CrowdStrike used its Fal.Con Europe conference in Barcelona on Tuesday, November 3, to make three connected moves on AI agent safety. The company introduced an AI Kill Switch inside Falcon Guardian, and it signed agreements to acquire two AI security startups, Fiddler AI and Dreadnode. Together, the announcements cover testing an agent before it ships, watching it in production, and stopping it when it goes off course.
The Kill Switch is the piece that is available now. CrowdStrike says an authorized administrator can terminate an agent that is exhibiting risky behavior, block it from relaunching, and cut its access to the enterprise network, with each action recorded in an audit log. The company says termination currently starts at the gateway, with endpoint termination coming soon. In a blog post, CrowdStrike described the feature as a first step toward broader enforcement across the endpoints, identities, cloud environments, software services, and browsers where agents operate.
Fiddler AI is the larger of the two planned purchases. Founded in 2018 and based in Palo Alto, the company sells tools that evaluate agents before deployment and monitor and explain their behavior once they are running. Its platform can trace the reasoning workflow and tool use behind an agent decision, which helps developers find the specific step that went wrong. Fiddler also uses custom models, which it calls Centor, to filter malicious prompts and block harmful output. CrowdStrike plans to offer the technology as Falcon Observe, and its chief executive, George Kurtz, has called it the flight recorder for every agent.
Dreadnode takes the opposite approach. Founded in 2023, the startup runs simulated attacks against models and agents before they reach production. SiliconANGLE reported that its platform uses more than 100 breach tactics to reveal weak points, and that it also looks for vulnerabilities in the MCP servers that agents use to carry out their work, ranking the issues it finds by severity. CrowdStrike plans to integrate Dreadnode into Falcon Guardian, so that the vulnerability data can feed recommendations for improving an agent setup.
CrowdStrike did not disclose what it is paying for either company. The Wall Street Journal reported a combined price of about 495 million dollars, with roughly 400 million dollars for Fiddler and about 95 million dollars for Dreadnode. CrowdStrike said both deals will be funded predominantly in cash, with a portion in stock subject to vesting. Both transactions are expected to close in the fourth quarter of CrowdStrike fiscal 2027, the quarter ending January 31, 2027, and the Falcon capabilities built on them are planned for general availability in that same quarter.
The timing reflects a real change in what security teams are being asked to control. Agents are no longer only answering questions. They are calling tools, moving through company systems, and taking actions that can be difficult to reverse. That makes a log after the fact less useful on its own. Teams also need a way to intervene while an agent is running, and a record that explains why it acted as it did.
CrowdStrike is not alone in building for that problem, and its claims should be read as vendor claims until the integrated products ship and are tested in customer environments. Even so, the shape of the package is instructive. One purchase watches and explains, one attacks and probes, and one switch stops. If agents are going to do consequential work inside companies, that combination of observation, testing, and a reliable way to stop is likely to become a standard expectation, rather than an optional extra.