CrowdStrike Highlights Integrated Identity, Runtime, and Exposure Management in Q2 2027

Management’s Comments on Identity, Runtime, and Exposure Management

Management presented identity, runtime security, and exposure management as interconnected controls for securing AI agents and modern workloads, rather than as isolated products.

Identity

• CrowdStrike said customers need an identity control plane, particularly for non-human identities, because AI agents increasingly operate with permissions and access to enterprise data. Management described identity as one of the core guardrails required alongside data protection, execution controls, and network connectivity. ¹

• Management also linked next-generation identity directly to the AI security opportunity, stating that it is “a big piece of the AI story.” Next-generation identity ending ARR was described as up 33% year over year, although the filing excerpt did not provide the standalone dollar amount. ²

• The broader concern is that AI adoption is increasing the number of identities, permissions, and policies, while agents can operate continuously and potentially alter permissions or access data at scale. ³ In management’s framing, identity is therefore not merely an access-management product; it is a control layer for determining what agents are allowed to do in production.

• Management also indicated that customers moving AI agents from isolated sandboxes into production data environments would need identity controls as part of that transition. ⁴

Runtime Security

• Management characterized CrowdStrike as the leader in cloud runtime security and argued that point-in-time posture scans are insufficient for fast-moving AI threats that can proliferate within seconds. ⁵

• The runtime proposition is to observe what AI agents are actually doing while they operate, whether they are running in a sandbox, on an endpoint such as a laptop, or in a cloud environment. Management said CrowdStrike can monitor these different deployment models and track where agents are connecting externally. ¹

• This is strategically important because AI may be created in the cloud but consumed on endpoints, requiring protection across both environments. Management argued that legacy antivirus and legacy security providers generally lack the ability to identify rogue AI agents and shadow AI. ⁶

• Management cited an eight-figure ARR win with a large technology conglomerate that selected Falcon cloud security to protect its AI cloud and labs, with the win attributed to CrowdStrike’s runtime capabilities, build-pipeline integration, and compatibility with the customer’s internal tools. ⁵

• The company’s AI Detection and Response, or AIDR, was described as a separate, incremental module priced separately from the core platform, while using the same underlying Falcon agent. Management emphasized that customers do not need to deploy another agent to obtain the capability. ⁷ This supports a monetization model in which runtime and AI protection can expand platform revenue without requiring a separate endpoint deployment.

Exposure Management

• Management said the speed of AI-enabled attacks is compressing the traditional patch window: the “agentic adversary” can exploit vulnerabilities faster than organizations can patch them. As a result, exposure management accelerated sequentially in the second quarter. ⁵

• CrowdStrike positioned Falcon Exposure Management as a response to this problem, offering real-time detection and continuous prioritization so customers can focus on the vulnerabilities posing the greatest immediate risk rather than relying only on periodic vulnerability scans. ⁵

• Management cited a seven-figure Flex transaction with a global religious organization that replaced a legacy vulnerability-management product during an AI transformation. The customer also immediately deployed AIDR to obtain visibility and control over AI usage, illustrating how exposure management can serve as an entry point for broader platform adoption. ⁵

• Management also described a partner-led motion in which partners use CrowdStrike’s platform to identify vulnerabilities, understand exposure, and support remediation for large enterprises. The company said this motion is producing platform pull-through and that its Quiltworks ecosystem had more than 25 partners collaborating on nearly $400 million of total contract-value pipeline. ⁸⁵

Financial and Strategic Implication

• Management’s message was that these products are benefiting from a common AI-driven demand cycle: more agents create more identities and permissions, runtime activity becomes harder to monitor, and vulnerability exposure becomes more urgent because attack speed exceeds patching speed. ³⁵

• The products are also being sold through CrowdStrike’s platform and Flex model. Management reported that ending ARR for the combined cloud, identity, and next-generation SIEM businesses reached $2.1 billion, up 39% year over year, while cloud ARR exceeded $905 million, up 29%, and next-generation SIEM ARR approached $700 million, up 60%. ² These figures do not isolate runtime or exposure-management revenue, but management said exposure management and AIDR both had strong quarters and that Flex was encouraging customers to purchase multiple products in larger, longer-term contracts. ²

Bottom line: Management described identity as the permissions and control layer for human and non-human agents, runtime security as continuous protection of agents and AI workloads while they operate, and exposure management as the real-time prioritization and remediation layer for vulnerabilities that organizations can no longer patch quickly enough. The strategic pitch is an integrated platform that governs AI adoption, monitors agent behavior, and reduces exploitable exposure across endpoints, clouds, and enterprise environments. ¹⁵⁸