Morgan Stanley: CrowdStrike plans to acquire two companies, extending its AI security platform

How will the two acquisitions complement Falcon?

CrowdStrike has signed definitive agreements to acquire Fiddler and Dreadnode. Both transactions are expected to close in the fourth quarter of fiscal 2027, subject to customary closing conditions; consideration is primarily cash, with additional equity subject to vesting conditions.
Neither company’s announcement disclosed the purchase prices or the acquired companies’ financial data. The Wall Street Journal reported that the two deals are worth a combined 495 million dollars; Morgan Stanley said that, to its knowledge, CrowdStrike had not commented on the report.
Fiddler will provide agent monitoring capabilities as Falcon Observe: evaluating accuracy and policy compliance before deployment, tracking decisions and tool calls during operation, and detecting hallucinations, behavioral drift and unintended actions. This also covers the risk of agents with legitimate permissions making unfounded decisions or failing to complete tasks.

Dreadnode uses more than 100 attack techniques to conduct automated security testing of models, applications, agents and MCP servers, looking for weaknesses such as jailbreaks and prompt injection before deployment. Test results will provide policy recommendations to Guardian, and test data will also be used to strengthen the SafeMind model.
Morgan Stanley believes these capabilities complement Guardian’s existing runtime protection: customers can find weaknesses before deployment, protect agents at runtime and subsequently investigate whether their behavior meets expectations. Fiddler will also correlate agent behavior with Falcon’s identity, cloud and runtime intelligence to support investigations and audits.
The bank believes the integrated workflow could reduce customers’ need to coordinate multiple tools and extend Falcon’s reach to AI engineering and governance teams. Falcon Observe and automated AI security testing are scheduled for general availability in the fourth quarter of fiscal 2027.

Morgan Stanley believes strengths in endpoint security, adoption of new modules and its positioning in AI could allow CrowdStrike to sustain revenue growth above 20% over the long term. The bank noted that annual recurring revenue (ARR) from the AI detection and response business in the second fiscal quarter was nearly three times the prior quarter’s level, indicating existing demand for runtime protection.
ARR from Falcon Flex accounts reached 2.29 billion dollars in the second fiscal quarter, up 101% year over year, showing that this sales mechanism has the potential to distribute new products quickly. If integration succeeds, the new capabilities could encourage customers to reduce their number of vendors, expand platform purchases and direct more AI deployment budgets to Falcon.
To gain confidence in the growth trajectory, Morgan Stanley is watching product integration, paid adoption of new features, customer expansion and the eventual ARR contribution, as well as integration costs and margins.

Morgan Stanley maintained its Overweight rating and base-case price target of 254 dollars, and said it had greater confidence in its bull-case target of 308 dollars. That scenario depends on a potential acceleration in cybersecurity spending and CrowdStrike continuing to gain market share.
The valuation is already high: the bank puts the enterprise value/free cash flow/growth rate metric at 3.2 times, versus 1.9 times for security industry peers. Downside risks listed in the report include intensifying competition, lower-priced alternatives compressing the premium, and a weak hiring environment affecting upselling.