What happened: CrowdStrike announced an AI “Kill Switch” for its Falcon Guardian security product and signed definitive agreements to acquire AI security startups Fiddler AI and Dreadnode. The proposed deals would add agent monitoring and pre-deployment testing to its security platform, but neither acquisition has closed. CrowdStrike did not disclose a purchase price; The Wall Street Journal reported a combined purchase price of roughly US$495 million.

The announcements, made on November 3 at CrowdStrike’s Fal.Con Europe event, target different risks across the AI-agent lifecycle: stopping an agent during operation, understanding its behavior, and testing for weaknesses before release. CrowdStrike described the capabilities in company releases; they should not be read as independent proof that every AI agent can already be secured or stopped in every environment.

What CrowdStrike’s AI Kill Switch does

CrowdStrike says an authorized administrator can use the AI Kill Switch in Falcon Guardian to terminate an agent, block it from relaunching on a targeted host or group, and cut its enterprise network access. The company says the feature is available today, but specifies that termination currently starts at the Gateway; endpoint termination is described as coming soon. Its announcement also says actions are recorded in an audit trail. These are vendor-stated capabilities, not a guarantee of universal coverage.

The distinction matters: a control that interrupts an agent’s Gateway traffic is not the same as stopping every process on every endpoint. Teams evaluating the feature will need to confirm which agents and environments are covered in their own deployments.

Fiddler would add visibility into agent behavior

Under the proposed Fiddler AI acquisition, CrowdStrike plans to add pre-deployment evaluation, production monitoring and explainability to the Falcon platform. The technology is expected to become Falcon Observe, with general availability planned for CrowdStrike’s fourth quarter of fiscal 2027, subject to the transaction closing and integration.

In practical terms, the company says the product will help teams trace agent decisions and tool calls, spot behavioral drift or unintended actions, and create records for audits. That is different from conventional endpoint protection: observability helps teams understand what an agent did and why, while a runtime control is intended to intervene when behavior crosses a policy line.

Dreadnode would test AI before deployment

The planned Dreadnode acquisition adds a pre-deployment testing layer. CrowdStrike says the technology can run more than 100 known attack strategies—including jailbreaks and prompt injection—against AI models, applications and agents, then rank findings for review. The company plans to make the offering generally available in Q4 FY27, pending customary closing conditions.

That gives Dreadnode a different role from Fiddler: testing looks for weaknesses before systems go live; observability records behavior after deployment. Both are planned integrations, not completed product rollouts.

What is the reported deal value?

CrowdStrike’s releases do not state a purchase price. The Wall Street Journal reported that CrowdStrike would pay roughly US$400 million for Fiddler and about US$95 million for Dreadnode, or US$495 million combined. The report says most of the consideration would be cash, with part in stock subject to vesting. CrowdStrike’s releases confirm the cash-and-stock structure but not the dollar amounts. TechCrunch also attributed the estimates to the Journal, while CyberScoop independently covered the proposed acquisitions and planned integrations.

Why the announcements matter to businesses

Many organizations are testing AI agents that can use tools, access company systems and perform multi-step tasks. That creates a security question beyond whether the underlying model is accurate: what can the agent access, what does it do when instructions conflict, and can a person intervene if it goes off course?

CrowdStrike is positioning the three moves as a connected answer: test systems before launch, observe their decisions in production, and give administrators a way to interrupt activity. Whether that approach delivers broad protection will depend on the final products, supported agents and frameworks, deployment coverage, and how reliably the controls work in customers’ environments. The announced acquisitions remain pending, and endpoint termination for the Kill Switch is still described as forthcoming.

Key questions

Have the Fiddler and Dreadnode acquisitions closed?

No. CrowdStrike announced definitive agreements to acquire both companies. The proposed transactions remain subject to customary closing conditions; CrowdStrike expects them to close in Q4 FY27.

How much is CrowdStrike paying?

The company has not disclosed the purchase prices. The Journal reported roughly US$400 million for Fiddler and US$95 million for Dreadnode, a combined US$495 million.

Can CrowdStrike’s AI Kill Switch stop any AI agent?

CrowdStrike says its feature can terminate agents, block relaunch and cut network access. Its release says termination is currently at the Gateway, with endpoint termination coming soon. The announcement does not establish that it covers every agent or environment.