Enterprise security is reorganizing around AI detection and response, as autonomous agents move from pilot projects into production systems that can act, chain tasks together and improvise. The same capabilities that make agents useful to defenders make them equally useful to adversaries, and that symmetry is forcing boards to ask harder questions about what their security teams can actually see.
That pressure has landed on cybersecurity companies with unusual speed over the past year, turning agent oversight from a research topic into a purchasing decision. Attacks assembled by cooperating agents have shown what the next phase of the threat landscape looks like — CrowdStrike’s “2026 Global Threat Report” found the average eCrime breakout time has already fallen to 29 minutes, with the fastest intrusion clocked at 27 seconds — according to Michael Sentonas (pictured), president of CrowdStrike Holdings Inc.
“I’ve never seen anything like it, and I’ve never seen anything move so fast,” Sentonas said. “We had boards, entire boards, come into our briefing center in California because they wanted to understand what to do. I had lunch with the CEO of a really large bank. He wanted to know was his security team doing enough and was he supporting the CISO enough, because they’re just so worried about what’s going on.”
Sentonas spoke with theCUBE’s Dave Vellante and Rebecca Knight at Fal.Con, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. (* Disclosure below.)
AI detection and response becomes a category, not a product
CrowdStrike used the event to make Falcon Guardian generally available, extending its single-sensor architecture to cover agents at runtime. The product traces back to the company’s acquisition of Pangea Cyber Corp., though the ambition behind it is broader than any one tool, Sentonas explained.
“Pangea brought us AIDR. So this is AI detection and response, prompt security,” Sentonas said. “We really had a vision of AIDR, not so much as a product, but we thought of AIDR as a category. That includes the AIDR gateway, it includes the prompt security, model security, the harnesses.”
The company also opened a Cyber Superintelligence Lab built on purpose-built models trained on its own threat data. Frontier models are good at finding vulnerabilities but leave customers holding a list of problems with no fix attached, Sentonas noted.
“We believe that we could build a better red teaming model to find the issues, but the blue team model is critically important. On one hand, we find the issues. On the other hand, we give you the fix,” Sentonas said. “Until we get to a point where the red team model fails, that’s when you know you’re safe and secure. No one’s done that.”
Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the Fal.Con event:
(* Disclosure: TheCUBE is a paid media partner for the Fal.Con event. Neither CrowdStrike Holdings Inc., the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)
