The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents

Artificial intelligence is transforming cybersecurity by accelerating both threats and defenses. AI enables adversaries to launch faster, more sophisticated attacks - often indistinguishable from human actions - reducing breakout times to minutes or even seconds. This shift has disrupted the traditional hierarchy of cyber threats, giving rise to an "agent state" where AI-powered actors, including hacktivists and e-crime groups, wield capabilities once limited to nation-states. Open-weight AI models are frequently exploited in these attacks due to fewer restrictions, while closed frontier models remain more controlled. Enterprises now face growing challenges from "shadow AI" - unauthorized AI agents operating without oversight - highlighting the need for better visibility, identity management, and monitoring of AI activity within their environments.

Defending against AI-driven threats requires leveraging advanced AI on the defensive side, with organizations needing to match offensive capabilities through specialized models trained on real-world security data. Solutions like digital twins allow for continuous red-blue team simulations to refine detection and response. While frontier models offer power, they often come with limitations that hinder defensive operations, prompting some security firms to develop their own cost-efficient, domain-specific AI. Looking ahead, the future of cybersecurity will depend on hybrid AI systems - combining local and cloud models - and ongoing innovation in hardware, model distillation, and software security. Despite concerns about job displacement and data sovereignty, AI is seen as a net enabler, driving efficiency, creating new roles, and demanding continuous adaptation in an evolving threat landscape.

• What if you weaponized open-weight AI to simulate attacks on your own software?

  • Move: Set up a local instance of an open-weight AI model (e.g., Llama, Mistral) and use it to generate phishing emails, exploit code, or simulate red-team attacks against your own application.
  • Why Now?: Open-weight models are increasingly capable and unrestricted - adversaries are already using them; you can proactively find flaws before they do.
  • Expected Upside: Discover and patch security vulnerabilities in your code, API endpoints, or user interfaces faster than traditional testing, reducing breach risk and improving trust.

• What if you embedded AI-powered monitoring to detect rogue or shadow AI agents in your app's ecosystem?

  • Move: Integrate lightweight logging and behavioral analysis into your app to flag unauthorized AI agent activity (e.g., unexpected API calls, code execution, data scraping).
  • Why Now?: Shadow AI usage is rising - both in enterprises and in software supply chains - and undetected agents create blind spots attackers exploit within minutes.
  • Expected Upside: Gain real-time visibility into AI-driven threats, prevent data leaks or misuse, and differentiate your product with built-in AI governance for security-conscious customers.

• What if you built your own defensive AI model fine-tuned on your app's unique attack surface?

  • Move: Use your application's logs, error patterns, and user behavior to fine-tune a small, open-weight AI model that detects anomalies specific to your system.
  • Why Now?: Frontier models are expensive and restricted; you have proprietary data from your users that gives you an edge in training a cheaper, more relevant defender AI.
  • Expected Upside: Achieve faster, more accurate threat detection at lower cost, while maintaining data sovereignty and enabling a defensible moat around your software business.

• Audit and inventory all AI tools currently in use within your software projects to identify and eliminate unauthorized or shadow AI usage.
• Implement strict permission controls for AI agents in your systems, ensuring they cannot execute or download code without explicit approval.
• Fine-tune open-weight AI models locally for your specific use cases to reduce costs and maintain data sovereignty, avoiding reliance on expensive frontier models.
• Use AI to continuously test your own code and systems by simulating attacks, leveraging red teaming techniques to uncover vulnerabilities before adversaries do.
• Build detailed visibility into AI agent behavior by logging and monitoring tool calls, data access, and network activity to detect anomalous or malicious actions in real time.