Future TechnologyCrowdStrike SafeMind: Two AI Models Built to Attack and Defend Each Other
Key takeaways
- Red Tempest is the attacker, a 27 billion parameter dense model with a 256K context window that stretches to a million tokens on longer runs
- Blue Solano is the defender, a post-trained Nemotron-3 Super mixture-of-experts model with 128 billion total parameters and 12 billion active, trained on fifteen years of CrowdStrike breach data
- The pair are pointed at a digital twin of the customer environment, where the defender writes new detections until no viable attack paths remain
- Falcon Guardian went generally available at the same event, and direct access to the models sits behind a program called Project QuiltWorks
Twenty seven billion parameters attacking, 128 billion defending. That is the shape of CrowdStrike SafeMind, announced at Fal.Con 2026 and built with Nvidia. CrowdStrike calls it the company's first complete agentic system for cybersecurity, which is the sort of phrase that usually means very little. The structure underneath it is the part worth reading.
What Red Tempest and Blue Solano actually are
Red Tempest plays the attacker. It is a dense model at 27 billion parameters with a 256K context window that stretches to a million tokens when a run needs the room. Blue Solano plays the defender and is built differently: a post-trained Nemotron-3 Super mixture-of-experts model with 128 billion total parameters, 12 billion of them active at any one time, trained on fifteen years of CrowdStrike breach data.
The two are pointed at a digital twin of the customer environment rather than the live network. Red Tempest attacks it, repeatedly. Blue Solano watches what happens, works out what got through, and writes new detections. The loop runs until there are no viable attack paths left to find.
Why continuous red teaming changes the maths
Red teaming has always been expensive and periodic. Most organisations run one or two engagements a year, then hope nothing important changes in the eleven months in between. Every new appliance, every new integration and every misconfigured admin account lands in that gap and sits there until the next engagement finds it.
Making the exercise continuous changes the economics of finding your own weak points, which is a narrower claim than making the network safe. A digital twin is only as good as its accuracy, and an attack path that exists solely in the real environment will not appear in a model of it. That gap is where this approach either works or quietly does not.
The question nobody answered well
Falcon Guardian also reached general availability at the same event, and standalone access to the models and harnesses is gated behind a program called Project QuiltWorks. That gating tells its own story. CrowdStrike has built an offensive model good enough to be worth restricting.
So: what happens when the attacker model outperforms the defender and somebody outside the program gets hold of it. Nobody at Fal.Con answered that convincingly. Attacker timelines have already compressed sharply this year, with one operator using frontier models to finish a two week intrusion in under ten hours. A purpose-built offensive model is a short step from that.
The part worth watching is not whether SafeMind writes good detections. It is who ends up holding Red Tempest, and how long QuiltWorks stays closed. Until then the unglamorous work still applies: know what is already being exploited in the wild, and patch the things sitting on that list, like the SonicWall SMA 1000 pair added this week.