CrowdStrike and NVIDIA launch SafeMind, purpose-built frontier cyber models and an agentic defender stack

CrowdStrike introduced CrowdStrike SafeMind on 1 September 2026 from Austin, Texas and Fal.Con 2026 in Las Vegas. The company describes SafeMind as a family of purpose-built security models and harnesses from the CrowdStrike Cyber Superintelligence Lab, and as an agentic system that will operate natively in the CrowdStrike Falcon platform. Trusted access for standalone models and harnesses is part of Project QuiltWorks.

Unlike a generic frontier model used as a copilot, CrowdStrike says SafeMind is one system: an offensive model that finds the attack path, a defensive model that closes it, and harnesses that operate both in the same loop. Training data, per the press release, comes from Falcon sensor telemetry, CrowdStrike threat intelligence, Falcon Complete MDR event annotations, and fifteen years of incident response fieldwork.

Red Tempest, Blue Solano, and Nemotron

SafeMind launches with two models. Red Tempest is the offensive red-team model, built to emulate AI adversaries in advanced attack scenarios. Blue Solano is the defensive blue-team model, built to protect enterprise assets with measures CrowdStrike says defenders use in real life.

CrowdStrike builds the models using NVIDIA Nemotron open models in collaboration with NVIDIA. The program also includes CoreWeave’s AI Cloud for training and inference. Harnesses operationalize the red and blue models in a closed loop that pits them against each other. CrowdStrike says the harnesses also work with frontier and open-source models.

NVIDIA’s Fal.Con 2026 blog adds the model split inside the defensive stack: NVIDIA Nemotron 3 Ultra orchestrates the defensive agent harness, and a fine-tuned Nemotron 3 Super powers SafeMind’s rule-generation sub-agent. That post also states Blue Solano is based on Nemotron 3 Super.

CrowdStrike’s evaluations, compared with leading frontier models and open-source baselines, claim 29% higher detection rate, 6x faster end-to-end remediation, and 99% cost savings on detection and remediation. NVIDIA reports that CrowdStrike internal evaluations showed Blue Solano delivered higher accuracy than leading frontier models at 99% lower cost.

Quotes from the stage

CrowdStrike CEO and founder George Kurtz said: “The future of cybersecurity won’t be defined by AI that simply identifies threats, it will be defined by AI that defeats them. SafeMind brings offensive and defensive models together in a system trained on CrowdStrike’s unique cyber data. It finds weaknesses, strengthens protection, and gets smarter with every cycle, advancing our mission to stop breaches at machine speed.”

NVIDIA founder and CEO Jensen Huang said: “Cybersecurity in the age of AI will be a continuous contest between adversaries using AI to scale attacks and defenders using AI to expand detection and response. Cyber defense will be among the most compute-intensive applications of AI.” He added that SafeMind combines Nemotron open models with CrowdStrike’s data, harnesses, evaluations, and safeguards as “a frontier agentic cybersecurity stack designed to operate at machine speed.”

CoreWeave CEO Michael Intrator said CoreWeave is powering SafeMind across training and inference. On the NVIDIA blog, Kurtz also told the Fal.Con audience: “The real gap that I saw was that the attackers had frontier AI, and the defenders didn’t. And that changes now.”

Digital twin testing and Falcon IQ

NVIDIA announced it is testing SafeMind models and harnesses in a high-fidelity cyber agent environment that simulates NVIDIA’s network—a digital twin of NVIDIA’s accelerated computing infrastructure, built with CrowdStrike and validated against NVIDIA’s threat landscape. In that loop, an offensive red-team agent finds an exploit, a blue-team agent closes it, and findings become detections. The blue-agent harness monitors via Falcon sensors, generates detection candidates, validates them, and promotes them.

CrowdStrike also announced Falcon IQ, which NVIDIA says operationalizes Project QuiltWorks through agentic workload automation. Falcon IQ uses more than 50 agents via Charlotte AI AgentWorks, CrowdStrike’s no-code agent development platform, to automate assessment, prioritization, and remediation. NVIDIA Nemotron models help power the agentic engine at the heart of AgentWorks.

Source: CrowdStrike Launches Frontier Models for Cybersecurity, Created with NVIDIA (1 September 2026). Also used: NVIDIA and CrowdStrike Strengthen Agentic Cybersecurity Frontier.