Falcon Guardian

CrowdStrike's AI Detection and Response product that discovers, monitors, and enforces policy on agentic AI running inside an organization.

CrowdStrike · Security and safety tooling · product

Published in Feed

Overview

Unveiled at Fal.Con 2026 (Las Vegas, Aug 31-Sept 3) on September 1, 2026, Falcon Guardian gives security teams discovery of an organization's full AI agent fleet, including unapproved 'shadow AI', runtime visibility into what agents access and do, and policy enforcement to stop threats before they act. It is the expanded successor to Falcon AI Detection and Response, which reached general availability in December 2025. On November 3, 2026, at Fal.Con Europe, CrowdStrike announced Falcon Guardian protection for Anthropic's Claude Cowork: the Falcon sensor runs inside the Cowork VM on macOS and Windows for visibility and detection of agent activity, in beta on macOS with Windows support expected later in November. Also on November 3, 2026, CrowdStrike added an AI Kill Switch to Falcon Guardian, available at launch, that lets administrators terminate a rogue agent, block it from relaunching on a host or host group, and remove its enterprise network access; enforcement runs through the Falcon AI Gateway (included with Guardian at no additional cost) or a third-party AI gateway, and one report says endpoint-level termination is planned for later.

This is a sourced directory entry. Features and capabilities are reported in the linked sources; this entry does not document independent Aymorphic testing.

Key features

  • Fleet-wide discovery of sanctioned and shadow AI agents
  • Runtime monitoring of agent actions and resource access
  • Policy-to-enforcement pipeline to block agent-driven threats
  • Successor to Falcon AI Detection and Response
  • Falcon sensor inside the Claude Cowork VM (beta on macOS, Windows expected later in November 2026)
  • AI Kill Switch (Nov 3, 2026): terminate an agent, block relaunch, cut network access via Falcon or third-party AI gateway

Use cases

  • Finding unapproved AI agents deployed by employees/teams
  • Runtime guardrails for enterprise agentic AI deployments
  • SOC visibility into AI-agent attack surface

Pricing

Not disclosed; part of the Falcon platform.

Pricing reflects the source record and may change. Confirm current terms with the provider.

Dates and sources

Released
1 Sept 2026
Record updated
8 Nov 2026
Record last checked
8 Nov 2026

Explore the Feed

Other entries filed under security and safety tooling; inclusion does not imply equivalent features.

  • DefenseClaw Edge Connector

    Cisco's open-source DefenseClaw gains an Edge Connector that allows or blocks AI agent tool calls directly on IoT and robot hardware.

  • Lakera Guard 2.0

    Lakera's real-time guardrail API for LLM apps, updated with multi-agent protection and a new benchmark for detecting indirect prompt injection in tool outputs.

  • Fleming-1

    Sierra's model that listens to a live phone call and scores whether the caller is an AI agent rather than a human.

Browse the Feed