When Attackers Have Agents: George Kurtz’s Case for Making Defensive Knowledge Operational

1. Guest Background

George Kurtz joins Sarah Guo and Elad Gil on No Priors as both a security practitioner and a company builder. He is the founder and CEO of CrowdStrike, having previously founded and led Foundstone. In the interview, he describes spending more than thirty years in security. That experience informs a conversation that moves between adversary behavior, defensive engineering, and the practical requirements of enterprise customers.

The roughly 45-minute episode asks what happens when attackers can delegate work to AI agents, and what defenders can do with agents of their own. Its scope includes untracked enterprise AI, the identities under which agents operate, CrowdStrike’s SafeMind research effort, and the choice between specialized, open-weight, local, and frontier models.

Kurtz also connects the discussion to Hacking Exposed, which he co-authored. His account of that earlier work is straightforward: explaining how offense works helps people build better defense. Today, he wants to accelerate that learning process through repeated interaction between offensive and defensive systems.

This background explains the perspective of the interview without making it neutral evidence of product performance. Kurtz is interpreting changes in the threat environment while explaining investments made by his company. His operational observations, product descriptions, customer stories, and predictions therefore deserve different kinds of scrutiny.

2. What the Episode Covers

The immediate enterprise problem in Kurtz’s account is visibility. Agents are appearing throughout organizations, including through tools such as Claude Code and Codex, while companies struggle to establish where they run, what they do, and whose identity they use. Shadow AI, in this telling, is more consequential than an incomplete software inventory. An agent can act through an existing identity while using compute, network connections, and data access to complete work.

On the offensive side, Kurtz describes a change in the distribution of capability. His traditional adversary pyramid places numerous, less sophisticated hacktivists at the bottom, electronic-crime groups in the middle, and fewer, more capable nation-state actors at the top. He calls the emerging alternative the “agent state”: models with removed guardrails can lower the knowledge and cost barriers to complex techniques. His comparison between lower-skilled attackers today and nation-state capabilities of earlier years is a threat assessment, however. The episode supplies no comparative capability study establishing that different groups have become equivalent.

Kurtz reports more vulnerability discovery and faster attack iteration. One numerical example concerns breakout time, which he defines as the interval between gaining an initial foothold and moving to another system. The first machine may not contain the assets an attacker ultimately wants. He cites an average of 29 minutes and a fastest observation of 27 seconds. Neither figure is presented with a sampling period, population, or explicit restriction to AI-driven incidents. They should not be treated as the time required to complete an entire attack, or as a measured causal effect of AI.

His emphasis on prompts concerns adaptive behavior. Prompts can shape how an agent gathers information, chooses a direction, and pivots through an environment. The issue extends beyond producing a malicious file more quickly. Yet speed is an unstable detection clue: Kurtz expects attackers could deliberately adopt slower behavior, making the rapid iteration visible today less useful for distinguishing AI activity later.

The enterprise counterpart is an agent given an employee’s identity and permission to download packages, then left running until someone returns days later. Kurtz argues that this combines permission exposure, dependency risk, and a supervision gap. A satisfactory final output does not establish that every intervening action was acceptable.

His description of AIDR addresses that execution layer. It starts with discovering unknown agents, then traces activity from an agent’s creation through subagents, tool calls, and MCP access, with policy and blocking rules applied around the chain. These are capabilities described in the interview, rather than independently demonstrated coverage. The episode gives no false-positive, false-negative, or completeness measurements showing how well the approach works across a customer environment.

3. Core Views: Reasoning, Examples, and Limits

The strongest version of Kurtz’s defensive argument is that knowing an environment must become an operational capability. Defenders possess information an outside attacker may lack: architectural diagrams, code, and knowledge of their own systems. But ownership alone offers little assurance. That knowledge must reach the models, tools, and feedback processes making defensive decisions. His call to fight AI with better AI consequently depends on context and execution, as well as underlying model capability.

Access to useful model behavior is another part of the argument. Discussing a Hugging Face-related incident raised by the hosts, Kurtz recounts an experimental attacking agent operating with guardrails disabled while defenders were refused assistance by frontier models. In his account, the defenders then used open-weight models to examine the material. He takes this as an example of unequal capabilities and one motivation for SafeMind. The incident is recounted rather than fully documented in the episode. It raises a legitimate question about authorized defensive access, but does not establish that all frontier models are unsuitable for security work or that simply removing safeguards produces an adequate defensive system.

CrowdStrike’s proposed engineering response combines specialized models with a recurring adversarial loop. Kurtz describes working with Nvidia and using foundation models including Nemotron in the development of Red Tempest and Blue Solano. A digital twin uses known information about a customer’s environment to create a virtual setting. Red repeatedly attempts to get in; Blue learns to identify and respond to what Red does. The reasoning is that an adapting offense calls for an adapting defense, rather than a security judgment frozen after one exercise.

The quality of the environmental representation is therefore central. A loop can improve performance against the conditions it contains while leaving important real-world conditions untested. The interview does not explain the twin’s fidelity, how configuration changes reach it, or how simulated improvements are validated in production. It supports understanding a development approach, not concluding that the approach already reproduces every relevant attack path. Defender knowledge is an advantage only to the extent that it is accurate, accessible, and used effectively.

Kurtz also makes a specialization argument based on data and the surrounding harness. He points to years of security operations, including threat-and-vulnerability pairings and attack chains from managed detection and response. He says the harness can materially improve results and reduce cost across different models. This suggests that a useful comparison should examine the whole task-execution system. It does not reveal how much of any reported improvement comes from post-training, proprietary information, tool orchestration, or other implementation choices; the episode provides no reproducible breakdown.

The cost illustration needs particularly careful attribution. Kurtz says general remediation might cost about ten dollars with a top-tier frontier cyber model, compared with about three cents using his company’s model. Without a matched task, success threshold, accounting scope, or record of human intervention, those figures cannot establish a general price ratio. They identify a purchasing question worth testing. A low-cost attempt that requires substantial review or rework is economically different from a verified repair, even if its model bill is small.

Customer constraints further complicate the choice. Kurtz says some customers do not want sensitive security information sent to model laboratories or used for training. He presents SafeMind as offering a choice of frontier models, CrowdStrike models, or routing between them. His anonymous New York bank example separates high-value work worth frontier pricing from other work suitable for open-weight models and post-training. A host adds a separate financial institution’s inability to absorb new releases every ten days. Together, these stories show how costs and organizational adoption capacity can matter. They do not establish an industry-wide migration or guarantee that a model several months behind meets another institution’s requirements.

Kurtz predicts a mixture of local, open-weight, and frontier systems. His broader optimism is also qualified by what he believes agents currently do: execute familiar attacks more quickly and at greater volume, rather than magically move between computers without an actionable path. That is his assessment of present capabilities, not a guarantee about future techniques.

Finally, improved code cannot carry the whole defensive burden. A host suggests that patient, scalable agents could improve architecture and review. Kurtz responds with his own experience of a coding tool producing code that its subsequent security review then found insecure. More checking may help, but successful generation is not proof of safety. Even software without vulnerabilities would leave identity misuse, he argues, while backward compatibility and older software create a long remediation tail. The episode’s defensive optimism therefore requires parallel attention to code, identities, and inherited systems.

4. Learning and Application

A practical application of the episode begins with a bounded agent workflow. The following steps are deductions from the discussion, rather than implementation results demonstrated in it. Record where the agent runs, who owns the task, which identity it actually uses, what data it can reach, and which tools or dependencies it can invoke. Then follow one execution through subagents and MCP access. An inventory establishes existence; tracing establishes whether the organization understands the actions taken on its behalf.

Permissions should follow the task’s requirements. For work involving package installation or extended unattended execution, define the accessible resources, permitted actions, and conditions requiring human handling before expanding the pilot. This introduces friction and may require changing a convenient workflow. Its purpose is to make supervision relevant while actions occur. Visibility alone remains insufficient: a log does not prove that a policy can block an unwanted action, and a product description does not demonstrate complete coverage. Test those properties in the actual pilot.

Model selection should turn Kurtz’s remediation-cost example into an evaluation design. Give candidate systems the same authorized tasks, define what counts as a correct repair, and record failures, retries, and human work alongside model charges. Separately establish where information goes, whether it can be used for training, and what may be routed externally. Local or open-weight deployment may fit some requirements, but the bank anecdote is a decision pattern to examine, not evidence that the same choice will work everywhere.

Apply similar discipline to digital twins. Start with an environment whose assets and permission relationships are reasonably understood. Check that the representation matches the intended scope, identify what it omits, and ask whether findings produce defensive changes that can be retested under authorization. Repeat the comparison after relevant environmental changes. Otherwise, repeated simulated success may say more about the simulation than about production exposure. Identity misuse and older systems should remain explicit parts of the assessment even when code quality improves.

There is an organizational lesson as well. Kurtz advocates focused small teams and shorter cycles, describing his direct participation in Falcon Guardian design and meetings on three days of the week. The transferable idea is shorter distance between decisions and feedback, rather than a prescribed meeting schedule. A pilot needs an accountable owner, a reviewable result, and conditions for revisiting it. Faster activity helps only when the organization can determine what improved.

Data volume deserves the same scrutiny. Kurtz describes CrowdStrike’s sensors as producing roughly seven trillion events daily and treats the continuing stream as an advantage. That is a company figure, without independent verification or a quality assessment in the episode. An enterprise should ask whether its own records explain the relevant identities, actions, and outcomes, rather than assume collecting more events necessarily improves a model.

Finally, evaluate a security purchase through protection, trust, total cost, deployment effort, and time to useful results—the customer priorities Kurtz emphasizes. His favorable deployment anecdotes should prompt local testing. Establish one valuable workflow before expanding it, and retain ongoing review. Security enables broader AI use when there is evidence for that expansion; Kurtz’s closing position is that cybersecurity remains a continuing exercise in risk mitigation.

Source

• Original episode: The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents