CrowdStrike to buy Fiddler AI, Dreadnode

CrowdStrike said on Nov. 3, 2026, that it has agreed to acquire AI security startups Fiddler AI and Dreadnode in pending deals it says will extend Falcon across the AI agent lifecycle. An official Fiddler announcement was not included in the supplied materials, but secondary reporting said the company made agreements to buy both startups and framed the move as a push deeper into testing, observability and production monitoring for AI agents.

The company did not disclose financial terms for either transaction. Secondary reporting citing The Wall Street Journal said CrowdStrike was expected to pay about $495 million combined, with roughly $400 million for Fiddler AI and about $95 million for Dreadnode. CrowdStrike has not confirmed those figures in its announcements, according to the reports.

Secondary reporting also said the purchase price is contemplated to be paid predominantly in cash, with a stock portion subject to vesting conditions, and that both acquisitions are expected to close in CrowdStrike’s fiscal fourth quarter of 2027, subject to customary closing conditions. The announcements were made at Fal.Con Europe 2026 in Barcelona, according to company-linked coverage.

What does CrowdStrike plan to add to Falcon?

CrowdStrike plans to add two different layers of AI security to Falcon: Fiddler AI’s agent observability and explainability tools, and Dreadnode’s automated security testing. Together, the acquisitions are meant to extend the platform from runtime protection into pre-deployment validation and ongoing monitoring.

In CrowdStrike’s framing, that means customers will be able to test AI systems before they go into production, trace decisions and tool calls, detect behavioral drift and hallucinations, and keep records that can support governance and audits. CrowdStrike said it intends to make Fiddler’s technology available as Falcon Observe, while Dreadnode will feed into Falcon Guardian and related policy recommendations.

CrowdStrike also said Dreadnode’s testing data will strengthen its SafeMind models, and that its Falcon Observe offering will support OpenTelemetry as well as agent frameworks including LangGraph, Amazon Bedrock, AWS Strands and Google ADK. SecurityWeek reported that Fiddler will also add token-usage and spending tracking.

How do Fiddler AI and Dreadnode differ?

Fiddler AI focuses on monitoring and explaining AI-agent behavior, while Dreadnode focuses on offensive-style testing that tries to expose weaknesses before deployment. That gives CrowdStrike two complementary products: one for visibility into live systems and one for pre-launch validation.

Fiddler is described as providing AI-agent observability and explainability, including monitoring agent behavior and tracing decisions and actions in production. CyberScoop said Fiddler works with common agent frameworks including LangGraph, Amazon Bedrock and Google ADK.

Dreadnode, by contrast, is built around automated security testing. CrowdStrike said the product tests AI models, applications and agents with known attack techniques to find weaknesses before deployment. Users can describe what they want to test in plain language, and then Dreadnode runs attack techniques that CrowdStrike said include more than 50 methods such as jailbreaks, prompt injection, multi-turn attacks and agent-specific attacks.

CrowdStrike said Dreadnode maps findings to frameworks and standards including OWASP Top 10 for LLMs, OWASP Agentic Security, MITRE ATLAS and NIST AI RMF. It also said the system produces a single risk picture with total findings, attack success rates, severity breakdowns, finding outcomes and deeper risk metrics, plus an exportable report intended to support go/no-go decisions.

Why is CrowdStrike making these deals now?

CrowdStrike is broadening its AI security stack as enterprises move from experimenting with AI to deploying more autonomous agents in production. The company said it acquired Pangea last year to secure enterprise AI use and development, and it said last month it introduced Falcon Guardian for runtime protection of AI agents, along with a new AI gateway and AI security services.

The new acquisitions fit that sequence. CrowdStrike said the Dreadnode deal brings automated AI security testing into Falcon so customers can validate AI systems before production, while Fiddler extends monitoring into production once agents are live. CSO Online said CrowdStrike plans to integrate both capabilities into Falcon and target general availability in the fourth quarter of fiscal 2027.

SecurityWeek reported that the Dreadnode team, led by CEO Brad Palm, will join CrowdStrike’s Cyber Superintelligence Lab. It also reported that Fiddler was founded in 2018 in Palo Alto, California, and raised $30 million in a January Series C round that brought total funding to $100 million. TechCrunch said Fiddler had raised about $99 million to date, according to PitchBook. SecurityWeek said Dreadnode was founded in 2023 and raised $14 million in early 2025; TechCrunch also reported it had raised $14 million so far.

What happens before the deals close?

Nothing changes immediately for customers beyond the announcement itself. These are pending acquisitions, and CrowdStrike said both transactions remain subject to customary closing conditions and are expected to close in fiscal Q4 2027.

Until then, the companies will remain separate. CrowdStrike’s announcements show a clear strategy to expand from runtime defense into the AI-agent lifecycle, from pre-deployment testing to production observability and policy guidance.