CrowdStrike Launches SafeMind, an Agentic AI System Specialized in Cybersecurity

CrowdStrike announced through its IR website that it unveiled SafeMind, a cybersecurity-focused agentic AI system, at its annual security conference Fal.Con 2026, held in Las Vegas, Nevada, on the 1st (local time). The system was built in collaboration with NVIDIA, and development was led by CrowdStrike's Cyber Superintelligence Lab.

SafeMind assigns offensive and defensive roles to different AI models and operates on a competitive structure between offensive and defensive AIs. As the AI in the offensive role repeatedly searches for new attack paths, the AI in the defensive role repeatedly detects and blocks them, autonomously strengthening defensive capabilities through this iterative learning structure.

CrowdStrike said this structure is expected to expand the scope of autonomous security operations in the cyber threat detection-to-response segment. SafeMind's default operating environment is the Falcon platform, and the separate access route is Project Quiltworks.

At the core of the system is a structure in which the AI models Red Tempest and Blue Solano continuously compete within a single system to improve security performance. Red Tempest is responsible for finding attack paths, while Blue Solano is responsible for detecting and blocking them. The operating method consists of Red Tempest discovering a new attack path, followed by Blue Solano detecting and blocking it, with the process repeated continuously. Through this repetition, each model's capabilities are advanced.

The company said SafeMind can be integrated with state-of-the-art models and open-source models. It added that this could increase user choice, improve model preference, and enable more cost-efficient management.

George Kurtz, CrowdStrike's CEO and founder, said the entity that will define the future of cybersecurity is not AI that identifies threats, but AI that neutralizes them. He said SafeMind conducts vulnerability discovery, strengthens protection, and improves performance on a recurring basis. He also said it is advancing the mission of stopping breaches at machine speed.

He said the cybersecurity landscape in the AI era will continue to evolve as a competition between adversaries using AI to scale attacks and defenders using AI to expand detection and response capabilities. He also noted that cybersecurity is one of the application areas of AI with very high demand for computing power.

CrowdStrike used its accumulated security data and field experience to train the model. The training incorporated Falcon sensor telemetry, threat intelligence, Falcon Complete MDR event annotations, and incident response experience.

Blue Solano was built using NVIDIA's open model Nemotron. NVIDIA said it is based on open Nemotron, does not send threat data to external vendors, and performs post-training using its own threat data. It also said NVIDIA Nemotron 3 Ultra oversees the defensive agent system and powers SafeMind's rule-generation sub-agent.

The company said SafeMind recorded a 29% increase in detection rates compared with major state-of-the-art models and open-source baseline models, a 6x increase in end-to-end problem-solving speed, and a 99% reduction in detection and recovery costs.

Bartley Richardson, CrowdStrike's chief AI and autonomous systems officer, said the company's models are a starting point for a new chapter in cybersecurity, and explained that an agentic system in which the model and harness evolve together can enable defenders to respond at machine speed. He linked this to his outlook for an AI security foundation over the next 10 years.

Source: TECHWORLD · Kim Hye-jin
Original: https://www.epnc.co.kr/news/articleView.html?idxno=406386

References

• https://www.epnc.co.kr/news/articleView.html?idxno=406386