What a CrowdStrike CTO’s Shift to AI Security Investing Reveals About the Industry

Introduction

In June 2026 CrowdStrike CTO Michael Sentonas announced his departure to create a venture fund dedicated to AI‑driven cybersecurity. The author uses this move to explore both technical and industry‑level forces reshaping the security landscape.

1. From Selling Products to Investing in Technology

Sentonas spent almost eight years at CrowdStrike, guiding the Falcon platform from a single EDR tool to a full‑stack XDR, cloud security, and identity‑threat detection solution. The July 2024 global blue‑screen incident, caused by a faulty kernel driver update that crashed 8.5 million Windows devices, highlighted the vulnerability of large, centralized, kernel‑level architectures.

In his resignation letter he wrote that future security will not be monopolised by a few giants but re‑defined by a swarm of small, AI‑native companies. He sees a concrete window: the diffusion of large‑model capabilities is lowering the data‑and‑time requirements for building security products.

Previously, building a threat‑detection engine required two to three years of data collection and rule development. With fine‑tuned security LLMs, a ten‑person team can produce a usable prototype in six months, turning the startup window into a VC‑friendly scenario where technical barriers shift from "data scale" to "scenario understanding".

2. CrowdStrike’s Technical Foundations and Limitations

The Falcon architecture combines a lightweight kernel‑mode agent with a cloud‑based threat‑graph. This model succeeded from 2015 to 2023 but faces three emerging problems by 2026:

Kernel‑mode agent risk. After the 2024 blue‑screen event, Microsoft accelerated the Windows Security Platform framework, encouraging vendors to replace kernel drivers with user‑mode eBPF extensions, eroding CrowdStrike’s "deep kernel visibility" advantage.

Latency of centralized cloud analysis. When telemetry must travel to the cloud for verdicts, response times for file‑less attacks or memory‑resident malware can stretch from hundreds of milliseconds to several seconds—enough for ransomware to encrypt critical files.

Rule‑plus‑ML detection vs. LLM‑native detection. Falcon still relies on IoC matching and traditional ML behavior models, while by 2026 several startups are delivering end‑to‑end threat inference using security‑specific large models.

3. AI‑Native Security: The 2026 Technical Paradigm

3.1 Edge‑side Security LLM (Security SLM)

By 2026, small language models (1‑7 B parameters) can run in real time on commodity GPUs. Vendors are moving behavior analysis from the cloud to the endpoint, replacing rule matching with a fine‑tuned SLM that semantically understands process‑behavior sequences.

For example, a process calls CreateRemoteThread to inject into lsass.exe, then uses a named pipe to exfiltrate data and finally issues a DNS TXT query. Traditional solutions would need three separate rules and correlation logic, whereas a security SLM can directly interpret the chain as a "credential theft + data exfiltration" attack, cutting response latency from seconds to hundreds of milliseconds.

3.2 Autonomous Security Agent

The hottest 2026 direction is an autonomous security agent—an AI‑driven assistant that not only advises analysts but also executes analysis, judgement, and remediation actions.

A mature autonomous agent should be able to:

Enrich alerts with contextual asset information, historical events, and threat intelligence.

Decide autonomously whether to isolate a host, block an IP, or disable an account.

Provide an explainable reasoning chain for each decision, enabling human audit.

Continuously learn from false‑positive feedback to reduce future mis‑classifications.

Google’s 2026 Security Agent framework (built on Gemini 2.5) and several startups leveraging Claude for SOC automation illustrate this trend. Sentonas is likely to target this segment because it addresses the industry’s biggest pain point: insufficient security staff.

Global cybersecurity talent shortage surpassed 4 million in 2026. A senior analyst earning $150 k can handle at most 50 alerts per day, whereas a well‑trained security agent can process thousands of alerts daily without fatigue.

3.3 AI‑Driven Attack Surface Management

Traditional ASM relies on periodic scans and asset inventories. The 2026 approach uses large models to continuously simulate attacker perspectives across an organization’s digital assets, automatically inferring potential attack paths rather than merely listing exposed ports.

For instance, an exposed Jenkins instance (CVE‑2024‑23897) combined with its AD service‑account permissions can be automatically reasoned into a full path from initial access to domain‑controller compromise—something that previously required manual chaining.

4. Where the Security Industry’s Capital Opportunities Lie

From an investment standpoint, Sentonas’s timing is calculated.

The 2025 global cybersecurity market was about $210 billion, with SecOps accounting for roughly one‑third. Yet AI‑native products represented less than 15 % of that segment, meaning most enterprises still rely on 2019‑era stacks to face 2026 threats.

This replacement demand creates capital opportunities.

Key numbers to watch:

Inference cost cliff: running a 70 B‑parameter model for security analysis cost about $15 per million tokens in 2024; by mid‑2026 the same capability drops below $2, making AI security affordable for production.

Clear exit paths: Palo Alto Networks, Fortinet, Cisco and others are actively acquiring AI security startups. In 2025, total M&A in security exceeded $28 billion, with AI‑related deals surpassing 40 % of the total.

Regulatory demand: the EU AI Act and the U.S. SEC cybersecurity disclosure rules (effective end‑2024) force enterprises to upgrade security capabilities, turning compliance into a non‑optional expense.

5. Takeaways for Security Professionals

Sentonas’s pivot offers three lessons:

1. Technical leadership is shifting from product building to ecosystem building. A top CTO moving into investing amplifies technical judgment through capital leverage, signalling a need for a fast‑iterating innovation ecosystem rather than a few monolithic platforms.

2. Security engineers must refresh their skill sets. Mastery of Snort rules or PCAP analysis is no longer sufficient. By 2026, core competence will be constructing detection logic with large models, designing autonomous agent decision flows, and assessing AI system security risks.

3. The startup window is narrow. Major vendors are rapidly releasing AI‑enhanced products—CrowdStrike’s Charlotte AI 2.0, Palo Alto’s Cortex XSIAM 3.0, Microsoft’s Security Copilot. Independent startups may have only 18‑24 months to gain traction before large‑scale data‑flywheels lock out competition.

However, vertical niches—medical‑device security, industrial‑control system security, automotive network security—remain less covered by the giants, offering longer‑term opportunities that Sentonas’s fund is likely to target.

Conclusion

A veteran security technologist choosing to re‑enter the field via capital demonstrates confidence that AI will reshape security beyond slide‑deck projections. Rather than debating whether AI will replace security engineers, professionals should focus on positioning themselves within this transformation, because the window Sentonas sees is visible to all.