The AI control plane is emerging as the next contested layer of enterprise security, as autonomous agents spread across endpoints, cloud workloads and identity systems faster than most organizations can inventory them. A year of agent-driven attack activity has replaced the question of which model performs best with a harder one: Who governs the machines already operating inside the business?

That shift is pushing cybersecurity out of its traditional role as one layer in the technology stack. CrowdStrike Holdings Inc. used its Fal.Con conference to press the point, introducing SafeMind, a family of purpose-built security models and harnesses created with Nvidia Corp. The industry drew the wrong lesson from the year’s most-discussed agentic incident, according to George Kurtz (pictured), president, chief executive officer and founder of CrowdStrike.

“The industry got lucky that they were just cheating on a test,” Kurtz said. “The defenders didn’t have the same AI as the offense. This was the missing element. It really highlighted the fact that advanced AI, frontier-capable AI, wasn’t in the hands of the defenders, and that’s the key.”

Kurtz spoke with theCUBE’s Dave Vellante and Rebecca Knight at the Fal.Con event during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed agent governance, purpose-built security models and the economics of the Falcon platform. (* Disclosure below.)

Falcon as an AI control plane for agents and identity

The case for security as an AI control plane rests on where AI is consumed rather than where it is built. Inference runs on endpoints and in cloud containers, environments that CrowdStrike already covers, and the company’s Signal AI acquisition extends that visibility into the identity layer, Kurtz noted.

“Our ability to actually create a control plane around how agents operate — first of all, where are the agents? Because you can’t even find them,” he said. “Number two is what are they doing? Are they touching data they shouldn’t be touching? Are they connecting to systems they shouldn’t be connecting to?”

Purpose-built models present an economic argument as well. SafeMind runs an offensive model that finds the attack path alongside a defensive model that closes it, with harnesses operating the two models in the same loop. CrowdStrike is measuring that system against general-purpose alternatives and offering customers both, Kurtz explained.

“We were 52% better than the best frontier model in terms of identifying vulnerabilities and issues in our test,” he said. “The second piece is we were 98% cheaper. The frontier labs have great technology. We all use it, but they’re not security people.”

The payoff from an AI control plane, in Kurtz’s framing, arrives only when the security operations center can act without a human reviewing every step. He laid out five levels of autonomy for the SOC last year and is now targeting the top of that scale.

“Part of why we started the Cyber Superintelligence Lab is to be able to build these sort[s] of technologies so that we can get to a level of automation where the car drives itself,” Kurtz said. “Maybe the human has to be in the loop, and if something’s really critical, fine. If you can automate the most mundane task and you can do it with the speed at which the adversary is moving, that’s going to be critical.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the Fal.Con event:

(* Disclosure: TheCUBE is a paid media partner for the Fal.Con event. Neither CrowdStrike, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE