CrowdStrike Plans Fiddler and Dreadnode Acquisitions for AI Security

CrowdStrike announced on November 3, 2026 that it intends to acquire Fiddler, whose technology will become Falcon Observe for evaluating and explaining AI-agent behavior. A separate announcement detailed plans to acquire Dreadnode and add automated AI security testing to the Falcon platform before systems reach production.

Both announcements came at Fal.Con EU 2026 and describe proposed acquisitions. CrowdStrike targets general availability for Falcon Observe and Dreadnode in the fourth quarter of its 2027 fiscal year. The planned products address distinct controls: probing AI for weaknesses before release, evaluating whether agents perform their intended tasks, and monitoring their decisions after deployment.

Fiddler’s Role in Falcon Observe

Before deployment, teams can use Fiddler to compare prompts, models and configurations when evaluating whether agents perform assigned tasks safely and accurately. After deployment, the platform is designed to trace decisions and reasoning paths across the full agent hierarchy, identifying behavioral drift and unintended actions. It reconstructs the decision process so teams can locate the step that caused a failure.

That visibility addresses a gap in conventional security controls. CrowdStrike’s refund example describes an agent using valid credentials and approved tools to approve a refund that violates company policy. Traditional controls may see legitimate activity even though the decision was wrong; explainability is intended to reveal why the agent acted and where its behavior went awry.

Fiddler covers first-party and third-party agents and supports instrumentation through OpenTelemetry, alongside LangGraph, Amazon Bedrock, AWS Strands and Google ADK. Its decision-level records are intended to support compliance and audits. Within Falcon, agent intent and behavior would be connected with endpoint, identity, cloud and runtime security telemetry, giving security teams a way to examine both why an agent acted and what happened across enterprise systems as a result.

Dreadnode’s Pre-Production Testing

Dreadnode begins with a plain-language description of the desired test, then probes AI systems, models, model repositories, applications, agents and MCP servers before production. CrowdStrike said it runs more than 50 attack techniques, including jailbreaks, prompt injection, multi-turn attacks and agent-specific attacks. Findings are ranked by severity and mapped to the OWASP Top 10 for LLMs, OWASP Agentic Security categories ASI01 through ASI10, MITRE ATLAS and the NIST AI Risk Management Framework.

The results feed a combined risk view covering total findings, attack success rates, severity breakdowns, finding outcomes and deeper risk metrics. An exportable report supports go/no-go decisions. Human reviewers can inspect the exact attacker prompt and target response, walk through an attack step by step, reclassify findings, adjust severity and document their reasoning. Dashboard metrics recalculate when findings are reclassified.

The planned handoff connects testing with runtime defense. Dreadnode findings would feed Falcon Guardian as policy recommendations, allowing weaknesses identified before deployment to inform protections after release. Testing data would also support CrowdStrike’s SafeMind models. Falcon Guardian provides AI detection and response for enterprise-developed AI at runtime, while Falcon Observe evaluates and explains whether agents behave as intended.

Together, the proposals describe a connected workflow from pre-production testing and evaluation through continuous observation and runtime protection. Delivering that chain depends on completing the proposed acquisitions and building the promised integrations, making execution against the availability target the central open question in CrowdStrike’s expanded AI-security roadmap.