AUSTIN/BARCELONA, November 3, 2026 — The CrowdStrike AI acquisitions announced on Tuesday would add tools to monitor AI agents and test their security before deployment, as companies move from chatbots to software that can take actions across corporate systems. The company has signed separate agreements to acquire Fiddler AI and Dreadnode, extending the Falcon platform into two parts of the AI lifecycle: checking whether an agent is safe to launch and keeping a record of what it does once it is in use.

The cybersecurity company announced both agreements at Fal.Con Europe 2026 on Tuesday. Fiddler AI focuses on observability and explainability, while Dreadnode specialises in automated security testing of AI models, applications and agents. Neither acquisition has closed. CrowdStrike said each is expected to close during its fourth quarter of fiscal 2027, subject to customary conditions.

CrowdStrike did not disclose the purchase prices in its announcements. The Wall Street Journal reported that the two transactions are worth a combined $495 million, with Fiddler valued at about $400 million and Dreadnode at roughly $95 million. Those figures are the newspaper’s reporting, not prices confirmed by CrowdStrike. The company said the consideration for the acquisitions would be predominantly cash, with a portion in stock subject to vesting conditions.

Fiddler is intended to give businesses a clearer account of how their AI agents behave. CrowdStrike said the technology will bring pre-deployment evaluation, continuous behavioural accountability and agent explainability to Falcon. It plans to sell the capabilities as Falcon Observe, with general availability scheduled for the fourth quarter of fiscal 2027.

In practical terms, observability is meant to help an organisation reconstruct what an agent did, which tools it called and why it took a particular path. That matters because an AI agent can hold valid credentials and use approved software while still making an unsupported decision, misunderstanding an instruction or claiming to have completed work it did not finish. A security incident is not always the result of an outside attacker breaking into a system; a poorly controlled agent can create risk while operating with legitimate access.

CrowdStrike says Fiddler will evaluate accuracy, task completion and policy compliance before an agent enters production, then track decisions and tool calls after deployment. The company also says the technology is designed to identify behavioural drift and unintended actions, and to provide records that can be examined during audits or regulatory reviews. These are planned product capabilities; the acquisition must close and the integration must be completed before customers can assess the combined offering.

Dreadnode addresses a different stage. CrowdStrike said its technology will continuously test AI models, applications and agents for security weaknesses before they reach production. The company described the acquisition as a way to extend automated testing into systems whose behaviour can change depending on prompts, context and the tools available to them. Dreadnode’s team is expected to join CrowdStrike’s Cyber Superintelligence Lab, and the automated AI security-testing capabilities are also planned for general availability in the fourth quarter of fiscal 2027.

Also read: Project Glasswing: Anthropic’s AI Cybersecurity Initiative Explained

The distinction between the two products is important. Dreadnode is intended to probe a system before deployment, looking for weaknesses that should be fixed before users rely on it. Fiddler is intended to observe and explain the agent’s behaviour across its lifecycle, including after it begins interacting with business data and applications. Testing can reduce known weaknesses, while monitoring can help an organisation identify behaviour that changes once an agent is operating in a live environment. Neither step guarantees that an AI system will be safe in every situation.

Also read: AI Cyberattacks on UK Critical Infrastructure ‘Highly Likely’ by 2028

The acquisitions arrive alongside other AI-security changes announced by CrowdStrike at the same event. The company said Falcon Guardian is adding an AI Kill Switch that can terminate unauthorised agents at the gateway and block them from running again across an organisation; endpoint termination is planned for a later stage. CrowdStrike also described agent-level controls and network inspection intended to connect what an agent is instructed to do, the traffic it sends and the actions it executes on a device.

Together, the announcements show how security vendors are trying to adapt to software that does more than generate text or answer questions. An agent may search internal files, write code, call external services, update customer records or trigger other automated processes. Each additional permission can make the tool more useful, but it also increases the potential impact of a mistaken instruction, a manipulated model or an action that falls outside the organisation’s policy.

Traditional security controls remain relevant, but they do not always explain why an agent made a decision or whether a sequence of tool calls was appropriate. A firewall may show that a connection occurred; endpoint protection may record a process; identity controls may confirm that an agent had permission. Organisations also need to understand the context of the action, whether the agent stayed within its task and whether it passed information to a tool or service that should not have received it.

The proposed purchases are part of a broader contest among cybersecurity companies to become the control layer for enterprise AI. Businesses are experimenting with agents in software development, customer service, research and back-office operations, but many are still working out how to assign identities, limit permissions, supervise decisions and retain evidence of what automated systems have done. Vendors see an opportunity to sell those controls alongside endpoint, cloud and identity security.

For CrowdStrike, the acquisitions would add capabilities that are difficult to replicate with a single monitoring feature. A security team could use pre-deployment tests to identify weaknesses, observe agents after launch, and connect the resulting records with the company’s existing identity and endpoint telemetry. The value will depend on how well the tools work together, how many agent frameworks they support and whether customers can use the controls without adding substantial complexity to their operations.

Fiddler’s planned integration also points to a growing governance requirement. Boards, auditors and regulators are increasingly likely to ask not only whether a company uses AI, but what its automated systems are permitted to do and whether the organisation can explain consequential decisions. A trace of an agent’s actions can help answer those questions, but a record alone does not establish that the decision was correct or that the organisation had an adequate approval process.

The same caution applies to automated testing. A test suite can expose known classes of weakness, including attempts to manipulate an agent through malicious instructions, but new models, tools and deployment configurations can introduce different risks. Security testing has to be repeated as systems change. Human review, access limits, monitoring and incident-response procedures remain necessary even when testing is automated.

Neither deal should be treated as a completed product launch. CrowdStrike has announced definitive agreements, not completed acquisitions. The stated fourth-quarter fiscal 2027 timeline is subject to closing conditions, and the company’s planned availability dates depend on integration and product development. Customers will need to see how the products perform in real deployments, how findings are prioritised and whether the controls can be applied consistently across different AI models and agent frameworks.

The Wall Street Journal’s reported $495 million combined price gives an indication of the scale of the company’s investment, but the final economics and integration costs will become clearer only through later disclosures. CrowdStrike’s announcements describe the strategic rationale and intended product capabilities; they do not provide a complete financial breakdown of either transaction.

The next milestones are the closing of the two acquisitions, the integration of Dreadnode into the Cyber Superintelligence Lab, and the planned rollout of Falcon Observe and automated AI security testing in the company’s fourth quarter of fiscal 2027. For enterprise buyers, the more important test will be whether the combined tools can provide reliable oversight without slowing legitimate AI use or creating a false sense that an agent is safe simply because it passed a test.