CrowdStrike SafeMind Pits AI Attackers Against AI Defenders in a Continuous Security Loop

Artificial intelligence is changing both sides of cybersecurity.

Attackers can use increasingly capable AI systems to automate reconnaissance, vulnerability discovery and other stages of an attack. Defenders, meanwhile, are using AI to analyze telemetry and generate security detections.

CrowdStrike argues that running these capabilities separately creates a gap: the defensive system is not necessarily tested against the same kind of AI-driven offense it is expected to detect.

Its answer is CrowdStrike SafeMind, a closed-loop system designed to make offensive and defensive AI agents continuously test and improve against each other.

The system was developed through research by the CrowdStrike Cyber Superintelligence Lab and uses a process CrowdStrike calls adversarial co-evolution. Instead of treating attack simulation and detection generation as separate activities, SafeMind connects them into a repeated cycle.

CrowdStrike says its internal benchmarks showed a 70% relative improvement in detection accuracy, a 99% reduction in detection-generation cost, and 6x faster detection creation. These figures are CrowdStrike's own reported results and are not presented as independent industry benchmarks.

What Is CrowdStrike SafeMind?

Traditional AI-assisted security can be divided into two broad functions.

An offensive system looks for weaknesses and attempts to compromise an environment.

A defensive system analyzes activity and attempts to detect or stop those attacks.

SafeMind connects these two functions.

At the center of the system are three components:

1. Cyber Agent Environment

2. Red Tempest, the offensive agent

3. Blue Solano, the defensive agent

The Cyber Agent Environment provides the setting in which the two agents operate. Red Tempest attempts attacks, Blue Solano analyzes what happened and generates detections, and the resulting defenses are fed back into the environment for another attack cycle.

The concept is therefore not simply two AI agents operating at the same time. The important part is the feedback loop between them.

The Cyber Agent Environment Creates the Testing Ground

For SafeMind to work, CrowdStrike says its agents need realistic environments rather than abstract attack simulations.

The company built Cyber Agent Environments intended to represent enterprise environments.

These environments use network maps and telemetry from the CrowdStrike Falcon platform to create what the company describes as a high-fidelity slice of a real environment.

CrowdStrike says each environment is designed with the minimum necessary components for the intended purpose.

The system can also run individual attack scenarios more than 10,000 times, according to CrowdStrike, allowing the company to build what it describes as statistically meaningful coverage.

This environment is important because the defensive agent is not simply asked to identify theoretical attacks.

It can examine activity generated by an actual attack sequence inside the test environment and use the resulting telemetry as part of detection development.

Red Tempest: The Offensive Side of SafeMind

Red Tempest is the offensive agent inside SafeMind.

CrowdStrike says it can work across the attack lifecycle, including:

• Network discovery

• Vulnerability enumeration

• Exploitation

• Privilege escalation

• Lateral movement

• Persistence

The system covers more than 1,000 distinct attack scenarios spanning 155 MITRE ATT&CK techniques, according to CrowdStrike.

Red Tempest is designed for long-horizon campaigns rather than isolated actions.

CrowdStrike says the agent can perform thousands of sequential actions across multiple runs while working toward an objective such as data exfiltration or another form of compromise.

A multi-agent architecture

Under the hood, CrowdStrike describes Red Tempest as a 27-billion-parameter dense model operating through a multi-agent harness.

An orchestrator manages the broader campaign while specialized subagents handle different stages, including reconnaissance and assault.

CrowdStrike also says the offensive system uses its threat intelligence knowledge base, which contains information on hundreds of apex adversaries and their associated tactics, techniques and procedures.

The context window is described as 256K tokens, with the ability to extend to 1 million tokens. CrowdStrike says this is important for long-running campaigns because the agent needs to maintain a large amount of state as an operation progresses.

Blue Solano Turns Attack Traces Into Detections

On the defensive side is Blue Solano.

CrowdStrike describes Blue Solano as a custom agentic harness built around NVIDIA Nemotron Ultra as its reasoning orchestrator, together with a purpose-built detection-generation model.

The process begins after Red Tempest completes an attack.

Blue Solano receives the attack trace and analyzes the techniques involved. It then queries live Falcon sensor telemetry to determine what actually happened on the endpoint.

This distinction is important.

Rather than generating a detection from documentation alone, CrowdStrike says Blue Solano works with telemetry produced by the attack itself.

The system then generates detection logic and validates it against the telemetry.

It also checks the detection against clean baseline data to determine whether it generates significant false positives.

The model behind detection generation

CrowdStrike says the detection-generation model is a post-trained NVIDIA Nemotron Super 120B mixture-of-experts model, with 12 billion active parameters.

The company says the model was first supervised-fine-tuned using its internal detection engineering corpus, which CrowdStrike describes as representing the equivalent of 3.1 million working hours of expertise.

It was then further trained through reinforcement learning.

In that process, Red Tempest attacks served as the reward signal. Detections that successfully caught attacks were rewarded, while detections that produced false positives on clean data were penalized.

The result is intended to be working detection logic rather than a written recommendation.

When SafeMind encounters a new attack, CrowdStrike says Blue Solano can generate candidate detections, test them against telemetry and validate them against clean activity.

The Feedback Loop Is the Core of SafeMind

The most important part of SafeMind is what happens after a detection works.

When Blue Solano successfully blocks Red Tempest, the new detection is used to harden the environment.

Red Tempest is then challenged again.

But there is an important twist.

CrowdStrike says the offensive agent receives complete knowledge of the defensive changes made during the previous cycle.

Red Tempest therefore has to attempt the attack again while knowing what defenses have been introduced.

This creates a continuous adversarial loop:

Attack → Detect → Harden → Attack Again → Detect Again

The cycle continues until a defined level of friction or cost is imposed on the offensive agent.

CrowdStrike describes this as a deliberately difficult test of the defense because the simulated attacker is not kept in the dark about the defensive changes.

What CrowdStrike Says Its Internal Benchmarks Show

CrowdStrike reports two major sets of benchmark results for SafeMind.

Red Tempest's offensive cost

The company says Red Tempest achieved 100% compromise at lower cost than the comparable models tested in its internal benchmark.

CrowdStrike says the $21 result represents an approximately 80% reduction compared with the $96 closed frontier model used in the comparison.

These are CrowdStrike's internal benchmark results and should not be interpreted as a general market-wide cost comparison.

Blue Solano's detection results

CrowdStrike says Blue Solano achieved a 70% relative improvement in accuracy over general-purpose harnesses orchestrated by frontier models.

The company also reports that the cost of generating a detection fell from approximately $10 to $0.03 in its benchmark.

CrowdStrike says the performance measurement required two conditions:

1. The detection had to catch the attack.

2. The detection could not produce significant noise when tested against clean production data.

A detection that caught the threat but generated excessive false positives did not pass the benchmark.

The company also reports that Blue Solano generated a validated detection in under six minutes, while general-purpose harnesses averaged more than one hour in the comparison.

Again, these measurements come from CrowdStrike's internal testing.

Why the Adversarial Approach Matters

CrowdStrike's argument is that AI changes the economics and speed of both attack and defense.

If offensive AI systems can perform more attack activity with less manual intervention, security teams need ways to test defensive controls against similarly capable systems.

SafeMind is designed around that premise.

The objective is not simply to create an AI system that searches for vulnerabilities or another AI system that generates detections.

Instead, the offensive system continuously challenges the defensive system.

The defensive system then changes the environment and forces the offensive system to adapt.

This creates a different model for security testing.

Rather than asking whether a defense can detect an attack that was previously known, the SafeMind approach asks whether the defense can continue working after the simulated attacker learns how the defense operates.

CrowdStrike says the goal is to build defenses that remain effective even when the adversary has complete knowledge of the defensive setup.

SafeMind's First Offering: FAIRR

CrowdStrike says the initial offering associated with SafeMind is the Frontier AI Readiness and Resilience Service, or FAIRR Service.

The service is powered by Red Tempest.

One capability described in the announcement is Red Tempest's code review functionality, which CrowdStrike says is designed to systematically identify vulnerabilities in custom applications and their underlying software dependencies.

CrowdStrike also says Red Tempest and Blue Solano will serve as foundational components for future product offerings and will be used to enhance the delivery of existing and new services.

Additional details about those future offerings were not disclosed in the announcement.

What SafeMind Represents for AI Security

SafeMind reflects a broader change in how AI can be used for security testing.

The conventional model separates offensive testing from defensive detection.

CrowdStrike's approach connects them.

The offensive agent creates realistic attack activity. The defensive agent analyzes the resulting telemetry and develops detections. Those detections change the environment, and the offensive agent attempts the attack again with knowledge of the changes.

That creates an iterative security test rather than a one-time assessment.

For security teams, the underlying idea is significant even beyond the specific SafeMind architecture: AI-based defense needs to be evaluated against increasingly capable AI-based offense.

At the same time, CrowdStrike's reported performance and cost figures should be understood in the context of the company's own testing methodology and benchmark environment.

The announcement does not provide independent validation of the reported accuracy, cost or speed figures.