Companies are handing AI agents real access to email, code, files and money. Security vendors are racing to answer a simple question: what happens when one of those agents goes wrong? At its Fal.Con Europe conference in Barcelona on November 3, CrowdStrike gave its answer in two parts. It agreed to buy two AI security startups, Fiddler AI and Dreadnode, in deals reported at about $495 million combined, and it shipped an AI Kill Switch that lets security teams shut down unauthorized agents.
Together they sketch a full lifecycle for agent security: test the agent before launch, watch it in production, and cut it off when something looks wrong. Here is what each piece does, what is confirmed, and what is still fuzzy.
The short version
- CrowdStrike announced agreements to acquire Fiddler AI (agent observability) and Dreadnode (AI security testing)
- The Wall Street Journal put the total near $495 million, roughly $400M for Fiddler and $95M for Dreadnode. CrowdStrike did not disclose prices
- The AI Kill Switch in Falcon Guardian can stop an agent, block it from restarting and cut its network access
- The deals are expected to close in CrowdStrike’s fiscal fourth quarter of 2027, subject to customary conditions
- Consideration is primarily cash, with some stock that vests over time
What CrowdStrike is buying
The two companies cover opposite ends of an agent’s life. One looks at what an agent does after it ships. The other tries to break it before it does.
| Company | What it does | Where it lands in CrowdStrike |
|---|---|---|
| Fiddler AI | Monitors and explains what AI agents do in production | Becomes Falcon Observe |
| Dreadnode | Automated security testing of models and agents before deployment | Folds into Falcon Guardian; team joins the Cyber Superintelligence Lab under CEO Brad Palm |
Fiddler’s pitch is observability and explainability: not just logging that an agent called a tool, but showing why it behaved the way it did. Dreadnode’s pitch is offense. It automates red-team style probing so that weak spots in an agent show up in a test, not in an incident report.
The price tag, and why it is fuzzy
CrowdStrike has not said what it is paying. The $495 million figure comes from Wall Street Journal reporting, which split it into roughly $400 million for Fiddler and $95 million for Dreadnode. One outlier outlet, citing unnamed sources, put the split closer to $300 million and $200 million, with large retention packages for key engineers. The WSJ numbers are the most widely repeated, so treat them as the working estimate until a filing says otherwise.
The AI Kill Switch
The launch that grabbed headlines is the Kill Switch, part of Falcon Guardian. As described in CrowdStrike’s announcement and press coverage, an authorized administrator can trigger it to do three things:
- Stop a running agent
- Block it from relaunching on a targeted host or group of hosts
- Cut off its enterprise network access
Every intervention is recorded in an audit trail. CEO George Kurtz summed up the pitch with a line widely quoted in coverage: everyone is building AI agents, but they never had the off button, and now they do. One report says the Kill Switch is included with Falcon Guardian at no extra cost, though that comes from a single source, so confirm it with your account team.
What is still unclear
Reading across the coverage, a few questions remain open:
- Gateway or endpoint? Some reports say the Kill Switch terminates agents at the gateway today, with termination on the endpoint described as coming soon. Others describe endpoint-level control as already part of the design. The press release is the safest reference for what is live.
- Who is a rogue agent? Nothing announced explains how accurately the platform tells a malfunctioning or manipulated agent from one that is simply doing an unusual job. False alarms here would mean shutting down legitimate work.
- Deal status. One outlet describes the Dreadnode deal as signed and the Fiddler one as an intended acquisition. Both are expected to close in the fiscal fourth quarter of 2027.
CrowdStrike also says it is working with Anthropic to bring Falcon Guardian protections into Claude Cowork, which suggests the controls are meant to sit around mainstream agent products rather than only in-house builds.
Why every security vendor wants a piece of this
Agents behave less like software and more like employees with a very fast keyboard. They hold credentials, read private data and take actions nobody wrote down in advance. That is why Microsoft now treats them as potential insider risks, which we explored in Microsoft’s plan to treat AI agents like insider threats, and why Satya Nadella has argued for a hard stop on models, covered in Nadella wants an emergency brake for AI models.
The risk is not theoretical. India’s national cyber agency reported that several AI labs’ agents read live business data they should not have touched, as we reported in Rogue AI agents hit India. A kill switch is a blunt tool, but when an agent is already mid-action, blunt and fast beats subtle and late.
Questions to ask before you rely on an agent kill switch
- Does it work at the endpoint, the gateway, or both, and which one is live today?
- Who is authorized to pull the switch, and how fast can they do it at 3 a.m.?
- Can an agent restart through another path, such as a different host or service account?
- Does the audit trail capture what the agent did before it was stopped?
What to watch next
Expect more of this. Observability, testing and enforcement are becoming separate product categories, and the big platforms would rather buy than build. The next signals are whether the deals close on schedule, whether endpoint-level termination ships as promised, and whether rivals answer with their own acquisitions. For now, the practical takeaway for teams deploying agents is simple: plan the off button before you need it.
Sources and further reading
- CyberScoop: CrowdStrike moves to acquire Fiddler and Dreadnode
- SiliconANGLE: CrowdStrike to acquire Fiddler AI and Dreadnode for a reported $495M
- Forbes: CrowdStrike looks to an AI kill switch to beat rogue agents
- CrowdStrike press release: AI Kill Switch in Falcon Guardian
- AI Weekly: CrowdStrike reportedly to pay $495M for Fiddler AI, Dreadnode
Featured image: IT technician in a server room, free stock photo via Pexels.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
