The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents

George Kurtz (0:00)

For the first time, security is the gas pedal, not the brake.

Sarah Guo (0:03)

How would you describe what you're seeing AI doing for adversaries?

George Kurtz (0:07)

The new apex predator is the agency. The same level of capability that a nation state would have just a few years ago, essentially a hacktivist would have today. That has dramatically changed the overall threat environment. What people have to keep in mind is it's not malware anymore, it's prompts. They can basically engineer prompts that would create a totally unique signature of what direction they're going to go in, how they gather information, where they pivot. Everyone's coming to CrowdStrike and others going, well, how do you make AI secure so we can go faster in AI? The only way to fight AI today is with better AI. The defender knows their own systems. The defender has the architectural diagram. The defender has the code. How do you put all of that into something that you can dramatically increase your probability of outsmarting the offensive AI?

Sarah Guo (0:59)

Hi, listeners. Welcome back to No Priors. Today, Elad and I are here with George Kurtz.

George is the world's first call when there's an incident, a legendary cyber defender, the founder and CEO of Foundstone and then CrowdStrike. We talk about what's happening in cybersecurity, fighting AI with AI, their internal research effort, SafeMind, and whether the odds are good for the Internet in the next era. Welcome back. George, thanks so much for doing this.

George Kurtz (1:23)

It's a pleasure to be here.

Sarah Guo (1:24)

So it is a sea change period in technology and agents are taking over the enterprise. CrowdStrike is on the forefront of that.

What can you tell us about what you're seeing in the wild right now? I think you have said that there are two, three magnitudes, more agents out there taking action in people's estates than they're aware of.

George Kurtz (1:51)

It's been incredible in the enterprise what we've seen. If you follow the trajectory of the frontier labs, and you just look at their own revenue, you can see just how many more agents are out there, whether it's Cloud Code or Codex, they're popping up all over the environment. Obviously, there's many other type of agents that are out there. But again, just using that as a proxy.

What we've seen is that they're popping up everywhere, and part of the problem in these enterprises is they have no idea where they're popping up. Shadow AI has become a huge issue for many companies. I know we're going to talk about what the agents are doing and all the bad sort of things that are happening. But just in general, having organizations understand where their AI is taking place and who's doing what, and more importantly, what identity are they actually operating under has been a big challenge in the industry, and a big focus for us at CrowdStrike in trying to crack the code for our customers.

Sarah Guo (2:45)

How would you describe what you're seeing AI doing for adversaries? You've described it as flattening the adversary pyramid before.

George Kurtz (2:54)

When I think about the adversaries, I call it the pyramid of pain. So if you just imagine the bottom part of the pyramid, the base of the pyramid is really what we call the hacktivist. So you've got the least level of sophistication, but the greatest number of adversaries. Then in the middle band of the pyramid, you've got e-crime, more sophisticated, and a few less than all the hacktivists. Then at the top of the pyramid, you've got nation-state actors. So the most sophisticated, but the least number relatively speaking. Well, that has been totally just blown up because really now, what we're seeing is the new apex predator is the agent state, not the nation state, it's the agent state. What the agent state has done, if we think about the models that are out there, that are ablated so there's no real guard rails, it's essentially taken all of these very complex topics and techniques and cost and now flatten the entire pyramid. So the same level of capability that a nation state would have just a few years ago, essentially a hacktivist would have today.

That has dramatically changed the overall threat environment. So what are we seeing? We're seeing more vulnerabilities found, and we're seeing faster attacks.

When the attacks come, it's just one after another. You can see it.

Right now, it's pretty clear whether it's an AI attack, because you can see how fast they're actually iterating. But at some point, they're going to introduce that being low and slow, and it's going to be more difficult to figure out what's AI and what isn't. But that's what we're seeing, and I think that's one of the real challenges that organizations are facing is just the barrage of attacks, and the level of sophistication has dramatically increased, and ultimately, if you give an agent a task with enough time, and the agent either needs to get in or dies, it's going to try to figure out a way to get in, and a lot of times, it's going to have success.