Person
1 episodes · 23 quoted claims
George Kurtz argues AI agents have given hacktivists capabilities that only nation-state attackers had a few years earlier.
“The new Apex Predator is the agent state. The same level of capability that a nation state would have just a few years ago, essentially a hacktivist would have today.”
CrowdStrike reports average attacker breakout time of 29 minutes, with the fastest observed at 27 seconds.
“On on average, it's twenty nine minutes, but we've seen it as quick as twenty seven seconds.”
CrowdStrike's platform has grown from one module at its founding to 33 modules.
“We've got 33 modules today, and, you know, ultimately, when I started the company, we had one module, and now we've got 33.”
Kurtz says CrowdStrike pioneered endpoint detection and response (EDR), which in its early days relied on a computer and a human analyst.
“So we pioneered EDR endpoint detection response, which a lot of it in the early days was a computer and a human.”
CrowdStrike's SafeMind system includes a red model named Tempest and a blue model named Solano.
“we've got Red, Tempest and Blue Solano, those are the two models.”
CrowdStrike used Nvidia's Nemotron model as one of the main bases for its blue defensive model.
“NemoTron is one of the main models that we leveraged on on the blue side.”
At Nvidia CEO Jensen Huang's urging, CrowdStrike built a digital twin that recreates a customer's environment virtually so red and blue models can be iterated against each other.
“So we built a digital twin where we can take all of the information that we know about a customer's environment.”
Kurtz says a general remediation task on a top frontier cyber model costs about $10, compared with about $0.03 on CrowdStrike's models.
“for a general remediation, if you use like, uh, uh, uh, the highest caliber frontier cyber model, probably cost you about ten.”
Kurtz says CrowdStrike has held customer security data for about 15 years, which it uses to post-train its models.
“We've been entrusted with that for the last 15 years.”
Kurtz says CrowdStrike's endpoint sensors generate roughly 7 trillion events per day.
“So we're creating 7 trillion or so events like, uh, a day.”
Kurtz says the main lesson of the Hugging Face incident was that defenders lacked AI capabilities matching the attackers'.
“My biggest takeaway was that the defenders didn't have the same capabilities as the offense.”
Kurtz says Hugging Face turned to open-weight models to analyse the incident data after frontier models refused its requests.
“They actually had to go to open weight models to kinda sift through all this data and figure it out.”
Kurtz says the latest frontier models heavily restrict cybersecurity requests, even rejecting a PowerPoint on the topic.
“you can barely create a PowerPoint that has cyber security in it. I mean, it literally rejects you and bumps you down to a lower model.”
Kurtz says North Korean attackers are very active, driven by the need to bring money into their economy, often through ransomware.
“They've got to, shall we say, get money into their economy, so they've been very busy on, uh, you know, stealing information.”
Kurtz says CrowdStrike and Nvidia have worked on the SafeMind models together for about six months.
“We've been working on it for the last six months, and we kinda went through how this would work.”
Kurtz predicts the operating system of AI will be open source and open weight, as Linux is for the internet.
“the operating system of the internet is Linux, like, period, okay, and there's a reason for that, and there's gonna be an operating system of AI”
Kurtz says a large New York bank CIO told him AI costs had spiraled and that heavy token use stopped once large bills arrived.
“The costs were out of control, you know, token maxing, you know, stopped when people got big bills.”
A bank CIO told Kurtz that open-weight models, even three months behind the frontier, are good enough for most of the bank's needs.
“the models are so the open weight models right now are so good, even if they're three months behind, it's plenty for what we need.”
Kurtz says it will be hard to stop distillation of frontier models by Chinese labs because much has already occurred.
“I think the challenge is the the genie's out of the bottle. I mean, there there's a lot of distillation already taken place.”
Kurtz says breaches would persist even with no software vulnerabilities because many attackers log in with stolen identities instead of breaking in.
“What people don't necessarily realize, uh, is that even with with zero vulnerabilities, which I hope the industry can get there, you're still gonna have breaches.”
Kurtz says CrowdStrike displaced older security incumbents such as Symantec and McAfee.
“we disrupted the incumbents, we disrupted the semantics, the MacAfee's, you know, all those other players are, like, all gone for the most part, or changed or bought or whatever.”
Kurtz says he was personally involved in designing CrowdStrike's Falcon Guardian product through small-team, frequent meetings.
“we've done that with, like, our Falcon Guardian product. And to your point, like, I was personally involved, you know, had three day a week meetings”
Kurtz dismisses the idea that the internet must be turned off or air gapped because of AI agents, calling it nonsense while acknowledging the real risks.
“I think it's nonsense, you know, uh, it like, is security and and what agents can do and and the risk that they pose is that serious?”