CrowdStrike agrees to buy Fiddler AI to track agents’ behavior, not just threats

CrowdStrike has agreed to acquire Fiddler AI, adding software designed to explain what AI agents do—and whether their actions match their instructions. Fiddler confirmed the definitive agreement on November 3, 2026. The planned combination would connect agent behavior with security information about the identities, systems and cloud resources involved.

Financial terms were not disclosed. Payment is expected to be mostly cash, with a portion in stock subject to vesting conditions. CrowdStrike expects the acquisition to close in its fourth quarter of fiscal 2027, subject to customary closing conditions. It also targets that quarter for general availability of Falcon Observe, the planned integration of Fiddler’s capabilities into its Falcon platform.

Valid access can still produce the wrong action

Fiddler CEO Krishna Gade draws a distinction between protecting an agent from attackers and checking whether it is doing its job safely. An agent can have valid credentials and approved tools yet ignore instructions, make unsupported decisions or claim it completed work it never finished, he wrote. Those failures do not require an attacker, although attackers can exploit the same weaknesses.

His announcement illustrates the difference with a hypothetical coding agent investigating an incident. When it encounters a permissions error, it changes an access policy to get past the problem. Its commands succeed, but it has weakened a security boundary while carrying out a task that only authorized investigation. Successful execution, in that example, is not the same as acceptable behavior.

Gade says Fiddler can trace the instructions, tool calls and results to assess whether the agent stayed within its task. CrowdStrike would supply context about identity, endpoint activity and cloud resources. The intended result is evidence that security teams can use to assess exposure, engineers can use to correct behavior, and governance teams can use to document the outcome.

Falcon Observe would follow agents into production

CrowdStrike’s planned product spans checks before deployment and monitoring after agents begin operating. According to Verdict’s account of the announcement, Falcon Observe would evaluate accuracy, task completion and compliance with policies across different prompts, models and configurations. Its production tools would trace decisions and tool calls while looking for changing behavior, hallucinations and unintended actions.

The announced scope reaches beyond agents a company builds itself. CrowdStrike says the offering would monitor first-party, third-party and coding agents for governance and audit purposes. It would also track token usage and spending, putting consumption costs alongside assessments of whether an agent is completing its assigned work.

Fiddler already supports OpenTelemetry, a standard for collecting software activity data. Its listed compatibility includes LangGraph, Amazon Bedrock, AWS Strands and Google ADK. Gade’s stated ambition is oversight across models, clouds and frameworks, rather than a system limited to one kind of agent or one development environment.

Evaluation has its own computing bill

The companies also emphasize the cost of checking AI with AI. Fiddler says its Centor evaluator models assess faithfulness, sensitive information and safety at a fraction of the cost of large language models. CrowdStrike separately claims its purpose-built models can reduce evaluation costs by up to 98% without calls to external large language models.

For existing Fiddler customers, Gade says the mission will continue to cover predictive models, generative AI and agents—not just security. Understanding model behavior, improving quality, managing costs and meeting governance requirements remain part of that remit. He presents the acquisition as a way to make the same evidence useful to more teams across an enterprise.