CrowdStrike to acquire Fiddler AI and Dreadnode in deals reported at 495 million dollars

On November 3, 2026, CrowdStrike said it had signed definitive agreements to acquire two artificial intelligence security startups, Fiddler AI and Dreadnode, in a pair of deals announced at the company's Fal.Con Europe conference in Barcelona. CrowdStrike declined to disclose the financial terms in its own statements, but The Wall Street Journal put the combined price at about $495 million, a figure that circulated quickly across the trade press. The move pushes the Falcon platform, already used widely across enterprises and governments for endpoint and cloud protection, into the unsettled market for watching over and testing autonomous AI agents.

The two targets do different jobs. Fiddler AI builds observability software that monitors AI agents inside enterprises, explains how they reach decisions and flags behavior that drifts from expectations. Dreadnode builds automated security testing that probes AI models, applications and agents for weaknesses before they are placed in front of customers or employees. Together they cover what vendors now call the agent lifecycle: the period before deployment, when an agent should be attacked on purpose, and the period after, when it must be watched continuously.

The timing reflects a shift in how enterprises think about AI risk. An agent can hold valid credentials, call approved tools and still take actions nobody intended, which means controls designed for predictable code do not reach the model layer or the agent's reasoning process. Software can ignore instructions or claim work it never completed, and boards and regulators increasingly want a record of what happened rather than a shrug. Traditional endpoint telemetry shows that a process ran; it does not explain why an agent chose to run it.

CrowdStrike has been building toward this gap. Its Falcon Guardian product was designed to see and understand what agents do on devices, and the company has argued that agent security requires both prevention and a durable record. The purchases add the missing halves: a testing engine that attacks AI systems before release and an observability layer that records their behavior afterward. TechCrunch reported on November 3 that Gartner forecasts the market for securing AI will reach almost $5 billion in 2027, a number that gives the strategy its financial logic.

Key Facts

TechCrunch reported on November 3 that CrowdStrike is paying around $400 million for Fiddler AI and about $95 million for Dreadnode, for a combined total of roughly $495 million. The breakdown matters because it prices the two companies very differently. Fiddler, a seven year old observability vendor, accounts for roughly four fifths of the consideration, while Dreadnode, founded in 2023, accounts for the remainder. CrowdStrike itself confirmed the agreements but not the numbers.

SecurityWeek reported on November 3 that both purchases will be paid mostly in cash, with a portion in stock subject to vesting conditions, and that the transactions are expected to close in the fourth quarter of CrowdStrike's fiscal year 2027, which ends January 31, 2027. Both offerings are slated for general availability in that same quarter, which compresses integration and launch into a single reporting period.

Fiddler was founded in 2018 and is based in Palo Alto, California. In January it announced a $30 million Series C round that brought total funding to $100 million, and PitchBook data cited by TechCrunch put its total raised at about $99 million. Its technology adds pre-deployment evaluation, tracing of reasoning and tool calls, detection of behavioral drift and hallucinations in production, audit logging and tracking of token spend. It works with LangGraph, Amazon Bedrock and Google ADK, and CrowdStrike plans to sell it as Falcon Observe.

Dreadnode was founded in 2023 and raised $14 million in Series A funding in early 2025. Its platform runs more than 100 known AI attack strategies, including jailbreaks, prompt injection and multi-turn and agent-specific attacks, against models, agent reasoning loops, applications and Model Context Protocol servers. Findings are ranked by severity and mapped to OWASP Top 10 for LLMs, OWASP Agentic Security, MITRE ATLAS and the NIST AI Risk Management Framework, then fed into Falcon Guardian as security policy recommendations.

CrowdStrike also introduced an AI Kill Switch inside Falcon Guardian, which lets authorized administrators halt a misbehaving agent, prevent it from restarting and cut off its network access. The Dreadnode team, led by chief executive Brad Palm, will join CrowdStrike's Cyber Superintelligence Lab, a detail CSO Online reported on November 4. CrowdStrike did not specify how the Fiddler team will be integrated.

Analysis

What this really means is that CrowdStrike is buying its way into a category before that category has settled into a stable set of buyers. CyberScoop reported on November 3 that the deals were announced at Fal.Con Europe in Barcelona and framed them as closing a gap that has widened as companies adopt AI agents. The company is not buying revenue at a discount, because neither target has revenue at platform scale. It is buying a position in the budget line that it expects agent security to become.

The price looks modest against the forecast. If the market for securing AI reaches almost $5 billion in 2027, then $495 million for two of the few independent vendors with shipped products in observability and offensive testing is a plausible entry fee. CrowdStrike is also paying with a balance sheet built on a large installed base, so the risk is less about cash and more about focus. Two acquisitions, two teams and two product surfaces landing in the same fiscal quarter is a heavy integration load.

There is a competitive argument too. Observability for AI agents has attracted cloud providers, model vendors and a long tail of startups, and much of that tooling started life as a developer convenience rather than a security control. By folding Fiddler into Falcon Observe, CrowdStrike is betting that buyers will prefer agent monitoring sold by the same vendor that already holds the endpoint and identity relationship. Whether security teams actually control that budget, rather than engineering or data platform teams, is the open question the deal cannot answer.

The judgement here is straightforward. This is a land grab executed at a reasonable price, and it is more defensible than most platform adjacencies because the technical gap is real: conventional testing does not reach the reasoning layer, and conventional logging does not explain an agent's choice. The risk is that agent adoption stalls in narrow, supervised workflows, in which case the acquisitions become expensive insurance rather than a growth engine. CrowdStrike is paying for the version of the next three years in which agents get real authority.

Why It Matters

For enterprise buyers, the practical effect is a shorter path to an audit trail. George Kurtz, CrowdStrike's chief executive and founder, has argued that when a regulator or board asks what an agent did, saying that the model did it is not an answer, and he described Fiddler as a flight recorder for every agent. That metaphor is the product pitch: testing before deployment, recording during operation, and a kill switch when something goes wrong. Few security categories can offer all three from one console today.

For the wider market, the deal sets a valuation marker. Fiddler's roughly $400 million price against $100 million in total funding is a solid outcome for its investors, while Dreadnode's $95 million against $14 million raised is a faster return on a much younger company. That math will pull more founders toward agent security. It also raises the bar for the remaining independent vendors, who now compete against a platform that can bundle testing, observability and response.

For CrowdStrike, the strategic value is architectural. Agent security is not a feature that can be bolted onto endpoint detection after the fact, because the evidence lives in prompts, tool calls and reasoning traces rather than in process trees. Owning both the testing engine and the recorder gives the company a way to close the loop: a finding from Dreadnode becomes a policy recommendation in Falcon Guardian, and a behavioral anomaly in Falcon Observe becomes a new test case. That loop is the actual asset being purchased.

Next Up

Both transactions still need standard approvals and are expected to close in CrowdStrike's fiscal fourth quarter of 2027, with general availability planned for the same window. The near term test is execution: whether Falcon Observe ships on schedule, whether the Dreadnode findings appear as usable policy recommendations rather than a separate console, and whether CrowdStrike's sales force can explain agent observability to buyers who are still learning what an agent is.

The next signal will come from CrowdStrike's filings and from Fal.Con Europe follow ups, where the company is likely to face questions about the reported $495 million price it has not confirmed. Watch also for rival platform vendors to respond with their own acquisitions, since the market for securing AI is forecast to approach $5 billion in 2027 and no large security vendor wants to arrive at that budget line without a testing and observability story.