CrowdStrike Unveils Falcon Guardian to Secure AI Agents Where They Execute: On the Endpoint at Runtime

The endpoint is the control point for AI agent security – CrowdStrike's structural advantage drives the innovation that defines it

AUSTIN, Texas & LAS VEGAS--(BUSINESS WIRE)--Fal.Con 2026, Las Vegas-- CrowdStrike (NASDAQ: CRWD) today introduced Falcon® Guardian, the new AI Detection and Response (AIDR) solution delivering complete visibility and runtime enforcement from the endpoint, where AI agents execute and across the enterprise.

Deployed across hundreds of millions of devices, CrowdStrike has more endpoint real estate than anyone. That structural advantage now defines AI agent security.

“CrowdStrike pioneered EDR by making the endpoint the control point for stopping attacks. AI demands the same approach,” said George Kurtz, CEO and founder of CrowdStrike. “AI hasn’t changed the attack, it has changed its speed. Governance alone can’t stop an agent already in motion. Falcon Guardian turns policy into protection, stopping threats where AI agents execute and before they can cause harm.”

The Control Point for AI Security

The industry is already seeing what happens when autonomy outpaces authority. As AI agents gain system-level privilege, the endpoint is where they reason, plan, and execute – accessing sensitive data and triggering downstream workflows with behavior indistinguishable from legitimate user activity. Posture tells you what could go wrong. Governance shrinks it. Only runtime stops what is going wrong. The endpoint is the only enforcement point with complete execution visibility, and where runtime security begins.

Complete AI Runtime Security

Guardian delivers the full spectrum of AIDR across the AI estate: data, models, prompts, agents, identities, infrastructure, and interactions. Protection extends from the endpoint to every surface where agents operate: cloud, SaaS, and browser. Only a single-sensor, unified architecture can cover this ground.

With this release, Guardian introduces:

• AI Agent Discovery and Inventory: The Falcon sensor discovers known and shadow AI agents across Windows and macOS, providing a live inventory of every running and dormant agent across the enterprise, who deployed it, and its security status.
• Agent Runtime Visibility: Connects AI agent behavior directly to Falcon endpoint telemetry, establishing a causal chain from user prompt, identity, tool call, and skill use to every downstream system action, revealing the full agent execution graph.
• Agent Access Controls: Defines which AI agents are permitted to run on managed endpoints, blocking unauthorized agents and translating governance policy into enforceable runtime controls.
• Runtime Detection and Response: Detects attacks on agents and malicious agent behavior, reconstructs the full execution chain, and determines blast radius in real time, containing AI threats before they spread.
• AI Gateway: Will provide a centralized control point for enterprise AI traffic across supported AI models and services, applying Falcon security context to enforce consistent visibility and policy across every AI communication, including MCP.
• Falcon Complete for Guardian: Will deliver 24/7 expert-led detection, investigation, and response for AI agents. CrowdStrike's elite analysts assess intent, distinguish legitimate AI behavior from malicious activity, and stop threats before impact.
• Falcon Adversary OverWatch for Guardian: Extends managed cross-domain threat hunting informed by frontline adversary tradecraft to AI agent activity, keeping organizations ahead of emerging AI threats.
• Native Next-Gen SIEM Integration: Ingests AI agent data into Falcon® Next-Gen SIEM as first-party data, ready for correlation across identity, cloud, and SaaS, with retention built in. Competing AI tools have no SIEM, forcing a costly third-party bolt-on that gets more expensive as agent volume grows.

AI’s Cybersecurity Infrastructure Layer

The Falcon platform is cybersecurity's infrastructure layer for AI adoption. Guardian is where that infrastructure meets the AI agent – securing every agent at runtime, across every surface where they operate. To learn more, read our blog and visit here.

About CrowdStrike

CrowdStrike (NASDAQ: CRWD), a global cybersecurity leader, has redefined modern security with the world’s most advanced cloud-native platform for protecting critical areas of enterprise risk – endpoints and cloud workloads, identity and data.

Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon® platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft, and enriched telemetry from across the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting, and prioritized observability of vulnerabilities.

Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity, and immediate time-to-value.

CrowdStrike: We stop breaches.

Learn more: https://www.crowdstrike.com/
Follow us: Blog | X | LinkedIn | Instagram
Start a free trial today: https://www.crowdstrike.com/trial

© 2026 CrowdStrike, Inc. All rights reserved. CrowdStrike and CrowdStrike Falcon are marks owned by CrowdStrike, Inc. and are registered in the United States and other countries. CrowdStrike owns other trademarks and service marks and may use the brands of third parties to identify their products and services.