CrowdStrike buys two AI security startups and launches a kill switch for rogue agents

CrowdStrike announced Monday at its Fal.Con Europe conference in Barcelona that it has signed definitive agreements to acquire two AI security startups, Fiddler AI and Dreadnode, in a combined deal reported at roughly $495 million — about $400 million for Fiddler and $95 million for Dreadnode, according to The Wall Street Journal. CrowdStrike has not confirmed the individual price breakdown.

The acquisitions target a problem that's grown alongside the rapid rollout of AI agents inside enterprises: most companies now have autonomous AI systems making decisions and taking actions across their networks, but few have a reliable way to monitor what those agents are actually doing, verify they're behaving as intended, or shut one down quickly if it starts misbehaving. That gap has become a boardroom concern as agentic AI deployments move from pilot projects to production systems with real access to sensitive data and critical workflows.

Fiddler AI, which will be rebranded as Falcon Observe, specializes in agent observability and explainability — giving security teams a traceable record of what an AI agent did, why, and whether its behavior matches what it was supposed to do. CrowdStrike CEO George Kurtz described it as "the flight recorder for every agent." Dreadnode takes the opposite approach: it runs automated adversarial testing against AI models and agents before they ever go live, simulating more than 100 known attack techniques including jailbreaks and prompt injection attacks, to find weaknesses before an actual attacker does.

The same day, CrowdStrike also unveiled an AI Kill Switch feature inside its Falcon Guardian product. The feature lets security teams halt a rogue or compromised AI agent wherever it's currently running, block it from relaunching, and sever its access to the broader corporate network — functioning, for AI agents, roughly the way an incident responder isolates a compromised laptop today. The capability currently operates through CrowdStrike's AI Gateway.

Both acquisitions are expected to close in CrowdStrike's fourth fiscal quarter of FY27, subject to standard regulatory approval, with Falcon Observe expected to reach general availability on a similar timeline. The deals position CrowdStrike against a growing field of security vendors racing to build tooling specifically for the agentic AI era, treating AI agent misbehavior and compromise as a new, distinct category of threat rather than an extension of traditional endpoint or cloud security.