CrowdStrike has agreed to acquire two AI security startups, agent observability company Fiddler AI and automated AI security testing firm Dreadnode, and launched an AI Kill Switch in its Falcon Guardian platform that can stop a misbehaving AI agent in real time. The company announced the deals on November 3 at its Fal.Con Europe 2026 conference in Barcelona.
CrowdStrike did not disclose prices. SecurityWeek reported a combined value of about $495M, with roughly $400M for Fiddler and $95M for Dreadnode. CrowdStrike said both purchases will be paid mostly in cash, with a portion in stock subject to vesting conditions, and expects both to close in the fourth quarter of its fiscal 2027, which ends January 31, 2027.
“Every company is deploying agents and asking the same thing: what are agents actually doing?”— George Kurtz, CEO and founder of CrowdStrike
Fiddler, founded in 2018 and based in Palo Alto, evaluates AI agents for accuracy, task completion and policy compliance before they reach production. Once agents are live, it traces their decisions, reasoning paths and tool calls, and flags behavioral drift, hallucinations and unintended actions. CrowdStrike said Fiddler can cut evaluation costs by up to 98% by using purpose-built models instead of external LLM calls.
Key facts
- 01CrowdStrike signed definitive agreements to acquire Fiddler AI and Dreadnode, announced November 3 at Fal.Con Europe 2026 in Barcelona.
- 02SecurityWeek reported a combined price of about $495M, roughly $400M for Fiddler and $95M for Dreadnode; CrowdStrike did not disclose terms.
- 03Both deals are mostly cash with some stock and are expected to close in CrowdStrike's fiscal Q4 2027, which ends January 31, 2027.
- 04Falcon Guardian's new AI Kill Switch terminates unauthorized agents in real time and blocks them from running again across an organization.
- 05Dreadnode runs more than 100 AI attack strategies, including jailbreaks and prompt injection, against models, agents and MCP servers.
CrowdStrike will sell Fiddler's technology inside Falcon under the name Falcon Observe, with general availability planned for the fourth quarter of fiscal 2027. It instruments agents through OpenTelemetry and supports LangGraph, Amazon Bedrock, AWS Strands and Google ADK, and CrowdStrike plans to correlate agent behavior with Falcon's identity, cloud and runtime data.
The AI Kill Switch is available now. It terminates unauthorized agents starting at CrowdStrike's AI Gateway, with endpoint enforcement to follow, and blocks those agents from running again anywhere in the organization. The AI Gateway, which routes AI traffic through one inspection point for prompts, responses and policy, is generally available and included with Guardian.
“One control point isn't enough to stop that. It takes the agent, the network, and the endpoint, together.”— Michael Sentonas, President of CrowdStrike
Guardian also gained agent-level hooks that enforce policy inside Claude Code, OpenAI Codex, GitHub Copilot, Microsoft 365 Copilot, OpenCode and Cursor. CrowdStrike added detection of malicious AI skills and MCP servers, and an Anthropic integration that lets the Falcon sensor run inside the Claude Cowork virtual machine. Guardian has been generally available since September 2026.
Dreadnode, founded in 2023, attacks models, agent reasoning loops, applications and MCP servers with more than 100 known AI attack strategies, including jailbreaks, prompt injection and multi-turn and agent-specific attacks. Its findings are ranked by severity and mapped to the OWASP Top 10 for LLMs, OWASP Agentic Security, MITRE ATLAS and the NIST AI Risk Management Framework.
“We founded Dreadnode to expose those weaknesses before AI reaches production”— Brad Palm, CEO of Dreadnode
CrowdStrike plans to make Dreadnode's automated AI security testing generally available in the fourth quarter of fiscal 2027. Findings will feed into Falcon Guardian as policy recommendations, and Dreadnode's team, led by CEO Brad Palm, will join CrowdStrike's Cyber Superintelligence Lab.
The pairing splits the agent problem in two. In CrowdStrike's framing, Guardian protects agents from attack and misuse, while Fiddler checks that they behaved as intended. CrowdStrike CEO George Kurtz called Fiddler "the flight recorder for every agent."
The deals extend a run of AI-focused purchases by CrowdStrike, which bought SGNL for $740M and Seraphic Security for a reported $420M in January after acquiring Pangea and Onum in 2025.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
