CrowdStrike has agreed to acquire Fiddler AI and Dreadnode, according to CyberScoop, Crypto Briefing and NewsCord. The reported combined value is $495 million, although CrowdStrike did not publicly disclose the purchase prices.
The deal targets a distinct cybersecurity problem: autonomous AI agents can possess valid credentials, use approved tools and still produce harmful or misleading actions. Fiddler is intended to provide AI agent observability, while Dreadnode will contribute automated security testing before deployment.
The short version
- Fiddler AI is expected to become Falcon Observe within CrowdStrike’s Falcon platform.
- Dreadnode tests models and AI agents with more than 100 known attack methods.
- The acquisitions are expected to close, and the capabilities to become generally available, in CrowdStrike’s fiscal fourth quarter of 2027.
- NewsCord reports a combined deal value of approximately $495 million: $400 million for Fiddler and $95 million for Dreadnode.
- CrowdStrike also introduced an AI Kill Switch as part of Falcon Guardian, separate from the technology acquired in the two deals.
How the AI agent security market got here
Security teams built their defenses around software whose behavior could be described with reasonable confidence. A legitimate process did not rewrite its own rules. A compromised account did not autonomously select its next tool or invent a completed task.
AI agents weaken those assumptions. They can interpret instructions, call services and decide which actions to take. According to CyberScoop, an agent may ignore directions, claim work it never performed or drift from expected behavior even when its credentials and permissions are valid.
That gap requires coverage at three stages. Before launch, teams need to test whether an agent resists prompt injection, jailbreaks and other known attacks. During operation, defenders need traces of decisions, tool calls and deviations. If the agent becomes unsafe, they also need a control outside the model that can stop it.
CrowdStrike’s proposed portfolio now maps to that lifecycle. Dreadnode covers pre-deployment testing, Fiddler supplies production observability, and the AI Kill Switch provides runtime intervention.
What changed with the acquisitions
CyberScoop reported that CrowdStrike signed the agreements at its Fal.Con Europe conference in Barcelona. Fiddler’s technology will become Falcon Observe, with capabilities for tracing decisions across agent systems, recording tool activity, detecting drift and surfacing fabricated answers.
NewsCord reported that Fiddler’s logs and traces could support compliance reviews and answer operational questions about what an agent actually did. That is valuable evidence, but it is also a new telemetry category for many security teams. The key implementation question is whether existing detection, incident-response and audit workflows can consume agent activity without creating another silo.
Dreadnode operates earlier. Crypto Briefing described its work as automated pre-deployment security testing, mapped to frameworks including OWASP, MITRE ATLAS and NIST. NewsCord gave a broader list that also included the OWASP Top 10 for large language models and the OWASP Agentic Security categories.
The company’s testing platform runs more than 100 attack strategies against models, applications, reasoning loops and Model Context Protocol servers. Findings can be prioritized and translated into recognized security frameworks. In practical terms, security teams gain a repeatable way to compare agent configurations before granting production access.
The acquisition also creates a dependency question. Framework alignment can help procurement and governance teams, but it does not prove that an agent is safe in a particular environment. Permissions, data access, tool design and monitoring still determine real-world exposure.
Who is affected, and what it means for you
The immediate users are enterprises deploying AI agents inside business workflows. For security professionals, this is closer to extending EDR and threat intelligence into a new execution layer than adding another conventional endpoint tool.
There is a trade-off between platform consolidation and reduced toolchain complexity. CrowdStrike can connect testing, runtime monitoring and emergency controls within Falcon. That may appeal to organizations seeking fewer vendors. It may also create concentration risk if agent telemetry, testing logic and enforcement controls sit in one ecosystem.
A practical example shows why the distinction matters. Say an internal support agent can read customer records and send refund requests. A pre-deployment test could expose prompt-injection weaknesses. Falcon Observe could then reveal an unexpected tool call or fabricated resolution. If policy requires intervention, the AI Kill Switch gives an authorized administrator a way to terminate the agent, prevent relaunch on specified systems and remove corporate network access.
That control was already available, according to NewsCord. The acquired observability and testing technologies had not yet been fully integrated at the time of the reports. Buyers should therefore separate present capability from roadmap promises.
Why this matters
The deal reflects a broader change in cybersecurity news: product categories once associated with model development are moving into enterprise security operations. That makes sense because agent failures can resemble malicious activity, configuration errors and data-quality problems at the same time.
Traditional application testing remains necessary. AI agents introduce additional paths involving model behavior, planning, tool selection and external instructions. Signature-based antivirus is poorly suited to judging whether an agent’s reasoning is appropriate, while behavior-based detection can help identify unauthorized actions. Neither replaces a test process designed to probe model and agent weaknesses.
For defenders, the immediate evaluation questions are practical. Which agent frameworks and deployment models are supported? How are traces retained and protected? Can testing results be connected to existing policy engines? Who can invoke a kill switch? And what happens when the agent operates across multiple clouds or business units?
The reported pricing also warrants caution. CyberScoop cited a Wall Street Journal report placing Fiddler at $400 million and Dreadnode at $95 million. Crypto Briefing and NewsCord repeated a combined value of approximately $495 million. CrowdStrike itself did not disclose what it paid.
What to watch next
The first checkpoint is closing. Both acquisitions still require customary approvals and are expected to close in CrowdStrike’s fiscal fourth quarter of 2027.
The second is integration. Does Falcon Observe become an operational record that responders can query during an incident, or merely a dashboard? Does Dreadnode produce findings tied to concrete deployment risks and remediation steps?
The third is enforcement. NewsCord reported that investors were watching whether the expanded platform produces new client adoption and revenue. Security teams should watch a simpler test: whether the combined workflow shortens the path from discovery to containment without burying teams in another alert stream.
Bottom line: CrowdStrike is buying more than two AI security startups. It is assembling a control plane for AI agent security, from pre-deployment testing through observability and shutdown. The architecture is promising, but the acquisition does not remove the need for careful permissions, tested responses and independent validation.
Key takeaways
- Treat AI agent security as a lifecycle covering testing, runtime observability and intervention.
- Require evidence from agent tests and traces before granting production access to sensitive systems.
- Compare the benefit of a consolidated Falcon workflow against the risk of deeper vendor dependence.
- Track the acquisitions’ closing and the actual integration of Falcon Observe and Dreadnode.
Frequently asked questions
What is CrowdStrike acquiring Fiddler AI and Dreadnode for?
Fiddler is set to become Falcon Observe for monitoring and explaining AI agent activity. Dreadnode contributes automated pre-deployment testing for weaknesses in models and agent systems.
How much are the acquisitions worth?
NewsCord and Crypto Briefing reported a combined value of approximately $495 million. The reported breakdown is $400 million for Fiddler and $95 million for Dreadnode, but CrowdStrike did not disclose the prices.
When are the acquired capabilities expected to be available?
CrowdStrike expects both deals to close in its fiscal fourth quarter of 2027. The related capabilities are also expected to become generally available in that quarter.
What does the AI Kill Switch do?
It gives authorized administrators a way to stop an AI agent, block its relaunch on specified systems and remove its access to the corporate network. NewsCord reported that the switch was already available independently of the acquisitions.
Does the deal replace antivirus or EDR?
No. The acquisitions extend security coverage to AI models and agents. Conventional endpoint controls remain relevant for malware, exploitation and malicious activity on managed systems.