CrowdStrike Acquires Fiddler and Dreadnode to Monitor AI Agents

CrowdStrike struck agreements to purchase Fiddler AI and Dreadnode, two companies that specialize in artificial intelligence security, at the Fal.Con Europe conference in Barcelona on Nov. 3, 2026. The Wall Street Journal reported that the combined price is about $495 million, but CrowdStrike has not confirmed the figure. CyberScoop and SecurityWeek reported that most of the funding will come from cash, with stock covering the rest under vesting conditions.

CyberScoop reported that conventional testing designed for predictable code overlooks the model layer and agent reasoning, and while standard tools can flag suspicious access, they cannot explain an authorized agent’s choices without an additional monitoring layer. Even with valid credentials and approved tools, agents can make poor decisions, ignore instructions or falsely claim completed work, creating risk even without a compromise.

Fiddler focuses on AI agent observability and explainability, and CrowdStrike will integrate it as Falcon Observe on its Falcon platform. George Kurtz, CrowdStrike’s chief executive and founder, described Fiddler as the “flight recorder for every agent.” Before deployment, Fiddler evaluates agents, then tracks their decisions and reasoning paths across systems, flags behavioral drift and made-up answers, and generates records for audits.

SecurityWeek reported that Fiddler monitors token usage and spending, and Yahoo Finance reported that it can lower evaluation expenses by as much as 98% using purpose-built models rather than external LLM calls.

Dreadnode creates automated security testing for AI systems and builds offensive AI security tools. CyberScoop and KuCoin reported that the platform uses more than 100 known attack techniques on models and agent systems, including jailbreaks and prompt injection. Unite.AI reported that CrowdStrike described Dreadnode’s arsenal as exceeding 50 attack techniques, ranging from jailbreaks and prompt injection to multi-turn and agent-specific attacks.

SecurityWeek and Unite.AI reported that testing extends to AI models, agent reasoning loops, applications and MCP servers, which connect AI models to external tools and data. Dreadnode’s platform assigns severity rankings to results and matches them to standards such as OWASP Top 10 for large language models and the NIST AI Risk Management Framework, and Unite.AI said the platform maps findings to MITRE ATLAS and OWASP Agentic Security categories ASI01 through ASI10. SecurityWeek said users can tell Dreadnode’s platform, in plain language, which test to run.

SecurityWeek and Unite.AI reported that Dreadnode’s findings turn into policy recommendations for CrowdStrike’s Falcon Guardian AI detection and response product. SecurityWeek said Falcon Guardian includes an AI Kill Switch that allows authorized administrators to halt a misbehaving AI agent, block restarts, and cut network access. Combined with Falcon Guardian innovations, CrowdStrike aims to deliver comprehensive AI security and AI safety, with Guardian protecting agents from attack and misuse and Fiddler confirming they behaved as intended.

“Every company is deploying agents and asking the same thing: what are agents actually doing?” said George Kurtz. Kurtz added that security used to mean blocking the adversary, whereas safety offers the larger chance to run AI at full speed inside the company under human control.

Fiddler began in 2018 and operates from Palo Alto, California. It announced a $30 million Series C round in January that brought its total funding to $100 million. Dreadnode began in 2023 and raised $14 million in Series A funding in early 2025. The Dreadnode team, led by CEO Brad Palm, will join CrowdStrike’s Cyber Superintelligence Lab.

CrowdStrike expects the deals to close in its fourth quarter of fiscal 2027, pending standard approval steps. CrowdStrike expects Falcon Observe and Dreadnode capabilities to reach general availability in the same quarter. CrowdStrike’s fiscal 2027 ends on January 31, 2027. In January, CrowdStrike announced plans to buy SGNL, an identity security firm, for $740 million, and Seraphic, a browser security company, for a reported $420 million; it also agreed in September 2025 to acquire AI security firm Pangea.

CRWD was up by 1 percent at $244.22 in pre-market trade on the Nasdaq on November 3, 2026. However, uncertainty remains for CrowdStrike investors about whether this new AI security category will produce substantial customer demand and recurring revenue.