Breakout time hits zero as CrowdStrike unveils autonomous red teaming: theCUBE’s Fal.Con 2026 day one keynote analysis
For years, security teams measured their odds by “breakout time,” the minutes an attacker needs to move from initial foothold to lateral movement. That clock used to run in hours; at this week’s CrowdStrike keynote, the number effectively hit zero. The industry’s answer is autonomous red teaming: pitting one AI model against another in a closed loop, attacking and patching an environment before a real adversary gets the chance. CrowdStrike Holdings Inc. used its Fal.Con 2026 keynote in Las Vegas to introduce SafeMind, a pair of AI models, Red Tempest for offense and Blue Solano for defense, built with Nvidia Corp.’s Nemotron models out of a new Cyber Superintelligence Lab. Dave Vellante (pictured, right), co-founder and chief analyst at theCUBE Research, called it the strongest Fal.Con keynote he’s seen in five years covering the event.
“He talked about the pyramid of pain, where the nation states used to be at the top and now it’s agents at the top, and they also flattened the pyramid,” Vellante said. “The nation state, the agent state he called it, is a prompt.”
Vellante was joined by fellow analysts Rebecca Knight (center) and Krista Case (left), for a day one keynote analysis of the Fal.Con event, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed CrowdStrike’s SafeMind launch and what autonomous red teaming means for defenders.
How autonomous red teaming closes CrowdStrike’s loop
The two models work in a closed loop: Red Tempest, trained partly on 15 years of CrowdStrike incident-response data, probes a digital twin of a customer’s environment inside Nvidia’s simulation technology for attack paths; Blue Solano remediates what it finds, and the cycle repeats until none remain. SafeMind runs natively inside the Falcon platform, with standalone access offered through CrowdStrike’s Project QuiltWorks program.
“Every year at this conference, George steps up and says breakout time has gone from two minutes to 72 seconds, down to 30 seconds,” Vellante said. “And now he’s like, it’s done. It’s just runtime. There is no breakout time.”
Case called Kurtz’s framing a wake-up call for the industry, even though attacks like it aren’t yet happening at scale. Vellante agreed with the keynote’s blunter point: attackers keep the edge because they only have to be right once, while defenders have to be right every time. “It’s not that the defense can’t win,” Vellante said. “But that’s an old saying: offense only has to win once.”
Stay tuned for the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the Fal.Con event.
Photo: SiliconANGLE
Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.
15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more** 11.4k+ theCUBE alumni**— Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network
Are you an AWS customer? Support SiliconANGLE financially by buying your AWS services from our Marketplace portal page and links: https://siliconangle.com/aws-marketplace/
About SiliconANGLE Media
theCUBE AIand theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.
Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.