CrowdStrike to Buy Fiddler AI and Dreadnode for Nearly $500M

CrowdStrike announced on November 3, 2026, at its Fal.Con Europe conference in Barcelona that it has signed two separate but simultaneous definitive agreements to acquire Fiddler AI, an AI agent observability company, and Dreadnode, an automated AI red-teaming company. Neither price was officially disclosed, but the Wall Street Journal reported a combined figure of roughly $495 million. Together, CrowdStrike says the deals extend its Falcon platform from watching an AI agent's behavior to actively attacking it before an adversary can, and add a new "AI Kill Switch" that lets a human operator shut an agent down at runtime. This article covers what was actually announced, what's independently confirmed, and what it means for security teams that already run AI agents in production.

What CrowdStrike actually announced

At Fal.Con Europe in Barcelona on November 3, 2026, CrowdStrike said it had signed definitive agreements to acquire two AI-security startups at once: Fiddler AI and Dreadnode. Fiddler, announcing the deal on its own blog the same day, confirmed only that it "has signed a definitive agreement to be acquired by CrowdStrike," without stating a price. CrowdStrike framed the pair of deals as a single strategic move: give security teams the tools to watch what an AI agent is doing (Fiddler's specialty) and the tools to find an agent's weaknesses before an attacker does (Dreadnode's specialty), then combine both into Falcon so a company can see, test, and if necessary stop its own AI agents from one console.

What Fiddler AI and Dreadnode actually do

Fiddler AI, founded eight years ago by Krishna Gade and Amit Paka, builds tools that evaluate AI agents before they reach production, trace an agent's decisions and reasoning step by step, flag behavior that drifts from what it's supposed to do or answers that appear fabricated, and generate audit records a company can show a regulator or a board. Fiddler's tooling supports agent frameworks including LangGraph, Amazon Bedrock, and Google ADK. Dreadnode takes the opposite approach: it runs more than 100 known attacks, including jailbreaks and prompt injection, against a company's models and agents, then ranks what it finds by severity and maps each finding to the OWASP Top 10 for large language models and the NIST AI Risk Management Framework, the two reference standards security teams already use to triage conventional software vulnerabilities.

The price tag, and how reliable it is

CrowdStrike has not published official purchase prices for either company. The roughly $495 million combined figure, split as about $400 million for Fiddler and about $95 million for Dreadnode, comes from Wall Street Journal reporting cited in subsequent coverage, not from a CrowdStrike filing. What is confirmed directly from CrowdStrike and Fiddler's own statements is that both deals are structured to be paid mostly in cash, with part of the consideration in CrowdStrike stock that vests over time as conditions are met, and that both are expected to close in CrowdStrike's fiscal fourth quarter of 2027, subject to customary closing conditions such as regulatory clearance. Readers should treat the dollar figures as a credible press report rather than an official number until CrowdStrike discloses the deals in a regulatory filing.

Why the "AI Kill Switch" is the headline feature

CrowdStrike CEO George Kurtz described the stakes in blunt terms: "When a regulator or your board asks what an agent did, saying 'the model did it' is not an answer." He called the Fiddler-derived observability capability "the flight recorder for every agent," and described the new Falcon Guardian kill-switch capability as something that "lives outside the model, at runtime, where an agent can't argue with it, rewrite it, or wait it out." The framing matters: the kill switch is explicitly designed to sit outside the AI model itself, as an independent control a human can trigger, rather than relying on the model to voluntarily stop. Kurtz tied this to a broader bet that companies will deploy more AI agents, not fewer, once they trust they can shut one down: "The more certain a company is that it can stop any agent, the more agents it can put to work."

Dreadnode CEO Brad Palm framed his company's contribution around who is best positioned to find an AI agent's weaknesses before it ships, saying the people best equipped to find those failures think like attackers. Fiddler's Gade, for his part, said Fiddler would "help connect that protection to whether the agents themselves are behaving safely," tying his company's observability work directly to CrowdStrike's security mission.

The bigger pattern: CrowdStrike's AI-security buying spree

Fiddler and Dreadnode are not CrowdStrike's first AI-focused acquisitions. The company bought identity-security company Pangea for a reported $260 million in 2025, then bought SGNL for a reported $740 million in January 2026, both deals aimed at securing the identities and permissions that AI agents use to access systems. With Fiddler and Dreadnode now added, CrowdStrike has assembled, inside roughly 18 months, a stack that covers identity (Pangea, SGNL), behavior monitoring (Fiddler/Falcon Observe), and adversarial testing (Dreadnode/Falcon Guardian) for AI agents specifically. Kurtz has described the overall shift as moving the company's mission from traditional cybersecurity toward what he calls AI safety: "Safety is the bigger opportunity: letting AI run at full speed, inside the business, with a human in control."

Who is affected

The most directly affected group is CrowdStrike's existing enterprise customers that have already deployed, or are piloting, AI agents for tasks like customer support, coding, or internal operations; they gain a vendor-native path to monitor and test those agents without adding a separate point solution. Existing Fiddler AI and Dreadnode customers face the more immediate question of how their standalone products get absorbed into Falcon Observe and Falcon Guardian, and on what timeline. Competing AI-security and LLM-observability vendors, including companies offering agent monitoring or automated red-teaming as independent products, now face a well-funded platform player bundling both capabilities into an existing security suite many large enterprises already buy.

Cost and availability

There is no standalone price for end customers yet; CrowdStrike has said Fiddler's and Dreadnode's technology will ship as Falcon Observe and new Falcon Guardian capabilities, including the AI Kill Switch, inside the existing Falcon platform rather than as separate paid products at launch. General availability for both is targeted for CrowdStrike's fiscal fourth quarter of 2027. Availability is not limited by region in anything disclosed so far; the deals and the resulting product integration are being rolled out globally as part of the Falcon platform, not restricted to specific markets.

What happens next

Three things are worth tracking. First, whether CrowdStrike confirms the Wall Street Journal's reported price in a future SEC filing, since CrowdStrike is a public company required to disclose material acquisitions. Second, whether Falcon Observe and the AI Kill Switch actually reach general availability in fiscal Q4 2027 as targeted, or slip, which would be a signal of how much integration work remains. Third, whether rival security vendors respond with their own AI-agent-security acquisitions, given CrowdStrike has now made four such purchases (Pangea, SGNL, Fiddler, Dreadnode) in about 18 months.

Our take: a buying pattern, not a one-off deal

Looked at by itself, a $495 million combined price for two AI-security startups is a mid-sized acquisition for a company CrowdStrike's size. Looked at as the fourth AI-and-identity-security purchase in 18 months, after Pangea and SGNL, it reads differently: CrowdStrike is deliberately assembling a full AI-agent-security stack, identity, behavior monitoring, and adversarial testing, piece by piece, faster than most competitors can build the equivalent in-house. The AI Kill Switch is the part worth watching closely, because it's a tacit admission from a major security vendor that AI agents need an external, non-negotiable stop mechanism, not just better prompts or guardrails baked into the model itself. That's a notable shift in how the industry is starting to talk about agent safety.

If your organization runs, or is piloting, AI agents in production, here's a practical checklist worth working through this week:

• Ask whether you can actually audit an agent's past decisions today. If you can't reconstruct what an agent did and why after the fact, that's the exact gap Fiddler's "flight recorder" framing targets, and you have it whether or not you buy anything from CrowdStrike.
• Check whether you have a real kill switch, not just a config toggle. A stop mechanism that lives inside the same system the agent operates in can, in principle, be bypassed by a compromised or malfunctioning agent; one that lives outside the model, as CrowdStrike describes its new capability, is a meaningfully different guarantee.
• Red-team your agents against known attack classes, not just your own test cases. Dreadnode's pitch, mapping over 100 known attacks to OWASP and NIST frameworks, is a reminder that jailbreaks and prompt injection are now well-catalogued risks with standard references, not novel threats you need to discover yourself.
• Treat vendor consolidation as a procurement decision, not just a technical one. If you already run point solutions for agent observability or red-teaming, this deal is a sign that incumbent security platforms will increasingly bundle these features, which may change your renewal math.
• Separate the confirmed facts from the reported price. The deal structure, product integration, and expected timeline come from CrowdStrike and Fiddler directly; the $495 million figure is press-reported, not officially disclosed, so treat it as a credible estimate rather than a confirmed number until a filing says otherwise.
• Watch the fiscal Q4 2027 general-availability date. Integration timelines for acquired security products frequently slip; if Falcon Observe and the AI Kill Switch ship on schedule, that's a reasonable signal CrowdStrike can execute on this strategy at the pace it's buying.

Sources

• Fiddler AI: Fiddler joins CrowdStrike
• CyberScoop: CrowdStrike acquires Fiddler and Dreadnode for AI agent security
• Decrypt: CrowdStrike's AI agent kill switch, and its Fiddler AI acquisition
• citybiz: CrowdStrike to acquire Fiddler AI, Dreadnode in reported $495M deal
• CrowdStrike press release: CrowdStrike to Acquire Fiddler to Deliver Agent Observability for AI Trust

For more on how AI agents are becoming a security battleground, see our coverage of Microsoft's Guardian Agents launch to police AI agents at work and the hacker who used AI agents to breach 100+ companies including Deere.

Frequently asked questions

Related articles