Explainer · CrowdStrike Falcon Guardian
CrowdStrike Falcon Guardian, explained
CrowdStrike launched Falcon® Guardian on 1 September 2026 as its flagship AI Detection and Response product. Here’s what it does, what it replaces, and the part the datasheet doesn’t cover: who deploys it, migrates you onto it, and runs it around the clock.
Vijilan is a CrowdStrike Powered Service Provider (CPSP), a CrowdStrike partner program designation.
The short version
Falcon Guardian secures AI agents where they actually run: on the endpoint. It’s built into the CrowdStrike Falcon sensor, so there’s no new agent to install. It finds AI agents on Windows and macOS devices, traces what they do at runtime, controls which ones may run, and detects and responds when one is misused or compromised.
It’s CrowdStrike’s answer to a specific problem. In CEO George Kurtz’s words at launch: “AI hasn’t changed the attack, it has changed its speed. Governance alone can’t stop an agent already in motion.”
What it does
CrowdStrike describes these capabilities at launch:
- 1
Agent discovery and inventory
Every AI agent on the device, including what skills, tools and MCP servers it can reach.
- 2
Runtime visibility
The causal chain from a prompt to the processes, files and network activity that followed.
- 3
Agent access controls
Policy over which agents run and how people use AI tools.
- 4
Runtime detection and response
Detecting compromised or misused agents and containing them.
- 5
Next-Gen SIEM integration
Guardian data arrives as first-party Falcon data.
CrowdStrike has also announced an AI Gateway and managed services, Falcon Complete for Guardian and Falcon Adversary OverWatch for Guardian, as part of the Guardian family.
What happened to Falcon AIDR?
“AIDR”, meaning AI Detection and Response, is the category. Falcon Guardian is now CrowdStrike’s product name for it. If you’ve seen earlier CrowdStrike announcements about AIDR for endpoint, Copilot Studio or cloud, Guardian is where that capability now lives. Existing customers should check the transition details with CrowdStrike or their provider.
Moving to Falcon Guardian, without a gap in coverage
Wherever you are starting from, the move runs in monitor-only mode first, so nothing you rely on is switched off before its replacement is proven.
From
Falcon AIDR
Falcon Guardian is where CrowdStrike’s AIDR capability now lives. We map the AI policies and detections you run today, confirm with CrowdStrike how your licensing carries over, and re-baseline in monitor-only mode before anything is enforced.
From
Another AI security tool
A gateway, a browser extension or a DLP rule set. Guardian runs in the Falcon sensor rather than as a new agent, so it runs beside your current tool first. We compare what each one sees, then retire what Guardian replaces and keep what still earns its place.
From
Vijilan Managed AIDR or ThreatAI Watch
Those were earlier names for this service. If you started with either, we move you onto AgentDefend on Falcon Guardian and carry your AI policy and reporting forward.
- 01
Inventory
What you run today, what it enforces, and what it reports.
- 02
Run side by side
Guardian in monitor-only mode beside your current controls.
- 03
Carry the policy over
Approved agents, blocked agents and protected data, rebuilt in Guardian.
- 04
Cut over in stages
A pilot group first, then the whole organization.
- 05
Hand to the 24/7 SOC
A tested handover, a first AI Exposure Report and 30 days of hypercare.
Guardian vs an AI gateway
| AI gateway | Falcon Guardian | |
|---|---|---|
| Where it sits | In the network path to AI services | In the Falcon sensor on the device |
| Sees agents that aren’t currently talking | No | Yes |
| Sees what a prompt did on the machine | No | Yes |
| Sees AI traffic routed around it | No | Yes, where the sensor runs |
| Best at | Central policy on sanctioned AI traffic | Discovery, runtime behavior, endpoint response |
They aren’t rivals. Guardian can take gateway data through a collector, and most organizations with a gateway should keep it.
What it takes to run
Guardian produces what every good detection product produces: detections, policies and decisions. Someone has to:
- decide what counts as sanctioned AI, and keep that list current as new tools appear
- tune the prompt detectors so legitimate work isn’t flagged all day
- set privacy controls before any prompt content is collected
- triage agentic detections at 2am and decide whether to isolate a developer’s laptop
- report to the CISO and the board on what’s running and what changed
CrowdStrike offers its own services for parts of this. Service partners, including Vijilan, offer others.
Have Vijilan run all five for youHow Vijilan deploys and runs Falcon Guardian
AgentDefend is AI security powered by CrowdStrike and delivered by Vijilan. It includes the Falcon Guardian license, deployment, AI policy management and a 24/7 SOC, delivered as Deploy, Sustain and Operate, with a Vijilan analyst authorizing every consequential action. Available as an add-on to ThreatDefend™ or NextDefend™, or on its own for organizations that already run Falcon. Mid-market and enterprise teams buy it direct; MSPs and MSSPs add it to the services they run for their clients.
AI security powered by CrowdStrike, delivered by Vijilan
AgentDefend is CrowdStrike Falcon Guardian with everything it takes to run it.
Falcon Guardian licensing
The CrowdStrike Falcon Guardian license is part of the service and scoped to your endpoints, so there is one contract to sign. Guardian runs in the Falcon sensor, and if you do not run Falcon yet, ThreatDefend™ brings it.
Deployment and policy management
Vijilan engineers discover what AI is running, design your policy with you, enforce it in stages and connect Guardian to Falcon Next-Gen SIEM. Then they keep that policy current as new tools appear.
24/7 coverage
Tier 1 to 3 Vijilan analysts watch every Guardian detection around the clock and contain what is compromised, with an analyst authorizing every consequential action.
Request an AI Exposure Snapshot
Tell us where you are starting from. A Vijilan engineer comes back with what Falcon Guardian would find on your endpoints, what moving to it involves, and how AgentDefend would run it for you.
- For security and IT teams buying direct
- For MSPs and MSSPs adding AI security for their clients
- For VARs and distributors quoting it as one line item
Vijilan is a CrowdStrike Powered Service Provider (CPSP), a CrowdStrike partner program designation.
The AgentDefend one-pagers
Four PDFs, formatted to forward to your team, your leadership or your clients.
AgentDefend overview
The service on one page: what it covers, the three phases, your named team.
Unlock belowDeploy: onboarding
Standing up Falcon Guardian in five steps, and what we need from you.
Unlock belowSustain: AI policy management
Keeping your AI policy current, with the monthly and quarterly cadence.
Unlock belowOperate: 24/7 AI SOC
How detections are investigated and contained, and who calls you.
Unlock belowSources
- CrowdStrike Unveils Falcon Guardian to Secure AI Agents Where They Execute on the Endpoint at Runtime · CrowdStrike, 1 September 2026
- Falcon Guardian (AIDR) product page · CrowdStrike, CrowdStrike
- CrowdStrike Establishes the Endpoint as the Epicenter for AI Security · CrowdStrike, 23 March 2026
Page published , last updated . We update it when CrowdStrike does.
CrowdStrike, Falcon and Falcon Guardian are trademarks of CrowdStrike, Inc. AgentDefend is delivered by Vijilan Security. Logos identify the platform and do not imply endorsement.
Related reading
- AgentDefendVijilan’s managed service on Guardian: Deploy, Sustain, Operate.Read
- Shadow AI agentsWhy endpoint-native discovery finds what a gateway cannot.Read
- AI Agent ReadoutSee what Guardian finds on your own pilot group.Read
- CrowdStrike alternativesHow Falcon sits against the platforms buyers weigh it against.Read