CrowdStrike (CRWD.US) spends nearly US$500 million to secure a position in AI security, and Morgan Stanley immediately turns bullish: the US$308 bull-case target price is getting closer.

CrowdStrike (CRWD.US) recently announced that it has reached agreements to acquire two artificial intelligence (AI) security startups for a combined US$495 million. As enterprises rush to deploy AI agents, the acquisitions will strengthen the company's ability to monitor and manage risks associated with AI agents, add complementary capabilities to its enterprise AI security business, and are expected to further deepen the company's role in this field. Specifically, CrowdStrike will acquire Palo Alto, California-based Fiddler AI for approximately US$400 million. Founded in 2018, the company develops software used to monitor and explain agent behavior. CrowdStrike is also acquiring Dreadnode for approximately US$95 million. Founded in 2023, the company provides an automated security testing platform that can detect vulnerabilities in AI models before they go live. CrowdStrike said most of the consideration for both acquisitions will be paid in cash, with the remainder in restricted stock. In its latest research report, Morgan Stanley said CrowdStrike's acquisitions of Fiddler and Dreadnode will expand Falcon's coverage across the AI security lifecycle. The bank maintained its "Overweight" rating on CrowdStrike, kept its base-case target price at US$254, and said its confidence in its US$308 bull-case target price has further strengthened. Morgan Stanley explained that Fiddler provides agent observability and explainability capabilities, enabling assessment of an agent's accuracy and policy compliance before deployment, tracking of its decisions and tool calls in production environments, and detection of hallucinations, behavioral drift and unintended actions. The technology will be launched as Falcon Observe, designed to address a risk that goes beyond malicious activity: even with legitimate credentials, agents may make unsupported decisions or fail to complete the tasks assigned to them. Dreadnode adds automated security testing capabilities covering models, applications, agents and MCP servers, using more than 100 attack strategies to identify security weaknesses such as jailbreak attacks and prompt injection before deployment. Its test results will be fed back to Guardian as policy recommendations, while the test data will be used to strengthen the SafeMind model. Combined, these two capabilities should complement Guardian's runtime protection capabilities, helping customers identify weaknesses before deployment, provide protection while agents are running, and investigate whether their behavior meets expectations. Fiddler will also link agent behavior with Falcon's identity, cloud and runtime intelligence, providing enterprise risk context for investigations and audit records. Morgan Stanley believes that integrating these workflows should enhance Falcon's value proposition: on one hand, reducing the work customers need to coordinate across different testing, monitoring and security tools; on the other, linking agent behavior to the systems it affects. This could also make Falcon more attractive to AI engineering and governance teams, in addition to its traditional security customers. Falcon Observe and automated AI security testing are expected to be officially launched in the fourth quarter of fiscal 2027. Both transactions are also expected to close in that quarter, subject to customary closing conditions. Combined, these two capabilities should complement Guardian's runtime protection capabilities, helping customers identify weaknesses before deployment, provide protection while agents are running, and investigate whether their behavior meets expectations. Fiddler will also link agent behavior with Falcon's identity, cloud and runtime intelligence, providing enterprise risk context for investigations and audit records. We believe that integrating these workflows should enhance Falcon's value proposition: on one hand, reducing the work customers need to coordinate across different testing, monitoring and security tools; on the other, linking agent behavior to the systems it affects. This could also make Falcon more attractive to AI engineering and governance teams, in addition to its traditional security customers. Falcon Observe and automated AI security testing are expected to be officially launched in the fourth quarter of fiscal 2027. Both transactions are also expected to close in that quarter, subject to customary closing conditions. Platform strategy and AI security investment thesis reinforced Morgan Stanley believes these acquisitions further reinforce its investment thesis: CrowdStrike's leadership in endpoint security, rising customer adoption of emerging modules, and its increasingly favorable market positioning in AI are expected to support the company in sustaining revenue growth of more than 20% over the long term. Morgan Stanley emphasized that CrowdStrike's market opportunity centers on three areas: addressing legacy technical debt, automating security operations centers (SOCs), and securing AI. Fiddler and Dreadnode further deepen the third pillarAI securityby expanding the problems Falcon can solve when customers deploy agents. Early signs of positive momentum have already emerged. During the second quarter of fiscal 2027 ended July 31, 2026, AIDR's annual recurring revenue (ARR) nearly tripled quarter over quarter, providing evidence of market demand for runtime protection. At the same time, the acquisitions are expected to extend customer conversations further into testing, operational reliability and governance. In addition, Falcon Flex has already demonstrated its potential to rapidly roll out new products. During the second quarter, Flex customer accounts contributed US$2.29 billion in ARR, up 101% year over year. If integration proceeds smoothly, customers will have more reasons to consolidate vendors, expand platform commitments, and continue using Falcon as their AI projects expand. Testing capabilities and behavioral accountability mechanisms may also help enterprises deploy agents into higher-impact workflows, potentially linking CrowdStrike to broader AI deployment budgets. As the product portfolio continues to expand, Morgan Stanley will focus on product integration progress, incremental paid adoption of new products, customer business expansion, and ultimately the contribution to ARR, while also watching whether the company maintains discipline on integration costs and margins, so that the bank can build greater confidence in its roadmap. Morgan Stanley added that although CrowdStrike's valuation remains elevated, with its enterprise value/free cash flow/growth (EV/FCF/G) multiple at 3.2x versus 1.9x for cybersecurity peers, the bank still believes CrowdStrike has an opportunity to reach its US$308 bull-case target price. Morgan Stanley emphasized that as the company uses the acquisitions to further benefit from a possible acceleration in cybersecurity spending while continuing to expand market share, its share price still has room for further upside.