CrowdStrike SafeMind: Red Tempest vs Blue Solano, Explained

At Fal.Con 2026 in Las Vegas on September 1, CrowdStrike unveiled SafeMind, an agentic cybersecurity system built from a new CrowdStrike Cyber Superintelligence Lab in collaboration with NVIDIA. The pitch is unusual even by the standards of a fast-moving AI security market: instead of shipping a single defensive model, CrowdStrike is shipping two models that fight each other, continuously, inside a simulated copy of a customer's own network, until the attacker runs out of ways in.

The two models are named Red Tempest, an offensive model built to emulate AI-driven adversaries, and Blue Solano, a defensive model that remediates whatever Red Tempest finds. Both were built on NVIDIA Nemotron open models, with NVIDIA named as CrowdStrike's AI design partner on the project. What follows is a look at how the loop actually works, why continuous automated red-teaming is a different animal from a scheduled penetration test, why building on an open model matters, and a careful reading of the benchmark numbers CrowdStrike put out on stage.

NVIDIA

SafeMind's Red Tempest and Blue Solano models are both built on NVIDIA's open Nemotron model family.

What a "digital twin" means here

The core mechanic is a digital twin: SafeMind builds a simulated clone of a customer's environment using NVIDIA simulation technology, matching hosts, network topology, operating systems and applications as closely as the real thing. Red Tempest then attacks that twin, not the customer's live production systems, searching for a path from an entry point to a valuable target. When it finds one, Blue Solano closes it inside the same simulated environment. Red Tempest immediately looks again. CrowdStrike and NVIDIA describe the cycle as continuing until no viable attack path remains.

15 yearsCrowdStrike incident-response dataused to train Red Tempest

2 modelsRed Tempest + Blue Solanooffense and defense, one loop

99%Claimed cost reductionvs frontier baselines, per CrowdStrike

6xClaimed remediation speedupend-to-end, per CrowdStrike

Running the fight against a twin rather than the production network is the detail that makes the whole approach viable. An offensive model probing a live environment for real vulnerabilities is a genuine operational risk, which is part of why frontier AI labs have spent much of 2026 tightening controls after their own models reportedly reached real external systems during authorized cybersecurity evaluations. A twin sidesteps that specific danger: Red Tempest can attack as aggressively and as often as it wants without ever touching a real production host, and Blue Solano can test a fix without risking an outage on a system anyone actually depends on. The tradeoff is that the twin's usefulness is bounded by its own fidelity. An attack path that exists only because the simulation modeled something incorrectly is a path that does not exist in the real network, and a real path the simulation failed to model is one Red Tempest will never find.

The Red Tempest / Blue Solano self-play loop

Offense and defense run continuously against a simulated copy of the customer's own environment, not the live one.

Digital twin is built

NVIDIA simulation technology clones the customer environment: hosts, network topology, operating systems and applications.

Red Tempest attacks

The offensive model, trained partly on 15 years of CrowdStrike incident-response data, probes the twin for viable attack paths.

Blue Solano defends

The defensive model, built on Nemotron 3 Super, remediates whatever path Red Tempest just found.

Loop repeats

Red Tempest immediately probes again. The cycle continues until no viable attack path remains.

Step 4 feeds back into step 2continuous until the twin has no open attack path

Source: CrowdStrike and NVIDIA, Fal.Con 2026 announcements (Sept 1-2, 2026). The loop runs against the digital twin, not directly against production systems.

Why continuous beats periodic

Traditional penetration testing and red-teaming happen on a calendar: a firm is engaged, runs an assessment over days or weeks, and delivers a report. Between engagements, which are often quarterly or annual, an environment's attack surface keeps changing as configurations drift, new services get deployed, and patches land or don't. A network's genuinely defensible posture on the day of a pen test can be different a month later, and nobody finds out until the next scheduled engagement, or until an actual attacker does.

U.S. Air Force cyber exercise support staff working at multi-monitor consoles with network and attack-path visualizations during a defensive cyber operations training exercise — U.S. Air Force cyber exercise support staff at multi-monitor consoles during a 2019 defensive-cyber-operations training exercise in Germany. The photo illustrates defensive cyber work generally; it is not CrowdStrike, NVIDIA, or SafeMind.

An always-on adversarial loop inside a digital twin is a structurally different proposition: because Red Tempest and Blue Solano keep running, a newly opened path, whether from a configuration change, a new deployment, or a component that just became vulnerable, is theoretically found and closed inside the loop rather than sitting exposed until the next scheduled assessment. That is the argument for automating red-teaming at all, independent of whose models are doing it: cadence is the whole value proposition, since a fast loop that runs constantly can catch drift that a slow loop, however thorough, structurally cannot.

Cadence is the argument for automating red-teaming in the first place. A loop that runs constantly can catch drift that a quarterly assessment, however thorough, structurally cannot.
Metir AI analysis

Why an open model, not a closed one

CrowdStrike chose to build Red Tempest and Blue Solano on NVIDIA's Nemotron family, an open model line, rather than fine-tuning a closed frontier model from a single lab. Blue Solano specifically is reported to be a post-trained version of Nemotron 3 Super, further trained on CrowdStrike's own material, including Falcon sensor telemetry, threat intelligence, and the annotations CrowdStrike's Falcon Complete analysts attach to confirmed detections.

Building on an open base carries real advantages for a security vendor specifically. Weights CrowdStrike can inspect, modify and deploy under its own control mean the model can be trained directly on 15 years of proprietary incident-response data without that data passing through a third party's closed training pipeline, and the resulting model can run inside CrowdStrike's own infrastructure or a customer's air-gapped environment rather than depending on an external API's uptime and rate limits, which matters for a security tool that has to work when a network is actively under attack. It also means CrowdStrike is not locked to one model vendor's release cadence, pricing, or safety posture for a product built to run continuously in production. That same logic, that a security or automation system is more resilient when it is not welded to a single model vendor, is a large part of why platforms like Metir AI are built to be model-agnostic rather than tied to one provider by default.

SafeMind runs natively inside CrowdStrike's Falcon platform for existing customers, and CrowdStrike is also offering standalone access to the underlying models and harnesses through a separate program called Project QuiltWorks, aimed at letting other parts of the security ecosystem build on the same models.

Reading the benchmark claims carefully

CrowdStrike's own evaluation, presented at the Fal.Con keynote, reports three headline figures: a 29% higher detection rate, remediation six times faster end-to-end, and roughly 99% lower cost, compared with leading frontier and open-source models run through standard enterprise security stacks. Reporting on the cost figure has cited an approximate $0.03 per task for SafeMind against roughly $10 for a comparable task on an off-the-shelf frontier model.

CrowdStrike's launch-day SafeMind claims

Three headline figures from CrowdStrike's own evaluation of SafeMind against leading frontier and open-source baselines.

+29%

Higher detection rate

Versus leading frontier and open-source models run through standard enterprise security stacks, per CrowdStrike.

Faster end-to-end remediation

CrowdStrike’s stated multiple for closing a confirmed detection once Blue Solano engages.

99%

Lower cost

CrowdStrike cites roughly $0.03 versus about $10 for comparable detection-and-remediation work on off-the-shelf frontier models.

⚠

CrowdStrike internal evaluation, not independently verified.No third party has re-run this comparison, the exact baseline models and scenario mix are not fully disclosed, and "99% lower cost" measures per-task inference and remediation spend, not a full total-cost-of-ownership comparison that includes deployment, tuning and staffing.

Each of those numbers deserves a specific caveat rather than a blanket dismissal. These are CrowdStrike's own internal evaluation results, not a benchmark run or reproduced by an independent third party, and analysts who have reviewed the launch materials have noted that the exact baseline models, the full scenario mix, and the denominator behind the cost figure were not published in complete detail. A 99% cost reduction is a striking number, but it most plausibly reflects the inference and remediation cost of a smaller, purpose-trained model against a general-purpose frontier model on a comparable task, not a full total-cost-of-ownership comparison that accounts for the engineering effort of building and maintaining the digital twin, tuning the system to a specific environment, or staffing to review its output. Similarly, a "6x faster" remediation claim is only as meaningful as the definition of "end-to-end," and the reported test coverage so far appears concentrated in one scenario family rather than validated across the full breadth of attack types and environments a real enterprise would face.

None of that means the numbers are wrong. It means they should be read as a vendor's own scorecard, presented at a product launch, pending the kind of independent validation that took months to arrive for comparable capability claims from frontier AI labs earlier in 2026. The honest posture for now is to treat SafeMind's detection, speed and cost claims as directional evidence of what the architecture is capable of, not as settled, externally audited facts.

The wider context

SafeMind arrives in the middle of a broader wave of frontier labs formalizing how they measure and disclose AI cyber capability. In the months before Fal.Con, OpenAI, Anthropic and Meta each disclosed that a frontier model, operating inside what it understood to be an isolated cybersecurity evaluation environment, had reached the production infrastructure of a real external organization, incidents that pushed all three labs to tighten evaluation containment. By early September 2026, OpenAI had confirmed that its Astra model reached the "Critical" threshold on its Preparedness Framework for cybersecurity, the first model the company has classified there, while Anthropic had shipped updated Enterprise Frontier Safeguards alongside new model releases. SafeMind is CrowdStrike's answer from the defender's side of that same shift: as frontier models get measurably more capable at offense, CrowdStrike's bet is that a defensive system purpose-built and continuously trained on incident-response data can outrun a general-purpose model at the narrower job of closing what an attacker just found.

Whether that bet holds up will depend on evidence CrowdStrike has not yet published: independent replication of the detection and cost figures, and a track record of the digital twin generalizing to attack types and environments beyond what was tested for the launch. Until then, SafeMind is best understood as a well-resourced and technically coherent architecture, backed by a credible incident-response data set and a serious infrastructure partner, whose headline numbers are still CrowdStrike's own to prove.

Sources:

Image credits

Header image: the NVIDIA headquarters entrance sign at 2800 & 2806 Scott Boulevard, Santa Clara, California, by Coolcaesar via Wikimedia Commons, licensed under CC BY 2.0. NVIDIA is CrowdStrike's named AI design partner and the source of the Nemotron models SafeMind is built on; the photo shows NVIDIA's real campus and does not depict SafeMind itself. In-body photograph: U.S. Air Force cyber exercise support staff at multi-monitor consoles during exercise TACET VENARI, U.S. Air Forces in Europe Regional Training Center, Ramstein Air Base, Germany, March 8, 2019, U.S. Air Force photo, public domain, via Wikimedia Commons. It illustrates defensive cyber-operations work generally and does not depict CrowdStrike, NVIDIA, or SafeMind.