购置
CrowdStrike AI安全计划小提琴手和Dreadnode购置
在 Google 上的首选来源中添加 Unite.AI
CrowdStrike 宣布于2026年11月3日表示打算收购小提琴手，其技术将变为Falcon Odvision，用于评价和解释AI-agent行为。 一个单独的公告详细计划是获取Dreadnode，并在系统到达生产前向猎鹰平台添加自动AI安全测试。
两项公告都出现在Fal.Con EU 2026，并描述了拟议的收购。 CrowdStrike计划在2027财年第四季度为猎鹰观测和Dreadnode提供通用服务。 计划的产品涉及不同的控制：在发布前检测AI的弱点，评价agents是否完成预定任务，部署后监测其决定。
小提琴手在猎鹰观察中的作用
在部署前，团队可以在评价agents是否安全准确地执行指定任务时，使用Fiddler来比较提示，模型和配置。 部署后，该平台旨在追踪跨越整个agent层级的决定和推理路径，识别行为漂移和意外行动。 它重建了决策过程，使团队能够找到导致失败的阶梯。
这种可见度解决了常规安全控制方面的漏洞。 CrowdStrike的退款例子描述了agent使用有效证书和批准的工具来批准违反公司政策的退款。 传统控制可能看到合法活动，即使决定是错误的；可解释性是为了揭示agent为何行动，以及其行为在哪里发生错误。
Fiddle覆盖了第一方和第三方的agents，并通过OpenTeleometry支持仪器化，与LangGraph,Amazon Bedrock,AWS Strands和Google ADK并列。 其决策层记录旨在支持合规和审计。 在猎鹰内部，agent的意向和行为会与端点，身份，云和运行时的安全遥测相联，让安全小组可以研究agent为何采取行动以及因此在企业系统之间发生的事情。
Dreadnode 生产前测试
Dreadnode开始于对想要的测试的简单语言描述，然后在生产前探测AI系统，模型，模型寄存器，应用，agents和MCP服务器。 CrowdStrike 称它运行着50多种攻击技术，包括越狱，提示词注入，多回合攻击和agent特有攻击。 调查结果按严重程度排列，并绘制为LLMs的OWASP前10名、通过ASI10的OWASP代理安全类别ASI01、MITRE ATLAS和NIST AI风险管理框架。
这些结果为综合风险观点提供了依据，涵盖总体调查结果、攻击成功率、严重性崩溃、寻找结果和更深层次的风险衡量尺度。 可导报告支持去/不去决定。 人类审查人员可以检查准确的攻击者迅速和有目标的反应，一步一步地穿过攻击，重新分类发现，调整严重程度，并记录他们的推理。 盘式计数器在重新分类结果时重新计算。
计划中的交接将测试与跑时防御连接。 Dreadnode的调查结果将作为政策建议为猎鹰卫士提供参考，允许在部署前发现的弱点在释放后告知保护情况。 测试数据也会支持CrowdStrike的安全明度模型。 Falcon Guardian在运行时间为企业开发的AI提供AI检测和响应，Falcon Oview则评价并解释agents的行为是否如意。
这些建议共同描述了从生产前测试和评价到持续观察和运行时间保护的相互关联的工作流程。 实现这一链条取决于完成拟议的收购和建立承诺的一体化，使执行与可用性目标相对应成为CrowdStrike扩大的AI-安全路线图中的核心开放问题。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Acquisitions
CrowdStrike Plans Fiddler and Dreadnode Acquisitions for AI Security
Add Unite.AI to your preferred sources on Google
CrowdStrike announced on November 3, 2026 that it intends to acquire Fiddler, whose technology will become Falcon Observe for evaluating and explaining AI-agent behavior. A separate announcement detailed plans to acquire Dreadnode and add automated AI security testing to the Falcon platform before systems reach production.
Both announcements came at Fal.Con EU 2026 and describe proposed acquisitions. CrowdStrike targets general availability for Falcon Observe and Dreadnode in the fourth quarter of its 2027 fiscal year. The planned products address distinct controls: probing AI for weaknesses before release, evaluating whether agents perform their intended tasks, and monitoring their decisions after deployment.
Fiddler’s Role in Falcon Observe
Before deployment, teams can use Fiddler to compare prompts, models and configurations when evaluating whether agents perform assigned tasks safely and accurately. After deployment, the platform is designed to trace decisions and reasoning paths across the full agent hierarchy, identifying behavioral drift and unintended actions. It reconstructs the decision process so teams can locate the step that caused a failure.
That visibility addresses a gap in conventional security controls. CrowdStrike’s refund example describes an agent using valid credentials and approved tools to approve a refund that violates company policy. Traditional controls may see legitimate activity even though the decision was wrong; explainability is intended to reveal why the agent acted and where its behavior went awry.
Fiddler covers first-party and third-party agents and supports instrumentation through OpenTelemetry, alongside LangGraph, Amazon Bedrock, AWS Strands and Google ADK. Its decision-level records are intended to support compliance and audits. Within Falcon, agent intent and behavior would be connected with endpoint, identity, cloud and runtime security telemetry, giving security teams a way to examine both why an agent acted and what happened across enterprise systems as a result.
Dreadnode’s Pre-Production Testing
Dreadnode begins with a plain-language description of the desired test, then probes AI systems, models, model repositories, applications, agents and MCP servers before production. CrowdStrike said it runs more than 50 attack techniques, including jailbreaks, prompt injection, multi-turn attacks and agent-specific attacks. Findings are ranked by severity and mapped to the OWASP Top 10 for LLMs, OWASP Agentic Security categories ASI01 through ASI10, MITRE ATLAS and the NIST AI Risk Management Framework.
The results feed a combined risk view covering total findings, attack success rates, severity breakdowns, finding outcomes and deeper risk metrics. An exportable report supports go/no-go decisions. Human reviewers can inspect the exact attacker prompt and target response, walk through an attack step by step, reclassify findings, adjust severity and document their reasoning. Dashboard metrics recalculate when findings are reclassified.
The planned handoff connects testing with runtime defense. Dreadnode findings would feed Falcon Guardian as policy recommendations, allowing weaknesses identified before deployment to inform protections after release. Testing data would also support CrowdStrike’s SafeMind models. Falcon Guardian provides AI detection and response for enterprise-developed AI at runtime, while Falcon Observe evaluates and explains whether agents behave as intended.
Together, the proposals describe a connected workflow from pre-production testing and evaluation through continuous observation and runtime protection. Delivering that chain depends on completing the proposed acquisitions and building the promised integrations, making execution against the availability target the central open question in CrowdStrike’s expanded AI-security roadmap.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.