CrowdStrike says organizations are adopting Falcon Guardian to secure AI agents
Summary
CrowdStrike says Falcon Guardian helps organizations discover AI agents, link their activity to endpoint actions, and apply runtime controls. The company cites customer evaluations reporting 99% prompt-injection detection at one firm.
Key points
- CrowdStrike says Falcon Guardian has been deployed at hundreds of organizations since its September 1, 2026 launch.
- The product discovers AI agents, tools, and MCP servers across endpoint, cloud, and SaaS environments, and links AI telemetry with endpoint activity.
- CrowdStrike says one evaluation found two internally built agents unknown to the security team; another identified risky data and instructions moving between agents and MCP servers.
- CrowdStrike’s OverWatch team observed an endpoint agent attempt to share corporate intellectual-property files through public data-sharing websites.
- The vendor says policies can detect, redact, or block personal and confidential information in supported AI interactions, and apply access and content controls.
- Customer-run evaluations reportedly measured 99% prompt-injection detection at a financial services firm and 95%+ average blocking across malicious prompt categories at a telecommunications company.
Article Details
- Event Type
- CrowdStrike customer deployment and adoption announcement for Falcon Guardian, its AI agent security product.
- Impact
- CrowdStrike reports Falcon Guardian is deployed at hundreds of organizations worldwide. In early deployments, organizations reported previously unrecorded AI interactions, more than 260 distinct AI services in use at one organization, and confidential documents and customer records being shared with public AI chatbots. Customer-reported testing results included 99% prompt-injection detection accuracy at one financial services firm and 95%+ average block rates at a global telecommunications company.
Vendors
Products
CrowdStrike Falcon GuardianWe asked what led them to Falcon Guardian; their answers fell into five themes listed below.CrowdStrike Falcon Next-Gen SIEMIts findings flow into CrowdStrike Falcon® Next-Gen SIEM, so AI activity can be investigated alongside endpoint, identity, SaaS, and cloud data.CrowdStrike Falcon platformThey act through the same processes, files, and user permissions that the Falcon platform already protects.Falcon browser extensionIt works through the Falcon sensor and console that organizations already use, and also leverages the Falcon browser extension.Falcon sensorIt works through the Falcon sensor and console that organizations already use, and also leverages the Falcon browser extension.
Industries
Energyof organizations around the world spanning financial services, healthcare, manufacturing, retail, energy, and the public sector.Financial Serviceson September 1, 2026, it has been deployed at hundreds of organizations around the world spanning financial services, healthcare, manufacturing, retail, energy, and the public sector.Healthcare2026, it has been deployed at hundreds of organizations around the world spanning financial services, healthcare, manufacturing, retail, energy, and the public sector.Manufacturingbeen deployed at hundreds of organizations around the world spanning financial services, healthcare, manufacturing, retail, energy, and the public sector.Public Sectoraround the world spanning financial services, healthcare, manufacturing, retail, energy, and the public sector.Retailat hundreds of organizations around the world spanning financial services, healthcare, manufacturing, retail, energy, and the public sector.TelecommunicationsA global telecommunications company measured 95%+ average block rates across malicious prompt categories, with 98%+ multilingual coverage