CrowdStrike Fal.Con 2025 | Mike Sentonas, CrowdStrike

Clips
More from CrowdStrike Fal.Con 2025

Michael Sentonas

President

CrowdStrike

play_circle_outline Combatting the AI-Driven Security Gap: Addressing Attack Timelines and Defender Challenges in an Evolving Cyber Landscape

play_circle_outline Empowering Cybersecurity: Autonomous Agents, Small Business Defense, and User-Centric Natural Language Interactions

play_circle_outline Recent acquisitions of Onum and Pangea enhance CrowdStrike’s data management and AI security.

Info
Transcript

Mike Sentonas, CrowdStrike

Michael Sentonas

President CrowdStrike

In this exclusive interview from Fal.Con 2025, theCUBE’s Rebecca Knight and Dave Vellante sit down with CrowdStrike president Mike Sentonas to unpack how AI is rewriting the rules of cybersecurity. Sentonas explains how adversaries are collapsing attack timelines from months to minutes with generative AI and why defenders must embrace a mindset shift toward automation and agentic SOC models. He highlights how the enterprise graph unifies threat, asset and identity data into a single framework, creating what he calls a “security system of intelligence” that bo... Read more

explore Keep Exploring

What challenges do security practitioners face in implementing new strategies to close the gap between attackers and defense systems, and how can they be supported in overcoming inertia and prioritizing these initiatives? add

What are the key challenges in cybersecurity and how is technology being used to address them? add

What acquisitions has CrowdStrike made recently, and how will these acquisitions benefit its customers? add

bolt Powered by CUBE AI

Mike Sentonas, CrowdStrike

search

Rebecca Knight

>> Good afternoon everyone, and welcome back to The Cube's live coverage of Fal.Con 2025. We are in the home stretch. I'm your host, Rebecca Knight, alongside my co-host and analyst, Dave Vellante. I would like to welcome Michael Sentonas to the show. He is the President of CrowdStrike. Thank you so much.

Michael Sentonas

>> Thank you. Thank you for having me.

Rebecca Knight

>> Yeah, and great job on the keynote this morning.

Michael Sentonas

>> Appreciate it.

Rebecca Knight

>> It was abjectly terrifying. You talked about how AI is rewriting the rules of cyber security and how adversaries are using AI to identify how to hurt their targets the most, which documents are most valuable, what's their best data. Using AI to press their psychological buttons and then demand the exact right ransom amount. Michael, I'm dying here.

Michael Sentonas

>> Well, hopefully that wasn't the only takeaway because we talked about how to solve the problem. But look, I think if you come to a security conference every year we're going to talk about the latest innovation, not only from a defender perspective, but what the adversaries are doing, and that's really important.

Rebecca Knight

>> Raising awareness.

Michael Sentonas

>> People need to understand what they're competing with. I talked a lot about the world that we live in because it's very easy to talk about futures and talk about what the adversaries could do. But we're living in a world now where technology's changing so quickly. The adversaries have disadvantage because they don't have regulatory requirements. They don't have change control. They don't have to do testing. They don't worry about resilience. If there's new technology that they can use to hurt you, to monetize you, to weaponize their research, they're going to use it. That's the world that we now live in. We are seeing adversaries use gen AI, use AI to create attacks, that once would've taken months and millions of dollars, and people can now do it for a dollar. That's why I say we have to defend endpoints and networks and email gateways and web gateways. But the new malware today are prompts. Anyone that can use one of these systems and can use natural language to effectively create these tools, they stand shoulder to shoulder with the most sophisticated nation states and the most capable e-crime groups.

Dave Vellante

>> You laid out an asymmetry in your keynote. I wanted to dig into that a little bit. I remember when cloud first came out, the narrative was, and it was true, that you as a startup could now have the same quality infrastructure as JP Morgan Chase. You might not have all the brains behind it, but still you didn't have to rack and stack. That transformed our industry. You talked about AI accelerating adversaries and say attack timelines have collapsed from months to minutes. A single attacker with AI can mimic nation state capabilities, so there's that similarity. But you also made the point that defenders are falling behind, that legacy architectures and alert overload is just widening the gap between attackers and SOC teams. My question is, we look at all these practitioners here, they're going to go back to their companies and say, "I learned a lot this week. The Agentic SOC is coming. We got to lean in." But then just inertia takes over. They got to do a business case, they've got other priorities. The assets aren't appreciated on the balance sheet. How can you help them close that gap?

Michael Sentonas

>> Well, I think there's a lot of things there. One is we need to have a mind shift, and the way we think about solving this problem has to change. In some respects, you could make a really compelling argument to say, we're at a point of saying, let's burn the boats and start again, in some ways.

Dave Vellante

>> Do over?

Michael Sentonas

>> You're going to have to because we talked about a future concept of what we call the Agentic SOC and how that needs to change. That's going to take a lot of time, but people need to be ready for that change as well. The reason why I say maybe we need a mind shift is because we've had technology in cyber that can do things autonomously. We've had technology that can help bridge the gap. As I said earlier, maybe it's regulatory reasons, trying to say to a regulator, if you're a bank, "Hey, this technology is going to make a decision on its own." People say, "No." The adversary doesn't have those challenges. They don't need to go to somebody to say, "Hey, is it okay if I use this tool?" We're going to have to make a mind shift to embrace this technology, but we also have to demonstrate the technology work, so it can be used safely and securely. We need to get it into people's hands. There's a lot of technical work that needs to happen. That's what I wanted to show everybody today. The here and now from an attacker perspective, there's a here and now from a defender perspective, and we're in that position now.

Dave Vellante

>> If I had to quantify that, you're right, there's been a lot of automation. The industry's actually done a pretty good job in the last five years. You'd probably stop 99% of the breaches and humans could deal with that other 1%, but it's not good enough now because that 1% you're overwhelming it with AI. You really have to rethink, and maybe it is a do over.

Michael Sentonas

>> You do, and I see examples all the time. For example, we know antivirus, legacy antivirus doesn't work. It's not something according to me or according to CrowdStrike. It's just we all in the industry know that. But a lot of auditors in the forms that they get organizations to fill, it's, what antivirus do you use? If you use anything more modern, you're non-compliant. We have to change the way that we think in some aspects. Otherwise, we're going to keep reading about the next organization that was taken offline. We're here in Nevada, there was a significant cyber attack that impacted the State for weeks. We have to make it harder for the adversary, otherwise we're not going to get on top of it.

Rebecca Knight

>> You are positioning the enterprise graph as the foundation for an AI-driven defense model. How does that change for organizations to have this visibility, the single layer of data, and what does it give them that they didn't have before?

Michael Sentonas

>> Well, there's a few things, and it starts off with, how do we bring information into a single source so we can look at everything that's happening in the environment? I think when people talk about lots of different platforms, and some vendors have multiple platforms, nothing screams security like needing a treasure map to try to find all your security products. It doesn't work. For us, the enterprise graph is having a single place to bring in all of your threat information, to bring in all of your asset data, to bring in all of your identity data, to bring in all of your user information, and being able to search that and unify the data. We talked about collect data once, reuse it many times, so all of our modules get the benefit of that. But here we are in this hub, there's over a hundred different vendors. We want to bring in their data as well, because I passionately believe integration needs to happen in the vendor community, not in the end user community. Their job is not to be systems integrators. The enterprise graph enables us to bring in telemetry from not only CrowdStrike products, but third-party products so that everything is in that one platform.

Dave Vellante

>> But if I understand it, Michael, it's even more than that, because what you described, I could say, "Well, that sounds like Amazon Security Lake." I love Amazon, we all have wonderful friends there, but I think what you have is different, I think. We talked to Eli about this when we're geeking out with him, it's an abstraction layer that harmonizes that data and it creates essentially a 4D map of your security enterprise, people, places, things, activities, workflows. It's not just a bunch of data in a data lake. First of all, is that true? Can you add some color to that?

Michael Sentonas

>> It is. It is. You're doing a great job. You can come and sit in that.

Dave Vellante

>> You're underselling it.

Michael Sentonas

>> Yeah, well, let's swap. I'll ask the questions. You're good to go. It is a common framework. We're building effectively the ability to have one language for all technology to work, CrowdStrike and non-CrowdStrike. All products are developed quite differently. We want to be able to bring in, communicate the same way. That's been an interesting project that we've been working on. It's being able to visualize the data, interact with the data, just to extract an incredible amount of intelligence from what's there to protect your organization. Ultimately, to me, it's a simple conversation. It's giving you higher efficacy levels to protect your organization, and it's giving you and saving time, the two things that organizations want. If we're going to distill it down to its most simplest form, that's what we're trying to do. Make you safer, save you time.

Dave Vellante

>> I called it a security system of intelligence. Is that reasonable?

Michael Sentonas

>> Yeah, it is. Absolutely.

Dave Vellante

>> Okay, perfect. Because it's going to feed the agents. Can it interpret context from the metrics and the data, the business data that's coming in, the security data that's coming? Can it interpret context in a way that is, maybe I'm over-selling it, but more advanced than just a data lake?

Michael Sentonas

>> Well, the modules and the agents will, they'll get the context. The enterprise graph is where we pull all of that information together and we start to join it. We start to enrich it. Then, the modules that we have, the agents that we have, they'll be the ones that get the benefit from that, that start to really give you the learnings. They'll be the ones that help you work out where to patch, what your most valuable asset is. If there's a critical vulnerability that gets announced, what's the system that you need to touch first? Not all devices are created equal. Their criticality is different. That's where we're going to get a lot of that value, by bringing everything together into the one graph.

Dave Vellante

>> The intelligence is within the platform, within the system itself?

Michael Sentonas

>> Yeah.

Rebecca Knight

>> I'm interested in how the day-to-day experience of the human changes in this with these new seven autonomous agents. What will this do? As you said on the main stage, every analyst will become an orchestrator. You're going from a handler to a commander. I like these lines. They're memorable. But what will their day-to-day look like with these new agents? Tell me.

Michael Sentonas

>> Yeah, I think it's really important to, again, talk about what we're trying to solve here. I've been doing cybersecurity for three decades now, and one of the things everybody talks about is a skills shortage. But I think one of the things that people don't talk enough about is cybersecurity is hard. It's a very hard job. When you are in the trenches, when you're dealing with cyber attacks, they're long hours, they're very stressful. When an organization is down, it's high stakes. One of the things that we're trying to do with the technology that I announced today is to make it simple. We want to take everybody and give them the same advanced capabilities that the most skilled people have. Of course, they still need experience, but we want to elevate people. We want to make small businesses highly capable to stop cyber attacks. That's very important. We're working a lot on simplicity. When you're interacting with our platform, talk in natural language. Ask Charlotte, which is the tool that we use, the AI tool that we use, to orchestrate these agents that I talked about. If you see this email or if you see this IP address, quarantine the machine, send a Slack message. Just talk in natural language. Then, Charlotte will do all the work in the background to spin up agents, to set up triggers, to set up the rules, to do the connections. That's really important to us because we talk about the democratization of destruction, what you are scared about. Well, we need to democratize the complexity. We need to make it easier for people to use cyber security products. That's one of the things that we're really focused on, and we've had such incredible feedback today. People have gone to the booth, have seen the demo, and they're incredibly excited.

Rebecca Knight

>> Talk about the acquisitions, Pangea and Onum. What will they do for CrowdStrike customers?

Michael Sentonas

>> Great teams, great technologies. We were really excited with both organizations. We closed Onum last week. We announced we're entering into an agreement to acquire Pangea yesterday. Onum, incredible technology that offers data pipelining, helps you push detections closer to the edge, closer to the source of the data, helps you move data, it helps you onboard a new next-gen SIEM Technology, has smart filtering, so it can save you a lot of money when you're moving data. But really, what I'm incredibly excited about is pushing detection into the data pipeline, pushing detection closer to the edge. Because when we talk about the problem that we're dealing with today, this is asymmetric problem that we're facing, we need speed advantage. This is going to help with that. When we talk about AI, it's all about data, high-quality data, clean data, and having it in the right place. Again, Onum helps with that. When I met the team and I saw the technology, for me, it was a perfect fit and it's going to help us help customers get access to next-gen SIEM. It's going to help CrowdStrike sell more next-gen SIEM, and we're incredibly excited. The reception's been fantastic. Pangea helps organizations secure their AI journey. If organizations are creating agents, if they're creating AI tools, it helps secure those tools. It helps protect them from things like prompt injection. We're looking at the CrowdStrike technology plus Pangea technology to really create AI detection response. We pioneered ADR. We're now pioneering AIDR as we're calling it, so that you can use any AI model. You can do it safely, you can do it securely. The team at Pangea, Oliver and Sourabh, fantastic team. I just came straight from being with them. Great team, great technology. That's what makes a great acquisition.

Dave Vellante

>> Two really important acquisitions actually, because you're doing a good job, obviously, at endpoint. You're pushing the adversary to the edges, so being able to accommodate that is important. Then, the Pangea acquisition, that Onum piece, then Pangea gives you visibility. You better get ahead of that before you start deploying all these agents. You want to be able to see what's going on in your AI infrastructure.

Michael Sentonas

>> Yeah, correct. It's understanding what tools people are using. Remember, when we talk about AI, there's a massive shadow AI explosion, another buzzword term, but it's the reality.

Dave Vellante

>> It's true. Yeah.

Michael Sentonas

>> Every organization is using ChatGPT, they're using Grok, they're using Llama. People have got Claude deployed. People are finding out that they're using DeepSeek that maybe they're not even sure of.

Dave Vellante

>> DeepSeek, absolutely.

Michael Sentonas

>> This is giving you visibility into the tools, but then it's enforcing safe use. It's applying guardrails, data loss prevention. Maybe you don't want employees searching, whether if they've got a, they want to research about how to buy weapons, or maybe they are researching inappropriate things. You don't want it in the workplace. It's giving you that data protection inside the environment, so stopping the query in the first place, but also keeping some of the results away. This is the capability that it provides. But if you are creating an agent and that agent is fantastic, you want to make sure that somebody who has malicious intent doesn't use prompt injection to maybe get your agent to do the wrong things. Pangea is also a tool for developers.

Rebecca Knight

>> Excellent.

Dave Vellante

>> A couple of announcements I wanted to hit on, Fal.Con IT risk-based patching, boring but important. It reframes patching. It makes it a really prioritized and precision exercise, I guess. Then, the threat AI announcement. Can you talk about those two?

Michael Sentonas

>> Yeah, for sure. Look, I have to say that some of the simple concepts are the most powerful. If you want to solve security problem, it might be a little bit boring, but it's so critically important. Knowing what systems do you have, knowing where they're vulnerable and then patching them is so important. It's a big thing that customers are asking us for. They're telling us their existing tools are cumbersome. They don't want lots of agents, they don't want lots of platforms. Can you help us with patching? We hear it every day. I'm really excited about this. We'll announce an upcoming beta, which will be fantastic, and we want to focus where an organization has the most risk, what to patch first. Make sure that if you're driving in on Tuesday morning, you hear about patch Tuesday, Microsoft announces some new vulnerabilities or any other vendor, you can go straight to the organization, where am I vulnerable? Use the enterprise graph, which are the most important assets, and go and patch them first. Then, from an Intel perspective, I believe we've got one of the best teams in the industry in counter-adversary operation. Adam's team, who did a keynote today, they know how to threat hunt. It's what they do. It's their bread and butter. We're building an agent to help you have the same capabilities as our hunting team. It's helping you get valuable information, but understand it, because it's a complex topic.

Rebecca Knight

>> Excellent. Well, Mike, thank you so much for coming on The CUBE. Always a pleasure having you on.

Michael Sentonas

>> Thank you so much.

Dave Vellante

>> Thanks, Michael.

Rebecca Knight

>> I'm Rebecca Knight for Dave Vellante. Stay tuned for more of The CUBE's live coverage of Fal.Con 2025. You're watching The CUBE, the leader in enterprise tech news and analysis.