CrowdStrike announced at its Fal.Con Europe 2026 conference in Barcelona on November 3 that it has agreed to acquire AI security startups Fiddler AI and Dreadnode in deals reportedly worth a combined $495 million. The Wall Street Journal reported the company will pay approximately $400 million for Fiddler and $95 million for Dreadnode. CrowdStrike confirmed both transactions will be funded predominantly with cash, alongside shares subject to vesting conditions.
The acquisitions are designed to expand the Falcon cybersecurity platform into autonomous AI agent security. Fiddler AI develops observability and explainability technology that helps organizations understand how autonomous agents make decisions, interact with external tools, and execute tasks. CrowdStrike plans to integrate Fiddler's capabilities into Falcon Observe, a new product expected to reach general availability in the fourth quarter of fiscal 2027. The platform will evaluate agent accuracy and policy compliance before deployment, trace decisions and tool calls during operation, and identify behavioral drift, hallucinations, and unintended actions, while creating auditable records for governance and regulatory reviews.
Dreadnode specializes in identifying security weaknesses before AI applications enter production. Its automated testing platform uses more than 100 attack strategies, including prompt injection, jailbreak attempts, and agent-specific attacks, to identify vulnerabilities in models, applications, and supporting infrastructure. CrowdStrike intends to connect Dreadnode's testing output with Falcon Guardian, allowing identified weaknesses to inform runtime security policies and contribute to its SafeMind AI security models. Both acquisitions are expected to close during CrowdStrike's fourth fiscal quarter of 2027, which ends January 31, 2027, subject to customary closing conditions.
Alongside the acquisition agreements, CrowdStrike introduced an AI Kill Switch within Falcon Guardian. The control lets authorized security administrators terminate an agent, block its relaunch on specified systems, and remove its enterprise network access. Each intervention is recorded for auditing and investigation. The initial functionality operates through gateway controls and is available now, with additional endpoint-level termination capabilities planned. CrowdStrike says gateway policies can inspect agent prompts and apply controls to tools including Claude Code, OpenAI Codex, GitHub Copilot, Microsoft 365 Copilot, Cursor, and OpenCode.
The move addresses a risk that conventional endpoint protection does not resolve: AI agents can perform harmful actions while using legitimate credentials and authorized software tools. The company cited examples such as an agent with permission to access financial records executing unintended transactions or disclosing sensitive information. CrowdStrike shares rose more than 2% in early Tuesday trading following the announcements.
