CrowdStrike 在 Fal.Con 2026 发布 agentic 网络安全系统 SafeMind，与 NVIDIA 合作构建

“我们正处于网络安全的一个拐点，”黄仁勋在周二拉斯维加斯CrowdStrike的Fal.Con 2026大会上对满场观众说道。攻击现在已经实现自动化。防御也必须如此。

这位NVIDIA的创始人兼CEO与CrowdStrike的创始人兼CEO乔治·柯尔茨共同宣布了CrowdStrike SafeMind：https://www.crowdstrike.com/en-us/press-releases/crowdstrike-launches-frontier-models-for-cybersecurity-with-nvidia/，这是由CrowdStrike网络超级智能实验室开发的自主网络安全系统。“这标志着网络安全新时代的开始，”黄仁勋对1万名安全专业人士说道。“一方面，对手将比以往任何时候都更具武装；另一方面，你们每个人也将比以往任何时候都更具武装。”

SafeMind将CrowdStrike专门构建的、超越前沿能力的模型和定制的自主工具，与基于NVIDIA Nemotron：https://www.nvidia.com/en-us/ai-data-science/foundation-models/nemotron/ 构建的防御模型相结合，在进攻与防御反复挑战和提升对方的持续共同进化循环中运行。

CrowdStrike还宣布了CrowdStrike Falcon IQ，用以通过自主工作负载自动化实现Project QuiltWorks，并扩展其CrowdStrike Guardian AI安全解决方案。“我们拥有不对称优势，因为我们有一个庞大的网络安全专家社区，他们希望相互合作，保护世界安全，”黄仁勋对观众说道。

CrowdStrike的年度大会吸引了来自金融服务、医疗保健、公共部门及关键基础设施的安全领导者。

“我看到的真正差距是，攻击者掌握了前沿AI，而防御者没有，”柯尔茨对他们说。“而现在，这种情况将发生改变。”

CrowdStrike使用NVIDIA Nemotron开放模型构建了SafeMind的防御模型，并结合CrowdStrike的网络经验和威胁数据进行后训练。SafeMind模型与优化为自主堆栈使用的专有网络安全工具配对。

该结果以 SafeMind 的形式原生部署在 CrowdStrike Falcon 平台上，SafeMind 是 CrowdStrike 的自主网络安全系统。SafeMind 将进攻和防御 AI 结合在一个持续共演化的循环中，每一方都适应并强化另一方。这个过程不断增强客户环境的安全性，直到攻击无法成功。

“我们有十五年的安全数据可以用于训练——我们可以利用前沿模型，将其本质上打造为一个在网络安全方面非常出色的超级 AGI，”黄对 Kurtz 说。Kurtz 表示：“我们与 NVIDIA 一起，构建了网络安全领域第一个完整的自主系统，包括用于防御者的首个前沿模型和专门设计的工具。这不是嵌入在他人智能中的协同助手，也不是带有安全外壳的聊天机器人。它是由 CrowdStrike 基于我们的数据并与 NVIDIA 合作训练和构建的前沿级别模型。”

NVIDIA Nemotron 3 Ultra 协调防御代理的使用。经过微调的 Nemotron 3 Super 驱动 SafeMind 的规则生成子代理。

通过使用 CrowdStrike 数据对 Nemotron 进行后训练，CrowdStrike 内部评估显示，基于 Nemotron 3 Super 的 Blue Solano 模型，其准确率高于领先的前沿模型，同时成本降低了 99%。

虽然 SafeMind 可以作为完整系统运行，但这些模型也可以独立使用，使防御者能够领先于对手。安全专家还可以将自己的模型与 CrowdStrike 的自定义工具结合，为客户提供在其环境中使用合适模型和能力的灵活性。

“这个工具本质上是大型语言模型的外骨骼，”黄说。“大型语言模型是大脑。外骨骼将其转变为代理——并且这个外骨骼在每个领域的形状和能力不必相同。”

根据 CrowdStrike 指出（https://www.crowdstrike.com/en-us/global-threat-report/），过去一年 AI 支持的攻击增长了 89%，而最快的电子犯罪爆发时间已达到 27 秒。以人类速度响应并不能算防御，它只是文档记录。

“在世界上有许多应用场景，需要你具备微调和后训练的能力——创造一个在特定领域非常擅长的人工智能，”黄说道。“Nemotron正是为此而创建的。完全免费。速度极快。你有能力在面对任何挑战时获得不对称优势。”

以开放的Nemotron为基础，CrowdStrike的安全团队在不将数据发送给外部供应商的情况下，对自己的威胁数据进行了后训练，并将AI定制化以适应他们的环境。

封闭的前沿模型无法实现这一点，而在安全领域，检查防御手段的能力至关重要。

NVIDIA宣布了其在高保真网络代理环境中运行CrowdStrike SafeMind模型并利用：https://developer.nvidia.com/blog/building-an-adaptive-agentic-cybersecurity-system-with-nvidia-nemotron/ 进行测试的工作，这个环境模拟了NVIDIA网络。

测试在进攻-防御循环中运行SafeMind，实现对抗性共进化。进攻的红队代理发现漏洞，蓝队防御代理进行修复，找到的结果转化为可操作的检测以阻止攻击。

红队代理使用Recon、Assault和Compromise子代理，在网络代理环境中执行攻击路径。蓝队代理通过Falcon传感器进行监控，生成检测候选，进行验证并提升其优先级。

CrowdStrike与NVIDIA一起构建了测试环境：NVIDIA自身加速计算基础设施的数字孪生，并对其进行了实际威胁环境的验证。

“SafeMind的基本框架——在环境数字孪生上运行的对抗模型，带有连续的猫鼠循环的防御者模型，最终学会如何自我保护——这一基本框架适用于机器人技术、边缘计算、企业计算以及几乎所有领域，”黄说道。

CrowdStrike还宣布了Falcon IQ：https://www.crowdstrike.com/en-us/press-releases/crowdstrike-falcon-iq-operationalizes-project-quiltworks-at-machine-speed/。NVIDIA Nemotron模型帮助驱动Charlotte AI AgentWorks核心的智能代理引擎，Charlotte AI AgentWorks是CrowdStrike的无代码代理开发平台，Falcon IQ即在其上运行。

Falcon IQ 使用超过 50 名代理共同协作，作为统一的代理化工作团队，自动化评估、优先级排序和修复中最耗时的工作流程。

合作伙伴使用 Falcon IQ 向客户提供定制的发现、建议和高管输出。Charlotte AI AgentWorks 使每位 Falcon 用户都能建立自己的代理化安全工作团队。

CrowdStrike 拥有数千个客户组织，每天生成数万亿条安全事件。

借助 NVIDIA 的全栈加速计算平台，这种协作从芯片开始，贯穿模型，再到对模型发现采取行动的工具。对 Kurtz 来说，这正是关键所在。

Kurtz 补充道：“CrowdStrike 中的群体是不对称性，这使得防御者处于独特的位置，可以击败对手。”

“We’re at an inflection point in cybersecurity,” Jensen Huang told a sold-out crowd at CrowdStrike’s Fal.Con 2026 in Las Vegas Tuesday. Attacks are now automated. Defense has to be, too.

The NVIDIA founder and CEO joined CrowdStrike CEO and founder George Kurtz to announce CrowdStrike SafeMind ：https://www.crowdstrike.com/en-us/press-releases/crowdstrike-launches-frontier-models-for-cybersecurity-with-nvidia/ , its agentic cybersecurity system developed by the CrowdStrike Cyber Superintelligence Lab. “This is the beginning of a new age of cybersecurity,” Huang told the crowd of 10,000 security professionals. “On the one hand, the adversaries are going to be more armed than ever. On the other hand, all of you are going to be more armed than ever.”

SafeMind combines CrowdStrike’s purpose-built, beyond frontier-capable models and customized agentic harnesses, with defensive models built on NVIDIA Nemotron ：https://www.nvidia.com/en-us/ai-data-science/foundation-models/nemotron/ , in a continuous coevolution loop where offense and defense repeatedly challenge and improve each other.

CrowdStrike also announced CrowdStrike Falcon IQ to operationalize Project QuiltWorks through agentic workload automation and expanded its CrowdStrike Guardian AI safety solution. “We have asymmetric advantages because we have a large community of cybersecurity experts who want to work with each other and keep the world safe,” Huang told the crowd.

CrowdStrike’s annual conference drew security leaders from financial services, healthcare, the public sector and critical infrastructure.

“The real gap that I saw was that the attackers had frontier AI, and the defenders didn’t,” Kurtz told them. “And that changes now.”

CrowdStrike built SafeMind’s defensive model using NVIDIA Nemotron open models, post-trained with CrowdStrike’s cyber experience and threat data. The SafeMind models are paired with proprietary cybersecurity harnesses optimized to work as an agentic stack.

The result ships natively in the CrowdStrike Falcon platform as SafeMind, CrowdStrike’s agentic cybersecurity system. SafeMind brings offensive and defensive AI together in a continuous coevolution loop, where each side adapts to and strengthens the other. This process continuously hardens the security of the customer environment until attacks are unsuccessful.

“Your decade and a half of security data that we can train on — we can take a frontier model and make it essentially a super AGI that is incredibly good at cybersecurity,” Huang told Kurtz. “Together with NVIDIA, we built cybersecurity’s first complete agentic system for cybersecurity, including the first frontier models and harness purpose-built for defenders,” Kurtz said. “This isn’t a copilot baked into someone else’s intelligence. It’s not a chatbot with a security skin. It is a frontier-class model built and trained by CrowdStrike on our data in partnership with NVIDIA.”

NVIDIA Nemotron 3 Ultra orchestrates the defensive agent harness. A fine-tuned Nemotron 3 Super powers SafeMind’s rule-generation sub-agent.

By post-training Nemotron with CrowdStrike data, CrowdStrike internal evaluations showed that the Blue Solano model — based on Nemotron 3 Super — delivered higher accuracy rates than leading frontier models at 99% lower cost.

While SafeMind can operate as a complete system, the models can be used independently to empower defenders to stay ahead of the adversary. Security experts can also pair their own models with CrowdStrike’s custom harnesses, giving customers the flexibility to use the right models and capabilities for their environment.

“The harness is essentially the exoskeleton of the large language model,” Huang said. “The large language model is the brain. The exoskeleton turns it into an agent — and this exoskeleton doesn’t have to be the same shape and capability for every domain.”

AI-enabled attacks rose 89% in the past year, and the fastest eCrime breakout time has reached 27 seconds, according to CrowdStrike ：https://www.crowdstrike.com/en-us/global-threat-report/ . Human-speed response isn’t defense. It’s documentation.

“There are many applications in the world where you must have the ability to fine-tune, to post-train — to create an AI that is super good at a particular domain,” Huang said. “Nemotron was created for precisely that. Completely free. Incredibly fast. You have the ability to have an asymmetric advantage against whatever comes your way.”

With open Nemotron as the base, CrowdStrike’s security teams post-trained on their own threat data without sending it to an outside provider, and customized the AI to their environment.

That’s not possible with a closed frontier model, and in security, the ability to inspect what’s defending matters.

NVIDIA announced its work testing the CrowdStrike SafeMind models and harnesses ：https://developer.nvidia.com/blog/building-an-adaptive-agentic-cybersecurity-system-with-nvidia-nemotron/ in a high-fidelity cyber agent environment running as a simulation of the NVIDIA network.

The testing runs SafeMind in an offensive-defensive loop for adversarial coevolution. An offensive red-team agent finds the exploit, a blue-team defensive agent closes it and the findings become actionable detections to block attacks.

The red-agent harness runs Recon, Assault and Compromise sub-agents executing attack paths inside the cyber agent environment. The blue-agent harness monitors via Falcon sensors, generates detection candidates, validates them and promotes them.

CrowdStrike built the test environment with NVIDIA: a digital twin of NVIDIA’s own accelerated computing infrastructure, validated against NVIDIA’s real threat landscape.

“The basic framework of SafeMind — an adversarial model acting on a digital twin of the environment, with a defender model in a continuous cat-and-mouse loop, eventually learning how to secure itself — this basic framework applies to robotics, edge computing, enterprise computing and just about everything,” Huang said.

CrowdStrike also announced Falcon IQ ：https://www.crowdstrike.com/en-us/press-releases/crowdstrike-falcon-iq-operationalizes-project-quiltworks-at-machine-speed/ . NVIDIA Nemotron models help to power the agentic engine at the heart of Charlotte AI AgentWorks, CrowdStrike’s no-code agent development platform where Falcon IQ runs.

Falcon IQ uses more than 50 agents working together as a unified agentic workforce to automate the most time-intensive workflows in assessment, prioritization and remediation.

Partners use Falcon IQ to deliver customized findings, recommendations and executive outputs to customers. Charlotte AI AgentWorks enables every Falcon user to build their own agentic security workforce.

CrowdStrike has thousands of customer organizations generating trillions of daily security events.

With NVIDIA’s full-stack accelerated computing platform, the collaboration runs from the chips up through the models to the harnesses acting on what those models find. For Kurtz, that’s the point.

“The crowd in CrowdStrike,” Kurtz added, “is the asymmetry that puts the defenders in a unique position to defeat the adversary.”