# News from Fal.Con Las Vegas: Guardian, SafeMind and Agentic IdP > CrowdStrike's Fal.Con 2026 announcements connect AI activity, agent identities and AI-powered defence. Here is what Guardian, SafeMind and Agentic IdP each add. Source: https://fmcybersecurity.com/en/insights/ai-security/crowdstrike-september-2026-falcon-ai-security-news/ Locale: English Other locale: https://fmcybersecurity.com/insights/ai-security/nytt-fra-falcon-crowdstrike-ai-sikkerhet-september-2026/ ## Metadata - Date: 2026-09-14 - Author: fredrik-standahl - Topic: ai-security - Format: news - Partner: crowdstrike - Scope: international CrowdStrike logo **In brief:** At Fal.Con 2026 in Las Vegas, CrowdStrike introduced Falcon Guardian, SafeMind and Agentic Identity Provider. The announcements address three connected subjects: securing AI activity, using AI for defensive work, and establishing the identities behind agent actions. The conference took place at Mandalay Bay from 31 August to 3 September. This article covers the announcements made on 1 to 2 September. It is a roundup of published material. [The official Fal.Con event page](https://www.crowdstrike.com/en-us/events/fal-con/las-vegas/) ## Guardian extends AIDR into agent activity On 1 September, CrowdStrike introduced Guardian as the evolution of Falcon AIDR. The change adds more context about agents running on computers: what is operating, which actions follow a prompt, and where security controls can intervene. [Guardian's launch explanation](https://www.crowdstrike.com/en-us/blog/falcon-guardian-defines-next-generation-of-ai-security/) CrowdStrike's comparison slide retains AIDR's four listed capabilities and adds ten Guardian rows. Those additions include agent discovery, inventories and risk scores, runtime controls, attack indicators, malicious skill detection, investigations, and token and cost analytics. Our [complete Guardian explanation](/en/insights/ai-security/what-is-falcon-guardian/) covers all 14 rows and includes the agent map and threat-score screenshots. ## SafeMind connects offensive and defensive AI SafeMind, also introduced on 1 September, is a system of specialised models and agent harnesses. NVIDIA describes defensive models based on Nemotron, paired with CrowdStrike's security software and context. [NVIDIA's announcement](https://blogs.nvidia.com/blog/nvidia-crowdstrike-fal-con-2026/) Red Tempest supplies offensive capabilities; Blue Solano supplies defensive capabilities. They are designed to work in a repeated attack-and-defence loop. CrowdStrike's [official demonstration](https://www.youtube.com/watch?v=mvOiYozVwO0) illustrates the system. Our [SafeMind article](/en/insights/ai-security/what-is-crowdstrike-safemind/) includes that video and explains the models, harnesses and controlled evaluation. ## Agentic IdP gives agents an identity for access decisions On 2 September, CrowdStrike announced Agentic Identity Provider within Falcon Next-Gen Identity Security. It describes registering discovered agents, establishing verifiable identities, brokering short-lived access and attributing actions to the human or workload behind them. [The Agentic IdP announcement](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-agentic-identity-provider-foundation-for-ai-agent-identity-security/) The distinction is between knowing which agent is acting and deciding what it is allowed to do. Agentic IdP establishes identity; Continuous Identity evaluates authorisation. Our [Agentic Identity Provider explanation](/en/insights/ai-security/what-is-crowdstrike-agentic-identity-provider/) follows that relationship from discovery to access. ## How the three announcements fit together | Product | Main subject | | --- | --- | | [Falcon Guardian](/en/insights/ai-security/what-is-falcon-guardian/) | The AI tools and agents in use, their activity and security controls. | | [SafeMind](/en/insights/ai-security/what-is-crowdstrike-safemind/) | AI models and harnesses performing offensive and defensive security work. | | [Agentic Identity Provider](/en/insights/ai-security/what-is-crowdstrike-agentic-identity-provider/) | Agent identities, scoped access and attribution to the person or system behind an action. | --- For the full documentation index, see https://fmcybersecurity.com/llms.txt For the complete corpus as a single document, see https://fmcybersecurity.com/llms-full.txt