AI has flattened the attacker pyramid, and defenders trail

1. The flattened pyramid — ▶ 2:45

   Kurtz describes a pyramid of adversaries: hacktivists at the base (least sophisticated, most numerous), e-crime in the middle, nation-states at the top (most sophisticated, fewest). Models without guardrails have absorbed complex techniques and their cost, so a hacktivist today has what a nation-state had a few years ago. He reports more vulnerabilities found and faster, back-to-back attacks. His expectation is that an agent given a task and enough time will keep trying until it gets in, and that attackers will eventually go low and slow, making AI-driven activity harder to spot.

2. Attackers prefer open weights — ▶ 4:51

   Kurtz says much of the offensive activity runs on open-weight models, some ablated or built specifically for cyber or red teaming. Guardrails on the latest frontier models are so strict, in his telling, that even a cybersecurity PowerPoint gets refused. He runs such models on two DGX Sparks at home and says building ransomware kits is trivial. He calls running them on a laptop only one step further, and expects capable Macs to extend this. Frontier models remain useful to attackers for tasks like PowerShell scripts.

3. It's prompts, not malware — ▶ 7:53

   CrowdStrike tracks breakout time: how long an intruder takes to pivot from the first compromised machine toward the crown jewels. It once took days or hours. Kurtz puts the average now at 29 minutes, with the fastest at 27 seconds, which he describes as the speed of inference. Because attackers engineer prompts that steer information gathering and pivots, each intrusion can produce a unique signature. That undermines malware-centric detection. He says the pattern holds across nation-state and e-crime actors, and he named North Korea and China as active users of AI.

4. Hugging Face's defender gap — ▶ 11:44

   Asked about the Hugging Face incident, Kurtz says his main takeaway was not the agentic, sandbox-escaping behavior. It was that defenders lacked offense-grade capability. He says Hugging Face first asked frontier models whether the event was real and was refused, so it had to analyze the data with open-weight models. He acknowledges the experiment ran with guardrails down, which he likens to airbags off. His conclusion is that defenders need frontier-level defensive AI equal to what attackers use, and that conclusion motivated CrowdStrike's own model work.

5. Red-blue digital twin loop — ▶ 14:30

   CrowdStrike's Safe Mind system pairs an offensive model, Red Tempest, with a defensive model, Blue Solano, built partly on Nvidia's Nemotron. Kurtz says Jensen Huang insisted on a digital twin, since other industries use them. CrowdStrike recreates a customer's environment virtually, then loops the models: red keeps attacking until it runs out of turns because blue has worked out what red is doing. Kurtz's logic is that defense usually lags, so continuous red-blue iteration is how defenders keep up. He also says the surrounding harness yields better results at much lower cost on almost any model.

6. Securing agents as identities — ▶ 17:39

   Kurtz treats an AI agent as a kind of superhuman: it has an identity, compute, data access and networking. CrowdStrike's AIDR offering first finds rogue and shadow AI, then instruments an agent from birth, tracing sub-agents, tool calls and MCP server pulls, and applying policy and blocking rules. He cites an estimate, which he thinks is low, of 90 agents per employee, and calls this a far bigger opportunity than endpoint detection and response (EDR). He criticizes agents run unsupervised with a user's own identity, free to download any package, as a black box.

7. Cost, data and sovereignty — ▶ 20:52

   Kurtz gives three reasons a security vendor should train its own models. First, cost: general remediation with a top frontier cyber model costs about $10, he says, versus 3 cents for CrowdStrike's. Second, data: more than a decade of data including managed detection response, threat-vulnerability pairings and attack chains, which he says synthetic data cannot replicate. Third, trust and AI sovereignty: customers do not want sensitive data going to labs or being trained on. He frames Safe Mind as routing across models, including frontier ones. The cost and quality figures are his own and unbenchmarked in the discussion.

8. Open weights are enough — ▶ 24:23

   A New York bank CIO told Kurtz that token costs ran out of control after the bank went all in on AI. Open-weight models, even 3 months behind, are good enough, and only high-value, alpha-generating work will go to frontier models. The bank plans to post-train its own. Kurtz predicts local models within 2 years and compares open-source, open-weight AI to Linux as the internet's operating system. He sees frontier models commoditizing. On distillation he offers no forecast, noting the genie is out of the bottle and frontier labs themselves trained on contested data.

9. More and faster, not new — ▶ 30:37

   Kurtz calls the idea that the internet must be air-gapped nonsense. Agents are a serious risk, but he argues they do what a human attacker would, only better and faster. They cannot simply beam themselves between machines. AI has produced more vulnerabilities and faster exploitation, not a new class of technique, because models were trained on what is already known and have not developed their own yet. The qualifier matters. He also says AI has made security a gas pedal for adoption rather than a brake, as customers ask how to secure AI so they can go faster.

10. Defense-dominant case — ▶ 35:36

    Asked for the best case that defense can dominate, Kurtz points to his book Hacking Exposed, whose premise was that showing how offense works improves defense, now at a far faster tempo. He says defenders need capabilities equal to or better than the offense's. Even a slight edge, he argues mathematically, yields an advantage. The only way to fight AI is with better AI, using what the defender uniquely holds: knowledge of its own systems, architecture diagrams and code. He concedes it remains a cat-and-mouse game. His argument is reasoned rather than backed by results.

11. Secure code won't end breaches — ▶ 37:47

    One host suggests agent-written code could be more secure, since agents have infinite patience and scale with compute. Kurtz sees some benefit, but notes the models trained on flawed code. He describes Claude writing code and then, as a security agent, flagging that same code as insecure. His larger point is that even zero vulnerabilities would not end breaches, because many attackers log in rather than break in, making identity the weak point. He adds that the software base is a long tail: Microsoft's backward compatibility means some issues never get modernized.

The most consequential claim in George Kurtz's account is not that AI makes attacks different in kind. It is that AI has removed the scarcity that once organized the threat landscape. Kurtz describes a pyramid of adversaries: hacktivists at the base, the least sophisticated but most numerous; e-crime in the middle; nation-states at the top, the most capable and the fewest. Models without guardrails, he says, have absorbed complex techniques and their cost, so a hacktivist today has what a nation-state had a few years ago. What he reports seeing is more vulnerabilities found, attacks that arrive in rapid succession, and agents that, given a task and enough time, keep trying until they get in.

Speed is the measurable symptom. CrowdStrike tracks breakout time, the interval between an intruder landing on one machine and pivoting to a more valuable one. That used to be days or hours. Kurtz puts the average now at 29 minutes, with the fastest case at 27 seconds, a pace he ties to the speed of inference. The deeper consequence is for detection. Kurtz's line is that "it's not malware anymore, it's prompts," meaning attackers can engineer prompts that give each intrusion a unique signature in how it gathers information and pivots. He notes a caveat: today AI-driven attacks are recognizable by how fast they iterate, but he expects attackers to slow down, which would make them harder to distinguish.

Where attackers get their tools explains why defenders feel behind. Kurtz says much of the activity runs on open-weight models, some ablated or built for red teaming, which can be run on home hardware without refusals. Meanwhile, the latest frontier models refuse even benign cybersecurity tasks. His reading of the Hugging Face incident follows from this. He says the company asked frontier models whether the event was real, was refused, and had to analyze the data with open-weight models. The lesson he draws is a parity problem. Defenders need frontier-grade defensive AI that does not balk at security work, and the labs' guardrails, whatever their merits, leave that gap open.

CrowdStrike's answer is Safe Mind, a system built around two models, Red Tempest and Blue Solano, trained partly on Nvidia's open Nemotron models. The mechanism is the interesting part. CrowdStrike builds a digital twin of a customer's environment, which Kurtz says Jensen Huang insisted on, and loops the models. Red attacks until it runs out of turns because blue has figured out what red is doing. This turns the defender's one structural advantage, intimate knowledge of its own systems, into a training signal. It also targets the asymmetry the hosts raised: offense is directed at a single goal, while defense must cover a broad surface and diffuse ecosystem.

The case for building rather than simply buying frontier access rests on three arguments. Kurtz says general remediation with a top frontier cyber model costs about $10, against 3 cents for CrowdStrike's. He says no public corpus matches more than a decade of proprietary data, including managed detection response records of threats, vulnerabilities and attack chains. And he argues that customers want AI sovereignty, with sensitive data kept from labs and not used for training. The cost and quality figures are his own, and the conversation offers no benchmarks. The honest reading is that the strategic logic is coherent, while the performance claims remain assertions from an interested party. Kurtz is careful to say the models will not do everything, and that frontier models can be routed in.

The same economics are reshaping enterprise AI more broadly, in Kurtz's telling. A New York bank CIO told him token spending got out of control, that open-weight models even 3 months behind are plenty, and that only high-value work would go to frontier models. One host added that a top financial institution cannot absorb a new model release every 10 days anyway. From this, Kurtz forecasts local models within 2 years and an open-source, open-weight foundation for AI akin to Linux for the internet, with value shifting to the application stack and harnesses. He professes no view on how distillation fights will resolve. He notes that frontier labs trained on contested data themselves, and says the genie is out of the bottle.

On the apocalyptic reading of agentic risk, Kurtz is blunt. He calls the idea of air-gapping critical systems nonsense. Agents do what human attackers do, only better and faster, and AI has produced more vulnerabilities and quicker exploitation rather than a new technique class. That is also where the commercial thesis sits. If adoption is gated by trust, security becomes what enables companies to go faster, hence his phrase that security is now the gas pedal rather than the brake. AIDR extends the logic: agents have identities, compute, data and network access, so each employee running many agents, an estimate Kurtz says is probably low at 90, widens the surface to secure. His case is credible, though it is also his own market.

The argument contains a tension Kurtz only partly resolves. His claim that agents bring nothing new comes with the qualifier that they have not developed their own techniques yet. He also describes agents running under human identities, downloading packages, with nobody watching, which he calls a black box. A host's hope that agent-written code could be more secure meets his anecdote of Claude flagging its own code as insecure, and his point that attackers increasingly log in rather than break in. Even zero vulnerabilities would not end breaches, and the long tail of legacy software, with Microsoft's backward compatibility as the example, ensures slow progress. His defense-dominant scenario is therefore conditional: even a slight advantage, he argues mathematically, is enough, but that is a premise, not a demonstrated result.

The unresolved issue is whether the defender's information advantage survives the trend Kurtz himself predicts. Within 2 years, he expects capable local and open-weight models to be common. That is the force making enterprise defense cheaper, but it also removes the remaining chokepoint on unguarded offensive capability, which the transcript presents as already available on a home workstation. If both sides ride the same curve, the decisive variable may not be raw model quality. It may be which side encodes its knowledge of the environment better, and keeps iterating faster. Kurtz bets that defenders can, and offers CrowdStrike's 7 trillion daily events as part of the reason. Whether that bet holds is the real test.