News from Fal.Con Las Vegas: Guardian, SafeMind and Agentic IdP

In brief: At Fal.Con 2026 in Las Vegas, CrowdStrike introduced Falcon Guardian, SafeMind and Agentic Identity Provider. The announcements address three connected subjects: securing AI activity, using AI for defensive work, and establishing the identities behind agent actions.

The conference took place at Mandalay Bay from 31 August to 3 September. This article covers the announcements made on 1 to 2 September. It is a roundup of published material. The official Fal.Con event page

Guardian extends AIDR into agent activity

On 1 September, CrowdStrike introduced Guardian as the evolution of Falcon AIDR. The change adds more context about agents running on computers: what is operating, which actions follow a prompt, and where security controls can intervene. Guardian’s launch explanation

CrowdStrike’s comparison slide retains AIDR’s four listed capabilities and adds ten Guardian rows. Those additions include agent discovery, inventories and risk scores, runtime controls, attack indicators, malicious skill detection, investigations, and token and cost analytics. Our complete Guardian explanation covers all 14 rows and includes the agent map and threat-score screenshots.

SafeMind connects offensive and defensive AI

SafeMind, also introduced on 1 September, is a system of specialised models and agent harnesses. NVIDIA describes defensive models based on Nemotron, paired with CrowdStrike’s security software and context. NVIDIA’s announcement

Red Tempest supplies offensive capabilities; Blue Solano supplies defensive capabilities. They are designed to work in a repeated attack-and-defence loop. CrowdStrike’s official demonstration illustrates the system. Our SafeMind article includes that video and explains the models, harnesses and controlled evaluation.

Agentic IdP gives agents an identity for access decisions

On 2 September, CrowdStrike announced Agentic Identity Provider within Falcon Next-Gen Identity Security. It describes registering discovered agents, establishing verifiable identities, brokering short-lived access and attributing actions to the human or workload behind them. The Agentic IdP announcement

The distinction is between knowing which agent is acting and deciding what it is allowed to do. Agentic IdP establishes identity; Continuous Identity evaluates authorisation. Our Agentic Identity Provider explanation follows that relationship from discovery to access.

How the three announcements fit together