The AI edge that helps defenders is helping attackers just as much

Enterprise security is shifting towards AI detection and response systems as autonomous agents transition from experimental pilots to production environments capable of carrying out tasks and adapting independently. These same advanced capabilities that assist defenders also empower attackers, prompting boards to question the extent of visibility their security teams can achieve.

This heightened pressure has swiftly translated into a purchasing priority for cybersecurity firms over the past year, transforming agent oversight from a theoretical concept into a concrete business decision. Recent findings from CrowdStrike's "2026 Global Threat Report" reveal that the average time to initiate an eCrime attack has plummeted to just 29 minutes, with the quickest intrusions measured at only 27 seconds, according to Michael Sentonas, president of CrowdStrike Holdings Inc. "I've never witnessed anything like it, and I've never seen anything progress at this pace," Sentonas remarked.

"Boards convened at our briefing center in California, demanding clarity on appropriate actions. I even dined with the CEO of a major bank who sought assurance regarding his security team's adequacy and his support for the CISO, as the threat landscape continues to intimidate them." Sentonas engaged in a detailed discussion on theCUBE's livestreaming platform during Fal.Con, where CrowdStrike unveiled the general availability of Falcon Guardian, expanding its solitary sensor architecture to encompass agents during operation.

This product stems from CrowdStrike's acquisition of Pangea Cyber Corp., although its overarching objective transcends any single tool, as explained by Sentonas. "Pangea bestowed upon us AIDR, which stands for AI detection and response, prompt security. We envisioned AIDR not merely as a product, but rather as a category, incorporating the AIDR gateway, prompt security, model security, and harnesses."

Furthermore, CrowdStrike inaugurated a Cyber Superintelligence Lab built upon specialized models trained on its proprietary threat data. Sentonas cautioned that while frontier models excel at identifying vulnerabilities, they leave customers with a myriad of unresolved issues. "We believe that constructing a superior red teaming model to uncover these issues is feasible, but equally vital is the blue team model.

On the one hand, we identify the problems. On the other hand, we furnish you with the resolution. Until our red team model falters, we can ascertain your security status. No entity has achieved this."