CrowdStrike Agrees to Acquire Fiddler AI and Dreadnode

CrowdStrike announced on November 3 at its Fal.Con Europe conference in Barcelona that it has agreed to acquire artificial intelligence (AI) security startups Fiddler AI and Dreadnode. The Wall Street Journal reported that CrowdStrike will pay approximately $400 million for Fiddler and $95 million for Dreadnode. CrowdStrike did not separately disclose the purchase prices, but confirmed that both deals will be funded mostly with cash, along with shares subject to vesting conditions.

Shares of CrowdStrike rose more than 2% in early Tuesday trading after the announcements, as investors assessed the company's expansion into AI security and governance. Both acquisitions are expected to close during CrowdStrike's fourth fiscal quarter of 2027, which ends January 31, 2027, subject to customary closing conditions.

What Fiddler and Dreadnode add

Fiddler AI develops observability and explainability technology that shows how autonomous agents make decisions, interact with external tools and carry out tasks. CrowdStrike plans to integrate these capabilities into Falcon Observe, a new product scheduled for general availability in the fourth quarter of its fiscal 2027. Falcon Observe will evaluate agent accuracy and policy compliance before deployment, trace decisions and tool calls during operation, and identify behavioral drift, hallucinations and unintended actions. It will also generate auditable records for governance and regulatory reviews.

Dreadnode specializes in finding security weaknesses before AI applications enter production. Its automated testing platform uses more than 100 attack strategies, including prompt injection, jailbreak attempts and agent-specific attacks, to find vulnerabilities in models, applications and their supporting infrastructure. CrowdStrike intends to connect Dreadnode's testing results with Falcon Guardian, so identified weaknesses can inform runtime security policies. The technology will also contribute to CrowdStrike's SafeMind AI security models.

How the AI Kill Switch works

CrowdStrike also introduced an AI Kill Switch within Falcon Guardian, which lets authorized security administrators step in when autonomous agents deviate from their intended behavior. Defenders can terminate an agent, block its relaunch on specified systems and remove its enterprise network access. Each intervention is recorded for auditing and investigation.

The initial functionality works through gateway controls, and endpoint-level termination capabilities are planned. CrowdStrike said the Kill Switch is available now, while the acquired technologies have yet to be fully integrated.

AI agents can carry out harmful actions while using legitimate credentials and authorized software tools, a problem that conventional endpoint protection does not necessarily resolve. An agent with permission to access financial records or enterprise applications could carry out unintended transactions or disclose sensitive information without an outside attacker compromising the underlying system. Major US banks have restricted unauthorized AI agents from accessing customer accounts after reports of automated systems operating beyond expected permissions.

CrowdStrike's controls are designed to let organizations intervene when such behavior occurs, although their effectiveness will depend on deployment coverage, policy configuration and the ability to identify problematic agent activity.

Growing AI security exposure

Enterprise AI adoption is creating new cybersecurity exposure as autonomous systems gain access to internal applications, corporate data, payment infrastructure and cloud environments. Unlike traditional software, AI agents can adapt their behavior to new information, which can make some failures hard to anticipate through conventional vulnerability scanning or static application testing.

Security researchers have already documented AI agents attempting more than 1,200 cyber intrusions and compromising over 100 websites in one campaign. Separately, researchers associated with Google and Meta have warned that securing AI agents requires system-wide defenses that cover more than individual models.

CrowdStrike is positioning Falcon to address testing AI systems before deployment, monitoring their behavior during operation and intervening when their actions become unsafe. The approach could increase demand for security capabilities that overlap with observability, identity management and AI governance software, bringing CrowdStrike into closer competition with providers in those markets.

CrowdStrike recently expanded AI partnerships with Amazon Web Services, CoreWeave, Deloitte and Dynatrace. CrowdStrike has not provided financial forecasts for the Fiddler and Dreadnode businesses, disclosed their existing revenue or quantified their expected contribution to annual recurring revenue.