CrowdStrike launches AI kill switch, buys two security startups for $495M
CrowdStrike just gave admins a red button to kill rogue AI agents, plus spent nearly half a billion to secure the entire agent lifecycle.
Business · Source: CrowdStrike
What happened
CrowdStrike just released an AI Kill Switch for its Falcon Guardian platform. The company announced the feature on November 3 at Fal.Con Europe in Barcelona. The tool gives enterprise administrators a direct way to terminate AI agents that go off script or leave their intended behavior. Right now, the Falcon sensor stops the rogue agent at the gateway. CrowdStrike plans to add direct endpoint termination next.
The kill switch does more than just pause the software. It blocks the rogue agent from launching again on a host or a host group. It also completely removes the agent from enterprise network access. Every single step is recorded in an audit trail. The final trigger remains strictly under human control. Chief Executive Officer George Kurtz stated this feature is intended to let companies deploy agents while retaining control when their behavior changes.
To back up this new kill switch, CrowdStrike is reportedly spending 495 million dollars to acquire two AI security startups. They are buying Palo Alto based Fiddler AI to handle observability and explainability. Fiddler will become a product called Falcon Observe. They are also buying Dreadnode to handle pre-deployment security testing. Both of these acquisition deals are expected to close in the fourth quarter of fiscal year 2027.
Key facts
- $495 million — Reported combined acquisition price for Fiddler AI and Dreadnode
- Q4 FY27 — Expected close date for the startup acquisitions and Falcon Observe launch
- $400 million — Reported valuation for Fiddler AI based on 4x its funding
- $95 million — Reported valuation for Dreadnode based on 6.8x its Series A
Why it matters
Enterprise adoption of AI agents is currently stalled by a massive trust gap. Companies are terrified of autonomous software running wild in their networks with access to sensitive cloud services and data. This release fundamentally changes the math for enterprise adoption. By adding a hard stop and a verifiable audit trail, security teams finally have the safety net they need. They can greenlight agent deployments knowing they hold a red button.
We are seeing the birth of a complete AI security lifecycle. CrowdStrike is assembling the pieces to own this entire pipeline. Dreadnode tests the agent before it ever launches. Fiddler monitors the agent while it runs in production. The kill switch executes the agent if things go sideways. Security vendors will now have to offer end-to-end agent governance. Basic threat detection is no longer enough to win enterprise contracts.
For builders
Build agents with clear audit trails
Enterprises will demand proof of what your agent did before it was terminated. You need to log every action and API call. If your agent is a black box, enterprise security teams will simply not buy it.
Test against standard security frameworks
Dreadnode maps its automated testing to OWASP, MITRE ATLAS, and NIST frameworks. You must do the exact same thing. Buyers will use these exact standards to evaluate your AI products before deployment.
Prepare for gateway level interruptions
CrowdStrike currently stops rogue agents at the gateway. Your agent architecture must handle sudden network disconnections gracefully. If your system corrupts enterprise data when a gateway connection drops, you lose the client.
My take
I have been saying this for months. You cannot sell autonomous agents to the enterprise without an eject button. CrowdStrike just validated the entire AI security market. Founders building naked agents are about to hit a massive brick wall.
Original reporting: CrowdStrike. This is my rewrite and opinion.