CrowdStrike Acquires Fiddler and Dreadnode for $495 Million
CrowdStrike has announced agreements to acquire AI agent observability firm Fiddler AI and offensive AI security testing company Dreadnode.
Radwan AbdulhadiEditor and technology writer
Acquisitions Overview and Financial Terms
Cybersecurity giant CrowdStrike announced agreements to acquire AI agent observability firm Fiddler AI and AI security testing company Dreadnode in deals reportedly worth a combined $495 million, according to information covered by SecurityWeek.
While CrowdStrike did not officially disclose the financial terms of either transaction, reporting from The Wall Street Journal indicated that the company is paying roughly $400 million for Fiddler and approximately $95 million for Dreadnode.
CrowdStrike stated that both purchases will be funded mostly in cash, with a portion paid in stock subject to vesting conditions. The transactions are slated to close during the fourth quarter of CrowdStrike’s fiscal year 2027, which concludes on January 31, 2027.
Fiddler AI and Falcon Observe Integration
Founded in 2018 and headquartered in Palo Alto, California, Fiddler AI brings specialized capabilities in monitoring AI agents and explaining their decision-making processes. Earlier in January, the company announced a $30 million Series C funding round that brought its cumulative funding total to $100 million.
Following the acquisition, CrowdStrike plans to commercialize the technology under the name Falcon Observe. According to CrowdStrike, Fiddler will provide pre-deployment evaluation of agents, trace reasoning steps and tool calls, detect behavioral drift and hallucinations in production environments, log agent activity for compliance audits, and monitor token usage and overall spending.
Dreadnode and Cyber Superintelligence Lab
Dreadnode, founded in 2023, focuses on developing offensive AI security tools and previously secured $14 million in Series A funding in early 2025.
The startup's platform allows users to describe testing goals in plain language, subsequently executing over 100 known AI attack strategies. These strategies include jailbreaks, prompt injection, multi-turn interactions, and agent-specific attacks targeting AI models, reasoning loops, applications, and MCP servers.
Findings generated by Dreadnode's tools are ranked by severity and mapped against established frameworks such as the OWASP Top 10 for LLMs, MITRE ATLAS, and the NIST AI RMF. These outputs are then converted into policy recommendations for CrowdStrike’s Falcon Guardian AI detection and response product. The Dreadnode team, headed by CEO Brad Palm, will integrate into CrowdStrike’s Cyber Superintelligence Lab, with Dreadnode-based testing features expected to reach general availability in the fourth quarter of fiscal 2027.
Falcon Guardian AI Kill Switch and Corporate Context
Alongside the announcements of the Fiddler and Dreadnode transactions, CrowdStrike introduced a new AI Kill Switch feature within Falcon Guardian. This feature empowers authorized administrators to immediately halt a misbehaving AI agent, block it from restarting, and sever its network connections.
The latest deals extend CrowdStrike's active acquisition strategy within the security sector over the past year. Notable prior transactions include plans to purchase identity security firm SGNL and browser security company Seraphic, alongside an agreement to acquire AI security firm Pangea.
Sources
- SecurityWeekCrowdStrike Reportedly Paying $495 Million for AI Security Firms Fiddler, Dreadnode
Continue chronologically
Related stories
Chinese Hackers Use ARTEX AI in Attacks on 200 Orgs
Chinese hackers leveraged the open-source ARTEX AI penetration-testing framework in automated global attacks targeting over 200 organizations.
ARTEX AI and Claude Agents Used in South Korean Bank Attacks
A Chinese hacker used the ARTEX AI penetration testing suite and Claude agents to target multiple South Korean banks, exposing client data and system outages.
Chinese Hackers Exploited Low-Severity ESXi Logging Flaw as Zero-Day
CISA warns that China-nexus threat actor Warp Panda exploited a low-severity VMware ESXi logging flaw, tracked as CVE-2026-41709, as a zero-day.
Ransomware Developer Sentenced Amid New AI Security Threats
A major ransomware developer receives a 13-year prison sentence as researchers uncover new AI-driven vulnerabilities including Plugin4Shell and SAP flaws.
