CrowdStrike Acquires Fiddler and Dreadnode: Buyer Guide

CrowdStrike used its Fal.Con Europe event in Barcelona on 3 November 2026 to announce two more acquisitions: Fiddler, which monitors and explains how AI agents behave, and Dreadnode, which tests AI models, applications and agents for weaknesses before they ship.

Each deal on its own is a capability purchase. Read alongside Pangea, which CrowdStrike announced in September 2025 to secure prompts and agent interactions, the two deals describe a specific bet: that buyers will want to test, enforce and observe AI from the same platform that already runs their endpoint, identity and cloud security. For anyone evaluating the AI Security market, that bet should be tested rather than taken on trust.

What happened?

According to CrowdStrike's announcement, it has signed a definitive agreement to acquire Fiddler. The price will be paid predominantly in cash, with a portion in stock subject to vesting conditions. CrowdStrike expects the deal to close in the fourth quarter of its fiscal 2027, which ends on 31 January 2027.

CrowdStrike describes Dreadnode as a proposed acquisition and has not given a closing timeline.

CrowdStrike did not disclose what it is paying. The Wall Street Journal reported a combined figure of about $495 million, roughly $400 million for Fiddler and $95 million for Dreadnode, according to SecurityWeek. CrowdStrike has not confirmed those numbers.

The two deals follow CrowdStrike's January agreements to buy SGNL (identity) and Seraphic (enterprise browser security). CrowdStrike has now made four acquisitions this year, outside its core endpoint business.

What do Fiddler and Dreadnode do?

Fiddler was founded in 2018 and had raised about $100 million, including a $30 million Series C in January, per SecurityWeek. Under CrowdStrike it becomes Falcon Observe, due to be generally available in Q4 FY27. CrowdStrike says it will let teams compare prompts, models and configurations before deployment, then trace agents' decisions across multi-agent workflows and flag behavioural drift once they're live. The company says it will connect agent behaviour to Falcon's endpoint, identity, cloud and runtime telemetry. It names support for OpenTelemetry, LangGraph, Amazon Bedrock, AWS Strands and Google ADK.

"Fiddler is the flight recorder for every agent: the observability to explain exactly what an agent did and why." George Kurtz, CEO, CrowdStrike

Dreadnode was founded in 2023 and raised a $14 million Series A in 2025. Futurum Group reports it was started by former AI red-team researchers from NVIDIA and NetSPI. CrowdStrike says the product runs more than 50 attack techniques against AI models, applications and agents. It maps findings to the OWASP Top 10 for LLMs, OWASP's agentic risk list, MITRE ATLAS and the NIST AI RMF, and those findings will feed Falcon Guardian as policy recommendations.

The label matters here. Dreadnode does AI red teaming, meaning it tests AI systems. That's a different job from AI-driven penetration testing, where AI is used to attack conventional infrastructure. If you're scoping either, check which one a vendor means.

What happens next?

Confirmed so far: Fiddler becomes Falcon Observe, both capabilities are slated for general availability in Q4 FY27, and Dreadnode's testing will feed Falcon Guardian policy.

The announcements do not specify:

whether Fiddler and Dreadnode will remain available to customers who don't run Falcon
how either will be priced or packaged
what happens to Fiddler's monitoring use cases outside security, given its tooling has historically served teams that build and run models
when the Dreadnode deal is expected to close

How does this change the AI Security landscape?

CrowdStrike isn't the first large security vendor to buy its way in. Palo Alto Networks (Protect AI), SentinelOne (Prompt Security), Check Point (Lakera) and Zscaler (SPLX) all acquired AI security startups in 2025.

What's different is coverage. CrowdStrike now claims all three stages of the AI lifecycle: Dreadnode tests before release, Falcon Guardian and the Pangea technology enforce at runtime, and Fiddler explains what happened afterwards. Futurum's Fernando Montenegro describes it as "a loop, not three products", with test findings becoming runtime policy and traces showing whether that policy held.

For independent AI security vendors, the competition is increasingly a bundle. That won't settle the market on its own. It moves the burden to evidence: depth of testing, framework coverage and how fast findings turn into controls.

It also raises a question we'll keep watching. Agent observability overlaps heavily with the application performance and MLOps tooling that engineering teams already buy. Is it becoming a security purchase, or will it stay with the AI platform team and integrate with security?

What should security teams watch?

The case for buying AI security from your existing platform is real. An agent action linked to the identity it used and the endpoint it ran on is more useful than an isolated alert, and fewer consoles means fewer gaps. The case for caution is equally concrete. Neither capability is generally available yet, one deal hasn't closed, and your agents may be built on frameworks that aren't on the supported list.

If you're evaluating AI security in the next two quarters, put these in your bake-off:

Run the loop end to end. Ask the vendor to take a test finding, turn it into an enforced runtime policy, and show the trace proving it worked, on an agent built with your own stack.
Check framework coverage. List the agent frameworks and model providers you use, and confirm each one is supported today, not on a roadmap.
Test what "stop" means. As Futurum notes, "halting an agent's process is not the same as revoking its authority." Ask whether a kill action also removes the agent's credentials and access.
Separate platform from product. Ask what can be bought standalone, what requires Falcon, and how pricing works.
Benchmark against a specialist. Run the same attack set and the same agents through an independent AI security vendor before deciding the bundle is good enough.

The takeaway

CrowdStrike is buying the argument that AI security belongs on the platform, and with Fiddler and Dreadnode it can now tell a complete lifecycle story. Most of that story ships in early 2027, though, and the parts that matter most to buyers (coverage, packaging, and whether a kill switch actually removes access) are still to be shown. Judge it on what you can run, not on the diagram.

Follow the story: see the AI Security category on Picari and follow Picari on LinkedIn for the next round of deals.

Sources

CrowdStrike, "CrowdStrike to Acquire Fiddler to Deliver Agent Observability for AI Trust", 3 Nov 2026. ir.crowdstrike.com
CrowdStrike blog, "CrowdStrike to Acquire Fiddler to Deliver Falcon Observe for AI Agent Observability", 3 Nov 2026. crowdstrike.com
CrowdStrike blog, "CrowdStrike to Acquire Dreadnode", 3 Nov 2026. crowdstrike.com
CrowdStrike blog, "CrowdStrike to Acquire Pangea to Secure Enterprise AI Use and Development", 15 Sep 2025. crowdstrike.com
SecurityWeek, "CrowdStrike Reportedly Paying $495 Million for AI Security Firms Fiddler, Dreadnode", 3 Nov 2026. securityweek.com
CyberScoop, "CrowdStrike moves to acquire Fiddler and Dreadnode, adding AI observability and testing to its security platform", 3 Nov 2026. cyberscoop.com
Futurum Group, "CrowdStrike Buys Fiddler and Dreadnode to Test, Watch, and Stop AI Agents", 4 Nov 2026. futurumgroup.com
CrowdStrike / Business Wire, "CrowdStrike to Acquire SGNL to Transform Identity Security for the AI Era", 7 Jan 2026. businesswire.com
CrowdStrike / Business Wire, "CrowdStrike to Acquire Seraphic Turning Any Browser into a Secure Enterprise Browser", 13 Jan 2026. businesswire.com

CrowdStrike Acquires Fiddler and Dreadnode: What Its AI Security Stack Means for Buyers