-energy-critical-infrastructure-2026-11-03