CrowdStrike Buys Fiddler and Dreadnode: Two Deals, No Price

CrowdStrike buys Fiddler AI and Dreadnode, it announced on Nov. 3 at its Fal.Con Europe conference in Barcelona. Fiddler AI, which watches what AI agents do, and Dreadnode, which attacks AI systems on purpose to find their weak spots before launch. Most headlines added them together and said "nearly $500 million." That number didn't come from CrowdStrike.

CrowdStrike is the endpoint-security company behind the Falcon platform. TechCrunch's report says the company is paying around $400 million for Fiddler and about $95 million for Dreadnode, "according to The Wall Street Journal." We haven't seen the Journal piece itself. Both of CrowdStrike's releases say only that the price is "contemplated to be paid predominantly in cash" with a portion in stock "subject to vesting conditions."

CrowdStrike's announcement of the Dreadnode deal on X, Nov. 3, 2026 (@CrowdStrike)

View on X

Two deals that do different jobs

Fiddler is for the agent you already built. According to CrowdStrike's Fiddler release, it will be sold as Falcon Observe, with pre-deployment evaluation, tracing of decisions and tool calls, drift and hallucination detection, and token-spend tracking. It instruments agents through OpenTelemetry and lists support for LangGraph, Amazon Bedrock, AWS Strands and Google ADK. CEO George Kurtz calls it "the flight recorder for every agent."

Dreadnode is for the agent you haven't shipped. CrowdStrike says it will run "more than 100 known AI attack strategies," including jailbreaks, prompt injection and multi-turn attacks, against models, agent reasoning loops, applications and MCP servers, then map findings to OWASP's LLM and agentic lists, MITRE ATLAS and NIST's AI Risk Management Framework. Its findings will feed Falcon Guardian as policy recommendations, and the Dreadnode team will join CrowdStrike's Cyber Superintelligence Lab.

One detail from the coverage doesn't match the release. TechCrunch writes that Dreadnode "will be integrated into the Falcon Guardian product." CrowdStrike's wording is that it will extend the Falcon platform, with testing results feeding Guardian. That's a looser link than a merger of products.

Nothing here is closed or on sale

Both releases say each deal is expected to close "during CrowdStrike's fourth quarter of FY27, subject to customary closing conditions." Both new products, Falcon Observe and Automated AI Security Testing, are scheduled to be generally available in the same quarter.

CrowdStrike's fiscal year ends Jan. 31, going by its fourth-quarter results arriving in March, as in 2020. Our inference is that Q4 FY27 means roughly November 2026 to January 2027. If so, the companies can't be integrated and sold before the closing it's waiting on, and a customer shouldn't expect Observe or the testing product to arrive earlier than that window.

Fiddler's CEO Krishna Gade wrote in his post that for existing customers, the needs behind Fiddler "remain central to our mission," across predictive models, generative AI and agents. It gives no word on pricing, contracts or migration.

What the numbers do and don't show

The release's most quotable claim is that Fiddler can "reduce evaluation costs by up to 98% using purpose-built models without external LLM calls." The release gives no workload, baseline or accuracy figure, so it's a ceiling from the company, not a result.

TechCrunch cites PitchBook for the startups' funding: about $99 million raised by Fiddler, founded in 2018, and $14 million by Dreadnode, founded in 2023. Against the reported prices, that works out by our arithmetic to roughly 4 times the money raised for Fiddler and nearly 7 times for Dreadnode. Both depend on third-party figures.

The product you can buy today

The acquisitions share the stage with Falcon Guardian, a separate launch. CrowdStrike says Guardian has been generally available since September 2026 and now adds an AI Kill Switch that "terminates unauthorized agents in real time first at the Gateway, and soon on the endpoint." The word "soon" matters: the endpoint half isn't there yet.

Guardian's agent-level hooks cover Claude Code, OpenAI Codex, GitHub Copilot, Microsoft 365 Copilot, OpenCode and Cursor, and CrowdStrike says it will run its sensor inside Claude Cowork's virtual machine in partnership with Anthropic. Network inspection on the endpoint is generally available on Windows, with Mac in early access.

Which half is a roadmap

Treat the three announcements as three different statuses. Guardian is shipping and has caveats. Fiddler and Dreadnode are signed agreements with a product name and a quarter attached. If you're evaluating agent security this winter, ask CrowdStrike which features are in the Guardian you can license now, and get the rest in writing with a date.

Source: CrowdStrike

crowdstrike fiddler ai dreadnode ai agent security falcon guardian

AI

About the author

AI Briefing Daily Editorial. The editorial desk of AI Briefing Daily, an independent publication covering artificial intelligence. Every story is researched against primary sources, checked by hand and reviewed by a person before publication.