At CrowdStrike’s Fal.Con 2026 in Las Vegas, NVIDIA CEO Jensen Huang and CrowdStrike CEO George Kurtz unveiled CrowdStrike SafeMind, an advanced agentic cybersecurity system designed to counter rapidly rising AI-enabled attacks. Combining NVIDIA Nemotron open models with CrowdStrike telemetry, SafeMind launches natively inside the CrowdStrike Falcon platform to automate threat defense at machine speed.
The Asymmetric Shift in Automated Adversarial Tactics
Cybersecurity is undergoing a severe structural transformation. According to data released by CrowdStrike at the Las Vegas conference, AI-enabled attacks surged by 89% over the past year, while the fastest eCrime breakout time compressed down to a 27 seconds. In an environment where threats operate autonomously, human-speed incident response amounts to little more than forensic documentation.
“The real gap that I saw was that the attackers had frontier AI, and the defenders didn’t,” George Kurtz told an audience of 10,000 security professionals. “And that changes now.”
To bridge this capability gap, the CrowdStrike Cyber Superintelligence Lab developed SafeMind. Unlike standard generic copilots or bolted-on chatbots, SafeMind operates as an integrated system featuring distinct offensive and defensive models coupled with specialized agentic harnesses.
Architectural Anatomy of SafeMind and NVIDIA Nemotron
Under the hood, SafeMind relies on a dual-model design powered by NVIDIA Nemotron open-weights architecture. CrowdStrike post-trained these open models using its massive repository of enterprise security data—including Falcon sensor telemetry, Falcon Complete MDR event annotations, and a decade and a half of incident response fieldwork—without exposing sensitive telemetry to outside providers.
The system comprises two core releases:
- Red Tempest: An offensive red-team model built for advanced attack scenarios, actively emulating AI adversaries to locate vulnerabilities.
- Blue Solano: A defensive blue-team model fine-tuned from NVIDIA Nemotron 3 Super, deployed to protect enterprise assets using battle-tested remediation measures.
Internal evaluations conducted by CrowdStrike demonstrated that the Blue Solano model delivered higher accuracy rates than leading frontier models while slashing operational costs by 99%. An NVIDIA Nemotron 3 Ultra instance orchestrates the overarching defensive agent harness.
“The harness is essentially the exoskeleton of the large language model,” Jensen Huang explained during his keynote address. “The large language model is the brain. The exoskeleton turns it into an agent — and this exoskeleton doesn’t have to be the same shape and capability for every domain.”
Digital Twins and Adversarial Coevolution
To ensure reliability under production loads, NVIDIA tested SafeMind models and harnesses within a high-fidelity cyber agent environment running as a digital twin of NVIDIA’s internal accelerated computing infrastructure. This environment establishes an adversarial coevolution loop: an offensive red-team agent executes Recon, Assault, and Compromise sub-agents to discover exploit paths, while a blue-team defensive agent monitors via Falcon sensors, validates detection candidates, and automatically hardens the network.
CoreWeave’s AI Cloud powers the underlying training and inference infrastructure for this accelerated computing stack. “The real test of AI is what it can do in production, at scale, when the stakes are highest,” noted CoreWeave co-founder and CEO Michael Intrator, emphasizing the demanding nature of enterprise-grade security workloads.
Expanding the Autonomous Workforce with Falcon IQ
Beyond the core SafeMind release, CrowdStrike introduced CrowdStrike Falcon IQ, an agentic workload automation engine operating inside Charlotte AI AgentWorks, the company’s no-code agent development platform. Falcon IQ leverages an orchestrated workforce of more than 50 specialized agents to automate time-intensive assessment, prioritization, and remediation workflows.
Trusted access for standalone models and harnesses will roll out through the Project QuiltWorks program, giving security leaders the flexibility to pair their own models with CrowdStrike’s custom harnesses. By pairing NVIDIA’s full-stack accelerated computing architecture with CrowdStrike’s threat intelligence, the partnership delivers an autonomous defense mechanism capable of outpacing modern machine-speed attacks.
