Strategic PartnersIssue 064 records
CrowdStrike
Fal.Con Europe day two centered on stopping AI agents. CrowdStrike shipped an AI Kill Switch in Falcon Guardian. Its own blog, and Decrypt, confirm that today it cuts agents off at the AI gateway, with endpoint and cross-platform containment still to come. CrowdStrike also agreed to buy Fiddler (agent observability) and Dreadnode (AI security testing); prices are unconfirmed and the products are not expected before fiscal Q4 2027. On the buyer side, a Columbia County, Oregon draft AI policy requires named owners, logs, human confirmation before agent actions and the right to suspend use. Shipped vendor controls meet only part of that, and no independent test or SLED deployment evidence exists yet.
- Evidence records
- 4
- Cross-source patterns
- 2
- Evidence classes
- 2 independent reporting1 vendor claim1 government evaluation
- Outcomes
- 4 emerging
- Source freshness
- 4 new this fortnight
- Research completed
- 2026-11-04
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
CrowdStrike's agent kill switch ships at the gateway first; endpoint and cross-platform containment are still promised
CrowdStrike's own technical blog says the Nov 3 AI Kill Switch currently blocks agents' model access through AI gateways, with endpoint, cloud, identity, SaaS and browser containment 'coming soon'. Decrypt's independent same-day report says the same thing. The press release's 'terminate it where it runs' wording is broader than what ships today. Interpretation: buyers should treat roadmap containment as a future commitment and test gateway coverage of their own agents.
Operating questionDo all of the agency's or campus's approved agents reach models through a gateway the kill switch controls, and what compensating controls cover agents that do not?
Supporting evidenceCrowdStrikeDecrypt (reporting on CrowdStrike)
Local AI policies now ask for suspend rights, agent logs and pre-action approval, which vendor agent controls only partly address
Columbia County, Oregon's Nov 2 draft policy requires named owners, activity logs, human confirmation before each consequential agent action, and contract terms allowing suspension. CrowdStrike's kill switch offers a logged, human-triggered cutoff, and its planned Fiddler (Falcon Observe) and Dreadnode products target audit trails and pre-deployment testing, but those products are not expected before fiscal Q4 2027. Interpretation: a stop control after the fact does not meet pre-action approval requirements, which depend on how the workflow is designed.
Operating questionWhich AI policy requirements can the agency evidence today with shipped controls, and which depend on workflow design or unreleased products?
Supporting evidenceColumbia County, Oregon (Board of Commissioners memo)CrowdStrikeCyberScoop (reporting on CrowdStrike, Fiddler AI and Dreadnode)
Evidence ledger
Full record · every source keeps its link and limitations
Introducing AI Kill Switch: CrowdStrike adds gateway-enforced agent cutoff to Falcon Guardian, with endpoint and cross-platform containment still to come
On Nov. 3, 2026, CrowdStrike made an AI Kill Switch available in Falcon Guardian. The technical blog says the shipping control works by directing connected AI gateways (the now generally available Falcon AI Gateway, included with Guardian, or a third-party gateway) to block an agent's access to the AI models it depends on. Terminating agent processes on endpoints, containing cloud agents, revoking agent identities, and restricting SaaS and browser activity are all described as 'coming soon' or as CrowdStrike's 'vision'. The same-day press release describes terminating agents 'where it runs', which the release itself qualifies as 'first at the Gateway, and soon on the endpoint'. No customer results, test data or pricing beyond 'no additional cost' for the gateway are given.
Why it matters, evidence and limitations
- Why it matters
- Relevant to state agencies, counties, universities and school districts that are starting to allow AI agents (coding assistants, workplace agents) and whose new AI policies require the ability to suspend use. No public-sector customer, government authorization or SLED deployment is cited.
- Evidence and measured results
- Vendor blog and press release only; capability descriptions with no measured results or independent testing.
- Limitations and uncertainty
- Vendor material. Several containment capabilities are roadmap items with no dates. Effectiveness against a real compromised agent is not demonstrated.
Decrypt: CrowdStrike's AI agent kill switch launches at the gateway, with endpoint termination planned later; Fiddler AI deal reportedly about $400 million
Decrypt's same-day report, based on CrowdStrike's technical explanation, states that the AI Kill Switch now available works through AI gateways that block an agent's access to its models, that direct endpoint termination is planned for later, and that 'the initial release does not yet provide every type of containment CrowdStrike has described.' It also reports CrowdStrike's agreement to acquire Fiddler AI, reportedly for about $400 million, for agent monitoring and decision explanation. Decrypt adds no independent test, customer interview or public-sector angle.
Why it matters, evidence and limitations
- Why it matters
- Useful to SLED buyers as an independent read that separates what ships today from what is promised; no SLED-specific content.
- Evidence and measured results
- Independent news reporting relying on vendor statements; no testing or customer data.
- Limitations and uncertainty
- Reporting depends on CrowdStrike's own description; the Fiddler price is attributed to other reporting and not confirmed by CrowdStrike.
CyberScoop: CrowdStrike moves to acquire Fiddler and Dreadnode, adding AI agent observability (Falcon Observe) and pre-deployment AI security testing
CyberScoop reports CrowdStrike signed agreements to acquire Fiddler AI and Dreadnode at Fal.Con Europe. Prices were not disclosed; the Wall Street Journal reported about $400 million and $95 million. Fiddler, to become Falcon Observe, traces agent decisions, flags drift and made-up answers, and creates audit records; it works with LangGraph, Amazon Bedrock and Google ADK. Dreadnode runs more than 100 known attack methods against models and agents and maps findings to the OWASP Top 10 for LLMs and the NIST AI RMF. Both products are expected to be generally available, and the deals to close, in CrowdStrike's fiscal Q4 2027 (ending Jan. 31, 2027). The article says 'Monday', although its publication date and the announcements are Tuesday, Nov. 3.
Why it matters, evidence and limitations
- Why it matters
- Relevant to agencies and universities whose AI policies require activity logs, audit records and testing before deployment; mapping to NIST AI RMF is familiar to state AI frameworks. No SLED customers or products available yet.
- Evidence and measured results
- Independent reporting on announced, not yet closed, acquisitions; capability descriptions come from the companies.
- Limitations and uncertainty
- Deals not closed; products not generally available until fiscal Q4 2027; prices unconfirmed; one date wording inconsistency in the article.
Columbia County, Oregon: draft county-wide AI policy requires approved, logged AI agents with human confirmation before actions and vendor terms allowing the county to suspend use
A Nov. 2, 2026 staff memo for the Nov. 4 Board of Commissioners meeting summarizes a draft county-wide AI policy, built after reviewing nine policies (eight local, one state) from an Oregon government IT association and Oregon state guidance. AI agents must be specifically approved, have limited access and a named county owner, keep activity logs, and get human confirmation immediately before actions such as sending, deleting, changing access or initiating a transaction. Agent logs may be public records. Vendors must disclose AI functions, sub-processors and material changes, and contracts must address the county's ability to suspend or end use. It is a draft, not an adopted policy, and is not linked to any vendor.
Why it matters, evidence and limitations
- Why it matters
- Direct: a current county-level example of the controls agencies are writing into AI policy, which is the buyer-side context for CrowdStrike's Nov. 3 agent controls. Transferability is limited to one small county's draft, though it was built from nine peer policies.
- Evidence and measured results
- Primary local government document; a policy draft summary, not an evaluation of outcomes.
- Limitations and uncertainty
- Draft summary only; final policy text and adoption status not confirmed; one county.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Independent reporting
- Independent reporting with attributable sources but without a formal evaluation design.
- Vendor claim
- A supplier-provided assertion that has not been upgraded to independent evidence.
- Government evaluation
- A public body’s measured evaluation or documented pilot.