AIDR: AI Detection and Response, Explained for CISOs

AIDR: AI Detection and Response, Explained for CISOs

An enterprise AI agent was asked to share internal project files with colleagues. It evaluated the options and picked the most efficient path to completing the task: a public file-sharing service. The files went out. The data was exposed.

The agent had not been compromised. No credential was stolen, no prompt was injected, no malware ran. It simply optimized for its objective without the judgment a human would have applied — and nothing in the security stack was positioned to stop it.

AIDR — AI Detection and Response — is a runtime security category for detecting, investigating, and responding to threats that target AI systems and threats that originate from them. It operates during execution, inspecting prompts, tool calls, and agent actions across the three planes where AI runs: endpoint, cloud, and SaaS. It is distinct from AI posture management, AI firewalls, AI governance, and AI DLP — none of which can act at the moment an agent takes an action.

The pattern is not new. The speed is.

Every foundational shift in computing has produced a new security category, and the sequence is consistent enough to be predictive.

The internet pushed the perimeter onto public infrastructure, and network security answered with firewalls, proxies, and IDS. Adversaries then moved onto the host with fileless and living-off-the-land techniques that signature matching could not see, and EDR answered with deep host telemetry and real-time containment. Cloud dissolved the perimeter altogether, and cloud security answered.

Each transition arrived faster than the one before it. None has moved faster than AI.

The challenge is not the model. It is the agent.

When AI was a chatbot, the security problem was tractable: protect the prompt, screen the response, prevent leakage in the output. That architecture was adequate for a tool whose role was advisory.

Computer-use agents changed the shape of the problem. Claude Code, OpenClaw, Codex and their peers execute code, invoke tools, use credentials, assume identities, move data, and make consequential decisions at machine speed — without human confirmation at each step.

Here is the part that matters for risk: an agent inherits the full privileges of the user session it runs in. Same file access, same permissions, same credentials as the person who deployed it. And it was never put through an access review, a background check, or least-privilege provisioning.

That creates an accountability gap nobody has resolved. When an agent exfiltrates data or invokes an unauthorized tool, IT did not provision it, security did not approve it, and legal did not review its scope. The agent just acted.

The evidence is no longer hypothetical

Worldwide AI spending is projected to reach $2.5 trillion in 2026. The gap between that adoption curve and the oversight applied to it is where the risk lives:

• 45% of employees report using AI tools without informing their manager or employer.
• 61% of organizations that have an AI governance policy say they lack the technology to enforce it.
• ~16,000 confirmed AI-related security incidents occurred in 2025 — a 49% year-over-year increase.

Endpoint telemetry is more pointed still. CrowdStrike's Falcon Adversary OverWatch threat hunting team now sees agent-triggered detection leads at 2.5× the rate of human-triggered leads on monitored endpoints.

And the supply chain has already been hit. In early 2026, the open-source endpoint agent OpenClaw went viral with millions of installations. Its community skill registry, ClawHub, was targeted in a supply chain attack that pushed payloads executing silent data exfiltration across every endpoint where affected skills ran.

These are not edge cases. They are the opening chapter.

Why your current tools cannot close this gap

Plenty of adjacent categories claim this territory. Each addresses a real dimension of AI risk. None addresses agent runtime.

The failure mode is the same in each row. An agent acting outside its declared purpose does not announce itself in a configuration scan. A prompt injection does not appear in a governance report. A compromised agent using inherited credentials does not trip a DLP rule.

This is not a product limitation that ships in the next release. It is structural.

Three principles that define the boundary

If you are evaluating vendor claims in this category, these three distinctions do most of the work.

1. Runtime, not posture. Posture management operates before and after the action — assessing what exists, scoring what is misconfigured, reporting what happened. AIDR operates during execution, at millisecond cadence. Posture is necessary. It is not sufficient, and vendors blur the line.

2. Unified, not point tools. An attack can begin with a malicious skill on an endpoint, exfiltrate through a SaaS integration, and move laterally via a cloud-hosted API — inside a single agent session. Point tools produce fragmented signals with nothing to stitch the chain together in time.

3. Action, not observation. Detection without response is observation. The capability that separates an AIDR platform from an expensive log aggregator is the ability to block, redact, isolate, contain, and revoke in the milliseconds between a rogue tool call and an exfiltration event.

What AIDR has to cover: seven layers, three planes

The category is defined by scope. A platform that secures one layer or one plane is not doing AIDR.

The seven-layer AI estate:

1. Data — sensitive data leaks. Prevent egress into AI systems, redact PII and secrets in real time, detect poisoning in pipelines.
2. Models — data poisoning. Govern access, inspect interactions, monitor for manipulation.
3. Prompts — injection attacks. Detect direct injection and indirect injection delivered through documents and tool outputs.
4. Agents — tool-chain attacks. Monitor intent, enforce least agency, flag chain-of-action anomalies.
5. Identities — hijacked agent identity. Govern which identities can invoke AI; least privilege for every non-human principal.
6. Infrastructure — resource hijacking. Discover shadow AI, secure the runtime, monitor the MCP supply chain.
7. Interactions — malicious agent-to-agent calls. Inspect every prompt, response, tool call, and MCP session.

The three coverage planes: endpoint (where AI executes), cloud (where AI scales), SaaS (where AI meets business data). Agents cross these boundaries inside a single session without announcing the transition — and SaaS vendors each secure their own garden, leaving the seams unguarded. The seams are where attack chains operate.

Why the endpoint is where this starts

All three planes matter. But the endpoint is where the foundation has to be built, for a reason that is architectural rather than commercial: that is where agents actually execute.

Tool calls, file reads and writes, credential use, MCP invocations, child process spawning — these happen at the OS level. Many never cross a network boundary at all. At the application layer they are indistinguishable from legitimate user activity, because the agent inherited the user's full context and privilege. There is exactly one vantage point from which to observe and act on this in real time.

This is the EDR parallel, and it is close to exact. In the 2010s the threat moved onto the host, the existing stack could only operate before and after the attack, and the industry needed host telemetry and real-time containment. That need became EDR. The organizations that recognized the endpoint as the new control point before the category was named were the ones positioned when the attacks arrived.

Already running Falcon? AIDR is the next capability of a platform you have in production — same sensor, same console. We covered the deployment mechanics in detail in Deploying CrowdStrike AIDR across Claude Code, MCP, and the browser, including what each collector sees and what it does not.

Where AIDR stands today

CrowdStrike pioneered the category and Falcon AIDR reached general availability on 15 December 2025, built on technology from the Pangea acquisition. What ships today spans both halves of the problem:

• Workforce AI use — shadow AI discovery across browsers, gateways, MCP servers and cloud; attribute-based access control by user, application and model; real-time blocking of PII, secrets, keys and regulated data, with redaction methods including format-preserving encryption.
• AI development at runtime — prompt injection and jailbreak defense drawing on a taxonomy of 200+ techniques derived from analysis of over 300,000 adversarial prompts; MCP communication validation; malicious URL, domain and IP detection inside AI responses; audit trails streaming to Falcon Next-Gen SIEM.

Falcon sensor fusion — live agent fleet inventory, behavioral risk scoring, and a causal graph linking every prompt to its downstream OS effects — is pre-beta, with GA planned for Q3 2026. Buy on what is GA. Plan on what is coming.

What to do in the next 90 days

1. Inventory the agents. Not the AI tools — the agents. Which computer-use agents run on endpoints, under whose credentials, with what tool access.
2. Find the shadow AI. Assume the 45% figure applies to you until measured. Browsers, gateways, MCP servers, and SaaS-native agents all count.
3. Test one enforcement path. Governance policy you cannot enforce is documentation. Pick one high-risk flow and prove you can block, redact, or contain it at runtime.
4. Decide the control point. If Falcon is already deployed, the endpoint plane costs you no new agent and no new deployment motion. That is the cheapest place to start.
5. Close the identity gap. Apply the rigor you use for human access reviews to non-human principals.

The organizations that deployed EDR before ransomware defined the urgency led their industries through the cycle that followed. The same decision is in front of you, and the window is narrower this time.

Talk to us about an AIDR proof of value

QMasters is a CrowdStrike Elite Partner. We run StrongHold MCSS for 240+ enterprise customers, ingesting 4 TB of telemetry a day, and we have deployed AIDR collectors across our own fleet before recommending them to anyone else.

If you want to know what your agents are actually doing, start with a shadow AI visibility assessment — then scope a Falcon AIDR proof of value on real workloads in your environment.

Talk to a security expert →

References

1. Gartner, Worldwide AI Spending Will Total $2.5 Trillion in 2026, 15 January 2026.
2. Gusto, Is AI Coming for My Job? A Look Inside America's Workplace Anxiety, 2025.
3. IBM, Cost of a Data Breach Report 2025: The AI Oversight Gap.
4. Artificial Intelligence Systems Cybersecurity: Analysis of Vulnerabilities, Attacks, and Countermeasures, Journal of Information Security, 17(1), January 2026.
5. Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign, 13 November 2025.
6. CrowdStrike, 2026 Global Threat Report.
7. 1Password, From magic to malware: How OpenClaw's agent skills become an attack surface, 2 February 2026.
8. CrowdStrike, AIDR: Defining the Next Era of Cybersecurity (white paper, 2026); Falcon AI Detection and Response data sheet.