No Priors: Artificial Intelligence | Technology | Startups
00:13:10 · Elad Gil, George Kurtz
[00:13:10] S2: And is that hard in the context that you mentioned of the guardrails being so strong on the state of the art labs models that to some extent you could argue there aren't those same defensive capabilities available to every enterprise? In other That's words, the fact that they had to go to open weight models suggests that you can't actually do it currently with the labs. And so the question then, how do you adopt that? [00:13:31] S0: Yeah, yeah. I mean, like you try to make a PowerPoint with a frontier model around cybersecurity and it refuses you. So, you know, this is part of why we created Safemind and our red and blue models just for that reason, because we wanted to give frontier caliber defenses to our customers that allow them to operate without sort of all these sort of refusals. I think that's going be an important element going forward for many companies.
00:13:31 · George Kurtz, Elad Gil
[00:13:31] S0: Yeah, yeah. I mean, like you try to make a PowerPoint with a frontier model around cybersecurity and it refuses you. So, you know, this is part of why we created Safemind and our red and blue models just for that reason, because we wanted to give frontier caliber defenses to our customers that allow them to operate without sort of all these sort of refusals. I think that's going be an important element going forward for many companies. [00:13:59] S2: I think, I guess, back to the offense versus defense side, it seems like with every technology shift, offensive capabilities are always a little bit ahead when you have a big change in how things are done for a few reasons. I mean, one of them is just with offense, it can be very directive. I need to go do x, while with defense, it's a broad surface area you need to cover. So to some extent, you need to cover more stuff. And then secondly, it's just technology adoption and diffusion. Right? You are one attack... You are a set of attackers. You know what you're going after versus the diffuse ecosystem of enterprises that you need to defend against. How does CrowdStrike think about ensuring that those defensive capabilities are very broadly available?
00:14:36 · George Kurtz
[00:14:36] S0: Well, this is one of the things that we focused on. We created our own cyber superintelligence labs before the term was popular, I might say. So I guess we kind of nailed that one. But essentially what we've done is we've created our own basically frontier type lab that is totally focused on security models, both red and blue and the harness and we call it safe mine as a system, but we've got red Tempest and blue Solano. Those are the two models. Now we worked extensively with NVIDIA on this and we basically leverage. We leverage a few model types, but Nemo Tron is one of the main models that we leverage on the blue side. And when we sat down with him and I sat down with Jensen, we were working on it for the last six months and we kind of went through how this would work and essentially to your point like you know the defense always seems to be one step behind. The big part of what we're doing is we're iterating the red and the blue. For our customers we have a view of what their environment looks like And and this was Jensen sort of insisting like you have to have a digital twin. If you look at other industries, they have digital twins. And he goes, you have to have one security. So we built a digital twin where we can take all of the information that we know about a customer's environment. We can basically recreate that in a virtual world and then we can iterate the models and loop the models where red continually is focused on getting in until it runs out of turns because Blue Solano has actually figured out what RED was doing. And that's really the way I think we have to keep up with the threats because RED is constantly iterating and you're gonna have to have this loop in place.
00:16:15 · Sarah Guo
[00:16:15] S1: That makes sense. I I mean, even just from a classic cybersecurity perspective, like knowing your environment is one of the only advantages that you have as a defender, as well as as as CrowdStrike has pioneered, like, you know, the ability to share intelligence and understanding of the adversary. Right? Actually, I I think it'd be useful to just, like, zoom out and describe, like, you know, the the key offerings and investments on the R and D side that CrowdStrike is making today? Because I I think like it's a it's a massive cyber player, but I think the the root of like endpoint protection and understanding the adversary might be an outdated view.
00:16:55 · George Kurtz
[00:16:55] S0: Yeah, I think that's right. You know, we we've really, you know, probably over the last, you know, four or five years, I guess, really moved into, you know, much broader platform capabilities. We've got 33 modules today, and you know, ultimately when I started the company, had one module, and now we've got 33. We've built capabilities not only across endpoint but around cloud, IT, identity and many different areas that are out there. So if you look at where we've made a lot of investments and some of the things that we just talked about at our latest user conference, Falcon, it was around what we call AIDR. So we pioneered EDR, Endpoint Detection Response, which a lot of it in the early days was a computer and a human. And then you know we've added obviously many more things around that and prevention and all those sort of things. But when you look at what an agent is doing, it's essentially a superhuman. It has an identity. It has access to compute. It runs on your computer or it can run-in a container. It has access to data as networking capabilities, right? So what we wanted to be able to do is to first find all of this rogue and shadow AI because nobody knew where it was like back to your point. You got to know what your environment looks like, And then two, we can instrument from the birth of an agent what that agent does. So if you're in, you know, clogged clogged code, you start an agent has sub agents. It has tool calls. It you know goes to an MCP server, pulls data, whatever it's doing. Can actually tell you the entire chain of events, and that's incredibly important and then be able to add policy and blocking rules around those. So we've spent a lot of time in that area, and I think from a business perspective, if you look at the stats right now on average today, which I actually think is low, but they say you can have 90 different agents, you know as an employee. Well, that can be a much bigger opportunity than just EDR for us, so that's one area that we've been focused on. The second area then, as I mentioned, is creating this super intelligence lab and creating our own frontier models. Again, our models, we start with existing models like a Nemotron class, you know, mostly the three class of Nemotron.
00:19:07 · George Kurtz, Sarah Guo
We're helping them sort of fine tune some of the things we need for the force that's coming out, but then you know we kind of, you know, post train them and using all the valuable data that we have over the last fifteen years to get the best outcome. And I'll say one more thing and I'll pause. The harness makes a huge difference like almost any model we take, whether it's frontier, whether it's just an off the shelf open weight model, we can get much better results at a way lower cost because of the harness that we created that goes with it. So those are some of the big investments. You know, there's more around identity. I'm happy to cover any of those, but let me pause there and see if had any any other comments or thoughts on those. [00:19:51] S1: That was going be one of my big questions about your labs investment here, which is I think a reasonable question to ask about any model training effort is like, why isn't that just a frontier? You know, you work with OpenAI and Anthropic Yeah. Like capability. These these labs, of course, they realize the importance of security, and then they have these programs for, like, vetted defenders, be it, like, Daybreak or sort of mythos access. Why is that insufficient? I mean, you have you have a capability argument based on, you know, harness your your understanding internally data. Is there anything else structurally that you think is important for an independent security vendor here?