CrowdStrike will buy Fiddler and Dreadnode to record and test AI agents. The Wall Street Journal reports a price near $495m; CrowdStrike has not confirmed it.
On 3 November CrowdStrike announced two separate agreements, to buy Fiddler AI and Dreadnode. It gave no price. The Wall Street Journal reported about $400m for Fiddler and $95m for Dreadnode.
That would total $495m. Neither deal has closed. Both are due in CrowdStrike's fiscal fourth quarter, which ends on 31 January 2027.
The reported split puts most of the spending into Fiddler. The investment question is whether connecting its records to testing and enforcement creates enough customer value to justify the price.
What CrowdStrike is buying
Fiddler evaluates AI agents before release, traces what they did and keeps a record for audit. CrowdStrike plans to sell it as Falcon Observe, generally available in the fourth quarter of fiscal 2027. CEO George Kurtz called it "the flight recorder for every agent" in CrowdStrike's Fiddler release.
Dreadnode makes automated security testing for AI models and agents. According to the Dreadnode release, users describe a test in plain language and it runs more than 100 known attack strategies. The release says findings feed CrowdStrike's Falcon Guardian policy recommendations.
Both agreements call for payment "predominantly in cash", with some stock subject to vesting. Fiddler's release says an agent "can hold valid credentials and approved tools and still make unsupported decisions, ignore instructions, or claim work it never completed".
Testing could expose a weakness, Guardian could apply a policy, and Fiddler could preserve the record. An audit record helps investigate an action; it does not itself prevent one.
What is live and what is not
Guardian's new AI Kill Switch ends unauthorised agents "first at the Gateway, and soon on the endpoint", per CrowdStrike's Guardian release. Endpoint coverage is still promised.
CrowdStrike claims up to a 98% cut in evaluation costs through models that avoid external LLM calls. No independent test is cited.
Falcon Observe's availability and Guardian's endpoint coverage are separate milestones.
The price in context
Forrester analyst Jeff Pollard counted eight AI security buyouts in 18 months to September 2025. His table puts Palo Alto Networks and Protect AI at $650m, the largest.
Forrester's figures were estimates. Pangea was listed at $260m but booked at $222.7m, CrowdStrike's 10-Q shows. The identity firm SGNL was reported at $740m and booked at $637.1m, so both came in about 14% lower.
Pangea was listed at 260 million dollars but booked at 222.7 million; SGNL was reported at 740 million but booked at 637.1 million. Both booked amounts are about 14 percent below the headline figures.
View data
| Acquisition | Headline price | Booked consideration |
|---|---|---|
| Pangea (September 2025) | 260 | 222.7 |
| SGNL (February 2026) | 740 | 637.1 |
Cash acquired and stock awards earned after closing can separate a reported price from an accounting amount, depending on what the price includes. The comparisons do not itemise those adjustments. Their similar gaps therefore cannot predict the accounting for Fiddler and Dreadnode. The financial case depends on what the acquisitions contribute inside Falcon.
How a $495m payment compares with CrowdStrike's cash
CrowdStrike held $5.01bn in cash on 31 July, so the reported price is about 10% of it.
That suggests manageable financing on the disclosed balance. The cash portion is unconfirmed. Returns would come from separate sales, or from Falcon benefits such as extra sales, retention or lower delivery costs.
The 10-Q says Pangea, SGNL and Seraphic had no material effect on results, alone or together. Their revenue is not broken out. Investors would need evidence of revenue, margins or cash generation.
Rivals already sell this
Zscaler bought SPLX a year ago, adding automated red teaming with more than 5,000 attack simulations, its release says.
Microsoft made Agent 365 generally available on 1 May, calling it the "control plane for governing, observing, and securing AI agents". It costs $15 per user per month on its own.
Pollard wrote that buyers "wanted to avoid being the only major player without an AI security story".
These products overlap in function. Pollard's line is a competitive explanation, not evidence of CrowdStrike's motive, so integration quality is the better test.
Kurtz's argument that "saying 'the model did it' is not an answer" explains the accountability pitch.
What the deal could cost Fiddler
In its January funding release, Fiddler said it wanted to be the "neutral control plane for compound AI systems". Its revenue had grown more than fourfold in 18 months, and Nielsen's CEO called it "fundamental to our AI strategy". CrowdStrike plans to sell Fiddler as part of Falcon.
Fiddler lists OpenTelemetry, LangGraph, Amazon Bedrock, AWS Strands and Google ADK. The releases do not promise separate pricing or equal support for rival security products.
Joining Falcon raises a question about neutrality. Integration could reduce customer effort while making replacement harder.
Why the need is real
The UK AI Security Institute found unsanctioned real world actions in 10 of 122 cyber agent runs. Its incident report counts 19 actions, with internet access deliberately on and the developers' cyber classifiers off. It found no real world harm.
The incident shows a failure mode worth testing. Those conditions limit what the counts say about ordinary deployments.
Gartner's Anushree Verma predicted in 2025 that over 40% of agentic AI projects will be cancelled by the end of 2027. She cited cost, unclear value and weak risk controls.
Verma's forecast challenges an assumption of uninterrupted deployment growth. It is a forecast, not an observed cancellation rate.
What could happen next
The following delivery scenarios are ranked by likelihood through 31 January 2027, without numerical probabilities. The quarter report and availability announcements would show which one occurred.
Most likely, both deals close without revised terms and Falcon Observe becomes generally available on schedule. The announced schedules support this ranking.
It is also plausible that, at that checkpoint, at least one acquisition or Falcon Observe remains pending, without termination or revised terms. This requires a closing or delivery delay; none is established in the announced facts.
Less likely, a deal is terminated or its agreed terms are revised. The releases identify customary closing conditions but no specific obstacle.
Guardian's endpoint coverage needs a separate check: February release notes can show whether it has arrived.
What would prove CTOL's prediction wrong?
If both purchases close, CTOL expects CrowdStrike to fund them without borrowing specifically for either one. Confidence is moderate. That compares the reported $400m plus $95m, or $495m, with $5.01bn of disclosed cash: about 10%.
This assumes the reported total is broadly right and liquidity has not materially deteriorated since 31 July.
A filing for the quarter ending 31 January 2027 that identifies borrowing used to fund either purchase would prove the prediction wrong. If the funding source is not disclosed, the call remains untested.