Smartflow vs. CrowdStrike Falcon Guardian: Agent Runtime vs. Request Path

CrowdStrike secures AI agents from the Falcon platform. Falcon Guardian, which it calls its flagship AI Detection and Response (AIDR) solution, discovers agents on the endpoint, enforces policy through agent-level hooks and an AI gateway, and since November 3, 2026 can stop a rogue agent with an AI Kill Switch. Smartflow enforces policy inline on every model call and MCP tool call routed through it, on the customer's own infrastructure, and records each decision. They do different jobs, and an enterprise can run both.

The short version

Falcon Guardian starts from the host. The Falcon sensor sees the agent on the machine where it runs, and CrowdStrike has added hooks inside widely used agents, an AI gateway and a kill switch. For an enterprise that already runs Falcon, Guardian extends a sensor it has already deployed.

Smartflow starts from the call. Applications and agents send their model calls and MCP tool calls through it, on the customer's own infrastructure, including air-gapped, and policy is applied before the call executes. When policy requires a person, the action pauses until someone with approval rights decides.

The question for a buyer is which agents and which calls each product can see and stop, where the control runs, and who decides.

What CrowdStrike ships for AI agents

This page covers CrowdStrike's AI agent products, not its wider endpoint, cloud and identity portfolio. The names have moved in the past year, so here is where they stand.

Falcon AIDR reached general availability in December 2025 with browser extensions, application SDKs, AI and API gateway integrations, an MCP proxy and cloud log analysis. On September 1, 2026, CrowdStrike announced Falcon Guardian to "Secure AI Agents Where They Execute," and Guardian has been generally available since that month. CrowdStrike describes Guardian as "the evolution of Falcon AI Detection and Response (AIDR)," and its product page calls Guardian its "flagship AI detection and response (AIDR) solution."

At Fal.Con Europe on November 3, 2026, CrowdStrike announced the AI Kill Switch, available that day, and the general availability of the AI Gateway, included with Guardian. The same announcement covers agent-level hooks, SafeMind-powered detection, AI supply chain protection and a Falcon sensor inside Anthropic's Claude Cowork virtual machine, delivered in partnership with Anthropic. Endpoint network inspection is generally available for Windows, with Mac in early access. Two more items are listed as new innovations: cloud expansion, and Agentic Identity, identity-aware controls that "will authorize what agents can access." The same day, CrowdStrike announced an agreement to acquire Fiddler, which it plans to sell as Falcon Observe for agent evaluation and observability. That acquisition has not closed; CrowdStrike expects it to close in its fourth quarter of fiscal 2027.

Agent authorization was announced earlier. In June 2026, CrowdStrike introduced Continuous Identity for AI Agents, which gives each agent a SPIFFE-based identity and authorizes its actions continuously by owner, caller and device risk. That announcement gives no availability date.

Feature Comparison

Where each control sits

Falcon Guardian's advantage is the host. The Falcon sensor sees what an agent does on the machine where it runs, and CrowdStrike's Agent Graph connects what the agent was asked to do with what followed. CrowdStrike makes the argument directly: hooks see the prompt but miss the model's response, and network-only approaches "can't stop the action, because the agent executes on the endpoint." When an agent runs a local or open-weight model that never touches the network, in CrowdStrike's words, "network-only tools go blind."

On the endpoint, that argument is correct. A command an agent runs in a local terminal is a host event, and a sensor on that host sees it where a gateway does not. Smartflow's own guide for Claude Code says terminal commands do not pass through MCP and are governed with Claude Code's managed controls.

Smartflow covers the calls routed to it, from any origin: an agent on a self-hosted model, an inference server on-premises, a tool call into an internal system, and any OpenAI-compatible cloud or local endpoint. Policy is evaluated before the prompt reaches the model and before a tool call executes. Guardian's agent discovery starts on the endpoint, and Falcon AIDR's SDKs, gateway integrations and MCP proxy reach the applications instrumented for them. Coverage of agents on cloud workloads and in cloud agent frameworks was announced on November 3 as a new innovation. The trade on the Smartflow side is that a call has to be pointed at the gateway.

Stopping an agent, and deciding an action

Both products put a person in control, at different moments. The AI Kill Switch is a response control. An authorized administrator triggers it, the agent is stopped, Falcon Guardian policy keeps it from relaunching on the targeted host or host group, it loses enterprise network access, and every action is recorded in the audit trail. For an agent that has gone wrong, that is the right tool.

Smartflow's control acts on one action, before it runs. When policy requires a person, the action pauses as an approval ticket: pending until someone with approval rights approves or denies it, redeemed once when the action runs, and expired after 24 hours. With step-up, set per action, the approver re-verifies their identity before the approval counts, and the record shows who decided. CrowdStrike's published material describes automated authorization through Continuous Identity and the kill switch for containment. A person approving an individual agent action before it runs is not documented.

For an examiner, the record matters as much as the stop. Guardian sends AI agent data to Falcon Next-Gen SIEM as first-party data. Smartflow's records are hash-chained, carry RFC 3161 timestamps and are written to the customer's own SIEM, with an optional write-once archive in Azure immutable blob storage in the customer's account. Smartflow generates examination packages and model inventory for FINRA 3110, HIPAA, SOX and the EU AI Act from those records. Guardian's product page and its September and November announcements name no regulation. Falcon Observe, planned from the pending Fiddler acquisition, is described as providing "evidence for compliance and audits."

Where the control plane runs

CrowdStrike describes the Falcon platform as built in the cloud on a single lightweight-agent architecture. The Guardian product page and announcements do not document a self-hosted or air-gapped deployment, and they do not say where the AI Gateway is hosted.

Smartflow runs on the customer's infrastructure: on-premises, air-gapped, Kubernetes-native. Configured with local embeddings and a local model, policy, cache and audit make no call to us or anyone else. For a firm whose model-risk perimeter has no egress at request time, that settles the deployment question before the feature table does.

Where CrowdStrike is strong

CrowdStrike sees the host. For an enterprise already running the Falcon sensor, Guardian adds agent discovery, runtime visibility and response on that same sensor, and ties an agent's prompt, identity and tool calls to the system actions that followed. Guardian sends that context to Falcon Next-Gen SIEM as first-party data.

The coverage is broad and moving quickly: discovery of known and shadow AI agents, with a live inventory of every running and dormant agent; hooks inside six named agents, from Claude Code to Microsoft 365 Copilot; protection against malicious AI skills and MCP servers before they enter the environment; a sensor inside Claude Cowork, delivered in partnership with Anthropic; and a kill switch that stops a rogue agent and keeps it from relaunching. CrowdStrike has also introduced managed threat hunting and detection and response for Guardian, so a team without AI security staff can hand the watch to analysts.

Its endpoint argument is the strongest case against any control that sits only on the network: an agent running a local model on a laptop never crosses a gateway. For the question "what are the agents on our machines doing, and how do we stop one," Falcon Guardian answers directly, and Smartflow does not compete on that axis.

When to choose Smartflow

• Enforcement inside the perimeter: the control plane runs on your infrastructure, including air-gapped, so policy decisions and records stay inside your boundary
• A person decides the high-risk action: the action pauses before it runs, the approver re-verifies identity with step-up where policy requires it, and the record shows who decided
• Agents beyond the endpoint: self-hosted models, on-premises inference and tool calls into internal systems, governed on the path the call takes
• Examination evidence and the model path: packages and model inventory for FINRA 3110, HIPAA, SOX and the EU AI Act, with routing, failover and caching on the same gateway

Running both

The two sit at different points, so they can run side by side. Falcon Guardian watches the host: which agents run, what they do on the machine, and how to stop one that goes wrong. Smartflow sits on the path the model call and the tool call take, applies policy before each call executes, pauses the actions that need a person, and writes the record to the customer's SIEM. The cost is two policy surfaces to keep aligned. The benefit is that the host and the call path each get a control built for them.

Common questions

What is Falcon AIDR, and how does it relate to Falcon Guardian? CrowdStrike describes AI Detection and Response (AIDR) as a solution category, and Falcon AIDR is the product it made generally available in December 2025. Falcon Guardian, announced September 1, 2026, is what CrowdStrike calls the evolution of Falcon AIDR and its flagship AIDR solution. Guardian includes Falcon AIDR's AI visibility, governance, data protection and threat detection, and CrowdStrike's November 2026 announcements use the Guardian name.

What does the CrowdStrike AI Kill Switch do? An authorized administrator triggers it to stop an agent, first at the gateway and soon on the endpoint. Falcon Guardian policy then keeps the agent from relaunching on the targeted host or host group, the agent loses enterprise network access, and each action is recorded in the audit trail. CrowdStrike announced it as available on November 3, 2026.

Does Falcon Guardian include an AI gateway? Yes. CrowdStrike announced on November 3, 2026 that the AI Gateway is generally available and included with Guardian. It routes AI traffic through a central point to inspect prompts and responses, monitor usage and enforce policy. Its hosting model, provider failover and response caching are not documented.

Can Falcon Guardian run on-premises or air-gapped? A self-hosted or air-gapped deployment is not documented. CrowdStrike describes the Falcon platform as built in the cloud.

Does Smartflow replace Falcon Guardian? No. Smartflow does not detect or contain threats on a host. It enforces policy on each call routed through it and records the decision.

Related reading

The AI control plane · AI agent governance guide · Smartflow for Claude Code · Smartflow vs. OneTrust · Smartflow vs. WitnessAI · Human-in-the-loop · Tamper-evident audit log · Air-gapped AI deployment · Examination readiness · All comparisons

Verified against each vendor's published documentation in November 2026. Vendor capabilities change. If something here is out of date, tell us and we will correct it.

CrowdStrike sources: crowdstrike.com/en-us/platform/falcon-guardian-aidr, crowdstrike.com/en-us/blog/crowdstrike-secures-growing-ai-attack-surface-with-falcon-aidr (December 15, 2025), crowdstrike.com/en-us/press-releases/crowdstrike-unveils-continuous-identity-for-ai-agents (June 15, 2026), crowdstrike.com/en-us/blog/falcon-guardian-defines-next-generation-of-ai-security (September 1, 2026), crowdstrike.com/en-us/blog/crowdstrike-advances-ai-security-and-safety-falcon-guardian (November 3, 2026), and CrowdStrike's releases at ir.crowdstrike.com of September 1, 2026 (Falcon Guardian) and November 3, 2026 (the AI Kill Switch, AI security and safety for the enterprise, and the pending Fiddler acquisition).