AI-based cyberattacks are now able to infiltrate an organization in seconds, leaving security teams next to no time to defend against intrusion.
This risk and CrowdStrike Holdings Inc.’s vision for helping organizations fight back were the focus of keynote remarks at CrowdStrike’s Fal.Con event by George Kurtz (pictured), president, chief executive officer and founder of CrowdStrike. AI has dramatically reduced the time it takes an attacker to move from an initial foothold within an organization to another target, a measure known as “breakout time,” according to theCUBE Research’s Dave Vellante.
“Every year at this conference, George steps up and says breakout time has gone from two minutes to 72 seconds, down to 30 seconds,” Vellante said in an analysis of the day one keynote. “And now he’s like, it’s done. It’s just runtime. There is no breakout time.”
Here’s the complete Day 1 Keynote Analysis, part of SiliconANGLE’s and theCUBE’s coverage of Fal.Con:
CrowdStrike’s “2026 Global Threat Report” reported an average eCrime breakout time of just 29 minutes. The fastest attack took only 27 seconds , according to Michael Sentonas, president of CrowdStrike.
“I’ve never seen anything like it. I’ve never seen anything move so fast,” he said. “That’s all happening on one side. On the other side … I think it’s fascinating. It’s so exciting. There’s so much possibility. There’s so much we can do. Unfortunately, the benefit we get is also the benefit the attacker gets. That’s kind of that challenge that we have right now.”
At Fal.Con, CrowdStrike introduced its solution to this problem: SafeMind, a family of purpose-built security models created in partnership with Nvidia Corp. SafeMind is the first innovation from the CrowdStrike Cyber Superintelligence Lab, which the company is positioning as the first frontier AI research organization that’s using AI to stay one step ahead of AI-based threats, Kurtz noted.
“What we did is we created bespoke models that were built for defenders,” he said. “Oobviously we have an offensive model as well, which is needed. What we wanted to do was to give choice to customers.”
Here’s the complete video interview with Michael Sentonas:
Sentonas and Kurtz spoke with Vallante and host Rebecca Knight at Fal.Con, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. Along with experts from Amazon Inc., Nvidia, CISO Group, and other organizations, they discussed how the best defense could be AI that goes on the offensive. (* Disclosure below.)
Here are four key insights you may have missed from Fal.Con:
Insight #1: CrowdStrike bets on AI-powered red and blue teaming to harden defenses.
SafeMind aims to give defenders access to the same advanced AI capabilities attackers are using. That need drove CrowdStrike to develop security-specific models, explained Daniel Bernard, chief business officer of CrowdStrike.
“Frontier models have done a fantastic job bringing AI innovation to the market at large. It’s really benefited the adversary,” he said. “It’s time for the defenders to have something, and it’s time for security to have its own model. It turned into a set of models, a model family, and that’s where SafeMind was born.”
SafeMind consists of two AI models, Red Tempest and Blue Solano, trained on CrowdStrike incident data and built on Nvidia’s Nemotron family of AI models. Red Tempest hunts for attack paths by scanning a digital twin of the customer’s environment, explained Justin Boitano, vice president and general manager of enterprise computing at Nvidia. Blue Solano then fixes any vulnerabilities it finds.
“The digital twin describes the environment of the actual world,” he said. “You run the red agent through the environment and you’ll find different ways in to exfiltrate data. Then the blue agent will come in and write rules that would have detected or prevented the red attack agent from getting through. That iterative loop basically hardens the environment.”
Here’s the complete video interview with Daniel Bernard and Justin Boitano:
Insight #2: AI adversaries are shrinking the window to respond.
CrowdStrike’s research shows that speed is becoming one of the biggest challenges for security teams facing AI-driven threats. Such threats have increased dramatically over the past year, according to Adam Meyers, senior vice president of intelligence at CrowdStrike.
“The stat that’s most interesting is we had something like 26 agentic adversaries that we were tracking in the last 30 days,” he said. “That’s more than we were tracking in the year before that.”
Those agentic adversaries can move quickly. They operate far faster than human attackers, Meyers pointed out.
“In 58 minutes, VAULT PANDA had conducted 1,100 commands. It was an agent that was doing it, and we were watching it learn in real time,” he said. “When I talk about breakout time from our global threat report, we were talking this year about 29 minutes on average, 27 seconds was the fastest. I’m talking about an entire intrusion operation conducted in minutes from start to finish.”
Here’s the complete video interview with Adam Meyers:
Box Inc. uses CrowdStrike technology to help clients prevent intruders, including AI agents, from accessing sensitive corporate information. The technology strengthens protections for critical company data, according to Heather Ceylan, Box’s chief information security officer.
“Attack surface is the same, but it’s not just humans who are the attackers anymore,” she said. “It’s agents and they move at machine speed. So everything got faster. Our detections need to be faster, our visibility needs to be real time.”
AI sprawl further complicates the problem. Enterprises have rushed to deploy bots across their businesses without necessarily building the architecture needed to govern access and trust, added Cristian Rodriguez, field chief technology officer of the Americas at CrowdStrike.
“They’re calling us saying, we have a problem, the AI sprawl is real, we know it’s in our SaaS apps, we know it’s on our endpoints, we know it’s in our cloud instances,” he said. “[They are saying] help us get our arms around visibility and governance programs and control, because we’ve bitten off a little more than we can chew.”
Here’s the complete video interview with Cristian Rodriguez and Heather Ceylan:
Insight #3: AI is reshaping data loss prevention from the endpoint up.
Endpoint security remains an important focus for security teams focused on enterprise data loss prevention. Implementing on-device AI security can help prevent data loss when, for example, an employee pastes sensitive corporate information into a chatbot, said Todd Cramer, senior director of business development and security ecosystem at Intel Corp.
“This year, we have Falcon data security from CrowdStrike announcing their first AI model that runs on an Intel NPU on a Dell device,” he said. “It’s the right time in the use case, because we’ve got all these AI assistants, chatbots. What’s the first thing CISOs are worried about? Data.”
Dell Technologies is developing hardware telemetry solutions that give security teams full visibility into threats. The technology provides coverage across the entire technology stack, said Lori Zwilling, senior director of software product management at Dell Technologies Inc.
“Not only are analysts seeing the endpoint behavior, but they also can see what’s happening with AI models, the data, the inferencing, the actual containers, the compute that’s powering the AI for the enterprise,” Zwilling said. “We’re talking about full-stack AI security now.”
Here’s the complete video interview with Todd Cramer and Lori Zwilling:
AI is also changing how DLP identifies risky data movement. Jazz Inc. won the 2026 Cybersecurity Startup Accelerator from CrowdStrike and Amazon Web Services Inc. for its AI-based solution, which learns the business context surrounding risky outbound messages. AI-enabled DLP represents the evolution of a longstanding security challenge, according to Ido Livneh, co-founder and chief executive officer of Jazz.
“We didn’t build yet another pattern match or another rule-based system,” he said. “We completely upturned the whole challenge with our approach, which is building an investigator, a context-first, business-first investigator that understands your business, understands not only what is happening with the data flows, but why it’s happening, the intent, and solving it through that.”
“We didn’t build yet another pattern match or another rule-based system,” he said. “We completely upturned the whole challenge with our approach, which is building an investigator, a context-first, business-first investigator that understands your business, understands not only what is happening with the data flows, but why it’s happening, the intent, and solving it through that.”
Traditional DLP tools have often struggled to prevent data loss at scale. AI could help address that limitation by analyzing large volumes of information more effectively, said CJ Moses, chief information security officer and vice president of security engineering at Amazon.
“In my experience, DLP providers have never done what DLP actually, the acronym, stands for. They’ve never done the data loss prevention,” he said. “With basically AI now being a thing that actually will allow you to be able to deal with the large scale of the information and how they’ve implemented was kind of game changing for us.”
Here’s the complete video interview with CJ Moses, Ido Livneh, and Daniel Bernard:
Insight #4: An ecosystem strategy underpins CrowdStrike’s AI security push.
CrowdStrike is positioning SafeMind as the first major achievement of its Cyber Superintelligence Lab. The lab is developing technology intended to automate routine security tasks at the speed required to counter modern adversaries, CrowdStrike CEO Kurtz told theCUBE.
“Part of why we started the Cyber Superintelligence Lab is to be able to build these sort[s] of technologies so that we can get to a level of automation where the car drives itself,” he said. “Maybe the human has to be in the loop, and if something’s really critical, fine. If you can automate the most mundane task and you can do it with the speed at which the adversary is moving, that’s going to be critical.”
Here’s the complete video interview with George Kurtz:
The lab’s goal is to “disproportionately bias the advantage towards the defender,” according to Bartley Richardson, chief AI and autonomous systems officer at CrowdStrike.
“The real remit of the lab is the commoditization of defense capabilities. It is [turning] the best offense into that disproportionately advantaged defender-like capability,” Richardson told theCUBE. “How are we improving other areas in the industry itself? What can we contribute back?”
Here’s the complete video interview with Bartley Richardson:
Partnerships will also be key, as evidenced by CrowdStrike’s Project QuiltWorks, a cross-industry alliance of technology companies, law firms, consultancies, and others focused on finding and fixing security vulnerabilities surfaced by AI models.
“QuiltWorks is a coalition of folks and partners who join us; they leverage our platform,” explained Amanda Adams, senior vice president of global alliances at CrowdStrike, in an interview with theCUBE. “We announced yesterday Falcon IQ, and this is a tool built on AWS that allows a partner to essentially drive an assessment and highlight the opportunities, the priorities. It’s using AI to accelerate the time from discovery to remediation down to minutes.”
CrowdStrike’s partnership with Amazon Web Services has also evolved alongside the technology, according to Mona Chadha, director, strategic partnerships and category growth at Amazon Web Services Inc.
“Over the decade, what we continued to do was build innovations together,” Chadha told theCUBE. “We’ve evolved from machine learning to generative AI to now agentic and building these agents. There’s a lot of opportunity there, but there [are] also a lot of threats.”
Here’s the complete video interview with Mona Chadha and Amanda Adams:
Catch up on our complete video coverage of Fal.Con:
(* Disclosure: TheCUBE is a paid media partner for Fal.Con. Neither CrowdStrike, the headline sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)
