CrowdStrike's CEO says AI has flattened the attacker pyramid

George Kurtz, CEO of CrowdStrike, argued on the No Priors podcast that AI has flattened the ladder of attacker skill. In his telling, the least skilled attackers can now do what only nation states could manage a few years ago.

What was said

Kurtz described a pyramid of attackers. At the base are hacktivists: the least sophisticated, but the most numerous. In the middle are criminal groups. At the top are nation states: the most skilled, but the fewest. AI, he said, has blown that shape apart. In his words, "the new apex predator is the agent state, not the nation state." He went on: "So the same level of sort of capability that a nation state would have just a few years ago, essentially a hacktivist would have today."

His mechanism was open-weight models, whose files anyone can download and run. He said the guardrails on the newest frontier models are so tight that they barely let you make a slide deck on cybersecurity. Some open models have their safeguards removed or are built just for cyber work. He runs models on two AI machines at home and said making ransomware with them is no problem.

He also gave a speed figure. CrowdStrike tracks breakout time: how long an intruder needs to move from the first machine to others. He raised it when discussing criminal groups. Kurtz said it used to be days or hours and now averages 29 minutes. The fastest he has seen is 27 seconds.

Why it matters

Kurtz did not say how teams prioritise threats. His speed figures also do not break out hacktivists, so any claim that a low-profile group moves just as fast is our inference, not his. If it holds, a process that waits for a person to open a ticket may be too slow against a 29-minute average. Buyers can ask vendors how fast a tool contains an intruder, not only how well it names one. Kurtz also flagged a second gap. Firms give their own AI agents an identity, and he said nobody is watching what those agents do.

The other side

Kurtz runs a security company, so he has reason to stress the threat. His hacktivist example is a broad claim, and the excerpts give no count of groups that now match nation states.

He also conceded that speed is only a temporary tell. Today, he said, AI attacks stand out because they iterate so fast. Later, attackers may go low and slow, and then AI activity will be harder to spot. That limits speed as a lasting signal.

He added that even with zero software flaws, which he hopes the industry can reach, breaches will still happen. The excerpts do not say what defenders should do once speed stops giving the game away.