Photo: Web Summit, CC BY 2.0 via Wikimedia Commons
Attacker breakout time, how long it takes a hacker to pivot from one compromised machine to a more valuable one, has collapsed from days to an average of 29 minutes. George Kurtz, co-founder, president and CEO of CrowdStrike, told Sarah Guo and Elad Gil on No Priors. Most of the cybersecurity industry still talks about spotting reused malware code. George says that framework is already obsolete.
"What people have to keep in mind is it's not malware anymore, it's prompts."
He has spent the last six months building CrowdStrike's own frontier AI models directly with Nvidia's Jensen Huang, a bet he says is now central to the company's roadmap.
The full interview is covered here so you can skip it. 45 minutes of audio, 9 minutes of reading.
Here are the 6 takeaways that matter.
No Priors: AI, Machine Learning, Tech, & Startups · Oct 22, 2026 · 45m · 36m saved
With George Kurtz, Co-founder, President and CEO of CrowdStrike
This Scuttlebutt Summary is available in full to premium subscribers. If you're not one already, please consider subscribing to keep reading.
Key Takeaways
Attacker breakout time has fallen to an average of 29 minutes, as fast as 27 seconds in one case
The same capability a nation-state had a few years ago now sits with a hacktivist, George says
Frontier models now refuse routine cybersecurity work, pushing attackers and defenders alike onto open-weight models
George runs uncensored models capable of building ransomware kits on his own home hardware
The defenders in the Hugging Face breach didn't have the same AI capability as the attackers
That gap is the direct reason CrowdStrike built its own models instead of leaning on a partner lab
CrowdStrike's own model costs about 3 cents per task against a frontier model's roughly $10
Built with Nvidia as "Safe Mind," on 15 years of CrowdStrike's own incident data
Most companies have no idea how much "shadow AI" is already running inside them
Breaches keep happening because attackers are logging in, not breaking in, George says
George rejects calls to "air gap" critical systems, saying agents just do familiar things faster
1. Attacks Now Take Minutes
George's framing for the episode is his own long-standing "pyramid of pain" model of adversary sophistication: hacktivists at the wide base, cybercriminals in the middle, nation-states at the narrow, most capable top. He says AI agents have blown that pyramid apart, putting nation-state-level capability into the hands of anyone willing to run an unaligned, open-weight model.
The same capability a nation-state had a few years ago now sits with a hacktivist, George says
"The new apex predator is the agent state, not the nation state. The same level of capability that a nation state would have just a few years ago, essentially a hacktivist would have today." — George Kurtz
That shift changes what a defender is even looking for. Instead of a reusable piece of malware with a fingerprint, each attack now carries a one-off prompt engineered on the fly for that specific target.
Breakout time has collapsed from days to an average of 29 minutes, as fast as 27 seconds
"That used to be days and hours and now it's minutes. On average it's 29 minutes, but we've seen it as quick as 27 seconds." — George Kurtz
Breakout time is how long it takes an attacker who has landed on one machine to pivot to a more valuable one. A window defenders used to measure in days now closes in well under an hour.
