CrowdStrike has been named a Leader in The Forrester Wave: Extended Detection and Response Platforms, Q2 2026 report. The company ranked highest of any vendor evaluated in the Current Offering category and received the highest possible scores across the Strategy criteria of Innovation and Community. This recognition underscores CrowdStrike's position in the cybersecurity market, particularly as enterprises face AI-accelerated adversaries.

Forrester highlighted that CrowdStrike's AI agents are a clear differentiator, enhancing the analyst experience through a strong approach to testing and validation. The report also noted that customers speak highly of CrowdStrike's acquisition strategy and its ability to integrate acquisitions into a true platform. Recent acquisitions include SGNL for risk-aware, continuous identity security and Seraphic for browser runtime security.

The company's single-sensor, unified platform architecture is designed to support the agentic Security Operations Center (SOC), elevating analysts from alert chasers to orchestrators of intelligent agents. Forrester recognized that CrowdStrike's strongest features come from its native detection surface coverage, especially on the endpoint. As the pioneer of Endpoint Detection and Response (EDR), CrowdStrike is establishing AI Detection and Response (AIDR) as a defining security category of the AI era.

CrowdStrike's AIDR business has achieved 250 percent sequential Annual Recurring Revenue (ARR) growth in under two quarters. The company focuses on securing AI across every surface it operates: data, models, prompts, agents, identities, infrastructure, and the interaction layer.

"AI has changed how adversaries operate. CrowdStrike has changed how defenders respond," said Elia Zaitsev, chief technology officer, CrowdStrike. "CrowdStrike committed to one sensor, one console, one platform from day one, and that architectural advantage is why we can deliver the agentic SOC today and own AIDR, the defining security category of tomorrow. For us, Forrester's recognition reflects what that foundation makes possible."

Key Recognition Highlights

CrowdStrike (NASDAQ: CRWD) is a global cybersecurity leader that has redefined modern security with the world's most advanced cloud-native platform. The CrowdStrike Falcon platform leverages real-time indicators of attack, threat intelligence, and enriched telemetry to deliver automated protection and remediation.

CrowdStrike has introduced Continuous Identity for AI Agents, a new capability within the CrowdStrike Falcon Next-Gen Identity Security platform designed to secure the agentic enterprise. Announced at Identiverse 2026, the solution addresses the security risks posed by AI agents operating with superhuman speed and system-level access. It replaces legacy static policies and standing privileges with continuous, risk-aware enforcement, authorizing every agent action based on ownership, caller identity, and real-time risk.

The new model dynamically grants, denies, and revokes access based on real-time risk signals, eliminating standing privileges entirely. This capability is powered by technology from CrowdStrike's recent acquisition of SGNL. It extends the company's risk-aware authorization across every identity—human, non-human, and AI agent—spanning on-premises, SaaS, browser, and cloud environments.

Securing AI Agent Identities

Continuous Identity for AI Agents provides several key features to control machine-speed operations:

• Verifiable Agent Identity: Every agent is assigned a cryptographically verifiable identity based on the SPIFFE standard, replacing static credentials like API keys with automated, secure workload identities.
• Context-Aware Authorization: Access is evaluated based on who owns the agent, who is calling it, and the risk posture of their device. Context is preserved when an agent delegates to a sub-agent.
• Zero Standing Privilege: Access is granted the moment it is needed and revoked the moment it is not.
• Defense in Depth: Falcon AI Detection and Response (AIDR) continuously inspects prompts and intent to detect permission misuse or manipulation attempts, triggering Continuous Identity to revoke access before damage occurs.

Technical Capabilities

The platform leverages native and third-party risk signals on the Falcon platform to evaluate authorization. This shift moves security away from point-in-time authorization, which CrowdStrike Chief Technology Officer Elia Zaitsev described as a liability in an autonomous environment. The company stated that "authorize once and trust indefinitely" is not a viable security model for AI agents.

CrowdStrike noted that any unreleased services or features referenced are still in development and subject to change.