CrowdStrike Fal.Con 2025 | Keynote Analysis, Day 2

Clips
More from CrowdStrike Fal.Con 2025

Dave Vellante

Co-Founder & Co-CEO

SiliconANGLE Media, Inc.

Rebecca Knight

Host

SiliconANGLE Media

play_circle_outline Comparative Analysis of Ecosystem Growth: ServiceNow, CrowdStrike, and Palo Alto's Strategic Acquisitions and Product Integration Approaches

play_circle_outline Embracing AI in Cybersecurity: Challenges and Innovations in the Evolving Threat Landscape

play_circle_outline Analysts predict a lengthy adoption period for new security technologies among customers.

play_circle_outline Discussion of CrowdStrike's new products, especially AI-driven capabilities and IT risk-based patching.

Info
Transcript

Keynote Analysis, Day 2

Dave Vellante

Co-Founder & Co-CEO SiliconANGLE Media, Inc.

HOST

Rebecca Knight

Host SiliconANGLE Media

HOST

Straight from the start of Fal.Con Day 2 in Las Vegas, theCUBE’s Rebecca Knight and Dave Vellante kick off our keynote coverage with sharp, on-the-ground insights from a packed house. They frame the big story of Fal.Con 2025: AI is rewriting the rules of cybersecurity and CrowdStrike is pushing agentic operations across the SOC. They unpack how the audience is largely customers, the ecosystem has surged and why pure-play leaders like CrowdStrike and Palo Alto are racing toward massive ARR while competing head-on with Microsoft. They explore the rise of specia... Read more

explore Keep Exploring

What are the strategies and market positions of CrowdStrike and Palo Alto in the cybersecurity industry? add

What are the implications of AI in cybersecurity, particularly regarding how adversaries utilize it, and how does the concept of an agentic SOC represent a fundamental shift in security operations compared to past trends? add

What challenges are faced by security professionals when trying to implement new technologies, such as those proposed by CrowdStrike? add

What were the key takeaways from the keynote presentation? add

bolt Powered by CUBE AI

Keynote Analysis, Day 2

search

Rebecca Knight

>> Good morning everyone, and welcome back to theCube's live coverage of Fal.Con 2025. It is day two. We have just listened to Michael Sentonas on the main stage. I'm your host, Rebecca Knight, alongside my co-host and analyst, Dave Vellante. Dave, it's day two.

Dave Vellante

>> Day two. I'll tell you, I'm impressed with the quality of the audience here. Vast majority has red lanyards on which indicates customers, and there's about 8,000 people here. As we were talking about yesterday, the ecosystems exploded-

Rebecca Knight

>> Yes....

Dave Vellante

>> which we said four years ago. It was kind of sparse and then they needed to fill that gap. We talked about the similarities to ServiceNow back in 2013 where we felt the momentum. We felt that the company had world-class products, was solving a problem, was a leader in the industry, all sort of similar to CrowdStrike. And I guess the other point is I look at specialists like Zscaler who sort of popularized the edge, security and SASE, and there are dozens and dozens and dozens and hundreds of them. Wiz is another one focused on posture management that just got bought out by Google for many billions, 34 billion, I think, or maybe 42 billion. I forget the number. Okta, which is an identity specialist. Palo Alto just bought CyberArk, which does both identity and some end point. So the point I'm making is that it seems to me that CrowdStrike and Palo Alto are the two that are going after pure play. I don't want to say dominance because nobody really dominates the security business, but the pure plays that are going to head toward $10 billion in annual recurring revenue with a growth trajectory that can take them further. They're both $100 billion plus market cap companies and they both compete very effectively with Microsoft. They have two really different strategies. CrowdStrike does these tuck-ins like Onum and Pangea, integrates into the platform. Palo Alto, very engineering driven organization, by the way. A lot of the attempts to deposition Palo Alto I think are just that marketing. Palo Alto does a good job of... They've got a really well run company. They're a product company, they're engineering focused. They do some pretty decent integration, but they do big M&A, and that's how they're sort of powering their growth. I likened it with George Kurtz yesterday to Cisco under John Chambers. Those strategies can be effective. He sort of hinted in the long run, I like my hand better and I kind of do too, actually, I think it's .

Rebecca Knight

>> Yeah, and I think he made a good point too about entrepreneurs want to sell to me because I'm an entrepreneur. I understand what it is to build a business and want to see it grow. So often when you see big companies purchase smaller companies, it's to kill the product. But in fact, he really wants to cultivate that and nurture it. And so I think that I agree, I'm in favor of that strategy.

Dave Vellante

>> And Palo Alto will do some tuck-ins as well, but they're really looking for TAM expansion. They're looking for big growth drivers that they can put through their go-to-market engine. And I think interestingly, four or five years ago, I don't think CrowdStrike had that go-to-market engine that it has today. And that's why people are here because they're here to sell. That's why the AWS ecosystem is so large, because the go-to-market is incredible. So that's good. We heard Michael Sentonas today, who's the president who's going to come on theCUBE a little bit later. You want to unpack? .

Rebecca Knight

>> Yes, I do, indeed. Because he was up there saying that AI has rewritten the rules of cybersecurity. This is the reality today. He was talking about adversaries using AI to identify the most damaging data, press the right psychological buttons, and then in fact demand the ransom that it knows you will pay. And so my question to you, because all of this is leading up to enter the era of the agentic SOC because this is what CrowdStrike is saying is the answer is the solution. This is what we need in order to fight adversaries who are using AI to do their bidding. Is it such a fundamental shift in your mind or how does it contrast and compare with past shifts that we've seen in security operations?

Dave Vellante

>> That is a really good question, Rebecca, and I feel like, I mean, I've been following this industry largely from afar in my early days because I wasn't a security analyst, but I've been paying attention. I remember the RSA conference when it was RSA and then EMC bought them, and I was following storage at the time, so I paid attention to what EMC was doing. And Art Coviello was the CEO of RSA. He would stand up at the conference every year. It basically give the same message, each year, we spend more on security and we're less secure. And it was like it underscored sort of the failure of the industry. Now, I think what's different, to answer your question is I do think the response to the adversaries is improving because the stakes are so much higher. Back then, it was a lot of malware and hacktivist. You didn't have the nation-state activity from the big four, which we just published last night, China, Iran, North Korea and Russia, who are very well-funded and very competent. Good mathematicians come out of China and Russia. And as well, you didn't have the organized crime. So the ROI and the exfiltration value was not nearly as is today. So the industry has done a better job of closing that gap. At the same time, again, to answer your question, I think the arms race is still on and the defenders are still at a disadvantage. As George Kurtz said, the attackers, they can automate the attack and all you got to do is succeed once. You have to succeed 100% of the time, which is impossible, at least today. And I don't think this changes. I think there's still an asymmetry between attacker and a defender, and I think attacker has the advantage. And I felt like between November 2022 when ChatGPT came out and today the attacker has had the advantage, has that advantage narrowed? I feel like it has slightly, but I think it's going to increase with agentic because I think agentic brings more gaps. And I think customers are behind in terms of adopting the marketing that we hear shows like this is always ahead of the customer adoption.

Rebecca Knight

>> Right. Exactly. But what they were showing was pretty impressive in terms of this idea that the SOC is moving toward becoming an outcome orchestrator from a handler to a commander. And I thought that that was really interesting the way they portrayed that. But my question is about how that will actually look in practice in day-to-day between a security analyst who is now managing all of these agents and using these natural language prompts to tell it what to build and then to check its work and then to make sure that it is deployed and doing the job it is in fact supposed to do. How much will that really change? And as you said, customer adoption is way, way behind.

Dave Vellante

>> I think it's like most things in tech, the vision that CrowdStrike's laying out is right on in my opinion. I think we need a much better SOC analyst experience. The problem is the practitioners that are here at the show, there's a range of folks. There's certainly some C-level executives here, but the vast majority are practitioners fighting the fight day to day. And what's going to happen is they're going to go back, they're going to do a trip report. How is CrowdStrike? Oh, it was amazing. There's innovations. We got to do this stuff. And then it's going to be, okay, well, how do we pay for it? What's the business case? Who's going to implement it? How do we deal with all the stuff that's on our books already and all the technical debt that we have on and on and on and on and on. So it'll take several years for that vision to actually be implemented and adopted at scale. And by the time we get there, there's going to be new threats and we're going to look back just like we do now with ChatGPT and other LLMs. It's kind of second nature, whereas in December of 2022, we're like, "Oh my God, this is mind-blowing." And back then, it wasn't that good actually compared to where it is today. And so these things sort of happened just like mobile. Mobile I think is the best example of how it completely changed and transformed our lives. But it did take the better part of a decade for that to happen. And I think the same thing is here. I think in terms of agentic and governing agents and actually having your data house in order, I do think it's going to take the better part of a decade before the agentic AI enterprise agents, enterprise agentic, security agentic and AGI, the autonomous SOC. I think it's going to take the better part of a decade, I would say at least half a decade for the customers to actually absorb that into their environments. And by then, there's going to be new threats.

Rebecca Knight

>> Well, indeed.

Dave Vellante

>> Quantum, who knows?

Rebecca Knight

>> Indeed. So let's talk about the announcements because there have been a number of new products and enhancements. And, of course, we have the acquisitions of Pangea and Onum, which may not have happened exactly at this conference, but are very current. CrowdStrike is really taking a lot of steps to integrate OpenAI models into what it's doing, into its cybersecurity operations and building that into AI workflows of companies. So what is most interesting to you, and what do you think are actually the real game changers here?

Dave Vellante

>> So just checking my notes here from the keynote today, there were six key takeaways that I had. Basically Michael Sentonas was saying, the AI gives the attackers the advantage, number one. Number two, that customers companies are behind and legacy tools aren't going to get it done. Again, good marketing, but by the way, it's true. Then he pivoted to the enterprise graph. And I like that because that is part of CrowdStrike's secret sauce, graph databases have always been sort of niche, but they've been a perfect candidate for security. CrowdStrike has a lot of experience around them because it unifies all the threat, the assets and the identity into a single graph so that you can visualize those and act on it very quickly. And then yesterday's announcements around the agentic security, the agent builder that they announced, built-in governance, and then this all leads to the sort of platform expansion. Today's announcements, there were two, Falcon for IT risk-based patching. So that's AI powered patching, that's precise and intelligent based upon the degree of threat. So it's going to prioritize because patching is a real pain in the neck. A lot of times it's not done for that reason. And so it's kind of a brute force approach. So prioritizing the patching and automating that is key, and having a phased rollout will minimize disruption. And by the way, that's very important because there wasn't a phased rollout last July, at least that was the criticism. It sort of just hit all at once. So I think that was some learnings from last July. And by the way, in fairness to CrowdStrike, the reason that they did that is because they know that customers don't patch and they're trying to move faster than the adversary. And this just sort of backfired. Okay, so let's automate that whole thing and let's prioritize that. I think they've really thought that through. So the interesting thing about this announcement, it pushes CrowdStrike further into IT beyond this detection and response. And so that's good. And it really addresses downtime and patch sprawl and things like that. It reframes patching as a more precise activity. I think the second announcement was the threat AI announcement. It's a new AI driven capability expanding CrowdStrike's agentic security platform. So it ties into the themes of yesterday. So it improves on detection, decision-making, automated responses across Falcon. It really underscores, Rebecca, in my view, the broader pivot to the agentic security platform. And so it signals that these guys want to be the first to automate the SOC and the first to ultimately get to that holy grail of security AGI. And so defenders, they're giving tools for the defenders to go faster. I mean, that's sort of the continued theme. And I think it strengthens their claim that they've got a proprietary platform. They've labeled all the security data. George Kurtz said it yesterday. We kind of got lucky. We didn't know AGI was going to come when it did, but we had done all this labeling, so we were perfectly set up with a high quality data set to take advantage of all this. And I think that's the significance of the two announcements today.

Rebecca Knight

>> Yeah, no, and I think going back to the Pangea acquisition, one of the things that I write about a lot in future of work is about how to get employees using AI. And one of the biggest recommendations that experts give is to let them experiment. Let them play, let them see what they can do, let them rub up against what AI can't do, and really, really make them learn to like it by just playing around with it. But at the same time, that's risky that their inherent risks with that. And so Pangea with its AI governance and allowing companies to have full visibility in terms of what employees are doing with their AI use, how they're using it, what they're using it for, and where they might be going off script a little bit. So I think that that was really interesting to me that they are trying to answer that recommendation.

Dave Vellante

>> It's interesting you said to me when we saw each other this morning, you said, "Well, the demos that I understand," that means it's a good demo. I agree with you. I hate demos because a lot of times I have no idea what they're talking about. This means nothing to me. I don't care about your stupid demo, just let's talk. And so very few, I'd say less than 20% of the demos that I see are useful and meaningful. The demos today of Pangea were very useful. I looked at it as observability for the AI activity that's going on. They didn't use that term observability, but that's kind of what it is for the AI activity that's going on in your enterprise. And they showed how that works. And I thought the demo was outstanding. And I've seen some good, actually, the AI demos are better-

Rebecca Knight

>> They are....

Dave Vellante

>> in this era. So maybe it's not 20%, maybe it's more than that. Now, google's got some pretty cool demos. Some of the AWS demos, although there's too many of them are pretty good. ServiceNow has good demos too. So the AI is making demos a little bit better. The Charlotte demos were really good too.

Rebecca Knight

>> Very cool.

Dave Vellante

>> So props to CrowdStrike for plus one for good demos.

Rebecca Knight

>> Indeed. Indeed. And also, what they're saying now in terms of actually what is the best coding language to learn English, because everything is natural language, and it's really meant for people to be empowered and understand how to work this themselves.

Dave Vellante

>> So the developers, it's interesting. I always sort of struggle between citizen developer, which hardcore developers don't like that term, and hardcore full-stack developers. The latter would say that you still really got to check the work. Although I would say the former, if you're a business analyst doing BI dashboards or Tableau work or analytics, things like that, and you've done a little bit of Python coding and you can write SQL queries, and these coding agents are a superpower for these individuals, and they do a pretty good job. And I've talked to some of those folks and they've said, yeah, GPT-5, for example, does better coding. Anthropic does pretty good coding. That's sort of their wheelhouse. And they've said, I've taken my old code, run it through, whether it's GPT-5 or Anthropic Claude, and said, fix this. And it does a really good job of it. And so it just keeps getting better and better. So I do think the entire developer world gets elevated just as it has in the past with higher-level languages. But this to me is a big step function as somebody who used to program in a similar language. I mean, of course, going from there to higher-level languages was a huge step-up, but I think this is even bigger because of the point that you made that the programming language is the human interface.

Rebecca Knight

>> Indeed. Indeed. Well, Dave, we are just kicking off day two. We've got an exciting lineup. I think there's 11 or 12 interviews we've got on today.

Dave Vellante

>> Woo-hoo.

Rebecca Knight

>> So we got to get going.

Dave Vellante

>> Let's go.

Rebecca Knight

>> We got to get into it.

Dave Vellante

>> Let's go.

Rebecca Knight

>> I'm excited.

Dave Vellante

>> All right.

Rebecca Knight

>> I'm Rebecca Knight for Dave Vellante. Stay tuned for more of theCUBE's live coverage of Fal.Con 2025. You're watching theCUBE, the leader in enterprise tech news and analysis.