CrowdStrike is investing almost half a billion dollars in the protection of AI agents capable of acting independently. On November 3, the firm unveiled its intention to acquire Fiddler AI and Dreadnode for a reported overall price of about $495 million. Both companies specialize in the protection against different kinds of risks related to these agents.
The announcement was made during CrowdStrike’s Fal.Con Europe conference held in Barcelona. The company pointed out the perils of AI agents that sometimes make wrong decisions even being equipped with valid credentials. Neither of the acquisitions has been closed so far, and no information on how much the deals cost has become available.
Two startups, one agent-security bet
The Wall Street Journal puts the price at roughly $400 million for Fiddler and $95 million for Dreadnode.
Fiddler helps security teams retrace an agent’s decisions and tool calls, including when its behavior strays from its task. CrowdStrike plans to offer the technology as Falcon Observe. Meanwhile, Dreadnode tests models and agents for vulnerabilities before deployment. Its findings will help shape Falcon Guardian policies.
Both capabilities are due for general availability in CrowdStrike’s fourth quarter of fiscal 2027.
CEO George Kurtz put it this way:
“Fiddler is the flight recorder for every agent: the observability to explain exactly what an agent did and why.”
CrowdStrike’s $495M AI Security Bet: Fiddler, Dreadnode and Market Rivals
How the Kill Switch fits in
Conducting the necessary testing of AI agents is only half the battle. Cutting off an agent that has gone haywire is the other. CrowdStrike’s AI Kill Switch , which was previously reported by Cryptopolitan, solves the second issue.
The AI Kill Switch is included in Falcon Guardian, allowing any authorized administrator to deactivate rogue agents, prevent them from restarting on certain hosts, and deny them network access. An important aspect of the AI Kill Switch is that any actions taken are documented. At this point, the process begins at the gateway, but endpoint capabilities will be released in the near future.
Kurtz said :
“When you deploy agents with a kill switch, you stay in control.”
CrowdStrike intends to integrate three capabilities: Dreadnode’s ability to conduct security testing and identify vulnerabilities pre-deployment, Fiddler’s monitoring of agent behavior, and Falcon Guardian’s Kill Switch to terminate rogue agents’ operations. However, the full system is not functional yet. Fiddler and Dreadnode still need to be integrated into the Falcon platform.
Why agents break containment
AI agents pose a security challenge that traditional access controls cannot fully address. These controls determine what an agent is allowed to do, but they cannot always prevent it from making a poor decision.
OWASP’s guidance identifies threats such as prompt injection, privilege escalation, and data theft. However, an agent does not need to be hacked to cause harm. It can misuse an approved tool or take an unintended action while operating with valid permissions.
This makes monitoring agent behavior just as important as controlling access. Yet a BCG survey found that only 23% of organizations monitor or log agent activity. CrowdStrike aims to address this gap through Fiddler, which would help security teams trace agents’ decisions and identify where things went wrong.
What it means for security budgets
As companies deploy more agents, protecting them could take a larger share of security spending. Grand View Research estimates the global cybersecurity market at $302 billion in 2026. Meanwhile, McKinsey projects that AI-related security could grow from 4% to 15% of cybersecurity budgets within three years.
Applying those percentages to a fixed $302 billion market gives roughly $12 billion and $45 billion. This is only an illustration, not a market forecast. AI security covers much more than agents, and actual spending will change.
CrowdStrike also faces competition. Zscaler is developing zero-trust controls for agent access. Palo Alto Networks offers Prisma AIRS and agent endpoint protection.
CrowdStrike takes a new approach that combines testing, monitoring, and intervention into one platform. For customers, the key question is, does this approach improve security without making them too reliant on one vendor.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It’s free .
