CrowdStrike Acquisition Adds Fiddler and Dreadnode for AI Agents

CrowdStrike is buying two AI security startups, Fiddler AI and Dreadnode, in deals announced on November 3 at its Fal.Con Europe 2026 conference in Barcelona. The CrowdStrike acquisition pair costs about $495 million in total, roughly $400 million for Fiddler and $95 million for Dreadnode, according to TechCrunch, citing The Wall Street Journal. CrowdStrike itself did not disclose the prices.

Both deals will be paid mostly in cash, with part of the price delivered in CrowdStrike stock subject to vesting conditions. The company expects both to close in the fourth quarter of its fiscal 2027, which ends in January 2027, subject to customary closing conditions.

What the CrowdStrike acquisition brings to Falcon

Fiddler, founded in 2018, builds observability and explainability tools for AI agents. According to CrowdStrike’s Fiddler announcement, its technology will be sold inside the Falcon platform as Falcon Observe, with general availability planned for Q4 FY27.

Falcon Observe is meant to answer a basic question for companies running agents in production: what did the agent actually do, and why? CrowdStrike lists these capabilities:

• Evaluation of agent accuracy, task completion and policy compliance before deployment
• Tracing of agent decisions, reasoning paths and tool calls across an agent hierarchy
• Detection of behavioral drift, hallucinations and unintended actions in production
• Audit trails for first-party, third-party and coding agents
• Token usage and spend tracking, with evaluation costs cut by up to 98% using purpose-built models
• OpenTelemetry support, including LangGraph, Amazon Bedrock, AWS Strands and Google ADK

“When a regulator or your board asks what an agent did, saying ‘the model did it’ is not an answer,” CrowdStrike CEO George Kurtz said, describing Fiddler as a “flight recorder for every agent.”

Dreadnode automates attacks on AI systems

Dreadnode, founded in 2023, takes the offensive side. Per CrowdStrike’s Dreadnode announcement, its platform runs more than 100 known AI attack strategies, including jailbreaks, prompt injection and multi-turn agent attacks, against models, agent reasoning loops, applications and MCP servers before they go live.

Findings are ranked by severity and mapped to frameworks such as the OWASP Top 10 for LLMs, MITRE ATLAS and the NIST AI Risk Management Framework. CrowdStrike says those results will feed Falcon Guardian as runtime policy recommendations, and the Dreadnode team will join the company’s Cyber Superintelligence Lab. Automated AI Security Testing is also due in Q4 FY27.

Why security vendors want agent tools now

The purchases land alongside a new AI Kill Switch in Falcon Guardian, which lets an administrator block a misbehaving agent’s access to AI models through a gateway, stop it from relaunching on targeted hosts and cut its network access. CrowdStrike says direct termination on the endpoint is coming later. The debate over who gets to pull the plug on AI systems has so far focused on frontier labs, but enterprise buyers are now asking the same question about their own agents.

Real incidents are adding pressure. Developer tools have already been abused as an entry point, as in the Claude Code extension hack that planted backdoors on developer machines.

CrowdStrike is not alone in spending on agents. Salesforce agreed to buy Cresta this week in its push into AI voice agents. For CrowdStrike customers, the practical change will come next year, when Falcon Observe and Dreadnode’s testing tools become part of the same platform that already watches their endpoints, identities and cloud workloads.