CrowdStrike introduced SafeMind on Tuesday, a family of purpose-built AI security models developed with Nvidia, designed to find and close attack paths at machine speed. The system operates natively in CrowdStrike’s Falcon platform.
SafeMind consists of two models: Red Tempest, an offensive model built to emulate AI adversaries, and Blue Solano, a defensive model designed to protect enterprise assets. The two are connected by software harnesses that run them in a closed loop, continuously pitting them against each other to improve, the company said.
CrowdStrike built the models by fine-tuning Nvidia’s open Nemotron models using its own threat intelligence, sensor telemetry, and fifteen years of incident response data, the company said. Nvidia’s Nemotron 3 Ultra orchestrates the defensive agent harness, while a fine-tuned Nemotron 3 Super powers a rule-generation sub-agent, according to Nvidia’s blog. The fine-tuning process took roughly 45 days and about 71 Nvidia B200 graphics processing units, according to the Wall Street Journal.
Advertisement
Advertisement
CrowdStrike internal evaluations showed SafeMind delivered a 29% higher detection rate, remediation six times faster, and 99% lower cost on detection and remediation compared to leading frontier models, the company said.
Nvidia Chief Executive Jensen Huang and CrowdStrike Chief Executive George Kurtz announced the system together at CrowdStrike’s Fal.Con 2026 conference in Las Vegas on Tuesday before a crowd of roughly 10,000 security professionals. “The real gap that I saw was that the attackers had frontier AI, and the defenders didn’t,” Kurtz said at the event. “And that changes now.”
As part of the collaboration, Nvidia tested SafeMind inside a digital twin of its own internal technology environment. Justin Boitano, Nvidia’s vice president of enterprise AI, said the red team agent combed through the environment, identified exploitable attack paths, and the blue team agent then applied safeguards — a process repeated until all attack paths were blocked.
Keeping sensitive threat data out of closed third-party systems was a key reason CrowdStrike opted for an open model, according to Bartley Richardson, the company’s chief AI and autonomous systems officer, who made the remarks to the Wall Street Journal.
Advertisement
Advertisement
The launch arrives as AI-enabled attacks have grown sharply. CrowdStrike said AI-enabled attacks rose 89% in the past year and that the fastest recorded criminal breakout time has reached 27 seconds. The announcements came days after CrowdStrike stock and Palo Alto Networks shares climbed to record highs following the Black Hat security conference, where analysts described AI agents as the foremost emerging attack vector and said demand for AI-driven defensive tools was dominating industry conversations.
CoreWeave is providing cloud infrastructure for SafeMind’s training and inference, CrowdStrike said.
