This week at Black Hat USA 2025, CrowdStrike introduced Signal, a groundbreaking self-learning detection engine that represents a significant advancement in AI-driven cybersecurity. Positioned to transform how organizations identify sophisticated threats, Signal aims to detect stealthy intrusions long before they escalate, generating considerable excitement within security circles.

Understanding Signal: Learning normal behavior and spotting subtle anomalies

At the core of Signal is a series of statistical time-series models that continuously learn the normal behavior of each user, host, and process over time and across systems. Rather than relying on static rules, Signal adapts in real-time by detecting even the slightest deviations that could indicate malicious activity.

By correlating these low-signal events over time, Signal generates high-confidence leads grouped into sequences of suspicious actions that cut through the noise of regular activity. This capability enhances the speed of investigation and response, significantly reducing alert fatigue for security teams.

Identifying the invisible: Connecting the dots

While traditional tools may interpret isolated benign behaviors, Signal makes connections among them. It identifies the use of living-off-the-land tools, unusual process executions, or atypical temporary directory activity—activities that may appear harmless in isolation but form part of a larger, more concerning pattern over hours or days.

This layered, temporal intelligence transforms fragmented events into actionable threat leads, enabling defenders to act early, often well before any compromise becomes apparent.

CrowdStrike's cloud-native strength

Signal is integrated into the Falcon platform and supported by the CrowdStrike Security Cloud. It operates at an immense scale, analyzing billions of events in each customer environment daily, yet distills this information into a few high-fidelity leads that can be acted upon.

CrowdStrike’s AI-native architecture allows for swift deployment and effective detection from day one without the need for heavy agents or complex setups.

The role of supercomputing: Enhancing AI detection at scale

While Signal utilizes distributed cloud infrastructure, the development and ongoing refinement of these advanced behavioral models rely heavily on modern high-performance computing (HPC). Research indicates that cutting-edge AI systems—particularly those focused on anomaly detection and time-series learning—benefit immensely from being trained at scale on supercomputers equipped with tens of thousands of cores and GPU clusters.

In fields like gravitational-wave research and anomaly detection, AI models are trained on supercomputing resources utilizing thousands of GPUs, later optimized for swift inference across large datasets using specialized tools like NVIDIA TensorRT.

By developing and testing detection models on such powerful infrastructure, cybersecurity innovators can enhance engines like Signal to become faster, more accurate, and more adaptive, enabling them to manage billions of events in nearly real-time.

Why It Matters

The combination of AI and supercomputing creates a powerful feedback loop:

- Model Training at Scale: Utilizing HPC to identify subtle patterns and behaviors.

- Real-Time Inference at the Edge: Operating in production environments on lightweight Falcon agents, allowing for instant decision-making.

- Continuous Feedback: Models continuously update, learning new baselines as organizational environments evolve.

This synergy allows CrowdStrike to deliver a detection engine that is both intelligent and operationally efficient.

Looking forward: A safer cyber future

Signal represents a transformative step toward an AI-native, proactive defense strategy, one that anticipates stealthy threats rather than simply reacting to them. As adversaries employ increasingly sophisticated tactics to evade detection across time and systems, tools like Signal provide a promising defense, enabling security teams to recognize the early signs of an attack, piece together patterns, and respond rapidly.

In the future, continued progress in supercomputing and cloud AI will further empower detection engines to remain ahead of attackers, paving the way toward a future where cyber resilience is anchored in intelligence, scale, and speed.

A decade-old thunderstorm that stretched across the Great Plains, from eastern Texas to nearly Kansas City—spanning 515 miles—has set a new world record for lightning, as discovered through an advanced global network of antennas located above Earth's surface.

In a recent study led by scientists at Arizona State University (ASU) and published in the Bulletin of the American Meteorological Society, the team re-examined satellite data from October 2017. They identified an astonishing megaflash extending 38 miles longer than the previous record set in April 2020.

From Antennas on Earth to Lightning Mappers in Orbit

Traditionally, lightning networks have relied on ground-based antenna arrays scattered across regions to locate strikes. However, this megaflash could only be fully mapped using space-based sensors. NOAA’s GOES-16 satellite, the first geostationary satellite equipped with a lightning mapper, joins similar instruments operated by Europe and China, enabling the detection of lightning from orbit.

These lightning mappers function like ultra-precise antennas in space. Each time a flash occurs, the sensors record its origin to the millisecond and trace its horizontal extent across continents.

Weaving Together Petabytes of Flash Data

The volume of data is staggering. GOES-16 detects about one million flashes each day, with each flash logged by time, location, and geographic extent. This massive stream of data must be continuously processed to identify the rare megaflashes, which are defined as exceeding approximately 100 kilometers (60 miles) in length.

Michael Peterson at Georgia Tech, the lead author of the published report, explains that modern data-processing techniques are essential. They sift through the vast number of ordinary lightning flashes, connecting fragmented pulses that belong to the same extended stroke. Only then can researchers reconstruct the full scale of these flashes, which can span hundreds of miles.

Networks of Antennas at Multiple Scales

Imagine dozens of satellite antennas, including GOES-16 in geostationary orbit and its counterparts operated by European and Chinese agencies. Together, they create a continuous, overlapping network of detection. Because these satellites cover most storm regions globally, even sprawling flashes can be captured in great detail.

While traditional ground networks are still useful for finer localization and cross-validation, the real breakthrough lies in the ability to measure continent-sized flashes from space.

Why It Matters—in Curiosity and Science

Fewer than 1% of thunderstorms produce megaflashes, which typically develop over more than 14 hours and cover areas the size of New Jersey. Capturing these rare phenomena allows scientists to explore storm dynamics and extreme weather from a new perspective.

Cerveny, a rapporteur for weather and climate extremes at the World Meteorological Organization, states, “It is likely that even greater extremes still exist.” As satellite systems advance and data archives grow, our ability to detect increasingly longer lightning events continues to improve.

In Summary

Satellites act as a network of space-based antennas, capturing lightning with millisecond precision and continental coverage. Advanced data-processing pipelines analyze millions of flash events each day, enabling the reconstruction of rare megaflashes that stretch across hundreds of miles. Ground networks still play a role, but the true advancement lies in the synergy of multiple satellites, assisting researchers in finding and analyzing the planet’s most extreme electrical events.

ASU’s work illustrates how innovations in detection and processing are redefining the limits of what we thought lightning could achieve—stretching across nations.