智能体
developer.nvidia.com ·
@Michelle Horton
NVIDIA与CrowdStrike联合构建自适应智能体网络安全系统
NVIDIA与CrowdStrike合作，利用Nemotron开放模型和Falcon遥测技术，构建了一个验证优先的攻防智能体系统。该系统在隔离环境中实现闭环操作，通过模式知识库、遥测接地、专用检测生成等机制，显著提升了检测率。实验显示，优化后的开放模型管道平均检测率达41.9%，较默认配置提升2.5倍；在实时测试中，45%的开放模型检测可泛化，优于前沿系统的29%。
AI推荐理由 NVIDIA官方博客发布，与CrowdStrike合作，提供具体技术细节和量化结果（如检测率提升2.5倍、45%泛化率），信息密度高，时效性强，对AI在网络安全领域的应用有实际参考价值。
85
正文
可信AI / 网络安全
使用NVIDIA Nemotron构建自适应代理网络安全系统
NVIDIA与CrowdStrike将Nemotron开放模型、Falcon遥测和专用代理框架相结合，构建了一个验证优先的攻防代理系统。
2026年9月1日
作者：Roberto Rodriguez和Neha Hudait
喜欢
L
T
F
R
E
AI生成摘要
NVIDIA和CrowdStrike评估了一个代理攻防系统，该系统将进攻和防御活动连接成一个连续的闭环，在模拟NVIDIA加速计算基础设施的隔离环境中以机器速度运行。
防御框架结合了六种机制，包括模式知识库、遥测接地、使用定制Nemotron 3 Super的专门检测编写、工件检查、检测重放和独立审查，以生成有根据、可测试的检测。
在评估的配置中，Nemotron 3 Ultra负责防御编排，而经过后训练的Nemotron 3 Super作为有界专家用于检测生成和修复，训练使用NVIDIA NeMo Gym和NVIDIA NeMo RL进行具有可验证奖励的强化学习。
回测显示，优化的开放模型流水线在六次会话中平均检测率达到41.9%，比仅使用Nemotron 3 Ultra的默认框架提高了2.5倍。
针对八个未见攻击的实弹测试表明，开放模型检测中有45%实现了泛化，而前沿系统为29%，其中三个开放检测达到黄金标准并覆盖所有八个攻击，而前沿系统没有检测达到黄金标准。
后续步骤
探索NVIDIA Nemotron 3，为有界领域定制和评估专用代理。
查看NeMo Megatron Bridge的模型集成能力。
尝试NeMo Gym，在逼真环境中验证和执行生成的查询。
使用NeMo RL，通过强化学习基于可验证结果更新模型。
由NVIDIA Nemotron提供支持。AI生成的内容可能不完整地总结信息。请验证重要信息。了解更多
AI正在改变网络安全的节奏。代理系统可以协调工作并在长时间范围内追求复杂目标。安全团队开始将代理应用于安全运营，但许多实现仍锚定于现有警报、预定义工作流和已知攻击行为。更难的问题是识别防御遗漏的内容，并将这些差距转化为可靠的覆盖。这需要在组织的独特环境中反复测试自适应攻击，并针对正常企业活动验证候选检测。
持续的攻防测试创造了这种反馈循环。受控攻击产生防御代理所需的遥测和地面真相，以暴露差距、改进覆盖并重新测试。然而，端到端循环仍然需要大量手动工作。由开放模型和专用框架驱动的红蓝代理能否以机器速度和规模运行此循环？
NVIDIA和CrowdStrike在模拟NVIDIA加速计算基础设施的隔离环境中评估了一个代理攻防系统。在防御方面，为网络安全定制的NVIDIA Nemotron模型在CrowdStrike SafeMind（其代理网络安全系统）中运行。CrowdStrike报告称，其Blue Solano防御模型在CrowdStrike内部评估中比测试的领先专有前沿模型更准确，成本降低99%。对于此评估，优化的开放模型配置将NVIDIA Nemotron 3 Ultra用于防御编排，并将微调的Nemotron 3 Super用于检测生成。
本文分享了Nemotron模型和专用代理框架如何与CrowdStrike的代理系统协同工作，如何部署和评估，以及生成的检测在独立播种的攻击运行中的表现。
将攻防转化为持续学习循环
传统的红蓝团队演练依赖于手动交接：红队执行攻击，蓝队审查生成的遥测，检测工程师开发或更新检测，红队重新测试。每次交接都需要时间，限制了团队可以评估的迭代次数和攻击变体。攻防代理系统将这些活动连接成一个可重复的闭环，可以以机器速度运行。在隔离的代表性环境中，每次运行都会产生攻击痕迹和传感器遥测，用于创建或改进检测。生成的上下文返回给红代理框架，该框架适应并测试替代攻击或逃避路径，直到在代表性环境中找不到进一步可行的路径。
图1. 网络安全闭环代理系统
工作流有四个连接阶段：
执行并捕获。从威胁知情目标开始，红代理框架在代表性环境内选择并执行攻击路径。其操作痕迹记录每个步骤，而CrowdStrike Falcon端点传感器捕获相应的遥测。
处理并重建。然后，蓝代理框架接收操作痕迹、传感器遥测和更广泛的攻击上下文。使用有关可用数据源和CrowdStrike检测工程专业知识的信息作为接地上下文，它确定事件序列的哪些部分可以重建，哪些现有检测触发，以及哪些可见性或检测差距仍然存在。
生成并验证。基于此分析，蓝代理框架生成候选检测。验证框架检查每个候选，针对捕获的遥测进行回测，返回失败以进行纠正，并将验证的检测发送到检测引擎。
重新测试、适应并重复。部署验证的检测后，独立播种的攻击重新测试
相同目标。检测和警报上下文返回给红代理框架，该框架适应并探索替代攻击或逃避路径，为蓝代理框架产生新的痕迹和遥测。
每个周期旨在加强防御覆盖，同时迫使进攻方在完全了解防御的情况下找到更困难的路径。循环持续，直到在建模环境中不再存在可行的路径。
构建代表性测试环境
为了启用安全、逼真的测试，NVIDIA提供了代表其加速计算基础设施的净化自然语言规范。代理辅助工作流将规范转换为使用Falcon平台传感器进行仪器化的隔离目标网络代理环境。
评估使用攻击路径和可观察里程碑来从操作痕迹和传感器遥测中测量进度，而不是代理自身的声明。NVIDIA安全专家审查了环境和威胁路径的逼真性。相同的审查环境支持每次攻击运行、检测测试和评估指标，从而能够跨配置进行一致比较。
专业化防御框架
下一个挑战是将生成的攻击痕迹和遥测转化为能够通过技术和行为验证的检测规则。开放代理框架已经提供规划、工具使用、上下文管理和迭代纠正等功能。开放安全AI联盟正在帮助扩展更广泛的开放模型、框架和网络安全工具生态系统。
图2. 为检测工程专业化默认代理框架
防御框架结合了六种机制：
模式知识库。工具允许代理枚举支持的Falcon传感器模式、字段和查询语法，防止发明字段和无效查询。
遥测接地。红代理痕迹、Falcon遥测和更广泛的攻击上下文将工作流锚定在观察事件和关系中，减少不支持或幻觉连接。
专门检测编写。定制的Nemotron 3 Super作为有界专家，用于生成和修复检测，将此专门任务与更长的编排上下文分开。
工件检查。自动检查拒绝语法错误、不支持的字段以及绑定到特定IP地址、主机、用户或子网的检测。失败返回指导，以围绕行为信号而不是环境特定字符串重写检测。
检测重放。每个候选都针对捕获的攻击遥测进行重放。未产生匹配的检测被拒绝并返回纠正，捕获看似有效但未能检测到记录活动的候选。
独立审查。具有新上下文的单独法官评估每个检测的行为对齐、鲁棒性和适当使用多个信号，捕获检查和重放遗漏的质量差距。
失败的检查返回结构化反馈给蓝代理工作流以进行纠正和另一次尝试。总之，这些机制编码了通常通过手动检测工程审查应用的做法，使检测生成有根据、可测试和可纠正，而不仅仅是看似合理。
为防御编排和检测生成定制Nemotron
诸如Nemotron之类的开放模型可以使用领域数据进行后训练，在受控环境中使用专有上下文部署，并针对成本和规模进行优化。在评估的开放模型配置中，Nemotron 3 Ultra重建攻击序列、规划检测工程步骤并调用工具。当检测需要编写或修复时，定制的Nemotron 3 Super作为有界专家。这种分离使工作流编排与专门检测编写保持不同。
图3. 将防御编排与专门检测编写和修复分开
为了创建此专门专家，CrowdStrike使用Nemotron 3 Super作为其NL2LogScale模型的基础，然后应用网络安全知识的持续预训练、监督微调和具有可验证奖励的强化学习。微调使用了9,349个检测生成和多步修复示例，涵盖59种程序生成的错误类型。训练数据结合了来自Nemotron 3 Super的请求改写、真实的Falcon LogScale执行错误以及来自Nemotron 3 Ultra的质量审查推理痕迹。
图4. 后训练专门Nemotron 3 Super用于检测、编写和修复
对于强化学习，训练工作流使用NVIDIA NeMo Gym在Falcon LogScale中验证和执行生成的查询。无效查询收到真实引擎错误和最多五次修复尝试，未解决的尝试获得零奖励。有效生成的查询和参考查询针对相同的合成日志运行，其返回事件之间的F1重叠提供奖励。NVIDIA NeMo RL支持组相对策略优化以更新模型。对于强化学习，工作流使用NeMo Gym验证生成的查询，并使用NeMo RL基于可验证结果更新模型。
图5. RLVR奖励匹配查询结果，而不仅仅是有效语法
从回测到实弹评估完整代理系统
检测可能检测到用于创建它的记录攻击，但在相同行为的新执行中失败。因此，我们分两个阶段评估每个系统：针对记录攻击的回测，然后针对来自相同场景系列的八个新攻击的实弹测试。每个通过的检测都逐字部署到实时检测引擎。独立的第三方模型判断每个匹配是否代表预期的攻击行为，结果在独立播种的编写会话中取平均。
针对记录攻击的回测
使用Nemotron
3 Ultra和默认框架，在八个独立播种的会话中，平均有16.5%的生成检测检测到记录的攻击。保留Ultra同时添加调整后的框架、定制的Nemotron 3 Super、领域上下文、工具和验证，将六个会话的平均值提高到41.9%，提高了2.5倍。由于优化配置同时更改了框架和模型堆栈，因此增益反映了完整的开放流水线，而不是孤立的模型消融。
图6. 独立播种编写会话中的平均回测检测
通过实弹测试评估泛化
在实弹测试期间，来自由Nemotron驱动的优化开放流水线的11个通过回测的检测和来自完整前沿系统的35个检测被部署到八个未见攻击。11个开放检测中有5个（45%）检测到至少一个攻击，而前沿检测为10个（29%）。开放流水线平均每个检测产生2.6个检测，而前沿系统为1.1个。
然而，仅检测是第一个质量门。要获得黄金资格，检测还必须在可用测试流量上保持安静，并通过独立审查，包括行为接地、多个信号和无环境特定字符串。五个触发的开放检测中有四个和十个触发的前沿检测中有九个保持安静，分别覆盖八个攻击中的八个和七个。审查后，三个开放检测和零个前沿检测获得黄金资格。三个开放检测仍然覆盖所有八个攻击。
图7. 实弹验证漏斗
解释结果
前沿系统产生了更多通过回测的检测，但优化的Nemotron开放模型流水线产生了更高比例的泛化检测，平均每个检测产生更多检测，并且是唯一产生黄金检测的系统。评估涵盖一个场景系列和小型检测集，因此跨场景泛化仍未测试。有限的良性流量也意味着噪声测试不代表生产误报性能。八个实弹运行中有三个遇到框架故障，但产生了完整的遥测并被保留。这些发现是方向性的系统级案例研究，而不是通用基准。
将模式应用于专用代理
评估显示了使用NVIDIA Nemotron构建专用代理的更广泛模式：推理模型编排防御工作流，后训练的开放模型处理有界专家任务，代理框架管理上下文、工具和验证。出现四个设计原则：
为每个模型定义可测量任务并分配明确职责。
使用领域数据和可验证奖励后训练专门模型。
将输出接地在权威上下文中，并通过确定性检查、逼真重放和独立审查进行验证。
在逼真条件下评估完整工作流，由安全专家控制场景、护栏和验证输出的使用。
CrowdStrike正在通过其代理网络安全系统SafeMind推进此方法，该系统将进攻性和防御性AI结合在连续共同进化循环中。探索NVIDIA Nemotron 3、NeMo Megatron Bridge、NeMo Gym和NeMo RL，为其他有界领域定制和评估专用代理。
喜欢
标签
代理AI / 生成式AI | 可信AI / 网络安全 | 通用 | NeMo | Nemotron | 中级技术 | 深入探讨 | AI安全
关于作者
关于Roberto Rodriguez
Roberto Rodriguez是NVIDIA AI安全运营负责人，专攻代理网络防御，在构建创新安全能力和将研究转化为现实防御系统方面拥有良好记录。
在加入NVIDIA之前，他领导了Microsoft自主防御与保护团队（ADAPT）内的应用AI研究团队，为Microsoft CISO组织开发自主安全能力。他还为Microsoft威胁情报中心（MSTIC）的研究和工程工作做出了贡献，帮助构建调查复杂威胁和解决世界上一些最具挑战性安全问题的能力。Roberto是开放威胁研究社区的创始人，也是Dapr Agents的创建者，这是一个开源、供应商中立的代理框架，为AI系统带来持久执行和生产级弹性，现在属于云原生计算基金会（CNCF）生态系统。
查看Roberto Rodriguez的所有帖子
关于Neha Hudait
Neha Hudait是NVIDIA的高级安全产品经理，与领导层合作领导网络安全战略的制定和执行。专注于推进安全研究和战略，Neha在塑造AI和加速计算安全的未来方面发挥关键作用。Neha拥有加州大学伯克利分校的电气工程与计算机科学（EECS）和工商管理学位，作为管理、创业与技术（M.E.T.）项目的一部分。她的工作强调技术创新、最佳实践，并推动网络安全社区内的多样性和包容性。
查看Neha Hudait的所有帖子
查看原文（中文正文为 AI 翻译）
Trustworthy AI / Cybersecurity
Building an Adaptive Agentic Cybersecurity System with NVIDIA Nemotron
NVIDIA and CrowdStrike combined Nemotron open models, Falcon telemetry, and specialized agent harnesses in a validation-first offensive-defensive agentic system.
Sep 01, 2026
By Roberto Rodriguez and Neha Hudait
Like
L
T
F
R
E
AI-Generated Summary
NVIDIA and CrowdStrike evaluated an agentic attack-defense system that connects offensive and defensive activities into a continuous closed loop operating at machine speed within an isolated environment modeled on NVIDIA accelerated computing infrastructure.
The defensive harness combined six mechanisms including a schema knowledge base, telemetry grounding, specialized detection authoring with a customized Nemotron 3 Super, artifact linting, detection replay, and independent review to produce grounded, testable detections.
In the evaluated configuration, Nemotron 3 Ultra handled defensive orchestration while a post-trained Nemotron 3 Super served as a bounded expert for detection generation and repair, with training using NVIDIA NeMo Gym and NVIDIA NeMo RL for reinforcement learning with verifiable rewards.
Backtesting showed the optimized open-model pipeline achieved a 41.9% mean detection rate across six sessions, a 2.5x improvement over the default harness with Nemotron 3 Ultra alone.
Live-fire testing against eight unseen attacks demonstrated that 45% of open-model detections generalized compared to 29% for the frontier system, with three open detections qualifying as gold and covering all eight attacks while no frontier detections achieved gold status.
Next Steps
Explore NVIDIA Nemotron 3 to customize and evaluate specialized agents for bounded domains.
Review NeMo Megatron Bridge for model integration capabilities.
Try NeMo Gym to validate and execute generated queries in realistic environments.
Use NeMo RL to update models based on verifiable results through reinforcement learning.
Powered by NVIDIA Nemotron. AI-generated content may summarize information incompletely. Verify important information. Learn more
AI is changing the pace of cybersecurity. Agentic systems can coordinate work and pursue complex objectives over long horizons. Security teams are beginning to apply agents across security operations, but many implementations remain anchored to existing alerts, predefined workflows, and known attack behaviors. The harder problem is identifying what defenses miss and turning those gaps into reliable coverage. This requires repeatedly testing adaptive attacks in an organization’s unique environment and validating candidate detections against normal enterprise activity.
Continuous offense-defense testing creates this feedback loop. Controlled attacks produce the telemetry and ground truth defensive agents need to expose gaps, improve coverage, and retest. However, the end-to-end cycle still requires significant manual effort. Could red and blue agents powered by open models and specialized harnesses operate this loop at machine speed and scale?
NVIDIA and CrowdStrike evaluated an agentic attack-defense system in an isolated environment modeled on NVIDIA accelerated computing infrastructure. On the defensive side, NVIDIA Nemotron models customized for cybersecurity operate within CrowdStrike SafeMind, its agentic cybersecurity system. CrowdStrike reports that its Blue Solano defensive model is more accurate than the leading proprietary frontier model tested, at 99% lower cost, in CrowdStrike internal evaluations. For this evaluation, the optimized open-model configuration paired NVIDIA Nemotron 3 Ultra for defensive orchestration with a fine-tuned Nemotron 3 Super for detection generation.
This post shares how Nemotron models and specialized agent harnesses work together with CrowdStrike’s agentic system, how it was deployed and evaluated, and how the resulting detections performed across independently seeded attack runs.
Turning offense and defense into a continuous learning loop
Traditional red-and-blue team exercises depend on manual handoffs: the red team executes an attack, the blue team reviews the resulting telemetry, detection engineers develop or update detections, and the red team retests them. Each handoff takes time, limiting the number of iterations and attack variations teams can evaluate. An offensive-defensive agentic system connects these activities into a repeatable closed loop that can operate at machine speed. Within an isolated representative environment, each run produces attack traces and sensor telemetry used to create or refine detections. The resulting context returns to the red-agent harness, which adapts and tests alternative attack or evasion paths until it finds no further viable route within the representative environment.
Figure 1. Closed-loop agentic system for cybersecurity
The workflow has four connected stages:
Execute and capture. Starting with a threat-informed objective, the red-agent harness selected and executed an attack path inside the representative environment. Its action trace recorded each step, while CrowdStrike Falcon endpoint sensors captured the corresponding telemetry.
Process and reconstruct. The blue-agent harness then received the action trace, sensor telemetry, and broader attack context. Using information about the available data sources and CrowdStrike detection-engineering expertise as grounding context, it determined which parts of the event sequence could be reconstructed, which existing detections triggered, and where visibility or detection gaps remained.
Generate and validate. Based on this analysis, the blue-agent harness generated candidate detections. The validation harness checked each candidate, backtested it against the captured telemetry, returned failures for correction, and sent validated detections to the detection engine.
Retest, adapt, and repeat. After a validated detection was deployed, an independently seeded attack retested the same objective. Detection and alert context returned to the red-agent harness, which adapted and explored alternative attack or evasion paths, producing new traces and telemetry for the blue-agent harness.
Each cycle is designed to strengthen defensive coverage while forcing the offense to find a harder path with full knowledge of the defense. The loop continues until no further viable path remains within the modeled environment.
Building a representative test environment
To enable safe, realistic testing, NVIDIA provided a sanitized, natural-language specification representing its accelerated computing infrastructure. An agent-assisted workflow translated the specification into an isolated target cyber agent environment instrumented with Falcon platform sensors.
The evaluation used attack paths and observable milestones to measure progress from action traces and sensor telemetry rather than the agent’s own claims. NVIDIA security experts reviewed the environment and threat paths for realism. The same reviewed environment supported every attack run, detection test, and evaluation metric, enabling consistent comparisons across configurations.
Specializing the defensive harness
The next challenge was turning the resulting attack traces and telemetry into detection rules that could pass technical and behavioral validation. Open agent harnesses already provide capabilities such as planning, tool use, context management, and iterative correction. The Open Secure AI Alliance is helping expand the broader ecosystem of open models, harnesses, and tools for cybersecurity.
Figure 2. Specializing a default agent harness for detection engineering
The defensive harness combined six mechanisms:
Schema knowledge base. A tool allowed agents to enumerate supported Falcon sensor schemas, fields, and query syntax, preventing invented fields and invalid queries.
Telemetry grounding. Red-agent traces, Falcon telemetry, and broader attack context anchored the workflow in observed events and relationships, reducing unsupported or hallucinated connections.
Specialized detection authoring. A customized Nemotron 3 Super served as a bounded expert for generating and repairing detections, separating this specialized task from the longer orchestration context.
Artifact linting. Automated checks rejected syntax errors, unsupported fields, and detections tied to specific IP addresses, hosts, users, or subnets. Failures returned guidance for rewriting the detection around behavioral signals instead of environment-specific strings.
Detection replay. Each candidate was replayed against captured attack telemetry. Detections that produced no match were rejected and returned for correction, catching candidates that appeared valid but failed to detect the recorded activity.
Independent review. A separate judge with a fresh context evaluated each detection for behavioral alignment, robustness, and appropriate use of multiple signals, catching quality gaps missed by linting and replay.
Failed checks returned structured feedback to the blue-agent workflow for correction and another attempt. Together, these mechanisms encoded practices normally applied through manual detection-engineering review, making detection generation grounded, testable, and correctable rather than merely plausible.
Customizing Nemotron for defensive orchestration and detection generation
Open models such as Nemotron can be post-trained with domain data, deployed with proprietary context in controlled environments, and optimized for cost and scale. In the evaluated open-model configuration, Nemotron 3 Ultra reconstructed attack sequences, planned detection-engineering steps, and invoked tools. When a detection required writing or repair, a customized Nemotron 3 Super served as a bounded expert. This separation kept workflow orchestration distinct from specialized detection authoring.
Figure 3. Separating defensive orchestration from specialized detection writing and repair
To create this specialized expert, CrowdStrike used Nemotron 3 Super as the base for its NL2LogScale model, then applied continual pretraining on cybersecurity knowledge, supervised fine-tuning, and reinforcement learning with verifiable rewards. Fine-tuning used 9,349 detection-generation and multistep repair examples spanning 59 programmatically generated error types. The training data combined request rephrasings from Nemotron 3 Super, real Falcon LogScale execution errors, and quality-reviewed reasoning traces from Nemotron 3 Ultra.
Figure 4. Post-training specialized Nemotron 3 Super for detection, writing, and repair
For reinforcement learning, the training workflow used NVIDIA NeMo Gym to validate and execute generated queries in Falcon LogScale. Invalid queries received real engine errors and up to five repair attempts, with unresolved attempts receiving zero reward. Valid generated and reference queries ran against the same synthetic logs, and the F1 overlap between their returned events supplied the reward. NVIDIA NeMo RL supported group relative policy optimization to update the model. For reinforcement learning, the workflow used NeMo Gym to validate generated queries and NeMo RL to update the model based on verifiable results.
Figure 5. RLVR rewarded matching query results, not merely valid syntax
Evaluating the complete agent system from backtest to live fire
A detection may detect the recorded attack used to create it, but fail on a new execution of the same behavior. Therefore, we evaluated each system in two stages: backtesting against the recorded attack, followed by live-fire testing against eight new attacks from the same scenario family. Every passing detection was deployed verbatim to the live detection engine. An independent third-party model judged whether each match represented the intended attack behavior, and results were averaged across independently seeded authoring sessions.
Backtesting against the recorded attack
With Nemotron 3 Ultra and the default harness, an average of 16.5% of generated detections detected the recorded attack across eight independently seeded sessions. Retaining Ultra while adding the tuned harness, customized Nemotron 3 Super, domain context, tools, and validation raised the mean to 41.9% across six sessions, a 2.5x improvement. Because the optimized configuration changed both the harness and model stack, the gain reflects the complete open pipeline rather than an isolated model ablation.
Figure 6. Mean backtest detection across independently seeded authoring sessions
Evaluating generalization through live-fire testing
During live-fire testing, 11 backtest-passing detections from the optimized open pipeline powered by Nemotron and 35 from the complete frontier system were deployed against eight unseen attacks. Five of the 11 open detections (45%) detected at least one attack, compared with 10 frontier detections (29%). The open pipeline averaged 2.6 detections per detection, compared with 1.1 for the frontier system.
Detection alone, however, was only the first quality gate. To qualify as gold, detections also had to remain quiet on available test traffic and pass an independent review for behavioral grounding, multiple signals, and no environment-specific strings. Four of the five firing open detections and nine of 10 frontier detections that fired stayed quiet, covering eight of eight attacks and seven of eight, respectively. After review, three open detections and no frontier detections qualified as gold. The three open detections still covered all eight attacks.
Figure 7. Live-fire validation funnel
Interpreting the results
The frontier system produced more backtest-passing detections, but the optimized Nemotron open-model pipeline yielded a higher share that generalized, averaged more detections per detection, and was the only system to produce gold detections. The evaluation covered one scenario family and small detection sets, so cross-scenario generalization remains untested. Limited benign traffic also means the noise test doesn’t represent production false-positive performance. Three of eight live-fire runs experienced harness failures but produced complete telemetry and were retained. The findings are a directional system-level case study, not a general benchmark.
Applying the pattern to specialized agents
The evaluation shows a broader pattern for building specialized agents with NVIDIA Nemotron: a reasoning model orchestrates the defensive workflow, a post-trained open model handles a bounded expert task, and an agent harness manages context, tools, and validation. Four design principles emerge:
Define measurable tasks and assign clear responsibilities to each model.
Post-train specialized models with domain data and verifiable rewards.
Ground outputs in authoritative context and validate them through deterministic checks, realistic replay, and independent review.
Evaluate the complete workflow in realistic conditions, with security experts controlling scenarios, guardrails, and use of validated outputs.
CrowdStrike is advancing this approach through SafeMind, its agentic cybersecurity system, which brings offensive and defensive AI together in a continuous coevolution loop. Explore NVIDIA Nemotron 3, NeMo Megatron Bridge, NeMo Gym, and NeMo RL to customize and evaluate specialized agents for other bounded domains.
Like
Tags
Agentic AI / Generative AI | Trustworthy AI / Cybersecurity | General | NeMo | Nemotron | Intermediate Technical | Deep dive | Security for AI
About the Authors
About Roberto Rodriguez
Roberto Rodriguez is a leader in AI for Security Operations at NVIDIA, specializing in agentic cyber defense, with a proven track record of building innovative security capabilities and translating research into real-world defensive systems.
Before joining NVIDIA, he led an Applied AI research team within Microsoft's Autonomous Defense and Protection Team (ADAPT), developing autonomous security capabilities for Microsoft's CISO organization. He also contributed to research and engineering efforts within the Microsoft Threat Intelligence Center (MSTIC), helping build capabilities to investigate sophisticated threats and tackle some of the world's most challenging security problems. Roberto is the founder of the Open Threat Research community and creator of Dapr Agents, an open-source, vendor-neutral agent framework bringing durable execution and production-grade resilience to AI systems, now part of the Cloud Native Computing Foundation (CNCF) ecosystem.
View all posts by Roberto Rodriguez
About Neha Hudait
Neha Hudait is a senior security product manager at NVIDIA, leading the development and execution of cybersecurity strategies in collaboration with leadership. With a focus on advancing security research and strategy, Neha plays a key role in shaping the future of security in AI and accelerated computing. Neha holds degrees in Electrical Engineering & Computer Science (EECS) and Business Administration from UC Berkeley, as part of the Management, Entrepreneurship, and Technology (M.E.T.) program. Her work emphasizes technical innovation, best practices, and driving diversity and inclusion within the cybersecurity community.
View all posts by Neha Hudait