CrowdStrike offered an answer for the growing fear around AI agents getting out of control and breaking critical systems.
On Tuesday at its Fal.con event in Las Vegas, CrowdStrike unveiled Falcon Guardian, a new enterprise visibility and protection platform that monitors everything agents do on your network and blocks malicious activity at the endpoint before it escalates.
The new product grows out of CrowdStrike's September 2025 acquisition of Pangea, one of the pioneers of generative AI cybersecurity, and it combines CrowdStrike's endpoint monitoring and protection with Pangea's intelligence in detecting malicious AI activity. The move is an attempt to create a new category of software called AIDR: AI detection and response.
"The industry has seen what happens when agentic autonomy outpaces the authority that those agents should have," said CrowdStrike's chief product officer, AJ Shipley, in a briefing with the media.
We've learned over the past month that OpenAI, Anthropic, and Meta have all had AI agents that broke through their guardrails and launched their own attacks that were unplanned and unintended by the teams running them.
"This was a watershed moment in security," said CrowdStrike CEO George Kurtz in the opening keynote at Fal.con on Tuesday.
And in recent days, over 100 leading tech and AI companies have united to call for collective action in prioritizing cyber defenses to protect critical infrastructure against the next wave of AI advances.
CrowdStrike Falcon Guardian wants to address the problem with multiple components in one platform:
Agent monitoring and detection: Automatically detects all agents operating on the network, no matter who started them or where.** Telemetry for tracking actions**: This plays to CrowdStrike's strengths in endpoint telemetry (process, file, network activity) to capture the full causal chain of everything an agent does.Agent access control and policy enforcement: Organizations can define which agents are allowed to run on which devices, and it blocks unauthorized agents to make AI governance policies enforceable.Real-time AI threat containment: Identifies compromised or malicious agents, determines their blast radius in real time, and neutralizes threats before they spread.
"Falcon Guardian will discover every approved and shadow AI agent across the enterprise. It'll provide a live inventory of every agent, who deployed it, [and] its security status. And it is continuously updated," said Shipley.
Our Deeper View #
Beyond just Falcon Guardian, which is focused on helping companies understand and control what's happening in their corporate infrastructure, CrowdStrike also announced two other big moves. It's launching the CrowdStrike Cyber Super Intelligence Lab as a factory to churn out the knowledge and understanding to stay ahead of attackers and malicious AI. It's also launching its own harness, SafeMind, and its own AI models, Red Tempest and Blue Solano. The models are built on Nvidia's open Nemotron models and the harness is aimed at creating a proactive, offensive system that's constantly evolving to counter the ways AI agents change and adapt to launch attacks. CrowdStrike claims it detects 52% more legitimate threats and remediates them 48x faster than general-purpose models. That sounds a lot like Cloudflare's Adaptive Intelligence, which just launched to give companies a security solution that adapts in real-time to the way AI evolves. Giving enterprises more dynamic solutions to protect against agentic AI attacks is a welcome development.