CrowdStrike Signs Two Deals in a Day to Buy Fiddler AI and Dreadnode

What happened

Once companies put agents into production in bulk, security teams face a new problem: existing tools struggle to fully record what an agent did inside a system and which tools it called. CrowdStrike announced the acquisitions and a new feature on the same day at Fal.Con Europe, covering both pre-deployment testing and post-deployment monitoring.

On terms, CrowdStrike did not disclose the prices. According to The Wall Street Journal, Fiddler AI is worth about $400 million and Dreadnode about $95 million, for about $495 million combined. CrowdStrike said both deals will be paid mostly in cash, with a portion in stock subject to vesting, and are expected to close in the fourth quarter of fiscal 2027, which ends January 31, 2027, subject to customary conditions; neither deal has closed.

On product integration, Fiddler AI's technology will be sold as Falcon Observe, and Dreadnode's test results will feed into Falcon Guardian as policy recommendations. On the same day, Falcon Guardian also added an AI Kill Switch that lets authorized administrators halt a misbehaving agent, prevent it from restarting, and cut off its network access.

Key facts

1. Announcement and venue: CrowdStrike, Nov 3, 2026, at Fal.Con Europe
2. Targets and focus: Fiddler AI (founded 2018, based in Palo Alto, agent observability and explainability); Dreadnode (founded 2023, automated AI security testing)
3. Deal value: not disclosed by the company; The Wall Street Journal reported about $400 million for Fiddler AI and about $95 million for Dreadnode, about $495 million combined
4. Payment and closing: mostly cash, with a portion in stock subject to vesting; expected to close in fiscal Q4 2027 (ending January 31, 2027), subject to customary conditions; neither deal has closed
5. Fiddler AI integration: sold as Falcon Observe, covering pre-deployment evaluation, reasoning and tool-call tracing, behavioral drift and hallucination detection, compliance audit logs and token usage
6. Dreadnode integration: findings ranked by severity and mapped to the OWASP LLM Top 10, MITRE ATLAS and NIST AI RMF, feeding Falcon Guardian as policy recommendations; the team joins the Cyber Superintelligence Lab
7. Same-day feature: Falcon Guardian added an AI Kill Switch letting authorized administrators halt a misbehaving agent, prevent restarts and cut network access