The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents

Summary

• AI is flattening the attacker hierarchy while compressing the window for defense. Kurtz’s “agent state” gives hacktivists capabilities nation-states had a few years ago, with open-weight models enabling unrestricted iteration. He cites an average of 29 minutes to move beyond an initially compromised system and a fastest observed 27 seconds. Rapid repetition can make AI attacks recognizable for now; he expects “low and slow” behavior to make them harder to identify.
• Agent security could become a larger opportunity for CrowdStrike than endpoint protection. Kurtz cites a statistic of 90 agents per employee, which he thinks is too low, and describes tracing identities, subagents, tool calls and data access before enforcing controls. Customers want protection so they can deploy AI faster: “safety is the gas pedal, not the brake.”
• CrowdStrike’s model strategy rests on specialized data, cheaper execution and customer control. Kurtz’s cost example is probably about $10 with a leading cybersecurity frontier model versus about 3 cents with CrowdStrike’s. He points to over a decade of security data and customers’ reluctance to send sensitive information to labs: “There is no CrowdStrike security data on Reddit.”
• Open-weight models are becoming sufficient for routine enterprise workloads in Kurtz’s customer conversations. One bank reserves frontier models for “Formula 1” work that generates alpha, while accepting open models three months behind for ordinary tasks after token bills escalated. Kurtz thinks the eventual AI operating system will probably be open source, but declines to predict distillation’s position two years out.
• Kurtz thinks defense might gain an advantage and rejects predictions that AI will force the internet offline. Defenders know their systems, code and architecture, but must receive AI capabilities at least equal to attackers’. Better code helps without eliminating identity attacks: “A lot of what we’re seeing today isn’t necessarily hacking; people are logging into the system.”
• CrowdStrike’s incumbent advantage depends on pairing fresh telemetry with startup operating speed. Kurtz cites approximately 7 trillion events generated daily, but says large teams and year-long schedules cannot keep up. His prescription is small squads, direct leadership involvement and a willingness to “disrupt yourself internally.”

Deep dive

1. The “agent state” collapses the attacker hierarchy

• The opening problem is visibility: enterprises do not know where agents are appearing or whose identity they use. Sarah’s opening question invokes Kurtz’s estimate that there are two to three times more agents acting on people’s behalf than they realize; Kurtz describes “Shadow AI” spreading through Claude Code, Codex and other deployments. Discovery and identity attribution precede meaningful control.
• Kurtz’s old “pyramid of pain” put numerous, relatively unsophisticated hacktivists below cybercriminals and a small nation-state elite. AI flattens it: “the new apex predator is the agent state.” A hacktivist can now have capabilities a nation-state had a few years ago. He cites Chinese AI activity and North Korea’s drive to bring in money.
• He sees much of the offensive work on open-weight models, including GLM and Qwen, with guardrails removed or cybersecurity-specific training. His home example is two DGX Sparks running models capable of generating ransomware and iterating attacks. Frontier-model restrictions are much tighter; he says even cybersecurity presentation requests can be refused.
• The operational clock has changed: moving from an initially compromised machine to another system once took days or hours. Kurtz gives an average of 29 minutes and a fastest observed 27 seconds. Rapid iteration currently helps identify AI attacks; he expects “low and slow” behavior to make identification harder. These attacks can produce unique paths and signatures as they gather information and choose their next steps.

2. Security becomes the accelerator, but defenders need equal tools

• For Kurtz, “security follows the slope of the technology curve”: attackers exploit seams around new technology before protection catches up. Enterprises once reviewed downloaded software; now they give agents broad identities, let them fetch npm packages and may leave them running for days. His business consequence is the reversal: “For the first time, safety is the gas pedal, not the brake.”
• The sandbox-escape experiment discussed in the conversation matters to him because “the defenders did not have the same opportunities as the offense.” Attacking agents operated with their guardrails down, while defenders asking frontier models to investigate were refused and had to use open-weight models. His demand is capability parity: defensive AI must be as good as, or better than, offensive AI.
• Elad Gil frames the asymmetry: attackers can pursue a specific directive, while defenders must cover a broad surface and distribute capabilities across many enterprises. Kurtz’s answer is a dedicated security-model lab and a continuous red-versus-blue feedback loop, built around knowledge of each customer’s environment.

3. Agent protection expands the product; specialization changes the economics

• CrowdStrike’s AIDR extends the endpoint detection and response idea to agents with identities, compute, data access and networking. Kurtz says it can trace an agent from creation through subagents, tool calls, MCP servers and data retrieval, then apply policies and blocking. He cites 90 agents per employee—a figure he thinks is too low—and sees a potentially bigger opportunity than EDR.
• The SafeMind system pairs Red Tempest and Blue Solano, with NVIDIA collaboration and Nemotron among the blue-side foundations. Jensen urged a security digital twin; CrowdStrike recreates a customer’s environment virtually, then loops the red and blue models until Blue learns to counter Red’s approach. The harness matters across models: Kurtz says it improves results while lowering cost, including with off-the-shelf open models.
• Asked why frontier labs and verified-defender programs are insufficient, Kurtz cites economics and data. His example would “probably” cost about $10 using a top cybersecurity frontier model, versus about 3 cents using his model. Post-training draws on over a decade of security data, especially managed detection and response, with attack chains and threat/vulnerability pairs. “There is no CrowdStrike security data on Reddit.”
• Customer sovereignty is the other argument: some customers do not want confidential security information sent to labs or used for training. CrowdStrike already holds that data and offers a choice of frontier or its own models. Asked whether CrowdStrike could serve as a neutral third party examining models, Kurtz emphasizes trust, reliable partnership and the company’s focus on security.

4. Open weights look sufficient for routine workloads; frontier models earn premium use

• An IT director at a large bank captures Kurtz’s demand-side view: going all-in on AI produced uncontrolled token bills. Open models “even if they’re 3 months behind” were sufficient for many tasks. The bank would pay for frontier performance for “Formula 1” work that generates alpha, while building and post-training open-weight models for the rest. Kurtz says he hears this repeatedly.
• Kurtz also recounts a top-five CFO relaying a large technology buyer’s view: “There’s no way their organization can afford to release a new model every 10 days.” A three-month capability lag can already outrun a regulated organization’s adoption pace. Kurtz thinks the eventual AI operating system will probably, in his opinion, be open source, while leaving room for profitable frontier models and application layers.
• Elad Gil asks whether open-model progress depends on Chinese developers distilling frontier labs, which are tightening defenses. Kurtz says the genie is difficult to put back in the bottle, credits genuine innovation under chip constraints, and declines a two-year prediction: “I wish I had a crystal ball on this. I don’t know.” He also says strong American open-weight alternatives are important.
• His adjacent opportunities are specialized chips and smaller models running on desktops and phones. He does not know the trajectory but guarantees things will become “faster and cheaper.” Lower power consumption and hybrid local/frontier execution could expand edge AI; he expects today’s underused TPU/NPU capacity to be put to work.

5. The internet survives, but better code cannot eliminate breaches

• Asked whether critical systems must disconnect because AI will break the internet, Kurtz responds, “I mean, this is nonsense.” The risks are serious, but agents execute recognizable attack actions faster and can chain vulnerabilities. “The agent doesn’t just broadcast itself from your computer to another.” His argument is that defensive technology can evolve to counter the increased speed and volume.
• A defense-dominated decade “might” be possible if the industry invests properly. Kurtz points to defenders’ knowledge of their own systems, architecture and code, combined with rapid learning from attacks. “The only way to fight AI today is to use better AI.” He still expects a cat-and-mouse game.
• Elad Gil offers a structural hope: agent-written software might improve security architecture because computation scales and agents have infinite patience. Kurtz sees benefits but cautions that training data contains flawed code. In his own experience, Claude generates code and his security agent flags it as unsafe; he asks, “Why didn’t you do it right the first time?”
• Even zero vulnerabilities would not end breaches, he says: “A lot of what we’re seeing today isn’t necessarily hacking; people are logging into the system.” Identity remains a separate failure mode. Replacing insecure code also has a long tail; Microsoft’s backward-compatibility obligations illustrate why the existing software base cannot simply be repaired overnight.

6. CrowdStrike’s data moat needs a faster operating rhythm

• Large teams and year-long waterfall schedules cannot match AI-native startups, Kurtz argues. CrowdStrike used Falcon Guardian as an example of moving differently, with Kurtz involved in development meetings three days a week. The lesson for established CEOs is operational: change team size, cadence and personal involvement. “You have to disrupt yourself internally.”
• CrowdStrike’s sensors generate approximately 7 trillion events every day. Kurtz says this continuously renewed stream gives the company an advantage because data is the lifeblood of AI. The customer test remains protection, a trusted supplier, competitive economics and easy deployment, without “seven consoles and six people running around.”
• On jobs, Kurtz firmly expects AI to create more opportunities, while changing the work. People will still manage agents and design architectures. Cybersecurity remains attractive because “This isn’t really a solvable problem”: the job is reducing risk as technology evolves. He expects technologies not yet imagined today to emerge in five years.