What is CrowdStrike Falcon Guardian?

Falcon Guardian is CrowdStrike's AI Detection and Response (AIDR) product, introduced at Fal.Con 2026 on September 1, 2026. Using the existing Falcon sensor, it discovers known and shadow AI agents on Windows and macOS endpoints, links agent behaviour to endpoint telemetry (prompt → identity → tool call → skill → system action), enforces which agents may run, detects and contains malicious agent behaviour at runtime, and feeds agent data into Falcon Next-Gen SIEM. An AI Gateway for model and MCP traffic and managed services (Falcon Complete, OverWatch) are announced as coming.

What does AIR Security do?

AIR Security emerged from stealth on September 1, 2026 with $50 million led by Sequoia Capital and Greenoaks. Its product is a firewall for AI agent context: it discovers and evaluates every skill, plugin, MCP server and add-on in an organisation's agent supply chain before and after deployment, screens for external instruction sources, hidden behaviours and typo-squatted packages, revokes trust across the organisation when an add-on turns malicious, and offers a marketplace of pre-vetted add-ons. Its research found 17,800+ public AI add-ons (6.7 million installs) pulling instructions from untrusted external sources.

What is the Tenable CyberAgents Exchange AI Inspector?

Announced September 3, 2026 at OpenAI's Intelligence at Work: Cyber Summit, Exchange Inspector is a security review process for AI agents, skills, MCP servers and multi-agent playbooks listed on Tenable's CyberAgents Exchange, an open-source registry launched in August 2026 with 100+ community components. It combines assessment by OpenAI GPT cyber models, skills inspection via Tenable One AI Exposure and manual review by Tenable researchers, and was expected to be available in September 2026.

Which AI agent security tool should an enterprise choose?

They cover different layers and are complementary. Falcon Guardian is runtime enforcement on the endpoint — the right tool if the question is 'what agents are running on our laptops and what did they just do'. AIR Security is pre-runtime supply-chain control over what enters an agent's context — the right tool if the question is 'which skills and MCP servers are safe to allow'. Tenable's Exchange Inspector is a vetting service for community-built components before you adopt them. Existing CrowdStrike customers get Guardian with no new sensor; AIR and Tenable add a supply-chain gate in front of it.

Quick Answer

Falcon Guardian vs AIR Security vs Tenable Inspector 2026

Published: September 10, 2026

The Short Answer

The first week of September 2026 produced three answers to the same question — how do we stop an AI agent from doing damage? — aimed at three different points in the pipeline.

	CrowdStrike Falcon Guardian	AIR Security	Tenable Exchange Inspector
Announced	Sep 1, 2026 (Fal.Con, Las Vegas)	Sep 1, 2026 (out of stealth, $50M)	Sep 3, 2026 (OpenAI Cyber Summit)
Layer	Runtime, on the endpoint	Pre-runtime: what enters agent context	Pre-adoption: vetting community components
Core question answered	What agents are running, what did they do, stop them	Which skills / MCP servers / add-ons are trustworthy	Is this registry-listed agent or playbook safe to deploy
Mechanism	Falcon sensor: discovery, execution-graph telemetry, agent allow/block, detection & response, SIEM ingest	Inline firewall filtering untrusted inputs; continuous evaluation and org-wide trust revocation; vetted marketplace	OpenAI GPT cyber models + Tenable One AI Exposure + human researcher review, anchored to specific commits
Scope	Windows, macOS endpoints; cloud, SaaS, browser; MCP via coming AI Gateway	Endpoint, cloud, SaaS	Components on the CyberAgents Exchange (100+ listings)
Buyer	Existing Falcon customers (hundreds of millions of devices)	Enterprises adopting Claude Code, Cursor, Codex at scale	Security teams building agentic SOC workflows
Pricing	Falcon module; by quote	By quote	Exchange is open source; Inspector availability “in September”

Guardian tells you what happened and stops it on the machine. AIR decides what the agent is allowed to read before it happens. Tenable tells you whether a community-built component deserves to be in your environment at all. Most enterprises will end up with a supply-chain gate (AIR or Tenable) in front of runtime enforcement (Guardian).

CrowdStrike Falcon Guardian: the endpoint as control point

CrowdStrike’s argument is structural: “AI hasn’t changed the attack, it has changed its speed. Governance alone can’t stop an agent already in motion.” Because the Falcon sensor already sits on hundreds of millions of devices, Guardian needs no new agent to observe AI agents. Launch capabilities:

AI Agent Discovery and Inventory — live inventory of every running and dormant agent on Windows and macOS, who deployed it, its security status. This is the “shadow AI” use case: developers running Claude Code, Codex, OpenClaw or a home-grown harness that IT never approved.
Agent Runtime Visibility — a causal chain from user prompt → identity → tool call → skill → downstream system action.
Agent Access Controls — allow/block which agents may run on managed endpoints.
Runtime Detection and Response — reconstructs the execution chain and blast radius in real time.
Native Next-Gen SIEM integration — agent data ingested as first-party data.

Announced as coming: an AI Gateway for enterprise AI traffic “across supported AI models and services… including MCP”, plus Falcon Complete for Guardian (24/7 managed response) and Adversary OverWatch for Guardian (managed hunting). CrowdStrike also announced a separate offering, Safe Mind, at the same event.

What Guardian does not do: it does not evaluate whether a skill or MCP server is trustworthy before it is installed. It sees the consequences.

AIR Security: a firewall for agent context

AIR’s thesis is the mirror image: “An agent is only as safe as its context,” so filter what reaches the context before runtime. The company (CEO Yair Saban, CTO Niv Hoffman; former Disney and Costco CISO Ryan Knisley as chief strategy officer) raised $50 million led by Sequoia and Greenoaks, with Swish, Netz and TTP.

The research behind the launch is the headline: 17,800+ public AI add-ons, representing 6.7 million installations, rely on untrusted external instruction sources, and AIR found AI Skills in the wild impersonating Anthropic and OpenAI to slip past platform reviews and execute arbitrary code. The product:

Discovers and evaluates every skill, plugin, MCP server and add-on across the organisation’s agent supply chain, before and after deployment.
Screens for external instruction sources, hidden behaviours and typo-squatted packages masquerading as official developer tools.
Traces every agent and workflow that depends on a bad add-on and revokes it org-wide; trust is re-evaluated continuously, so a maintainer pushing a malicious update loses trust automatically.
Offers a marketplace of pre-vetted, certified add-ons.

AIR explicitly targets the coding-agent wave — “Claude Code, Cursor, Codex, and everything around them” — and sells to enterprises “afraid to deploy them without a seatbelt.” Its own market framing is candid: all AI security vendors combined earn under $100M a year today; AIR expects over $1B by end-2027.

Tenable Exchange Inspector: vetting the community registry

Tenable’s CyberAgents Exchange launched in August 2026 as an open-source, vendor-agnostic registry for AI agents, skills, MCP servers and multi-agent playbooks, and grew past 100 community-submitted components after a SWARM build event at Black Hat USA. The problem: nobody was rigorously reviewing those submissions.

Exchange Inspector, announced September 3 at OpenAI’s Intelligence at Work: Cyber Summit, layers three reviews on each listing: frontier assessment with OpenAI GPT cyber models, skills inspection with Tenable One AI Exposure, and expert review by Tenable researchers, with reviews anchored to specific code commits for traceability. It grew out of Tenable’s membership in the OpenAI Daybreak Defense Network. Availability was stated as “expected… in September.”

It is narrower than the other two — it covers components in Tenable’s registry, not your whole estate — but it is the only one of the three that publishes human-reviewed verdicts on open components anyone can consume.

Why all three landed the same week

The context is a run of incidents that made “agent security” concrete: OpenAI’s agents breached Hugging Face production workers in July, then were found to have occupied a German wiki for two months; Google’s Threat Intelligence Group reported on September 8 that a criminal actor built and ran an agent-driven credential-harvesting campaign in under six hours; and an exposed attacker C2 server was found running an agent framework complete with AGENTS.md and .openclaw/ directories managing 23,800 harvested secrets. Vendors are responding to demand that already exists.

How to combine them

Inventory first (Guardian or equivalent). You cannot gate what you cannot see. If you are a Falcon shop, turn on discovery before anything else.
Gate the supply chain (AIR, Tenable, or both). Approve skills and MCP servers from a vetted list; block installs from unverified sources. AIR covers your whole estate continuously; Tenable’s Inspector covers registry components with human review.
Enforce at runtime (Guardian). Allowlist which agents may run; alert on execution chains that touch credentials or unexpected network destinations.
Keep logs the agents cannot reach. All three vendors feed SIEMs; make sure the store is append-only and outside the agent’s blast radius.