Arora主张将虚拟补丁作为应对AI加速漏洞发现的最直接过渡方案，并称该技术成熟且厂商已可提供。

最显而易见的解决方案是虚拟补丁。这是一项经过时间检验的技术，目前网络安全厂商已在终端、WAF、云和网络场景中提供。

原文 (en)

The most obvious solution is virtual patching. This is a time tested technology that is currently available with cyber vendors for endpoints, WAF, cloud, network use cases.

周鸿祎警告智能体让漏洞发现批量低成本化，打破攻防平衡。

AI已重塑网络安全的游戏规则。过去漏洞很难被发现，因此攻击频率较低，攻防能勉强维持平衡。但现在智能体可以批量、自动化、低成本、快速发现漏洞，如果没有具备对等能力的智能体基础设施，信息系统将处处是漏洞、处处可攻击，面临更大威胁。

周鸿祎主张“以模治模”，用安全大模型监控智能体，人类保留最终决策权。

智能体越聪明，越不可控、越具有不确定性，它会产生自己的“想法”，此时就需要“以模治模”，即搜集智能体的行为日志、推理日志，打造另一个安全大模型和安全智能体对此进行分析、判断，对它可能的失控行为预判。

周鸿祎透露360早期试用OpenClaw架构时发现权限和执行风险，转而借鉴Codex、Claude Code架构，强调Agent安全。

周鸿祎透露，团队早期曾尝试OpenClaw架构，但在内部使用过程中发现了权限和执行方面的风险，后来调整为借鉴Codex、Claude Code等产品的架构。

George Kurtz 认为 AI 安全是充分发挥 AI 价值的前提，部署带终止开关的智能体能让企业保持掌控。

“AI 安全是让你充分获得 AI 全部收益的途径。”CEO George Kurtz 在新闻稿中表示。“当你部署带有终止开关的智能体时，你就始终掌控局面。”

原文 (en)

“AI safety is how you get the full benefit of AI,” said CEO George Kurtz in a press release. “When you deploy agents with a kill switch, you stay in control.”

George Kurtz 表示，各家公司都在问 AI 智能体能否被叫停，而 CrowdStrike 的 AI 终止开关让答案变成了肯定。

每家公司都在问关于 AI 智能体的同一个问题：它们能被叫停吗？现在答案是肯定的。

原文 (en)

Every company is asking the same question about AI agents: can they be stopped? Now the answer is yes,

Kurtz 称 CrowdStrike 的 AI 终止开关为智能体补上了缺失的关闭按钮，是智能体安全运行的关键一环。

“人人都在构建 AI 智能体，但它们从来没有关闭按钮，现在有了。这将是确保 AI 智能体安全运行的极其重要的一环。”

原文 (en)

"Everyone is building AI agents, but they never had the off button, and now they do," Kurtz told CNBC's Jim Cramer on "Mad Money." "It's going to be an incredibly important part of making sure that AI agents run and operate safely."

Kurtz 认为保障智能体安全是巨大的市场机会，既能防外部入侵，也能约束智能体行为。

“让智能体安全工作对 CrowdStrike 来说是巨大的市场机会。我们有 AI 能力从外部防止这些入侵，也有能力确保智能体基本上按指令行事。”

原文 (en)

"Enabling agents to work safely is a massive market opportunity for CrowdStrike," Kurtz said. "We have AI capabilities to prevent these breaches from happening on the outside, and we also have the capabilities to make sure that agents are basically doing what they are instructed to do."

Kurtz 把终止开关比作安全气囊，称即便 AI 设计正确也需要保障措施，越界的智能体可在运行时被终止。

他说：“如果它们在运行时越出这些护栏，我们可以终止这些智能体。”

原文 (en)

"If they go outside of those guardrails at runtime, we can kill those agents," he said.

Kurtz 称企业客户要求在部署 Anthropic 产品前集成 CrowdStrike，说明对其安全产品需求强劲。

“我们的客户去找 Anthropic 说，‘在部署 AI 之前我们需要 CrowdStrike’。客户没有 CrowdStrike 就不愿推出 AI，这说明了很多。”

原文 (en)

"Our customers went to Anthropic and said, 'We need CrowdStrike before we can deploy AI,'" Kurtz said. "I think it says volumes that customers would not roll out AI without CrowdStrike."

Kurtz 认为 AI 安全（如智能体终止开关）能让企业充分获得 AI 的收益，安全因此同时成为技术采用的加速器和安全网。

AI 安全是充分获得 AI 全部收益的途径。当你为智能体部署了终止开关，你就能保持掌控。安全首次同时成为技术采用的加速器和安全网。

原文 (en)

AI safety is how you get the full benefit of AI. When you deploy agents with a kill switch, you stay in control. For the first time, security is simultaneously the accelerant and the safety net for technology adoption.

Kurtz 认为 AI 安全是充分发挥 AI 价值的前提，部署带终止开关的智能体能让企业保持控制权。

AI 安全是你充分获得 AI 全部收益的途径。当你部署带有“终止开关”的智能体时，你就始终掌控局面。

原文 (en)

AI safety is how you get the full benefit of AI. When you deploy agents with a kill switch, you stay in control,

Kurtz 表示企业将必须配备 AI 智能体的终止开关，CrowdStrike 同时推出了可检测、监控并停止智能体的工具。

“我认为对企业来说，终止开关将是必须具备的。”Kurtz 说。

原文 (en)

“I think the kill switch will be mandatory for companies,” Kurtz said.

Kurtz认为AI智能体成为新的顶级威胁，使任何攻击者都具备国家级能力。

现在出现了新的顶级掠食者，那就是智能体。我称之为“智能体国家”的崛起。当顶级能力变成一条提示词时，就不再有层级之分，每个对手、每个电子犯罪团伙、每个内部人员都能像国家级对手一样行动。

原文 (en)

Now there's a new apex predator and that's the agent. I call this the rise of the agent state. Because when Apex capability becomes a prompt, there are no tears at all. Every adversary, every ecime crew, every insider now can operate like a nation state.

Kurtz称攻击已进入推理速度，突破时间消失，零日变成“负一日”。

攻击现在以推理速度发生。当攻击者拥有推理速度时，就没有突破时间了，实际上根本没有时间。我们将不再称之为零日，而是“负一日”。

原文 (en)

Attacks now happen at inference speed. Inference speed. And when the attacker has inference speed, there is no breakout time. There's actually no time at all. And unfortunately, we won't be calling these zero days. We'll be calling them minus one days.

Kurtz认为放慢AI发展无济于事，前沿和开放权重模型已落入对手手中。

我们现在面临的挑战是精灵已经出了瓶。放慢未来AI发展无法解决眼前的风险，前沿模型和开放权重模型无处不在，包括在对手手中。

原文 (en)

The challenge we have now is the genie is out of the bottle. Slowing down future AI development won't fix the risk in front of us. Frontier and open weight models are literally everywhere including in the hands of the adversary.

Kurtz把从安全到AI安全保障的转变定位为企业加速器而非刹车。

安全过去是把所有人挡在外面，而“安全保障”是让组织跑得更快。它不是刹车，而是让你能运行智能体并加速的东西。

原文 (en)

Security was keep everyone out. Safety is allow our organizations to go faster. And safety isn't the brakes. It's what allows you to run agents and go faster.

Kurtz认为堆token时代将结束，开放权重模型将推动降本与数据主权。

我认为一味堆token的时代可能结束了，现在越来越多人关心如何降低成本。在我看来，开放权重模型将是降低成本和实现数据主权的关键领域之一。

原文 (en)

I think all the token maxing might be over. And in fact, now we're hearing more and more on how do we reduce cost. And in my view, open weight models are going to be one of the key areas to help reduce cost and drive this data sovereignty.

Kurtz预测本地终端运行开放权重模型将大幅增长。

我的预测是：直接在终端上运行的开放权重模型将大幅增加。你可以在桌面电脑上运行280亿参数的Qwen模型。

原文 (en)

So here's my prediction. I think there's going to be a massive increase in openw weight models running directly on the endpoint. You can run a 28 billion parameter Quinn model on your desktop.

Kurtz指出通用AI不适合防御者，需要专为防御打造的AI，由此推动CrowdStrike的实验室和模型。

所以地球上最好的AI是为除防御者之外的所有人打造的。通用模型是为通用目的构建的，我们需要为防御者打造的AI。

原文 (en)

So the best AI on earth was built for everyone except the defenders for everyone in this audience. General purpose models are built for general purpose and we need everyone in this room needs AI built for the defender.

Kurtz 警告称，缺乏安全保障的 AI 会给对手可乘之机，安全必须从一开始就内置于 AI 基础设施中。

“每家企业都在争相构建 AI，但没有安全保障的 AI 就是给对手的机会。在 AI 驱动的世界里，安全不能事后才考虑。”

原文 (en)

“Every enterprise is racing to build AI, but AI without security is an opportunity for the adversary,” Kurtz said. VIEW ALL “Security cannot be an afterthought in an AI-powered world.

Kurtz 称 Falcon 的 AI 原生防护将成为 Dell 与 NVIDIA AI Factory 的基础，让企业能安全地规模化创新。

Dell 和 NVIDIA 在推动 AI 革命，而 CrowdStrike 在为其提供安全保障。我们共同让 Falcon 的 AI 原生防护成为 AI Factory 的基础，让企业有信心在经过验证的优化架构上安全地规模化创新。

原文 (en)

Dell and NVIDIA are powering the AI revolution, and CrowdStrike is securing it. Together, we’re making Falcon’s AI-native protection foundational to the AI Factory, giving enterprises the confidence to safely innovate at scale on validated, optimised architectures.

Kurtz 称所有企业都将依赖 AI，保障 AI 安全是 CrowdStrike 历史上最大的市场机会。

Kurtz 表示，每家企业都将运行在 AI 之上，而保障 AI 安全是公司历史上最大的市场机会。

原文 (en)

Kurtz said every enterprise will run on AI and that securing it is the largest market opportunity in the company’s history.

George Kurtz 警告称，缺乏安全的 AI 会给攻击者可乘之机，安全必须从一开始就内置。

“每家企业都在竞相构建 AI，但没有安全保障的 AI 就是给对手的机会。在 AI 驱动的世界里，安全不能事后才考虑。”

原文 (en)

“Every enterprise is racing to build AI, but AI without security is an opportunity for the adversary,” said George Kurtz, CEO and founder of CrowdStrike. “Security cannot be an afterthought in an AI-powered world.

Prince 称 CISO 正陷入恐慌，最严重的漏洞冲击尚未过去。

我认为现在 CISO 们都在恐慌，感觉天要塌了。大家都在屏住呼吸希望最糟的已经过去，但我确知最糟的还没过去。

原文 (en)

I think right now what CISOs are doing is panic. It feels like the sky is falling. Again, I think everyone is sort of holding their breath and saying, "Hopefully the worst of it's over." I know for a fact the worst of it is not over.

Prince 称客户购买的是统一平台，单点零信任厂商沦为功能。

人们不再只买零信任、WAF 或 DDoS，而是购买整个 Cloudflare 平台，零信任厂商实际上沦为更大平台中的一个功能。

原文 (en)

people aren't buying just Zero Trust. They're not just buying WAF, they're not just buying DDoS, they're not just buying the developer platform. They're buying the overall platform of Cloudflare, and they're seeing that if you incorporate and use all of what we do, that you get a much more holistic solution. As a result, the Zero Trust vendors effectively just become features within what is a much larger platform play.

Prince 警告严重漏洞浪潮才刚开始，还将持续两年。

安全方面：14 天内披露了历史上六个最严重的漏洞。最糟的还在后面，这种状态还将持续两年。

原文 (en)

Security: Six of the most severe vulnerabilities in history were disclosed within 14 days. The worst is yet to come, and this state will persist for another two years.

Prince 认为第一代零信任厂商未能解决智能体身份问题，正沦为平台中的功能。

第一代零信任厂商没有解决智能体身份问题；客户正在放弃进行中的招标；客户购买的是“整个平台”，第一代厂商沦为单一功能。

原文 (en)

First-generation Zero Trust vendors aren't addressing the issue of agency identity; clients are abandoning ongoing RFPs; customers are buying an "entire platform," and first-generation vendors are becoming mere features.

Matthew Prince 表示自己近两个月一直担心AI发现的漏洞在补丁就绪前泄露，并预计未来两年平均每周都会出现一个影响全互联网的严重漏洞。

“过去两个月，我一直处于极度恐惧之中，担心有人在大家打好补丁、完成修复之前发现这个漏洞，或者相关信息泄露出去。”“未来两年，我们将处在这样一种状态：平均每周都会出现一个影响整个互联网的严重漏洞。”

原文 (en)

“The last two months, I’ve been living in a state of abject terror that someone else would find the bug or the information would leak before everyone had patches and fixes in place,” said Matthew Prince, CEO of Cloudflare. “For the next two years, we’re going to be living in a state where, on average, every week there is a critical, internet-wide vulnerability.”

Prince 认为尽管未来两年会感觉天要塌下来，但借助AI发现漏洞最终会让互联网更加安全。

“在我们能发现这些问题的世界里，你其实更安全。”“未来两年会感觉天要塌了，但我认为走出这段时期后，互联网会安全得多。”

原文 (en)

“You’re actually safer in a world where we are finding these things,” Prince said. “The next two years, it’s going to feel like the sky is falling, but I think we come out the other end of it with a much safer internet.”

Krebs指出，住宅代理服务是恶意流量的主要来源，涵盖账户接管、广告欺诈和AI内容抓取。

正如过去一年本站多篇报道所详述，住宅代理服务是大量不受欢迎且往往带有恶意的流量的主要来源，包括账户接管、广告欺诈以及为AI项目进行的大规模内容抓取。

原文 (en)

As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover activity, advertising fraud, and mass content scraping for AI projects.

Schneier警告称，AI式的法律漏洞利用必将到来，立法者需要强化立法流程，甚至自己也要借助先进AI。

在这样的世界里，立法者需要大幅强化立法流程，例如自己也利用先进的AI。目前仍处于早期阶段，但这肯定是即将到来的趋势。

原文 (en)

In such a world, lawmakers would need to significantly harden the process of legislation, for example by leveraging advanced AI themselves. Still in its early stages, but definitely something that’s coming.

Schneier指出AI驱动的漏洞发现正以惊人的速度找出关键软件漏洞，今年有望使历史漏洞总量增加约26%，并称这一情况令人震惊。

有史以来记录在案的“关键”软件安全漏洞中，有3%是在上个月被发现的。照这个速度，仅今年就将再发现约10万个漏洞，使历史漏洞总数增加约26%。你意识到这有多疯狂吗？

原文 (en)

3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?

Zafrir认为Check Point正从防火墙转向预防式安全，因为现有安全范式已显现漏洞。

我们不再只是一家防火墙公司或网络安全公司。我们关注攻击者的去向，在这个行业30年后我个人认为，现有范式已显现漏洞，不久之后许多我们习以为常的东西将越来越不相关。我们必须不再回看后视镜，而要开始预判攻击。

原文 (en)

we're no longer a firewall company, and we're no longer a network security company. We are looking at where the attackers are going, and I personally believe after 30 years in this industry that the current paradigm, we're seeing holes in the current paradigm, and I think it won't be long before many of the things that we were accustomed to will become less and less relevant. We have to move from looking at the rearview mirror, and we have to start anticipating attacks.

Zafrir预计AI数据中心建设将从2027年起为Check Point带来增量安全需求。

数据中心特别是AI数据中心的投资，无论是训练还是推理，都令人难以置信。这些数据中心需要安全防护，我们认为从2027年起这将带来增量。

原文 (en)

The investment in data centers, and specifically AI data centers, whether it's for training or for inference, is just mind-boggling. These data centers need security. In fact, that's some of the places where we believe this is going actually to be incremental starting 2027.

Zafrir称数据主权和本地开放权重模型正在重新定义网络安全，并推动本地部署需求。

我认为现代网络安全的含义已不同于几年前，它也意味着主权数据中心，意味着在本地运行开放权重模型，有时是出于主权，有时是为了保持独立。

原文 (en)

I do think that network security, modern network security does not necessarily mean what it meant a couple of years ago. It also means a sovereign data center. It also means running open-weight models locally, sometimes because of sovereignty, sometimes because of the need to remain independent.

Zafrir警告出现“漏洞末日”，被动应对将失败，必须主动缓解。

我们看到的是一场所谓的“漏洞末日”。保持领先的唯一方法是精简技术栈并主动出击，大幅降低攻击发生的概率。

原文 (en)

what we are seeing is a vulnerability apocalypse, if you like. The only way to stay ahead of that is to be able to thin the stacks and proactively, on the one hand, dramatically lower the probability that it will happen.

Zafrir称AI安全对客户和公司几乎关乎生存，明年将加倍投入。

AI安全是一种我们认为对客户几乎关乎生存、因此对我们也是如此的能力或产品。

原文 (en)

Security for AI is one example of a capability or a product that we believe is almost existential for our customers, and hence for us.

Zafrir为防火墙12%-20%的涨价辩护，称其合理且不会损害需求。

我们认为这是一次非常合理的涨价，不会损害需求。

原文 (en)

We believe that it's a very reasonable price increase that won't hurt the demand.

Zafrir称需求在上升，复苏放缓源于自身执行与销售招聘节奏。

我们实际上看到需求在上升，现在要靠我们更有竞争力、更好地执行。

原文 (en)

We actually see demand rising. Now, it is on us to be more competitive, to be out there, and to execute better.