CrowdStrike started by helping security teams secure the laptop, which is where you stop a breach. At Fal.Con 2026 in Las Vegas on September 1, the company applied that same argument to software that now sits on the machine and acts on its own.

It announced Falcon Guardian. CrowdStrike calls this AI Detection and Response. The product builds an inventory of agents on the endpoint and includes a switch that turns an unapproved one off.

George Kurtz, CrowdStrike’s chief executive, said: “AI hasn’t changed the attack, it has changed its speed.”

What Guardian Does on the Laptop Today

An AI agent takes a prompt, uses an identity, calls a tool, and can write files. That work happens on Windows and macOS. A network monitor may see some of the traffic. A policy document does not see the process. CrowdStrike says the Falcon sensor is already on the machine, so it can record the prompt, the identity, the tool call, and the file write as one sequence (CrowdStrike, 2026).

The parts CrowdStrike is shipping do four jobs. The sensor finds known agents and shadow agents, whether they are running or sitting idle, and records who deployed each one. It ties that agent activity back to other endpoint telemetry. Administrators name the agents allowed on a managed device and block the rest. Detection and response rebuilds the path the agent took and tries to stop it from moving to other systems.

An approved-model list on a slide does not remove an agent that a developer already installed on a laptop.

AI Gateway and Falcon Complete Have Not Shipped

AI Gateway is the planned product that sits in front of company traffic to AI models, including connections that use Model Context Protocol, and applies Falcon policy to each call. CrowdStrike’s September 1 release lists Gateway as a future control point. Coverage in SiliconANGLE the same day said Gateway is in pre-beta and is expected to go generally available next quarter.

Falcon Complete for Guardian is the planned 24-hour expert team for agent incidents. SiliconANGLE reported that Complete is expected later this quarter. Falcon Adversary OverWatch for Guardian is also listed as coming. CrowdStrike already sells cross-domain hunting. The Guardian version of that service is not out yet.

Those dates come from CrowdStrike’s wording and from SiliconANGLE. They are plans, not a ship confirmation from CrowdStrike.

Other Announcements From Fal.Con Day 1

Falcon IQ puts more than 50 pre-built agents on Project QuiltWorks so vulnerability assessment and remediation can run as software instead of a year-long services project (CrowdStrike, 2026). QuiltWorks now feeds live data into Falcon Next-Gen SIEM from twelve vendors, including Zscaler and Rubrik.

SafeMind, built with NVIDIA Nemotron inside a new Cyber Superintelligence Lab, pairs an offensive model named Red Tempest with a defensive model named Blue Solano. CrowdStrike’s own tests claim a 29 percent higher detection rate, six times faster remediation, and a 99 percent cut in detection and remediation cost against generic frontier models. Those numbers are CrowdStrike’s comparison, not an outside lab result.

Falcon also landed on Google Cloud in U.S. regions and on Snowflake Marketplace, where buyers can pay with Snowflake capacity they already committed. Optiv said lifetime contract value with CrowdStrike passed $2 billion. EY named Falcon the security layer under EY.ai Value Blueprints.

What to Check Before You Expand Falcon for Agents

Most companies already have agents on laptops that security never approved. Some arrived in a pilot. Some arrived when a developer installed a coding assistant. Some arrived inside a vendor’s desktop app.

CrowdStrike is using the Falcon sensor it already has on machines to build the agent list and the shutoff, so you do not install a second agent for this job. The company says that sensor runs on hundreds of millions of devices. That figure is CrowdStrike’s.

If your team cannot handle agent incidents around the clock, Falcon Complete for Guardian is the add-on you will be offered, and it is not for sale yet.

About Shashi Bellamkonda

Loading bio…

LinkedIn Profile

Get new posts by email:

Subscribe

Powered by