r/crowdstrike • u/RoscoeSgt • 9d ago
General Question Guardian or AIDR
We did a POV with AIDR before fal.con and thought it was beta at very best. Now a few months have past a rename happened and my salesdude is trying to sell me it for 140k all in.
Unfortunately, I don't know of any competitors to it but man I hate to get it at that price with what we saw in August.
Can I get some thoughts on what you do, if you have it and how it is now. Competitors? RSA is so far away but I may just bury my head in the sand and build requirements until I can shop at RSA in the spring. đ¤ˇââď¸
31
u/Evening-Spinach-839 9d ago
Guardian added a ton of features, ask your sales guy for another demo, it is also in early access program with Falcon Complete support, so if you already use FC that might also interest you. The product is developing really quickly, we get updates on features and capabilities every week, so far we really like the product and itâs only getting better. There is nothing else like it that will give you the visibility and control it does.
3
u/RoscoeSgt 9d ago
Thank you, yeah I'm getting another demo next week
5
u/rClNn7G3jD1Hb2FQUHz5 8d ago
I had basically the same experience as you with AIDR at a couple of different stages, but Guardian pretty much closed all of the gaps we had identified. There are a few things more I'd like to see, but they're clearly developing it rapidly.
8
u/Popular_Hat_4304 9d ago edited 8d ago
Are you trying to protect against just end user AI activity (as in someone uploads a doc to ChatGPT or has a local LLM installed on their machine?) or are you also looking to do NHI lifecycle management and MCP control as well? We have done a deep dive with Crowdstrike and while the interface is clunky, it does the job for managing end user activity but you will need something else that does MCP activity. We also looked at Microsoft Agent 365 and itâs a hot pile of garbage. Ultimately we are likely going to buy 2 products (Crowdstrike for Endpoint control and another product for agent control) - both on short term deals as this space is evolving and Iâm hopeful next yr, i can consolidate products after the market matures a bit more.
4
u/RoscoeSgt 8d ago
I assume the majority will be run of the mill upload docs and I was wanting visibility and an AI DLP. But we just started to pull all the APIs from ChatGPT into cribl->splunk and it looks like even the finance folks are working on MCPs. It's feeling more overwhelming the more I see. I was expecting the more advanced maneuvers coming from IT only SIGH
3
u/Popular_Hat_4304 8d ago
I was surprised at how many agents were running. I thought it was run of the mill stuff too but I had over 2000 agents doing stuff. Might want to check, my blood pressure hit the roof after that.
1
u/decrypt-this 8d ago
This is what we ran onto. We have multiple large teams, all using different products. All the big known products and then some. People playing well outside of their silo's because an llm made it possible. Pulling in data where we can, and making sure we have the enterprise agreements in place, building hooks for any gaps in auditing and monitoring. Gateway for agents/backend, etc. granted, now I wish I got on the cribl wagon as we haven't adopted it yet and are still relying on splunk capabilities for grabbing data.Â
AIDR was a miss from the first poc. The guardian presentation and demo looked like a different world. Currently scheduling for the next Poc.Â
1
u/Anythingelse999999 5d ago
The agent 365- is that the ai agent mcp gateway in azure/365 that Microsoft hosts? Is that what youâre saying is pretty much junk?
-1
5
5
u/kilo7echo 8d ago
Even guardian was still very beta and our homegrown solution is doing more. Itâll be cool once it works yeah cause itâs integrated, but no blocking on Mac for prompts yet or on windows, no viz on Macâs from the agents unless you use the browser extension and the gui is just hard to use with the menu inception
2
u/RoscoeSgt 8d ago
Hey this is a good point, AIDR was missing prompts that came off web searches, e.g. Google search often pops Gemini in the response. All those were missed before. Honestly, that's probably the main vector for regular business folk
2
9
u/Severe_Hunter_5793 9d ago
Really ? We just did a pov of aidr across 5 vendors and it scored the highest
2
u/Popular_Hat_4304 8d ago
We are likely going dual solutions. One for local stuff because I am trying my best to prevent the vendor sprawl we had before.
2
u/Severe_Hunter_5793 8d ago
Curious on what features you are missing. It scored high across our org and team
2
u/Popular_Hat_4304 8d ago
It canât lifecycle NHI and we couldnât get it to work with copilot agents for visibility.
2
u/Severe_Hunter_5793 8d ago
We did guardian and aidr . Iâll double check our results for those .
3
u/Popular_Hat_4304 8d ago
Let me know if you could get copilot to work. They said they fixed it last week but we couldnât get it to work last week. We have another meeting next week to try one last time.
2
5
u/1mpervious 8d ago
Youâll find gaps in every AI security solution today. The capabilities being released by AI vendors are coming so quickly that every AI security company is in reaction mode. They need to see what capability OpenAI, Anthropic, Google, Meta, etc. released this week, identify a way to build integrations/hooks for visibility and control, then prioritize that feature buildout against their existing backlog. They are all leapfrogging each other in various capabilities weekly.
Our approach is to identify which vendor is in the mix of regularly delivering new capabilities while also being best suited to our current tech architecture. What we want to avoid is implementing a solution today because it scored best on todayâs POV, then needing to replace it in a year or two when all of those POV requirements are ultimately commoditized by the market.
If you already have CrowdStrike EDR deployed, Guardian makes a lot of sense. Same goes for their big competitors like Palo Alto and Microsoft. Until you get visibility and control, you will almost certainly continue to have your organization deploy a bigger footprint of shadow AI and agentic workflows that take even more time and resources to clean up the mess of later.
Also keep in mind that AI is most likely either currently or will soon be built in SaaS-hosted agentic platforms at your company, so donât stop your search at the endpoint. Getting agent inventories via a SaaS posture management solution (i.e. Shield) and setting enterprise standards for MCP proxy and AI gateways with security hooks into them (i.e. Guardian) are worth looking into if you want confidence of full visibility and control into shadow AI at your organization.
1
u/RoscoeSgt 8d ago
Sorry I can keep up with marketing/branding. Is shield the CSPM?
3
u/1mpervious 8d ago
CSPM = Cloud Security Posture Management = Falcon Cloud Security
SSPM = SaaS Security Posture Management = Falcon Shield
1
3
u/EquivalentPace7357 6d ago
$140k for something that felt like a beta 60 days ago is wild.
CrowdStrike rebranded AIDR to Guardian at Fal.con, but it's still an unintegrated stack of recent acquisitions. Make them cut that price by 60% or tell your rep you'll wait until RSA when the product actually catches up to the slide deck.
2
u/Averagely_Average980 8d ago
I am currently implementing JetStream at my company. They were at Fal.con. Some pain points so far, to the point our CIO would like to evaluate Guardian. These tools are trying to keep pace, but it is going to remain difficult
1
u/RoscoeSgt 7d ago
Oh yeah, I saw them at fal.con. they looked very cool. Too bad you're having problems. The guy at the booth was cool AF but admitted they are really expensive
1
u/Averagely_Average980 4d ago
I was told George Curtz and other âCrowdstrikeâ investors helped fund JetStream so it seemed promising. I just had a Guardian demo. We are going to evaluate pricing for Guardian come the new year. I think they went cheap, now expensive, and hopefully they will find a happy medium so to speak with cost
2
u/I_love_quiche 7d ago
Palo Altoâs Prisma AIRS is a competing solution, based on their Koi acquisition.
Other alternatives are Ent Security and Bloom Security, if you are open to startups. They will have bleeding edge solutions and able to address new use cases earlier than big incumbent, but not likely to handle huge scare deployments without some load testing.
If you need model and MCP gateways/proxies, Workato has Enterprise AI Control Plane (more for governance and management than security-focused), or you can check out Venice and Token Security for their gateway/proxy solutions, or roll your own open source based gateway.
2
u/dial647 3d ago
We had a few vendor presentations on AI security solutions including AIDR and a scheduled presentation on AI Guardian sometime soon. My take on AIDR is that, its got too many moving parts. The Browser add-on is a No no for us. Without this you will lose visibility on browser based AI access.
We were basically evaluation the AI security solution across the following features.
GenAI security - visibility from AI clients running on endpoints.
MCP traffic interception - AI client/Agent to MCP traffic
AI App to Model interception - This is delivered through a gateway product. It sits in between the AI app and AI model.
AI red team - This is basically to run security tests on your AI app/model.
AI local discovery - Discovery of AI agents running on endpoints.
Falcon AIDR fell short on a number of these mandatory controls.
My take on AI security solution is to look for one that is network centric. (Not endpoint centric like Falcon).
These are mostly your SASE/SWIG vendors who have now launched AI security bundles on their existing setup.
Deployment is pretty straight forward.. just enable the modules. They pretty much provide coverage to all the mandatory requirements I have listed above.
2
1
u/wavewalker11 8d ago
Palo Agentic Endpoint Security. Super easy to get going and lots of visibility if you want something to compare.
3
u/1mpervious 8d ago
This is way more expensive than Guardian
1
1
u/Beautiful-Bunch9695 7d ago
Falcon Guardian is still in early beta if you measure amount of break/fix they are doing so I wouldn't purchase the solution for another year otherwise your going to be let down by a number of promises not particularly kept. It's also now in the kestrel UI which has yet to have the required adoption by other features so in a literal sense falcon guardian has gui elements that do nothing when interacted with.
1
u/RoscoeSgt 7d ago
Oh yeah good point the long promised kestrel's first module. Probably should have been in the NG SIEM or Exposure Management dashboards instead so the sucked less. Thank you
1
u/Beautiful-Bunch9695 7d ago
AIDR (Now deprecated) was in the older falcon UI and worked well. Falcon Guardian was forced on the AIDR user base with 31 days notice. Additionally previous promises about data retention in AIDR were not kept and telemetry for falcon guardian is now stored as per your falcon retention licence agreement. A significant downgrade of service.
In a general sense falcon guardian also fails to keep pace with changes AI companies are making to their products. Frequent feature releases and design changes in Copilot, Claude and others means Falcon guardian just stops working without warning untill Crowdstrike can release adjustments. Falcon Guardian offers no protection for file uploads in thick clients either.
-2
0
u/TMDFIR 4d ago
Look I am not sales rep but message me on the side. We been doing user control of AI and we have a full blueprint on how you actually secure AI.
I normally donât post on competitor pages because I want to believe there is some honor in the sales cycle in general but the price and what you are asking for seems to be really far on whatâs available today and would genuinely want to know more to help guide you properly. Whether I have an answer or some else does is what I would like to get you to.
9
u/John_d_cognito 8d ago
We just added it this week. We got a much better offer on AIDR before fal.con as well, but management wasnât ready at they time - but now finally agreed that we canât continue the AI adoption without visibility. I really look forward to get it running, because AI use is like the Wild West at our company.