CrowdStrike (CRWD.US) recently announced that it has reached agreements to acquire two artificial intelligence (AI) security startups for a combined $495 million, according to a report.
As enterprises rush to deploy AI agents, these acquisitions will strengthen the company's ability to monitor and manage risks associated with AI agents, add complementary capabilities to its enterprise AI security business, and are expected to further deepen the company's role in this area.
Specifically, CrowdStrike will acquire Palo Alto, California-based Fiddler AI for approximately $400 million. Founded in 2018, the company develops software for monitoring and explaining agent behavior.
CrowdStrike is simultaneously acquiring Dreadnode for approximately $95 million. Founded in 2023, the company provides an automated security testing platform that can detect vulnerabilities in AI models before they go live.
CrowdStrike stated that the majority of the consideration for both acquisitions will be paid in cash, with the remainder in restricted stock.
In its latest research note, Morgan Stanley stated that CrowdStrike's acquisitions of Fiddler and Dreadnode will expand Falcon's coverage across the AI security lifecycle. The bank maintained its "Overweight" rating on CrowdStrike, kept its base case target price at $254, and expressed increased confidence in its $308 bull case target price.
Morgan Stanley explained that Fiddler provides agent observability and explainability capabilities, enabling assessment of agent accuracy and policy compliance before deployment, tracking of agent decisions and tool calls in production environments, and detection of hallucinations, behavioral drift, and unintended actions. The technology will be launched as Falcon Observe, designed to address a risk that goes beyond malicious activity: even when agents possess legitimate credentials, they may still make unfounded decisions or fail to complete assigned tasks.
Dreadnode adds automated security testing capabilities covering models, applications, agents, and MCP servers, utilizing over 100 attack strategies to identify security weaknesses such as jailbreak attacks and prompt injection before deployment. Its test results will be fed back to Guardian as policy recommendations, while test data will be used to strengthen the SafeMind model.
Combined, these two capabilities should complement Guardian's runtime protection capabilities, helping customers identify weaknesses before deployment, provide protection during agent operation, and investigate whether agent behavior meets expectations. Fiddler will also correlate agent behavior with Falcon's identity, cloud, and runtime intelligence, providing enterprise risk context for investigations and audit records.
Morgan Stanley believes that integrating these workflows should enhance Falcon's value proposition: on one hand, reducing the effort customers need to coordinate different testing, monitoring, and security tools, and on the other hand, linking agent behavior to the systems they affect. This could also make Falcon more appealing to AI engineering teams and governance teams, in addition to continuing to serve its traditional security customers.
Falcon Observe and automated AI security testing are expected to be officially launched in the fourth quarter of fiscal year 2027. Both transactions are also expected to close in that quarter, subject to customary closing conditions.
Combined, these two capabilities should complement Guardian's runtime protection capabilities, helping customers identify weaknesses before deployment, provide protection during agent operation, and investigate whether agent behavior meets expectations. Fiddler will also correlate agent behavior with Falcon's identity, cloud, and runtime intelligence, providing enterprise risk context for investigations and audit records. We believe that integrating these workflows should enhance Falcon's value proposition: on one hand, reducing the effort customers need to coordinate different testing, monitoring, and security tools, and on the other hand, linking agent behavior to the systems they affect. This could also make Falcon more appealing to AI engineering teams and governance teams, in addition to continuing to serve its traditional security customers.
Falcon Observe and automated AI security testing are expected to be officially launched in the fourth quarter of fiscal year 2027. Both transactions are also expected to close in that quarter, subject to customary closing conditions.
Platform Strategy and AI Security Investment Thesis Strengthened
Morgan Stanley believes these acquisitions further reinforce its investment thesis: CrowdStrike's leadership in endpoint security, increasing customer adoption of emerging modules, and its increasingly favorable market positioning in AI are expected to support the company in sustaining revenue growth of over 20% in the long term.
Morgan Stanley emphasized that CrowdStrike's market opportunity revolves around three main areas: addressing legacy technical debt, automating security operations centers (SOCs), and securing AI. Fiddler and Dreadnode further deepen the third pillar—AI security—by expanding the problems Falcon can solve when customers deploy agents.
Early signs of positive momentum are already emerging. During the second quarter of fiscal year 2027, ending July 31, 2026, AIDR's annual recurring revenue (ARR) nearly tripled quarter-over-quarter, providing evidence of market demand for runtime protection. Meanwhile, these acquisitions are expected to extend customer conversations further into testing, operational reliability, and governance.
Additionally, Falcon Flex has already demonstrated its potential for rapidly rolling out new products. During the second quarter, ARR contributed by Flex customer accounts reached $2.29 billion, up 101% year-over-year. If integration proceeds smoothly, customers will have more reasons to consolidate vendors, expand platform commitments, and continue using Falcon as their AI projects scale.
Testing capabilities and behavioral accountability mechanisms may also help enterprises deploy agents into higher-impact workflows, potentially connecting CrowdStrike to broader AI deployment budgets.
As the product portfolio continues to expand, Morgan Stanley will monitor progress on product integration, incremental paid adoption rates of new products, customer business expansion, and ultimately the contribution to ARR. At the same time, the bank will also watch whether the company can maintain discipline on integration costs and margins, in order to build greater confidence in its development roadmap.
Morgan Stanley added that although CrowdStrike's valuation remains elevated, with its enterprise value/free cash flow/growth (EV/FCF/G) multiple reaching 3.2x compared to 1.9x for cybersecurity peers, the bank still believes CrowdStrike has an opportunity to reach its $308 bull case target price.
Morgan Stanley emphasized that as the company leverages these acquisitions to further benefit from a potential acceleration in cybersecurity spending growth while continuing to expand market share, its stock price still has room for further upside.
Comments