CrowdStrike wants a big red button for the AI agent era. The cybersecurity company announced on Tuesday, November 3, that it has agreed to buy two AI security startups, Fiddler AI and Dreadnode, for a reported $495 million, and it launched an AI kill switch designed to stop an agent the moment it goes off script.

The announcements landed at CrowdStrike’s Fal.Con Europe event in Barcelona, and they target the same worry from three directions: stopping a bad agent mid-run, understanding what it did, and testing it before it ever reaches production.

Investors liked the pitch. CrowdStrike shares closed Tuesday up about 1%, at $244.68, after the company laid out the deals.

What the CrowdStrike AI kill switch does

The AI kill switch lives inside Falcon Guardian, CrowdStrike’s product for securing AI agents. An authorized administrator can use it to terminate an agent that strays from its instructions, block it from relaunching on a targeted host or group of hosts, and cut its access to the corporate network. Every administrator action is recorded in audit logs, according to the company.

One detail matters for buyers. The kill switch is available now, but termination currently starts at the gateway level; endpoint termination is described as coming soon.

Until now, most companies running agents had no clean way to pull the plug on one that started behaving strangely.

CrowdStrike also said Falcon Guardian is coming inside Anthropic’s Claude Cowork, with its sensor running in the virtual machine where Cowork’s agents execute code. The message is plain: the company wants its controls sitting wherever agents actually run, not just on a dashboard somewhere.

Fiddler AI becomes Falcon Observe

Fiddler AI is the bigger of the two deals, at a reported $400 million. Founded in 2018 and based in Palo Alto, California, the company builds software that watches AI agents in production and explains their decisions: what tools an agent used, what data it touched, and why it chose one action over another.

Inside CrowdStrike, that technology becomes Falcon Observe. The plan is to give enterprises pre-deployment evaluation, continuous monitoring of agent behavior, and explanations they can show an auditor or a regulator. General availability is planned for CrowdStrike’s fiscal fourth quarter of 2027, once the deal closes and the integration is done.

Fiddler had raised about $99 million before the deal, according to PitchBook figures cited in deal coverage.

“Guardian secures agents from attack and misuse; Fiddler validates they behaved as intended,” CrowdStrike said in announcing the deals. It’s a tidy summary of the division of labor: one product stops the attack, the other proves the agent did its job properly.

Dreadnode tests agents before they ship

Dreadnode is the smaller, sharper piece. Founded in 2023, the startup automates security testing for AI models, applications, and agents before deployment, running more than 100 known attack strategies against them, including jailbreaks and prompt injection. Its testing results will feed into Falcon Guardian as security policy recommendations, and its team will join CrowdStrike’s Cyber Superintelligence Lab.

The reported price is about $95 million, against roughly $14 million raised. Dreadnode’s pitch is prevention: catch the weakness in testing, not after the agent has access to real systems and real data.

The $495 million question

CrowdStrike itself disclosed no purchase price for either deal. The $495 million combined figure, about $400 million for Fiddler and about $95 million for Dreadnode, comes from The Wall Street Journal’s reporting, and it has been repeated across deal coverage since. CrowdStrike said the deals will be paid mostly in cash, with a portion in stock subject to vesting conditions.

Both transactions are expected to close in CrowdStrike’s fiscal fourth quarter of 2027, which ends January 31, 2027, subject to customary closing conditions. Until then, they are signed agreements, not finished integrations, and the Falcon Observe general availability date depends on that timeline holding.

The spending fits a pattern: CrowdStrike paid $740 million for SGNL and a reported $420 million for Seraphic in January 2026.

Why this matters

AI agents are different from chatbots in one dangerous way: they act. A chatbot writes text. An agent can run code, move files, send messages, and complete transactions on a user’s behalf, sometimes across several systems at once. That autonomy is the whole selling point, and it’s also the risk.

Apple flagged the same danger in its fiscal 2026 annual filing, warning that AI agents “can take actions autonomously,” reaching systems they aren’t authorized to access and causing harms, like deleted data or completed transactions, that may be impossible to reverse. When the company that ships the iPhone puts that in a 10-K, it’s not a hypothetical anymore.

Enterprises have noticed. Banks, hospitals, and retailers are rolling out agents for service, procurement, and internal work, and their security teams are finding the old controls don’t quite fit software that is supposed to reach across systems by design.

CrowdStrike is betting that gap becomes a product category of its own. The kill switch is the headline, but the acquisitions are the strategy: without monitoring, you don’t know an agent has gone wrong, and without testing, you keep shipping agents that will.

Skepticism is still warranted. The deals haven’t closed, the integrated products aren’t generally available yet, and rivals from Palo Alto Networks to Microsoft are building their own agent controls.

But the direction of travel is hard to argue with. Agents that never log off need an off switch, and someone was going to sell it. CrowdStrike just spent a reported $495 million to make sure it’s the one holding it.

FAQ

What is CrowdStrike’s AI kill switch?

It is a feature in CrowdStrike’s Falcon Guardian product that lets an authorized administrator terminate an AI agent that strays from its instructions, block it from relaunching, and cut its access to the corporate network.

How much is CrowdStrike paying for Fiddler AI and Dreadnode?

CrowdStrike did not disclose the price. The Wall Street Journal reported a combined $495 million, about $400 million for Fiddler AI and about $95 million for Dreadnode, paid mostly in cash.

When will the CrowdStrike Fiddler and Dreadnode deals close?

Both acquisitions are expected to close in CrowdStrike’s fiscal fourth quarter of 2027, which ends January 31, 2027, subject to customary closing conditions.

What do Fiddler AI and Dreadnode add to CrowdStrike?

Fiddler AI adds monitoring and explainability for agents in production, becoming Falcon Observe. Dreadnode adds automated security testing of models and agents before deployment.

Sources: The Wall Street Journal, TechCrunch, SiliconANGLE, SecurityWeek, CrowdStrike