Two Models Fighting Inside a Digital Twin of Your Environment Until No Path Remains: CrowdStrike and Nvidia Launch SafeMind
CrowdStrike unveiled SafeMind with Nvidia at Fal.Con 2026, built from two models: Red Tempest, an offensive model emulating adversaries to find attack paths, and Blue Solano, a defensive model fine-tuned from Nvidia Nemotron 3 Super that deploys remediations, with a Nemotron 3 Ultra instance orchestrating the defensive agent harness. It runs as a closed loop: Falcon sensors build a digital twin of the enterprise environment — asset inventories, identity stores, threat graphs, adversary intelligence — Red Tempest attacks it repeatedly, and Blue Solano learns from each attempt and deploys new detections until no viable attack paths remain. Training data includes Falcon sensor telemetry, CrowdStrike threat intelligence, Falcon Complete MDR annotations and 15 years of incident-response knowledge. CrowdStrike says internal evaluations found Blue Solano more accurate than the frontier models tested, at 99% lower cost.
