No Priors: Artificial Intelligence | Technology | Startups
00:11:43 · George Kurtz, Sarah Guo
[00:11:43] S0: of the seminal moments? Let me ask you a question first. So what was your big takeaway from Hugging Face? [00:11:48] S1: That anybody running frontier models needs to be careful of their environment quality and have very good ongoing production monitoring. [00:11:57] S0: Yeah, that is the takeaway. But I think what a lot of people would say as well, this was the first agentic end to end attack. All true, and you kind of look at you know what these things were doing, and you know people talk about them, you know hiding themselves and you know trying to basically survive to the next generation and those sort of things. All true. My biggest takeaway was that the defenders didn't have the same capabilities as the offense. Okay, now you would look at this and say the airbags were off because this was an experiment where the agents, you know, the guardrails were down. The airbags were off, and ultimately they found a way out of the sandbox. But the reality was Hugging Face, you know, when the first thing they did was they went to the frontier models and they said, like is this thing real? What's going on? And they got refused, right because the airbags were on over there. So what do they have to do? They actually had to go to open weight models to kind of sift through all this data and figure it out. So a big piece for me is to basically make sure that defenders have the same level of frontier defensive AI as what the offense is using. And that was a big takeaway for me and part of the things that CrowdStrike is working.
00:13:10 · Elad Gil, George Kurtz
[00:13:10] S2: And is that hard in the context that you mentioned of the guardrails being so strong on the state of the art labs models that to some extent you could argue there aren't those same defensive capabilities available to every enterprise? In other That's words, the fact that they had to go to open weight models suggests that you can't actually do it currently with the labs. And so the question then, how do you adopt that? [00:13:31] S0: Yeah, yeah. I mean, like you try to make a PowerPoint with a frontier model around cybersecurity and it refuses you. So, you know, this is part of why we created Safemind and our red and blue models just for that reason, because we wanted to give frontier caliber defenses to our customers that allow them to operate without sort of all these sort of refusals. I think that's going be an important element going forward for many companies.
00:13:31 · George Kurtz, Elad Gil
[00:13:31] S0: Yeah, yeah. I mean, like you try to make a PowerPoint with a frontier model around cybersecurity and it refuses you. So, you know, this is part of why we created Safemind and our red and blue models just for that reason, because we wanted to give frontier caliber defenses to our customers that allow them to operate without sort of all these sort of refusals. I think that's going be an important element going forward for many companies. [00:13:59] S2: I think, I guess, back to the offense versus defense side, it seems like with every technology shift, offensive capabilities are always a little bit ahead when you have a big change in how things are done for a few reasons. I mean, one of them is just with offense, it can be very directive. I need to go do x, while with defense, it's a broad surface area you need to cover. So to some extent, you need to cover more stuff. And then secondly, it's just technology adoption and diffusion. Right? You are one attack... You are a set of attackers. You know what you're going after versus the diffuse ecosystem of enterprises that you need to defend against. How does CrowdStrike think about ensuring that those defensive capabilities are very broadly available?
00:14:36 · George Kurtz
[00:14:36] S0: Well, this is one of the things that we focused on. We created our own cyber superintelligence labs before the term was popular, I might say. So I guess we kind of nailed that one. But essentially what we've done is we've created our own basically frontier type lab that is totally focused on security models, both red and blue and the harness and we call it safe mine as a system, but we've got red Tempest and blue Solano. Those are the two models. Now we worked extensively with NVIDIA on this and we basically leverage. We leverage a few model types, but Nemo Tron is one of the main models that we leverage on the blue side. And when we sat down with him and I sat down with Jensen, we were working on it for the last six months and we kind of went through how this would work and essentially to your point like you know the defense always seems to be one step behind. The big part of what we're doing is we're iterating the red and the blue. For our customers we have a view of what their environment looks like And and this was Jensen sort of insisting like you have to have a digital twin. If you look at other industries, they have digital twins. And he goes, you have to have one security. So we built a digital twin where we can take all of the information that we know about a customer's environment. We can basically recreate that in a virtual world and then we can iterate the models and loop the models where red continually is focused on getting in until it runs out of turns because Blue Solano has actually figured out what RED was doing. And that's really the way I think we have to keep up with the threats because RED is constantly iterating and you're gonna have to have this loop in place.
00:16:15 · Sarah Guo
[00:16:15] S1: That makes sense. I I mean, even just from a classic cybersecurity perspective, like knowing your environment is one of the only advantages that you have as a defender, as well as as as CrowdStrike has pioneered, like, you know, the ability to share intelligence and understanding of the adversary. Right? Actually, I I think it'd be useful to just, like, zoom out and describe, like, you know, the the key offerings and investments on the R and D side that CrowdStrike is making today? Because I I think like it's a it's a massive cyber player, but I think the the root of like endpoint protection and understanding the adversary might be an outdated view.
00:16:55 · George Kurtz
[00:16:55] S0: Yeah, I think that's right. You know, we we've really, you know, probably over the last, you know, four or five years, I guess, really moved into, you know, much broader platform capabilities. We've got 33 modules today, and you know, ultimately when I started the company, had one module, and now we've got 33. We've built capabilities not only across endpoint but around cloud, IT, identity and many different areas that are out there. So if you look at where we've made a lot of investments and some of the things that we just talked about at our latest user conference, Falcon, it was around what we call AIDR. So we pioneered EDR, Endpoint Detection Response, which a lot of it in the early days was a computer and a human. And then you know we've added obviously many more things around that and prevention and all those sort of things. But when you look at what an agent is doing, it's essentially a superhuman. It has an identity. It has access to compute. It runs on your computer or it can run-in a container. It has access to data as networking capabilities, right? So what we wanted to be able to do is to first find all of this rogue and shadow AI because nobody knew where it was like back to your point. You got to know what your environment looks like, And then two, we can instrument from the birth of an agent what that agent does. So if you're in, you know, clogged clogged code, you start an agent has sub agents. It has tool calls. It you know goes to an MCP server, pulls data, whatever it's doing. Can actually tell you the entire chain of events, and that's incredibly important and then be able to add policy and blocking rules around those. So we've spent a lot of time in that area, and I think from a business perspective, if you look at the stats right now on average today, which I actually think is low, but they say you can have 90 different agents, you know as an employee. Well, that can be a much bigger opportunity than just EDR for us, so that's one area that we've been focused on. The second area then, as I mentioned, is creating this super intelligence lab and creating our own frontier models. Again, our models, we start with existing models like a Nemotron class, you know, mostly the three class of Nemotron.