Cybersecurity

CrowdStrike Bolsters AI Security with Fiddler, Dreadnode Acquisitions

Analyst 207||Source: CyberScoop
A technology lab setting with AI equipment on display and people working in the background.

"When a regulator or your board asks what an agent did, saying ‘the model did it’ is not an answer," CrowdStrike CEO George Kurtz said, framing the company's latest moves as a response to a newfound accountability gap.

CrowdStrike's acquisitions of Fiddler and Dreadnode at Fal.Con Europe

CrowdStrike announced Monday that it has signed agreements to acquire two artificial intelligence security companies, Fiddler AI and Dreadnode, in deals revealed at its Fal.Con Europe conference in Barcelona. CrowdStrike did not disclose what it paid; a Wall Street Journal report listed Fiddler at $400 million and Dreadnode at $95 million. CrowdStrike said both deals are expected to close in its fourth quarter of fiscal 2027, pending standard approval steps, and will be paid mostly in cash with part of the consideration issued as company stock over time as conditions are met.

Fiddler (to become Falcon Observe): observability and explainability for agents

CrowdStrike said Fiddler, which specializes in AI agent observability and explainability, will be folded into the Falcon platform as Falcon Observe. According to the announcement, Fiddler’s technology "works after deployment." The company also said Fiddler evaluates agents before they reach production, traces decisions and reasoning across agent systems, flags drifting behavior and made-up answers, and creates records that can be used in audits.

Fiddler is described as compatible with common agent frameworks named in the release, including LangGraph, Amazon Bedrock and Google ADK. Kurtz called the capability "the flight recorder for every agent," presenting it as a tool to answer questions from boards and regulators about agent behavior.

Dreadnode: automated adversarial testing against jailbreaks and prompt injection

Dreadnode, which CrowdStrike will integrate to strengthen pre-deployment testing, builds automated security testing for AI systems. Its platform runs more than 100 known attack methods — the announcement specifically cited jailbreaks and prompt injection — against models and agent systems. Dreadnode ranks problems by severity and maps findings to widely used security standards, including the OWASP Top 10 for large language models and the NIST AI Risk Management Framework. Dreadnode Chief Executive Brad Palm described the company’s founding idea as that "the people best equipped to find those failures think like attackers."

Falcon Guardian and the AI Kill Switch: runtime protection and human controls

The acquisitions were announced alongside new Falcon Guardian capabilities that CrowdStrike says protect agents while they run. In a separate post on X, Kurtz introduced an "AI Kill Switch," a control described as living "outside the model, at runtime, where an agent can’t argue with it, rewrite it, or wait it out." Kurtz argued that the ability to stop an agent in real time is an enabler: "The more certain a company is that it can stop any agent, the more agents it can put to work." He framed the collective shift as moving from traditional notions of security toward "safety" — letting AI run at speed within a business while keeping a human in control.

What this means for technologists, regulators, and procurement leaders

  • Technologists and security teams: Teams will be dealing with an expanded toolset that combines pre-deployment adversarial testing and post-deployment observability inside a single vendor platform. Security testing that "does not reach the model layer or the agent’s reasoning process" is explicitly identified as a gap these products aim to fill.
  • Policymakers and regulators: The announcements signal a demand for auditable records and runtime controls that can answer questions about agent behavior — the exact exchange Kurtz referenced when discussing boards and regulators.
  • Affected enterprises and procurement leaders: Buyers should expect these capabilities to become generally available in CrowdStrike’s fourth quarter of fiscal 2027 and to be delivered as integrated Falcon platform features, subject to the acquisitions closing and contractual earn-outs tied to stock issuance over time.

The moves stitch together three stages of AI security the company named: pre-deployment adversarial testing (Dreadnode), post-deployment observability and explainability (Fiddler/Falcon Observe), and runtime human controls (Falcon Guardian and the AI Kill Switch). CrowdStrike positions that trio as a response to software agents that "can hold valid credentials and approved tools yet still make bad decisions, ignore instructions or claim work it never completed." Both products are slated for general availability in the company’s fiscal fourth quarter of 2027, with closing subject to routine approvals — the immediate questions are whether the integrations will operate as a cohesive workflow and how customers and auditors will adopt the new runtime and record-keeping controls.

Source: https://cyberscoop.com/crowdstrike-acquires-fiddler-dreadnode-ai-security/

Ai SecurityArtificial IntelligenceCrowdstrikeEmerging ThreatsEuropeMachine LearningAcquisitionsFiddler AIDreadnode
Related Intelligence

Continue Reading

Network equipment rack with a blurred security device in a clean-room setting.

Barracuda Vulnerabilities Expose Path to Root Access

Barracuda has uncovered two critical vulnerabilities that can be exploited together to grant an attacker root access to a vulnerable device - but only if they have a foothold in the administrative interface. This chained attack path could lead to full device compromise, making it a serious threat to security.

Analyst 207
Security team engineers and analysts collaborate in a brightly lit operations center surrounded by computer workstations…

Gartner Warns of SOC Shifts as AI Agents Assume Alert Handling

Get ready for a seismic shift in security operations centers (SOCs): by 2028, teams will have 50% more engineers than analysts, thanks to AI agents taking over alert handling. This structural change marks the end of alert processing as the SOC's primary function, empowering teams to focus on high-value tasks.

Analyst 207
Network appliance with visible front panel and lights on a plain surface.

Barracuda Discloses Flaws Enabling Root Access to Devices

Beware: two newly discovered vulnerabilities in Barracuda devices could give attackers the keys to the kingdom, allowing them to gain complete control over affected appliances if they can get their hands on administrative access. Patching is crucial to prevent these flaws, tracked as CVE-2026-116606 and CVE-2026-111560, from putting your devices at risk.

Analyst 207
Technicians monitor industrial control systems in a room with screens and workstations.

Machine Learning Enhances Network Anomaly Detection in Industrial Control Systems

As industrial control systems expand, a staggering 50% of respondents have boosted their inventory and visibility tools - highlighting the crucial need for cutting-edge solutions like Kaspersky's Machine Learning Event Processor to safeguard networks. Effective asset discovery is foundational to this security, but incomplete inventories remain a pressing challenge.

Analyst 207