On November 3, 2026, CrowdStrike announced definitive agreements to acquire two artificial intelligence security startups, Fiddler AI and Dreadnode, in a move to solidify its role as the primary control plane for the emerging era of “agentic” AI. The dual acquisition, valued at approximately $495 million according to reports from the Wall Street Journal and SecurityWeek, marks a significant shift in the cybersecurity landscape toward securing autonomous agents rather than just the underlying models.
While CrowdStrike did not officially disclose the financial terms in its investor communications, the reported breakdown includes $400 million for Fiddler AI and $95 million for Dreadnode. The deals are expected to close in the fourth quarter of CrowdStrike’s fiscal year 2027, which concludes on January 31, 2027.
From Model Security to Agentic Control
The acquisitions target a critical gap in the AI lifecycle: understanding and controlling how autonomous agents make decisions. As businesses move beyond static chatbots toward agents that can execute tasks and interact with corporate data, the security focus is shifting from simple prompt filtering to behavioral observability.
Fiddler AI will be integrated into the CrowdStrike platform as Falcon Observe. This module is designed to provide “explainability” and observability for AI agents, functioning essentially as a flight recorder for agent behavior. Unlike traditional security monitoring that tracks code execution, Falcon Observe focuses on the reasoning and intent behind an agent’s actions. This capability is increasingly viewed as a requirement for regulatory compliance and board-level reporting, where organizations must prove that AI systems are operating within safe, ethical, and legal boundaries.
Dreadnode, the second acquisition, will power the platform’s automated security testing. The startup specializes in simulating more than 100 known AI attack strategies, including complex jailbreaks and prompt injection techniques. By integrating Dreadnode, CrowdStrike aims to allow developers to “red team” their AI agents before they are deployed into production environments.
Enforcement via the ‘AI Kill Switch’
Concurrent with the acquisition news, CrowdStrike released a new “AI Kill Switch” feature within its Falcon Guardian ecosystem. This tool provides the immediate enforcement mechanism for the observability and testing capabilities being added through the new acquisitions.
The AI Kill Switch allows administrators to terminate misbehaving agents or block specific interactions in real-time if the system detects an unauthorized shift in intent or a security breach. This transforms Falcon Guardian from a passive monitoring tool into an active enforcement layer for autonomous systems.
The integration of these technologies reflects a broader industry trend where cybersecurity vendors are racing to secure the “reasoning layer” of AI. As agents gain more autonomy to move data and change settings, the ability to observe their internal logic—and stop them if that logic fails—becomes a baseline requirement for enterprise adoption. According to BigGo Finance, the move positions CrowdStrike to manage the entire lifecycle of AI risk, from pre-deployment testing to live execution and emergency termination.
CrowdStrike plans to make these features generally available alongside the closing of the acquisitions in early 2027. Existing customers will likely see these capabilities introduced as new modules within the Falcon Guardian platform rather than automatic updates to existing endpoint security packages.