There’s a new acronym in enterprise security, and it’s going to matter. CrowdStrike is calling it AIDR: AI Detection and Response. It’s their answer to what happens when you put thousands of autonomous agents inside a company’s infrastructure and realize nobody built a system to watch them.
The setup is straightforward. In September 2025, CrowdStrike acquired Pangea, one of the earliest companies focused specifically on generative AI security, for roughly $260 million. Pangea’s core capability was securing the prompt layer: blocking prompt injection attacks, stopping model jailbreaks, and controlling how chatbots and agents interact with sensitive systems. CrowdStrike combined that with its existing endpoint monitoring and threat intelligence to launch what it’s calling the industry’s first complete AI Detection and Response platform.
AJ Shipley, CrowdStrike’s chief product officer, put the stakes plainly: “The industry has seen what happens when agentic autonomy outpaces the authority that those agents should have.”
That’s not a hypothetical. It’s a pattern we’ve already seen play out, and it’s going to get worse before it gets better.
What AIDR Actually Covers
Traditional endpoint security is about protecting computers, servers, and devices from external threats. Endpoint Detection and Response, or EDR, was the category CrowdStrike helped define a decade ago: continuous monitoring of endpoints, behavioral analysis, real-time response when something looks wrong.
AIDR is the same playbook applied to a different layer. Instead of watching what happens on devices, it’s watching what happens inside AI systems: how models are prompted, what agents are doing, what data they’re accessing, and whether any of that behavior falls outside the bounds of what was intended.
The AIDR platform covers data, models, agents, identities, infrastructure, and interactions from AI development all the way through workforce usage. That’s a wide scope. The Pangea piece handles the prompt layer specifically: the interface where humans and machines talk to AI, and where a surprising amount of the actual attack surface lives.
Prompt injection is a real category of vulnerability. An attacker who can manipulate what an AI agent “reads” as instructions can redirect that agent’s behavior, exfiltrate data, or use the agent as a stepping stone into systems it has legitimate access to. Traditional security tools weren’t built to detect this because they weren’t built to understand what an AI agent is doing or why.
The Insider Threat Problem Nobody’s Talking About
The external threat angle is obvious and already getting coverage. Attackers are going to probe AI systems the same way they probe everything else, and agentic AI with broad system access is a juicy target.
The less-discussed angle is the insider threat problem, and it’s potentially more significant.
When you give an AI agent access to your CRM, your email systems, your internal databases, and your customer records, you’ve created a new kind of principal in your security model. It’s not a person. It’s not a traditional service account with fixed, audited permissions. It’s an autonomous system making decisions in real time, and depending on how it’s configured, it can do a lot of damage without any external attacker being involved.
Employees misusing AI agents to access data they shouldn’t see. Models that gradually expand their own scope as they encounter edge cases. Agents that accumulate permissions through legitimate-looking requests over time. These aren’t exotic threat scenarios. They’re predictable failure modes for any system that combines broad access with autonomous decision-making.
Chris said it directly in briefing this piece: it’s not just malicious external threats. Insider threats are a core part of why AIDR matters. A monitoring layer that only watches the perimeter doesn’t catch the agent that’s quietly building a picture of every customer’s data because nobody defined what “too much” looks like.
Why This Category Is Inevitable
CrowdStrike isn’t building AIDR because they want to. They’re building it because enterprise AI adoption has already outpaced the security infrastructure designed to contain it.
Think about how the cloud era went. When companies started moving workloads to AWS and Azure, they quickly discovered that their on-premises security tools didn’t translate. New categories emerged: Cloud Security Posture Management, Cloud Workload Protection, Cloud Detection and Response. Each one addressed a specific gap between what traditional security assumed about infrastructure and what cloud actually looked like in practice.
Agentic AI is the same forcing function. The assumption embedded in most enterprise security tools is that the things with system access are people or well-defined software. Agentic AI breaks both halves of that assumption. These systems make decisions that weren’t explicitly programmed. They use access in ways that are hard to predict in advance. And they operate at a speed and scale that makes manual oversight impractical.
AIDR is the category that fills that gap. CrowdStrike is betting they get to define it the same way they defined EDR: early enough to shape what “good” looks like, before the threat becomes so mainstream that everyone is scrambling to catch up.
The Real Question
The category is real. The threat is real. What’s worth watching is whether AIDR becomes a genuine platform or a marketing wrapper around existing Falcon capabilities with a Pangea integration stapled on.
CrowdStrike has the distribution to make this matter at scale. Pangea’s technology is genuinely specialized. The combination is credible. But “AI security” is going to attract a lot of vendors over the next two years who are applying existing tools to AI-shaped problems without actually solving them.
What makes AIDR different, if it works, is that it’s watching the right layer. Endpoint security watches the device. Network security watches the connection. AIDR watches the model’s behavior, the prompt interactions, and the downstream actions of autonomous agents. That’s a new thing. It might also be the most important security layer anyone builds in this decade.
The agentic AI wave isn’t waiting for security infrastructure to catch up. It’s already here, already inside enterprise systems, and already running with levels of access that would make any security engineer uncomfortable if they thought too carefully about it.
CrowdStrike is counting on enterprises thinking carefully about it. They’re probably right.
Chris Meredith writes about AI, technology, and futures most people aren’t watching yet. He’s based in the US.
Chris Meredith writes about AI, technology, and what it actually means for real people. Follow along on Substack: monkeyattack.substack.com
