CrowdStrike announced two purchases at its Fal.Con Europe conference in Barcelona on November 3, and both companies help businesses keep their AI tools safe. Fiddler watches AI agents, the software assistants that can take actions inside a company's systems, while they are running. CrowdStrike will rename that product Falcon Observe. Dreadnode attacks a company's AI tools before launch to find weak spots. CrowdStrike did not say what it paid. CyberScoop, citing The Wall Street Journal, reported about $400 million for Fiddler and about $95 million for Dreadnode (CyberScoop, 2026).

Dreadnode is the smaller deal, and it brings CrowdStrike a new buyer. CrowdStrike's usual customer is the security team, the people who watch for attacks on systems that are already running, and Fiddler fits that customer. Dreadnode's customer is the engineering team that builds an AI tool and decides when it is ready to launch. Security teams weigh in on that decision. Engineers make it.

The engineers who build AI tools decide what Dreadnode's report is worth

A Dreadnode test starts with someone describing, in everyday language, the AI tool they want checked. Dreadnode then tries more than 50 kinds of attack on it (Sentonas, 2026). One example is a jailbreak, where an attacker words a request so the AI ignores its own safety rules. Another is a long, multi-step conversation that steers the AI into doing something it should not.

Dreadnode sorts the problems from most to least serious and matches them against security checklists published by the Open Worldwide Application Security Project, MITRE and the National Institute of Standards and Technology. The result is a report that answers one question: is this AI tool safe enough to launch?

In a typical company, the engineers and the business owner of the AI tool answer that question, and the security chief reviews the answer. CrowdStrike built its business selling to security chiefs. To make Dreadnode pay off, its salespeople need to win over engineering teams they have not sold to before.

Dreadnode also lets a person check its work. A reviewer can see the exact attack and the AI's exact reply, change how serious a problem is rated, and write down why. Keep that record. If a board member or regulator later asks who decided an AI tool was safe to launch, you will have the answer in writing.

CrowdStrike will turn Dreadnode's test results into protections inside its own products

CrowdStrike sells a product called Falcon Guardian that blocks attacks on AI tools while they are running. CrowdStrike plans to send Dreadnode's findings into Guardian as suggested blocking rules. If testing shows your AI tool falls for a certain trick, you can set Guardian to watch for that trick after launch. CrowdStrike announced Guardian last month, and Guardian builds on Pangea, a company CrowdStrike bought in 2025.

Other big security companies made the same move. Cisco bought Robust Intelligence in 2024. Palo Alto Networks bought Protect AI, Check Point bought Lakera, and F5 agreed to pay $180 million for CalypsoAI in September 2025 (Beek, 2025). Each buyer paired AI attack testing with a product that blocks attacks after launch. Within about two years, the large vendors bought up the best-known independent companies that test AI this way.

CrowdStrike will take each weakness your tests uncover and write a blocking rule for it inside its own product.

That setup helps a busy security team, because the testing tool and the protection tool share what they learn. One round of testing produces rules that protect every AI tool your company runs on Guardian, so each team building AI gets the same defenses without writing its own tests and rules from scratch. Over a year, those shared results grow into a library of protections tuned to your business.

Ask CrowdStrike how you can export that library, so the work stays yours as your plans change.

CrowdStrike says the product will be ready within three months

CrowdStrike expects to finish the purchase and start selling Dreadnode by the end of its fiscal fourth quarter. CrowdStrike's fiscal year ends January 31, which gives the company about 13 weeks. That is a short time to join two products together. Ask what will work on day one and what will come later, starting with the link to Guardian.

Ask about the attack count as well. CrowdStrike's blog says more than 50 attack techniques (Sentonas, 2026), while news coverage of the press release says more than 100 attack strategies (Investing.com, 2026). Both can be true if each source counts attacks in its own way. The number that matters to you is how well Dreadnode tests the systems your own AI tool can reach, such as your customer records or your claims system.

Dreadnode's hacker culture now has to fit CrowdStrike's product schedule

Dreadnode's founders come from ethical hacking, where experts break into systems on purpose to find flaws before criminals do. Will Pearce led AI attack testing at NVIDIA, and Nick Landers ran research at the security firm NetSPI. Dreadnode raised $14 million in early 2025 from investors led by Decibel, with In-Q-Tel, a nonprofit investor that backs technology for U.S. national security, also taking part (Dreadnode, 2025). Dreadnode runs Crucible, an online set of challenges where people practice hacking AI systems. The deal announcement names Brad Palm as chief executive, and the team will join a CrowdStrike research group called the Cyber Superintelligence Lab.

Palm told CyberScoop that the people best suited to find AI flaws think like attackers. Crucible and Dreadnode's open-source software, which anyone can download, built that reputation. CrowdStrike has not said whether those public projects will continue once the team works on CrowdStrike's product schedule.

CrowdStrike has not said whose test data will train its AI

CrowdStrike says data from Dreadnode testing will improve SafeMind, its set of AI models for measuring how secure other AI models are. The announcement does not say whether that data includes tests customers run on their own AI tools.

A test of your AI tool creates a written log of every attack and every reply. Those replies can reveal the hidden instructions your team gave the AI or pieces of your internal data. CrowdStrike customers have shared security data for years, but that data describes files and programs on a computer. A test log describes your business. Before you test anything connected to real company data, read the contract terms on how long CrowdStrike keeps that log and whether it can use the log to train its AI.