George, it's so great to be sitting here with you at RSA. You know, just thanks for taking some time to sit down and talk about the market.
Always a pleasure. Lots going on this week and I'm sure a lot to get into.
I know it is right. I mean, like when you think about RSA, you cannot go anywhere an inch without hearing the word AI. So, I mean, like, what are you hearing from customers across the board, you know, when it comes to the AI revolution, how that's going to impact cyber security?
Well, there hasn't been a meeting this week, and I've had dozens and dozens that didn't start with AI. And the number one request was, help us protect AI at our endpoints, at our desktop. And if you think about it, where does AI happen? It happens at the desktop. After the models are built, how do you actually interact with AI? How do you harness the power? It's at your desktop. You might be using Claude Code. You might be using ChatGPT. You might have your own open models, what have you, but it's running on your desktop. And I asked customers, I said, 'Okay, well, what's holding you back?' And they said, 'Well, we don't have the visibility into AI. We don't have the compliance and governance around it, and we don't have the protection.' And they're looking to CrowdStrike. So, at the end of the day, I said, 'What's the best outcome?' They said, 'The best outcome for us is you can actually unlock what's blocking AI usage in our enterprise because we're all clamoring for it from the board all the way down.' Massive opportunity.
That's, I mean to some extent because I feel like CrowdStrike you have been so far ahead in terms of early seeing where the market's going and even though it's cyber security to some extent you're really a part of the broader AI use cases and deployments. It's not going to happen without those security guardrails.
Well that's it. If you think about AI you need GPUs. That's everybody knows that. And that's to create AI. If you want to use AI, you have to have security there. There's no company that we're talking to that isn't concerned about security. And as I said earlier, it's one of the areas that's holding them back. So, we go hand in glove with AI. We've been an AI native company since I started at the company in 2011. Started with machine learning. Obviously, it's evolved over time, but it is a big part of solving the security problem, and it's a big unlock for companies to really harness all the incredible developments that we've seen just over the last couple years.
And to that point, and I know me and you have talked about before and you've spoken about it, when you think about cyber security, it's almost going to become more strategic when you think about the trillions of dollars spent on AI, how cyber security goes hand in hand. And I guess for CrowdStrike, I mean that represents just such a massive opportunity.
It is because if you look at the way AI has evolved, it evolved from sort of GenAI chatbot to reasoning to now actually doing work with agents and the agents are incredible. Just think about what happened between October to the latest models today. All right, they're unbelievable and they are really focused on what's called goal seeking. So if you tell them a task, they're really good at goal seeking. Now how they get there, it doesn't really matter. They will go around just about any obstacle you put in your way. So, let me give you a couple examples, okay? Because I think you got to really put it in context.
I think these are great examples.
Yeah. So, I'm going to give you a few. So, there's one customer that had 100 AI agents and one of the agents was actually looking for flaws in code and they were all reporting and working as a swarm in Slack. Okay. So, one AI agent found the problem but it didn't have permissions to actually fix it by design. So what it did is it went on to Slack and said, 'Hey, I'd like to fix this. Who has permission to fix it?' Another agent raised his hand, says, 'I'll happily fix it for you. Just tell me what you want because I have permissions.' So it totally went outside the boundaries. Okay. The second story is around a very large Fortune 50 company and they are very sophisticated. So what they did is they fed the security policy into the AI agents that were working and they had one that wanted to do something but it was bound by the security policy but it couldn't achieve its goal. So essentially what it did is it rewrote the security policy and attempted to publish it back just to work around the guardrails that were in place. We are seeing crazy amounts of innovation just from the agents in seeking the goal no matter what means to get there.
As well as also it creates more security issues which speaks to your whole portfolio and the whole product that you're building when it comes to AI.
Well, that's right and a big part of controlling these AI agents starts with the control plane which is around identity. So what's happening today is users are trying to install or installing all these various AI applications. They're installing things like OpenClaw. They're giving it access to everything as the user and it becomes like a security disaster. So, one of the acquisitions that we recently did was a company called Signal AI which really provides zero standing privileges for AI agents. Meaning the AI agents have no privileges until they need to do something and it can dynamically give them privileges based upon what they want to do. And part of the real control plane for AI agents is going to be around identity and we've got one of the leading products there.
Well, and also the key, I mean I like in terms of walking around talking to every vendor so many vendors are talking about what they're going to do when it comes to AI, but you're one of the few it's built. You have the product. Like could we just like dive into that in terms of like why you've separated yourself besides just what you built in terms of CrowdStrike the products built. We're not talking about something that's coming out in the next 6 months or year.
That's right. If you look at what we built and what we built a massive business on, we started with one module, but it was around endpoint and visibility and really helped pioneer what's called the EDR market, endpoint detection response. We did that before there was even a name EDR. And the whole idea was how do we gather data at scale because we're a net data creator. Once we have that data, then we can apply different algorithms and we can solve different security use cases that are out there. Okay. So the amount of data that we create is incredible and that allows us to solve problems. So if we think about what's happening with AI now, you know, what's old is now new, right? The endpoint is back in vogue because that is the tip of the spear for where AI takes place, the consumption of AI, the interaction with users, right? How you're solving problems. And we're taking the same technology that we use to understand what a user is doing, what an application is doing if it was a human and now we're applying it to AI agents. We already have the technology. It does things a little bit different. You have to report on it a bit different. There's some other, you got to understand prompt layers and things of that nature. But we've got the whole apparatus built and customer after customer are looking at us to solve this problem.
And to that point, let's hit the elephant in the room. It's been out there, you know, across the industry. Software, the AI goose trade, Anthropic, LLMs, unseating cyber security. Let's dig into as an expert in the field and everything you've seen over the decades, why LLMs are not going to unseat the CrowdStrikes, the Falcons, that they're going to be disruptive. Let's just, could we just dig into this debate and really try to like, you know, sort of pinpoint it?
Yeah. So, I think when you look at what happened over the last couple months, you've got folks like Anthropic that came out with the ability to look at code and figure out if there's vulnerabilities, which is fantastic, right? And it makes sense because they have the ability to generate code. So, they're looking at code, but just looking at code and finding vulnerabilities is not going to solve all the security problems in the world. And what I mean by that is it's certainly useful, but even if you eliminate every security vulnerability in software, you would not stop breaches. There's just, 20% of these things are sort of malware and sort of breach related. 80% are identity based and, you know, social engineering and all kinds of other ways that people get in. So, while it's fantastic and it's going to move the industry forward, it's a very small piece of what's happening. Now, what is an LLM good at? It's good at looking at lots of data. It's lots of text, you know, it's good at reasoning. But in the security world, you have to make a first and final decision within 100 milliseconds whether something's good or bad. And you know, I don't know, last time you used any number of your AI applications, how many hallucinations did you get? How long did it take? Right? This is not, you're not in line. You're literally looking at data, but you're not in line blocking things. So, this is a big part of why Falcon, why CrowdStrike, and why our platform is going to be around for a long time because ultimately we're a net data creator. The agent, when I say agent, the sensor itself that's running on the machine is looking at what's happening on that system. Say it's a Windows system, what's running, what applications, what processes are running, and we can figure out what's good or bad, which is fantastic, but we use that as a net data creator to train our own models. And certainly we'll leverage frontier models, but the data that we have is proprietary. We built it up over 10 years of looking at all these threats and vulnerabilities and things of that nature. So you can't just waltz in with an LLM and solve this problem. That's just the technology side. Guess what happens? Enterprises need somebody to build it, to test it, to maintain it. And if something happens, they need somebody who's going to support it.
And I think the best example of this is and I ask all the customers, well, what are you, are you building your own? What are you thinking? They said, a, we can never recreate what you did. And two is what people fail to realize. Even if somebody vibe coded something and they get funding for it, it's never funded for the next 10 years.
That's, but that to me is the key in the whole thing.
That's it. Because even if you came up with something, it's not going to be enterprise grade. You're not going to build, you know, there's no bank in the world that is going to allow somebody to vibe code something and run it on critical infrastructure. It's not going to happen. But the biggest thing is just follow the money. And we've seen banks are a great example. They used to build all their software until finally they realize we can build it the first time, but we can't maintain it. And we don't have a view of every customer. So the benefit of CrowdStrike is we have data coming from 176 countries. We know all the attacks. We know all the adversaries. And each company, you know what they see? They see their own data. We have access to the entire world, which makes our algorithms better because of the training data that we actually have.
That's, I mean, I think that really nails it in terms of the differentiation. And also to some extent, if CrowdStrike was going after a market opportunity this big, AI, doesn't AI just make it this much bigger based on just the surface area and overall opportunity?
