CrowdStrike (NASDAQ:CRWD) introduced new features for its Falcon platform aimed at strengthening AI agent discovery and runtime protection across endpoints, software-as-a-service platforms, web browsers and cloud environments.
The cybersecurity firm said its sensors currently detect more than 1,800 different AI applications operating on enterprise devices, accounting for nearly 160 million unique application instances across its customer base. The newly announced capabilities are designed to improve visibility and control over AI-driven activity as autonomous systems gain deeper access to enterprise infrastructure.
“AI agents are fundamentally changing how technology operates and how it must be secured,” said Michael Sentonas, president of CrowdStrike. “Security built for static applications can’t keep up with autonomous systems.”
Among the updates is EDR AI Runtime Protection, which monitors commands, scripts, file activity and network connections generated by applications running on endpoints. Another feature, Shadow AI Discovery for Endpoint, automatically identifies AI applications, agents and development tools deployed across endpoint devices. The company also introduced AIDR for Endpoint, which extends prompt-layer protections to desktop AI tools such as ChatGPT, Gemini, Claude and Microsoft Copilot.
The expanded platform capabilities also extend to additional environments following CrowdStrike’s acquisition of Seraphic Security, enabling runtime protection for browser-based activity. New cloud-focused tools include Shadow AI Discovery for Cloud and AIDR for Cloud, designed to secure AI workloads operating in containerized environments.
Additional tools introduced include Shadow SaaS and AI Agent Discovery for enterprise platforms such as Microsoft Copilot, Salesforce Agentforce and ChatGPT Enterprise. CrowdStrike also launched AIDR for Copilot Studio Agents, which monitors prompts and AI agent behavior in real time.
The announcement was made during the RSA 2026 conference. The company noted in its press release that some of the referenced services and features remain under development and may change before full release.