CrowdStrike unveiled SafeMind at its annual Fal.Con 2026 conference in Las Vegas, introducing what it calls the first purpose-built agentic AI models for cybersecurity that operate in both offensive and defensive modes simultaneously.
SafeMind pairs two models built on Nvidia's Nemotron foundation: Red Tempest, an offensive "attacker" model trained on 15 years of CrowdStrike's incident-response data, and Blue Solano, a defensive "defender" model that autonomously patches discovered vulnerabilities. The two models run in a closed loop against a digital twin of the customer's actual environment, built on Nvidia's infrastructure, continuously probing and defending without human intervention.
The system was developed through CrowdStrike's new Cyber Superintelligence Lab, a dedicated research unit focused on building frontier AI for security operations. The models are integrated into CrowdStrike's Falcon platform and will also be available through a standalone offering called Project QuiltWorks.
The launch represents a significant escalation in the AI arms race within cybersecurity. By combining offensive and defensive capabilities in a single system, CrowdStrike is betting that autonomous AI agents can identify and remediate threats faster than human security teams working with traditional tools. The closed-loop approach means the models continuously learn from each engagement, improving their effectiveness over time.
CrowdStrike also announced Falcon Guardian at the same event — a product that inventories known and shadow AI agents running on Windows and macOS endpoints, reflecting growing enterprise concern about unsanctioned AI tools operating inside corporate networks.
