For Windows administrators, there's one point to take away early. Two Microsoft products, GitHub Copilot and Microsoft 365 Copilot, are on CrowdStrike's list of agents Guardian can police. The network inspection component also ships first on Windows and is only in early access on Mac. Anyone whose developers have started letting agents run shell commands at 2 a.m. should pay attention.
What CrowdStrike says it fixes
CrowdStrike's argument is that you can't secure an AI agent by watching from just one spot. The release describes three places to watch, and names a weakness for each one used alone:
- Agent-level hooks can see the prompt. CrowdStrike says they miss the model's response and can't catch every action the agent takes afterward.
- Network-only tools can see traffic. But the agent runs on the endpoint, so a network tool can't stop the action itself. If the agent uses a local or open-weight model that never sends traffic over the network, the network tool sees nothing.
- The endpoint is where the agent actually runs, and where Guardian's runtime protection has operated since launch.
CrowdStrike says Guardian combines all three in one Falcon sensor. That links what an agent was told to do, what it sent over the network, and what it ran on the machine. Michael Sentonas, CrowdStrike's president, said every week the company sees agents "chain steps together, hit an obstacle, and take actions they were never authorized to take." CrowdStrike says Guardian has been generally available since September 2026.
That's a reasonable design argument. Still, it's CrowdStrike's claim about its own product. The release includes no independent testing, false-positive rates or customer deployment results.
Section summary: Guardian's pitch is correlation. It tries to connect a prompt, the network traffic it produced and the endpoint action it triggered, so an agent going off-script can be spotted and stopped.
The "available today" list
CrowdStrike says these capabilities are available now:
| Capability | What CrowdStrike says it does | Caveats in the announcement |
|---|---|---|
| AI Kill Switch | Terminates unauthorized agents in real time and blocks them from running again across the organization | Works "first at the Gateway"; termination on the endpoint is described as coming "soon" |
| AI Gateway | Sends AI traffic through a central gateway to inspect prompts and responses, monitor usage and enforce policy on managed and unmanaged devices | Generally available and included with Guardian; supported providers and protocols aren't listed |
| Agent-Level Hooks | Enforces policy inside Claude Code, OpenAI Codex, GitHub Copilot, Microsoft 365 Copilot, OpenCode and Cursor, inspecting prompts and blocking malicious activity | No supported versions given, and no statement on whether every feature works the same in each tool |
| SafeMind-Powered Detection | Uses CrowdStrike's SafeMind models and adversary intelligence to detect prompt injection, malicious instructions and personally identifiable information | No detection-rate data |
| AI Supply Chain Protection | Finds malicious AI skills and MCP servers before they get into the AI environment | Scanning workflow and coverage limits aren't specified |
| Anthropic Integration | Runs the Falcon sensor inside the Claude Cowork virtual machine, built with Anthropic, for visibility inside Cowork linked to enterprise-wide activity | No deployment details |
Read the Kill Switch entry carefully. It's listed under "available today," but the release says termination starts at the Gateway and reaches the endpoint later. If you need to stop an agent process on a specific Windows machine, the release doesn't say that's possible yet.
The MCP server item also stands out. As Model Context Protocol servers become the standard way to give agents tools, a malicious or tampered one is a typosquatted npm package with a lot more access. CrowdStrike is clearly treating AI tools as a software supply chain problem, and that's the right category for them.
Section summary: Most of the list is shipping now. The Kill Switch's endpoint enforcement is still to come, and none of these items come with version or configuration details.
New features, and which ones aren't here yet
CrowdStrike puts three items under "New Innovations." They're at different stages:
- Endpoint Network Inspection. It inspects AI traffic entering and leaving the endpoint and matches what an agent sends with what it does locally. It's generally available for Windows, with Mac in early access. This is the clearest platform availability statement in the release. It doesn't name supported Windows versions or Falcon sensor requirements, and it doesn't explain what "all AI traffic" covers for unusual or hard-to-inspect connections.
- Agentic Identity. It's written in the future tense: identity-aware controls "will" authorize what agents can access. No date is given.
- Cloud Expansion. It extends Guardian to cloud workloads, SaaS, virtualized agents such as Claude Cowork, and cloud agent frameworks including AWS AgentCore. The release doesn't say which parts ship now and which come later.
Section summary: Windows gets endpoint network inspection first. Agentic Identity is a roadmap item, and the cloud expansion has no published rollout dates.
Fiddler and Falcon Observe
Guardian is about stopping bad agent behavior while it happens. Fiddler is about evaluating agents before deployment and explaining their behavior afterward. CrowdStrike says Fiddler will be sold as part of the Falcon platform as Falcon Observe, generally available in Q4 FY27. The company frames the split this way: Guardian secures agents from attack and misuse; Fiddler validates they behaved as intended.
According to CrowdStrike's Fiddler announcement, the planned features include:
- Pre-deployment evaluation: the ability to evaluate agent accuracy, task completion, and policy compliance across prompts, models, and configurations before production
- Traceability: the ability to trace agent decisions, reasoning paths, and tool calls across the full agent hierarchy to pinpoint why agents acted and where failures occurred
- Framework support: agents instrumented through OpenTelemetry, with support for LangGraph, Amazon Bedrock, AWS Strands, and Google ADK
- Cost tracking: token usage and spend across agents, with CrowdStrike claiming it can reduce evaluation costs by up to 98% using purpose-built models without external LLM calls
The deal hasn't closed. Securities.io reports that CrowdStrike expects the acquisition to close during its fourth quarter of fiscal 2027, subject to customary closing conditions, and plans to make Falcon Observe generally available in the same quarter. Investing.com reports that the purchase price will be paid predominantly in cash, with a portion delivered as stock subject to vesting conditions. CrowdStrike didn't disclose the amount. Third-party outlets have published different estimates, so treat any figure you see as unconfirmed.
Current Fiddler customers should take note of BERI's advice to get standalone availability, deployment options and price in writing now, because CrowdStrike's announcement answers none of them. That isn't cynicism. Acquired products often get folded into platform bundles, and the deployment option you bought may not survive the change.
Section summary: Fiddler becomes Falcon Observe, possibly by Q4 FY27, if the deal closes. Everything about it is forward-looking until then.
Why this matters for Windows and Microsoft shops
This is the second CrowdStrike story in recent memory where the details matter for Windows administrators. This time the concern isn't an outage. It's about who owns the controls around AI agents.
The organizations most affected are ones that have:
- Developers running GitHub Copilot, Claude Code, Codex or Cursor in agent mode on Windows workstations, where agents can edit files, run terminals and call MCP tools
- Knowledge workers using Microsoft 365 Copilot to handle sensitive documents
- Shadow AI on unmanaged devices, which is the case the AI Gateway's managed-and-unmanaged coverage is aimed at
There's a fair counterpoint, and it's based on general industry knowledge, not on this announcement. Microsoft is building its own agent controls across Entra, Purview and Defender, and GitHub has its own policy controls for Copilot. Putting a third-party layer on top could give you defense in depth or duplicate policy engines that disagree with each other. Which one depends on your existing setup. Every vendor in this space also claims it alone sees the whole picture. CrowdStrike's "only CrowdStrike" line is marketing, not a measured result.
What to do before you deploy
The release has no setup steps, so this checklist is about what to verify, not how to configure anything:
- Get the Windows requirements. Ask which Windows versions and Falcon sensor builds support endpoint network inspection. The announcement doesn't say.
- Pin down the Kill Switch. Confirm it works only at the Gateway for now, and get a timeline for endpoint enforcement.
- Check hook coverage for each tool. Confirm which versions of GitHub Copilot, Microsoft 365 Copilot and the other listed agents are supported, and whether every capability works in each.
- Test on a pilot group first. Try prompt-injection and PII detection on a small group to see what false-positive rates look like in your environment.
- Ask about licensing. The AI Gateway is included with Guardian, but the release doesn't give SKU or pricing details for anything else.
- Count Falcon Observe as roadmap. Budget for it only after the Fiddler deal closes and pricing is published.
The bottom line
CrowdStrike is betting that agent security needs visibility at every layer: what the agent is told, what it sends over the network and what it runs on the machine. The Windows-first network inspection and the hooks for Microsoft's Copilot products make this directly relevant to Windows shops. The parts to watch are the ones still marked "soon" or "will": endpoint termination for the Kill Switch, Agentic Identity, the cloud rollout and Falcon Observe. If an agent ever goes rogue in your environment, you'll want a working kill switch on that machine, not one that's still on the roadmap.