CrowdStrike Fal.Con 2025 | Tom Etheridge, CrowdStrike

Clips
More from CrowdStrike Fal.Con 2025

Thomas Etheridge

Chief Global Services Officer

CrowdStrike

play_circle_outline CrowdStrike's AI offerings improve internal operations and combat threat actor activities.

play_circle_outline Red team operations assess vulnerabilities in AI tooling for enhanced security.

play_circle_outline AI for SecOps readiness helps defenders automate and improve incident detection and response.

play_circle_outline AI expertise is crucial for training models to prevent obsolescence and ensure efficiency.

Info
Transcript

Tom Etheridge, CrowdStrike

Thomas Etheridge

Chief Global Services Officer CrowdStrike

In this exclusive interview from a lively Fal.Con 2025 at the MGM Grand, theCUBE’s Rebecca Knight and Dave Vellante sit down with Tom Etheridge, Chief Global Services Officer at CrowdStrike. Etheridge explains how CrowdStrike is helping customers embrace AI securely while defending against adversaries that are also weaponizing it. He outlines three new service offerings: AI red teaming, AI security assessments to uncover shadow AI and AI for SecOps readiness to accelerate detection and response.

The conversation explores why data governance and skill... Read more

explore Keep Exploring

What recent trends have been observed regarding the use of AI by organizations and threat actors, and how are organizations addressing security concerns related to AI? add

What are the benefits and details of an AI security assessment in relation to managing risks associated with AI tooling in organizations? add

What are the key offerings provided to optimize security and improve capabilities in AI tooling and SecOps? add

What are the key factors contributing to the growth of AI services in the market, particularly in relation to skilled personnel and expertise? add

bolt Powered by CUBE AI

Tom Etheridge, CrowdStrike

search

Rebecca Knight

>> Hello everyone and welcome back to theCUBE's live coverage of Fal.Con 2025 at the MGM Grand. I'm your host, Rebecca Knight, alongside Dave Vellante, my co-host and analyst. We'd like to welcome Tom Etheridge. He is the Chief Global services officer at CrowdStrike. Welcome back, Tom.

Thomas Etheridge

>> Thank you. Nice to be here, Rebecca.

Rebecca Knight

>> Long time, no see.

Dave Vellante

>> Hey, Tom. Good to see you again.

Thomas Etheridge

>> Nice to see you, Dave. Likewise.

Rebecca Knight

>> So from your vantage point, you're seeing companies grapple with AI in a lot of ways. They're, number one, they're using it to improve their operations and make their employees more productive, but they're also using it to fight the adversaries. So talk a little bit about what you make of how companies are using it with this dual challenge.

Thomas Etheridge

>> So what we've been seeing, Rebecca, is we've seen this transition and actually acceleration of AI for internal use for a lot of organizations. And like you said, we've seen tremendous uptick in threat actor activity where AI is part of the portfolio of tools that threat actors are using to accelerate the speed at which they carry out their attacks. In order to not only help from a product point of view, the services organization at CrowdStrike has made substantial investments in building offerings that enable customers on both fronts. So Back in March of the year in this year, we developed a red team for AI service. So we would go out and run red team operations against AI tooling to see where that tooling was vulnerable. A lot of organizations have the capabilities to stand that infrastructure up and start testing it, but they really don't do it with a security lens. So running a red team operation against AI tooling can really help organizations understand where they might be at risk. More recently, we launched two additional services offerings. One of those offerings is AI security assessment. With the expansion of AI tooling within company infrastructures, what we call that shadow AI, there's a lot of unknown visibility or lack of visibility into where AI is actually being leveraged and what kind of risk does it represent to the business. So the AI security assessment offering is really a discovery exercise to understand where AI is being used. We look at the models that are being used. And then we provide crisp recommendations around how to optimize, improve, and reduce the security risk associated with AI tooling. The last offering is AI for SecOps readiness. So it's really going back into the protectors, the defenders, and working with those organizations to help them understand what are the key most valuable use cases they can use to automate and use AI to improve their overall capabilities to detect and respond to incidents. So those three offerings combined really are starting to get momentum within our customer base.

Dave Vellante

>> And these are for pay services, correct?

Thomas Etheridge

>> Absolutely.

Dave Vellante

>> Okay. And so red teaming, explain that a little bit. That's when you basically simulate an adversary and you try to identify weak spots. You ever get customers, you know when the stock market really drops badly, you don't even want to look? Do you ever get customers saying, "Ah, I don't want to look," but you got to force them to? But you started there, and now you're evolving into these higher value add services. I wonder if you could explain that evolution and then where do you leave off and where do your GSI partners pick up?

Thomas Etheridge

>> That's a great question. So absolutely. I think our intent around red teaming and some of the assessment offerings is to really scope out for a customer how big of a problem do they have. I mentioned shadow AI. A lot of organizations, there's a bottoms up swell of interest in AI, as well as a top-down push, to drive automation and efficiencies within the business. So that top down push and the bottom up push creates this sprawl of AI usage that a lot of security and IT teams don't really have great visibility into. And as it's being used, this is not just about tooling, it's about data. You've heard George Kurtz talk about that this week at his keynote. A lot of this is about the data that is feeding and training these AI models, and that's coming from across the business. And in some cases, some of that data is very, very sensitive. So running red team operations really helps understand what data is feeding these models. Is it sensitive data? How are we insulating and protecting that information as we're building out our AI tool structure?

Rebecca Knight

>> So you keep mentioning shadow AI. I'd love for you to talk a little bit about what that looks like in practice and what you are discovering when you go into these environments.

Thomas Etheridge

>> So as I said, I think a lot of times we will go in and run a security assessment for AI and we will uncover usage of AI that the IT and security teams were previously unaware of. And a great example would be we could run some input into the AI model that is faulty to train the model on doing something that maybe the agent wasn't really intended to do. An example might be approve a zero interest loan for a multi-million dollar loan application. That's something that I would assume an organization wouldn't want their AI systems to be able to spit out. So we really focus on getting organizations to understand how the AI models are structured, what kind of controls they have in place, how are they governing their AI tooling, and then how are they making sure that it isn't being misused by threat actors potentially.

Dave Vellante

>> So as somebody who's been in the service business and understands the economics of it, there's a change going on in discussion. I'm talking broadly. CrowdStrike's different because it's sort of a new business line for you, so it's nothing but upside. But even the folks at Deloitte we were talking to, it's a human-centric business. You talk to the IBM consulting folks and the Accentures of the world and Wipros, all the India consulting firms, they'll say there's this interesting dynamic where potentially there's a revenue pressure because AI is automating a lot of this, but the margin opportunity is greater. As an observer of this industry for a long time, how do you see that playing out? Or is it just sort of AI services are going to be such a big opportunity in big TAM that that can continue to grow at historical rates?

Thomas Etheridge

>> So I'll tell you how I think about it, and I think our leadership team at CrowdStrike thinks about it this way as well. And I'm passionate about this because it's an important fact that I think gets lost on all the talk around the technology. The value of AI is really in the training and enablement of these models, and that requires really skilled, talented people. George mentioned a couple of times in his keynote, as did Mike, a lot of what we're doing from an AI perspective within our own technology is driven in large part by the expertise of our intelligence team, the capabilities and skill set of our Falcon Complete organization that's monitoring, detecting, preventing and actually remediating customer environments in real time. The excellent work of our professional services organizations that's doing in excess of 1000 breaches a year that we're responding to. So that expertise really is helping build and feed these models. And the models can get stale after a while if they're not continuously fed. So the thought process around reduction or cost savings, I do agree that with efficiency, with expertise, with the models being as efficient and driving faster value for the process that they're supporting, there are going to be cost savings and efficiencies. But you absolutely need skills and experience to continue to train and enable these models. And the conversation we're having right now about AI, that was not the conversation we had last year. So the threat landscape evolves faster than a lot of organizations are able to keep up. Without that expertise feeding those models, I think they get stale pretty quickly and the cost savings and the efficiencies go down. The way I talk to my team about it in the services organization is the more efficient we get by leveraging AI, the more customers we're able to support. And that gives us the ability to scale and touch and support a lot more of our client base. And I think that's how the GSIs are looking at it as well. We have a lot of great collaborative conversations about being able to scale and impact a lot more people at scale by leveraging the capabilities of these AI tools.

Dave Vellante

>> And we've seen it over the history of the services industry. Remember the BPM craze, the whole putting in ERP? It was a boon for a lot of these consultancies and everybody kind of predicted, "Oh, they're all be big trouble." But then something else comes along, whether it's cloud or big data and now security. So that continues. So as a product company, CrowdStrike's a product company, a platform company. It's a technology company, it's not a services company.

Thomas Etheridge

>> Yeah.

Dave Vellante

>> Right? So that's always an interesting balance, right?

Thomas Etheridge

>> Always.

Dave Vellante

>> You're a services person inside of a, I'm calling it a product company, but product platform company. How do you strike that balance, again, within the company and with your partners?

Thomas Etheridge

>> So I think number one, we have a tremendous partner ecosystem that we collaborate with day in and day out. And in the last year plus since our last conversation, the amount of growth we have within our partner ecosystem's been almost double what we did last year in terms of subcontracted work that we do with partners, in terms of building programs to support partner delivered services for our client base.

Dave Vellante

>> You're subbing them or they're subbing you, or both?

Thomas Etheridge

>> Both. But we implemented a partner delivered IR program. So for small down market customers where we might be at capacity, we have the ability to leverage third party authorized, trained, and enabled partners to deliver services under our advisory capabilities for our customers. So it gives us the ability to scale. They use our tooling, they follow a lot of our policies and protocols for how we expect the incident response engagement to work, and they deliver those services on our behalf as part of the-

Dave Vellante

>> As the CrowdStrike brand?

Thomas Etheridge

>> As a part of a subcontract agreement that we have for down market customers that are in that small to mid-market segment. We still will service them if availability exists, but it gives us another opportunity to service customers down market.

Dave Vellante

>> But that's on your paper? Is that right?

Thomas Etheridge

>> It is, but we also have a program called the engagement license program, which gives trained and authorized partners the ability to access the platform to monetize their services business. So we have incident response providers that are requesting a provision SID to our platform. They get access to the product for 60 days at no cost and they can deliver the service directly to their client without our involvement at all.

Dave Vellante

>> They can white label it essentially?

Thomas Etheridge

>> Exactly.

Dave Vellante

>> Very cool.

Rebecca Knight

>> So Tom, when an organization comes to you and says, "We want to adopt AI for our security operations," what would you say is the gap between their ambition to do that and their actual readiness to do that?

Thomas Etheridge

>> So I think there's probably a couple things. One, I would say if you haven't heard about our announcements this week at Fal.Con, you need to get-

Rebecca Knight

>> Watch theCUBE....

Thomas Etheridge

>> educated on our announcements this week at Fal.Con because a lot of the technology that we are bringing to market is really in support of defenders and protectors to be able to use the data that we've collected in the platform, use the tooling that we've built, and to be able to build your own agent to do things like malware analysis, which we're providing actually out of the box with our new intelligence agents. Do hunts across the estate that you have for indicators of compromise or attack. All of the capabilities that we bring to the market are things that we're going to be talking to organizations about. How do we integrate that into your overall operation, extend what we already deliver today in terms of a platform or a service like our MDR, and be able to help customers start to get educated on automation and efficiency and doing things at the scale we need to in order to stop these aggressive attacks.

Dave Vellante

>> So in many ways, I look at your organization as an accelerant. And so one of the things Rebecca and I have been talking about this week is the practitioners here are going to go back to their organizations and they're going to say, "Wow, I saw some really cool stuff. There's this future, the agentics SOC, we got to lean in." And then it's going to bubble up. It's got to go to the CFO. He or she's, they got to make a business case. "Well, these assets are still in the balance sheet. They're not depreciated yet. We've got all these processes." You know what I'm talking about, right?

Thomas Etheridge

>> Yeah.

Dave Vellante

>> And so the marketing and the product announcements always lead the adoption. How can you help accelerate that?

Thomas Etheridge

>> So I think one of the things we do a really good job of as part of our assessment and advisory services, when we're talking to customers about some of the threats that we see in the threat landscape, we talk about, in addition to the threats, we talk to a lot of organizations about how they can mature and optimize their programs. We will go in and do an IT hygiene assessment as an example and point out where they may need some optimization of their external exposures using our exposure management technology. And then through those conversations we can help them drive efficiencies, consolidation of tooling. One of the biggest challenges we see with a lot of organizations, it's not a shortage of tools. It's actually a sprawl of tools that aren't really integrated or delivering a value-added outcome for the security organization. So rethinking the tooling that they're using, rethinking how they're getting value out of that tooling and automation, and be able to help them figure out how to save money, not cost more money, or at least make trade-offs that deliver a better outcome from a security perspective.

Dave Vellante

>> And do you help them, and how do you help them prioritize that based on... It's one thing to say, "Okay, you're exposed here." It's another thing to say, "You're exposed here, but that's of a lower priority from a business value standpoint. You got to go after the high-value targets." I know traditionally, IT has had a difficult time connecting to business value. I go back to Nick Carr, does it matter? I mean, that's ancient history, but there is still some of that in IT. Is it similar in security or is it because the risks are better understood and it's really more of a risk play?

Thomas Etheridge

>> I think one of the... You mentioned making risk decisions. Again, think about what we announced this week. We announced a risk-based patch management capability within our Falcon for IT offering. Really helping organizations understand how to prioritize what vulnerabilities they have, what needs to be done in order to patch those, and actually helping them patch those vulnerabilities, I think is where we're trying to get to. Our goal around services is to not just point out where the gaps are or where there's room for improvement, it's actually to provide very prescriptive guidance and/or provide strong recommendations about how they can get value out of implementing a tool like a Falcon platform app to help them solve for those problems. You mentioned accelerant, services as an accelerant. Everything we do from a services perspective, yes, it drives revenue for the business. Yes, it's important to solve problems. Like our number one priority is making sure customers aren't breached or they're able to recover from an incident very, very quickly. But one of the areas where we really focus a lot of our service capabilities is helping organizations understand the tooling that we to the table is something that we can help them implement and optimize to help solve those gaps. Speed being one of them, visibility being another one, and then being able to kind of take action as quick as the threats are evolving in their environment, because that's one of the biggest reasons why we stood up our managed detection response business.

Rebecca Knight

>> Great

Dave Vellante

>> Oh one last, if I may.

Rebecca Knight

>> Yeah.

Dave Vellante

>> Typical news cycle, right? The journalists talk about... Sorry, Rebecca's a journalist. You know how the journalists are, they always looking for the negative.

Rebecca Knight

>> The worst.

Dave Vellante

>> But we love you. But there's a discussion around quantum ready. I think somebody in one of the keynotes mentioned it, but I was talking to a CEO of a cybersecurity company, they said, "The adversaries, they don't need quantum. They're doing fine just without it." Which I thought was kind of clever. But is the fear of quantum overblown? Do you have a perspective on that? Does it come up with your clients at all? Or is it just like they're putting out fires daily, they really can't worry about this at this point in time?

Thomas Etheridge

>> I think people are thinking about it, but they're thinking about it couple of years out. I think you're absolutely spot on. The threats of today are real. Mike mentioned this in his keynote this morning.

Dave Vellante

>> Yeah, sure did.

Thomas Etheridge

>> AI is here. The threat actors are leveraging it for social engineering, for reconnaissance, for deep fake videos, for social engineering capabilities, and they are really, really getting adept at it. And it is really difficult for defenders to be able to detect and stop that activity at the speed that they need to. So a lot of the announcements that we made this week, a lot of the services offerings that we continue to bring to the market are really designed to help organizations get in front of this problem and/or at least keep pace with the growth of this problem.

Rebecca Knight

>> Excellent. A great note to end on. Tom, thank you so much for coming on theCUBE again.

Thomas Etheridge

>> Thanks, Rebecca. Thanks, Dave.

Dave Vellante

>> Thanks, Tim. Great to see you.

Thomas Etheridge

>> Appreciate it.

Rebecca Knight

>> Thanks. I'm Rebecca Knight, for Dave Vellante. Stay tuned for more of theCUBE's live coverage of Fal.Con 2025. You're watching theCUBE, the leader in enterprise tech news and analysis.