The Short Answer
CrowdStrike's AI Kill Switch, launched on November 3, 2026, stops an AI agent that misbehaves loudly, but clinical AI usually fails quietly by drifting. Health systems need canaries as well as a stop control: fixed test cases re-scored on a schedule. On ibl.ai you own all the code and the data, so the kill switch and the evaluation logs both sit on infrastructure you run.
CrowdStrike paired the launch with agreements to buy Fiddler AI and Dreadnode, reported at about $495 million combined.
The healthcare lesson is older. In 2020, the share of patients triggering a sepsis model's alerts at 24 hospitals went from 9% to 21% when COVID-19 changed who was being admitted.
What did CrowdStrike announce at Fal.Con Europe 2026?
On November 3, 2026, at Fal.Con Europe in Barcelona, CrowdStrike announced three things aimed at AI agents running inside the enterprise.
The first is the AI Kill Switch in Falcon Guardian, which CrowdStrike said is available now. Falcon Guardian itself has been generally available since September 2026.
The second is an agreement to acquire Fiddler AI, a Palo Alto company founded in 2018 whose software monitors AI agents and explains their decisions. CyberScoop reports it will be sold as Falcon Observe; George Kurtz called it "the flight recorder for every agent."
The third is an agreement to acquire Dreadnode, founded in 2023, which builds automated security testing for AI. Its platform runs more than 100 known attack methods, including jailbreaks and prompt injection, against models and agents before they ship.
Both acquired products are expected to be generally available in CrowdStrike's fourth quarter of fiscal 2027. Both deals are still pending.
The demand behind the move is visible in CrowdStrike's own numbers. On its fiscal Q2 2027 earnings call, Kurtz said AI Detection and Response ending ARR "nearly tripled versus Q1."
What does CrowdStrike's AI Kill Switch actually do?
Per CrowdStrike's release, an authorized administrator can take four actions against one agent.
- Stop the running agent from executing.
- Prevent it from relaunching on the targeted host or host group.
- Cut off its enterprise network access.
- Record every one of those actions in an audit trail.
The release says enforcement runs "first at the Gateway, and soon on the endpoint," so the endpoint half is a stated roadmap item rather than a shipped one.
It is a strong answer to a specific question: can we stop an agent that is plainly doing the wrong thing? As the release describes it, the switch is an action an authorized administrator takes. Someone still has to decide that an agent has gone wrong.
We mapped the rest of 2026's agent-security releases, and which tier each vendor kept for itself, in Enterprise Agent Security: What Actually Shipped in 2026.
Did CrowdStrike pay $495 million for Fiddler and Dreadnode?
CrowdStrike has not said. The company did not disclose terms for either acquisition.
The figure comes from The Wall Street Journal, as reported by SecurityWeek: roughly $400 million for Fiddler and about $95 million for Dreadnode, mostly in cash with some stock subject to vesting.
Treat $495 million as a reported number, not a disclosed one. For scale, SecurityWeek notes Fiddler had raised $100 million in total, including a $30 million Series C in January, and Dreadnode had raised a $14 million Series A in early 2025.
Why doesn't a kill switch catch clinical AI that degrades silently?
A kill switch is triggered by a decision, and a decision needs a signal. Clinical models rarely send one. They keep returning scores in the expected format while the patients they score change underneath them.
The clearest documented case is the Epic Sepsis Model at the start of the pandemic. A study in JAMA Network Open tracked its alerts across 24 hospitals in four health systems: Michigan Medicine, NYU Langone, Mass General Brigham and BJC HealthCare.
Over the three weeks on either side of each system's first COVID-19 case, the share of patients generating an alert more than doubled, from 9% (953 of 10,159) to 21% (1,363 of 6,634).
Total census fell 35% while daily alerts rose 43%. The authors note the rise "could have resulted from dataset shift," and that they did not evaluate the model's accuracy.
At Michigan, the governance committee acted.
A letter in the New England Journal of Medicine by Finlayson and colleagues describes a dataset shift that altered the relationship between fevers and bacterial sepsis, after which the hospital's clinical AI committee decommissioned the model's use.
That is the right outcome, but notice what produced it. The signal was a change in alert volume that people noticed. Without that, nothing would have prompted anyone to reach for a stop control.
The model also had a baseline problem before any drift. An earlier external validation found it missed 67% of sepsis cases at a hospital that had not built it. A kill switch has nothing to say about a model that was never as good as its documentation.
What is a canary for clinical AI, and what would it have caught?
A canary is a fixed set of cases with known correct answers, re-run against the deployed model or agent on a schedule. The score on that set is tracked over time, and an alarm fires on the trend, not on a single bad output.
To make the shape concrete, take an illustrative example rather than a measurement: a model that drops from 99% to 95% on its canary set has not produced one output that looks broken. Only the comparison across runs shows the slide.
A practical canary program for a health system has three parts.
- A frozen test set. Cases from your own patients, with answers your clinicians agreed on, versioned so last month's score and this month's are comparable.
- A schedule and a threshold. Re-score weekly or after any model, prompt or vendor change, and alert when the score falls by a set margin.
- An input monitor. Outcome labels such as confirmed sepsis arrive late, so also watch what you can see at once: alert rate, input mix and refusal rate. The 9% to 21% alert-rate jump was visible within three weeks.
The canary tells you when to reach for the switch. The switch tells you how. Both are needed, and neither substitutes for the other.
Kill switch or canary: which failure does each one catch?
The two controls answer different failure modes. This table maps each to the cases above.
| Failure mode | Kill switch | Canary | Documented example |
|---|---|---|---|
| Agent acting outside its task | Stops it, blocks relaunch, cuts network | May not see it if the test set is narrow | The scenario CrowdStrike built the AI Kill Switch for |
| Known attack, before deployment | Too late; the agent is already live | Partly, if attacks are in the set | Dreadnode runs 100+ attack methods pre-deployment |
| Population drift | Only once someone notices and decides | Yes: score and input-rate trend | Sepsis alerts 9% to 21% across 24 hospitals, 2020 |
| Weak from day one at your site | No signal to act on | Yes, on the first run against local cases | 67% of sepsis cases missed in a 2021 external validation |
| Silent model or vendor change | No signal to act on | Yes, if re-run after every change | Any provider switch on a model-agnostic stack |
The two highlighted rows are the clinical ones. In both, the stop control works perfectly and is never used, because nothing tells anyone to use it.
Who holds the kill switch and the evaluation logs when you own the agent stack?
Every control above produces a record: who stopped what and when, which test set ran, what each case scored, and which model answered. For a health system, those records are patient-safety evidence with a long retention life.
On a managed platform, the vendor holds those records and the switch. On ibl.ai you own all the code and the data, self-hosted inside your own perimeter, so both stay with you.
In practice that looks like this on Agentic OS:
- The canary is the Evals tab. A benchmark of your own questions with expected answers runs against an agent, a judge model you pick scores every response, and Export CSV returns one row per case with its
trace_id. Re-run it after every change and diff the runs. - The change log is the Audit panel. It records who changed what and when, including model and provider changes, the commonest cause of a silent behaviour shift.
- The stop control is your infrastructure. The containers, the network policy and the model credentials run in your environment, so stopping an agent does not depend on a vendor's console.
We made the longer case for owning test evidence in Who Owns the Evidence That Your AI Agent Was Tested?. The platform is model-agnostic, which makes the re-run after every model change non-optional rather than a nice-to-have.
1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University.
ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.
Want to set up canaries for your clinical AI agents?
Our team will build a canary benchmark from your own cases with you, run it against your agents, and walk through what a scheduled re-score and its alarm threshold look like.
Book a 30-minute demo or talk to the ibl.ai team.
Sources: the AI Kill Switch's capabilities and availability from CrowdStrike's release; Falcon Guardian availability from CrowdStrike; the Falcon Observe name, GA timing, Dreadnode's attack methods and the Kurtz quote from CyberScoop; the reported prices, founding years and funding from SecurityWeek, citing The Wall Street Journal; AIDR ARR from the Q2 FY2027 earnings call; sepsis alert rates from Wong et al., JAMA Network Open, 2021; the Michigan decommissioning from Finlayson et al., NEJM, 2021.