CrowdStrike announced Monday it has signed agreements to acquire two artificial intelligence security companies, Fiddler AI and Dreadnode, in deals announced at its Fal.Con Europe conference in Barcelona.

CrowdStrike did not disclose what it paid for the companies. A report in the Wall Street Journal listed the price for Fiddler at $400 million, and Dreadnode at $95 million. 

Fiddler, which specializes in AI agent observability and explainability, will become Falcon Observe on the company’s Falcon platform. Dreadnode builds automated security testing for AI systems, checking models and agents for weaknesses before deployment.

The acquisitions address a gap that has widened as companies adopt AI agents: the software can hold valid credentials and approved tools yet still make bad decisions, ignore instructions or claim work it never completed. Traditional security testing, built for code that behaves predictably, does not reach the model layer or the agent’s reasoning process.

Fiddler’s technology works after deployment. It evaluates agents before they reach production, traces decisions and reasoning across agent systems, flags drifting behavior and made-up answers, and creates records that can be used in audits. It works with common agent frameworks including LangGraph, Amazon Bedrock and Google ADK.

“When a regulator or your board asks what an agent did, saying ‘the model did it’ is not an answer,” said George Kurtz, CrowdStrike’s chief executive and founder, describing Fiddler as “the flight recorder for every agent.”

Dreadnode works earlier in the process. Its platform runs more than 100 known attack methods, including jailbreaks and prompt injection, against models and agent systems. It ranks problems by severity and maps them to widely used security standards, such as the OWASP Top 10 for large language models and the NIST AI Risk Management Framework. Dreadnode Chief Executive Brad Palm said his company was built on the idea that “the people best equipped to find those failures think like attackers.”

The announcements come alongside new Falcon Guardian capabilities that protect agents while they run. In a separate announcement, Kurtz introduced what the company calls the AI Kill Switch, a control that lets humans stop any AI agent. Writing on X, Kurtz said the switch “lives outside the model, at runtime, where an agent can’t argue with it, rewrite it, or wait it out.” He argued that the ability to stop an agent is what allows companies to run them faster: “The more certain a company is that it can stop any agent, the more agents it can put to work.”

Kurtz framed the shift as a move from security to safety. “For decades, security meant keeping the adversary out,” he wrote. “Safety is the bigger opportunity: letting AI run at full speed, inside the business, with a human in control.”

Both products are expected to be generally available in CrowdStrike’s fourth quarter of fiscal 2027. Both deals are expected to be paid mostly in cash, with part of the payment made in company stock that will be given out over time as conditions are met. They are expected to close in that quarter, pending standard approval steps.

The post CrowdStrike moves to acquire Fiddler and Dreadnode, adding AI observability and testing to its security platform appeared first on CyberScoop.

Proofpoint agreed Thursday to acquire Varonis Systems in a cash transaction valued at approximately $6.3 billion, combining two companies that have positioned themselves around a shared bet: that securing data has become the central problem of the AI era.

The acquisition pairs two distinct approaches to security. Varonis specializes in data security, mapping where sensitive information sits inside an organization, who can reach it, and how it is actually used. Proofpoint, owned by private equity company Thoma Bravo, built its business around protecting people, blocking phishing, fraud and other attacks that arrive primarily through email and target employees rather than machines.

Sumit Dhawan, Proofpoint’s CEO, wrote in a blog post Wednesday that AI is changing the security equation on two fronts. Outside the enterprise, attackers are using AI to launch faster and more advanced campaigns aimed at data and critical systems. Inside, companies are deploying AI agents that have wide-ranging access to sensitive information, creating new categories of insider risk.

“Data Security — protecting data from compromise, loss, and misuse by people or AI agents — has become the defining priority for organizations seeking to realize AI’s full potential,” Dhawan wrote.

The companies frame the deal as a response to that dual pressure. In a joint announcement, they said the combined organization would serve millions of organizations globally, and described plans for helping organizations adopt and secure AI.

Proofpoint’s global reach, he wrote, includes 3.4 million customers, 2.37 trillion emails scanned annually, 410 billion data security events ingested, and more than 13,000 sensors across 105 countries. Those signals feed what the company calls its Knowledge Graph, which strengthens its AI models with intelligence on threats, human behavior and data risk. Combined with Varonis’ visibility into sensitive data, the companies envision a foundation for discovering and remediating risks at machine speed.

“For CISOs and CIOs, this also means stronger protection with less complexity and lower costs,” Dhwan wrote. “Our goal is to simplify security operations, enable vendor consolidation, and free up resources for reinvestment in innovation, while maintaining open integrations across the broader cybersecurity ecosystem.”

The deal extends a buying pattern for both companies. In February, Proofpoint acquired Acuvity, an AI security startup whose platform monitors how employees and automated systems interact with external AI services. Financial terms were not disclosed. 

That purchase followed Proofpoint’s acquisition of Hornetsecurity, a German provider of Microsoft 365 security services, in a deal reportedly worth more than $1 billion. Varonis, for its part, acquired the AI security firm AllTrue.ai for $150 million. 

Yaki Faitelson, Varonis’ CEO and co-founder, said the company’s mission is “to secure AI and the data that powers it” and that joining Proofpoint would advance that goal faster than the company could on its own.

The deal, approved unanimously by Varonis’ board, is expected to close in the first half of 2027, subject to shareholder and regulatory approvals.

The post Proofpoint to buy Varonis for $6.3 billion appeared first on CyberScoop.

IonQ announced Monday that it will acquire Elisity, a zero-trust network security firm, in an all-stock transaction valued at up to $1.3 billion that folds enterprise access control into the quantum computing company’s expanding cybersecurity business.

Elisity, founded in 2019, sells a software policy layer that governs which users, devices, workloads and AI agents can communicate across a network, independent of the underlying network technology. The California-based company reports more than 100 global deployments and says revenue and customer counts have doubled year over year, with no churn among deployed customers.

Maryland-based IonQ, whose core business is quantum computing, has been building a security arm around post-quantum cryptography and quantum key distribution, technologies intended to replace or supplement encryption that future quantum computers may be able to break. 

The combination addresses what the companies describe as a two-front problem: conventional attacks that operate at machine speed, and the risk that encrypted data could be retained until quantum decryption becomes practical, a concept known as “harvest now, decrypt later.”

“Our customers need to contain attacks today, put AI to work safely, and prepare for quantum risk,” Elisity CEO James Winebrenner wrote in a blog post announcing the deal. 

IonQ Chairman and CEO Niccolo de Masi struck a more urgent note in a release announcing the deal: “Q-Day is coming much faster than predicted,” he said, referencing the point at which quantum computers could break current encryption technology. 

Both governments and the technology industry have accelerated their timelines to adopt post-quantum cryptography over the past few years. This is partly due to a belief among executives in the U.S. quantum sector that Chinese scientists and labs have achieved breakthroughs across several different fields of quantum computing over the past two years.

The Trump administration recently issued an executive order directing federal agencies to boost the domestic quantum industry and move up internal timelines for migrating to PQC encryption from 2035 to 2030. Google, a potential industry bellwether, and other companies have opted to move their own migration timelines to 2029.

Winebrenner told CyberScoop those deadlines are easier to set than to meet. Enterprises will hace to start with identifying the information and operations that need protecting, then mapping the identities, communications and cryptographic dependencies that support them.

“You won’t replace every legacy system at once,” he said. The approach is to migrate what can be migrated, test interoperability and operational impact, and tightly control access around systems that need more time. Segmentation helps contain threats, he added, but does not replace the cryptographic upgrades.

Elisity’s planned role in that transition is to connect identity data to cryptographic decision-making. Its roadmap would extend its IdentityGraph product with cryptographic inventory and risk information, allowing customers to rank post-quantum upgrades by business risk.

The deal also reflects how AI agents are reshaping network security. Elisity’s platform already treats AI agents and other non-human identities as subjects of access policy, and the company has joined the Open Secure AI Alliance with priorities that include least-privilege rules for sanctioned agents, containment of agentic threats and control of unsanctioned AI.

Winebrenner identified the hardest unresolved problem in agent control as maintaining trustworthy identity and authorization as an agent’s task, tools and delegated permissions change. “Knowing an agent is approved is only the beginning,” he said. “You need to understand whose authority it is exercising, what it needs to reach right now and when that access should end.” His prescription is least privilege down to the task: “An AI agent should have access only to the resources its task requires, including when it interacts with older infrastructure.”

The deal is expected to close in the fourth quarter of 2026, subject to regulatory approval.

UPDATE: 10/12/2026, 4:25 p.m.: This story has been updated with comments from Elisity CEO James Winebrenner.

The post IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion appeared first on CyberScoop.

A cybersecurity working group at the G7 is urging governments to accelerate defenses against quantum computers that could break some existing forms of public key encryption.

The working group’s report, prepared in June at the G7 Summit in France, said organizations “can no longer afford to postpone” work transitioning critical systems and data to “post-quantum” forms of encryption.

“The quantum threat remains off the radar for many organizations and not properly resourced, with other security concerns taking precedence,” the working group report said. “Yet, a successful and collective transition to PQC can only be achieved if organizations understand that the quantum threat is an economic and business risk, and not merely a cryptographic risk.”

Instead, leaders in government and industry “must reframe the quantum threat from a distant future problem to a near-term threat that demands action across all sectors, not just critical infrastructure.”

The report acknowledged uncertain timelines for quantum computers, but identified that threats like harvesting current sensitive, encrypted data to decrypt it in the future do exist today.

The report also warned that quantum computers could compromise authentication and assurance mechanisms—by forging trusted data or stealing confirmation— jeopardizing secure communications and legal contracts.

The working group’s conclusions are largely in line with what governments have been recommending for years, urging industry to inventory and prioritize their critical systems and shift over to newer, “post-quantum cryptography” encryption algorithms.

These encryption algorithms, originally designed by independent cryptographers and vetted by the National Institute for Standards and Technology and National Security Agency, will be used to protect the government’s own systems and data from cybercriminals and foreign governments.

The Trump administration recently issued an executive order directing agencies to boost the domestic quantum industry and move up internal timelines for migrating to PQC encryption from 2035 to 2030. Google, a potential industry bellwether, and other companies have opted to move their own migration timelines to 2029.

But while that work has proceeded on schedule in some areas, like the federal government and the highly regulated financial sector, it has lagged in other industries where owners and operators feel they have more immediate concerns than quantum computers.

“We acknowledge that transitioning to PQC is not a problem for individual organizations to solve in isolation, but rather a collective transition that can only be achieved with early engagement, coordinated planning and informed decision making across the public and private sectors,” the working group wrote.

While often referred to as “Post-Quantum” encryption, the reality is more complex. Cryptographers believe the algorithms selected by NIST and NSA will stand up to attacks from a quantum computer, but since one doesn’t exist today, designing cryptographic protections against it requires some guesswork and mathematical estimation.

Estimates can be wrong, or overlook the entire cryptographic attack surface. Some NIST-selected algorithms have already been broken with traditional computers or AI. That’s why the agency backs multiple algorithms and concepts like “crypto-agility,” allowing organizations to quickly switch between them.

The G7 report was signed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the UK’s National Cyber Security Centre (NCSC), The French Cybersecurity Agency (ANSSI), Germany’s Federal Office of Information Security (BSI), Canada’s Communications Security Establishment (CSE), Japan’s National Cybersecurity Office (NCO) and Italy’s National Cybersecurity Agency (ACN).

The post The G7 tells industry to hurry up and prep for post-quantum encryption appeared first on CyberScoop.

Trump administration budget chief Russell Vought told lawmakers Tuesday that he’s willing to work with Department of Homeland Security Secretary Markwayne Mullin on re-staffing up the Cybersecurity and Infrastructure Security Agency, following deep personnel cuts and further proposed reductions in the fiscal 2027 budget blueprint.

Mullin said last week at a House Appropriations Subcommittee on Homeland Security hearing that he would like to hire 600 more people at CISA, similar to remarks he made earlier this month at another House hearing. President Donald Trump has cut or lost more than 1,000 from an agency that stood around 3,400-strong at the end of the Biden administration — cuts criticized by lawmakers in both parties.

At a House Appropriations Subcommittee on Financial Services and General Government   hearing Tuesday, Rep. Mark Amodei, R-Nev., asked Vought about Mullin’s CISA remarks.

“You don’t just flip a light switch on, and you got 600 folks over in CISA now. What’s the plan for getting CISA fully operational?” Amodei, who chairs the panel’s Subcommittee on Homeland Security, asked. “How do we make sure we have a robust, effective, cost-effective CISA force? Because I don’t think anybody thinks we have it now.”

Vought, director of the Office of Management and Budget, said he hasn’t received a formal request from Mullin to increase CISA’s number of full-time employees, but knows that hiring isn’t instantaneous.

“He was not here when we developed this budget, so if he feels the need to have additional resources, we will work through that internally, and at the appropriate time, come up and brief you,” he answered Amodei. “I do think he’s in the process still of getting his arms wrapped around the department,” he said. Mullen became DHS secretary in late March.

“This is probably one of those things, particularly in the cyber world, you now have a year and a half of a new administration,” Vought continued, and referred to conservative complaints about how CISA handled election security and disinformation under Biden. “We saw this agency had major concerns with it in our four years outside of government and with new management, I think it’s now an agency, or could be an agency, that plays a very valuable part for DHS’s portfolio.”

Bringing hundreds of new CISA personnel on board could prove challenging for reasons beyond the usual bureaucratic hurdles and security clearance processes that slow any federal hires in the national security space. Past CISA employees and agency observers have said the way the Trump administration has purged personnel and treated those who have stayed could prove a further disincentive to future hires.

Acting CISA director Nick Andersen recently said that the agency has begun the process of hiring new CISA staffers, and expected to have nearly 200 job offers out by the end of this month.

The post Trump budget boss Russell Vought open to re-staffing CISA appeared first on CyberScoop.