CrowdStrike Introduces SafeMind AI System for Adversarial Testing and Detection Generation
Summary
CrowdStrike introduced SafeMind, a system that pits offensive and defensive AI agents against each other to generate and validate security detections. Its initial offering is the FAIRR service, powered by the Red Tempest offensive agent.
Key points
- SafeMind combines an offensive agent, Red Tempest, and a defensive agent, Blue Solano, in a simulated enterprise environment for continuous adversarial testing.
- Red Tempest runs attack scenarios spanning network discovery, exploitation, privilege escalation, lateral movement, and persistence.
- Blue Solano uses attack traces and Falcon sensor telemetry to generate detection logic, then tests it against attacks and clean baseline data.
- CrowdStrike says Blue Solano improves detection accuracy by 70% over general-purpose harnesses and can produce a validated detection in under six minutes.
- CrowdStrike says the system's initial offering is the Frontier AI Readiness and Resilience (FAIRR) service, using Red Tempest for code review of custom applications and dependencies.
- The company says Blue Solano and Red Tempest will also underpin future product offerings and enhancements to existing services.
Article Details
- Event Type
- CrowdStrike announced SafeMind, an AI-powered security system that uses adversarial co-evolution between offensive and defensive agents.
- Impact
- CrowdStrike says SafeMind improved detection accuracy by 70%, reduced detection-generation costs from about $10 to $0.03, and generated validated detections in under six minutes in its internal benchmarks. The initial offering is the Frontier AI Readiness and Resilience (FAIRR) Service, powered by Red Tempest. These are company-reported results.
Vendors
Products
Blue SolanoSafeMind is built on three components: a high-fidelity Cyber Agent Environment that hosts an offensive agent (Red Tempest) and a defensive agent (Blue Solano) locked in continuous adversarial competition.CrowdStrike FalconThe system anchors on ingesting network maps and telemetry from the CrowdStrike Falcon® platform to produce a high-fidelity slice of a real environment.Frontier AI Readiness and Resilience (FAIRR) ServiceThe initial offering for CrowdStrike SafeMind is the Frontier AI Readiness and Resilience (FAIRR) Service, powered by Red Tempest.NVIDIA Nemotron Super 120BThe detection generation model is a post-trained NVIDIA Nemotron Super 120B mixture-of-experts model with 12 billion active parameters.NVIDIA Nemotron UltraIt operates as a custom agentic harness built around NVIDIA Nemotron Ultra as the reasoning orchestrator and a purpose-built detection generation model, post-trained on CrowdStrike's own detection engineering data.Red TempestSafeMind is built on three components: a high-fidelity Cyber Agent Environment that hosts an offensive agent (Red Tempest) and a defensive agent (Blue Solano) locked in continuous adversarial competition.SafeMindSafeMind is CrowdStrike's answer to that gap.