Key announcements from the cybersecurity giant included the unveiling of two AI security acquisition deals, along with the launch of new capabilities including controls for rogue agents and detection for AI-powered insider threats.
CrowdStrike debuted its next set of major moves to advance the AI-powered capabilities of cyber defenders this week—amid increasing urgency around protecting against fast-moving attacks that are using the same agentic-driven technologies.
Key announcements from the cybersecurity giant at its Fal.Con 2026 Europe conference included the unveiling of two AI security acquisition deals, along with the launch of new capabilities including controls for rogue agents and detection for AI-powered insider threats.
[Related: CrowdStrike SafeMind Gives Frontier AI To Defenders That Doesn’t Just Create ‘More Work:’ Partners]
Notably, CrowdStrike said that the planned acquisitions and new capabilities will provide a boost to the company’s SafeMind frontier AI models and harnesses, which were unveiled at Fal.Con 2026 in September.
During his keynote Tuesday at the Barcelona conference, CrowdStrike co-founder and CEO George Kurtz said that AI agents are undoubtedly changing the calculus for cyber defense teams—by putting advanced cyberattack capabilities within reach of a far broader array of threat actors.
“Every adversary, every e-crime crew, every insider, now can operate like a nation state,” Kurtz (pictured) said.
The ideal way to respond is to provide defenders with access to more capable AI, while at the same time establishing the necessary controls to deploy agents securely within businesses, he said.
“Slowing down future AI development won’t fix the risks in front of us,” Kurtz said. “Frontier and open-weight models are literally everywhere, including in the hands of the adversary.”
What follows are the details on CrowdStrike’s five biggest moves at Fal.Con 2026 Europe.
Dreadnode Acquisition Deal: Automated AI Security Testing
CrowdStrike announced Tuesday it has agreed to acquire Dreadnode to help partners and customers identify weaknesses in the security of AI models, applications and agents before deploying them more widely.
The deal is valued at about $95 million, according to The Wall Street Journal, though CrowdStrike did not disclose terms of the deal. The company expects the acquisition to close during the fourth quarter of its fiscal 2027, which ends Jan. 31.
The planned acquisition of Dreadnode is aimed at bringing capabilities for automated AI security testing to CrowdStrike’s Falcon platform, according to Kurtz.
“It runs more than 100 attack strategies against your AI models, applications and agents—and what it learns will make SafeMind’s model even stronger,” he said.
Dreadnode’s team will join CrowdStrike’s Cyber Superintelligence Lab, the company said.
Fiddler AI Acquisition Deal: Improved Visibility For Agents
CrowdStrike’s planned acquisition of Fiddler AI, meanwhile, is aimed at adding visibility into the decisions and actions of AI agents, the company said—with the technology slated to form the basis for a new offering called Falcon Observe.
CrowdStrike, which did not disclose terms of the deal, is reportedly paying about $400 million for Fiddler, according to The Wall Street Journal. The deal is also expected to close during the fourth quarter of CrowdStrike’s fiscal 2027, which ends Jan. 31.
The move aims to address questions of the nature and reason for the actions taken by agents, according to CrowdStrike.
“Think of it as a flight recorder for every AI agent—every action, every decision [is] recorded and explained,” Kurtz said during his keynote.
“When a regulator, or perhaps your board, asks, ‘What did that agent actually do?’—if you say ‘The model did it,’ and shrug your shoulders, that’s not going to work,” he said. “This gives you the observability to explain what an agent did—and more importantly, why.”
Expanding Falcon Guardian With The AI Kill Switch
CrowdStrike announced Tuesday that it’s launching an AI Kill Switch for Falcon Guardian, providing security teams with a way to halt agents that have become compromised or begun to stray from their intended tasks.
The capability is aimed at enabling intervention into AI agent behavior that is highly targeted—as well as enabling a broader shutdown of an agent when necessary, Chief Product Officer AJ Shipley said during a media roundtable briefing ahead of the conference.
“A human makes that decision—and they can make it with surgical precision,” Shipley said.
“So it’s not a blunt-force instrument where we’re just cutting off all AI—although that is possible if necessary,” he said. “We are giving the power to the human with all of the context they need to be able to make very surgical or informed decisions, or to pull the circuit breaker and shut down all AI until they decide it’s safe for it to run again.”
Agentic Adversary Emulation
CrowdStrike announced the launch Wednesday of its new Agentic Adversary Emulation offering, which utilizes offensive AI to test how attackers could combine various weaknesses to reach an organization’s key assets. The tool then checks whether the resulting fixes actually block those routes, according to the company.
The offering is powered by CrowdStrike’s SafeMind frontier AI system, including its Red Tempest offensive model.
Ultimately, while “these aren’t new attack techniques, what is new is the speed and scale that they are being executed at,” Shipley said during the media roundtable. “These are all preventable gaps. They’re just going unprevented.”
With Agentic Adversary Emulation, “we don’t just stop at finding the problem,” Shipley said.
“CrowdStrike then will generate a set of compensating controls to close attack paths—including patches or configuration changes—or in some cases we will roll out new detections to be able to detect some of these new attack paths as well,” he said. “And then once we’ve done that, Red Tempest will re-run in order to validate that the fix has worked.”
Agentic Adversary Emulation is available in early access through Project QuiltWorks partners, CrowdStrike said.
Agentic SOC: Preventing AI-Agent Insider Risk
CrowdStrike announced Wednesday it is expanding its agentic SOC (Security Operations Center) capabilities to enhance identification of insider risk involving AI agents—particularly agents that are behaving unexpectedly, but without violating an explicit policy.
“The hardest case is the agent that behaves abnormally without breaking a business process rule,” Shipley said during the roundtable. “Policy and log-based tools will miss this because there’s no violation to catch.”
The Agent Insider Threat Detection capability will be available in Falcon Next-Gen SIEM, CrowdStrike said.
With the capability, “we learn the normal behavior and we start to baseline the normal behavior of every AI agent and the person that’s behind it,” Shipley said.
“And then when an agent deviates from what is expected or normal behavior, we detect it—even when a policy violation might not have been triggered—because that agent wasn’t acting maliciously or violating a policy; it was just acting abnormally,” he said. “That deviation then goes straight into a coordinated, multi-agent investigation in our SOC running on our Next-Gen SIEM.”
Ultimately, the result is that the capability can “converge on a trusted verdict in seconds,” Shipley said.
