CrowdStrike launches Falcon Guardian to police AI agents at the endpoint

CrowdStrike has introduced Falcon Guardian, a software solution aimed at identifying and managing artificial intelligence agents running on company endpoints. The announcement was made at the company's Fal.Con 2026 conference in Las Vegas. Falcon Guardian is an expanded version of Falcon AI Detection and Response, which was made generally available in December and gained endpoint runtime protection and shadow AI discovery at the RSAC Conference in March. The new feature, Enforcement, is what has been added to Falcon Guardian.

The reasoning, planning, and execution of AI agents occur at the endpoint level, making it the ideal location for complete visibility into their actions. The Falcon sensor first discovers both known and shadow agents on Windows and macOS machines, logs their deployment, and tracks their security status. Guardian then correlates agent behavior with endpoint telemetry, creating a timeline that starts with a user's prompt and ends with the agent's actions on the system.

Administrators can approve which agents are allowed to run on a managed endpoint, with all others being blocked.

Falcon Guardian's detection and response capabilities are built on the same telemetry. It flags attacks targeting agents as well as agents behaving maliciously on their own. It then reconstructs the execution chain and estimates the blast radius while an incident is ongoing. The two components of Guardian not yet released are AI Gateway and the managed detection and response tier, Falcon Complete for Guardian.

AI Gateway will monitor enterprise AI traffic and apply Falcon policy to every call, including Model Context Protocol connections. It is currently in pre-beta and will be generally available next quarter. The managed detection and response tier, Falcon Complete for Guardian, is set to launch later this quarter.

CrowdStrike's stance is that AI has not changed the nature of attacks but only their speed, and governance alone cannot stop an already active agent. The company's telemetry from Guardian is included in Falcon Next-Gen SIEM as first-party data, ready for correlation with identity, cloud, and software-as-a-service activity. In contrast, competing AI security tools do not provide security information and event management of their own, forcing customers to purchase additional third-party products as agent volume increases.

This is the second major product CrowdStrike has announced at this year's conference, following the launch of Falcon IQ, which delegates assessment and remediation tasks to a fleet of over 50 agents.