No Priors: Artificial Intelligence | Technology | Startups
00:14:36 · George Kurtz
[00:14:36] S0: Well, this is one of the things that we focused on. We created our own cyber superintelligence labs before the term was popular, I might say. So I guess we kind of nailed that one. But essentially what we've done is we've created our own basically frontier type lab that is totally focused on security models, both red and blue and the harness and we call it safe mine as a system, but we've got red Tempest and blue Solano. Those are the two models. Now we worked extensively with NVIDIA on this and we basically leverage. We leverage a few model types, but Nemo Tron is one of the main models that we leverage on the blue side. And when we sat down with him and I sat down with Jensen, we were working on it for the last six months and we kind of went through how this would work and essentially to your point like you know the defense always seems to be one step behind. The big part of what we're doing is we're iterating the red and the blue. For our customers we have a view of what their environment looks like And and this was Jensen sort of insisting like you have to have a digital twin. If you look at other industries, they have digital twins. And he goes, you have to have one security. So we built a digital twin where we can take all of the information that we know about a customer's environment. We can basically recreate that in a virtual world and then we can iterate the models and loop the models where red continually is focused on getting in until it runs out of turns because Blue Solano has actually figured out what RED was doing. And that's really the way I think we have to keep up with the threats because RED is constantly iterating and you're gonna have to have this loop in place.
00:16:15 · Sarah Guo
[00:16:15] S1: That makes sense. I I mean, even just from a classic cybersecurity perspective, like knowing your environment is one of the only advantages that you have as a defender, as well as as as CrowdStrike has pioneered, like, you know, the ability to share intelligence and understanding of the adversary. Right? Actually, I I think it'd be useful to just, like, zoom out and describe, like, you know, the the key offerings and investments on the R and D side that CrowdStrike is making today? Because I I think like it's a it's a massive cyber player, but I think the the root of like endpoint protection and understanding the adversary might be an outdated view.
00:16:55 · George Kurtz
[00:16:55] S0: Yeah, I think that's right. You know, we we've really, you know, probably over the last, you know, four or five years, I guess, really moved into, you know, much broader platform capabilities. We've got 33 modules today, and you know, ultimately when I started the company, had one module, and now we've got 33. We've built capabilities not only across endpoint but around cloud, IT, identity and many different areas that are out there. So if you look at where we've made a lot of investments and some of the things that we just talked about at our latest user conference, Falcon, it was around what we call AIDR. So we pioneered EDR, Endpoint Detection Response, which a lot of it in the early days was a computer and a human. And then you know we've added obviously many more things around that and prevention and all those sort of things. But when you look at what an agent is doing, it's essentially a superhuman. It has an identity. It has access to compute. It runs on your computer or it can run-in a container. It has access to data as networking capabilities, right? So what we wanted to be able to do is to first find all of this rogue and shadow AI because nobody knew where it was like back to your point. You got to know what your environment looks like, And then two, we can instrument from the birth of an agent what that agent does. So if you're in, you know, clogged clogged code, you start an agent has sub agents. It has tool calls. It you know goes to an MCP server, pulls data, whatever it's doing. Can actually tell you the entire chain of events, and that's incredibly important and then be able to add policy and blocking rules around those. So we've spent a lot of time in that area, and I think from a business perspective, if you look at the stats right now on average today, which I actually think is low, but they say you can have 90 different agents, you know as an employee. Well, that can be a much bigger opportunity than just EDR for us, so that's one area that we've been focused on. The second area then, as I mentioned, is creating this super intelligence lab and creating our own frontier models. Again, our models, we start with existing models like a Nemotron class, you know, mostly the three class of Nemotron.
00:19:07 · George Kurtz, Sarah Guo
We're helping them sort of fine tune some of the things we need for the force that's coming out, but then you know we kind of, you know, post train them and using all the valuable data that we have over the last fifteen years to get the best outcome. And I'll say one more thing and I'll pause. The harness makes a huge difference like almost any model we take, whether it's frontier, whether it's just an off the shelf open weight model, we can get much better results at a way lower cost because of the harness that we created that goes with it. So those are some of the big investments. You know, there's more around identity. I'm happy to cover any of those, but let me pause there and see if had any any other comments or thoughts on those. [00:19:51] S1: That was going be one of my big questions about your labs investment here, which is I think a reasonable question to ask about any model training effort is like, why isn't that just a frontier? You know, you work with OpenAI and Anthropic Yeah. Like capability. These these labs, of course, they realize the importance of security, and then they have these programs for, like, vetted defenders, be it, like, Daybreak or sort of mythos access. Why is that insufficient? I mean, you have you have a capability argument based on, you know, harness your your understanding internally data. Is there anything else structurally that you think is important for an independent security vendor here?
00:20:33 · George Kurtz
[00:20:33] S0: Yeah, think there's a few things there. So first, what the labs are creating is incredible. I mean, where they've come from, what they created, it's unbelievable, right? And we also want to make that available to our customers. So the general theory is if you have a safe mind and you want to leverage a frontier model, great. We can leverage that. If you want to leverage our models, fantastic. Our models will be significantly cheaper. So just to give you an example, so for general remediation, if you use the highest caliber frontier cyber model, probably costs you about $10 Ours is like $03 So there is a huge cost difference, which is important. But then when you look at our model, because of the way we've post trained it on our data, a huge difference is we have the data. Like there is no Reddit of CrowdStrike security data. You can create synthetic data, but it's really not the same as what we have. We've got fifteen years. Well, maybe a little bit less because I started fifteen years ago, but call it over a decade of security data, including from our MDR, our Managed Detection Response Service, that has all of this sort of threat and vulnerability pairings and sort of the attack chains, and we've basically created this massive amount of data that we use to train it. We were getting great results on it, and I think it is very focused because of the post training. You know again, it's not going to cure cancer, but it's going to give you great results for security. That's number one. Number two is there is a safety and trust aspect. We have all of the data from our customers. We've been entrusted with that for the last fifteen years. We know how to protect it. We know what they want. We know how they want to use it. There's a real concern by customers. They don't want all this data going out to the labs. They don't want all their sensitive information. They don't want it. Their information being trained on, right? So we can provide a way to get them the trust and security that they want for their own security program. This sort of concept of AI sovereignty is very important to many of our customers. So again, we're not saying exclude the labs because they have incredible technology, but you can pick what you want or you can route between the various models, but ultimately we want to give customers choice.
00:22:55 · Elad Gil, George Kurtz
[00:22:55] S2: I think you've also talked a little bit about separation of church and state. Want to make sure that to some extent there's a neutral third party that can also interrogate some of the models that the labs are providing or some of the other open source out there, and it seems like CrowdStrike can definitely play that role as well. [00:23:12] S0: I think the number one factor in security is being trusted, being a trusted partner. You know, you can look at the vendors out there. There's obviously a few big guys that are out there. There's many security companies, but trust is built in drips and lost in buckets, and you know, customers, they don't want sort of cowboy activities that may put their data at risk. And again, everybody's trying to do the best they can. But our whole focus and I think focus is incredibly important in any business. Our whole focus is security, and our whole focus is keeping our customers safe. And we're not trying to solve the world's problems in AI and other areas. So I think that is certainly an advantage for us. [00:23:57] S2: If you were to think out two years from now, what do you think is the state of the security world? Like what do you think shifted from this point forward?