CrowdStrike Fal.Con 2025 | Elia Zaitsev, CrowdStrike

Clips
More from CrowdStrike Fal.Con 2025

Elia Zaitsev

Global CTO

CrowdStrike

play_circle_outline Discussion on the importance of adapting to AI in cyber security for defenders.

play_circle_outline The enterprise graph allows natural language queries across multiple data systems easily.

play_circle_outline Comparative advantages of CrowdStrike’s agent builder over generic options in several dimensions.

play_circle_outline The significance of data quality, security context, integration, and governance in agentic systems.

play_circle_outline Insights on board members' concerns regarding AI security and digital transformation.

Info
Transcript

Elia Zaitsev, CrowdStrike

Elia Zaitsev

Global CTO CrowdStrike

Straight from Las Vegas at the MGM Grand, theCUBE brings you inside CrowdStrike Fal.Con 2025. Rebecca Knight and Dave Vellante sit down with CrowdStrike chief technology officer Elia Zaitsev for a fast-paced look at how AI is changing security operations in real time. Zaitsev breaks down Enterprise Graph as an abstraction layer across CrowdStrike’s data estate, describing it as a “graph of graphs” that lets humans and agents ask plain-English questions and get optimized answers across identity, endpoint, cloud and vulnerability data. He connects this foundati... Read more

explore Keep Exploring

What is the significance of the enterprise graph and how does it impact the development of AI technologies? add

What is the role of the enterprise graph in simplifying complex queries for humans and AI agents? add

What are the dimensions and key aspects that differentiate CrowdStrike's agent builder from other generic agent builders? add

What are the advantages of building on a particular platform, and how do partnerships with other companies enhance its capabilities? add

What are the primary concerns of C-Suite executives regarding the adoption of AI and digital transformation, particularly in relation to security? add

bolt Powered by CUBE AI

Elia Zaitsev, CrowdStrike

search

Rebecca Knight

>> Good morning everyone, and welcome back to theCUBE's Live coverage of Falcon 2025 here at the MGM Grand in Las Vegas. I'm your host, Rebecca Knight, alongside my co-host and analyst, Dave Vellante I would like to welcome back to theCUBE, Elia Zaitsev. He is the Chief Technology Officer at CrowdStrike. Thank you so much.

Elia Zaitsev

>> Thanks for having me back.

Rebecca Knight

>> Yeah, so we were all fresh from the main stage where Michael Satonis was up there talking about how AI is really rewriting the rules of cyber security. And he asked a question, can we, as defenders, adapt faster than our adversaries? Elia, what's your answer to that?

Elia Zaitsev

>> I think absolutely we have no choice. We have to, right? We have to get there, and it's something that we've been building our platform towards for several years now. And one of the big announcements that George talked about, and Mike talked about a little bit of a tease, teeing me up for my keynote tomorrow, is this big investment we made in the enterprise graph, which is this system that we built that combines everything we've done on the platform to date so far, simplifies it, abstracts it, normalizes it all together and has a lot of benefits for our end users, even for our developers, as they look to harness the power of all the data we collect. One of the other major benefits that it brings is the interface it creates is actually tailor-built for AI and agentic systems. One of the things that's a little bit, we have to think about it a little bit different from a mindset perspective when we're building technologies and platforms with AI is we need to think about the slope of the accelerating slope of the innovation curve there. The technology that we have today, the intelligence even 12 months ago, it's orders of magnitude more powerful and that's increasing. So if you take a traditional product development approach where you sit down and you think about, okay, what are the pain points our customers have today? What can our technology solve today? Let's go build out those use cases. Let's spend 3, 6, 12 months delivering that. If you take that approach, by the time you ship your capabilities, the intelligence systems that you have now at your disposal, the use cases, the problems you can solve, now you're already behind and the adversary isn't waiting that long. So by building these deep investment in our platform, in our architecture, we also want to take a different mindset, which is build a platform, start building a platform now, and we've successfully delivered that, that allows us to integrate and bring in any black box intelligence system, any agentic capability that we don't even know exists today, but we could slot in at any point in time so that when the latest and greatest intelligence system is available, we don't have to wait 12 more months to integrate into our platform. Our platform is designed from the ground up to be agentically operated and managed. So I'm really excited about that.

Dave Vellante

>> Can you add some color, technically, on the enterprise graph, because graph databases have been around for a long time. They're obviously ascending now with AI. The challenge with graph has always been, they're so expressive, but to actually query them, you got to go back 15 years and it's sort of the dark ages, and now we're seeing a lot more facile ways to interact with graph databases. But in security, it's always been a great use case. And I want to tie it in to agentic workflows. So when you think about things like AgentWorks, building your own agents, and you think about the secret sauce around your graph database, how should we think about those workflows? In enterprise use cases, I think about paving the cow path, I call it. We don't want to just apply intelligence to a workflow that could be improved. Is there an analogy like that in security where you've got these fossilized workflows, but with agentic, you could actually reform those workflows, do it much more efficiently, much more quickly. So a two part question is; can you double click on the secret sauce of your graph, and what about that workflow reformatting question?

Elia Zaitsev

>> So I'm going to let you all in on a little bit of a secret. The enterprise graph is not really a graph and it's not really a database. It's actually a unification of all the other graph and non-graph systems that we've been building and investing in for many years. And you're right, graphs are really good at certain types of problems like understanding relationships and traversing those relationships and seeing how they build out over deeper and deeper levels. But even we have multiple graph systems already in our platform. For example, threat graph and asset graph. Why do we have two different graph systems? Well, they're built to solve different sorts of use cases and they have different performance requirements and optimizations built in. And by the way, a graph system isn't the right database for every single problem out there. That's why we have next-gen SIEM built on top of log scale. We've got relational databases, we've got time series systems that are keeping track of state, et cetera, et cetera. The point here is that depending on the problem you want to solve a different database system, a different data layer will be more optimized to some of those use cases, but not optimized to some of them. So we've built multiple systems here so that we don't have to deal with where unoptimized, we can pick the right one when it's the best system suited for the job. So that's the historical architecture. What's happened now, though, is we have all these different systems. They have different nuances, different query language, different data models, and even just understanding as a human, and definitely as an agentic system, if I'm trying to solve this complex question that may require me to use multiple data systems, graph and non-graph alike, which one do I pick? Sometimes two different systems will even have the same piece of data, but depending on how you're trying to interact with it, one is going to be better suited to solving your complex question than the other one. So how do we deal with this? All right, it's become a pretty significant mental burden on the humans, and the AI agents, they don't out of the box know all these different nuances. They're not trained that necessarily in all these different query languages, et cetera. So what do we do? And that's where the enterprise graph comes in. So the enterprise graph is actually this abstraction layer that sits on top of all these systems and it allows a human or an agentic system to ask pretty much in plain English language, "Hey, tell me about, answer this question that involves information about cloud and identity and endpoint and vulnerabilities." I'm not asking it to say, "Go to this module, go to that module, go to this graph database. I'm just telling it what I want it to do, and the agentic system, through this abstraction layer, it'll ask that question. And then this magic layer, this enterprise graph layer will figure out, based on the question you're asking me, I'm going to pick these systems. These are the optimized best systems to answer that request, sometimes more than one. And then it'll do the translation for you in that plain, simple English language to all the nuances and details and the underlying query syntaxes of all those systems. And that gets hidden away from the user, but it also gets hidden away from the agent. So the agent is now able to basically reason in natural language, which it's trained to do out of the box. We don't have to spend any additional time now teaching it all the nuances of our platform and which database does what and how to write the queries. It's just going to reason and execute those requests. And the enterprise graph will take care of making sure it's being done the most efficiently and the most performative manner possible. It also means that as we bring in new data and connect new systems into the platform, we don't have to now waste precious months to retrain or update these systems. It's just able to take advantage of this all out of the box because of that abstraction. So going back to your question now on the workforce side.

Dave Vellante

>> So can I just follow up on that?

Elia Zaitsev

>> Sure, sure.

Dave Vellante

>> So that says to me that that abstraction layer is not a graph. You call it a graph, but it's actually a map.

Elia Zaitsev

>> It's like a graph of graphs.

Dave Vellante

>> It's a graph of graphs. I think of it as a map. Is that the wrong way to think of it?

Elia Zaitsev

>> No, I think that's a good analogy. It's a map of your enterprise.

Dave Vellante

>> And it's a multi-dimensional app. It's not like a two-dimensional app, like a map like customer and location. It's maybe a 4-D map, or I don't know.

Elia Zaitsev

>> It's got time, it's got location, it's got different security domains.

Dave Vellante

>> Identity.

Elia Zaitsev

>> Exactly. Identity, data, users.

Dave Vellante

>> And it's able to... I think at databases you store data in strings that databases understand, but this abstraction puts things in the concept of things, that humans.

Elia Zaitsev

>> The technical term we use is semantic. Semantic objects. We're not talking about a vendor-specific or a product-specific field name, which we have to then teach and translate the AI systems. We're asking it to think in semantic concepts like a machine, a user, an identity.

Dave Vellante

>> People.

Rebecca Knight

>> So words.

Dave Vellante

>> What was that?

Rebecca Knight

>> Words, a semantic concept is a word.

Dave Vellante

>> People, places.

Elia Zaitsev

>> Exactly, in large language models, language is in the name. They're really good at words.

Dave Vellante

>> So people, places, things, activities that humans can understand.

Elia Zaitsev

>> Exactly.

Dave Vellante

>> And then the other follow up is, that suggests you have all this data in different systems. You've had to harmonize that data in order to be able to serve it up so that agents can act confidently.

Elia Zaitsev

>> Correct. So you can take an AI system and stick it against these traditional independent databases and ask it to do some things, and it'll sometimes get it right and it'll fail a lot and it'll make mistakes. And when you swap out the same data, same capabilities, but you give it this new interface that's designed out of the box to work with these agentic systems, the same requests, the efficacy rates just skyrocket up. It just works much more often and it gives you the data you expect. And to your original question. Now, we don't actually think about how would we construct a workflow today? We don't worry about that anymore. We tell the agents, this is what I want to accomplish. Go use the enterprise graph. You figure out the best way to do that for me. I'm just telling you the outcome that I'm looking for, and it can go deliver and execute that for you.

Dave Vellante

>> So you have, I'm drawing a block diagram in my head and I'm seeing this harmonization layer, or I call it a-

Elia Zaitsev

>> You need a whiteboard next time .

Dave Vellante

>> I know, right, exactly. But I call it a system of intelligence. That's a term that George Gilbert and I have been using, that can interpret context from metrics and dimensions and the business and the activities and then serve up the agents and the agent control framework that's governed. Is that a reasonable representation of what you guys have built? Is that your<.

Elia Zaitsev

>> Absolutely. That's why the other side of this coin, enterprise graph was probably, in my opinion, the biggest thing where we've announced, the other big one that you already touched on is AgentWorks letting our customers and our partners come and develop their own agents. And the reason this works and it works so effectively and doesn't require expert IT teams and programmers is because one, it's built on top of this enterprise graph foundation. So we can, in fact, just develop these new agents with natural language. Now we're saying you don't have to be a developer anymore to create and customize systems on this platform and integrate with third parties. You just have to be able to, I was going to say type out written language, but let's be honest, there's really good speech-to-text systems, too. So you could be functionally illiterate now and still create agentic systems, tell them what you want to do, and again, it can tap into the enterprise graph. So it's just going to know how to follow those instructions without you needing to be an expert in the platform. And we've got that enterprise-grade security and governance identity and data protection built into it, so you can build with confidence and start to create workflows, customize your organization that we, frankly, never even dreamed of. But because you're powering it with the enterprise graph, it's going to work at very high efficacy rates without having to have the customer bring in teams of data scientists to make sure it works after painstaking fine-tuning and iteration.

Dave Vellante

>> So when George, on his keynote yesterday when he announced AgentWorks, I was like, well, why should I use George's agent Builder versus something from some other company, AWS or Google? And then he immediately answered that. And so, it was basically a data. So I had a conversation last night with my friends, Chat GPT and Claude and Grok saying, "What are the dimensions?" Imagine you're CrowdStrike and you've got this agent builder capability. What are the dimensions in the salient aspects of CrowdStrike's agent builder relative to generic agent builders? And it came up with five: data quality, security context, customization, integration, and governance. And I said, "Well, show me a graph of where, in theory, CrowdStrike will do better." And basically it did better in all of those with the exception of customization, but data quality, security context, integration, and governance. I'm not sure about governance, but the other ones I buy in the context of security. Is that a reasonable way to think about your advantage?

Elia Zaitsev

>> I think so. And actually, let me touch on customization since I guess-

Dave Vellante

>> That was a parody.

Rebecca Knight

>> Chat GPT is not impressed, yet.

Dave Vellante

>> That was a parody. Well, that was not just Chat GPT, it was a perplexity, Chat GPT, Claude, and Grok, and they all kind of, sort of agreed, and then I put in my own analyst interpretation.

Elia Zaitsev

>> There's some truth to that statement. You build on our platform because it has all those other advantages because it's simple and secure and all the data's there. But we also recognize that there's going to be inevitably scenarios where you want to use the power of our platform and our data, but with other types of workflows, other agents from other companies. We've announced a lot of partnerships and we're working closely with companies like Nvidia and Salesforce. They have their own agent force capabilities.

Dave Vellante

>> Right.

Elia Zaitsev

>> So sometimes you're going to want to do other things outside of a platform, but you bring your own intelligence, so to speak, but you still want to leverage data and functionality from our systems. So one of the things that I'm going to be talking about tomorrow in my keynote and Mike spoke about a little bit, as well, is this agent gateway concept where you can also bring your own intelligence hosted somewhere else and use that to interact with enterprise graph directly so that because of the investments we've made there, in the same way that it makes our own internal agentic systems operate much more simply and with higher efficacy and speedier outcomes, you'll get those same benefits if you bring your own external intelligence system that there might be some additional complexities and governance and other challenges you have to deal with, but we're giving you that flexibility to customize. You still get the power of all the native agentic innovations we've built into the platform, but you could also take the intelligence somewhere else if you've got your own custom model that you've been developing as an enterprise and you want to tap into our platform.

Dave Vellante

>> So you would say you have advantages in the customization, as well as those other areas that I?

Elia Zaitsev

>> We have advantages in both ends, and we give you choice. At the end of the day, we're giving choice to the customers and flexibility.

Dave Vellante

>> If you want to want to use somebody else's agents, go for it, is what you're saying.

Elia Zaitsev

>> Maybe there's very special data sets or systems locally in your enterprise that you can or won't bring up to the CrowdStrike cloud. That's a great use case of where you want to operate that intelligence locally, but you still want to be able to leverage the power of the data and the integrations we've built in our platform.

Dave Vellante

>> And Salesforce is a good example for sure.

Elia Zaitsev

>> That's a perfect example.

Rebecca Knight

>> So Elia, you spend a lot of time talking to board members and C-Suiters about their AI transformation and their technology concerns, what keeps them up at night. What are you hearing most from them, and then how do you respond?

Elia Zaitsev

>> I thought you were going to start by saying, "I spend a lot of time talking," and that was it. But yes.

Rebecca Knight

>> We can hear it in your voice and it's been.

Elia Zaitsev

>> Yeah, thank you. I think that the number one concern I'm hearing is, especially from the C-Suiters that are responsible for securing all these new innovations. They don't want to be blocking digital transformation, AI adoption. It's a board level mandate to adopt these technologies and accelerate and innovate. The CISO doesn't want to stop that innovation, but they're also a little bit terrified that there's what, like 700 million people now using Chat GPT, and they want the peace of mind and governance to know that data isn't leaving the front door. Developers aren't just uploading sensitive keys and source code up to the cloud. So there's this, when people are talking to me about AI and security, I have to first clarify, well, which element of it? There's really two. There's using AI to enhance security, which is what we just talked about, bringing these agentic systems to revolutionize our operations. But then there's also this other coin of how do we secure these AI systems that enterprises are rushing to adopt that they have to adopt? So that's this other half of the coin. I can't talk about all the announcements we've got there. They're embargoed, I think, until tomorrow. But there's some things we're doing on the data and the identity side, but that's a key topic of conversation. How can we enable that digital transformation safely and not hinder the adoption of AI at the workforce level, at the enterprise level?

Rebecca Knight

>> Well that's excellent.

Dave Vellante

>> We saw some good demos today. We saw some Charlotte demos. The Pangea demo really resonated. I take it you were involved in some of those acquisitions. You usually take a little look?

Elia Zaitsev

>> Yeah, I did a thing or two.

Dave Vellante

>> Kick the tires. Can you put both Onum and Pangea, can you put them in context? What does that mean generally and specifically for the SOC analyst experience?

Elia Zaitsev

>> Yeah, so let's maybe start with Onum. We announced that a little bit earlier, that the transaction's close. We're really excited now to be integrating that into the platform. Onum is all about streamlining and making it easier for SOC teams and analysts to get the data into the platform in the first place. So very high performance, very efficient filtering and transformation at the edge, which, by the way, has some pretty exciting performance and cost savings implications for our customers. They can now intelligently filter out the non-relevant data and actually make more room from a computation and from a budget perspective to bring in the valuable data that maybe they can't afford to bring in right now. It also allows us to start to shift some of that detection and analytical capability out at the edge so it occurs faster. So by the time the data has entered our platform, we've already done some pre-analysis and already identified that there's something anomalous going on in that data stream, so we can take faster action with it once it's in the platform through that process. So that's a lot of what Onum is about, let's talk about Pangea for a second. So really this is about filling in for us as a company. I'd say maybe the crucial last missing piece of the puzzle for this vision of AIDR, Artificial Intelligence Detection and Response. So when you think about securing agentic systems now, which, by the way, I think is going to be an incredibly important topic over the next year or two, we're already getting to the place where for every single human you have in your enterprise, you've got an agent supporting them in the very not too distant future, you're going to have more agents than humans operating inside these enterprises. And George talked about this in his keynote. In many ways, all but one that I'll get to in a second, I promise. Securing an agent is actually just like securing a human. They look the same. That's by design. They're replacing or augmenting humans doing previously human tasks. So they have an identity, they have access to certain data, maybe read only, maybe read, write. They can take action, they can reason. So the same techniques and capabilities we've used to secure humans at the identity level, at the data level, at the configuration, at the infrastructure level, you need all of that with agents, and that's not too big of a lift because it looks very similar as the human model. But there is one very crucial novel thing that agents bring to the table, which is this handling of unstructured data prompts. Prompts are a new attack surface. We talked about it as being almost the new malware. You can do things like prompt injection attacks and jailbreaking. So it's not enough to just log and record all these instructions and output coming in and out of these agents, you have to be able to actually analyze them, and because they're unstructured, that can be a challenge. So Pangea brings a lot of things to the table for us, but the one that really, really, that I'm focused on is this last missing piece of the puzzle to bring into our overall platform. So now we can comprehensively secure, analyze, detect, and prevent every aspect of an agent's life cycle.

Rebecca Knight

>> Excellent. Well, Elia Zaitsev, thank you so much for coming on. theCUBE, a really great conversation.

Elia Zaitsev

>> Thank you for having me. And maybe we'll get that whiteboard for next week year.

Dave Vellante

>> Oh, yeah.

Rebecca Knight

>> I think we need it.

Dave Vellante

>> Let's do it.

Rebecca Knight

>> We need it. I'm Rebecca Knight for Dave Vellante, stay tuned for more of theCUBE's live coverage of Falcon 2025. You're watching theCUBE, the leader in enterprise tech news and analysis.