Bridging the Gap: How NVIDIA and CrowdStrike are Automating Cyber Defense with Agentic Systems
In the rapidly evolving landscape of cybersecurity, the speed of attack has historically outpaced the speed of defense. While security teams have begun adopting artificial intelligence, many implementations remain tethered to static alerts and predefined workflows. To counter increasingly adaptive threats, industry leaders are shifting toward a new paradigm: autonomous, closed-loop systems that evolve in real-time.
NVIDIA and CrowdStrike recently collaborated to evaluate a novel agentic cybersecurity system, designed to transform offensive and defensive operations into a continuous learning loop. By leveraging open-model configurations, the teams demonstrated that machine-speed testing can significantly improve detection accuracy while drastically reducing operational costs.
A Continuous Learning Loop
Traditional “red team vs. blue team” exercises are often fragmented, relying on manual handoffs where human engineers must bridge the gap between attack execution, telemetry review, and detection development. This latency limits the number of variables security teams can test.
The agentic system developed by NVIDIA and CrowdStrike replaces this manual bottleneck with a four-stage, high-speed loop:
- Execute and Capture: An offensive agent selects and runs an attack path in an isolated environment, while sensors record the resulting telemetry.
- Process and Reconstruct: A defensive agent analyzes the trace, identifying where current detection coverage is lacking.
- Generate and Validate: The defensive agent creates candidate detections, which are then rigorously tested against the recorded telemetry.
- Retest and Adapt: Validated detections are deployed, forcing the offensive agent to find new, more sophisticated attack paths, thereby strengthening the defense in every cycle.
The Power of Specialized AI
The evaluation utilized NVIDIA’s Nemotron models—customized for high-stakes cybersecurity tasks—running within CrowdStrike’s “SafeMind” system. The configuration paired NVIDIA Nemotron 3 Ultra for high-level defensive orchestration with a specialized Nemotron 3 Super for the complex task of detection generation.
According to CrowdStrike, this open-model configuration proved more accurate than the leading proprietary frontier models tested, all while operating at 99% lower cost.
The success of the system hinges on a specialized “defensive harness” that ensures reliability. Rather than relying on a general-purpose model, the team implemented six critical mechanisms, including schema knowledge bases to prevent syntax errors, automated “artifact linting” to ensure detections are behavioral rather than environment-specific, and independent review judges that audit detections for robustness.
From Backtesting to Live-Fire
The system was evaluated through a rigorous two-stage process: backtesting against known attacks and “live-fire” testing against unseen attack variants.
The results were striking. In live-fire scenarios, the optimized open-model pipeline successfully generated detections that generalized across unseen attacks, outperforming frontier systems in both reliability and effectiveness. Notably, after a final expert review, the open-model pipeline produced “gold-standard” detections that covered 100% of the live-fire test cases, whereas the compared frontier systems struggled to match that level of precise, actionable output.
The Future of Autonomous Defense
This case study underscores a broader, fundamental shift in AI architecture. Rather than relying on a single “all-knowing” model, the most effective systems utilize a modular approach: a high-level reasoning model to orchestrate strategy, and post-trained expert models to handle specific, bounded tasks like code generation or detection repair.
For security organizations, this research provides a clear roadmap:
- Assign clear responsibilities: Separate orchestration from task-specific execution.
- Leverage domain-specific post-training: Use specialized data and verifiable rewards to sharpen models.
- Ground the output: Ensure every automated action is validated against real-world telemetry and independent expert checks.
As CrowdStrike continues to advance these capabilities within its Falcon platform, this collaborative effort stands as a proof-of-concept for the next generation of cybersecurity—one where the defense doesn’t just wait for the next attack, but actively evolves to meet it.
