CrowdStrike today announced SafeMind, a cybersecurity-specific AI model-harness system that CEO George Kurtz described as the “first complete agentic system for cybersecurity” at the company’s Fal.Con conference in Las Vegas.
At the heart of SafeMind are two purpose-built cybersecurity models, the adversarial Red Tempest and the defensive Blue Solano. Both models have been trained on CrowdStrike’s Falcon sensor telemetry, a security data set Kurtz called the largest in the world, drawing from “the trillions of events Falcon sensors see every day,” as well as “15 years of stopping breaches,” a reference to the company’s incident response fieldwork and threat intelligence.
Separately, Red Tempest operates as an offensive red team, emulating adversarial attack paths to provide “continuous red teaming at machine speed,” while Blue Solano, a “frontier-class model purpose-built for defense,” works to protect enterprise IT systems through measures it has learned analyzing real-world deployments, Kurtz said.
Together, however, through the SafeMind harness, the two models work in a feedback loop in which “everything Red Tempest runs” against an enterprise environment, “Blue Solano learns from,” Kurtz said, an agentic system that moves SecOps closer to autonomous defense.
“Most people drew the wrong conclusion from Hugging Face,” Kurtz said, referring to the OpenAI model escape that resulted in an attack on the AI community platform’s production systems. “The real gap that I saw was that the attackers had frontier AI and the defenders didn’t. That changes now.”
At issue during that incident was the fact that Hugging Face, which first attempted to analyze the attack with general-purpose frontier models behind commercial APIs, came up against guardrails, causing it to have to switch to open-weighted models. Kurtz’s implication then is that, with a cybersecurity-specific model, cyber defenders will no longer bump up against usage limitations that frontier AI labs have begun placing on their most capable models.
The SafeMind agentic system will be available natively in CrowdStrike Falcon, but as Kurtz mentioned, enterprises will be able to access the Red Tempest and Blue Solano models directly through the company’s Project QuiltWorks trusted access program to expand their use of the models.
SafeMind, which was built in partnership with Nvidia and is based on the AI giant’s Nemotron open model, leverages CrowdStrike’s Falcon sensors to create a digital twin of an enterprise’s environment, complete with asset inventories, identity stores, threat graphs, and adversary intelligence. Red Tempest traverses that cloned digital environment to find attack paths, and Blue Solano, learning of those paths through the SafeMind harness, works to fix them. The result is a prevention-detection-response lifecycle, Kurtz said.
Nvidia CEO Jensen Huang shared the stage with Kurtz as a SafeMind partner and customer, saying that SafeMind has been able to replicate the Nvidia IT system using Falcon sensors in use across the company’s IT landscape, enabling the company to edge closer to autonomous SecOps.
SafeMind is a product of CrowdStrike’s Cyber Superintelligence Lab, a cybersecurity frontier AI research organization headed up by Dr. Bartley Richardson, formerly of Nvidia, that the company also announced today.