- Published on
Building an Adaptive Agentic Cybersecurity System with NVIDIA Nemotron
- Authors
- Name
- DeepHorus
NVIDIA and CrowdStrike evaluated an agentic attack-defense system in an isolated environment modeled on NVIDIA accelerated computing infrastructure. The work pairs NVIDIA Nemotron models with CrowdStrike SafeMind, an agentic cybersecurity system. The goal is to automate continuous offense-defense testing and expose defense gaps.
Many security teams use agents in security operations, but many implementations rely on existing alerts, predefined workflows, and known attack behaviors. The harder problem is finding what defenses miss and turning gaps into reliable coverage. That requires repeated adaptive attack testing and validation against normal enterprise activity.
Traditional red-and-blue exercises depend on manual handoffs. Red teams attack, blue teams review telemetry, engineers update detections, and red teams retest. Each handoff takes time, limiting iterations and attack variations.
The proposed closed loop has four stages: execute and capture, process and reconstruct, generate and validate, and retest, adapt, and repeat. A red-agent harness executes a threat-informed attack path while CrowdStrike Falcon sensors capture telemetry. Its action trace records each step.
The blue-agent harness receives the action trace, sensor telemetry, and attack context. Grounded in available data sources and CrowdStrike detection expertise, it finds what can be reconstructed, which detections triggered, and where gaps remain. It generates candidate detections.
A validation harness backtests each candidate against captured telemetry, returns failures for correction, and sends validated detections to the detection engine. An independently seeded attack then retests the same objective. Detection context returns to the red-agent harness, which adapts and explores alternative evasion paths.
CrowdStrike reports its Blue Solano defensive model is more accurate than the leading proprietary frontier model tested, at 99% lower cost, in internal evaluations. The optimized configuration paired NVIDIA Nemotron 3 Ultra for defensive orchestration with a fine-tuned Nemotron 3 Super for detection generation. The setup aims to run the loop at machine speed and scale.
The work signals a shift toward adaptive, continuous cybersecurity. Connecting red and blue agents could help organizations test defenses more often and improve coverage. Future iterations may further reduce manual effort and scale validation across complex environments.
