Nvidia and CrowdStrike Develop New Cybersecurity AI Models

Good morning. Nvidia and CrowdStrike are addressing what they see as one of cybersecurity’s biggest gaps: the need for cyber defenders to harness AI at the velocity of cyber attackers.

In the current cyber landscape, frontier AI models are discovering bugs at machine speed—raising alarm bells among experts, who warn that when autonomous hacking models go rogue or attack companies, chaos is on the horizon.

But cyber defenders aren’t getting enough of that same AI firepower, according to Nvidia and CrowdStrike, who on Tuesday introduced a new family of agentic AI models, dubbed SafeMind, which can both find attack paths and close them for customers. The models are available in CrowdStrike’s flagship Falcon platform and through its API.

“There’s all these offensive capabilities of models and systems. CrowdStrike’s point of view is, we should be giving every defender equal and greater capability of every attacker,” Bartley Richardson, the company’s chief AI and autonomous systems officer, told me.

SafeMind has two models: Red Tempest, which is an “offensive” model that emulates AI adversaries, and Blue Solano, which is a “defensive” model designed to fix identified issues. The two models are connected by software called a harness, which runs the models in a closed-loop system that pits them against each other for self-improvement.

“They co-evolve and learn from each other,” Richardson said.

CrowdStrike developed SafeMind by fine-tuning Nvidia’s open Nemotron models with its own threat intel and other cyber data. Nvidia, in turn, provided feedback on the SafeMind system by testing it inside the company.

“We’re at an inflection point in cybersecurity,” said Nvidia CEO Jensen Huang, who spoke onstage with CrowdStrike Chief Executive George Kurtz at the cyber firm’s conference on Tuesday. “Instead of what everybody talks about, which is using AI to exploit companies, we’re going to use AI to defend companies.”

Cyber defense meets machine speed

For enterprise leaders, the cybersecurity challenge used to be discovering software vulnerabilities before attackers could exploit them. But now, with AI models detecting software weaknesses at unprecedented speed, companies are under immense pressure to fix vulnerabilities before attackers act.

As part of its work with CrowdStrike, Nvidia tested SafeMind inside a “digital twin” of its internal tech environment, said Justin Boitano, the chip giant’s vice president of enterprise AI.

In a simulation, Nvidia used the Red team agent to comb through its environment and identify an attack path it could execute on. Then, the Blue team agent applied safeguards to those attack paths. The same process was repeated six or seven times, Boitano said, until safeguards blocked all the possible attack paths.

CrowdStrike chose to fine-tune Nvidia’s open Nemotron models because it needed the assurance that its proprietary and customer data would remain private, Richardson said.

The cybersecurity company’s data is sensitive from a business standpoint, and because it contains information that adversaries could use to their advantage if exposed, he said. The process of fine-tuning Nvidia’s Nemotron 3 Super model took roughly 45 days from discovery to creation, and about 71 Nvidia B200 graphics processing units, he added.

Other enterprises, including AT&T, have been taking advantage of open-weight and open-source models to not only save on token costs, but also protect their corporate data.

In addition to working with CrowdStrike, Nvidia has led a coalition of tech companies called the Open Secure AI Alliance that aims to create and deploy a suite of open-source AI tools that any company can use to defend against cyberattacks.

Nvidia’s Huang, speaking at Tuesday’s conference, said he believes in both open and closed models, but domains like cybersecurity require the customizability of an open model to make the AI highly specialized.

“We don’t need every AI to be super smart at everything. But in some areas we need to be extraordinarily good at something, and cyber defense is something we want to be incredibly good at,” Huang said.

How is your company responding to the growing threat of AI-fueled cyber threats? Send your feedback to me at belle.lin@wsj.com (if you’re reading this in your inbox, you can just hit reply).

That gap between attacker speed and defender response helping drive the CrowdStrike, Nvidia partnership showed up elsewhere this week, both in a cybersecurity company’s earnings and in OpenAI’s own admission about what its next model can do.

Palo Alto Networks’ latest earnings show customers already voting with their budgets to modernize their cyber defenses to meet the capabilities of ever-more-powerful AI models, the WSJ reports. The cybersecurity company on Tuesday said it is expecting revenue to rise between 23% and 24% to a range of $14.1 billion to $14.2 billion in fiscal 2027, outpacing analyst expectations of $13.84 billion polled by FactSet.

Palo Alto on Tuesday also said it had acquired Console, a platform for overseeing agentic AI operations.On the potential threat side, OpenAI in a blog post Tuesday said it added additional security layers to its upcoming Astra model after finding it capable of devising and carrying out novel cyberattacks against difficult targets with minimal human guidance, the WSJ reports.

OpenAI also said it would limit the advanced cybersecurity capabilities of the version it releases publicly, giving the full-power version to a small set of testers.

The WSJ Tech Council brings together CIOs, CTOs and CISOs advancing innovation and shaping the future. Join this trusted community where tech executives connect with peers to explore emerging trends and gain the perspective they need to stay ahead of disruption.

Request an Invitation

Follow Isabelle Bousquette on LinkedIn, Instagram, X, and TikTok for more behind the scenes on her tech and AI coverage, and lately, her contributions to the WSJ Leadership Institute’s new Executive Resilience series, where she’s profiling America’s top execs about their fitness and wellness habits.

Follow Belle Lin on LinkedIn and X for her latest reporting on enterprise technology and AI.

Steven Rosenbush is chief of the enterprise technology bureau at the WSJ Leadership Institute. He also has a column. You can follow him on LinkedIn.

Tom Loftus is the editor of The Morning Download. He suggests following Isabelle, Belle and Steve on their various social channels. But if you insist, here’s his LinkedIn.