CrowdStrike introduces SafeMind, a new AI-driven cybersecurity system, enhancing threat detection and response capabilities with Nvidia.
CrowdStrike has introduced a new cybersecurity system named SafeMind, created in collaboration with Nvidia. This innovative system merges offensive and defensive artificial intelligence models, allowing for a dynamic feedback loop where one model probes for vulnerabilities while the other establishes and refines detection protocols.
The unveiling occurred on September 1 during the Fal.Con 2026 conference in Las Vegas, with SafeMind being integrated directly into the CrowdStrike Falcon platform.
The initial release includes two specialized models:
- Red Tempest, which imitates attacker behavior to pinpoint potential vulnerabilities;
- Blue Solano, which processes data to create and evaluate detection rules.
These components are supported by agent wrappers—software frameworks that equip the AI with the necessary context, tools, and protocols for executing complex tasks.
Nvidia explained the system's operation as a continuous interaction between red and blue teams, where Red Tempest simulates attacks within a controlled setting. The Falcon platform collects telemetry data, and the defensive components identify weaknesses and devise new detection strategies, which are then tested in successive iterations.
The defensive aspect of SafeMind leverages Nvidia's Nemotron open-weight models, which have been further adjusted using CrowdStrike's proprietary datasets.
Nemotron 3 Ultra coordinates the defensive operations, reconstructing attacks and strategizing responses. Meanwhile, Nemotron 3 Super specializes in developing and optimizing detection rules, enhanced through additional cybersecurity training that included supervised fine-tuning and reinforcement learning based on over 9,000 examples.
The data utilized for SafeMind encompasses Falcon telemetry, proprietary threat intelligence, and extensive incident response documentation collected over 15 years. According to Nvidia, the use of open-weight models allows organizations to train these systems on their own data while keeping that information secure from external providers.
CoreWeave cloud infrastructure also supports the training and operational processes of SafeMind.
Performance Metrics
Internal evaluations demonstrated that SafeMind outperformed traditional models with a 29% increase in threat detection rates, a six-fold decrease in issue resolution time, and a 99% reduction in costs linked to detection and remediation.
Nvidia provided additional data from a controlled environment test, which indicated that after integrating the specialized wrapper with Nemotron 3 Super, the detection capability improved from 16.5% to 41.9% for identifying attacks.
In live testing, five out of eleven detection rules from the open framework successfully identified attacks, resulting in a 45% success rate compared to 29% for a leading advanced system.
Follow-up analysis awarded three of the open framework’s detection rules a top gold rating for covering all eight attacks executed, while the comparative system failed to produce any equivalent rules. However, it was noted that this evaluation was limited to a narrow range of scenarios.
New Initiatives
Additionally, CrowdStrike has launched a Cyber Superintelligence Lab to combine expertise in AI, offensive security, and incident response, headed by Bartley Richardson, the company’s Chief AI and Autonomous Systems Officer. Nvidia is collaborating with this lab and plans to invest $100 million over the next five years to bolster AI development.
CrowdStrike also rolled out Falcon IQ, a tool aimed at automating tasks related to risk assessment and remediation across more than 50 agents, and expanded Falcon Guardian to improve AI agent protection on endpoints.
In August, it was reported that CrowdStrike, alongside OpenAI and 127 other organizations, signed an open letter highlighting the urgent need for enhancements in cybersecurity amid increasing threats from AI-driven attacks.
