CrowdStrike agreed on 3 November to acquire Fiddler AI and Dreadnode in deals worth about $495 million combined, SecurityWeek reported. The cybersecurity company plans to add Fiddler’s AI agent monitoring and Dreadnode’s automated security testing to its Falcon platform, extending its tools for organisations deploying AI agents.
Key points
- The reported prices are roughly $400 million for Fiddler and about $95 million for Dreadnode.
- CrowdStrike says it will pay mostly in cash, with some stock subject to vesting conditions.
- Fiddler’s monitoring tools are planned as Falcon Observe. Dreadnode’s tests would feed policy recommendations into Falcon Guardian.
- Both acquisitions are expected to close in CrowdStrike’s fourth quarter of fiscal 2027.
Fiddler’s reported $400 million price
Roughly $400 million of the reported purchase price is for Fiddler, while about $95 million is for Dreadnode, SecurityWeek reported. CrowdStrike said the consideration for both acquisitions will be predominantly cash. The stock portion is subject to vesting conditions, tying some of the payment to conditions after the agreements are signed.
Fiddler, founded in 2018 and based in Palo Alto, California, announced a $30 million Series C funding round in January that brought its total funding to $100 million. Its technology monitors AI agents and provides explanations for their decisions. CrowdStrike plans to offer the acquired tools under the name Falcon Observe.
CrowdStrike says Fiddler’s tools will let customers assess agents before deployment, trace their reasoning and use of other tools, and detect changes in behaviour once they are running. The company also plans to use the technology to log agent activity for audits and track token use and spending. Those functions would put operating costs and agent behaviour in the same monitoring product.
Falcon Observe is planned for general availability in the fourth quarter of fiscal 2027, Stocktwits reported. The planned release places Fiddler’s tools alongside products CrowdStrike has already been bringing into enterprise AI deployments. An earlier AI Affairs report covered three Falcon tools added to Dell AI Factory with Nvidia.
Falcon Guardian gains an AI Kill Switch
CrowdStrike also introduced an AI Kill Switch in Falcon Guardian, its product for detecting and responding to AI-related risks. The company says authorised administrators can stop an agent acting outside its intended instructions, prevent it from restarting and cut off its network access. Stocktwits reported that the feature is available now and that administrator actions are recorded in audit logs.
That control addresses an agent already running, while the two proposed purchases cover monitoring and testing at other stages. CrowdStrike says findings from Dreadnode’s tests will become policy recommendations in Falcon Guardian. CrowdStrike says Dreadnode’s test findings will feed policy recommendations into Falcon Guardian, while the testing capability is scheduled for a later release.
The acquisitions follow other purchases in CrowdStrike’s security portfolio. In January, CrowdStrike set out a $740 million plan to buy SGNL and a separate proposed purchase of Seraphic at a reported $420 million, SecurityWeek reported. CrowdStrike also agreed to buy AI security firm Pangea in September 2025. Those deals are part of a wider run of CrowdStrike security acquisitions.
Dreadnode brings more than 100 attack strategies
Dreadnode, founded in 2023, raised $14 million in Series A funding in early 2025. It develops tools to test AI systems for weaknesses. CrowdStrike says customers can describe a test in ordinary language and have Dreadnode’s platform run more than 100 known attack strategies, including jailbreaks, prompt injection and attacks aimed specifically at agents.
The tests cover models, applications, agent reasoning loops and MCP servers. CrowdStrike says the platform ranks findings by severity and maps them to established AI security frameworks before sending recommendations to Falcon Guardian. Dreadnode’s team, led by chief executive Brad Palm, will join CrowdStrike’s Cyber Superintelligence Lab.
CrowdStrike expects both acquisitions to close in its fourth quarter of fiscal 2027, which ends on 31 January 2027. It expects Dreadnode-based testing to become generally available in that quarter.
