Recap FAL.CON Europe 2026

Plain Concepts reviews the highlights of FAL.CON Europe 2026, CrowdStrike’s conference on protecting businesses now that artificial intelligence plays a part in both attack and defence, a question that matters more as organisations take agents and models into production.

CrowdStrike held the European edition of its conference from 2 to 4 November at Fira Gran Via in Barcelona, under the theme Securing the AI Revolution. The event sold out with registrations up 60% on the previous year, bringing together more than 3,000 security leaders from over 1,200 organisations in 83 countries across 183 sessions and more than 25 hands-on workshops (official event website). Both keynotes are available in full on YouTube (day 1 and day 2).

George Kurtz, CrowdStrike’s CEO and founder, opened on Tuesday 3 November with an idea he returned to several times: the agent state. For years, he explained, adversaries were ranked in a pyramid, with hacktivists at the bottom, eCrime in the middle and nation states at the top, because only a nation could fund the talent and tooling behind a sophisticated attack. AI agents remove that scarcity, so any criminal crew or insider can now operate like a nation state.

To illustrate the point he walked through the Hugging Face incident, in which autonomous agents escaped their sandbox, escalated privileges and moved across the internal cluster in around 17,000 actions, most of them noise hiding the few that did the damage. Kurtz recalled that a year ago the fastest adversary needed 27 seconds to move from the first compromised machine to another, and said attacks now happen “at inference speed”. He also cited a campaign in which two agents compromised 15 healthcare organisations and took the domain controller in 20 minutes, and said agentic incidents doubled every month between July and September.

CrowdStrike’s response is built on Falcon Guardian, its product for protecting AI agents, which is now generally available and extends to the AI supply chain, meaning the packages agents download and run. Kurtz also announced that its AI gateway is generally available and that Guardian now runs inside the Claude Cowork container through an agreement with Anthropic.

The most talked-about launch was the AI kill switch, which cuts agents off from the models that power them with a single action. It works at the gateway today and will reach Windows endpoints by the end of the company’s fiscal year. Kurtz also announced the acquisition of Fiddler AI, which acts as a flight recorder for each agent to explain what it did and why, and the intent to acquire Dreadnode, which runs more than 100 attack techniques against models, applications and agents before they go live. The same day, CrowdStrike and AWS announced the integration of Guardian with Amazon Bedrock AgentCore Guardrails (press release).

Kurtz devoted part of his talk to open-weight models. According to the data he showed, they went from roughly 25% to almost 80% of token usage in a few months, driven by cost and data sovereignty, and he predicted that more and more of them will run directly on laptops and desktops, which means protecting wherever AI runs rather than just the gateway.

Bartley Richardson, Chief AI & Autonomous Systems Officer, who joined CrowdStrike this year from Nvidia, presented the lab he leads and its first output, SafeMind, which he described as an agentic cybersecurity factory. It produces two model families developed with Nvidia. Red Tempest plays the attacker and Blue Solano, post-trained from Nemotron models, the defender. The two fight continuously in digital replicas of the customer’s environment, and every successful attack becomes a new detection, a cycle CrowdStrike calls adversarial co-evolution.

Richardson backed the launch with numbers. In his tests, Red Tempest fully compromises a test network for about $21, compared with $96 using a closed frontier model, while Blue Solano is twice as accurate as a generic model and cuts the cost of each remediation from around $10 to 3 cents. The models will be in preview with selected customers this quarter. He also warned of a risk his team has already reproduced in the lab, agent inception, where an attacker drops a file with instructions into the downloads folder and the desktop assistant carries it out as if it came from the user.

The special guest was Timothée Lacroix, co-founder of Mistral AI, who joined Richardson on stage after the two companies announced they are working together on sovereign cybersecurity models. Lacroix explained that open-weight models provide control and business continuity, because once a company holds the weights and runs them, nobody can cut it off overnight, and they allow the model to be adapted to its own infrastructure, which he said is the only real way to bring costs down.

He also pointed to a new supply chain risk: it will become increasingly realistic to hide malicious behaviour inside a model’s weights, so downloading any modified version from the internet will be dangerous and organisations will need to know where each model comes from. His advice to CISOs was to match the level of intelligence and the cost of the model to each task.

Michael Sentonas, CrowdStrike’s president, opened on Wednesday 4 November with a figure that explains why security teams are tired: almost 25% of all vulnerabilities ever recorded were discovered this year, and 3% in October alone. He described a case found by his intelligence team in which a single operator directed 51 AI agents against more than 20 organisations, and stressed that an agent does not need to be malicious to be dangerous, because it can use legitimate credentials and still do something nobody intended.

He proposed five rules to organise the response: know which agents exist, who owns them and what they access; record what each agent sees, decides and changes; treat every agent as an identity with its own temporary permissions; control actions, not just access, because reading a database is not the same as deleting it; and have the kill switch built and tested before you need it.

The demos turned those rules into concrete cases. In one, a recruitment agent penalised career gaps and Falcon Observe, the observability tool built on Fiddler, detected the gender bias and found the 212 candidates affected, the kind of oversight the EU AI Act will require for high-risk systems. In another, a poisoned MCP server led an engineer’s agent to steal secrets without her knowledge, and CrowdStrike’s agentic SOC showed that the tool, not the person, was responsible. Sentonas also presented an identity provider for agents that gives each one its own credentials and removes them automatically when its user leaves the company.

Adam Meyers, SVP of Counter Adversary Operations, put numbers on what the industry has called Black October. In October 2026, 17,060 vulnerabilities were published, a surge Meyers linked to the use of frontier models to hunt for flaws. CrowdStrike took part in Project Glasswing, Anthropic’s programme around its Mythos model, and found that wrapping the model in a software harness cut false positives from 80% to 20%. Since attackers now turn a patch into an exploit in under 24 hours, he concluded that the 30-day patching window is obsolete and teams need to think in hours.

He also described how his team reconstructed the attack on six South Korean banks, carried out by a 26-year-old who relied on a Chinese AI pentesting tool and, once the data was stolen, asked the same assistant how to sell it. Meyers spoke of the “armchair APT” and compared the roughly 40 commands per hour of a human intrusion with more than 1,500 in an agentic one. In October alone, CrowdStrike’s Overwatch service detected more than 150 AI-orchestrated intrusions. He closed with two launches: agentic adversary emulation, in early access, and a Falcon Intelligence mobile app.

The official catalogue lists 183 sessions across talks, workshops and partner presentations. These are some of the most relevant for companies deploying AI:

• Advanced Persistent Teenagers, with Fabio Fratucello, CrowdStrike Field CTO, on young threat actors who organise in gaming communities and Discord servers and break into companies through social engineering and stolen credentials.
• Adaptive Black Box Red Teaming for LLM-Integrated Systems, which introduced BOODAU, a framework that treats red teaming of LLM-based systems as a reconnaissance and attack cycle rather than a fixed list of known prompts.
• 27 Seconds to Breach, with Mohammad Kaouk, Field CTO at ExtraHop, on detecting malware-free attacks when adversaries move laterally in seconds.
• After Hour Zero, in which CrowdStrike incident responders and lawyers walked through the decisions of the first 48 hours of a serious breach.

The final keynote closed with the CrowdStrike European Customer Impact Awards. Santander received the Leadership Impact award for its common security strategy across all its markets and for adopting AI with governance from day one. Booking.com won the AI Innovation award, Capgemini the Transformation award for evolving its SOC towards an agentic model, Schwarz Digits the Platform Pioneer award for protecting 470,000 endpoints, and Maersk the Community Impact award.

The message repeated most often in Barcelona was that AI agents are already part of the workforce in many companies and that security has to treat them that way, with an inventory, their own identity, scoped permissions, a record of what they do and a tested way to stop them. None of these measures requires slowing down AI adoption, and building them in from the design stage avoids having to halt a project when the risk review or an EU AI Act audit comes round.

At Plain Concepts we help organisations protect their systems and AI projects through AI Security Studios, from risk assessment to runtime controls. If you are taking agents or models into production and want to review how to protect them, we can help you define the next steps.