CrowdStrike Acquires Fiddler to Expand Falcon Observe for AI Agent Observability

What happened

CrowdStrike today announced its acquisition of Fiddler, a company that specializes in observability solutions for artificial intelligence workloads. The deal is designed to integrate Fiddler’s capabilities directly into the Falcon platform, expanding Falcon Observe to provide real‑time visibility into the behavior of AI agents deployed across an organization’s endpoints and cloud environments.

The acquisition follows a growing trend of security vendors adding AI observability to their toolsets. By embedding Fiddler’s telemetry and analytics into Falcon, CrowdStrike will allow defenders to track model inputs, outputs, and internal state changes, helping to detect anomalous behavior that could indicate model tampering or data exfiltration.

Who is affected

All Falcon customers who run AI agents—whether for threat hunting, automated triage, or application-level inference—will benefit from the enhanced observability. This includes enterprises that use Falcon’s Endpoint Detection and Response (EDR) and Cloud Workload Protection (CWP) services, as well as those leveraging Falcon’s AI‑driven threat intelligence feeds.

Organizations that have already integrated Falcon Observe for traditional endpoint telemetry will need to adopt the new AI observability features. The integration is expected to be available in the next Falcon release cycle, with a rollout timeline that will be communicated through the CrowdStrike community portal and partner channels.

Impact

With Fiddler’s telemetry, defenders gain granular insight into AI model execution, including data flow, inference latency, and decision paths. This visibility enables quicker detection of model drift, adversarial manipulation, or unauthorized data access, all of which can compromise the integrity of security operations.

The enhanced observability also improves compliance reporting, as organizations can now demonstrate that AI workloads are monitored and governed in accordance with internal policies and external regulations. Additionally, the integration reduces the mean time to detect and respond to AI‑related incidents by providing actionable alerts tied to model behavior.

What to do

To leverage the new capabilities, security teams should first ensure that their Falcon platform is updated to the latest version that includes Falcon Observe for AI. Next, enable the AI observability feature through the Falcon console and configure data collection for all relevant AI agents.

Once enabled, follow these concrete steps to maximize protection:

• Define baseline behavior profiles for each AI agent and set thresholds for deviations.
• Configure alerts for anomalous input patterns, unexpected output distributions, or sudden changes in inference latency.
• Integrate Falcon Observe logs with your SIEM or SOAR platform to correlate AI telemetry with other security events.
• Review model training pipelines for secure data handling and enforce least‑privilege access to model artifacts.
• Schedule regular audits of AI agent permissions and network access to prevent lateral movement.

What to watch

Adversaries are increasingly targeting AI workloads to manipulate models or exfiltrate data. Watch for signs of model poisoning, data leakage through inference outputs, or unauthorized access to model training data. Keep an eye on emerging threat reports that detail new techniques for AI model exploitation.

Also monitor the evolving regulatory landscape around AI governance. New compliance frameworks may require demonstrable observability of AI decision processes, making Falcon Observe’s capabilities essential for meeting audit requirements. Stay informed through CrowdStrike’s threat intelligence feeds and community discussions to anticipate potential risks.