Fal.Con 2026: Securing AI | George Kurtz, Jensen Huang, Lip-Bu Tan & Greg Brockman

Yeah, I agree.

And they gave us a gift, and then they said you guys would like.

AI is changing the world—every business, every industry—and it's moving faster than anything that came before. But with all of its promise, AI is nothing if it's not secure. So the question is, how do we secure AI at the speed of AI? We were built to answer that question. This is our moment to secure what AI makes possible and protect what the world depends on. The future is here, and we're trusted to secure it together.

Welcome to Fal.Con. Please welcome Chief Executive Officer and founder of CrowdStrike, George Kurtz.

Well, this summer you all read the same story I did about an agent that escaped its sandbox. It broke into one of the most relevant AI companies on the planet. It escalated privileges, it stole credentials, and it buried the real attack under a mound of information. Then our industry did what it normally does: it went on social media and argued whose fault it was. But almost everyone drew the wrong lesson from the OpenAI-Hugging Face incident, and I'm going to spend the next 30 minutes telling you the right one, because in my mind, it changes everything about our industry. So for years, we ranked our adversaries in the pyramid—I call it the pyramid of pain—where hacktivists were on the bottom, e-crime in the middle, nation-state on the top. Of course, more hacktivists than nation-state. And the top really represented the apex predator: the greatest capabilities, the most sophistication. The bottom, many more, least sophisticated. The pyramid existed for exactly one reason: the offensive capability was scarce. It took a nation to fund the talent, the tooling, the infrastructure, the patience. But the scarcity is over.

And let me give you two examples. Last November, Anthropic disclosed a state-sponsored actor running a live espionage campaign using its models. Roughly 30 organizations were targeted: banks, tech companies, governments. Eighty to ninety percent was orchestrated by AI—80 to 90%. And instead of a piece of malware, it was actually English. It was a prompt that did most of the work, and there were four to six human touches for targeting approvals, things of that nature. The agent did everything else. Now, this wasn't a demo. It wasn't a lab exercise. It was a live campaign. If we fast-forward to July, we can talk about Hugging Face. Autonomous agents drove an intrusion end-to-end. Let me say that again: autonomous agents drove an intrusion end-to-end. And for me, this was a watershed moment in security. We all thought the agents broke out of the sandbox. I personally think the agents thought they broke free. There's a big difference. And it's amazing when you go through the reports on this—and I give credit to OpenAI and Hugging Face for putting this information out—so the agents weren't attacking anyone. They were trying to find information to actually cheat on a test. No campaign, no tasking, no malice. They were literally looking to try to find the answers. And this is the flaw in which AI is operating from merely passing a test in this particular case.

Now, some of you know the July incident. It was in a sandbox with the guardrails relaxed, the safety systems were turned down. And some of you may say, "Well, the airbags were off, that doesn't count." And when I hear that, I think the opposite. With the safety system off, it gives us a view into the capabilities of what the agents can actually do. And you have to ask yourself one question, and that is: do we think the adversaries are going to turn the safety systems off? I personally don't, and there's a good reason why. Now, this may be a new term for you, but it's something that you should know because it's really relevant to what I'm talking about: obliterate models, from the term ablate. So essentially, these are models that basically have their guardrails relaxed. These are open-weight models that anyone can download. And what that means is that you essentially have frontier-capable models essentially without guardrails. Very easy to ask it a question and to get an answer. And some of the questions that you ask it and some of the answers you get back, you would be astounded. Folks, this is here today, and this is one of the reasons why, when I say the airbags are off, they're staying off, I actually mean it.

Now let's get back to our apex predators, the pyramid of pain. It used to be capabilities that separated the tiers. The apex predators were at the top: time, resources, and sophistication. But the new apex predator is the agent. I've got to update my chart now. Now we've got four rungs. And what I mean by that is this is really the rise of the agent state. We hear about nation-state; it's now the agent state, because when apex capabilities become a prompt, guess what happens? There are no tiers at all. Every adversary, every e-crime crew, every insider are now operating with nation-state capabilities. The pyramid has just been obliterated, flattened. This is what we're dealing with in today's environment. So let's go back to July and we'll talk about what actually happened. I'm going to breeze through this because I think many of you know it, but I'll talk about it and you can see it on the screen. You have sandbox escapes, you have a malicious dataset, you have code execution, privilege escalation, lateral movement, credential theft, covert C2 decoy activities—it's all there. By the way, this looks exactly like a nation-state activity. And I actually urge everyone to go back and read some of the white papers on this to see how the agents communicated, to see what they did with the message boards, to see how they coordinated. And some would say that the 1,200 agents were actually believed to be acting for the collective. Think about that: actually working on behalf of the collective for the common good.

Now, if you look closer, you've got 17-plus thousand actions with no human on the keyboard. You can see here droppers, recon, remote code execution, backdoor tunneling, C2 evasion—it's all there. Anything in red actually caused damage: 56 that stole data, 69 that took source code, 87 that seized the clusters. The successful attack was hidden in thousands of lines of actual failures. And by the way, no human can actually pick all of that out from the data that they had to sift through. So for years, I stood on the stage like this one and I tracked this number called breakout: 62, 48, 29. The fastest one that we saw last year was 27, and we called that machine speed. We were wrong, I was wrong. This was human speed with better tools, and breakout time is over. I don't know what we're going to do for next year's report, but we're going to have to come out with another metric because it's gone. But this is what I want you all to understand: attacks now happen at inference speed. Think about that. Attacks are happening at inference speed. And when an attacker has inference speed, there is no breakout time. There's actually no time at all to deal with these attacks.

So in this particular case, going back to Hugging Face, the intrusion succeeded: credentials were stolen, forged identities and tokens stolen. They held admin access across multiple internal clusters. But this is an important point: intent stopped the attack. What did they want to do? Those agents wanted to pass the test—goal-seeking in a way that I think we've never seen before in cybersecurity. I mean, really powerful and fascinating. The agent was cheating, but it wasn't trying to do damage. So let me make it clear: the company was spared because of the agent's intent, not the defense—not the defense. Security SOAR generated a lot of information, but it failed to raise enough alarms that the administrators were paged. So it cost some time. They saw some activity, didn't know how to put it all together. And by the way, this is not a knock on anyone. You've got a sophisticated company with incredible people, but there's a lot of data that you have to go through. And these agents, again, are acting in an autonomous fashion. So here's where it gets interesting to me: the frontier AI actually refused to do the forensics. The guardrails that actually stopped AI from writing exploits actually stopped it from taking one apart. The fire department wouldn't enter the building. Seventeen thousand actions couldn't sort out what happened. So what did they actually have to do? They actually had to stand up their own open-weight model to understand what happened with all of the log information they had and try to reconstruct the attack. There was no adversary in this particular case, and what tore through the infrastructure was legitimate: agents doing their job all too well, with more access than anyone realized it actually had.

So you have to ask yourself: what's running in your environment? Do you know? What is it actually doing? Who knows? And what risk does it actually pose? This is not a hypothetical threat; this is something that happened. And again, I think as an industry, we got lucky because it wasn't really intent on damage. But this incident really shapes what's inside your own walls. So the agent state isn't at your perimeter; it's actually on your payroll. You just don't know its name. And here's what's amazing: your companies, your people, organizations brought them all in. The old motto was keep everybody out; now it's let them all in. So that's where we are. We can't see them, we can't keep up with them, and no one has built AI for the defender. AI is the new battleground. You're going to hear that obviously a lot through this conference. And 15 years ago I told everyone endpoint was the battleground. Then it was identity, then it was cloud, and today AI is the new battleground. Every time computing grows a new attack surface, Falcon grew with you, our customers: the same platform, the same sensor, the same weapon that you needed to win. We were there for you, and we've been there for some of the most consequential attack surface changes in the world, and the AI agent is the next one.

So today we're talking AI detection and response. We're launching Falcon Guardian. I'm so excited about this. This is one of the things that we've worked on. I personally worked on this myself with the team, and we spent a lot of time with customers getting their feedback, listening to what they wanted, and basically delivering something that can help them not only understand their risk, understand what's running, but more importantly, help accelerate AI adoption in your own organizations. So let's roll the video.

Today, CrowdStrike launches Falcon Guardian, securing AI agents where they execute on the endpoint. A decade of runtime security leadership now extended to agents. AI agents act autonomously at machine speed, but organizations don't know where they run, who deployed them, or what risks they introduce. Guardian changes that. It starts with discovery. Guardian maps your entire AI agent fleet, known as shadow AI, across every endpoint. An interactive honeycomb renders the full inventory at a glance. Filter by type, cluster by risk, answer the board's hardest questions in seconds. Turn AI governance policy into runtime enforcement: define which agents run where, which tools they touch, what executes, and set guardrails for prompt visibility and control. At the core is the agent graph, a single causal timeline fusing prompt layer activity with OS layer telemetry—what the agent was told, what it actually did. One sensor, one story. This is layered detection, exposing attacks that either layer alone would miss. Guardian secures the entire agent runtime, letting your enterprise embrace AI with confidence to work at the speed of innovation. One sensor, one console, one platform: Falcon Guardian.

All right, well, it's now available. It's GA, so if you want to check it out, get down to the booth, get a demo. And folks, that was just a teaser. Michael Sentonas is going to give you the full details, the full demo tomorrow, and it's going to blow your socks off. Now getting back to the agent state, I told you it's on your payroll. Now you know its name, how to stop it, how to control it. Same sensor, new attack surface. But the best AI on Earth was built for everyone. And remember what happened in Hugging Face: they turned to AI for the forensics, and the model refused. The guardrails that stopped the model from writing exploits stopped it from taking it apart. And in the moment of crisis, the best AI on Earth was really built for everyone except for the folks in the audience, except for the defenders. Think about that: the best AI on the planet was built for everyone but the defenders.

General purpose models are general purpose. However, as defenders, we need models that are built for defenders, that understand security, that have been trained on some of the largest datasets in the world. So I'm pleased to announce that we're launching the CrowdStrike Cyber Superintelligence Lab. Three elements—you know what its name is, let's go through what it's actually going to do. Mission: pretty simple. Frontier AI research with a single purpose, and that is cyber defense—not general intelligence with a security feature, security intelligence. We're not interested in solving hard math problems; we're interested in solving hard security problems. Number two, the data: actually trained on the trillions of events that the Falcon sensor sees every day—endpoints, identities, cloud, now agents—in a dataset that doesn't exist anywhere else on Earth. And it's not something that's general purpose that anyone else has; it is something that we actually have and we've trained our models on. And the people and the partnership: the lab is run by Bartley Richardson, formerly of NVIDIA. You're going to hear from him on Thursday. We're bringing the best AI talent in the world to CrowdStrike. However, we're not building it alone, and you'll hear in a second who we're partnering with.

Now, when a company announces a lab, everyone has the right to be skeptical because labs turn out papers, and I can tell you papers don't stop breaches. So we decided to stand up our lab, and we didn't announce the lab until we could actually show you what we built. The lab is not the announcement; the lab is the factory. And I want to show you the factory. I want to show you what cranked out of this factory. But let me show you who we actually partnered with. Together with NVIDIA, we built cybersecurity's first complete agentic system for cybersecurity, including the first frontier models and harness purpose-built for defenders. This isn't a Copilot that's baked into someone else's intelligence; it's not a chatbot with a security skin. It is a frontier-class model built and trained by CrowdStrike on our data in partnership with NVIDIA, and we're going to talk more about that right after my keynote. Couldn't be more excited. So I want you to meet Blue Solano, a frontier-class model purpose-built for defense. We need to defend at the speed of the attack. It's trained on the largest security dataset—15 years of stopping breaches. But defending is only half of the job. Meet Red Tempest, purpose-built for offensive security. This acts as an advanced adversary, doing the work that general-purpose models won't touch: continuous red teaming at machine speed.

Now, we have the saying "offense in service of defense." Kind of gets back to the old Hacking Exposed days: if you understood how the attacks work, you're better able to defend against those. And this is really an important element: understanding how the adversary works is key to stopping the breaches. It's in the ethos of CrowdStrike. So every attack that Red Tempest actually runs, Blue Solano learns from—offense in service of defense. Now, two models are in a system. What makes this very unique is the harness that we actually built to run them, and that's CrowdStrike SafeMind. That is a complete system, including the harness. And I can tell you the harness makes a massive difference and the training makes a massive difference to get to the best outcome with the lowest cost. So CrowdStrike SafeMind: offense, harness, defense—a complete system that works in tandem together. Now I want to give you one example. This is just one example of an unlimited number of examples that we want to demonstrate: the power when you combine blue and red together. So the best way to survive an attack is to make sure you're attacking yourself, and one that you've never seen before. It actually happens on one side, it closed the loop, and the offensive model runs the attack, but the defensive model actually learns from it. It's the continuous cycle that helps get the defender to be sharper, to continuously learn from what Red is doing. Now, it's easy for me to talk about it, but one of the things that I want to do is show it to you. And one of the exciting pieces that we actually built is a digital twin to actually simulate this in a safe environment. So with that, let's roll the video.

Meet SafeMind, an autonomous agentic system to redefine cybersecurity as we know it. SafeMind is a complete set of state-of-the-art harnesses and models that exceed frontier-level capability for cybersecurity applications. SafeMind excels at delivering the prevention, detection, and response lifecycle at machine speed. It goes beyond surfacing findings all the way to taking autonomous cyber defense action. In one use case, an analyst activates SafeMind as a skill in an AI tool. Powering SafeMind are two new classes of models: Red Tempest and Blue Solano. The analyst loads data about their enterprise. This data can be anything: asset inventories, identity stores, adversary intelligence, threat graphs, Falcon telemetry—everything needed for cyber operations. SafeMind's best-in-class models both build and deploy a complex clone of your enterprise, matching hosts, topology, operating systems, and applications. Let's harden our defenses by loading an attacker scenario, unleashing Red Tempest. The model immediately assesses multiple paths to achieve its goal, autonomously succeeding in data exfiltration. SafeMind captures the traces from Red Tempest, and Blue Solano takes over: a defender model beyond frontier level operating in a CrowdStrike harness. Blue Solano learns, identifies holes, validates new detections, and deploys them immediately. With the new detections in place, let's see how Red Tempest does. The new defenses written by Blue Solano stop Red Tempest in its tracks, and it's forced to adapt and find a new path. The loop repeats again and again and again until there isn't a path left for Red Tempest. The Blue Solano model outsmarted the attack, learning from Red Tempest while creating new remediations and defenses. Detection coverage grows, raising the cost for an actual adversary dramatically. But what you saw doesn't just happen once. SafeMind gives every defender beyond frontier capabilities, as Blue Solano is built and evolves with Red Tempest, ensuring the best defense is always aware of the best offense. Use Red Tempest for the best offensive security and to identify risk. Use Blue Solano for your defense. Use them independently or combine them to ensure your defense stays ahead of elite offense. SafeMind goes beyond generic frontier models for cybersecurity, turning findings into autonomous action. The defender advantage starts now. CrowdStrike delivering the first frontier AI models purpose-built for cybersecurity.

All right. How cool is that? How cool is that? Now, this is just one example that we showed. Obviously the models and the harness will help power the platform, the Falcon platform that you all use, and you'll see that come into the platform. But I want to be clear, because we have worked with a lot of partners in advance of this, and there is an interest in getting access to the models directly. And what we're doing for that is we're opening that up to our trusted access program, and that will be part of our QuiltsWorks program. So if you have more interest in that, you can talk to your reps. But the models themselves, the harness, will be in the platform, and then obviously there will be a lot more things that you could do with it if you're consuming the models directly. So more to learn on that, more to see. You can stop by the booth and see what it all looks like. But I couldn't be prouder of the team and what we put together. I couldn't be more thankful for the help that NVIDIA provided, and I think this is one of those areas where you have good folks in the industry coming together to solve a really hard problem and doing it in a way that customers want. Now, for me, it's important to talk about choice, because I want to be clear about this: we're not going to lock you into our models, right? If you want to use our models, if you want to use frontier models—and we'll talk about that a little bit later—or you want to use open-source models, or you actually want to put all the models together, that's fine. It's an open ecosystem, and we're not talking about vendor lock-in. But we want to give our customers choice in what they want to use as part of the overall platform, and of course, leveraging the harness, which really is the 10x factor in getting additional results at the lowest cost.

So if you step back and you look at what we built: Guardian protects every agent on the new attack surface. The lab builds frontier AI defenses, and that's its goal, and there'll be a lot more that's coming out from the lab. And of course, SafeMind acts natively in one platform, one console, one agent, one control plane, which is critical for our customers. I also want to be clear that you stay in control—you stay in control of the system. This is incredibly important from a safety perspective and things that we thought about in the overall architecture. So in closing, I want to go back to what I talked about in the beginning, and that is most people drew the wrong lesson from Hugging Face. Some saw these autonomous agents act in a way that we haven't seen before. Some saw the swarm, some read about the message boards, some saw covering up their tracks, and some saw the agents work as a collective group for the good of the entire group. But the real gap that I saw was that the attackers had frontier AI and the defenders didn't. And that changes now. The agent state is here. Attacks at inference speed is here. So every leap in AI can serve the attacker or it can serve the defender. But at CrowdStrike, we're bending the curve and we're giving the power back to the defender. Adversaries have frontier capabilities; now you do too. You have Falcon. Thank you so much. Have a great Fal.Con, and I look forward to seeing you in just a minute.

Please welcome Chief Business Officer at CrowdStrike, Daniel Bernard.

Amazing innovation, amazing announcements. Every relationship in this room is a partnership. Together we stop breaches. We're securing AI as a collective. You can see it in the hub where we have over 150 sponsors here and partners that integrate with our technology. We listen to your feedback every day as our trusted customers, and we innovate together to create where this market is going and how we're going to protect it together. There's no better voice to talk about where this market is going than our own George Kurtz, founder and CEO of CrowdStrike. And it gives me great pleasure to also invite to the stage none other than Jensen Huang, the CEO and founder of NVIDIA. Jensen, George, come on out. Join us.

Thank you. Have fun.

Thank you.

Fal.Con! All right. Wow, how great is this? I feel safer already. This is the safest place on Earth, George.

It is, it is. And I said I met you in the green room, and I said one day I'm going to aspire to wear the leather jacket. I'm going to stick to plaid for now.

You've got to work up your cool.

I know, I know. Not everyone can be as cool as you. All right, well, again—

This is the coolest CEO, by the way. His office is in—yeah, whose office is inside a hangar? Did I just tell him something that nobody else knew?

It's a struggle. It's good.

Yeah, he's a race car driver.

We were putting this stuff together, and I was on a Zoom call and literally landed, got out, and went to the office. And he goes, "What did you just do?" And I said, "Well, I just landed and got out and went to my office." He goes, "Who has that?" You were jealous. You were jealous.

I wasn't jealous. I thought it was—I was going to use the S-word.

All right, so let's get down—

A little jealous, a little jealous.

Let's get down to it. All right, so, look, you gave the world the technology to create AI, and you're standing now in front of the cybersecurity stage. And by the way, I remember when you gave the world the technology to have an amazing graphics card, because when I was a kid, it was an NVIDIA graphics card that I had. So I just have to be clear. But now AI is a theme, you're revolutionizing the world. What pulled you here, and why is security so important for you and NVIDIA?

Yeah, I'm just so happy I raised him.

Yes. Good job.

The first question, the setup is, "When I was a kid, I used your products." Yeah, thanks.

Okay. When I was a kid, yeah.

When I was eight.

I was a little bit older.

Anyhow, we're in an inflection point in cybersecurity for obvious reasons. We have now agentic AI, the ability to automate attacks, and the attacks on companies are going to grow exponentially. However, at exactly, precisely the same time, we also have in our hands the necessary technologies to automate, to identify cyber defense. And you and I met recently—as recently as several years ago—and we started to talk about what we could do together to bring the world's best AI technologies in service of cybersecurity defense, instead of what everybody talks about, which is using AI to exploit companies. We're going to use AI to defend companies. And so the announcement that you just made, SafeMind, was a proud moment for me, and it was great to see it come together. Incredibly visionary product from CrowdStrike, and you are my number one cybersecurity partner—my number one cybersecurity provider. And so it was essential that CrowdStrike has access to the best of NVIDIA and that we put our best minds together to create something that could be helpful to me, to be helpful to the world.

And I think this is really where I get encouraged, because you hear about the attackers having the advantage and having capabilities, and defenders are a step behind. But the thing that I love about security is that companies can come together in a community to actually solve a problem. And you and I were on the call, and you talked about this being so important to you, and in a number of months we got it done together with just tremendous work from both teams and support. And I think that's what makes the cybersecurity community so special: that we can come together and get stuff done like this.

So this is a goodwill community democratizing the fundamental technologies that are used by the attackers so that the defenders have access to the technology, right? That asymmetry is fundamentally what we count on. And so most people don't realize the cybersecurity community working transparently, working together cohesively—that is the asymmetric advantage the good guys have on the bad.

Yeah, right. Exactly.

And that technology called community is something that most people underestimate. And so we're case in point. I mean, obviously we care about the same thing: we care about the security of the country, we care about security of companies and nations, and by working together transparently, you now are an AI company. You have a research lab. Our AI researchers love working with yours together with your domain expertise, your decade and a half of security data that we can train on. We can create Nemotron, take a frontier model, and make it essentially a super AGI that is incredibly good at cybersecurity. And then you put it into a system called SafeMind with red teaming, blue teaming, the two adversarially working against each other in a digital twin of NVIDIA and testing it against that. I mean, that's completely brilliant. And so now you have helped us create these rules that will run on Falcon, and you're helping us automate SecOps. And then, of course, beyond that, we're going to keep on working on it so that we become more and more autonomous in SecOps. And so this is the first step.

So this is a good segue then into open-weight and open-source—there is a difference—models. Nemotron: we worked with you using the Nemotron models built by NVIDIA. And talk a little bit about your view of the ecosystem, right? You've got frontier, you've got open-source, I talked a little bit about choice. You guys have an incredible model, we're working with you. What's the vision for where Nemotron is going, and how are we going to continue to work with you on the security side to help advance its capabilities?

George, you are the poster child of Nemotron. I don't mean good-looking; I mean just poster child.

I see how this is going to go. I see how this is going to go.

You set it up! Okay, CrowdStrike is absolutely the poster child. And the reason for that is I believe in closed models and open models. We should use closed models and proprietary models and off-the-shelf as much as you can. Why build something unless you have to? However, there are many applications in the world where you have to: you must have the ability to fine-tune, to post-train, to, in the context of SafeMind, create an AI that is super good at a particular domain. We don't need every AI to be super smart at everything, but in some areas we need to be extraordinarily good at something, and cyber defense is something we want to be incredibly good at. And so Nemotron was really created for precisely that: to enable you, enable CrowdStrike in partnership with us, to create a superintelligence who is incredible at cyber defense. And it was also created in a way that is very cost-effective. It was designed to be both smart but also fast. And the reason for that is because in many of the applications that we're interested in, we want that asymmetric advantage. And so now with Nemotron being cost-effective, you guys deploy yourself, it's completely free, it's incredibly fast, you have the ability to have an asymmetric advantage against whatever comes your way. And so I think that was the mission of Nemotron: to be at the frontier—it doesn't have to be the frontier, but it has to be at the frontier—it has to be completely customizable, it's completely transparent to you. Not only do we open-weight, but we also open the data, open all the training scripts, we also open our research teams to work with you. We're working on Nemotron 4 together; the Nemotron 4 will be even better for cybersecurity than Nemotron 3. And then beyond that is Nemotron 5. And NVIDIA has enough scale and expertise and dedication to this, I can work on this for as long as I shall live, and so we'll be able to, as a partner, keep the world safe.

Well, that's a good segue to the next question. Because we're going to be doing this a long time, in five years, when you come back on stage and we think about security, what are we going to be talking about that this audience hasn't even heard of, thought of, or dreamt of, specific to AI and security?

Well, in five years when I'm back here, you still won't be cool enough to wear a leather jacket. But you'll still be working in a garage, in a hangar, slumming it away in a garage. That was the funniest. I'm trying to have a serious conversation with George about SafeMind—I mean, it's basically the precursor of SafeMind—and we're on the phone, on video, and it's literally like that part of the movie where somebody's running and they're breathless, going from hallway to hallway up the stairs. It was the wildest.

Well, I had a limited time with you, and I got delayed a bit, and I took it on the plane and walked right in the office. So it all worked out, right? I wasn't going to move the meeting. Would you move the meeting?

And so in five years' time—and way, long before that—the attack surface of a company is significant from the outside in. And of course, today we're going to automate SecOps, and we're going to help SecOps write the rules. And inside this digital twin, with this mouse-and-cat scheme going on, we're going to create the best rules to secure our company. However, over time, that's going to become more and more autonomous. And the reason for that is because obviously we want to find these exploits and look for a patch within seconds. But in the future, we want to do that ideally as autonomously as possible all the time, with human in the loop looking at big decisions. However, the attack surface from inside the company is incredible, because today we have thousands of employees—we have 40,000 employees on our network with identity and access controls, and they're using tools or accessing files and doing things. And so these 40,000 employees will soon be augmented by several hundred thousand agents. And these several hundred thousand agents, we work on this thing called OpenShell that creates a secure container around them. Of course, we're going to try to containerize them and keep them as secure as possible. However, they're going to have more and more access control and use more tools and so on and so forth. And so inside the company, we have zero trust policies today and technologies from CrowdStrike to maintain a zero trust environment, but in the future, we're going to have to maintain a zero trust agentic environment. And so how are we going to monitor and secure all of these agents, all working on our behalf, keeping the company safe, keeping the company secure, making sure that they don't have any exploits that we don't want them to do? Inside the company, we're going to have a lot of computing work to do. And so I think we got together because your expertise in cybersecurity and our expertise in AI and computing really has to come together. This is the next giant computing frontier: we're going to be computing all the time. The first application, if you will, is coding agents, and now SafeMind will be the second incredible agent—security, cyber agents. So yeah, I think we're going to see a lot of advances in this area. Very, very exciting work, and of course, very important work.

Amazing, amazing. So when you think about what we've built, maybe a couple of comments. When you and I got together, it was really focused on the need for defenders, and I talked about that in my keynote: the fact that they were outgunned, outmatched. When you think about the defender, maybe you can comment.

Did you say, therefore you brought the big guns?

I brought the big guns. I had to put that in there.

Did I bring the big guns? Did he say that Jensen has big guns?

You do have big guns. Should we take the jackets off? But I do think that it's an inflection point for both of us because there is a recognition by the industry, customers, of what AI can do. And more importantly, as you talked about, choice, right? It's all about choice and the models you use, where you want your data, how you use it. And you and I talked a little bit about this: the application layer, this harness becomes really important, because the models at some point are all pretty good, and they keep getting better. Whose model is better one day versus the other? But with the right training data, the right harness, and being very specific, you can get great outcomes. We're focused on a very specific use case. As I said, we don't want to solve all problems in the world; we want to solve the hardest security problems. Do you see that trend happening now in other industries where you have this verticalization of these models? And I'm just curious for the audience how they should be thinking about it, even for their own businesses outside of security.

Well, we should use the smartest general intelligence wherever we can, and for a lot of different use cases, I think just a super smart general intelligent AI can reason through a problem and become good at it. However, for tasks that are highly specialized and quite intensive—meaning it's specialized work that you have to do all the time, for example cybersecurity, it's hyper-hyper-specialized, you're doing it continuously—this is an area where, if you had the necessary data, and you say harness—harness is essentially the exoskeleton, if you will, of the large language model. The large language model is the brain; the exoskeleton turns it into an agent. And so this exoskeleton doesn't have to be the same shape and the same capability for every single domain and every single application. Some of the exoskeletons could have wheels, some of the exoskeletons have legs, and so on and so forth. And so these different capabilities really want to be domain-specific, task-specific. And so I see a lot of different industries that are going to have more and more of these type of application-specific, domain-specific, highly specialized, super-capable harnesses that, in combination with a fine-tuned model that sits inside it, really becomes superintelligence. And so I think you and I see it the same way. And I think SafeMind is really one of the world's first, and it was designed for one of the most important applications: cybersecurity. So I'm super excited to see that.

Yeah, amazing. So we're going to talk about a few topics here, and you and I spoke a little bit about robotics and digital twins and things of that nature. When we think about the physical world, obviously there's compute, there's AI, there's—

Just, you know, an amazing amount of technology that goes into these robots. You know, you may have seen the Robot Olympics a couple of weeks ago. There was running faster than Usain Bolt and slamming into the walls. I mean, it's hysterical. They come out with the stretchers. But to me, they're all going to need security. How should we think in our industry? What opportunities does that present when we just think about all the physical AI that's going to take place in the form of robots and other sort of automation? We need SafeMind everywhere, I mean, and so we need it in every single layer of the computing stack. We need it obviously inside our companies, we need it in the cloud, we're going to need it at the edge, we're going to need it at the distributed edge.

I think the basic framework of SafeMind, which is an adversarial model which is acting on a digital twin of the environment with a defender model trying to figure out how to cat-and-mouse this thing, eventually learning how to secure itself within that domain of the digital twin. This basic framework applies to robotics, edge computing, enterprise computing, and just about everything. And so the fact that CrowdStrike has sensors all over Nvidia, and you now have the ability to replicate the Nvidia IT system as a digital twin, that's an incredible capability. Now that you can replicate the digital twin, we can create the adversarial and the defender system to defend itself. And so I think this basic idea replicates in just about every different domain. Whether it's a factory, you want to keep factories safe and secure, whether it's a robot, the robot itself has to be safe and secure. In every single one of these systems, we could create something like SafeMind. We could use the SafeMind framework and create essentially a cybersecurity agent that runs alongside the AI model itself.

Okay. So whenever I come visit you, it's like the professor sits down and gives the lesson, right? And you talk shop and you always give us something to think about. So in the last minute or two here, as security practitioners, as folks who are helping to drive the industry, but also folks who are consuming products, what should we be thinking about now? What problems should we be solving now that we're not thinking about?