In short: CrowdStrike Falcon Guardian is CrowdStrike's flagship AI detection and response (AIDR) product on the Falcon platform. It discovers sanctioned and shadow AI tools and AI agents across endpoints, cloud and SaaS, turns AI usage policy into enforceable controls, and detects threats such as prompt injection and sensitive data exposure. It is licensed per endpoint.
What Falcon Guardian is
Staff are using generative AI tools whether or not there is a policy, and AI agents, including coding assistants that can run commands on a developer's machine, are arriving on endpoints quickly. That creates new risks: confidential data pasted into public AI tools, agents with too much access, and attacks such as prompt injection that trick an AI tool into doing something it should not.
Falcon Guardian is CrowdStrike's answer. Unveiled in September 2026, it is now the product CrowdStrike presents as its flagship AI detection and response (AIDR) solution. It correlates AI activity with Falcon's endpoint telemetry to give security teams visibility and control over how AI is used across the organisation, and to detect and respond when AI tools or agents are misused or compromised.
What it includes
| Capability | What it gives you |
|---|---|
| AI discovery | Finds AI tools and AI agents in use across endpoints, cloud and SaaS |
| Shadow AI detection | Surfaces unapproved and previously unknown AI tools and agents |
| AI usage policy | Turns governance policy into controls over which tools and agent types may run |
| Agent runtime protection | Detects compromised agents, links prompts to the processes and actions that followed, and contains them |
| Prompt injection detection | Detects and can block direct and indirect prompt injection |
| Data protection in AI workflows | Applies policy to sensitive data in AI interactions and can redact, encrypt or block it |
CrowdStrike lists some components, such as an AI gateway for central control of enterprise AI traffic, as coming soon, and managed services around Guardian are being added over time, so we confirm what is available when we quote.
How it is licensed
Falcon Guardian is an add-on licensed per endpoint, on top of a Falcon bundle such as Falcon Defend or Falcon Complete Defend. It is billed monthly.
You can license every device, or start with the teams making the heaviest use of AI, such as developers, marketing and analysts. Ask us for a quote.
Deployment and requirements
Guardian is built on the Falcon platform and uses its endpoint telemetry, so on devices already running the Falcon sensor it is enabled through licensing and policy rather than a new agent. The first step is usually discovery: see which AI tools and agents are actually in use before writing or enforcing policy.
From there we help you agree an AI acceptable use policy with your leadership and data protection lead, then translate it into Guardian controls: which tools are approved, which agent types may run, and what happens when sensitive data is about to be shared.
Who it suits and how we help
Falcon Guardian suits organisations already running CrowdStrike that want to allow AI use safely rather than ban it, particularly those with developers using AI coding agents or staff handling personal or client data.
We license Guardian on your Forever Systems account, run the initial discovery, help shape policy and tune the controls. For broader data loss prevention beyond AI, see Falcon Data Protection. Staff guidance matters too: see security awareness training.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Falcon Guardian and Falcon AIDR?
Falcon AIDR was the name of CrowdStrike's earlier AI detection and response product. CrowdStrike's AIDR page now presents Falcon Guardian, which it calls its flagship AIDR solution, adding runtime protection for AI agents to AI discovery, governance, data protection and prompt threat detection.
Can Falcon Guardian detect shadow AI?
Yes. It discovers AI tools and AI agents in use across endpoints, cloud and SaaS, including ones IT has not approved, so you can decide what to allow.
Does Falcon Guardian protect against prompt injection?
Yes. CrowdStrike lists runtime inspection of AI interactions for direct and indirect prompt injection, with the option to block malicious interactions, as part of Falcon Guardian.
How is Falcon Guardian licensed?
Per endpoint, as an add-on to a Falcon bundle, on monthly billing.