On November 3, 2026, at its Fal.Con Europe event, CrowdStrike announced two acquisitions and a new control for AI agents. SecurityWeek reports that CrowdStrike agreed to acquire Fiddler AI and Dreadnode and did not disclose terms, while the Wall Street Journal, which reported the deals first, put the prices at roughly $400 million for Fiddler and about $95 million for Dreadnode. Both are to be paid mostly in cash and are expected to close in CrowdStrike's fiscal fourth quarter, which ends on January 31, 2027. We could not find CrowdStrike's own release on the acquisitions, so their details below are as SecurityWeek reported them.
What the two companies add
Fiddler, founded in 2018, monitors AI agents and explains their decisions. According to SecurityWeek, CrowdStrike says it will add "pre-deployment evaluation of agents, tracing of their reasoning and tool calls, and detection of behavioral drift and hallucinations in production", log agent activity for compliance audits, and track token usage and spending. It will be sold as Falcon Observe. Dreadnode, founded in 2023, builds offensive AI security tools: a user describes in plain language what to test, and the platform runs more than 100 known attack strategies, including jailbreaks, prompt injection and multi-turn and agent-specific attacks, against models, agent loops, applications and MCP servers. Findings are mapped to the OWASP Top 10 for LLMs, MITRE ATLAS and the NIST AI RMF.
The kill switch, and what is available today
CrowdStrike's own release describes the AI Kill Switch in Falcon Guardian. "If an agent breaks out of its intended behavior, a defender can terminate it where it runs, block it from launching again, and cut off its enterprise network access." An authorized administrator triggers it, and every action is recorded in the audit trail. The release says it "is available today", but the detail matters: the Falcon sensor stops the agent "first at the Gateway, and soon on the endpoint". The release's own disclaimer adds that unreleased features "are still in development and subject to change".
The release also says something worth quoting about why such a control is needed even without an attacker: agents "chain steps, hit obstacles, and can take actions no one authorized, even when no adversary is involved."
What remains uncertain. The prices are reported, not disclosed. Neither deal has closed, and Dreadnode-based testing is not expected to be generally available until CrowdStrike's fiscal fourth quarter. The release does not say how quickly the kill switch acts, which agent runtimes it recognises, or what happens to an agent's work in progress when it is stopped.
Analysis: Observability, adversarial testing and a stop control are three parts of the same operating loop, and a large security vendor is now selling them as one product. A small team can build the loop itself. At Belgavi's Book Store, Hansini could give the help-desk agent a documented stop procedure: one switch that revokes its refund tool credentials and blocks restarts, owned by a named person, tested once a month on staging. A stop that has never been tried is not a control, whoever sells it.
Sources and evidence
CrowdStrike announced on November 3 that it will acquire Fiddler AI (agent observability, to become Falcon Observe) and Dreadnode (automated AI attack testing), for about $400 million and $95 million as reported by the Wall Street Journal, closing by January 2027. It also released an AI Kill Switch in Falcon Guardian that terminates a misbehaving agent, blocks relaunch and cuts network access. Termination works at the gateway first, with the endpoint to follow.