CrowdStrike SafeMind Overview

This video was created and contributed by, CrowdStrike. 

Overview

CrowdStrike SafeMind is described as cybersecurity's first agentic system, an autonomous platform built to move security from surfacing findings to taking defensive action. It is a set of purpose-built harnesses and models that CrowdStrike says exceed frontier-level capability for security use cases. SafeMind runs the full prevention, detection and response lifecycle at machine speed. It is powered by two new classes of models. Red Tempest is the offensive model, and Blue Solano is the defender. In the demo, an analyst activates SafeMind as a skill in an AI tool and loads enterprise data, such as asset inventories, identity stores, adversary intelligence, threat graphs and Falcon telemetry. Both models build and deploy a clone of the enterprise that matches its hosts, topology, operating systems and applications. Red Tempest is then unleashed against it and autonomously finds a path to data exfiltration. Blue Solano captures those traces, identifies the gaps, validates new detections and deploys them right away. Red Tempest is stopped and forced to find a new path, and the loop repeats until no path is left. Detection coverage grows, and the cost to a real adversary rises sharply. You can use the two models independently or together, so your defense stays aware of the best offense.

Key points

• Purpose-built AI models: Two new classes of models: Red Tempest for offense and risk identification, and Blue Solano for defense.
• Autonomous defense loop: Red Tempest attacks, Blue Solano learns, writes and deploys new detections, and the cycle repeats until no attack path remains.
• Tested against a clone of your enterprise: Builds a replica of your hosts, topology, operating systems and applications from your own data, including Falcon telemetry, identity stores, asset inventories and adversary intelligence.
• Action, not just findings: Goes beyond surfacing issues to taking autonomous defensive action across prevention, detection and response, at machine speed.
• Flexible use: Use Red Tempest and Blue Solano independently or combined, and activate SafeMind as a skill in an AI tool.
• Rising adversary cost: Detection coverage grows with each cycle, which raises the cost of attacking you.