CrowdStrike (CRWD) Business Profile

What it does

CrowdStrike is a cybersecurity software company founded in 2011. Its headquarters are in Austin, and George Kurtz is President, Chief Executive Officer and Director.

The company sells subscriptions to the cloud-native Falcon platform, which is designed to help organizations detect, investigate, prevent and respond to cyber threats. A lightweight software sensor is installed on endpoints and cloud workloads. It collects security data from devices, workloads, identities and third-party sources; that data is used across security functions rather than collected separately for each product.

Falcon combines the sensor with the Enterprise Graph, a connected intelligence layer that includes Threat Graph, Intel Graph and Asset Graph. These technologies correlate data and threat intelligence to identify activity, provide context for investigations, track assets and support automated response. The platform uses cloud-scale AI trained on security and enterprise data, alongside information from managed detection, threat intelligence and incident-response activities.

The company offers 33 cloud modules. These cover endpoint and workspace security, cloud security, identity protection, data protection, exposure management, next-generation SIEM and log management, managed detection and response, threat intelligence, SaaS security, IT automation, security workflow automation, and security for generative AI and AI-driven systems. It also provides incident response, forensic investigation, breach recovery, consulting, deployment, operational services, training and certifications.

How it makes money

CrowdStrike primarily earns subscription revenue from Falcon platform access and cloud modules. Subscriptions are generally priced per endpoint and per module, and a substantial majority have terms longer than one year. The company generally recognizes subscription revenue evenly over the subscription term. It typically invoices at the start of a subscription term, or in instalments for some multi-year arrangements, creating deferred revenue before revenue is recognized.

Customers can begin with any number of modules and add endpoints or modules over time. This is the company’s land-and-expand model. Its direct sales team and channel partners sell subscriptions, while trials of additional modules support expansion within existing accounts. Falcon Flex is a subscription model intended to let customers buy multiple products together. Management said on the Q2 2027 call that accounts using Falcon Flex had ending ARR above $2.29 billion.

Professional services are the other revenue stream. They include incident response, forensics, recovery, assessments, advisory work, platform deployment, operational services, training and certifications. These services are generally priced on a time-and-materials basis and can lead customers to later buy platform subscriptions.

For FY2026, subscription cost of revenue was $4.6 billion and professional-services cost of revenue was $247.3 million. For Q2 FY2027, total revenue was $1.47 billion, including $1.40 billion of subscription revenue and $71 million of professional-services revenue.

Customers and how it sells

CrowdStrike serves large enterprises, government organizations, high-profile brands, small and medium-sized businesses, and customers of managed security service providers. It was trusted by more than 88,000 organizations worldwide as of January 31, 2026. The business is not dependent on any particular end customer.

The company historically sold mainly to large organizations, but has expanded its focus to smaller businesses, including through trials and a trial-to-pay model. It sells through direct field and inside-sales teams, channel partners, managed service providers and managed security service providers. Falcon Go can be downloaded through the company website, AWS Marketplace, Google Marketplace and Microsoft Marketplace.

The United States generated $3.2 billion of FY2026 revenue, or 66.8%. Europe, the Middle East and Africa generated $782.7 million, or 16.3%; Asia Pacific generated $495.7 million, or 10.3%; and other geographies generated $317.0 million, or 6.59%. Management said on the Q2 2027 call that approximately 65% of quarterly revenue came from the United States and 35% from international geographies.

Suppliers and costs

CrowdStrike operates a cloud-delivered software model rather than a manufacturing business. Its ability to deliver Falcon depends on internet infrastructure, data centers and third-party cloud infrastructure providers. AWS is identified as a provider whose speed, data capacity and security are necessary for reliable internet access and services.

The company’s cost base includes cloud infrastructure, data-center capacity, software reliability and disaster-recovery arrangements, as well as employee costs, sales and marketing, research and development, accounting, compliance and investor relations. It had 10,698 employees in FY2026. The company expects to continue investing in sales and marketing, research and development, and platform functionality.

Management said on the Q2 2027 call that cloud optimization contributed to an 81% non-GAAP subscription gross margin for the quarter. The company also said that automation and AI investments were producing productivity gains across its business.

Competitive position

CrowdStrike competes with established and emerging security vendors across endpoint protection, IT operations, cloud security, identity security, network security, professional cybersecurity services, and SIEM and log management. The company also competes with legacy antivirus providers, alternative endpoint vendors using on-premises or cloud-hosted products, and suppliers that offer point products or fragmented platforms.

The company identifies competitive factors including the ability to provide a unified modular platform, threat detection and breach prevention, ecosystem integrations, time to value, price, total cost of ownership, brand and trust, sales and channel relationships, support and incident response, and ingestion and search of first- and third-party data. It acknowledges that some competitors have greater resources, recognition, customer relationships, customer bases or intellectual-property portfolios. Palo Alto Networks and Zscaler have been reported as established cybersecurity competitors.

Our reading: The single-sensor architecture and the reuse of security data across modules are a meaningful product-integration moat because they support platform consolidation, but customers can still compare price, efficacy and deployment against alternatives. [item1]

Our reading: The security-data flywheel is a meaningful moat because Falcon data is used to train models and improve detection, but its value depends on continued data collection, platform reliability and customer retention. [item1, item1a]

Our reading: Direct sales, channel partners, marketplaces and managed-service partners broaden distribution, but competitors with deeper customer relationships remain a material constraint. [item1, item7]

Growth opportunities

CrowdStrike’s growth model centers on winning new customers, expanding deployments to more endpoints, and selling additional modules to existing customers. The platform is designed to allow customers to start with selected modules and add capabilities over time. The company also uses incident response and proactive services as a route to subscription sales.

The company is expanding beyond endpoint protection into cloud security, identity protection, next-generation SIEM, log management, exposure management, data protection, SaaS security, IT automation and AI security. It is also targeting smaller organizations through low-touch sales, trials, marketplaces and managed-service providers. The company expects to continue investing in new modules, platform functionality, sales and marketing, research and development, and potentially acquisitions that add technology, expertise, customers or markets.

Management said on the Q2 2027 call that 51%, 35% and 26% of subscription customers had adopted six, seven, and eight or more modules, respectively. It also said NextGen SIEM ending ARR surpassed $695 million, cloud ending ARR exceeded $905 million, and identity ending ARR exceeded $585 million. Management expects FY2027 total revenue of $5.991 to $6.011 billion and net new ARR of $1.350 to $1.359 billion.

Structural risks

• The July 19 Incident has adversely affected sales, customer and partner relations, reputation, results of operations and financial condition. The company expects related legal, professional-services and other administrative expenses to continue, and says the precise financial impact cannot reasonably be quantified.

• Customer purchasing decisions have been delayed and sales cycles have lengthened following the July 19 Incident. Customer commitment packages have included discounting, modules, professional services, flexible payment terms and subscription extensions, which have increased contraction and reduced upsell dollar values.

• Falcon availability and performance depend on data centers, the internet and third-party cloud infrastructure providers, including AWS. Outages, cyberattacks, capacity constraints, defects, configuration errors or failures of redundancy and disaster-recovery arrangements could disrupt service.

• Growth depends on attracting customers, retaining them and expanding their subscriptions. Customer budgets, economic conditions, purchasing cycles, channel relationships, module adoption, pricing and adoption of cloud-based security solutions can affect demand.

• The market is intensely competitive. Competitors may improve products, introduce new services, consolidate, reduce pricing or benefit from greater resources, customer relationships and brand recognition.

• The company must attract, integrate and retain employees, particularly in sales, marketing and research and development, while expanding infrastructure, systems, controls and international operations.

Bottom line

Our reading

Our reading: CrowdStrike is a subscription cybersecurity platform business that combines endpoint software, cloud infrastructure, security data and professional services, with expansion driven by adding modules and endpoints within customer accounts. [item1, item7]

Our reading: Its operating model depends on the reliability of a cloud-delivered platform and the trust of customers after the July 19 Incident, while competition spans endpoint, cloud, identity and SIEM markets. [item1a, item7]

Our reading: The company’s data reuse, single-sensor design, module breadth and partner distribution are central to its ability to consolidate customer security spending. [item1, call_prepared]