Real Alpha
Watch modeSubscribed

No Priors · 2 min · Oct 22, 2026

Breakout time has fallen to 29 minutes on average

George Kurtz

President & CEO, CrowdStrike

Co-founded CrowdStrike in 2011 and leads it as president and CEO, after founding Foundstone.

  • Sarah GuoHost · Founder, Conviction

    Ex-Greylock partner; early investor in Cognition, Harvey and Mistral.

  • Elad GilHost · CEO, Gil & Co

    Investor in Airbnb, Stripe, Coinbase and Anthropic; co-founded Color.

About this segment

Kurtz says attackers now move from an initial machine to another system in 29 minutes on average, with one breakout taking 27 seconds. Prompt-driven activity also changes how defenders spot attacks.

From “The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents”, Oct 22, 2026. Watch the full episode

“On average, it's 29 minutes, but we've seen it as quick as 27 seconds.”
George Kurtzat 6:34 · No Priors6:34

Takeaways

  1. Breakout time has dropped from days or hours to minutes.
  2. CrowdStrike has seen a breakout in 27 seconds.
  3. Attackers use prompts to vary how they gather information and pivot.
Watch 2:29 from 5:12

In this episode

Full episode
  1. 18:28Security models win on cost, data and customer trust3:28
  2. 28:43AI attacks raise the pace, not create a new attack class2:51
  3. 38:25Large companies need startup-speed teams and clear moats3:31
  4. 22:34Enterprises may reserve frontier models for their hardest tasks6:31

  5. 5:12Breakout time has fallen to 29 minutes on average2:29

Up next · TBPNOpen-source models trail closed ones by about six months4:41

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

  1. 5:24

    And is there a common geography, like are mostly attacks coming from a single region? Is there a common attack type? Is it mainly ransomware? Is it something else? Is it phishing campaigns? I'm a little bit curious, like has the mix shifted as you've kind of seen the adoption of AI tools? We sort of look at it, maybe just reframe the question a little bit. because we look at it from an adversary perspective.

  2. 5:44

    You know, is it a nation state? Is it e-crime? Nation state, we sort of, you know, we've come up with these names of bears and pandas, depending if they're Russia or, you know, it could be from Iran, kittens and other things. So, but we've seen a lot of attacks. We see North Korea being very busy with these sort of attacks. They've got to, shall we say, get money into their economy. So they've been very busy on, you know, stealing information, a lot of it around ransomware and getting paid.

  3. 6:13

    But yeah, I think overall what we've seen is a lot of, we've seen obviously out of China. lot of activity using AI. And we've also seen it in the e-crime world where when someone gets onto a system, we track breakout time. That is, if they got onto your system, how long would it take them to actually break out and pivot and move to a different system? Generally, the system they first land on is not the most interesting. It could be, but it's not the most interesting. The crown jewels might be somewhere else. So that used to be days and hours, and now it's minutes. On average, it's 29 minutes, but we've seen it as quick as 27 seconds. And essentially, you know, now what we're looking at is the speed of inference. So as soon as they get on the machine, you can just see it iterating very quickly. And what people have to keep in mind is it's not malware anymore,

  4. 7:03

    it's prompts. So they can basically engineer prompts that would uniquely create a totally unique signature of what direction they're going to go in, how they gather information, where they pivot, which makes it, you know, more challenging to figure all that out. But that's what we're seeing right now. And it's across the board from the nation state and e-crime actors, for sure. You have been a leader in security since, you know, Foundstone, CrowdStrike, the founding of