CrowdStrike AI acquisitions took a major step forward on Tuesday, November 3, 2026, as the cybersecurity company announced deals to buy two artificial intelligence security startups, Fiddler AI and Dreadnode. Announced at Fal.Con Europe 2026 in Barcelona, the deals will extend CrowdStrike's Falcon platform into securing AI agents, the systems now spreading through corporate networks, rather than only the computers and servers they run on.

The Wall Street Journal reported a combined value of about $495 million, roughly $400 million for Fiddler AI and $95 million for Dreadnode, paid predominantly in cash with some stock subject to vesting. CrowdStrike itself did not disclose the prices. Both deals are expected to close in CrowdStrike's fourth quarter of fiscal 2027, subject to customary closing conditions.

Key Points

• CrowdStrike announced on Tuesday, November 3, 2026, at Fal.Con Europe 2026 in Barcelona, that it has signed definitive agreements to acquire Fiddler AI and Dreadnode.
• The Wall Street Journal reported a combined value of about $495 million, roughly $400 million for Fiddler and $95 million for Dreadnode, paid mainly in cash.
• Fiddler AI, founded in 2018 in Palo Alto, focuses on observability and explainability of AI agents and will become Falcon Observe, expected to be generally available in CrowdStrike's fourth quarter of fiscal 2027.
• Dreadnode, founded in 2023, specialises in automated security testing of AI models, applications and agents before deployment, including jailbreak and prompt-injection tests.
• Both deals are expected to close in CrowdStrike's fourth quarter of fiscal 2027, subject to customary conditions.

What Happened

CrowdStrike announced the two acquisitions together at its European customer conference, framing them as a single strategic push. Fiddler AI will help organisations see what their AI agents are doing, why they made a particular decision and where something went wrong. Dreadnode will attack those systems first, in a controlled way, before they are released to real users.

The distinction matters because AI agents differ from traditional software. A conventional application follows a fixed set of instructions, while an agent can plan, use tools, call other systems and adapt as it works. That flexibility makes agents powerful, but also harder to audit: a company may know that an agent completed a task, yet struggle to explain the steps it took, the data it touched or the services it contacted.

Fiddler AI built its reputation on observability and explainability for machine learning systems. Under CrowdStrike, it will become Falcon Observe. Dreadnode focuses on automated testing before deployment, including tests designed to jailbreak a model or slip a malicious instruction past its safeguards through prompt injection.

Background and Context

The deals arrive as security teams are asked to protect a fast-growing population of AI agents. Companies are deploying agents to handle customer support, draft documents, query internal databases, write and review code, and automate routine business processes. Each agent typically has access to sensitive data and to tools that can change records, send messages or move money, raising the stakes if an agent is manipulated or makes a mistake.

That expansion has created risks that traditional endpoint security was not built to cover. An endpoint product can protect a laptop or a server, but an agent's failure may occur in the reasoning of a model, in a prompt supplied by a user, or in data retrieved from an external source. Vendors have therefore begun adding agent-specific controls, including monitoring of agent behaviour, testing before release and limits on what an agent may do.

CrowdStrike AI Acquisitions Reshape the Falcon Platform

The effect of the CrowdStrike AI acquisitions will depend on how tightly the new tools are integrated into Falcon. Observability alone can generate large volumes of logs, but its value rises when it is connected to detection and response, so an unusual agent action can be flagged, investigated and stopped in the same workflow that already handles malware or intrusions.

Falcon Observe is expected to give security teams that visibility, tracing a decision back to its inputs. Dreadnode's testing is designed to find weaknesses before deployment, when fixing them is cheaper and safer. Together, the two capabilities cover the lifecycle of an agent: test it before release, watch it while it runs, and explain what happened if something goes wrong.

Reactions and What Analysts Will Watch

CrowdStrike did not disclose the purchase prices, and the reported figures rest on the Wall Street Journal's reporting. Analysts and customers are likely to watch whether Fiddler and Dreadnode continue to work for customers who do not use Falcon, whether observability tools can keep pace with agents without flooding analysts with alerts, and whether the new capabilities are bundled into existing Falcon subscriptions or sold separately.

Why It Matters

The deals matter because AI agents are moving from experiments to everyday business tools, and their security problems differ from those of earlier software. An agent tricked by a malicious prompt might disclose confidential information, follow instructions hidden in a document it was asked to read, or take an action its owner never intended. Those risks cannot be fixed by patching an operating system or blocking a malicious file.

Observability and pre-deployment testing address two pressing gaps. Testing can catch prompt-injection and jailbreak weaknesses before an agent reaches customers. Observability can reveal after deployment whether an agent is behaving as intended, drifting from its instructions or accessing data it should not touch. For regulated industries such as finance and healthcare, that audit trail may also become a compliance requirement.

What Happens Next

Both deals are expected to close in CrowdStrike's fourth quarter of fiscal 2027, subject to customary conditions. Until then, the companies are expected to operate as before, with no immediate change for existing customers. After closing, attention will turn to product integration and the launch of Falcon Observe, with further details possibly emerging in earnings calls or regulatory filings.

For organisations already deploying AI agents, the announcement is a prompt to review their own controls: which agents can access sensitive data, what they may do without human approval, how their actions are logged, and how they are tested before release. Those questions remain relevant regardless of which vendor ultimately supplies the tools.

Related coverage: Chainalysis breach exposes customer names and emails in AI agent attack, Claude Code backdoor hit up to 5,000 Cursor users, Microsoft warns.

Frequently Asked Questions

What did CrowdStrike announce on November 3, 2026?

CrowdStrike announced at Fal.Con Europe 2026 in Barcelona that it had signed separate definitive agreements to acquire Fiddler AI and Dreadnode, extending Falcon into securing AI agents.

How much are the deals worth?

The Wall Street Journal reported about $495 million combined, roughly $400 million for Fiddler AI and $95 million for Dreadnode. CrowdStrike itself did not disclose the prices.

What does Fiddler AI do?

Fiddler AI, founded in 2018 in Palo Alto, focuses on observability and explainability of AI agents. It will become Falcon Observe, expected to be generally available in CrowdStrike's fourth quarter of fiscal 2027.

What does Dreadnode do?

Dreadnode, founded in 2023, specialises in automated security testing of AI models, applications and agents before deployment, including jailbreak and prompt-injection tests.

When will the deals close?

Both deals are expected to close in CrowdStrike's fourth quarter of fiscal 2027, subject to customary conditions.