September 2026 · 6 min read
CrowdStrike Falcon Guardian: runtime security for AI agents
Key Definitions
AIDR (AI Detection & Response) CrowdStrike's security category: detection and response at the AI agent runtime — the EDR analogue for agents — spanning data, models, prompts, agents, identities, infrastructure, and interactions across the whole AI estate.
Shadow AI agent An AI assistant or coding agent (e.g. Claude, Claude Code) employees use or deploy without IT/security approval, running outside organizational visibility — the first gap in agent security.
Blast radius The range of systems, data, and workflows an agent or attacker can affect once compromised. Runtime detection and response exists to compute and contain it in real time before it spreads.
At Fal.Con 2026 in Las Vegas on September 1, CrowdStrike unveiled Falcon Guardian — what it calls an AI Detection and Response (AIDR) solution that puts AI agent security where agents actually execute: on the endpoint, at runtime. CEO George Kurtz was direct: "AI hasn't changed the attack, it has changed its speed. Governance alone can't stop an agent already in motion — Falcon Guardian turns policy into protection."
Why the endpoint is the control point
Once agents gain system-level privilege, the endpoint is where they reason, plan, and execute — accessing sensitive data and triggering downstream workflows with behavior indistinguishable from legitimate user activity. CrowdStrike's argument is a clean security layering:
Posture tells you what could go wrong; governance shrinks it; only runtime stops what is going wrong. And the endpoint is the only enforcement point with complete execution visibility — a structural advantage the company built as an EDR pioneer: Falcon sensors already deployed across hundreds of millions of devices are a natural enforcement point for AI agent security.
Six core capabilities
Shadow-agent discovery
The Falcon sensor discovers running and dormant AI agents on Windows and macOS, producing a live inventory of every agent in the enterprise — who deployed it and its security status. Turning invisible agents into managed assets is step one.
Agent runtime visibility
Connects AI agent behavior directly to Falcon endpoint telemetry, building a causal chain from user prompt, identity, tool call, and skill use to every downstream system action — the full agent execution graph.
Agent access controls
Defines which agents are permitted to run on managed endpoints and blocks unauthorized ones — translating governance policy into enforceable runtime controls rather than leaving it on paper.
Runtime detection and response
Detects attacks on agents and malicious agent behavior, reconstructs the full execution chain, and computes the blast radius in real time — containing threats before they spread.
AI Gateway
A centralized control point for enterprise AI traffic across supported models and services, applying Falcon security context to every AI communication — including MCP — for consistent visibility and policy.
Managed response and native SIEM
Falcon Complete for Guardian delivers 24/7 expert detection, investigation, and response; AI agent data lands in Falcon Next-Gen SIEM as first-party data, correlatable across identity, cloud, and SaaS without third-party bolt-ons.
Governance, platform, endpoint: a three-layer structure is forming
Falcon Guardian is not an isolated move — it is a signal that the agent-security category is rapidly taking shape. In the past two weeks we have seen Broadcom AgentMinder push authorization to the action level (intent governance), BCG propose a cross-platform enterprise AI control plane (unified policy), and Ping Identity and Okta handle agent identity. CrowdStrike's step fills in the bottom layer: who stops an agent where it actually executes.
The division of labor is becoming clear: the governance layer defines what agents should do, the platform layer unifies how policy is enforced across environments, and the endpoint layer answers what is happening and how to stop it. For enterprises the question is no longer which layer to pick — it is whether the three close the loop. A policy defined well is worthless if the enforcement point cannot even see the agent.
What this means for enterprises
Shadow agents are the real first gap
The Claude on an employee's desktop, the Claude Code in a terminal, the assistants in browsers — they run with system-level privilege outside the security team's visibility. Any agent-security strategy starts by seeing them.
Runtime visibility is not optional
When agent behavior is indistinguishable from legitimate user activity, post-hoc audit cannot answer "what did this agent actually do." A causal chain — prompt to identity to tool to action — is the only mechanism that reconstructs the full execution graph.
SIEM integration decides whether your stack becomes a silo
Whether agent data lands in your SIEM as first-party data and correlates with identity and cloud events determines whether you extend your existing security stack or build a new isolated system.
Three steps to act
Build a shadow-agent inventory first
Regardless of vendor, answer three questions: which AI agents are running in your company right now? Who deployed them? Do any hold system-level privilege? No inventory, no program.
Bring agent behavior into your existing endpoint and SIEM stack
Assess whether your endpoint sensor and SIEM already cover the agent execution graph and tool calls. Prefer solutions that ingest agent data as first-party data into the SIEM you already run rather than starting fresh.
Turn one governance policy into an enforceable runtime control
Pick one critical policy — e.g. "no unapproved agents on managed endpoints" — translate it into an enforceable runtime control, and verify the full loop from definition to enforcement to audit.
References
- CrowdStrike: CrowdStrike Unveils Falcon Guardian to Secure AI Agents Where They Execute: On the Endpoint at Runtime (2026-09-01) — https://www.crowdstrike.com/en-us/press-releases/crowdstrike-unveils-falcon-guardian-ai-agent-security/
- CrowdStrike: Falcon Guardian — AI Detection & Response product page — https://www.crowdstrike.com/en-us/platform/falcon-guardian-aidr/
- Broadcom: AgentMinder (2026-08-31) — https://www.broadcom.com/company/news/product-releases/64636
FAQ
What is Falcon Guardian?+
CrowdStrike's AI Detection & Response (AIDR) solution unveiled at Fal.Con 2026 (Sept 1): runtime security for AI agents where they execute — on the endpoint — covering shadow-agent discovery, runtime visibility, access controls, detection & response, and an AI gateway across data, models, prompts, agents, identities, infrastructure, and interactions.
Why is the endpoint the enforcement point?+
Once agents gain system-level privilege, the endpoint is where they reason, plan, and execute — accessing sensitive data and triggering downstream workflows with behavior indistinguishable from legitimate user activity. Posture tells you what could go wrong, governance shrinks it, only runtime stops what is going wrong — and the endpoint is the only enforcement point with complete execution visibility.
How is this different from agent governance or platform controls?+
Governance defines the policy (e.g. AgentMinder's intent-level authorization, BCG's control plane); Falcon Guardian enforces it at the execution point — translating governance policy into enforceable runtime controls and detecting, responding to, and containing malicious behavior. As CEO George Kurtz put it: 'Governance alone can't stop an agent already in motion.'
What capabilities does it ship?+
Shadow-agent discovery (live inventory on Windows/macOS), agent runtime visibility (causal chain from prompt, identity, tool call, and skill use to downstream actions), agent access controls, runtime detection and response (reconstructing the execution chain and computing blast radius in real time), an AI gateway covering MCP, Falcon Complete 24/7 managed response, and native Next-Gen SIEM integration.
What is the value for enterprises?+
It extends the existing endpoint and SIEM stack instead of creating a new silo: agent data lands in the SIEM as first-party data, correlatable across identity, cloud, and SaaS — and shadow agents (employees' unsanctioned Claude, Claude Code, etc.) get a path from discovery to control.
Related Articles
AgentMinder: intent-level runtime governance for AI agents
Broadcom AgentMinder governs agents as enterprise identities, binding authority to declared mission and approved intent — action-level runtime authorization.
BCG's Enterprise AI Control Plane: Governing Agents at Scale
BCG Aug 14: as agents scale across platforms, per-platform governance fails. The EACP unifies identity, registry, runtime policy, and golden-path deployment.
From AI assistant to attacker operator: Check Point 2026
Check Point 2026: AI now runs live intrusions — building 88k-line C2 frameworks and planting persistent backdoors. Defense must move to runtime.
AI Agent Execution Layer: Model Falls Short
Enterprises protect model-layer AI but ignore execution-layer tool calls. In 2026, most agent attacks happen at the execution layer, not the model layer.