The NVIDIA founder and CEO joined CrowdStrike CEO and founder George Kurtz to announce CrowdStrike SafeMind, an agentic cybersecurity system developed by the CrowdStrike Cyber Superintelligence Lab. “This is the beginning of a new age of cybersecurity,” Huang told the crowd. “On the one hand, the adversaries are going to be more armed than ever. On the other hand, all of you are going to be more armed than ever.”

SafeMind combines CrowdStrike's purpose-built, beyond frontier-capable models and customized agentic harnesses with defensive models built on NVIDIA Nemotron, operating in a continuous coevolution loop where offense and defense repeatedly challenge and improve each other. CrowdStrike also announced CrowdStrike Falcon IQ to operationalize Project QuiltWorks through agentic workload automation and expanded its CrowdStrike Guardian AI safety solution.

We have asymmetric advantages because we have a large community of cybersecurity experts who want to work with each other and keep the world safe.

The real gap that I saw was that the attackers had frontier AI, and the defenders didn't. And that changes now.

SafeMind's Architecture

CrowdStrike built SafeMind's defensive model using NVIDIA Nemotron open models, post-trained with CrowdStrike's cyber experience and threat data. The SafeMind models are paired with proprietary cybersecurity harnesses optimized to work as an agentic stack, shipping natively in the CrowdStrike Falcon platform.

NVIDIA Nemotron 3 Ultra orchestrates the defensive agent harness, while a fine-tuned Nemotron 3 Super powers SafeMind's rule-generation sub-agent. By post-training Nemotron with CrowdStrike data, internal evaluations showed that the Blue Solano model—based on Nemotron 3 Super—delivered higher accuracy rates than leading frontier models at 99% lower cost.

Together with NVIDIA, we built cybersecurity's first complete agentic system for cybersecurity, including the first frontier models and harness purpose-built for defenders. This isn't a copilot baked into someone else's intelligence. It's not a chatbot with a security skin. It is a frontier-class model built and trained by CrowdStrike on our data in partnership with NVIDIA.

The harness is essentially the exoskeleton of the large language model. The large language model is the brain. The exoskeleton turns it into an agent—and this exoskeleton doesn't have to be the same shape and capability for every domain.

AI-Enabled Attacks Outpace Human Response

AI-enabled attacks rose 89% in the past year, and the fastest eCrime breakout time has reached 27 seconds, according to CrowdStrike. Human-speed response cannot match this pace. “There are many applications in the world where you must have the ability to fine-tune, to post-train—to create an AI that is super good at a particular domain,” Huang said. “Nemotron was created for precisely that. Completely free. Incredibly fast. You have the ability to have an asymmetric advantage against whatever comes your way.”

There are many applications in the world where you must have the ability to fine-tune, to post-train—to create an AI that is super good at a particular domain. Nemotron was created for precisely that. Completely free. Incredibly fast. You have the ability to have an asymmetric advantage against whatever comes your way.

With open Nemotron as the base, CrowdStrike's security teams post-trained on their own threat data without sending it to an outside provider, customizing the AI to their environment. That capability is not possible with closed frontier models, and in security, the ability to inspect what's defending matters.

Testing in Adversarial Simulation

NVIDIA tested the CrowdStrike SafeMind models and harnesses in a high-fidelity cyber agent environment running as a simulation of the NVIDIA network. The testing runs SafeMind in an offensive-defensive loop for adversarial coevolution: an offensive red-team agent finds exploits, a blue-team defensive agent closes them, and the findings become actionable detections to block attacks.

The red-agent harness runs Recon, Assault, and Compromise sub-agents executing attack paths inside the cyber agent environment. The blue-agent harness monitors via Falcon sensors, generates detection candidates, validates them, and promotes them. CrowdStrike built the test environment with NVIDIA as a digital twin of NVIDIA's own accelerated computing infrastructure, validated against NVIDIA's real threat landscape.

The basic framework of SafeMind—an adversarial model acting on a digital twin of the environment, with a defender model in a continuous cat-and-mouse loop, eventually learning how to secure itself—this basic framework applies to robotics, edge computing, enterprise computing and just about everything.

Falcon IQ and Automated Workflows

CrowdStrike announced Falcon IQ, which operationalizes Project QuiltWorks at machine speed. NVIDIA Nemotron models power the agentic engine at the heart of Charlotte AI AgentWorks, CrowdStrike's no-code agent development platform where Falcon IQ runs. Falcon IQ uses more than 50 agents working together as a unified agentic workforce to automate the most time-intensive workflows in assessment, prioritization, and remediation.

Partners use Falcon IQ to deliver customized findings, recommendations, and executive outputs to customers. Charlotte AI AgentWorks enables every Falcon user to build their own agentic security workforce.

Full-Stack Acceleration

CrowdStrike manages thousands of customer organizations generating trillions of daily security events. With NVIDIA's full-stack accelerated computing platform, the collaboration runs from the chips up through the models to the harnesses acting on what those models find. “The crowd in CrowdStrike,” Kurtz said, “is the asymmetry that puts the defenders in a unique position to defeat the adversary.”

The crowd in CrowdStrike is the asymmetry that puts the defenders in a unique position to defeat the adversary.