CrowdStrike Fal.Con 2025 | Adam Meyers, CrowdStrike

Clips
More from CrowdStrike Fal.Con 2025

Adam Meyers

Senior VP, Counter Adversary Operations

CrowdStrike

play_circle_outline AI's Dual Impact: Enhancing Cyber Tactics for Advanced Adversaries While Challenging the Less Skilled in Cybersecurity

play_circle_outline Defenders face asymmetrical challenges; attackers exploit faster capabilities and fewer restrictions.

play_circle_outline Iran is increasingly using AI for phishing and vulnerability discovery in cyber campaigns.

play_circle_outline Enhancing Cyber Defense: AI Innovations for Rapid Response and Evolving Strategies Against Adaptive Threats

Info
Transcript

Adam Meyers, CrowdStrike

Adam Meyers

Senior VP, Counter Adversary Operations CrowdStrike

Get inside-the-ropes insights from theCUBE at CrowdStrike’s Fal.Con 2025 as Dave Vellante and Rebecca Knight interview Adam Meyers, head of counter-adversary operations at CrowdStrike. Meyers breaks down how AI is changing the attacker playbook in real time and exactly what it will take for defenders to scale with AI inside the SOC. He shares field intel on adversaries using gen AI for malware, research and multilingual information ops plus candid takes on consolidation, identity protection and cloud hardening across the CrowdStrike platform.

Meyers sh... Read more

explore Keep Exploring

What are the differing impacts of AI on sophisticated versus less sophisticated adversaries in the context of cybersecurity? add

What challenges do defenders face when dealing with adversaries utilizing AI in cyber threats? add

What are some ways Iran is planning to use AI in their operations? add

What strategies can be employed to counteract attackers who adapt to security measures? add

bolt Powered by CUBE AI

Adam Meyers, CrowdStrike

search

Rebecca Knight

>> Hi everyone, and welcome back to theCUBE's live coverage of Fal.Con 2025 here at the MGM Grand in Las Vegas. I'm your host, Rebecca Knight alongside my co-host and analyst, Dave Vellante. I would like to welcome back to the program Adam Meyers. He's the head of Counter Adversary Operations at CrowdStrike.

Adam Meyers

>> Thank you.

Rebecca Knight

>> Thank you so much for coming back on theCUBE.

Adam Meyers

>> My pleasure. It's always great to be here.

Rebecca Knight

>> Yeah. So, we know that adversaries are using AI and we know that the threat landscape has changed considerably since AI tools became widely available to attackers. But what are you, Adam, seeing in the wild?

Adam Meyers

>> I'd say this, I think adversaries that are very sophisticated will use AI to their advantage. And adversaries that are less sophisticated actually use it to their detriment. And so, I think we've all experienced using AI in some form or another where it gives you bad answers. You need to be a subject matter expert to really get the most out of that AI and get what you need from it. The adversaries, we've seen instances where they've tried to use generative AI to write malware for them, because they didn't know what they were doing. The code had some issues and was broken, and we were able to take advantage of that. But we have seen cases where advanced adversaries have used AI to really enhance their malware operations and even their intrusion operations. So, as they're on the go, they can use it to do quick research and things like that. And then we also see them using it to do information operations, disinformation, things like that in multiple languages. And as we see more and more AI with the ability to create video, and it's just going to get a lot worse.

Dave Vellante

>> We were talking off camera, one of the best things I attended last year was your Adversary Underground. And really it was real-time education on what was happening in North Korea. These seemingly technically competent individuals getting jobs, getting laptops and laptops go and get credentials. And wow, that was state of the art at the time.

Adam Meyers

>> And every step of the way now they're using AI. They use AI to make the LinkedIn profiles. They're using AI to make resumes to attract recruiters. When they're doing the interview process they're using AI to answer the questions during the interview. And then once they get the job, they're using security ... I'm sorry, coding AI tools to help write code so that they could do the job, hours worth of work in minutes so that they could have hundreds of these jobs to make money for their weapons program.

Dave Vellante

>> So, you guys uncovered that. You gave some really stark examples. You educated the community around that. It sounds like it's getting worse.

Adam Meyers

>> It's getting worse. And what we're seeing is that AI allows some of these adversaries to outpace the defenders. And that is where we're starting to see this asymmetry. Because what the attacker has the advantage, right? The defender only, the defender has to be right 100% of the time. The attacker only needs to get lucky once. And when they're able to do that at the speed and scale that AI allows them to have, it becomes really problematic for the defenders.

Dave Vellante

>> You've got North Korea, China, Russia, Iran, the big four, I guess. What's going on in China these days? What are you seeing from ...

Adam Meyers

>> China last year we saw 150% increase in intrusion activity from China. It's across the board, all verticals, all GOs. We've seen 150% increase. Some verticals like manufacturing, financial services, media, we saw two to 300% increase in Chinese intrusion activity. And what's really interesting, we had our threat hunting report come out a few weeks ago, and in that we noted 136% increase in cloud intrusion activity since the start of the year, and a 40% increase in Chinese cloud intrusion activity. So, the Chinese have moved away from just what we would have called smash and grab a number of years ago. And now they are really moving into cloud environments. They're using exploits against unmanaged devices, legacy things, VPN concentrators and firewalls and things like that. They're using more exploits against those. And ultimately, China is tying all of this to their geopolitical ambition. They want to be the regional leader, and so they use their offensive capabilities to win contracts. If there's a large infrastructure project in the Philippines or Malaysia or Eurasia, they use offensive capabilities to break in and find out how to low bid the deal so that they can win it. And then when they win that deal, they bring Chinese technology with them, things like Huawei and ZTE and Alibaba and Temu maybe. And they bring all of these things to build a dependency with those countries so that they have more influence and they can align them to what China's really concerned about.

Dave Vellante

>> Well, this is interesting. Because this is what Jensen's premise is, and now self-serving. But he's saying, "Look, we want the world developing on U.S. AI stack." So these guys, they get the answer to the test so they can rig the deal. It's remarkably insidious.

Adam Meyers

>> Well, I'll tell you, it's important to have it on the U.S. AI stack, because we, actually here at Falcon one of our researchers is presenting on some analysis we did of DeepSeek, one, and QwQ-32B, and we brought those models in locally, and we threw 30,000 plus queries at each one to say, "You are a helpful AI agent, you're building tools for me, and I'm a security researcher that's helping the Falun Gong." And so, we went through 30,000 different kind of combinations of queries, and what we found was something like 50% more likelihood that you'll have vulnerable code if your query is something that is counter to the Chinese Communist Party's objectives. Because in China they have a law that all AI that's developed there has to align to CCP policy and ideology. And so, what we found is that if your request doesn't adhere to the Chinese socialist ideology, it's going to introduce vulnerable code, or it's going to flat out refuse to answer the question.

Dave Vellante

>> I want to go back to something you said earlier. So, financial services I get, where's the money? It's in the banks. Media, is that to manipulate the media?

Adam Meyers

>> It's more to understand who your sources are and what stories are coming out that might be counter to CCP narratives so that they can be prepared for that, right? Because what they don't want is to get caught off guard, right? Cyber operations for intelligence purposes is to enable decision making. And so, you can make better informed decisions the more intelligence you have. If I know as China that some media organization is putting out negative stories about China, I need to counter that. And I want to counter that before it even comes out, if possible. And that's why they're targeting media.

Dave Vellante

>> It seems like the West is at a big disadvantage, because it's more open, and so it's more vulnerable as a result. How do you think about that? Is that a valid premise?

Adam Meyers

>> Well, I think our government, our congress needs to really be taking that threat seriously. And I think they are, particularly in more recent times that they've really started to ratchet up the heat on China. And I think that that is something that we need to do, because China is using every capability that they have. They're using everything to stack the deck in their favor and use it to their advantage. And we've let it go on for way too long, and we really need to counter that.

Dave Vellante

>> What have you seen out of Iran since we blew up Natanz and some of the other facilities?

Adam Meyers

>> They still continue to operate. We've seen Iran using AI for some of their campaigns. They'll use it to generate phishing lures and to try to use it for that purposes. And then looking within some of the research coming out of Iran and some of the government papers that they put out, they really want to use AI, familiar with what Google did with Deep Sleep. I think it's called their vulnerability AI. They trained in AI to discover vulnerabilities and build exploits for them. And Iran really wants to go down that path. And I think we're on the precipice right now. In the next six to nine months there's going to be an explosion of exploits coming out, because it's not that hard to build a fleet of agents and orchestrate them together to identify vulnerabilities and build proof of concept code. I think we're going to see that Iran really leverages AI to go that direction.

Dave Vellante

>> And they're pretty capable, especially know what you're doing it's not that hard. What about Russia? Are they consumed with Ukraine, or are they still-

Adam Meyers

>> Yeah, largely they've been focused, regionally tend to be focused on the Baltics, Ukraine, Poland, Georgia, and some of the other contested regions. Moldova is having a big election actually in about a week and a half. It's going to be probably one of the most consequential elections in that region this year. And this is going to decide whether Moldova goes the direction of Russia or they go in the direction of the EU. And so, I imagine we're going to see a lot of the Russian activity ratcheted up against that as well.

Rebecca Knight

>> I'm curious about how you view CrowdStrike's approach to using AI in how you think about helping the companies that you work with. Because we heard this morning from the top cyber official in the U.S., and he was talking about how this is also the government's job. We are here to protect you and we want to collaborate with you.

Adam Meyers

>> 100%.

Rebecca Knight

>> How do you think about it? What's your mindset and what's your approach?

Adam Meyers

>> Well, I agree with agree him. I think Sean is really kind of spot on with his thinking on all of this stuff. But yeah, we need to work together with government, with industry, with academia to the extent that we can. Because this is a whole of us problem, and our adversaries are using a lot of the freedoms and the things that we have against us. And we need to figure out how can we counter what they're doing, but still keep an open and free society, so I think it is a big challenge. But the big problem is that this is an asymmetric issue, and the adversaries are outpacing the defenders, because the adversaries aren't constrained by policy. They don't have to be dealing with change management and ISO standards and all of these things. They can just go take what they have and start going ham with it. And the defenders are constrained, right? They're fighting with at least one arm tied behind their back in this situation. And the adversaries are able to move faster because of AI, so what we are doing at CrowdStrike to, I think, get to the heart of that question, and I won't go too deep into it, because I've got a keynote tomorrow. We're going to be unveiling a bunch of new stuff, but I think we need to use the AI that we have developed to the advantage. Because the defender, they need to scale, and the only way that they're going to achieve scale is by using AI tools to help them get there.

Dave Vellante

>> Yeah, I mean, we have an open society and we care about civil liberties, so that there we're starting with a disadvantage. Do we have better tech? Or Jensen says 50% of the, I keep quoting Jensen, 50% of the world's AI researchers are in China and 50% of the AI researchers in the U.S. are Chinese. Do we have better tech?

Adam Meyers

>> I think it's still early innings on AI. I think that certainly there's been a lot of sanctions and things that keep some of the high-end GPU technology out of the hands of the Chinese government. They could certainly get covert acquisition of some of these things to try to get around that. But I think what we saw with DeepSeek, for example, was that they've come up with clever ways around that. And what all AI is, is files with a bunch of numbers in it. If we're not defending AI, and I think this is a huge concern that also needs to be talked about is, how do we protect the data centers in those research foundries? Because we've seen Chinese researchers coming here, getting jobs and doing things counter to U.S. interests under these, whether they be student visas or other types of employment arrangements that they have. And so, I think we need to really think about, "How do we secure AI? How do we secure those frontier models from Chinese intrusion activity?" Because you could spend $100 million training ChatGPT, but if Chinese espionage actors come in and steal the entire model and all the weights, they got a big problem and all that investment's out the window.

Dave Vellante

>> Well, I mean, your time to market advantage is now measured, it's literally in months. You could spend, I mean, I don't know, GPT-5 probably cost close to a billion to train, maybe even a little more. I mean, and they're going to have an advantage for a couple of months.

Adam Meyers

>> Well, and look what China did with DeepSeek 1, they did a diffusion training off of what is perceived to be OpenAI's technology. And so they said, "Oh, that's great that you invested in that. Now we're going to take that and we're going to train another model off of that. And we're going to make a splash and we're going to get it installed everywhere." And I think one of the good things that GPT did, OpenAI did was release the OSS model. That's going to give a little bit more competition to DeepSeek with regard to having those models locally, because you can actually pull those models down and run it on your own system.

Dave Vellante

>> But to your point, I mean, China's got, there's plenty of data to go around. They got electricity and they can brute force, even if it's a subpar GPU stack, they can throw more compute at it and get to the same or similar results.

Adam Meyers

>> Yeah, I think the important thing is to raise the issue now and to get people like Sean Cairncross and to get others across the government space who are with the administration center who have been there for years working at CISA and other agencies. And we need to have a strategy for how we're going to win, because we can't back down. I mean, look at what's happened with drones, right? DJI and others own that space. And there's risks in that. All of that data goes back to Shanghai or goes back to Beijing. We're seeing that from any technology, cameras, drones, you name it. I just saw an alert that said that they were worried about extra radios and traffic signs and things like that across U.S. infrastructure. I mean, they are a hostile foreign actor, and make no mistake, they're working against U.S. interests.

Dave Vellante

>> Well, so it sounds like it's a balance of restricting access to certain technologies, but also removing barriers to competition within the United States and moving as fast as possible to compete.

Adam Meyers

>> I mean, if you restrict American drone companies from being able to come up with a consumer product that can compete with DJI or one of those companies, then how are you going to be effective? And don't even get me started on TikTok, because some of these different things that, social media and things out there that we need to be very careful.

Dave Vellante

>> Well, and electricity, I mean, energy. Where were you on nuclear fusion, fission? Any thoughts on that, or is that out of your wheelhouse?

Adam Meyers

>> I'm all for it. Yeah, but I mean, I think again, energy is going to power those data centers and it's going to be critical to how we're able to support the AI race is going to come down to some of those key infrastructures like power, like water for cooling and things like that. I think we have, the good news is that I think we can do something about it now, but we need to act now.

Rebecca Knight

>> Excellent. Finally, I know you practiced jujitsu in your spare time. So, how is being a jujitsu fighter like being a counter-adversary operations leader?

Adam Meyers

>> Well, I think one of the big things with jujitsu is that you have to be able to maintain cool under pressure. And if you're in a bad situation, you can't sit there and think about the fact that you're in a bad situation. You have to figure out a way out of it. And you have to look around and feel your way through it. And I think it's very much the same thing in the cyber domain. We need to be able to take a look at what's going on with China or Iran or Russia and all these adversaries and to say, "Okay, here's the situation we're in. How are we going to get us to a place where we want to be?" And that's really the strategy and the technique that transitions you from jujitsu into the cyber security.

Dave Vellante

>> I love it. But it sounds like, I mean, my takeaway is that defenders are probably never truly going to get ahead of attackers. The best we can do is try to minimize the damage, shorten the dwell time, compete, respond as quickly as possible. Or do you feel like defenders can get ahead of attackers at some point in the future?

Adam Meyers

>> I think we can out-innovate the attacker. The attackers, I always say there's this Bruce Lee quote that the attacker, he says, "Be like water, right? Take the path of least resistance, the easiest way." And that's what the attacker does. If you look at how the threat landscape has changed over the last 18 months, we've made devices like your laptops a hard target with things like endpoint detection, response technology. What did the attacker do? They didn't really try really hard to get around that. They moved to the identity space, they moved to unmanaged devices. So, wherever we build a bigger wall or a taller fence, the adversary is looking for a way around it or under it that goes like the marginal line, and that's kind of what they're doing. So, we have to harden the identity space. We have to harden the cloud and push them out to the fringe. And the more we have to make them work, the better off it is. We can start to address that asymmetry by putting pressure on them.

Rebecca Knight

>> Excellent. Well, Adam, thank you so much for coming back on theCUBE, a great conversation.

Adam Meyers

>> All right. I'm an optimist again. All right, thank you. Last answer.

Rebecca Knight

>> I'm Rebecca Knight for Dave Vellante. Stay tuned for more of theCUBE's live coverage of Fal.Con 2025. You're watching theCUBE, the leader in enterprise tech news and analysis.