CrowdStrike expanded its CrowdStrike AI security lineup on Tuesday by agreeing to acquire startups Fiddler AI and Dreadnode, alongside releasing an emergency kill switch for autonomous agents. Announced at the Fal.Con Europe conference in Barcelona, the twin purchases aim to help corporate security teams monitor, test and contain self-directed software across their digital networks.
Key points
- CrowdStrike is buying Fiddler AI for agent tracking and Dreadnode for adversarial testing, paying predominantly in cash alongside vesting stock.
- Both acquisitions will close in the fourth quarter of CrowdStrike’s fiscal 2027, with products folding into the Falcon platform.
- The company released an immediate AI Kill Switch in Falcon Guardian to disconnect and terminate malfunctioning autonomous agents.
- Falcon sensors will also deploy inside virtual machines hosting Anthropic’s Claude Cowork agents.
Agent observability with Fiddler
The deal for Fiddler gives CrowdStrike dedicated telemetry tools for tracking the step-by-step reasoning of automated models. The startup builds software that records what an agent does and why, helping security analysts reconstruct decisions if an automated workflow executes an unexpected instruction.
CrowdStrike plans to rebrand the software as Falcon Observe within its core platform, according to its Fiddler acquisition release. The release is scheduled for the fourth quarter of fiscal 2027. CrowdStrike said the underlying evaluation models can cut the computational expense of auditing agent behaviour by up to 98% compared with general-purpose frontier models.
The central problem Fiddler addresses is corporate liability and compliance. As companies deploy enterprise AI agents to manipulate internal databases and execute administrative tasks, audit trails become mandatory.
“Fiddler is the flight recorder for every agent: the observability to explain exactly what an agent did and why,” said George Kurtz, CrowdStrike’s chief executive and founder. He argued that telling a regulator or board that an unmonitored model caused an operational error is no longer acceptable for corporate governance.
Automated red-teaming from Dreadnode
While Fiddler tracks active software, Dreadnode focuses on finding vulnerabilities before automated systems reach production. Dreadnode tests models, agent reasoning loops, connected applications and Model Context Protocol servers against more than 100 known offensive strategies, including prompt injections and jailbreaks.
Dreadnode correlates identified vulnerabilities against established industry benchmarks, referencing NIST’s AI Risk Management Framework alongside the MITRE ATLAS matrix and the OWASP catalogue of critical hazards for large language models. CrowdStrike stated in its Dreadnode announcement that the startup’s team will join CrowdStrike’s Cyber Superintelligence Lab.
“AI fails in ways traditional testing was never designed to catch, and the people best equipped to find those failures think like attackers,” said Brad Palm, Dreadnode’s chief executive.
Dreadnode’s security auditing tools are expected to reach the Falcon platform during the fourth quarter of fiscal 2027, on the same timeline as the Fiddler integration. Financial terms for both private acquisitions were not disclosed, though CrowdStrike indicated the transactions consist mostly of cash with restricted stock subject to vesting conditions.
The emergency kill switch and Claude integration
Alongside the long-term acquisitions, CrowdStrike launched a defensive control that enterprise administrators can use immediately. The company introduced an AI Kill Switch within its Falcon Guardian product line.
The mechanism lets a security officer stop an active agent if its behaviour deviates from expected operating parameters. Triggering the switch terminates execution on the spot, revokes network access privileges and blocks the agent from restarting. Every termination command produces an immutable log entry for incident investigation. CrowdStrike said the sensor blocks rogue software at the network gateway today, with endpoint-level blocking planned soon.
At the same time, CrowdStrike disclosed an endpoint defensive partnership with Anthropic. As businesses implement coding assistants and autonomous workflow tools, protecting developer runtime environments has grown urgent. Recent engineering updates such as Anthropic message threads have made agent responses faster, increasing the pace at which autonomous instructions execute.
Under the new deployment, Falcon Guardian sensors run directly inside the virtual machines where Anthropic’s Claude Cowork agents execute code. The integration operates as a beta programme on macOS, with Windows support arriving later in November, CrowdStrike confirmed in a technical blog post.
CrowdStrike’s enterprise AI defence expansion
The announcements in Barcelona follow an aggressive push by CrowdStrike to reposition itself for autonomous computing risks. In September, the security company added OpenAI tools into its detection platform to automate multi-agent breach investigations. In October, CrowdStrike analysts attributed intrusions at South Korean banks to attackers using generative tools to bypass perimeter filters.
During the opening sessions of the Fal.Con Europe conference on Monday, CrowdStrike announced collaborative infrastructure projects with Dell for its Nvidia-based AI Factory, alongside partnership agreements with Dynatrace and CoreWeave. It also expanded its Project QuiltWorks initiative across Europe, signing 15 regional telecommunications and security partners, including BT, Deutsche Telekom Security, Orange Cyberdefense and Telefónica, to deploy frontier models against network intrusions.
Investor and industry capital has poured into defensive controls for machine learning over the past year, mirrored by dedicated venture funds such as Auriga Cyber Ventures II targeting automated threats. CrowdStrike’s purchases show established cybersecurity vendors prefer acquiring specialist startups over building observability and red-teaming software from scratch.
Both transactions remain subject to standard closing procedures. The conference in Barcelona concludes on Wednesday, with early access programmes for Falcon Observe and Dreadnode testing scheduled to begin for selected enterprise customers early next year.
