Global – October 12, 2026 -- CrowdStrike has been named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises Vendor Assessment, and is using the recognition to push its Falcon platform into protection for AI agents on the endpoint.
CrowdStrike frames AI agents as a new source of endpoint activity
The company says humans, applications, and AI agents now work side by side on endpoints, executing commands, accessing data, using identities, working through browsers, invoking tools, and introducing software. CrowdStrike calls this the "agentic endpoint," where humans, AI agents, and AI-enabled adversaries converge.
Ransomware, malware-free attacks, hands-on-keyboard activity, and credential abuse remain critical risks, according to the company. Supply chain attacks can introduce risk before code executes, and AI agents add new access and autonomy. CrowdStrike argues that security teams must now determine who or what acted, the access and intent behind the activity, and whether it should continue.
Falcon Guardian extends the existing Falcon sensor to AI agent activity
Falcon Guardian discovers approved and unknown agents, enforces AI governance policy, and detects threats such as prompt injection and malicious skills. It also connects prompt-layer activity with OS-level telemetry, letting teams trace AI agent actions through the processes they trigger.
Because Falcon Guardian runs on the Falcon sensor customers already deploy, organizations can add agent protection without another endpoint sensor, separate console, or control plane.
Supply chain protection blocks malicious npm and PyPI packages at download
CrowdStrike Real-Time Supply Chain Attack Protection blocks malicious npm and PyPI packages at download, before embedded code can run. The control applies whether a human or an AI agent downloads the package, and moves endpoint prevention further upstream in the attack chain.