ExpertsFMThe New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents
No Priors: Artificial Intelligence | Technology | Startups · October 22, 2026
5 Selected Lessons:
framework · 2 heuristic · 2 case · 1
Pyramid of pain flattened into the 'agent state'
Source
No Priors: Artificial Intelligence | Technology | Startups — The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents (October 22, 2026) · at 0:00 ▸ · at 2:45 ▸
When this applies
when a new general-purpose capability tool becomes available to anyone, assess whether it collapses the skill/resource barrier that used to separate elite actors from amateurs
The takeaway
When a powerful general tool becomes freely accessible, it doesn't just help the strong get stronger — it erases the capability gap between weak and strong actors entirely.
Why it works
Unguarded/ablated models package years of nation-state-level technique and cost into something a single low-resource actor can run, removing the sophistication and capital barriers that used to separate tiers of adversary.
One level up
Any technology that democratizes a previously scarce capability should be assumed to flatten the competitive hierarchy built on that scarcity, not just shift it.
Where it stops holding
This stops working as a threat model once effective guardrails or detection catch up to close the capability gap the flattening created, or once the tool itself becomes closely monitored/regulated.
Detail
approach: Reframe adversary capability not by resources/identity but by what tools they can access; recognize that ablated/open models erase the old tiering.
signals:
- more vulnerabilities found
- faster attacks
- rapid iteration visible in attack telemetry
rationale: If the base of the pyramid can now operate like the former apex, your defensive posture must assume everyone is a sophisticated actor.
In their words
So, the same level of sort of capability that a nation state would have just a few years ago, essentially a hacktivist would have today. And that has dramatically changed the overall threat environment.
Disrupt yourself: small-squad AI-native operating model inside a large incumbent
Source
No Priors: Artificial Intelligence | Technology | Startups — The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents (October 22, 2026) · at 39:15 ▸
When this applies
when an incumbent organization with large teams and long planning cycles must compete against lean, AI-leveraged new entrants
The takeaway
To compete with faster AI-native entrants, restructure execution into small, empowered teams leveraging AI directly rather than relying on large-team, long-cycle processes, even inside an established company.
Why it works
Waterfall-style development with long schedules and thousands of contributors cannot match the iteration speed of small AI-native teams running agents continuously; replacing that model with small, empowered squads that leverage AI directly (including personal founder/CEO involvement) restores startup-level velocity inside a big company.
One level up
Incumbents must periodically disrupt their own operating model, not just their product, to remain competitive against structurally faster new entrants.
Where it stops holding
This stops working when problems genuinely require large coordinated teams (e.g., due to scale, compliance, or integration complexity) that small squads cannot handle alone.
Detail
procedure:
- Recognize the operating model/cadence must change, not just the product
- Break work into small squads instead of large teams with long schedules
- Have senior leadership (even the CEO) personally embedded in rapid-iteration design meetings
- Continuously ask what your moats are (e.g., system of record, net new data creation) and disrupt yourself before a competitor does
benchmarks: {"example":"Falcon Guardian product built with small-squad, weekly direct CEO involvement","data moat":"7 trillion events/day generated by CrowdStrike's own sensors"}
rationale: You can't be in a waterfall mentality where things pop out a year later — you'll be out of business; smaller teams leveraging AI can match the speed of AI-native startups.
In their words
You can't be in a, not that we are, but you can't be in like the waterfall mentality of development. Like things pop out a year later, like you're going to be out of business.
Proprietary data + harness beats raw frontier model on cost and fit
Source
No Priors: Artificial Intelligence | Technology | Startups — The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents (October 22, 2026) · at 18:54 ▸
When this applies
when deciding build-vs-buy for AI capability in a narrow, high-value domain where you hold unique proprietary data
The takeaway
In a narrow domain where you own unique data unavailable to anyone else, a smaller specialized model plus a good harness can outperform a general frontier model on cost and task-fit, even if it can't do everything the frontier model can.
Why it works
Post-training a smaller model on a decade-plus of proprietary, domain-specific data (that no public dataset replicates) combined with a purpose-built harness yields dramatically better cost-efficiency and fit for the narrow task than a general frontier model, even though the frontier model is more capable broadly.
One level up
Durable competitive advantage in the AI era often comes from proprietary data and the integration layer (harness) around a model, not from the model's raw general intelligence.
Where it stops holding
This stops working when the proprietary data advantage erodes (e.g., becomes available publicly or synthetically reproducible), or when the task requires broad general reasoning the specialized model can't provide.
Detail
rule: Build specialized models on proprietary data plus a custom harness rather than relying solely on frontier lab models for narrow, high-value tasks.
threshold: Cost example: ~$10 per remediation using the highest-caliber frontier cyber model versus ~3 cents using CrowdStrike's own post-trained model.
rationale: There is no public dataset equivalent to 15 years of proprietary threat/vulnerability pairing data; synthetic data isn't the same, and the harness alone materially improves results from any underlying model.
In their words
So, just to give you an example, so for general remediation, if you use like the highest caliber Frontier cyber model, it probably costs you about $10. Ours is like three cents.
AI sovereignty / trust as a competitive moat
Source
No Priors: Artificial Intelligence | Technology | Startups — The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents (October 22, 2026) · at 22:07 ▸
When this applies
when customers hold data so sensitive that losing control of it (even to a capable third party) is an unacceptable risk
The takeaway
When your core offering depends on handling customers' most sensitive data, the trust built from safely stewarding that data over time becomes a moat that is independent of raw model capability.
Why it works
Long-standing data custodianship builds an accumulated trust asset that is costly and slow to replicate; offering customers routing choice between proprietary and frontier models converts that trust into a durable service advantage.
One level up
Trust compounds slowly and collapses quickly — treat it as a scarce asset to be protected, not a byproduct of doing business.
Where it stops holding
This stops working when customers no longer care about data sovereignty (e.g., for low-sensitivity use cases) or when a competitor can offer equivalent trust guarantees without the history.
Detail
rule: Give customers choice to route between proprietary models and frontier labs rather than forcing all data to flow to external labs.
threshold: Trust is 'built in drips and lost in buckets' — implying trust erosion is nonlinear and must be guarded conservatively.
rationale: Customers don't want sensitive information trained on by third parties; a trusted intermediary with its own models captures this preference as a structural advantage.
In their words
So I think the number one factor in security is being trusted, being a trusted partner
CrowdStrike's platform expansion from 1 to 33 modules
Source
No Priors: Artificial Intelligence | Technology | Startups — The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents (October 22, 2026) · at 16:32 ▸
When this applies
when your original product category becomes too narrow for the evolving threat/opportunity surface
The takeaway
Grow your platform by continuously following where the attack/opportunity surface is expanding, instrumenting visibility first, then control.
Why it works
As the enterprise surface diversified (cloud, IT, identity, now autonomous agents with their own identity/compute/network access), a vendor that keeps instrumenting each new category from first principles (visibility, then policy/blocking) captures each new wave rather than being disrupted by narrower point solutions.
One level up
Durable platform companies expand scope in step with the changing shape of the problem they solve, rather than staying fixed on their founding product.
Where it stops holding
This stops working when expansion dilutes focus or quality in the core product, or when a new category requires fundamentally different technical competencies the company lacks.
Detail
situation: CrowdStrike started with one module (endpoint protection) 15 years ago.
decision: Expanded into cloud, IT, identity, and now AI agent detection/response (AIDR), instrumenting agent behavior from 'birth' through sub-agents, tool calls, and MCP server interactions.
outcome: Now operates 33 modules; sees AI agent security (with up to 90 agents per employee reported industry-wide) as a bigger opportunity than the original EDR business.
lesson: Following the expanding shape of the problem (shadow AI, agent sprawl) rather than defending a static product category created a larger total addressable opportunity.
In their words
We've really, probably over the last four or five years, I guess, really moved into much broader platform capabilities. We've got 33 modules today. And ultimately, when I started the company, we had one module, and now we've got 33.