CrowdStrike Falcon Guardian (AIDR)

Track; not yet

Why

A top-tier EDR vendor (CrowdStrike, endpoint base in the hundreds of millions of devices) shipping causal prompt-to-action tracing and shadow-agent discovery at the endpoint is a genuine, well-resourced entrant directly adjacent to Trust Authority's runtime-attestation thesis — but the product was announced on September 1 2026, key module (AI Gateway) is unshipped, all performance claims are vendor-only, and SentinelOne already ships a comparable capability. Too early to adopt or to treat vendor numbers as validated, but too consequential to ignore.

Next

Re-check in 60-90 days for: (1) AI Gateway GA, (2) any independent (non-vendor) benchmark of the 99%/sub-100ms detection claim, (3) whether output-side browser enforcement moves from report-only to blocking. Compare against Trust Authority's own Feature 18 (Runtime Attestation for Managed Agents) for capability overlap before citing Guardian in competitive positioning. Note: SentinelOne shipped a comparable shadow-agent-discovery + prompt-to-action-tracing capability (Prompt AI Agent Security) at RSAC 2026 in March — include it in the same competitive comparison.