CrowdStrike to Acquire Dreadnode for Automated AI Security Testing
CrowdStrike has announced its intent to acquire Dreadnode, a company that tests AI models, applications and agents for security weaknesses before they go into production. The technology is meant to become part of the CrowdStrike Falcon platform, according to a post by Michael Sentonas published at Fal.Con EU 2026.
- CrowdStrike announced its intent to acquire Dreadnode at Fal.Con EU 2026.
- Dreadnode tests AI models, applications and agents with known attack techniques before deployment.
- It runs more than 50 attack techniques, including jailbreaks, prompt injection and agent-specific attacks.
- Findings are ranked by severity and mapped to OWASP, MITRE ATLAS and NIST AI RMF.
- According to CrowdStrike, Dreadnode will be generally available in Q4 FY27.
Why CrowdStrike wants pre-production AI testing
CrowdStrike argues that many businesses deploy AI models and agents before confirming they are secure, an approach it says "can have severe consequences." According to the company, an agent that ships with a weakness allowing jailbreaking or manipulation gives an adversary a way to reach the sensitive systems and data that the agent can access.
CrowdStrike says such weaknesses must be found before an agent goes live, and that security testing built for conventional software does not find them. The company describes the probabilistic and dynamic nature of AI agents and LLMs as having broken the traditional security testing model, which was designed to assess code that behaves the same way every time. In its view, that older approach cannot identify weaknesses inside the reasoning loop built into AI models and agents.
The post lists prompt injection, jailbreaking and agent tool manipulation as risks that can lead to customer data loss, financial loss and brand reputation damage.
How Dreadnode works
According to CrowdStrike, users first describe in plain language what they want to test. Dreadnode then runs more than 50 attack techniques against the AI systems a business relies on. The listed techniques include jailbreaks, prompt injection, and multi-turn and agent-specific attacks. The targets named in the post are AI systems, models, model repositories, applications, agents and MCP servers, all tested before they reach production.
Once testing is complete, Dreadnode ranks findings by severity and maps them to several frameworks:
- OWASP Top 10 for LLMs
- OWASP Agentic Security (ASI01-ASI10)
- MITRE ATLAS
- NIST AI RMF
All assessments are combined into a single risk picture. CrowdStrike says it includes total findings, attack success rates, severity breakdown, finding outcomes and deep risk metrics. The source text is cut off at this point, so further details on what Dreadnode delivers are not covered here.
What it means for Falcon customers
CrowdStrike says that together with Dreadnode it will extend the Falcon platform into the layer where businesses build AI. The goal, according to the company, is that every customer can evaluate their AI agents for security gaps and deploy them with confidence.
The company states that Dreadnode will be generally available in Q4 FY27. The post does not give pricing or other availability details. As this is an announced intent to acquire, the deal has not been described as completed in the source.
The announcement sits within a broader set of AI security news that CrowdStrike published on the same day. The company's blog lists related items on an AI Kill Switch for rogue agents, a planned acquisition of Fiddler for AI agent observability, and wider AI security and safety work from endpoint to cloud.
