CrowdStrike is paying about $400 million for Fiddler AI and roughly $95 million for Dreadnode, two startups built to watch AI agents and break them before attackers do. The deal, announced Tuesday at Fal.Con EU 2026, folds Fiddler into a new product called Falcon Observe and routes Dreadnode’s testing work into Falcon Guardian. It’s the clearest signal yet that the market for securing AI agents has gone from a side project to a line item big security vendors are willing to write nine-figure checks for.
Two acquisitions, one problem
The Wall Street Journal first reported the price tags, and CrowdStrike itself confirmed the deal in a blog post from company president Michael Sentonas, who called it an extension of CrowdStrike’s push into “the agentic enterprise.” Fiddler AI has been around since 2018 and has raised close to $99 million, building observability software that watches what AI systems actually do once they’re live. Dreadnode is younger, founded in 2023 with about $14 million raised, and its specialty is automated adversarial testing: poking at models, apps and agents to find the flaws before they ship.
Put together, the pitch is simple. Fiddler tells you what an agent is doing right now. Dreadnode tells you what could go wrong with it before you ever turn it on. CrowdStrike wants both signals flowing into the same dashboard its security teams already use for everything else. It is also a sign of how differently the company is thinking about AI risk than it was even a year ago. Teams and individual employees across industries are now experimenting with AI tools, automating workflows, vibe-coding custom apps and deploying fleets of agents to do their work for them, and that shift has left most security teams without an established playbook for watching software that makes its own decisions.
What Falcon Observe and Falcon Guardian actually do
Sentonas described the split this way in CrowdStrike’s announcement: “Falcon Guardian protects AI agents from attacks and misuse. Falcon Observe evaluates and explains whether agents behave as intended. Together, they secure AI operations in the agentic enterprise.” Fiddler’s technology, rebranded as Falcon Observe, plugs into standard OpenTelemetry instrumentation and works with the frameworks most enterprises are already building agents on, including LangGraph, Amazon Bedrock, AWS Strands and Google’s Agent Development Kit.
CrowdStrike’s own example of the problem it’s trying to solve is worth sitting with: an AI agent approves a refund that violates company policy, using valid credentials and tools it was approved to use. Nothing about that transaction looks like a traditional security incident. No stolen password, no malware, no alert. The agent just did something it shouldn’t have, using access it was legitimately given, and most security stacks built for human attackers have no way to catch it. That gap is exactly what Falcon Observe and Falcon Guardian are meant to close. Falcon Observe is expected to reach general availability in CrowdStrike’s fourth fiscal quarter of next year. Neither company has said how many employees from Fiddler or Dreadnode will move over to CrowdStrike, or exactly when either deal is expected to close. Both announcements note only that they remain subject to standard closing conditions, boilerplate language for a deal this size that still leaves the integration timeline an open question.
Why CrowdStrike is spending big right now
The timing tracks with how fast companies are actually deploying agents, not just talking about them. Gartner forecast in August that the market for securing AI tools will hit $4.8 billion by 2027, with spending on AI security growing 68.7% in 2027 alone. That’s a narrow slice of the broader security market, but it’s growing faster than almost anything else CrowdStrike sells into.
CrowdStrike isn’t the only one chasing it. Smaller players like Pluto Security, AIR and HiddenLayer have each raised tens of millions this year to build similar agent-testing and agent-monitoring tools, and the fact that CrowdStrike chose to buy rather than build suggests it didn’t want to wait around and let a startup get there first. Enterprises are already pouring real money into agents themselves. Y Combinator president Garry Tan said this week he personally spends up to $200,000 a year just on AI agent tokens, and that kind of spending is becoming normal across the companies CrowdStrike sells to. Every one of those agents is a new thing a security team has to watch, and most of them weren’t designed with watching in mind. Much of the cybersecurity industry has spent 2026 arguing over whether AI agents are mostly a productivity boost or mostly a liability. CrowdStrike’s roughly $500 million answer is that they are both at once, and that whoever controls the tooling for watching those agents will have outsized influence over how comfortable enterprises feel letting them run with real access.
The urgency isn’t limited to agents acting on their own systems, either. When Google dismantled a botnet built from 1.3 million hijacked Android TV boxes last month, it was a reminder that attackers move as fast as the infrastructure in front of them lets them. AI agents with real permissions, real credentials and real access to company systems are quickly becoming that infrastructure, and right now very few companies have a clear picture of what their agents are actually doing day to day.
The bottom line
Nearly $500 million is a lot to pay for two startups with a combined headcount small enough to fit in a single CrowdStrike conference room, but the number makes more sense once you stop thinking of it as a feature purchase and start thinking of it as a land grab. Observability and adversarial testing for AI agents are going to be table stakes for every security vendor within a couple of years, the same way endpoint detection became table stakes a decade ago. CrowdStrike would rather own two of the better tools in that category now, while the market is still small enough to buy into, than spend the next three years trying to catch up to whoever gets there first. Whether Fiddler and Dreadnode’s technology actually holds up once it’s running at CrowdStrike’s scale is the part nobody can answer yet.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
