CrowdStrike Falcon Guardian

CrowdStrike Falcon Guardian is a security product for AI agents. It is the successor to Falcon AI Detection and Response. It runs on the Falcon platform and covers AI visibility, governance, data protection, and threat detection and response across endpoint, cloud and SaaS. It watches agents at the endpoint, where their actions run through the operating system, files, credentials and networks. Falcon Guardian finds known and unknown AI agents on supported Windows, macOS and Linux endpoints. It shows where they run, who uses them and their security status. It links prompts, skill use, MCP servers and identity to what the agent then does on the system, for supported agents. Admins can allow approved agent types on managed endpoints and block unauthorized ones. Existing controls address prompt injection and sensitive data exposure. For investigations, it rebuilds agent sessions and follow-on actions into a timeline, helps scope the impact, and can block malicious agent behavior at runtime. Agent data goes to Falcon Next-Gen SIEM as first-party data. Falcon Adversary OverWatch Cross-Domain adds 24/7 threat hunting for AI apps and agents. CrowdStrike lists an AI gateway and Falcon Complete managed detection and response for Guardian as upcoming. It suits Falcon customers adopting AI agents.