Salt Security and CrowdStrike give joint customers visibility across the full agentic path, from the model to the system where the action lands
An employee at a bank asks an AI assistant a routine question. How much money is in my savings account? The assistant answers correctly. The prompt was legitimate. The response was accurate. A model-layer security control inspects both and finds nothing wrong, because nothing is wrong with either.
Now look at what happened in between.
To answer that question, the agent called an internal MCP server. That server connected to a user profile service and an accounts service. Those services called APIs that returned social security numbers and were not authenticated. The API gateway in the path had no rate limiting enabled. The MCP server's source code contained hard-coded API keys. Internal-only services in the chain were reachable from the internet. And the agent itself had been granted far more tool access than a bank teller function requires.
Every one of those findings is a serious security problem. None of them is visible from the prompt or the response. This is the gap that agentic security exists to close, and it is why Salt Security has expanded its integration with the CrowdStrike Falcon platform across the full agentic path.
What is the agentic path?
The agentic path is the full sequence an AI agent follows from decision to consequence. It begins with the model reasoning about a request. It continues through the tools and MCP servers the agent connects to, the APIs those connections invoke, and the data those APIs return. It ends at the system where the action actually takes effect: a record updated, a payment issued, a file retrieved, a ticket closed.
Traditional application security was built for software that does what it is told. The path from input to outcome was written by a developer and could be reviewed before it shipped. Agents are different. They decide which tools to use and in what order, and they improvise sequences that no one designed in advance. The path is assembled at runtime, so it cannot be fully reviewed in advance, and it changes from one request to the next.
That has a direct security consequence. Authorization is no longer a static property of an application. It is a live question about what an agent is doing right now, what it is connected to, and whether that still matches what it was permitted to do.
Two questions, not two layers
Securing AI agents means answering two different questions, and an enterprise needs both answered.
The first is whether the agent was manipulated. Prompt injection and jailbreaking are real techniques, and model-layer protection is where they get caught. An organization running agents without it has left an obvious door open.
The second is what the agent can actually do, and whether what it is doing right now is still within scope. The bank example is entirely made up of that second kind of problem. Not one of those findings involved a manipulated prompt. The agent was not tricked. It behaved exactly as instructed, and the risk came from what it was connected to and what it was permitted to reach. An agent that has never been attacked at all can still cause serious harm if its permissions were too broad on the day it was deployed.
Neither question is a subset of the other, and neither answers on its own. That is the case for bringing the two together in one place rather than running them as separate programs.
What the integration gives joint customers
Through the certified Salt application on CrowdStrike Falcon Foundry, customers deploy Salt using their existing Falcon agents, with no additional gateways, proxies, or configuration.
Salt Agentic Security Posture Management (AG-SPM) then provides continuous discovery of the agents in the environment, the MCP servers and tools they connect through, the APIs they can invoke, and the permissions attached to each step. It surfaces the things nobody meant to deploy: forgotten MCP servers exposed to the public internet, shadow integrations sitting in private repositories, agent-connected APIs that never went through review.
Salt Agentic Detection and Response (AG-DR) monitors those interactions at runtime. It establishes behavioral baselines for agent-driven activity and detects when an agent exceeds its intended scope, follows an unsafe execution path, pulls data at a volume that does not match its function, or is manipulated into taking an unauthorized action.
Both are unified by the Salt Agentic Security Graph, which maps every discovered relationship between agents, MCP servers, and APIs into a single view of how an agent reasons, connects, and acts.
Those findings flow into CrowdStrike Falcon Next-Gen SIEM, where agent inventory, posture findings, and behavioral detections are correlated with the endpoint, identity, and cloud telemetry teams already collect in Falcon. When Salt detects behavior that departs from an established baseline, customers can trigger automated responses through CrowdStrike Falcon Firewall Management. The practical result is one workflow rather than a separate console for agentic security.
What this looks like in practice
Return to the bank agent. With visibility across the full path, the same request produces a different security picture:
- The MCP servers and tools the agent connected through are inventoried, including any that were never formally deployed.
- The APIs those connections invoked are discovered, along with which return sensitive data and which lack authentication.
- Excessive tool permissions granted to the agent are surfaced as a posture finding rather than discovered after an incident.
- Behavioral detections fire when the agent's activity departs from its established baseline.
- All of it lands in Falcon Next-Gen SIEM alongside the rest of the security telemetry.
The organization moves from validating what the agent said to understanding what the agent did.
Getting started
Salt is available to CrowdStrike customers through a certified Foundry application that leverages existing Falcon agents, with no additional gateways, proxies, or configuration required. Salt is also natively integrated with Falcon Next-Gen SIEM and can trigger automated response through Falcon Firewall Management. For more information on the Crowdstrike integration click here.