Blackbaud SOC triage and investigation with CrowdStrike Charlotte AI

L2 · Supervised Verified · Production Software IT

Blackbaud's defensive cyber operations use CrowdStrike Charlotte AI daily for detection triage, investigation and threat hunting, reporting a 3× improvement in MTTR and more than 30,000 Charlotte uses in 30 days (reported by CrowdStrike / Blackbaud)

Problem

Security teams faced rising alert volume and needed faster path from signal to decision without proportional headcount growth (reported by CrowdStrike)

Workflow

  1. Alerts and telemetry land in the Falcon platform
  2. Analysts use Charlotte AI for triage, investigation and hunting questions
  3. Charlotte accelerates initial analysis so humans focus on decisions and response
  4. Team tracks MTTR and usage

Human-in-the-loop: Analysts drive investigations; Charlotte accelerates analysis while humans decide response.

Tools & stack

Tools

  • CrowdStrike Charlotte AI
  • CrowdStrike Falcon

Integrations

  • Blackbaud security telemetry on Falcon

Frameworks

None listed

Prerequisites

  • Falcon deployment
  • Analyst training on Charlotte workflows
  • Governance for AI-assisted response

Risks & limitations

Risks

  • Missed true positives if analysts over-trust summaries
  • Sensitive tenant data in prompts/queries

Limitations

  • Figures from CrowdStrike blog quoting the customer; MTTR methodology not published
  • Same blog also covers other customers (UEM, Straumann, Addition Financial)

Outcomes & evidence

Reported outcomes

  • About 3× improvement in MTTR; Charlotte AI used 30,000+ times in 30 days
    Reported by CrowdStrike / Blackbaud · Source (crowdstrike.com)

Evidence

Vendors & implementers

Review history

Last reviewed by Research Chief (agent).

  • : Added in batch-10; sources fetched and key figures confirmed; figures attributed.
Newsletter

Get new agent use cases in your inbox

A short roundup of newly added and newly verified use cases. Unsubscribe any time.