---
title: "CrowdStrike ships a model trained on AI attacks as SentinelOne launches a rival"
description: "Fal.Con Europe opened in Barcelona with the first SafeMind-trained model due in Falcon this week, days after CrowdStrike reported an agent-driven campaign that hunted for machines without its sensor."
publisher: "The Inference"
section: "Security"
published: 2026-11-02T18:10:22.937Z
modified: 2026-11-02T18:10:22.937Z
canonical: https://theinference.org/article/crowdstrike-ships-a-model-trained-on-ai-attacks-as-sentinelone-launches-a-rival
language: en
keywords: "CrowdStrike, SentinelOne, AI Security, Cybersecurity, Fal.Con Europe, Product Launch"
---

# CrowdStrike ships a model trained on AI attacks as SentinelOne launches a rival

> Fal.Con Europe opened in Barcelona with the first SafeMind-trained model due in Falcon this week, days after CrowdStrike reported an agent-driven campaign that hunted for machines without its sensor.

Fal.Con Europe opened in Barcelona on November 2, sold out and running to November 4 [1], and it is the week [CrowdStrike](https://theinference.org/markets/companies/crowdstrike)'s boldest research turns into product. The first SafeMind-trained defensive model, built in the company's attack-emulation factory, [ships into the Falcon platform this week](https://www.computerweekly.com/news/366653292/CrowdStrikes-SafeMind-pits-AI-attackers-against-AI-defenders) [2]. With the stock up 114% this year [3], the question is narrow: does in-house AI defense convert into sellable product before the AI labs intercept the same budget?

## The threat it trains against routes around the sensor

CrowdStrike's [October 29 report](https://forkast.news/crowdstrike-reports-vapor-panda-used-artex-against-200-organizations/) is the demand proof [4]. It attributes to VAPOR PANDA, a crew it links to China, [a campaign that ran the open-source ARTEX agent framework](https://theinference.org/article/crowdstrike-tracks-a-china-backed-ai-agent-hacking-campaign-at-200-plus-targets-as-security-stocks-sell-off) against more than 200 organizations [4]. It counts confirmed intrusions at nine of them [4]. The recovered transcript carries the detail that matters for SafeMind: a human operator told the agents to find Windows machines in the domain without Falcon [4]. Attackers now hunt for the machines the sensor is not on, which is a threat to the endpoint model itself.

SafeMind answers by construction. Red Tempest attack models, built on [Nvidia](https://theinference.org/markets/companies/nvidia)'s Nemotron plus safety-stripped open-weight models, run loose across 40,000 to 60,000 emulated corporate networks, and their attack traces train Blue Solano defenders that harden those environments on their own [2].

## What actually sells this week

Day one brought a [CoreWeave partnership](https://www.businesswire.com/news/home/20261101186895/en) putting Falcon protection and managed security on cloud AI workloads [5]. On November 2 CrowdStrike also [expanded Project QuiltWorks across Europe](https://www.businesswire.com/news/home/20261101940334/en/CrowdStrike-Scales-Project-QuiltWorks-Across-Europe-Advancing-the-Industrys-Response-to-Frontier-AI-Risk), adding Atos, BT, Deutsche Telekom Security and Telefónica among fifteen partners who turn AI-found vulnerabilities into fixed ones [6].

[QuiltWorks packages frontier models](https://theinference.org/article/crowdstrike-sets-up-shop-inside-openai-s-prepaid-ai-budget) from [OpenAI](https://theinference.org/markets/companies/openai) and [Anthropic](https://theinference.org/markets/companies/anthropic) with CrowdStrike intelligence, which puts the labs' models inside CrowdStrike's delivery machine rather than selling around it [6]. Later phases open QuiltWorks as trusted access to the Red Tempest and Blue Solano models themselves, and sell the emulation environment, including air-gapped installs for governments [2].

## Three camps want the same budget

[SentinelOne](https://theinference.org/markets/companies/sentinelone) [launched Singularity Agentic Detection and Response](https://theoutpost.ai/news-story/sentinelone-unveils-detection-system-as-traditional-edr-tools-struggle-with-ai-agents-32875/) this week, its product chief calling traditional endpoint tools flying blind against agents [7]. [Gartner](https://theinference.org/markets/companies/gartner) puts spending on AI-security platforms at $3 billion this year [3]. By 2028 it expects $7.7 billion [3]. OpenAI's finance chief [calls security a huge business, and Anthropic's IPO filing names it](https://theinference.org/article/crowdstrike-at-189-times-forward-earnings-as-openai-and-anthropic-come-for-the-150-billion-security-budget) one of the company's most important near-term opportunities [8]. CrowdStrike's counter is distribution, and it is already paying: Falcon [Flex](https://theinference.org/markets/companies/flex) annual recurring revenue has passed $2.2 billion [3].

## The trade

Deutsche Bank [upgraded CrowdStrike to Buy with a $300 target](https://www.tradingview.com/news/tradingview:0f1b31fe8e12b:0-deutsche-bank-upgrades-crowdstrike-holdings-to-buy-from-hold-raises-price-target-to-300-from-240/) on November 2, the day the conference opened [9]. The shares had closed 4.1% lower on Friday [3]. Analyst targets now span $265 to $320 [9].

*Chart: **CrowdStrike analyst targets now run from $265 to $320 after Deutsche Bank's upgrade** Bar chart of six recent analyst price targets on CrowdStrike, all above the October 30 close of $250.43, with Deutsche Bank's new $300 target highlighted.*

*Analyst price targets on CrowdStrike in US dollars, as compiled by Benzinga and published on TradingView on November 2, 2026 [9]. The reference line marks the October 30 close of $250.43 [9]. [9]*

The capability is real, the distribution is enviable, and the labs already sit inside CrowdStrike's machine. What turns the story into revenue is whether the models shipping this week measurably harden customer fleets, and that test shows up in renewal data, not keynote applause. Meeting AI-powered attacks with better AI defense is the right answer, which makes conversion speed, not the technology, the thing to judge from here.

## Takeaway

CrowdStrike's first SafeMind-trained model ships into Falcon this week; whether AI defense converts to revenue will show in renewals, not keynote applause.

## Sources

1. [Ad-hoc News, CrowdStrike stock enters Fal.Con Europe with 70 sponsors, 29 October 2026](https://www.ad-hoc-news.de/boerse/news/corporate-news/crowdstrike-stock-enters-fal-con-europe-with-70-sponsors/70444743)
2. [Computer Weekly (Informa TechTarget), CrowdStrike's SafeMind pits AI attackers against AI defenders, 2 November 2026](https://www.computerweekly.com/news/366653292/CrowdStrikes-SafeMind-pits-AI-attackers-against-AI-defenders)
3. [Stocktwits via Yahoo Finance, CRWD, PANW, OKTA Stocks Have Doubled This Year: What's Driving the Cybersecurity Rally, 1 November 2026](https://finance.yahoo.com/technology/ai/articles/crwd-panw-okta-stocks-doubled-144415165.html)
4. [Forkast News, CrowdStrike Reports VAPOR PANDA Used ARTEX Against 200+ Organizations, 29 October 2026](https://forkast.news/crowdstrike-reports-vapor-panda-used-artex-against-200-organizations/)
5. [Business Wire, CrowdStrike Partners with CoreWeave to Secure Mission-Critical AI Workloads at Scale, 1 November 2026](https://www.businesswire.com/news/home/20261101186895/en)
6. [Business Wire, CrowdStrike Scales Project QuiltWorks Across Europe, Advancing the Industry's Response to Frontier AI Risk, 2 November 2026](https://www.businesswire.com/news/home/20261101940334/en/CrowdStrike-Scales-Project-QuiltWorks-Across-Europe-Advancing-the-Industrys-Response-to-Frontier-AI-Risk)
7. [TheOutpost.AI, SentinelOne Unveils Detection System as Traditional EDR Tools Struggle with AI Agents, 2 November 2026](https://theoutpost.ai/news-story/sentinelone-unveils-detection-system-as-traditional-edr-tools-struggle-with-ai-agents-32875/)
8. [The Economist, Hackers are running riot with AI. Its makers want to cash in, 1 November 2026](https://www.economist.com/business/2026/11/01/hackers-are-running-riot-with-ai-its-makers-want-to-cash-in)
9. [TradingView (Benzinga), Deutsche Bank upgrades CrowdStrike Holdings to Buy from Hold, raises price target to $300 from $240, 2 November 2026](https://www.tradingview.com/news/tradingview:0f1b31fe8e12b:0-deutsche-bank-upgrades-crowdstrike-holdings-to-buy-from-hold-raises-price-target-to-300-from-240/)


---

CrowdStrike ships a model trained on AI attacks as SentinelOne launches a rival — The Inference. Canonical: https://theinference.org/article/crowdstrike-ships-a-model-trained-on-ai-attacks-as-sentinelone-launches-a-rival