When an AI agent takes an action nobody approved, CrowdStrike wants its Falcon platform to be where a company finds out what happened and why. The cybersecurity company said Tuesday it has signed definitive agreements to buy two startups: Fiddler AI, which tracks and explains what agents do, and Dreadnode, which attacks AI models and agents to find weak spots before they reach production.
Both deals were announced at CrowdStrike’s Fal.Con Europe conference in Barcelona. CrowdStrike didn’t disclose a price for either company. Each announcement says the purchase price will be paid predominantly in cash, with a portion delivered in stock subject to vesting conditions, and each deal is expected to close during CrowdStrike’s fourth quarter of fiscal 2027, subject to customary closing conditions.
A record of what the agent did
Fiddler will be sold as part of Falcon under the name Falcon Observe, with general availability planned for the fourth quarter of fiscal 2027. CrowdStrike said the product will evaluate agents for accuracy and policy compliance before deployment, trace their decisions and tool calls across the full agent hierarchy, and flag behavioral drift, hallucinations and unintended actions once they are live. It will also track token usage and spending, and the company claims Fiddler’s purpose-built models can cut evaluation costs by up to 98% without calling external LLMs. Supported frameworks include LangGraph, Amazon Bedrock, AWS Strands and Google ADK, instrumented through OpenTelemetry.
“When a regulator or your board asks what an agent did, saying ‘the model did it’ is not an answer,” George Kurtz, CrowdStrike’s CEO and founder, said in the announcement. “Fiddler is the flight recorder for every agent: the observability to explain exactly what an agent did and why.”
Krishna Gade, Fiddler’s CEO and co-founder, said the startup was founded to answer whether enterprises can trust what their AI agents are doing. “As AI security and observability converge, enterprises need to understand their agents’ actions, intervene when they go off course, and explain why,” he said.
Breaking the AI before attackers do
Dreadnode covers the earlier stage. Its software runs more than 100 known AI attack strategies, among them jailbreaks, prompt injection and multi-turn, agent-specific attacks, against models, agent reasoning loops, applications and the MCP servers that connect agents to tools. Findings are ranked by severity and mapped to frameworks such as the OWASP Top 10 for LLMs, MITRE ATLAS and the NIST AI RMF. CrowdStrike said those findings will feed Falcon Guardian, its AI detection and response product, as policy recommendations, and Dreadnode’s team will join the company’s Cyber Superintelligence Lab. The testing product is also slated for the fourth quarter of fiscal 2027.
“AI fails in ways traditional testing was never designed to catch, and the people best equipped to find those failures think like attackers,” said Brad Palm, Dreadnode’s CEO.
The kill switch is available now
One piece of the news didn’t have to wait for a deal to close. CrowdStrike released an AI Kill Switch in Falcon Guardian that lets an authorized administrator stop a misbehaving agent, block it from relaunching on a host or host group, and cut its enterprise network access, with every action logged. Termination happens first at the Gateway and “soon” on the endpoint, the company said.
“One control point isn’t enough to stop that,” Michael Sentonas, CrowdStrike’s president, said in a separate release on the Guardian updates, describing agents that chain steps together and take actions they were never authorized to take.
CrowdStrike isn’t the only vendor building agent controls. IBM recently tied AI agent identity to HashiCorp Vault so access can be cut off mid-task, and Fortinet added prompt and MCP tool-call inspection to FortiGate through a cloud service. CrowdStrike is also reaching into Anthropic’s product: it said Tuesday it is bringing Falcon Guardian natively into Claude Cowork, an integration The Next Web reported is in beta on macOS, with Windows support expected later in November.
Fal.Con Europe wraps up Wednesday. On Monday, its first day, CrowdStrike announced security deals with Dell, Dynatrace and CoreWeave, according to The Next Web.
from WebProNews https://ift.tt/cleSw2M
No comments:
Post a Comment