CrowdStrike is buying Fiddler and Dreadnode to watch, test and stop AI agents

CrowdStrike announced on Tuesday, Nov. 3, 2026, at its Fal.Con Europe conference in Barcelona, definitive agreements to acquire Fiddler AI, an AI agent observability company, and Dreadnode, an automated AI security testing company.

Security companies spent two years selling "AI-powered" defense; now the job is defending against the AI itself. Buying a flight recorder and a crash-test lab in one morning says CrowdStrike thinks agent behavior is the next thing boards will be grilled about. The skeptical read: roughly half a billion dollars for two young startups is also a land grab before Palo Alto Networks or Microsoft buy the same features.

CrowdStrike, which trades on the Nasdaq as CRWD, signed definitive agreements to acquire Fiddler AI and Dreadnode. It announced both on Nov. 3, 2026, at Fal.Con Europe in Barcelona. A definitive agreement is a signed deal. It still has to close. Those lines are CrowdStrike's.

CrowdStrike did not disclose the prices. The Wall Street Journal reported that the two deals total about $495 million: about $400 million for Fiddler and about $95 million for Dreadnode. Those dollar figures are the Journal's report. They are not a price CrowdStrike published.

Each purchase price is to be paid predominantly in cash, with a portion in stock subject to vesting conditions. Vesting means that stock is earned over time, not handed over in full on the day the deal closes. Both deals are expected to close in CrowdStrike's fourth quarter of fiscal 2027, if the usual closing conditions are met. Fiscal 2027 is CrowdStrike's own accounting year, which is not the same as the calendar year. Closing conditions are the approvals and paperwork still ahead. Those terms are the releases'.

Fiddler, founded in 2018 and based in Palo Alto, does AI agent observability and explainability. Observability, here, is a record of what an agent actually did. Explainability is being able to say why. The work covers pre-deployment evaluation, which is testing an agent before it ships, continuous behavioral accountability once it is live, and agent explainability. CrowdStrike will sell it on the Falcon platform as Falcon Observe, generally available in that same fourth quarter of fiscal 2027. Fiddler says its purpose-built models can cut evaluation costs by up to 98%. A purpose-built model is one made for this job rather than a general chatbot. That 98% figure is the company's claim. Those lines are CrowdStrike's and Fiddler's.

Dreadnode, founded in 2023, with Brad Palm as chief executive, does automated AI security testing. You describe what to test in plain language, and it runs more than 100 known AI attack strategies against models, the loops where an agent reasons, applications, and MCP servers. Those strategies include jailbreaks, prompt injection, attacks that take more than one turn, and attacks aimed at an agent. A jailbreak is a prompt written to talk a model out of its rules. Prompt injection is hidden instructions that try to override the ones the builder wrote. An MCP server is a connector that lets an AI use an outside tool. Findings are ranked by severity and mapped to the OWASP Top 10 for LLMs, OWASP Agentic Security, MITRE ATLAS, and the NIST AI Risk Management Framework. Those are public catalogs of known AI attacks and the risk lists they sit on. Dreadnode's team joins CrowdStrike's Cyber Superintelligence Lab. Automated AI Security Testing is due to be generally available in the fourth quarter of fiscal 2027. Those lines are CrowdStrike's.

The same day, CrowdStrike launched an AI Kill Switch in Falcon Guardian. An authorized administrator can stop a rogue agent where it runs, block it from starting again, and cut its network access, and every action is logged. It is available now. CrowdStrike says it stops agents at the gateway first, and "soon" on the endpoint. The gateway is the door the agent uses to reach the network. The endpoint is the laptop or server the agent is running on. Those lines are CrowdStrike's.

George Kurtz, CrowdStrike's chief executive and founder, said: "When a regulator or your board asks what an agent did, saying 'the model did it' is not an answer. Fiddler is the flight recorder for every agent: the observability to explain exactly what an agent did and why." On Dreadnode he said: "Enterprises are deploying AI faster than they can prove it is secure. A model can be jailbroken, an agent can be manipulated, and most organizations have no way to find those flaws until the AI is already in production." Those quotations are his.

The picture is George Kurtz speaking on stage in a light blue blazer, wearing a headset microphone, against a dark backdrop with red lights. The credit is George Kurtz, under a Creative Commons BY-SA 4.0 license, via Wikimedia Commons.

In plain terms, CrowdStrike signed deals to buy a company that records what AI agents did and why, and a company that attacks models before they ship. CrowdStrike did not name a price. The Wall Street Journal put the pair at about $495 million. The same morning CrowdStrike also shipped a switch that can shut a rogue agent down.