CrowdStrike to shell out nearly $500M for 2 AI security startups as the market for securing agents takes off

CrowdStrike is spending about $495 million across two acquisitions. It will pay around $400 million for Fiddler AI and about $95 million for Dreadnode, according to The Wall Street Journal. The purchases target different parts of the AI security problem.

Fiddler AI makes observability software. That software helps enterprises monitor AI agents while they operate, understand their actions, and evaluate them before deployment. Dreadnode focuses on automated security testing for AI models, applications, and agents. Its goal is to detect flaws before those systems go live.

The distinction matters because monitoring and testing solve different problems. Fiddler provides visibility during an agent’s lifecycle and feeds information into CrowdStrike’s platform. Dreadnode provides testing results that can become security policy recommendations. Together, the acquisitions broaden CrowdStrike’s coverage as companies deploy more AI tools and agents.

Fiddler AI will become Falcon Observe inside CrowdStrike’s Falcon platform. It is intended to help customers evaluate AI agents before deployment, understand what those agents do, monitor their activity, and send that information as telemetry across the broader platform.

Dreadnode will be integrated into Falcon Guardian, CrowdStrike’s product for seeing and understanding what agents do on devices. Dreadnode’s testing software will feed results into Falcon Guardian, where they can be turned into security policy recommendations. This gives the product a way to connect testing with defensive action.

The additions extend CrowdStrike’s existing AI controls rather than standing apart from them. The company has already been building Falcon Guardian. The acquisitions add deeper observability and automated testing, helping customers address risks before agents launch and while they operate across enterprise environments.

In general, an AI agent is software that uses an AI model to pursue a task, make decisions, and take actions toward completing it. A conventional AI model mainly produces outputs from inputs, such as text, classifications, or predictions. An application may package that model into a user-facing feature without independently managing a broader task.

An agent can operate across several steps. It may interpret a request, choose an action, use a connected tool, inspect the result, and continue. In an enterprise, that can mean automating a workflow or working through connected applications and data. The article refers to companies deploying armies of agents and trying to understand what agents do on devices.

That autonomy creates a larger security footprint. An agent’s activity must be monitored, tested, and controlled, not just its individual response. CrowdStrike is expanding Falcon to evaluate agents before launch and observe their behavior afterward.

Rapid AI adoption creates security problems because enterprise policies and processes are lagging behind actual use. Teams and individual employees are experimenting with AI tools, automating workflows, vibe-coding custom applications, and deploying large numbers of agents. Security teams must manage activity that may spread faster than their existing controls.

The risk is especially difficult when agents operate through devices, tools, connectors, and applications. An agent may perform work across an organization, making its actions harder to see and evaluate than a standalone AI response. CrowdStrike says companies need controls that help them understand what agents are doing on their devices.

The article presents this as a broader industry shift, not a problem for one company. Existing security software may not be enough to monitor and control AI tools, connectors, or usage. CrowdStrike is responding with Falcon Guardian, Falcon Observe, and the two acquisitions.

Dreadnode helps companies automate security testing for AI models, applications, and agents before deployment. Its purpose is to detect flaws while systems are still being evaluated, rather than waiting until they are live in an enterprise environment.

The key mechanism is automated testing aimed specifically at AI systems. Dreadnode examines the systems before they are set live and produces testing results. CrowdStrike plans to feed those results into Falcon Guardian, where they will become security policy recommendations.

The article does not identify particular flaw types, such as data leakage or prompt manipulation. It only states that Dreadnode detects flaws in AI models, apps, and agents. Its value is therefore the timing and focus: it helps organizations find security weaknesses before deployment and connect those findings to defensive policies.

AI observability is the practice of collecting and examining information about an AI system’s operation. For an agent, that means seeing its actions, understanding its behavior, and monitoring activity after deployment. It can also help customers evaluate the agent before it goes live.

In the article, Fiddler AI provides observability software for monitoring agents inside enterprises. As Falcon Observe, it will help customers understand what agents do and send that information as telemetry into CrowdStrike’s broader platform. This creates a record that security teams can use to inspect agent activity.

Observability does not by itself describe every possible security problem. Instead, it improves visibility into behavior that might otherwise be difficult to track. That matters as companies deploy agents across devices and workflows. Combined with Dreadnode’s testing, it gives CrowdStrike both predeployment checks and ongoing monitoring.

AI models, applications, and agents can interact with information and systems in different ways. A model produces an output, an application puts that capability into a workflow, and an agent can use connected tools or systems while carrying out tasks. The article highlights AI tools, connectors, devices, custom apps, and enterprise workflows.

Those connections create security risk because they expand where AI activity happens and what teams must monitor. An agent working through a device or connector may affect a workflow beyond a single chat or model response. The article does not specify particular attack methods, but it emphasizes the need to see and understand agent actions.

CrowdStrike is building controls around this problem. Falcon Guardian helps customers understand what agents do on devices. Falcon Observe will monitor and evaluate agents, while Dreadnode tests models, applications, and agents before deployment. Together, these tools address visibility and testing as AI adoption grows.