CrowdStrike plans to acquire AI security companies Fiddler AI and Dreadnode in separate deals that will extend its Falcon platform into automated testing of AI systems and monitoring of AI agent behaviour, as enterprises look to address security risks arising from increasingly autonomous applications.
CrowdStrike made the announcements at Fal.Con Europe 2026 in Barcelona, saying the acquisitions will add capabilities to test AI models, applications, and agents for security weaknesses before deployment and monitor their decisions and actions in production.
The company plans to integrate Dreadnode’s automated testing technology and Fiddler’s agent observability capabilities into Falcon, with both offerings scheduled for general availability in the fourth quarter of fiscal 2027.
Dreadnode will bring automated security testing to identify vulnerabilities in AI models, applications and agents before deployment. Fiddler, meanwhile, will add AI agent observability and explainability, allowing enterprises to monitor agent behaviour, trace decisions and understand why agents take particular actions, CrowdStrike said in two separate statements.
CrowdStrike said the Dreadnode team will join its Cyber Superintelligence Lab, but did not specify how the Fiddler team would be integrated into the company.
CrowdStrike adds AI testing and observability
“With this acquisition, Dreadnode will extend the Falcon platform into the layer where enterprises build and test AI, delivering Automated AI Security Testing capabilities,” CrowdStrike said in its announcement.
It further added that Dreadnode’s technology will allow security teams to test AI models, applications, agent reasoning loops and Model Context Protocol (MCP) servers against more than 100 AI attack strategies. These include jailbreaks, prompt injection, multi-turn attacks, and attacks targeting AI agents.
The technology will also let teams describe tests in natural language, rank findings by severity, and map vulnerabilities to frameworks including OWASP Top 10 for LLMs, OWASP Agentic Security, MITRE ATLAS, and the NIST AI Risk Management Framework. CrowdStrike said findings will feed into Falcon Guardian as policy recommendations.
Fiddler, the second acquisition, will bring agent observability and explainability capabilities to Falcon. CrowdStrike said the technology is intended to address risks that can arise even when agents have not been compromised.
“An agent can hold valid credentials and approved tools and still make unsupported decisions, ignore instructions, or claim work it never completed. They don’t have to be compromised to create risk,” the company said in a statement.
CrowdStrike plans to offer Fiddler’s technology through Falcon Observe. The product will evaluate agent accuracy, task completion, and policy compliance before deployment, and trace decisions, reasoning paths, and tool calls once agents are in production, the company said.
The company further added that Falcon Observe will also detect behavioural drift, hallucinations and unintended actions, while maintaining records of agent activity for compliance and audit purposes. The offering is expected to support OpenTelemetry and frameworks including LangGraph, Amazon Bedrock, AWS Strands and Google ADK, it added.
Governance remains a shared responsibility
The addition of observability and automated testing to a security platform could help enterprises correlate agent behaviour with identity, runtime activity and security events, said Apeksha Kaushik, senior principal analyst at Gartner.
However, Kaushik said the acquisitions would not make security teams the sole owners of AI agent governance. Platform and observability teams would continue to be responsible for reliability, performance and operational telemetry, while application security and AI teams would retain responsibility for secure development and testing.
“Business, data and compliance leaders also retain accountability for use cases, data and regulatory obligations,” Kaushik said.
She said CIOs should establish a governance model that defines responsibilities across engineering, security, risk, and business teams. CISOs, meanwhile, should ensure security teams have the authority to set minimum controls, monitor agent behaviour and intervene when activity creates unacceptable risk.
Integration and roadmap questions
CrowdStrike expects both transactions to close during its fourth quarter of fiscal 2027, subject to customary closing conditions, and has scheduled both offerings for general availability in the same quarter.
Kaushik cautioned enterprises against treating the announced timelines as confirmation of final product capabilities or integration plans.
“Enterprises should distinguish between announced plans and demonstrated product capability, with closing timeline and conditions possibly being different, especially with the pace of change of the threat landscape and evolution of AI,” she added.
She advised customers to seek clarity on pricing, packaging, migration terms, service continuity, support commitments, deployment models, data handling, telemetry retention and API access.
“Once the Existing and prospective customers have further details, they should set up their roadmap changes, support commitments, service continuity, contract and pricing, data portability, open integrations, and access to historical data changes,” she pointed out. CrowdStrike did not disclose the financial terms of either acquisition.
No Responses