CrowdStrike: designing Falcon Bot — an AI support agent that knows when to hand off.
How I designed a conversational support experience for a security platform's toughest users — one that deflects with the right knowledge article, and escalates gracefully to a human case the moment it can't.
Expert users, high stakes, no patience for a bad bot
CrowdStrike's customers are security professionals — analysts and administrators running one of the most consequential tools in their stack. When they come to the support portal, something is usually already wrong, and they don't have time to fight a chatbot that loops, misunderstands, or traps them.
Falcon Bot lived inside a broader "Get Help" support experience I designed across Phase 2 and Phase 3 — cases, knowledge base, recommendations, notifications, and search. The bot was the front door: the first thing a stressed user meets when they ask "how can we help you?"
Answer fast — or get out of the way, fast
A support bot for expert users has to earn its place in two opposite directions at once. It has to deflect — resolve the common questions with the right knowledge article so a human never has to — and it has to escalate — recognize the moment it can't help and hand off to a human case without making the user repeat themselves or start over.
Get either wrong and you lose trust instantly: over-eager deflection feels like a wall, and clumsy escalation feels like a dead end.
Designing the conversation, not just the chat window
As Experience Designer on Falcon Bot, I designed the end-to-end conversation — the intent branches, the multi-turn flows, the escalation paths, and the error and edge-case handling — alongside the visual UI that housed it.
- Conversation blueprint — mapping intents (general question vs. product support) into clear, recoverable branches
- Knowledge deflection — surfacing ranked articles inline, then explicitly checking "did this answer your question?"
- Graceful escalation — a "no" turns into an offer to create a case, routed by support type, with context carried forward
- Confirmation & closure — a real case number, a clear promise of follow-up, and an off-ramp to end or continue
- Agent voice & behavior patterns — tone, acknowledgements, and recovery moments that keep a stressed user oriented
One conversation, from question to resolution
The full flow, in the order a user actually experiences it — from the support portal's front door, through knowledge deflection, to a graceful hand-off into a human support case.
A bot users could actually trust
Falcon Bot shipped as the conversational layer of the redesigned support experience, carried across three release phases. The design set a repeatable pattern for the rest of the portal:
- Deflect-then-escalate as a principle — every branch resolves to either a real answer or a real human, never a loop
- Context preservation — what the user said upstream flows into the case, so escalation never means starting over
- A reusable conversation pattern — intent → deflect → confirm → escalate → close, applied consistently across support scenarios
What designing an AI agent taught me
Conversation is interaction design, not copywriting. The hard part wasn't the words in each bubble — it was the state machine underneath: every branch, every "what if they say no," every path back to safety. Designing an agent is designing a system of recoverable states.
Trust is built at the hand-off. Users forgive a bot that can't answer everything; they don't forgive one that traps them. The escalation moment — how gracefully the agent admits its limit — did more for trust than any single successful answer.
Design for the worst moment. These users arrive stressed, mid-incident. Designing for that state — clear intent, no loops, always an exit to a human — is what separates an AI agent people rely on from one they route around.