By Paul Derrington, Jr.
CEO | Chief Engineer | Research Engineer | Editor, D-CSIL
3 min read
Key Takeaways
CrowdStrike announced on November 3 that its Falcon Guardian product now includes what it calls an AI Kill Switch, which lets an authorized administrator stop a rogue AI agent, block it from starting again, and cut its network access. The same day, CrowdStrike announced agreements to acquire Fiddler AI and Dreadnode for agent observability and AI security testing. The Wall Street Journal reported a combined price of about $495 million; CrowdStrike has not disclosed financial terms.
The reported $495 million
The Wall Street Journal reported, according to SecurityWeek, roughly $400 million for Fiddler AI and about $95 million for Dreadnode, a combined $495 million. CrowdStrike announced both deals on November 3 at its Fal.Con Europe conference in Barcelona and did not disclose a price for either one in its releases.
CrowdStrike says the purchase prices are to be paid predominantly in cash, with a portion in stock subject to vesting conditions, and both deals are expected to close in CrowdStrike’s fourth quarter of fiscal 2027, which ends January 31, 2027, pending customary closing conditions.
How CrowdStrike describes the AI Kill Switch
According to CrowdStrike, the AI Kill Switch is part of Falcon Guardian, its AI detection and response product. If an agent misbehaves, an authorized administrator can terminate it where it runs, block it from launching again on the targeted host or host group, and cut off its enterprise network access. CrowdStrike says every action is recorded in the audit trail and that the decision to stop an agent rests with security leaders.
CrowdStrike says the Falcon sensor stops the agent first at the Gateway and “soon on the endpoint,” and that the AI Kill Switch is available today. CEO George Kurtz put it this way: “AI safety is how you get the full benefit of AI. When you deploy agents with a kill switch, you stay in control.”
The two acquisitions
According to CrowdStrike, Fiddler AI evaluates agents before deployment, traces decisions, reasoning paths, and tool calls, and flags behavioral drift, hallucinations, and unintended actions in production. CrowdStrike will sell it as Falcon Observe, generally available in the fourth quarter of fiscal 2027. Kurtz called it “the flight recorder for every agent: the observability to explain exactly what an agent did and why.”
CrowdStrike says Dreadnode provides automated security testing that runs more than 100 known attack strategies — jailbreaks, prompt injection, multi-turn and agent-specific attacks — against models, agent reasoning loops, applications, and MCP servers before they reach production. Findings are ranked by severity and mapped to the OWASP Top 10 for LLMs, OWASP Agentic Security, MITRE ATLAS, and the NIST AI Risk Management Framework, and feed back into Falcon Guardian as policy recommendations.
Timing
Of the announcements, CrowdStrike says the AI Kill Switch is available now. The two acquisitions have not closed, and CrowdStrike says both resulting products will be generally available in its fourth fiscal quarter, which ends January 31, 2027. The $495 million figure has not been confirmed by CrowdStrike.
CrowdStrike also announced on November 3 that Falcon Guardian protection is now built natively into Anthropic’s Claude Cowork, in partnership with Anthropic, on Windows and Mac.