CrowdStrike plans to buy Fiddler and Dreadnode. Security vendors want to test and watch your AI agents

In brief

At Fal.Con Europe 2026 in Barcelona on 3 November 2026, CrowdStrike announced two planned acquisitions aimed at enterprise AI agents. It has signed a definitive agreement to acquire Dreadnode, which tests AI models, applications and agents for weaknesses before deployment. It also announced its intent to acquire Fiddler, an AI observability company that monitors how agents behave.

The same day, CrowdStrike launched an "AI Kill Switch" in Falcon Guardian, its runtime protection product for AI agents. Taken together, the announcements cover testing before launch, monitoring after it, and a way to stop an agent that goes wrong.

What CrowdStrike announced

• Dreadnode. CrowdStrike says Dreadnode "runs more than 100 known AI attack strategies, including jailbreaks, prompt injection, and multi-turn and agent-specific attacks, against the models, agent reasoning loops, applications, and MCP servers that power enterprise AI." Findings are mapped to "OWASP Top 10 for LLMs, OWASP Agentic Security (ASI01-ASI10), MITRE ATLAS, and NIST AI RMF." Automated AI Security Testing is due to be generally available in Q4 FY27.
• Fiddler. Fiddler "will become part of the CrowdStrike Falcon® platform as CrowdStrike Falcon® Observe, generally available in Q4 FY27." It covers pre-deployment evaluation and "continuous behavioral monitoring", and supports OpenTelemetry, LangGraph, Amazon Bedrock, AWS Strands and Google ADK.
• AI Kill Switch. An authorised administrator can terminate an agent, block it from relaunching on the targeted host or host group, and cut its enterprise network access, with every action logged. Termination works "first at the Gateway, and soon on the endpoint."
• Terms. For Dreadnode, the price is "contemplated to be paid predominantly in cash and includes a portion to be delivered in the form of stock subject to vesting conditions", with closing expected in CrowdStrike's fourth quarter of FY27. CrowdStrike did not disclose a price.

Why it matters

CrowdStrike's Fiddler announcement argues that "AI agents don't have to be compromised to be dangerous". An agent with valid credentials and approved tools can still make a harmful decision. Traditional controls see legitimate activity in that case, so the evidence has to come from the agent's own decision trail.

Large security platforms are now moving into AI red-teaming and observability. That suits buyers who want fewer consoles. The risk is that the vendor protecting the agent also becomes the one grading it.

What security leaders should do next

1. Make pre-deployment testing a release gate. Whichever tool you use, require documented jailbreak and prompt-injection testing for any agent or MCP server going to production, mapped to a framework your auditors recognise.
2. Decide who can stop an agent. A kill switch only helps if ownership, approval and logging are agreed before an incident.
3. Ask for decision-level logs. For each agent, check that you can reconstruct what it was asked, what it decided and which tools it called.
4. Treat roadmap dates as roadmap. Falcon Observe and Dreadnode testing are not yet generally available, and neither deal has closed.

Sources and scope

Facts and quotations are from CrowdStrike's Dreadnode press release, its Fiddler announcement blog and its AI Kill Switch press release, all checked on 3 November 2026. Capability descriptions are vendor claims that ByteNib has not tested. Media reports of purchase prices could not be confirmed from a source we could read in full, so we have left them out. The analysis and recommendations are ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.