CrowdStrike (CRWD.US) spent nearly $500 million on AI security, and Damo immediately sang a lot: the target price of the $308 bull market is closer

The Zhitong Finance App learned that CrowdStrike (CRWD.US) recently announced that the company has reached an agreement to invest a total of 495 million US dollars to acquire two artificial intelligence (AI) security startups. As companies scramble to deploy AI agents, this acquisition will strengthen the company's ability to monitor and risk control AI agents, add complementary capabilities to its enterprise AI security business, and is expected to further deepen the company's role in this field.

Specifically, CrowdStrike will buy Fiddler AI, headquartered in Palo Alto, California, for about $400 million. The company was founded in 2018 to develop software to monitor and interpret the behavior of intelligent agents. CrowdStrike also bought DreadNode for approximately $95 million. The company was founded in 2023 to provide an automated security testing platform that can detect vulnerabilities in AI models before they go live. CrowdStrike said most of the two purchase prices were paid in cash, with the remainder being restricted stocks.

Morgan Stanley said in a newly released research report that Crowdstrike's acquisition of Fiddler and Dreadnode will expand Falcon's coverage in the AI security lifecycle. The bank maintained its “gain” rating on CrowdStrike. The basic scenario target price was still $254, while confidence in the $308 bull market scenario target was further strengthened.

Damo explained that Fiddler provides observability and interpretability of agents, which can evaluate the accuracy of agents and whether they meet policy requirements before deployment, track their decisions and tool calls in production environments, and detect illusions, behavioral drift, and unexpected operations. The technology will be launched in the form of Falcon Observe to address a risk that goes beyond the scope of malicious activity: even if agents have legitimate credentials, they may still make unfounded decisions or be unable to complete tasks assigned to them.

Dreadnode has added automated security testing capabilities covering models, applications, agents, and MCP servers, and uses more than 100 attack strategies to identify security weaknesses such as jailbreak attacks and prompt injection before deployment. The test results will be fed back to the Guardian as policy recommendations, and the test data will be used to enhance the SafeMind model.

Combined, these two capabilities should complement Guardian's run-time protection capabilities, help customers identify weaknesses before deployment, provide protection during agent operation, and investigate whether their behavior is in line with expectations. Fiddler will also link agent behavior to Falcon's identity, cloud, and runtime intelligence to provide enterprise risk background information for investigation and audit records.

Damo believes that integrating these workflows should enhance Falcon's value proposition: on the one hand, reducing the work required for customers to coordinate different testing, monitoring, and security tools, and on the other hand, linking the behavior of agents to the systems they affect. This could also make Falcon more appealing to AI engineering and governance teams in addition to continuing to serve its traditional security customers.

Falcon observe and automated AI security testing are expected to be officially launched in the fourth quarter of fiscal year 2027. The two deals are also expected to close during the quarter, but they are still subject to customary delivery conditions.

Combined, these two capabilities should complement Guardian's run-time protection capabilities, help customers identify weaknesses before deployment, provide protection during agent operation, and investigate whether their behavior is in line with expectations. Fiddler will also link agent behavior to Falcon's identity, cloud, and runtime intelligence to provide enterprise risk background information for investigation and audit records.

We believe that integrating these workflows should enhance Falcon's value proposition: on the one hand, reducing the work required for customers to coordinate different testing, monitoring, and security tools, and on the other hand, linking agent behavior to the systems they affect. This could also make Falcon more appealing to AI engineering and governance teams in addition to continuing to serve its traditional security customers.

Falcon observe and automated AI security testing are expected to be officially launched in the fourth quarter of fiscal year 2027. The two deals are also expected to close during the quarter, but they are still subject to customary delivery conditions.

Platform strategy and AI security investment logic strengthened

Damo believes that these acquisitions have further strengthened its investment logic: CrowdStrike's leading position in the terminal security field, increased customer adoption of emerging modules, and an increasingly favorable market position in the AI field are expected to support the company's long-term revenue growth of more than 20%.

Damo emphasized that CrowdStrike's market opportunities mainly revolve around three areas: solving traditional technology debts, automating secure operation centers (SOC), and ensuring AI security. By expanding on the problems Falcon can solve when customers deploy agents, Fiddler and Dreadnode have further deepened the third pillar — AI security.

Early signs of positive momentum are already showing. During the second quarter of fiscal year 2027 ending July 31, 2026, AIDR's annual recurring revenue (ARR) nearly tripled month-on-month, providing evidence of the market's demand for runtime protection. At the same time, the acquisition is expected to further extend customer conversations to the areas of testing, operational reliability, and governance.

Furthermore, Falcon Flex has shown the potential to rapidly promote new products. During the second quarter, ARR contributions to Flex customer accounts reached $2.29 billion, up 101% year over year. If the integration is successfully completed, customers will have more reasons to integrate suppliers, expand platform commitments, and continue to use Falcon as AI projects continue to expand.

Testing capabilities and behavioral accountability mechanisms may also help companies deploy agents into more impactful workflows, which could hopefully link CrowdStrike to broader AI deployment budgets.

As the product portfolio continues to expand, Damo will focus on the progress of product integration, incremental payment adoption of new products, customer business expansion, and ultimate contribution to ARR. At the same time, Damo will also focus on whether the company can maintain discipline in terms of integration costs and profit margins, so that the bank can establish greater confidence in its development roadmap.

Dama added that although CrowdStrike's valuation is still high, with an enterprise value/free cash flow/growth rate (EV/FCF/G) ratio of 3.2 times, while the cybersecurity industry's valuation multiplier is 1.9 times, the bank still believes that CrowdStrike has a chance to reach its target price in a bull market scenario of $308. Damo stressed that as the company uses this acquisition to further benefit from a trend where cybersecurity spending is likely to accelerate growth while continuing to expand its market share, its stock price still has the potential to rise further.