CrowdStrike agrees to buy Dreadnode to test AI security before deployment

CrowdStrike is buying a way to probe AI systems for weaknesses before businesses put them to work. On November 3, 2026, the company said it had signed a definitive agreement to acquire Dreadnode, with plans to bring automated attack testing for AI models, applications and agents into its Falcon security platform.

The purchase price was not disclosed. CrowdStrike expects to pay predominantly in cash, with a stock portion subject to vesting conditions. The transaction is expected to close in its fourth quarter of fiscal 2027, subject to customary closing conditions. The company also targets that quarter for general availability of the automated AI security testing offering.

Attacking the system before it ships

Dreadnode’s workflow begins with a plain-language description of what a user wants to test.

The techniques include jailbreaks, which try to defeat an AI system’s restrictions, and prompt injection, which attempts to manipulate it through instructions. Dreadnode also tests attacks spread across multiple exchanges and attacks aimed specifically at agents. The intended scope extends beyond a model’s answer to the agent’s reasoning process and the components supporting it.

CrowdStrike’s rationale is that conventional security testing was built for code that behaves consistently, while AI systems can respond differently and be manipulated inside their reasoning loops. In its account, an agent’s weakness can give an attacker a route to sensitive systems and data that the agent can access. That is the risk the proposed acquisition is intended to address before deployment.

AI fails in ways traditional testing was never designed to catch, and the people best equipped to find those failures think like attackers. We founded Dreadnode to expose those weaknesses before AI reaches production.

Brad Palm, Dreadnode CEO

People still judge the findings

The output is meant to support a release decision, not simply produce a list of successful attacks. CrowdStrike says Dreadnode ranks findings by severity, connects them to established security and risk frameworks, and produces exportable reports. Its dashboard brings together total findings, attack success rates, severity breakdowns and finding outcomes.

What reviewers can inspect and change

• Inspect the exact attacker prompt and target response, then walk through an attack step by step.
• Reclassify findings, change their severity and record the reasoning behind those judgments.
• See dashboard metrics recalculate automatically when findings are reclassified.

The framework mappings include OWASP’s categories for language-model and agent security risks, MITRE ATLAS and NIST’s AI Risk Management Framework. These give teams named categories for organizing the findings.

Turning test results into live defenses

The planned integration would carry findings beyond the testing dashboard. Dreadnode results would feed Falcon Guardian as policy recommendations. Guardian protects enterprise-developed AI while it runs, so the proposed connection would let a weakness found during testing inform the rules used after deployment. CrowdStrike also plans to use Dreadnode’s testing data to strengthen its SafeMind models.

Dreadnode’s team is set to join CrowdStrike’s Cyber Superintelligence Lab. The company says the technology will also help SafeMind assess the security and cyber capabilities of frontier models. Those integrations remain plans: CrowdStrike’s acquisition announcement explicitly identifies both closing the transaction and integrating Dreadnode’s technology and operations as subject to risks and uncertainties.