CrowdStrike introduced Falcon Guardian at Fal.Con 2026, extending its Falcon platform with new capabilities designed to discover, monitor, control, and detect autonomous AI agents operating across enterprise environments.
The launch reflects a growing security challenge as AI agents gain broader access to endpoints, cloud environments, SaaS applications, and browsers. Falcon Guardian is designed to give security teams visibility into what those agents are doing, what data and models they access, and whether their behavior poses a risk.
“I think we’ve all seen – and the industry has seen – what happens when agentic autonomy outpaces the authority that those agents should have,” said AJ Shipley, Chief Product Officer, CrowdStrike. “As agents gain these system-level privileges, the endpoint is where those agents reason, to where they plan and ultimately to where they execute.”
Shipley added: ‘Falcon is deployed across hundreds of millions of devices globally today. More endpoint real estate than any other security vendor in the industry.”
CrowdStrike extends Pangea into autonomous AI security
In 2025, CrowdStrike acquired Pangea to secure AI use and development across the enterprise.
Guardian builds on that acquisition, which also initially provided protection against human-generated prompts. Guardian extends that capability to autonomous agents that can act independently rather than simply responding to human input.
“Pangea delivered human-initiated prompt-level protection,” said Shipley. “But what we’ve seen most recently is that agents don’t type, they act. And so what we’ve done with Guardians is we’ve extended what Pangea began through the marriage of our market-leading Falcon platform, for endpoint visibility and control of OS-level indicators of attack.”
Guardian is designed to correlate endpoint telemetry with agent activity to establish a complete picture of what an AI agent is doing.
Shipley described the product as extending across endpoints, containers, cloud environments, SaaS applications, and browsers.
“That includes all of the data that those agents create as well as access,” Shipley notes. “All of the models that they access, the prompts that they generate, the agents themselves, the identities of those agents, the infrastructure that they traverse, and the interactions between multiple agents.”
Falcon Guardian discovers and controls AI agents
Guardian’s core capabilities include discovering approved and unauthorized AI agents, monitoring their activity, controlling which agents can operate on devices, and detecting malicious agent behavior.
The system is intended to provide organizations with enforceable governance over AI agents.
“Guardian will discover every approved and shadow AI agent across the enterprise,” said Shipley. “It’ll provide a live inventory of every agent who deployed it, its security status, and it is continuously updated.”
“We then extend it with agent access control, so we can define which agents are permitted to run to or manage devices, as well as block unauthorized agents for money. So now that governance that a lot of organizations have can become enforceable one-time control that they need,” Shipley continued.
CrowdStrike connects Guardian telemetry to Falcon Next-Gen SIEM
CrowdStrike is also extending Falcon Complete and OverWatch capabilities to Guardian, while integrating Guardian telemetry with Falcon Next-Gen SIEM.
Shipley emphasized that AI agents generate substantially more telemetry than traditional endpoint applications.
“Because AI agents generate orders of magnitude more telemetry than traditional applications on the endpoint, we are integrating Guardian with our Next-Gen SIEM,” Shipley explained. “Guardian will export all of that data into Falcon Next-Gen SIEM as first-party data.”
CrowdStrike partners gain agentic AI security tooling
For MSPs, MSSPs, and other security partners, the rise of autonomous AI agents could create a new layer of monitoring and governance requirements inside customer environments.
Tools such as Falcon Guardian point toward a broader managed-services opportunity around discovering unauthorized agents, enforcing access controls, monitoring agent behavior, and incorporating agent-generated telemetry into existing detection and response workflows.
CrowdStrike has not detailed a specific partner go-to-market motion for Guardian in this announcement, but the product’s integration with Falcon Complete, OverWatch, and Falcon Next-Gen SIEM suggests agent security could increasingly become part of the broader managed security stack.