The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents

Summary · 2 min read

Kurtz says he has spent more than 30 years in security. He founded Foundstone and CrowdStrike and is CrowdStrike’s president and CEO.

Kurtz says AI agents are multiplying in enterprise environments and flattening the attacker pyramid, giving low-skill actors capabilities once associated with nation states. He argues that defenders need security-specific AI, tested against their own environments, to keep pace with faster, prompt-driven attacks. He says CrowdStrike is investing in agent visibility, security models and a broader platform, while open-weight and local models can lower costs and give customers more control. He rejects predictions that AI will make the internet unusable and says AI will create new opportunities, including in cybersecurity.

Minute by minute

1. 5:12

   Breakout times have fallen to minutes. Kurtz says North Korean actors are busy stealing information and seeking ransomware payments, and that he has also seen substantial AI activity from China. He says the average breakout time is 29 minutes, with cases as fast as 27 seconds, and that attackers increasingly use prompts to vary their paths.

2. 7:11

   Security enables faster technology adoption. Kurtz says security risks grow alongside technology complexity, especially when companies give agents identities and let them download packages without monitoring their work. He says agents can operate as a black box, but argues that security can now help businesses adopt AI faster rather than simply slow them down.

3. 10:02

   Defenders need frontier-level AI. Discussing the Hugging Face incident, Kurtz says his main takeaway was that defenders lacked the capabilities available to attackers. He says Hugging Face turned to open-weight models after frontier models refused to help, and that CrowdStrike created SafeMind to provide security-focused defensive models.

4. 18:37

   Security models can cost less and use unique data. Kurtz says CrowdStrike’s security models can make remediation much cheaper: he compares about $10 for a high-caliber frontier cyber model with three cents for CrowdStrike’s model. He says the models draw on more than a decade of CrowdStrike security data, and that customers value data protection, trust and control over where their data goes.

5. 22:34

   Enterprises will use more local models. Kurtz expects local models and open-weight models to take on more enterprise work, with frontier models reserved for especially valuable tasks. He says customers find models that lag frontiers by three months adequate for many uses, and argues that distillation is hard to stop and that open-weight alternatives, including U.S. models, will remain important.

6. 28:43

   Kurtz rejects internet shutdown fears. Kurtz calls predictions that critical systems will need to leave the internet unreasonable, while agreeing that organizations should take agent risks seriously. He says agents do not teleport between computers; they perform familiar actions faster, creating more vulnerabilities and faster exploitation that defenders need to address.

7. 37:50

   Large companies need a faster cadence. Kurtz says established companies need smaller teams, shorter development cycles and a willingness to disrupt themselves. He describes CrowdStrike’s long-running security data as an advantage, citing about seven trillion events a day, and says customers want protection, trust, lower cost and easy deployment.

8. 41:51

   AI will create new opportunities. Kurtz believes major technology shifts create more opportunities and jobs, though the work changes. He says people will still need to manage agents and design architectures, and recommends cybersecurity, technology and AI as fields for students because security keeps evolving.

Published Oct 22, 2026.