No PriorsThe New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents
CHAPTERS
- 0:00 – 1:25
AI agents as the new “apex predator” in cyberattacks
Kurtz frames the new threat landscape as driven by “agent state” capabilities rather than traditional nation-state sophistication alone. He argues attackers are increasingly powered by AI agents and prompt-engineered workflows, shifting the defender’s challenge from detecting malware to understanding prompt-driven behavior.
- •“Agent state” flattens the attacker sophistication pyramid—hacktivists gain near nation-state capability
- •Attack tooling is shifting from malware signatures to prompt-engineered behaviors
- •Attackers iterate faster, creating unique signatures and harder-to-classify activity
- •Defenders must respond with stronger AI, leveraging their knowledge of internal systems
- 1:25 – 2:45
Shadow AI in enterprises: agents everywhere, identities nowhere
The conversation expands to what CrowdStrike observes inside enterprises: agents proliferating across environments, often without centralized awareness. Kurtz highlights the visibility and identity problem—organizations don’t know where agents are running or what permissions they’re operating under.
- •Explosion of enterprise agents (e.g., coding agents) used as a proxy for growth
- •“Shadow AI” becomes a major governance and security gap
- •Key risk: unknown agent identities and permissions across systems
- •Need to inventory where AI is used and under what access model
- 2:45 – 4:51
AI’s impact on adversaries: faster vulnerability discovery and breakout time
Kurtz explains how AI accelerates the full attack cycle: more vulnerabilities found and exploited more quickly, with rapid lateral movement once initial access is achieved. He introduces breakout time as a key metric and describes a world where attackers’ speed resembles “inference speed.”
- •More vulnerabilities discovered and exploited at higher velocity
- •Breakout time dropping from hours/days to minutes; examples down to seconds
- •AI attacks are recognizable today due to rapid iteration—may become “low and slow” later
- •Prompt-driven operations enable customized attack paths and pivoting patterns
- 4:51 – 6:37
Open-weight models as the attacker’s workhorse (and why guardrails matter)
Elad asks what models attackers use; Kurtz argues open-weight models dominate because frontier models refuse many cyber-related requests. He notes local compute is becoming powerful enough that attackers can run capable models without guardrails on consumer-grade hardware.
- •Attackers heavily use open-weight and cyber-ablated models
- •Frontier model guardrails limit even benign cyber workflows (refusals)
- •Local hardware is approaching “run serious models at home/laptop” territory
- •Offense advantage comes from unguardrailed availability and easy iteration
- 6:37 – 8:34
Adversary mix and geography: nation states, e-crime, and speed-led operations
Rather than focusing only on geography, Kurtz categorizes threats by actor type: nation-state, e-crime, and hacktivist. He cites active regions (e.g., North Korea, China) and emphasizes that AI is changing operational tempo across all categories.
- •Threat analysis framed by actor type rather than only location
- •North Korea highlighted as highly active (theft/ransomware funding motives)
- •China noted for significant activity using AI-enabled approaches
- •E-crime operators optimize for rapid pivoting to reach “crown jewels”
- 8:34 – 11:24
Security’s new role: enabling AI adoption (gas pedal, not brake)
Kurtz contextualizes AI-era security as part of a long arc where security tracks technology complexity. The new enterprise reality—agents downloading packages, operating with powerful identities, and producing code unreviewed—creates seam-filled attack surfaces that security must make safe for business acceleration.
- •Security evolves with tech complexity (cloud + AI raises complexity sharply)
- •Agents introduce new exposure: package downloads, tool access, powerful identities
- •Explainability and monitoring are weak—agents operate as black boxes today
- •Security becomes the business enabler for faster AI deployment
- 11:24 – 14:36
The Hugging Face moment: first end-to-end agentic escape and defender capability gap
Discussing the Hugging Face incident, Kurtz’s key takeaway is that defenders lacked equivalent capability to the offensive side—especially when frontier models refuse to help analyze cyber events. He argues defenders need frontier-grade defensive AI, not neutered tools that can’t be used during incidents.
- •Hugging Face seen as an early end-to-end agentic attack/escape scenario
- •“Airbags off” experiment shows how sandboxes can be escaped
- •Frontier models refused assistance; responders turned to open-weight models
- •Core lesson: defenders must have parity (or advantage) in AI capability
- 14:36 – 16:15
CrowdStrike’s response: SafeMine, red/blue models, and a digital twin loop
Kurtz describes CrowdStrike’s internal “cyber superintelligence” lab approach: SafeMine with Red Tempest (offense simulation) and Blue Solano (defense). A digital twin of customer environments enables continuous red/blue iteration so defenders can rehearse and harden against evolving attack strategies.
- •SafeMine system includes Red Tempest (red) and Blue Solano (blue) models
- •Built with Nvidia collaboration; Nemotron leveraged on the blue side
- •Digital twin recreates a customer environment for safe iterative testing
- •Closed-loop iteration: red tries to break in until blue detects/blocks patterns
- 16:15 – 19:51
From EDR to ‘AI-DR’: instrumenting agents from birth to tool calls
Sarah prompts a platform overview; Kurtz explains CrowdStrike’s expansion beyond endpoint protection into a broad set of modules and introduces AI-DR. The key idea is to discover rogue/shadow agents and record the full chain of agent behavior—sub-agents, tool calls, MCP usage—then enforce policy and blocking.
- •CrowdStrike expands from 1 to 33 modules across endpoint, cloud, IT, identity
- •AI-DR: extend detection/response to AI agents operating like “superhumans”
- •Discover rogue/shadow agents and map what identities they use
- •Full event chain visibility (sub-agents, tool calls, MCP servers) enables policy enforcement
- 19:51 – 23:57
Why build security-specific models: cost, proprietary data, and trust/sovereignty
Kurtz addresses why frontier-lab access isn’t sufficient even with defender programs. He argues CrowdStrike can deliver dramatically lower-cost inference, better domain performance via post-training on proprietary telemetry, and stronger customer trust controls around sensitive data and “AI sovereignty.”
- •Choice architecture: route to frontier models or use CrowdStrike models
- •Cost delta example: ~$10 per remediation vs ~$0.03 with their approach
- •Unique advantage: decade-plus of real incident/MDR data (not just synthetic)
- •Trust + sovereignty: customers resist sending sensitive security data to labs
- 23:57 – 25:46
Near-term model economics: enterprises shift toward open-weight and local/hybrid setups
Looking ahead, Kurtz predicts more local models running on endpoints with selective routing to frontier models for critical tasks. He reports CIO feedback: frontier costs drove “token maxing” to stop, and open-weight models—slightly behind—are good enough for most enterprise needs.
- •Two-year view: more local models + hybrid routing to frontier when needed
- •Enterprises prioritize cost control; big bills changed behavior quickly
- •Open-weight models ‘good enough’ for most workflows even if slightly behind
- •Operational reality: regulated orgs can’t absorb constant model upgrades
- 25:46 – 29:53
Distillation and geopolitics: the genie is out, open-weight becomes the AI ‘Linux’
The discussion turns to distillation dynamics and whether labs can prevent it. Kurtz suggests distillation is already widespread, credits innovation under constraints, and predicts an “operating system of AI” that is open source/open weight—akin to Linux—while frontier models persist for premium use cases.
- •Distillation likely continues; difficult to reverse at scale
- •Acknowledges innovation outside the US driven by compute constraints
- •Predicts open source/open-weight becomes foundational ‘AI operating system’
- •Frontier models still matter, but commoditization pressures are real
- 29:53 – 32:41
Assessing agent threat realism: not magic, just faster humans—so defense can win
Sarah raises fears of the internet becoming unsafe; Kurtz calls “turn it off” doomerism unrealistic. He argues agents don’t introduce mystical new attack classes—they automate known techniques faster—so strong security engineering can keep pace and even become defense-dominant with better AI.
- •Rejects imminent ‘internet collapse’ narratives as overstated
- •Agents replicate human attacker workflows—better, faster, not supernatural
- •AI drives ‘more and faster’ vulnerabilities/exploitation, not teleportation
- •Defense-dominance requires giving defenders better AI than attackers
- 32:41 – 39:15
What to watch in AI: chips, efficiency breakthroughs, and edge deployment
Kurtz highlights hardware and efficiency as major catalysts: specialized chips, math innovations, and improved power/performance curves. He expects meaningful advances in shrinking models to run on desktops and phones, driving a future where edge compute is more fully utilized.
- •Chips and specialization re-emerge as a central innovation frontier
- •Step-function gains possible via math/science breakthroughs
- •Model shrinking/efficiency enables phone/desktop-grade local inference
- •Edge compute (TPUs/NPUs) will be increasingly utilized, not idle
- 39:15 – 45:27
Executive playbook: agility in large companies, protect moats, optimize for customer value
In closing, Kurtz offers leadership advice for incumbents facing AI-native disruption. He emphasizes shifting cadence (small squads, faster iteration), leveraging durable moats like being a system of record and net data creator, and winning via trust, outcomes, cost, and simplicity/time-to-value.
- •Adopt AI-native operating cadence: smaller teams, rapid iteration, avoid waterfall
- •Identify moats: system-of-record position and continuous data creation
- •Disrupt yourself before others do; return to ‘startup roots’ in execution
- •Customer-first focus: trust, economic value, simplicity, fast deployment
