CrowdStrike buys Fiddler and Dreadnode to test, monitor and stop AI agents

CrowdStrike is moving its security perimeter inside AI applications. According to The Futurum Group, the company has bought Fiddler and Dreadnode, two startups focused on AI observability and adversarial testing, and plans to fold their capabilities into its security platform.

The headline framing is deliberate: test, watch and stop AI agents. Those three verbs map onto the hardest problems enterprises face when they hand work to agentic systems, which call tools, touch data and chain multiple steps together. Endpoint and network telemetry alone does not show what an agent is doing or why.

Fiddler is known for AI observability, helping teams monitor how models behave in production, explain their outputs and trace failures back to data or model changes. Dreadnode comes from the offensive side of the field, running adversarial testing and red-team exercises against AI systems. One company watches, the other probes.

For CrowdStrike the deal extends a platform that began with endpoint detection and response and later spread into cloud workloads, identity and data. AI agents fit awkwardly into those categories: they are neither ordinary processes nor ordinary users, and they need their own identity, permission and behaviour baselines.

The acquisition also reflects a shift in security buying. As companies wire large language models into support desks, software development, IT operations and back-office workflows, buyers are asking who is accountable when an agent misbehaves, and what evidence is left behind. Discovery, testing and runtime protection for agents is turning into a category of its own.

On timing, CrowdStrike has spent the past two years closing gaps through acquisitions in cloud, identity and data security. Buying two AI-native startups suggests the company believes internal development cannot keep pace with how quickly agentic AI is reshaping the threat surface.

Details remain thin. The report does not set out an integration timeline, and it is unclear whether Fiddler and Dreadnode will keep their own brands or be absorbed into CrowdStrike's console. For existing customers, the practical questions are how smoothly current deployments migrate and whether the extra monitoring data creates a new compliance burden.

Two things to watch next: whether CrowdStrike can connect AI observability data to its threat intelligence and incident response workflows, closing a loop from anomaly to agent to blocked action; and whether rival vendors follow with acquisitions of their own, turning agent security into the next contested budget line.