For years, security teams measured their odds by “breakout time,” the minutes an attacker needs to move from initial foothold to lateral movement. That clock used to run in hours; at this week’s CrowdStrike Fal.Con keynote, the number effectively hit zero. The industry’s answer is autonomous red teaming: pitting one AI model against another in a closed loop, attacking and patching an environment before a real adversary gets the chance.
CrowdStrike Holdings Inc. used its Fal.Con 2026 keynote in Las Vegas to introduce SafeMind, a pair of AI models, Red Tempest for offense and Blue Solano for defense, built with Nvidia Corp.’s Nemotron models out of a new Cyber Superintelligence Lab. Dave Vellante (pictured, right), co-founder and chief analyst at theCUBE Research, called it the strongest Fal.Con keynote he’s seen in five years covering the event.
“He talked about the pyramid of pain, where the nation states used to be at the top and now it’s agents at the top, and they also flattened the pyramid,” Vellante said. “The nation state, the agent state he called it, is a prompt.”
Vellante was joined by fellow analysts Rebecca Knight (center) and Krista Case (left), for a day one keynote analysis of the Fal.Con event, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed CrowdStrike’s SafeMind launch and what autonomous red teaming means for defenders.
How autonomous red teaming closes CrowdStrike’s loop
The two models work in a closed loop: Red Tempest, trained partly on 15 years of CrowdStrike incident-response data, probes a digital twin of a customer’s environment inside Nvidia’s simulation technology for attack paths; Blue Solano remediates what it finds, and the cycle repeats until none remain. SafeMind runs natively inside the Falcon platform, with standalone access offered through CrowdStrike’s Project QuiltWorks program.
“Every year at this conference, George steps up and says breakout time has gone from two minutes to 72 seconds, down to 30 seconds,” Vellante said. “And now he’s like, it’s done. It’s just runtime. There is no breakout time.”
Case called Kurtz’s framing a wake-up call for the industry, even though attacks like it aren’t yet happening at scale. Vellante agreed with the keynote’s blunter point: attackers keep the edge because they only have to be right once, while defenders have to be right every time.
“It’s not that the defense can’t win,” Vellante said. “But that’s an old saying: offense only has to win once.”
Stay tuned for the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the Fal.Con event.
