At Fal.Con Europe in Barcelona on November 3, CrowdStrike said it signed definitive agreements to acquire AI agent observability company Fiddler AI and automated AI security testing company Dreadnode, and launched an AI Kill Switch in Falcon Guardian that can terminate a misbehaving agent, block it from relaunching and cut its enterprise network access. Both deals are expected to close in CrowdStrike's fiscal Q4 FY27, with the products generally available that quarter. CrowdStrike did not disclose prices; CyberScoop, citing the Wall Street Journal, put Fiddler at about $400 million and Dreadnode at about $95 million.
Key Takeaways
- ✓Both acquisitions were announced the same day and are expected to close in CrowdStrike's fiscal Q4 FY27, paid mostly in cash plus some stock subject to vesting conditions.
- ✓CyberScoop, citing the Wall Street Journal, puts Fiddler at about $400 million and Dreadnode at about $95 million, roughly $495 million combined; CrowdStrike did not disclose the amounts.
- ✓Fiddler will be sold as Falcon Observe: pre-deployment evaluation, tracing of decisions and tool calls across the agent hierarchy, drift and hallucination detection, and evaluation costs cut by up to 98% using purpose-built models.
- ✓Dreadnode runs more than 100 known AI attack strategies (jailbreaks, prompt injection, multi-turn and agent-specific attacks) against models, agent reasoning loops, applications and MCP servers, mapping findings to OWASP LLM Top 10, OWASP Agentic ASI01-ASI10, MITRE ATLAS and NIST AI RMF.
- ✓The AI Kill Switch is available today: an authorized admin triggers it, the agent is stopped first at the Gateway (endpoint enforcement coming soon), blocked from relaunching and cut off from the network, with every action logged.
Key Decision Metrics at a Glance
Turn your technical choice into a development budget
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Background and the Problem
Enterprise AI agents often hold valid credentials and approved tools yet can still make bad decisions, ignore instructions or claim work they never did. Traditional security testing was built for predictable code and does not reach the model layer or an agent's reasoning. At Fal.Con Europe, CrowdStrike moved to cover three stages at once: before deployment, in production, and when something goes wrong.
Architecture and Mechanism
Fiddler becomes Falcon Observe, instrumenting agents through OpenTelemetry with support for LangGraph, Amazon Bedrock, AWS Strands and Google ADK, tracing decisions, reasoning paths and tool calls, and correlating them with Falcon identity, cloud and runtime data. Dreadnode handles automated pre-deployment attack testing, and its findings feed Falcon Guardian as policy recommendations. The AI Kill Switch builds on the existing Falcon sensor, with a human triggering termination, relaunch blocking and network cutoff.
Benchmarks and Measured Numbers
This is security product and acquisition news, with no public third-party benchmarks. Official figures include more than 100 attack strategies in Dreadnode and up to 98% lower evaluation costs claimed for Fiddler; both are vendor claims. CrowdStrike did not disclose prices; the roughly $400 million and $95 million figures come from a Wall Street Journal report cited by CyberScoop.
Getting Started for Developers
Teams already on Falcon can use the AI Kill Switch in Falcon Guardian today, with endpoint-level termination coming soon. Falcon Observe and Dreadnode testing are expected to be generally available in fiscal Q4 FY27. Teams building their own agents can instrument with OpenTelemetry now and organize test plans around OWASP Agentic ASI01-ASI10 and MITRE ATLAS to ease later integration.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.