CrowdStrike Emphasizes Identity, Runtime Security, and Exposure Management Driving AI Security in Q2 2027

Management’s Comments on Identity and Runtime Exposure Management

Identity

Management framed identity as a foundational control layer for AI and agent security, particularly because agents require access to enterprise data, applications, and systems. CrowdStrike said it already provides an “identity control plane” for non-human identities, alongside data protection and runtime monitoring. ¹

The identity function is intended to govern the transition from isolated or sandboxed agents into production environments using real enterprise data. In management’s description, customers need guardrails around identity, data, execution, and network connectivity as they create and consume AI agents across desktops, cloud environments, and sandboxes. ¹²

Management also characterized next-generation identity as an important part of the AI opportunity. Next-gen identity ending ARR was reported at $2.1 billion across the relevant product grouping, up 39% year over year, while the identity component itself was described as growing 33% year over year. ³ Management specifically called next-gen identity “a big piece of the AI story.” ³

The broader commercial message is that identity is being sold as part of a larger platform rather than as an isolated point product. Management said customers are using FalconFlex to adopt multiple products simultaneously, including cloud, next-gen identity, next-gen SIEM, exposure management, and AIDR, which is contributing to larger and longer-duration platform deals. ³

Runtime security

Management positioned CrowdStrike as a leader in cloud runtime security, arguing that conventional point-in-time posture scans are inadequate for AI workloads because threats can develop and spread within seconds. ⁴

The runtime proposition is to observe and control what AI agents actually do after deployment, whether they operate in a sandbox, on an employee’s computer or laptop, or in a cloud environment. Management specifically cited the ability to understand agent behavior, track where agents are calling out, and apply controls across both sandboxed and unsandboxed deployments. ¹

The commercial evidence cited by management included an eight-figure ARR win with a major technology conglomerate that selected Falcon Cloud Security for its runtime capabilities, build-pipeline integration, and compatibility with internal DevOps tools. ⁴ Management said the platform now secures that customer’s AI cloud and laboratories. ⁴

This implies that CrowdStrike views runtime security as a differentiated component of AI workload protection: identity determines what an agent is allowed to access, while runtime security monitors whether the agent behaves appropriately once it is executing. Management also said the product can enforce policies and guardrails while minimizing false positives, which it considers important for low-friction deployment. ⁵

Exposure management

Management described exposure management as increasingly important because the speed of modern and agentic attacks is exceeding the speed at which organizations can patch vulnerabilities. The company said the “patch window” has collapsed and that customers cannot keep up with traditional remediation timelines. ⁴⁶

CrowdStrike’s response is Falcon Exposure Management, which management described as providing real-time detection and continuous prioritization of vulnerability risk rather than relying on periodic assessments. ⁴ Management said exposure management accelerated sequentially in the second quarter as customers responded to the faster pace and scale of vulnerability risk. ⁴

Management also cited a representative seven-figure exposure-management win with a global religious organization that replaced a legacy vulnerability-management product during an AI transformation. That customer also deployed AIDR to gain visibility and control over its AI usage, illustrating how exposure management can serve as an entry point into broader AI-security platform adoption. ⁴

The partner channel is another part of the exposure-management strategy. Management said partners use CrowdStrike’s platform to identify vulnerabilities, understand exposure, and support remediation for large enterprises, with the resulting activity contributing to platform pull-through. ⁷

Overall interpretation

Management’s core message was that identity, runtime security, and exposure management address different but connected stages of AI risk:

• Identity: controls which human and non-human agents can access data and systems. ¹
• Runtime security: monitors and governs what agents do while executing across endpoints, sandboxes, and cloud environments. ¹
• Exposure management: identifies and continuously prioritizes vulnerabilities and other risks before attackers exploit them, particularly when traditional patching is too slow. ⁴

The strategic significance is that CrowdStrike is presenting these capabilities as incremental modules on a common platform. AIDR, for example, is priced and licensed separately but uses the existing CrowdStrike agent, allowing customers to deploy it without installing another agent. ⁸ Management said this architecture supports separate monetization while preserving friction-free deployment and cross-selling across the installed base. ⁸

Overall, management portrayed identity and runtime exposure management as durable AI-driven growth areas: identity provides the access-control foundation, runtime security protects active AI workloads, and exposure management addresses the rapidly changing vulnerabilities and attack paths surrounding those workloads. The cited customer wins and sequential exposure-management acceleration provide evidence of current commercial traction, although management did not disclose standalone revenue or profitability for each of these areas. ⁴⁶³