# CrowdStrike's reported ~$495M bet: treat AI agents as insiders

URL: https://www.thedeepfeed.ai/posts/2026-11-06-crowdstrike-buys-agent-flight-recorder/
Category: Business
Published: 2026-11-06
Author: the-deep-feed
Tags: crowdstrike, security, agents, acquisitions, observability
Kind: news

> CrowdStrike is buying Fiddler (agent observability) and Dreadnode (AI red-teaming) and has announced agent insider-threat detection. Security vendors now treat agents like employees who can go rogue.

## TL;DR

- CrowdStrike will acquire **Fiddler** (agent observability) and **Dreadnode** (AI red-teaming). Both were announced Nov 3.
- CrowdStrike didn't disclose terms. The WSJ reported about **$400M** for Fiddler and **$95M** for Dreadnode.
- Fiddler becomes part of **Falcon Observe**. Dreadnode's team joins CrowdStrike's Cyber Superintelligence Lab.
- On Nov 3 CrowdStrike added an **AI Kill Switch** to Falcon Guardian. A Nov 4 release added **Agent Insider Threat Detection**, targeted for Q4.
- Both deals are expected to close in CrowdStrike's **Q4 FY27**, which ends Jan 31, 2027.

CrowdStrike is now pricing AI agents as a new kind of insider. In two days it announced two acquisitions and a product line that treat agents the way it treats employees. That means recording what they do, testing whether they can be turned and shutting them down when they drift.

# The two deals

[Fiddler](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-to-acquire-fiddler-to-deliver-agent-observability/) brings agent observability, which CrowdStrike will fold into Falcon Observe. CEO George Kurtz's pitch is about accountability: "When a regulator or your board asks what an agent did, saying ‘the model did it’ is not an answer. Fiddler is the flight recorder for every agent."

[Dreadnode](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-to-acquire-dreadnode-advance-ai-trust/) brings offensive testing of models and agents. Its team joins CrowdStrike's Cyber Superintelligence Lab. "Enterprises are deploying AI faster than they can prove it is secure," Kurtz said. [SecurityWeek](https://www.securityweek.com/crowdstrike-reportedly-paying-495-million-for-ai-security-firms-fiddler-dreadnode/) reports that Dreadnode covers more than 100 attack strategies, can test MCP servers, and maps its findings to OWASP, MITRE ATLAS and NIST frameworks.

CrowdStrike didn't disclose prices. [TechCrunch](https://techcrunch.com/2026/11/03/crowdstrike-to-shell-out-nearly-500m-for-2-ai-security-startups-as-the-market-for-securing-agents-takes-off/) and SecurityWeek, citing The Wall Street Journal, put them at about $400 million for Fiddler and about $95 million for Dreadnode. TechCrunch adds that Fiddler, founded in 2018, had raised about $99 million according to PitchBook. Dreadnode, founded in 2023, had raised $14 million. CrowdStrike says both deals will be paid predominantly in cash plus stock subject to vesting, and expects both to close in its fourth quarter of fiscal 2027.

# The product framing: agents as insiders

On November 4, CrowdStrike [announced](https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-extends-agentic-soc-detect-and-stop-agent-insider) Agent Insider Threat Detection and AI Credit Visibility and Control, both targeted for Q4, plus Policy-Drift Agent Guardrails, targeted for Q1 of fiscal 2028. "AI agents can be both an insider threat and an adversary," said Michael Sentonas, the company's president. The release adds: "You pay this insider in tokens." The release builds on the Falcon Guardian AI Kill Switch, which CrowdStrike introduced on Nov 3 alongside the acquisitions. SecurityWeek describes it as halting an agent, preventing it from restarting and cutting its network access.

# Our read

Two signals matter for teams deploying agents. First, observability is becoming a security purchase, not just an MLOps tool. When the vendor that owns your endpoint agent also owns your agent traces, those traces get pulled into incident response and audits. Second, the reported prices are modest for CrowdStrike. Buying capability is cheaper than waiting for agent-security startups to become platforms of their own. Expect rivals to follow. This fits the pattern from our coverage of the [Claude Code extension backdoor](/posts/2026-10-31-claude-code-extension-backdoor/): the agent's toolchain is now the attack surface.

## Sources

- [CrowdStrike — CrowdStrike to Acquire Fiddler for AI Agent Observability (Nov 3, 2026)](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-to-acquire-fiddler-to-deliver-agent-observability/)
- [CrowdStrike — CrowdStrike to Acquire Dreadnode for Automated AI Security Testing (Nov 3, 2026)](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-to-acquire-dreadnode-advance-ai-trust/)
- [CrowdStrike — CrowdStrike Extends Agentic SOC to Detect and Stop Agent Insider Threats (Nov 4, 2026)](https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-extends-agentic-soc-detect-and-stop-agent-insider)
- [TechCrunch — CrowdStrike to shell out nearly $500M for 2 AI security startups (Nov 3, 2026)](https://techcrunch.com/2026/11/03/crowdstrike-to-shell-out-nearly-500m-for-2-ai-security-startups-as-the-market-for-securing-agents-takes-off/)
- [SecurityWeek — CrowdStrike Reportedly Paying $495 Million for AI Security Firms Fiddler, Dreadnode (Nov 3, 2026)](https://www.securityweek.com/crowdstrike-reportedly-paying-495-million-for-ai-security-firms-fiddler-dreadnode/)

---

Canonical: https://www.thedeepfeed.ai/posts/2026-11-06-crowdstrike-buys-agent-flight-recorder/
Site: https://www.thedeepfeed.ai
Full corpus: https://www.thedeepfeed.ai/llms-full.txt