CrowdStrike Introduces SafeMind, an Agentic Cyber Defense System with NVIDIA

CrowdStrike SafeMind is a new group of security models and agentic “harnesses” that the company introduced on September 1 at the Fal.Con 2026 conference in Las Vegas. The system is intended to operate natively within the Falcon platform and connect attack simulation with the creation, testing, and adjustment of security detections.

CrowdStrike is developing the system in cooperation with NVIDIA. The models are expected to be based on NVIDIA Nemotron open models, while CoreWeave is to provide training and inference. The announcement represents a product step in AI tools for security operations teams, but the company has not yet provided a general availability date, the scope of customer access, or licensing and pricing terms.

CrowdStrike SafeMind Connects Offensive and Defensive Models

SafeMind includes two named models. Red Tempest is intended to simulate offensive scenarios—that is, to look for possible attack paths. Blue Solano is a defensive model for tasks on the security team’s side. CrowdStrike describes the intended process as a closed loop: a simulated attacker examines the environment, and a defensive agent then creates, tests, and adjusts detections.

According to NVIDIA, the offensive-defensive cycle was tested in an isolated environment modeled on NVIDIA’s infrastructure. It therefore was not a customer production network. The testing process included validating generated detections through telemetry, replaying captured attacks, and independent evaluation.

This process is particularly important because an automatically generated detection must respond to relevant behavior without producing an excessive number of false positives. However, the announcement does not provide the complete technical evaluation methodology or details about the specific scenarios used in the test environment.

Declared Results So Far Come from Company Evaluations

CrowdStrike reports a 29 percent improvement in the detection rate, six times faster remediation, and 99% lower costs compared with selected models. However, these are results from company evaluations. The announcement does not fully disclose the models used for comparison, the methodology, or independent reproduction of these results.

CrowdStrike calls SafeMind the first agentic system for defenders. This, too, is a marketing comparison that has not been independently verified. The available materials also do not indicate that the system has already prevented a specific real-world attack or been deployed at scale in production environments.

What Will Matter When Deployed in Falcon

For customers, it will be important to see how CrowdStrike SafeMind will be made available directly in Falcon and whether the individual models will be accessible through Project QuiltWorks. The rules for approving automated actions, output auditability, handling sensitive telemetry, and protection against misuse of the model intended for attack simulation will also be important.

Other points to watch include independent benchmarks and a more complete description of the technical methodology. Initial customer references or production deployment data will also be relevant. For now, what has mainly been confirmed is the system’s introduction, its partnership with NVIDIA, and testing in an isolated, modeled environment.

Verified and updated: 09/02/2026 06:59