โ† Back to news

Cyphrex Intelligence

CrowdStrike Buys Fiddler and Dreadnode as Sysdig Ships Per-Action Controls for AI Agents

November 5, 2026

Category: Industry Analysis | Reading time: 3 min

Two large security vendors moved on AI agent oversight in the same week. CrowdStrike announced it will acquire Fiddler AI and Dreadnode, and Sysdig made AI Defense generally available, a product that checks each action an agent takes before it completes.

CrowdStrike: about $495 million for two startups

At Fal.Con Europe on November 3, CrowdStrike said it signed a definitive agreement to acquire Fiddler AI, whose technology will become Falcon Observe, with general availability planned for Q4 of CrowdStrike's fiscal 2027. CrowdStrike lists pre-deployment evaluation, agent traceability, behavioral accountability, auditable governance and cost control among its features, with OpenTelemetry support for frameworks including LangGraph, Bedrock, Strands and ADK. Dreadnode, founded in 2023, which tests AI applications and agents for flaws, will fold into Falcon Guardian.

TechCrunch, citing the Wall Street Journal, puts the prices at about $400 million for Fiddler and about $95 million for Dreadnode.

Sysdig: allow, confirm or block

Sysdig says AI Defense sees every agent action from endpoint to cloud and can allow it, ask for confirmation, or block it before it finishes. It instruments the agent harness (tools, MCP servers, skills and plugins), keeps a live agent inventory traced to an accountable human, and ships policy templates mapped to the OWASP Top 10 for LLM applications, starting in alert mode before enforcement. Sysdig says it keeps "audit-grade, immutable records" of which policies applied and who signed off.

Why it matters

Both announcements describe the same requirement: knowing what each agent did, under which rule, and being able to prove it later. For regulated buyers, the open question is who stands behind that proof. A record held inside one vendor's platform has to be taken on that vendor's word. Evidence that is signed and independently timestamped can be checked by an auditor or regulator without that trust.

Source: CrowdStrike announcement, TechCrunch, Sysdig announcement