CrowdStrike Launches SafeMind: Purpose-Built Offense and Defense AI Models Built With Nvidia

CrowdStrike unveiled its Cyber Superintelligence Lab and a new family of security-specific AI models called SafeMind at Fal.Con 2026 on September 1, built in partnership with Nvidia. The lab, led by CrowdStrike's chief AI and autonomous systems officer Dr. Bartley Richardson, unites the company's AI researchers, offensive operators, and incident responders around one goal: purpose-built frontier models trained specifically for security work, rather than adapted from general-purpose models.

Two Models, Working Against Each Other

• Red Tempest is the offensive model — a frontier-class system built to emulate AI-driven adversaries and run advanced attack scenarios against an environment, functioning as an automated red team
• Blue Solano is the defensive counterpart, deploying the same containment measures CrowdStrike's human responders use on live incidents, tuned for greater accuracy, speed, and cost efficiency than general-purpose models CrowdStrike tested
• The two operate in a closed loop: Red Tempest attempts an attack, Blue Solano responds, and the results feed the next round — an adversarial training cycle meant to let both sides continuously improve against each other

The Data and Technical Partnership Behind It

Both models are trained on CrowdStrike's Falcon sensor telemetry — described as the largest security dataset in the world, drawing on trillions of daily events — plus 15 years of accumulated breach-response data. Technically, CrowdStrike built the models using Nvidia Nemotron open models in collaboration with Nvidia as its AI design partner, with CoreWeave's AI Cloud providing training and inference infrastructure. Nvidia separately received CrowdStrike's Global Partner of the Year award at the same Fal.Con conference — the third distinct Nvidia partnership announcement from CrowdStrike in under a year.

What This Means for Security Teams Evaluating Tooling

SafeMind is a notable entrant in a fast-moving category: security vendors building models specifically for their domain rather than layering general-purpose LLMs onto existing tools. For any organization evaluating security AI tooling, the adversarial self-improvement loop (offense versus defense, continuously) is worth watching as a genuine architectural differentiator — though as with any newly launched capability, independent, real-world efficacy data will matter more than the launch framing over the coming months.