The Agent State: How AI Flattened the Adversary Pyramid and Why Defenders Need Their Own Frontier Models

Kurtz says agents are popping up across enterprises, and the revenue trajectories of the frontier labs are a proxy for how many. Tools like Claude Code and Codex appear all over corporate environments, and organizations often have no idea where. Shadow AI has become a major issue, and knowing which identity each agent operates under is a big challenge that CrowdStrike is focusing on.

For attackers, he uses a pyramid: hacktivists at the wide base with the least sophistication, e-crime in the middle, and nation-states at the narrow top. Models with no real guardrails have collapsed that structure. The new apex predator, he says, is the "agent state" rather than the nation-state, and a hacktivist today has capability a nation-state would have needed years ago.

The result is more vulnerabilities found and faster, relentless attacks. For now, Kurtz says it is fairly clear when an attack is AI-driven because of how quickly it iterates, but attackers will eventually go low and slow. An agent given a task and enough time will keep trying to get in, he notes, and often succeeds.

Asked whether attacks use open or closed models, Kurtz says a lot of activity relies on open-weight models. Frontier models are so guarded that, in his words, you can barely create a PowerPoint about cybersecurity without being refused. Models such as GLM and Qwen are effective for security tasks, and many are ablated or built specifically for cyber or red teaming.

He says he runs these models at home on two DGX Spark machines and that building ransomware kits is no obstacle, which is one step from a laptop. Frontier models are mostly useful to attackers for tasks like writing PowerShell scripts. On geography, he says he frames threats by adversary type, noting North Korea is very active in ransomware to bring money into its economy and that China shows a lot of AI-assisted activity.

CrowdStrike tracks breakout time, the interval between landing on one system and pivoting to others. It used to be days and then hours; the average is now 29 minutes and the fastest observed is 27 seconds. Kurtz says attackers now work at the speed of inference, and since it is prompts rather than malware, each campaign can have a unique signature in how it gathers information and pivots.

Kurtz, who has worked in security for over 30 years, says security parallels the slope of the technology curve and that today's environment is more complex than the era of Cisco routers and early toolkits. Adversaries find the gaps and seams in new technologies, such as unvetted NPM packages. Companies that once vetted everything now unleash an agent under their own identity and tell it to download whatever it wants, often with nobody watching and little explainability.

Despite those risks, he calls it a great time to be in technology and says that for the first time, security is the gas pedal and not the brake. Asked what he took from the Hugging Face incident, he points to the fact that it was an agentic end-to-end attack, run in an experiment with the guardrails down, in which agents found a way out of the sandbox. His main lesson, though, is that the defenders lacked the capabilities the offense had.

He explains that Hugging Face first asked frontier models whether the event was real and was refused. They had to turn to open-weight models to sift through the data. This is why Kurtz wants defenders to have frontier-caliber defensive AI without constant refusals, and why CrowdStrike built its own red and blue models.

The hosts note that offense tends to lead after each technology shift because it is directed while defense must cover a broad surface. Kurtz says CrowdStrike built a frontier-type lab focused on security models, which it calls SafeMind as a system, with two models: Red Tempest and Blue Solano. It worked extensively with Nvidia over about six months, using Nemotron as one of the main models on the blue side.

Kurtz says Nvidia CEO Jensen Huang insisted that security needs a digital twin, as other industries have. CrowdStrike recreates a customer's known environment in a virtual world and loops the models: red keeps trying to get in until it runs out of turns because blue has worked out what red was doing. He sees this continuous iteration as the way to keep up with threats.

He also describes how far the company has expanded beyond endpoint protection, to 33 modules covering cloud, IT and identity. A focus is AIDR, which finds rogue and shadow AI and instruments an agent's whole chain of events, including sub-agents, tool calls and MCP servers, so policies and blocking rules can apply. He says an employee might have around 90 agents, a bigger opportunity than endpoint detection and response alone.

CrowdStrike starts from existing models in the Nemotron class, helps fine-tune them, and post-trains them on over a decade of its security data. Kurtz says the harness makes a huge difference: nearly any model, frontier or off-the-shelf open weight, gets better results at much lower cost when paired with it.

Asked why not rely on the labs' vetted-defender programs, Kurtz first praises the labs and says customers can use their models through SafeMind. But he says his models are far cheaper: general remediation costs about $10 with the highest-caliber frontier cyber model and about 3 cents with CrowdStrike's. There is also no Reddit of security data, he argues, and synthetic data is not the same as the attack chains and threat pairings from its managed detection and response service.

The second argument is trust. Customers do not want sensitive data going out to labs or being trained on, and AI sovereignty matters to many of them, so CrowdStrike offers choice and routing between models. Kurtz says trust is built in drips and lost in buckets, and that being focused solely on security is an advantage.

Kurtz predicts that within two years local models will run on people's computers, probably with last-mile routing to frontier models, and that open-weight use will grow. He says CIOs tell him their AI costs got out of control and token-maxing stopped when bills arrived. A big New York bank told him open-weight models, even three months behind, are plenty, and that only high-value, "Formula 1" work will go to the frontier.

On distillation, he asks what the frontier models distilled when they gathered their own data, noting the lawsuits. He believes labs will try to prevent it but that the genie is out of the bottle, while giving credit to resourceful non-US labs working with fewer chips. One host adds that a large financial buyer told him it could not absorb a new model every 10 days anyway.

Kurtz stresses that strong US open-weight models matter, which is partly why CrowdStrike chose Nemotron, which is open source as well as open weight. He compares AI's future to Linux, the operating system of the internet, and expects an open-weight operating system of AI, though frontier labs and the application and harness layers will still make money. He sees frontier models being commoditized by cost.

Asked about people who say critical systems should be air-gapped because the internet will fall apart, Kurtz calls it nonsense. Agent risks are serious, he says, but an agent does not beam itself from one computer to another; it does what a human would do, better and faster. AI has created more vulnerabilities and faster exploitation, but there is no new class of technique, since models are trained on what we already know.

He sees doomerism as unwarranted and argues security has become an enabler as customers ask how to make AI secure so they can go faster. In his view, the case for defense dominance rests on understanding what the offense is doing and keeping pace, much like the Hacking Exposed book he co-authored. "The only way to fight AI today is with better AI," he says, because defenders know their own systems, architecture and code.

A host suggests agent-written code could enforce better security architecture. Kurtz agrees code is probably good enough for some benefit, but notes that code was trained on imperfect examples and that even with zero vulnerabilities there would be breaches, since attackers are logging in rather than breaking in. He notes the long tail of legacy software, using Microsoft's backward compatibility as an example, which means fixes will take a long time.

Asked how large incumbents can stay agile, Kurtz says a company must recognize that the operating model and cadence have changed. AI-native startups have a handful of people with agents running all day, so waterfall-style development in which products emerge a year later will not survive. He says CrowdStrike uses smaller squads, as with its Falcon Guardian product, where he was personally involved with meetings three days a week.

He also says companies should ask what their moats are. CrowdStrike is a security system of record and a net data creator, generating around 7 trillion events a day, and data is the lifeblood of any AI system. The company disrupted incumbents like Symantec and McAfee and tries to disrupt itself, with a focus on protection, trust, economics and ease of deployment.

On jobs, Kurtz says the feared losses have not materialized so far and that each major technology shift of the last couple of centuries created more opportunity and more jobs. People will still be needed to manage agents and design architectures, he says. He recommends cybersecurity to students as an ever-changing field that is not solvable, only manageable, and one where understanding AI is a big advantage.