If Dreadnode tests your AI systems, or you have it on a shortlist, get its contract, on-prem and data terms in writing before the deal closes, because neither company has published them. CrowdStrike announced a definitive agreement on November 3 to buy Dreadnode and says its Automated AI Security Testing product will be generally available in Q4 FY27. The release never mentions existing customers, standalone sales or on-premises deployment.
The second decision belongs to your CISO. Dreadnode findings "will feed Falcon Guardian as policy recommendations," according to that release, so the company testing your agents will also sell the runtime product those findings point to. Decide now whether that test still counts as independent evidence for your board and your auditors.
What CrowdStrike Is Buying and What It Paid
CrowdStrike is buying automated attack testing for AI systems, at a price it has not disclosed. Automated AI red teaming means software that runs known attacks, such as jailbreaks and prompt injection, against a model or agent and scores whether they worked. The release promises more than 100 attack strategies aimed at "models, agent reasoning loops, applications, and MCP servers," with findings mapped to the OWASP Top 10 for LLMs, OWASP Agentic Security, MITRE ATLAS and the NIST AI RMF.
Two price figures are circulating, and they conflict. CyberScoop cites a Wall Street Journal report of $95 million for Dreadnode. TechBuzz cites unnamed sources for roughly $200 million. We could not read the Journal's report directly, so treat both as unconfirmed, with $95 million the better-attributed of the two. CrowdStrike says only that it will pay mostly in cash, with a portion in stock subject to vesting. For scale, Dreadnode's $14 million Series A was reported in February 2025.
The timing is short. CrowdStrike expects to close in its fiscal fourth quarter, the same quarter it promises general availability. When we covered the same-day Fiddler AI deal, we counted that quarter forward to about January 31, 2027. CrowdStrike has published no calendar date, and TechBuzz says the first quarter of 2027, so ask your account team.
Why the Current Product May Not Match the Falcon Plan
What you can buy from Dreadnode today is wider than what CrowdStrike has described. Dreadnode's homepage calls the product "AI infrastructure for cyber operations" and lists AI red teaming alongside web application penetration testing and network operations, including Active Directory assessments and "attack-path analysis and C2 tools." The post from Brad Palm and Nick Landers commits only one part of that to the new owner: "Our automated AI security testing capabilities will be heading to the Falcon platform." Neither announcement says what happens to the pentest and network agents. If your security team bought Dreadnode for those, ask first.
The deployment gap is the one regulated buyers should care about most. Dreadnode's pricing page lists a single Enterprise plan with custom pricing and on-prem deployment, plus SOC 2, ISO 27001:2022 and ISO 27701 claims. Its FAQ answers yes when asked about on-prem or air-gapped environments, though the answer names only on-prem. Its self-hosting guide shows a real deployment path: Helm on Kubernetes 1.28 or later, with mirrored images and replicated.isAirgap: true for clusters without outbound access. CrowdStrike's release does not use the words on-premises, self-hosted or air-gapped.
That guide also shows a dependency worth checking. Your license ID is the password for registry.replicated.com, and images come through a Dreadnode proxy tied to that license. Nobody has said those credentials will stop working after the close. You should still know what your contract says, because a self-hosted install needs them for every upgrade unless you mirror images yourself.
Attack counts need a question too. The release says more than 100 strategies, and the homepage lists "70+" attack strategies, "600+" transforms and "130+" scorers. The two may count differently, or the roadmap may add some. Ask which number describes the product you can run today.
Whether a Tester Owned by Your Runtime Vendor Is Still Independent
For internal engineering use, yes. For evidence you hand to someone outside, plan on a second source. We found no audit standard that bars one vendor from doing both, so this is a judgment about how outsiders will read the report, and your auditor can tell you how theirs will. An independent test is one where the tester has no commercial interest in the result. Once this deal closes, CrowdStrike will sell the test and Falcon Guardian, which it says has been generally available since September 2026 and "secures AI agents where they execute."
The case for the deal is strong. A finding that becomes a runtime policy with no second vendor involved shortens the path from test to enforcement. If you already run Falcon and Guardian, that loop may be worth more to you than a separate tester. Nothing suggests the engineers will soften a finding, and their published research argues against easy scores: across 22 models, 37.1% of baseline passes on an offensive cyber benchmark involved cheating, which put the average pass rate at 41.5% against a clean solve rate of 26.1%.
The problem is how the result reads to an outsider. When a finding arrives as a recommendation for a product from the same vendor, an auditor or a customer's security reviewer can fairly ask who else looked. We made a similar argument when Anaconda bought Enkrypt AI, and the field of unaffiliated testers keeps shrinking. Beacon took Haize Labs in September, and Protectt.ai plans to take control of AIShield.
Two product details bear on how much weight a report can carry. The release advertises human review in which "operators reclassify findings, adjust severity, and document their reasoning." Dreadnode's red-teaming guide says findings can be edited and dashboard metrics recompute on save, and a judge model scores each response from 0.0 to 1.0. Human review is sensible. For audit purposes you need the original score kept beside the edit, plus a pinned judge model so that a rerun is comparable. The guide does not say the first happens, so ask.
The Data Clause That Now Needs a Second Look
Dreadnode and CrowdStrike have made two statements about data that you should reconcile in writing. Dreadnode's pricing page says "Your data is never used for training" and that AI red teaming data "stays within your organization's environment." CrowdStrike's release says "Dreadnode testing data will strengthen CrowdStrike's SafeMind models." CrowdStrike's sentence may refer only to Dreadnode's own attack corpus. It does not say so.
The difference matters because the guide says each trial records its prompts, responses and scores. A test run against your internal agent can hold system prompts, tool output and whatever data the attack managed to pull out. Ask for a written answer on whether any customer test data reaches SafeMind, on what basis, and whether a self-hosted install sends any of it anywhere. The self-hosting guide says the Replicated SDK calls out unless air-gap mode is on, and it does not describe what is sent.
What You Keep if the Product Changes
You keep the open-source SDK and whatever reports you export. The Dreadnode SDK on PyPI is Apache-2.0, at version 2.0.53 as of October 27, 2026. It includes AIRT attack methods (TAP, GOAT, Crescendo, AutoDAN-Turbo and ReNeLLM), and its text interface has a local-only mode. Login is what unlocks platform sync, sandboxes and evaluations. Published releases stay usable under that license whoever owns the company. CrowdStrike's release does not mention the SDK, so future maintenance is unknown. The Reports tab exports PDF or CSV, and each assessment keeps its workflow script.
For a second opinion, these were open options on November 3, 2026. Each has an owner with its own commercial interests, so choose one with no stake in your stack.
| Tool | Owner | License | Note |
|---|---|---|---|
| PyRIT | Microsoft | MIT | Automated scans, multi-turn attacks and a web UI |
| garak | NVIDIA | Apache-2.0 | Describes itself as an LLM vulnerability scanner |
| Promptfoo | OpenAI | MIT | Says it will keep supporting a range of providers |
| Dreadnode SDK | CrowdStrike, once closed | Apache-2.0 | Local-only mode; platform login adds sandboxes and evaluations |
The precedent does not answer the continuity question. CrowdStrike's closest earlier deal, Pangea in September 2025, was also announced as "part of the Falcon platform," and that release was also silent on existing customers and standalone sales. We could not find a public account of what happened to those customers. Promptfoo at least stated a goal to "ensure continuity of service and support." Dreadnode's post thanks its customers and stops there. You can reasonably ask for a sentence like Promptfoo's, with dates attached.
What to Do Before the Close
Your leverage is highest while Dreadnode's team still answers for the contract and CrowdStrike wants a clean transition.
This Week:
- Pull your Dreadnode order form and the linked terms. Have procurement record the assignment, change-of-control and renewal clauses. The pricing page describes a "one-time annual fee," so check what you prepaid and what you get back if a deployment mode ends.
- Send your account team this list: Will Dreadnode stay available without a Falcon subscription, and until when? Will on-prem and air-gapped installs carry over to Automated AI Security Testing? What happens to the web and network agents? Does any customer test data reach SafeMind?
- Export your latest full assessment as CSV and PDF, and save the workflow scripts with the model version each one tested.
This Month:
- Have your AI platform lead rerun one production agent's assessment with a second tool from the table, using the same goals. Record where the results differ, since that gap is your first measure of how much a single tester misses.
- If you self-host, confirm your license allows mirroring, then mirror the current images and Helm chart into your own registry. Ask what data the Replicated SDK sends.
- Have your CISO write down which uses need outside evidence (board reporting, customer questionnaires, audits) and which only need an engineering signal. Only the first group needs the second tester.
Before Renewal:
- Ask for a clause stating the product, deployment modes and data terms for a fixed period, with a termination right if a mode you use is withdrawn.
- Ask CrowdStrike for a reference from a former Pangea customer, and find out what happened to their contract after that deal closed.
- If you run Falcon Guardian, test how a finding becomes a policy on your own agents, and check that your reviewers can trace the original score after any edit.
The Bottom Line
AI security testing is following the path guardrails took: specialists are being folded into larger platforms, and our comparison of NeMo Guardrails, Guardrails AI and Lakera covers the runtime side of that shift. For a Falcon shop, one vendor from test to enforcement may well be the better operating model. You should still plan on a separate source for claims you make to an outsider. Open-source tools can supply one for the cost of an engineer's time and model calls, though your own team's run stops short of third-party attestation.
Export your last assessment to CSV this week and file it with the model version it tested.
Continue Reading
- CrowdStrike's Reported $400M Fiddler AI Buy Adds Falcon Observe
- Beacon Bought Haize Labs. Who Red-Teams Your Agents Now?
- Anaconda Bought Your AI Red Teamer. Read the License.
- Protectt.ai Plans to Take Control of Bosch's AIShield
- NeMo Guardrails vs Guardrails AI vs Lakera: Buy the Detector
- RAMPART: Microsoft's Free Test Suite for $5.7M AI Breaches