NVIDIA and CrowdStrike Build Adaptive Agentic Cybersecurity System with Nemotron

NVIDIA and CrowdStrike have jointly developed and evaluated an agentic, closed-loop cybersecurity system that automates continuous offense-defense testing at machine speed. The collaboration addresses the manual bottlenecks of traditional security operations by deploying specialized large language models within an isolated environment modeled after NVIDIA accelerated computing infrastructure. The system leverages NVIDIA Nemotron models integrated into CrowdStrike SafeMind to automate detection engineering, telemetry analysis, and adaptive attack simulation. The architecture operates through a four-stage automated workflow. An offensive agent harness executes threat-informed attack paths while CrowdStrike Falcon endpoint sensors capture telemetry. A defensive agent harness processes this data to identify coverage gaps, generate candidate detection rules, and validate them against captured traces. Validated detections are deployed, after which the offensive agent adapts its strategy to test evasion capabilities, repeating the cycle until defensive coverage is maximized. This closed loop eliminates manual handoffs, enabling rapid iteration across thousands of attack variations. To optimize the system, NVIDIA separated orchestration from specialized detection engineering. NVIDIA Nemotron 3 Ultra handles high-level planning and workflow coordination, while a customized Nemotron 3 Super model, fine-tuned by CrowdStrike for security detection authoring, manages rule generation and repair. The specialized model was trained using 9,349 detection-generation examples spanning multiple error types, combined with continual pretraining on cybersecurity knowledge and reinforcement learning with verifiable rewards. This training pipeline utilized NVIDIA NeMo Gym to execute and validate queries in Falcon LogScale, applying group relative policy optimization to reward models that produced accurate event matches rather than merely syntactically correct code. Evaluation results demonstrate significant performance gains over traditional approaches. Backtesting against recorded attacks showed that the optimized open-model pipeline improved detection generation by 2.5 times compared to using a default harness with Nemotron 3 Ultra alone. In live-fire testing against eight unseen attacks, the open pipeline proved more resilient than a leading proprietary frontier model. While the frontier system achieved a 29 percent detection rate, the optimized Nemotron configuration fired in 45 percent of cases and averaged 2.6 detections per attack path, compared to 1.1 for the frontier system. After rigorous validation for behavioral alignment and noise suppression, the open pipeline produced three gold-standard detections that successfully covered all eight unseen attacks, outperforming the frontier model which yielded zero gold detections in the same category. The evaluation confirms that decoupling orchestration from domain-specific tasks, paired with rigorous agent harness validation, significantly enhances detection accuracy and generalization. CrowdStrike is integrating this agentic workflow into its SafeMind platform, establishing a continuous coevolution loop between offensive and defensive AI. The architecture and training methodologies provide a scalable template for deploying specialized AI agents across bounded cybersecurity domains, reducing reliance on manual security operations while improving adaptive threat coverage.