CrowdStrike puts SafeMind on NVIDIA's stage while Check Point patches its own exploited 9.8s

One stage, two guards, one landlord

On 3 October 2026 Jensen Huang sat beside George Kurtz and called CrowdStrike's SafeMind "the beginning of a new age of cybersecurity": agentic defense built on NVIDIA's open Nemotron models, running natively in Falcon ¹. The models underneath, an offensive one called Red Tempest and a defensive one called Blue Solano, had launched five weeks earlier at Fal.Con on 1 September↗, trained on Falcon telemetry and fifteen years of incident-response fieldwork, with CoreWeave supplying compute ².

Same stack, two tills

Six days before the shared stage, on 28 September, Check Point had published its half of the same NVIDIA stack: a beta integration↗ that pushes its semantic monitoring through the open-source OpenShell runtime and returns a verdict on every proposed agent action in under 100 milliseconds, before it reaches the host ³⁴. Check Point sells judgment, CrowdStrike sells autonomous counterattack, and the buyer writes one line item either way. CrowdStrike starts from the bigger base: $5.84 billion of recurring revenue, up 25%, stock at $269.12 on 2 October ⁵. Check Point reports third-quarter results before the open on 2 November↗ ⁶.

The guard with the open door

Check Point's own 22 September advisory confirmed active exploitation↗ of two flaws rated CVSS 9.8: unauthenticated remote code execution in Security Gateway VPN certificate handling (CVE-2026-85102) and a zero-day path traversal in the Management web service (CVE-2026-93616) ⁷. CISA catalogued both as exploited that same day↗, with a 25 September deadline ⁸⁹. LivePatch Takes 28 and 29, the fixes many customers already run, do not close the management hole ⁷. The vendor selling the 100-millisecond verdict spent September watching attackers walk through its own front door.

The fear is the invoice

Both camps price from the same fear file, mostly CrowdStrike's: AI-enabled attacks up 89% in a year, the fastest eCrime breakout down to 27 seconds, 2.5 times as many threat-hunting leads triggered by AI agents as by humans↗, and 88% of exploits detected within 48 hours of a proof-of-concept in the first half of 2026 ¹¹⁰. CrowdStrike also grades its own exam, claiming Blue Solano beat leading frontier models at 99% lower cost in internal evaluations ¹².

Check Point banks the profit while CrowdStrike buys the growth

CrowdStrike grew revenue 25.8% in the quarter ended 31 July; Check Point grew 1.3% through June, its fourth straight slowdown ¹¹¹². Check Point still banked $185 million of operating income while CrowdStrike lost $33 million ¹¹¹².

Agent security in the revenue, or only in the slides

Check Point's exhibits hold up: the VPN flaw was fixed on 9 September, before the exploitation wave it observed from 12 September; the zero-day was fixed with the advisory; no customer breach is named ⁷. A patch proves the door is shut now, never that nobody walked in earlier↗ ¹³. SafeMind's 29% detection gain is a vendor number, and OpenShell is a beta ²³. The 2 November call decides whether agent security shows up in Check Point's revenue or only in its slides. NVIDIA gets paid either way; the quarter decides which guard collects the line item.