Continuous identity becomes the new front line for AI agents: theCUBE’s Fal.Con 2026 day two keynote analysis

Identity security was built for people. You sign in, you’re trusted, and that trust lasts until you leave. AI agents break that bargain. They can hit a stack of tools almost instantly, which makes a one-time login feel quaint in the worst possible way.

CrowdStrike used its Fal.Con 2026 keynote in Las Vegas to lean hard into that reality. President Michael Sentonas laid out how the Falcon platform now handles identity, and theCUBE analyst Krista Case said the shift to continuous AI agent identity was one of the day-two announcements that stood out most to her. The idea is simple enough to say and annoying enough to build: authorize every action in real time, then let that authorization die when the task is done.

CrowdStrike’s version comes out of its SGNL acquisition, a $740 million deal announced in January and turned into a product called Continuous Identity for AI Agents in June. The system checks who owns the agent, who is invoking it and what the device risk looks like before allowing each move. And it applies that same real-time logic to both human and non-human identities.

That matters because the pace of abuse is already ugly. CrowdStrike researcher Adam Meyers told the same audience that AI agents are generating roughly 250 times more detections than humans. In its threat research published this week, CrowdStrike said the average eCrime breakout time has dropped to 29 minutes, with the fastest intrusion taking 27 seconds. Case’s point was blunt: this is about confidence as much as speed. Security teams need to know they are stopping the right thing before critical services go sideways.