CrowdStrike has signed definitive deals to buy two major artificial intelligence security startups, Fiddler AI and Dreadnode, in a move to cover nearly every stage of an AI agent’s life. Announced on November 3 at the company’s Fal.Con Europe conference in Barcelona, the pair adds pre-deployment testing and in-production observability to a platform that already stops rogue agents at runtime.
What CrowdStrike is buying
Fiddler AI, founded in 2018 in Palo Alto, builds software that records and explains what AI agents do, from their decisions and tool calls to whether they stayed within their task. CrowdStrike will sell that technology as Falcon Observe, with general availability planned for its fiscal fourth quarter of 2027.
Once live, Falcon Observe is meant to evaluate agents before deployment, trace their behavior across the agent hierarchy, and flag drift, hallucinations, and unintended actions. CrowdStrike chief executive George Kurtz called Fiddler the flight recorder for agents, a phrase capturing the pitch: when a regulator or a board asks what an agent did, the company wants the answer on record.
Dreadnode, founded in 2023, takes the other end of the problem: automated security testing of AI models, applications, and agents before they reach production. Its software probes for weaknesses such as jailbreaks and prompt injection, and CrowdStrike says its results will feed into Falcon Guardian as security policy recommendations, with the team joining the company’s Cyber Superintelligence Lab.
The price, as reported
CrowdStrike disclosed no price for either deal, saying only that payment will be predominantly in cash with a portion in stock subject to vesting. The Wall Street Journal reported a price of about $495 million, $400 million for Fiddler and about $95 million for Dreadnode, figures that CrowdStrike has not confirmed and that should be read as reported, not official.
Both deals are expected to close in CrowdStrike’s fourth quarter of fiscal 2027, the quarter running from November 2026 through January 2027, subject to customary closing conditions. Neither deal has closed yet, and the releases state no effect on financial guidance, so the purchases are best understood as a plan for the Falcon platform, not a finished integration.
How the three pieces fit
The acquisitions land alongside the AI Kill Switch CrowdStrike launched the same day in Falcon Guardian, which lets teams stop a rogue agent, block it from relaunching, and cut its access. Where the kill switch acts at runtime, Dreadnode tests before launch and Fiddler watches after it, giving CrowdStrike a story that covers the agent’s life rather than one moment.
Our read
Our read is that CrowdStrike is buying the audit trail, not just more tooling. As agents gain authority over spending, data, and systems, the question boards and regulators ask is shifting from whether an agent was attacked to what it actually did, and Fiddler answers the second question. Pairing that record with a kill switch turns observation into control.
Two open questions deserve attention. Neither company has said whether Fiddler will remain available standalone or only through Falcon, a detail that matters to existing Fiddler customers. And with both deals still unclosed, the promised Falcon Observe launch date depends on conditions CrowdStrike has not spelled out, so buyers should treat the timeline as planned rather than guaranteed.
Why It Matters
The stakes are rising because agents are no longer just answering questions; they are approving spending, moving data, and acting across systems on their own. Without a record of what an agent did and a test of what it might do, companies are flying blind at the moment they hand agents more authority.
CrowdStrike’s bet is that the vendor who can both watch and stop agents will own this layer of enterprise security. Rivals will answer with their own bundles, and the contest will be decided less by who has the best single tool than by whose record regulators and boards trust when something goes wrong.
Background
Fal.Con Europe is CrowdStrike’s annual European customer conference, and the Falcon platform is its cloud-native security system spanning endpoints, cloud workloads, identity, and data. The company has spent the past year extending Falcon from traditional endpoint protection toward AI agent security, a shift driven by customers deploying agents faster than their security policies can follow.
0 Comments