# CrowdStrike moves to acquire Fiddler and Dreadnode and launches an AI Kill Switch for agents

By Ivo Donker · 4 November 2026 — compiled with AI assistance (DeepSeek V4.1 Flash)
On 3 November 2026, during Fal.Con Europe 2026 in Barcelona, CrowdStrike (NASDAQ: CRWD) published three separate announcements: a press release about its planned acquisition of Fiddler AI, a separate press release about its planned acquisition of Dreadnode, and an investor-relations release via Business Wire titled "CrowdStrike Delivers AI Security and Safety for the Enterprise" about Falcon Guardian and a new AI Kill Switch. The three releases stand on their own: the Guardian release does mention the planned Fiddler acquisition, but not Dreadnode.

For teams that build and operate agents, the combination is relevant. On one hand, there is more visibility into what an agent actually does — observability, tracing and evaluation. On the other, there is a structured way to expose agent architectures to attacks before production, with findings that flow through into runtime policy. If you are already working on agent observability, you will recognise the same questions that come up in day-to-day practice: which decision did the agent take, on what basis, and can you explain that later? For the latter, see also the background piece on [agent observability: seeing what your agent did and why](https://community.llmnet.nl/en/agent-observability-zien-wat-je-agent-deed-en-waarom).

## Three announcements at Fal.Con Europe

The first announcement is the press release in which CrowdStrike says it has signed a definitive agreement to acquire Fiddler AI, described as "a leader in AI agent observability and explainability". The second is a separate press release about a definitive agreement to acquire Dreadnode, described as "a leader in Automated AI Security Testing". The third is the investor-relations release about Falcon Guardian and the AI Kill Switch.

That separation is not just a formality. It determines which promises belong to which product, and which parts still depend on an acquisition. The Guardian release refers to the planned Fiddler acquisition, but does not mention Dreadnode anywhere. Dreadnode is therefore a separate track with its own press release, even though, according to that release, Dreadnode findings are later meant to feed Falcon Guardian as policy recommendations.

## Fiddler becomes Falcon Observe

According to the Fiddler press release, Fiddler brings pre-deployment evaluation, continuous behavioural accountability and agent explainability to the Falcon platform. The positioning in the release is sharp: "Guardian secures agents from attack and misuse; Fiddler validates they behaved as intended." Fiddler will be sold as part of the Falcon platform under the name Falcon Observe, and is due to become generally available in Q4 FY27 — the fourth quarter of CrowdStrike's fiscal year 2027.

The same release contains a formulation that gets to the heart of why observability for agents differs from classic logging: "An agent can hold valid credentials and approved tools and still make unsupported decisions, ignore instructions, or claim work it never completed. They don't have to be compromised to create risk." An agent does not need to be hacked in order to cause damage. Valid credentials and approved tools are no guarantee that the behaviour is correct.

George Kurtz (CEO and founder of CrowdStrike): "Every company is deploying agents and asking the same thing: what are agents actually doing?" — In plain terms: the question is not whether agents exist in your environment, but whether you can reconstruct what they did.
George Kurtz: "When a regulator or your board asks what an agent did, saying 'the model did it' is not an answer. Fiddler is the flight recorder for every agent: the observability to explain exactly what an agent did and why." — In plain terms: the answer to an audit question has to trace back to concrete decisions and tool calls, not to a reference to the model.
Krishna Gade (CEO and co-founder of Fiddler): "We started Fiddler to help enterprises answer a fundamental question: can I trust what my AI agents are doing?" — In plain terms: trust here is a measurement question, not a feeling.

## What Falcon Observe is meant to do

The Fiddler press release lists the capabilities that are to fall under Falcon Observe. Pre-Deployment Evaluation measures agent accuracy, task completion and policy compliance across prompts, models and configurations. Agent Traceability follows decisions, reasoning paths and tool calls across the full agent hierarchy. Behavioural Accountability detects behavioural drift, hallucinations and unintended actions in production. Auditable Governance records decisions and actions across first-party, third-party and coding agents, as evidence for compliance and audits. AI Cost Control tracks token usage and spend, and can reduce evaluation costs by up to 98% by using purpose-built models without external LLM calls.

There is also Framework Support via OpenTelemetry with LangGraph, Amazon Bedrock, AWS Strands and Google ADK, plus Unified Falcon Telemetry for correlating with Falcon identity, cloud and runtime intelligence. That OpenTelemetry route is practical: if you already export traces, you can reuse that instrumentation instead of maintaining a parallel measurement system. An overview of what tools exist in this area is in the [overview of LLM observability tools](https://directory.llmnet.nl/en/llm-observability-tools).

The cost component deserves separate attention. Token and spend tracking per agent or per workflow is often the first thing to run out of hand, before anyone gets round to security. The same instrumentation you use to explain behaviour also produces the numbers that let you justify a limit. How to make such limits hard rather than advisory is covered in [enforcing hard cost limits: budget cap, quota and kill switch](https://api.llmnet.nl/en/harde-kostenlimieten-afdwingen-budgetcap-quota-en-kill-switch).

## Dreadnode: testing attacks before production

The Dreadnode press release describes a different goal: extending the Falcon platform to continuously test every AI model, application and agent for weaknesses before deployment. Dreadnode runs more than 100 known AI attack strategies against models, agent reasoning loops, applications and MCP servers, including jailbreaks, prompt injection and multi-turn and agent-specific attacks. You describe what you want to test in plain language. Automated AI Security Testing is due to become generally available in Q4 FY27.

Findings are ranked by severity and mapped to OWASP Top 10 for LLMs, OWASP Agentic Security (ASI01-ASI10), MITRE ATLAS and NIST AI RMF, with exportable reports for go/no-go decisions before deployment. There is also model and component scanning (models, model repositories, components) and human-in-the-loop review, in which operators reclassify findings, adjust severity and document their reasoning. The findings feed Falcon Guardian as policy recommendations, and the testing data strengthens CrowdStrike's SafeMind models. The Dreadnode team joins CrowdStrike's Cyber Superintelligence Lab.

George Kurtz: "Enterprises are deploying AI faster than they can prove it is secure. A model can be jailbroken, an agent can be manipulated, and most organizations have no way to find those flaws until the AI is already in production." — In plain terms: today, testing often happens only once the agent is already live and something has gone wrong.
Brad Palm (CEO of Dreadnode): "AI fails in ways traditional testing was never designed to catch, and the people best equipped to find those failures think like attackers." — In plain terms: classic acceptance tests do not cover this behaviour; you need adversarial testing.
How to set up such tests for your own LLM applications is covered in the guide on [red teaming and security testing for LLM applications](https://benchmark.llmnet.nl/en/red-teaming-en-veiligheidstests). The combination with observability is logical: red teaming tells you what can go wrong, observability tells you what actually happens. Without the first you miss scenarios; without the second you miss the deviations nobody predicted.

## From test finding to runtime policy

What ties the announcements together is the route from test result to enforcement. Findings from Dreadnode tests arrive in Falcon Guardian as policy recommendations. In concrete terms, that means a detected attack pattern does not disappear into a report, but can become a rule that is evaluated at runtime. Conversely, observability provides the evidence that a rule actually takes effect.

For your own architecture, that is a usable pattern regardless of these products. Describe per agent which actions are permitted, which tools it may call and which data it may read. Test those boundaries actively with attack scenarios. Then log every decision and every tool call together with its input, so that you can trace a deviation. The basis for the latter is in [prompt injection and jailbreaks explained](https://community.llmnet.nl/en/prompt-injection): anything an agent reads can be input that steers its behaviour.

That also applies to what an agent encounters along the way. If you are setting up agent security, it is wise to start from the assumption that any external text — a document, a web page, a response from an MCP server — can be attack input. See [agent security: everything your agent reads is attack input](https://radar.llmnet.nl/en/agent-security-augustus-2026). You see the same thinking at vendors that detect misuse of their own models, as described in [how OpenAI and Anthropic detect misuse of their models](https://nieuws.llmnet.nl/en/lab-misbruik-detectie-openai-anthropic). AI labs are scaling up their own defences too; read [OpenAI's new security sprint and higher bug bounties](https://nieuws.llmnet.nl/en/openai-security-sprint-bug-bounty) for that.

## The AI Kill Switch: gateway first, endpoint later

The investor-relations release contains the core of the new emergency stop: "AI Kill Switch: Terminates unauthorized agents in real time first at the Gateway, and soon on the endpoint, and blocks them from running again across the organization." No date is given for the endpoint variant. The AI Gateway is now generally available and included with Guardian; it routes AI traffic through a centralised gateway to inspect prompts and responses, monitor usage and enforce policy across managed and unmanaged devices. Guardian itself has been generally available since September 2026.

The order matters: gateway first, endpoint "soon". So no moment has been announced for enforcement on endpoints. Anyone who reads the announcement as "available everywhere now" is running ahead of the source. The product claim follows the IR text, not the social post. CrowdStrike's X post about the Kill Switch (x.com/CrowdStrike/status/2117537184903238032, 3 November 2026) presents it as terminating agents at the root, blocking relaunches and cutting network access. That is marketing copy; the formal claim is what the IR release states.

Michael Sentonas (president of CrowdStrike): "One control point isn't enough to stop that. It takes the agent, the network, and the endpoint, together." — In plain terms: the reason to enforce at multiple layers is that each control point on its own has blind spots.
The IR release underpins those multiple control points with a concrete argument: agent-level hooks see the prompt but miss the model's response; network-only approaches watch traffic but cannot stop the action, because the agent executes on the endpoint; and when an agent runs a local or open-weight model that never touches the network, network-only tools go blind. That is precisely the situation in which a kill switch is useful: not as a standalone button, but as the final piece of policy that is evaluated in several places.

If you build agents yourself, designing such an emergency stop is a task in its own right. Three questions help. Where can an agent still be stopped at all — at the call, at the tool, or at execution on the machine? Who is allowed to decide that an agent stops, and how is that decision logged? And what happens to tasks that were interrupted halfway? A kill switch that only terminates the process without leaving a trace makes it harder to determine what happened. For the building blocks, see also [enforcing hard cost limits: budget cap, quota and kill switch](https://api.llmnet.nl/en/harde-kostenlimieten-afdwingen-budgetcap-quota-en-kill-switch).

## The rest of Falcon Guardian

The IR release names more components of Falcon Guardian. Agent-Level Hooks enforce policy inside Claude Code, OpenAI Codex, GitHub Copilot, Microsoft 365 Copilot, OpenCode and Cursor. SafeMind-Powered Detection targets prompt injection, malicious instructions and personally identifiable information. AI Supply Chain Protection discovers malicious AI skills and MCP servers. There is an Anthropic integration that runs the Falcon sensor inside the Claude Cowork virtual machine, delivered in partnership with Anthropic. New are Endpoint Network Inspection (generally available for Windows, Mac in early access), Agentic Identity (identity-aware controls that will authorise what agents can access) and Cloud Expansion (cloud workloads, SaaS, virtualised agents including Claude Cowork, and cloud agent frameworks including AWS AgentCore).

For your own environment, Agentic Identity means the most tangible work: tokens and roles for agents should be as narrow as possible. Do not give an agent a credential that allows more than the task requires, and separate credentials per agent instead of sharing one broad key. That limits the impact when an agent is steered in the wrong direction, and it makes logs easier to read because you can see who did what.

## What the acquisitions cost (and what is not known)

CrowdStrike did not disclose a price. The transaction details are worded identically in both press releases: the purchase price is contemplated to be paid predominantly in cash and includes a portion delivered in stock subject to vesting conditions; each proposed acquisition is expected to close during CrowdStrike's fourth quarter of fiscal year 2027, subject to customary closing conditions. The deals are therefore not yet closed.

What is circulating is a media report. CyberScoop (Greg Otto, 3 November 2026) writes that a report in The Wall Street Journal listed Fiddler at $400 million and Dreadnode at $95 million. Those are amounts from that report, not from a CrowdStrike statement. Together that is roughly $495 million according to the WSJ report. If you cite this, it is worth passing on the provenance: according to The Wall Street Journal, as reported by CyberScoop.

Item | Status according to the sources | 

Fiddler price | $400 million according to The Wall Street Journal, as reported by CyberScoop; not disclosed by CrowdStrike | 

Dreadnode price | $95 million according to The Wall Street Journal, as reported by CyberScoop; not disclosed by CrowdStrike | 

Payment method | Predominantly cash, plus a portion in stock subject to vesting conditions | 

Expected closing | Fourth quarter of fiscal year 2027 (Q4 FY27), subject to customary conditions | 

Falcon Observe | Generally available in Q4 FY27 | 

Automated AI Security Testing | Generally available in Q4 FY27 | 

AI Kill Switch | First at the Gateway; "soon" on the endpoint, without a date | 

## When it closes

The expected closing of both acquisitions is CrowdStrike's fourth quarter of fiscal year 2027. That is the same period in which Falcon Observe and Automated AI Security Testing are due to be generally available. Until then they are proposed acquisitions: a definitive agreement has been signed, but the transactions have not closed and the customary closing conditions apply.

In practice, that means for now you should plan without this functionality in your stack, but with the assumption that observability and automated adversarial testing will come together in the Falcon platform. If you build instrumentation on OpenTelemetry today, you keep the option open to connect later without replacing your entire measurement system.

## Why now: agents as target and as attacker

The timing coincides with a broader picture in which agents are not only an attack surface but also a tool for attackers. On 3 November 2026, GitBook reported on its status page that it was "the target of a sophisticated, highly targeted attack using AI agents"; at 19:00 CET on 2 November an attacker gained unauthorised access to some infrastructure credentials. Possibly affected: integration tokens, Git Sync secrets, API tokens and questions asked to GitBook Assistant. There is no evidence that content was modified. Users must rotate their GitBook API tokens and third-party secrets and, if they use the GitBook MCP server, re-authenticate it.

That pattern — tokens that grant access and are then used — recurs in the threat picture around cloud models. Google Threat Intelligence Group describes "LLMjacking": monetising compromised access to cloud models with stolen keys. Costs for victims can run up to $1 million, in some cases more than $100,000 per day. At the AWS API MCP Server there was a token-validation vulnerability, which was fixed in version 1.6.0 (published on 27 October).

Those three examples point in the same direction: the weak spot is often not in the model, but in the keys, tokens and connections around it. That explains why a kill switch is being announced at both gateway and endpoint level, and why identity-aware controls for agents appear in the same list. It also explains why red teaming and observability are announced together: you want to know what an agent can do before it does it, and you want to be able to explain what it did after it has done it.

## What this means for builders in the Netherlands and Europe

The announcements are American, and the products will become available on an American fiscal-year rhythm. For teams here that changes the planning, not the task. If you run agents in production, you will face questions from security, compliance and sometimes the board of directors: what does this agent do, which data does it touch, and can you demonstrate that. The announcements supply a vocabulary for those questions — traceability, behavioural accountability, auditable governance — but not a ready-made solution for your own architecture.

The most useful insight is the separation between testing and observing. Testing says what can go wrong; observing says what actually happens. Both are needed, and both require instrumentation you control yourself. If you build on OpenTelemetry, you stay flexible. If you record findings in a way that aligns with OWASP, MITRE ATLAS or NIST AI RMF, you can later plug into what vendors offer without redesigning your reporting.

Expect a slow rollout as well. The endpoint kill switch has no date yet. The acquisitions still have to close. The functionality that results from them is scheduled to be generally available in Q4 FY27. So plan with what you can build yourself today: narrow tokens per agent, logging of decisions and tool calls, an emergency stop you can trigger yourself, and tests you can run yourself.

## Practical checklist

- Map which agents run in your environment and which credentials, tools and data sources they use.

- Limit tokens and roles per agent to what the task needs; do not share broad keys between agents.

- Log per agent which decisions, tool calls and inputs led to an action, so you can trace a deviation.

- Test before production with attack scenarios: jailbreaks, prompt injection, multi-turn attacks and agent-specific patterns.

- Rank findings and map them to known frameworks such as OWASP Top 10 for LLMs, OWASP Agentic Security, MITRE ATLAS and NIST AI RMF.

- Turn test findings into runtime policy instead of a report that disappears into a drawer.

- Design an emergency stop that can act at more than one layer and that logs the stop itself.

- Account for agents that run local or open-weight models and therefore fall outside network-based controls.

- Monitor token usage and spend per agent or workflow, and attach a hard limit where needed.

- Review keys and secrets periodically, and immediately after any incident in which tokens may have been exposed.

The three announcements of 3 November 2026 can be read separately and planned separately. The Fiddler acquisition brings observability and explainability to Falcon under the name Falcon Observe. The Dreadnode acquisition brings automated adversarial testing with more than 100 known attack strategies. The AI Kill Switch is available first at the Gateway and "soon" on the endpoint, without a date. Prices were not disclosed by CrowdStrike; the figures of $400 million and $95 million come from a WSJ report as reported by CyberScoop. Both acquisitions are expected to close in Q4 FY27 and have not yet been completed.

For builders, the practical lesson is that observability and red teaming complement each other, and that the emergency stop only gains value once you know exactly what you are stopping. Start with the instrumentation and the tokens. The rest follows after that.

Checked on 2026-11-04.

This article was compiled with AI assistance and editorially reviewed; sources are listed below.

Read also: [Claude now auto-connects connectors: IdP-managed GA, Claude-issued in beta](https://nieuws.llmnet.nl/en/claude-plugins-auto-connect-mcp)

## Sources

- CrowdStrike press release on the planned acquisition of Fiddler AI and Falcon Observe: [https://www.crowdstrike.com/en-us/press-releases/crowdstrike-to-acquire-fiddler-to-deliver-agent-observability/](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-to-acquire-fiddler-to-deliver-agent-observability/)

- CrowdStrike press release on the planned acquisition of Dreadnode and Automated AI Security Testing: [https://www.crowdstrike.com/en-us/press-releases/crowdstrike-to-acquire-dreadnode-advance-ai-trust/](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-to-acquire-dreadnode-advance-ai-trust/)

- CrowdStrike investor relations: "CrowdStrike Delivers AI Security and Safety for the Enterprise" (Falcon Guardian and AI Kill Switch): [https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-delivers-ai-security-and-safety-enterprise/](https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-delivers-ai-security-and-safety-enterprise/)

- CyberScoop (Greg Otto, 3 November 2026) on both acquisitions and the price figures from The Wall Street Journal: [https://cyberscoop.com/crowdstrike-acquires-fiddler-dreadnode-ai-security/](https://cyberscoop.com/crowdstrike-acquires-fiddler-dreadnode-ai-security/)

- CrowdStrike X post about the AI Kill Switch: [https://x.com/CrowdStrike/status/2117537184903238032](https://x.com/CrowdStrike/status/2117537184903238032)

- CrowdStrike X post about Dreadnode: [https://x.com/CrowdStrike/status/2117540788724785222](https://x.com/CrowdStrike/status/2117540788724785222)

- GitBook status page on the security incident of 3 November 2026: [https://www.gitbook.com/status/security-incident-2026-11-03](https://www.gitbook.com/status/security-incident-2026-11-03)

- Google Cloud Threat Intelligence on LLMjacking: [https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/)