CrowdStrike Holdings, Inc.
CrowdStrike Holdings, Inc. (CRWD)
Overview
CrowdStrike Holdings is a cybersecurity technology company that provides cloud-native protection for endpoints, cloud workloads, identity, and data through its Falcon platform. Headquartered in Austin, Texas, the company was founded in 2011 by George Kurtz (CEO), Dmitri Alperovitch, and Gregg Marston, and went public on Nasdaq in June 2019. CrowdStrike has grown rapidly into one of the largest pure-play cybersecurity vendors, with trailing-twelve-month revenue of roughly $5.4 billion (fiscal year 2026 revenue of about $4.81 billion) and around 10,700 employees. It joined the S&P 500 in June 2024 and carries a market capitalization above $200 billion, reflecting investor enthusiasm for its subscription-based growth model even as the company has only recently approached sustained GAAP profitability.
What They Do & How They Make Money
CrowdStrike sells cybersecurity software delivered as a cloud-based, SaaS subscription rather than traditional on-premises security appliances. Its core innovation is the Falcon platform: a single lightweight software agent installed on a customer's laptops, servers, and cloud workloads that streams telemetry to CrowdStrike's cloud, where AI and threat-intelligence models detect and stop attacks in real time. Once a customer installs the base agent, CrowdStrike upsells additional "modules" — covering areas like identity protection, cloud security, next-generation SIEM, and AI-driven automation — that snap into the same platform, a land-and-expand model that drives high net revenue retention. Revenue is overwhelmingly subscription-based (about 95% of total revenue), billed on annual or multi-year contracts, with a smaller professional-services component (roughly 5%) from deployment, incident response, and advisory work. Because the platform runs in the cloud and shares detection data across its entire customer base, CrowdStrike also monetizes its accumulating threat-intelligence data asset, marketed as processing "trillions of events" daily to improve detection for all customers.
Business Segments
CrowdStrike does not report discrete GAAP operating segments; it manages and discloses the business as a single reportable segment (cybersecurity solutions) and instead breaks results out by revenue type and by product/module category for investors:
- Subscription revenue (~95% of total): recurring fees from the Falcon platform and its modules, including Endpoint Detection & Response/endpoint protection, Cloud Security, Identity Protection (including the newer FalconID authentication offering), Next-Gen SIEM (a fast-growing category, cited at roughly 75% year-over-year growth), managed threat hunting (Falcon OverWatch), threat intelligence, and AI-native capabilities such as Charlotte AI and Falcon AI Detection and Response.
- Professional services revenue (~5% of total): implementation, incident response, proactive services, and training engagements that typically accompany or follow a subscription sale.
Profitability is reported at the consolidated level rather than by module: gross margin runs around the mid-70s percent, while GAAP operating margin has been slightly negative on a trailing basis even as the company highlights improving non-GAAP profitability and cash flow.
Competitors
- Endpoint security / EDR: Microsoft (Defender for Endpoint), SentinelOne, Palo Alto Networks (Cortex XDR), Trend Micro, Sophos, Broadcom/Symantec
- Cloud security (CNAPP): Palo Alto Networks (Prisma Cloud), Wiz (Google Cloud), Microsoft Defender for Cloud, Orca Security
- Identity security: Microsoft, Okta, SailPoint
- SIEM / security operations & observability: Microsoft Sentinel, Splunk (Cisco), Palo Alto Networks (Cortex XSIAM), Google Chronicle
- Broader platform/incumbent competition: Oracle, ServiceNow, and Fortinet are also cited by analysts as adjacent competitive threats as CrowdStrike expands beyond endpoint into a broader security "operating system."
Competitive Position
CrowdStrike's principal moat is data network effects: its single lightweight agent and cloud-native architecture accumulate telemetry across a large and growing customer base, which sharpens detection models for every customer and creates switching costs once a company standardizes on Falcon. The company has pushed hard on platform consolidation — bundling endpoint, cloud, identity, and SIEM capabilities into one console and one agent — to displace point-solution vendors and reduce the number of security tools a customer must operate, a strategy reflected in strong net-new annual recurring revenue growth (management has cited ARR growth around 32%) and reported customer renewal rates near 97%. Its "Falcon Flex" subscription structure, which lets customers reallocate spend across modules, is designed to accelerate this land-and-expand motion. Heavy investment in AI (Charlotte AI, agentic "AI Detection and Response," and partnerships with OpenAI, Anthropic, and Nvidia) is aimed at both improving detection and automating security-operations workflows that previously required large human analyst teams.
Key risks include intensifying competition from much larger, better-capitalized rivals — Microsoft bundles endpoint and identity security into its enterprise licensing at aggressive pricing, and Palo Alto Networks, Oracle, and others are pushing their own platform-consolidation pitches. CrowdStrike also still carries significant reputational and legal overhang from the July 19, 2024 outage, in which a faulty Falcon Sensor content update crashed roughly 8.5 million Windows machines worldwide, disrupting airlines, banks, and broadcasters; the incident triggered customer scrutiny, competitive displacement attempts by rivals, and dueling litigation with Delta Air Lines. Additional risks include a still-thin GAAP operating margin despite strong revenue growth, elevated valuation multiples that leave little room for execution missteps, and dependence on continued enterprise IT security budget growth in a market where large incumbents are increasingly bundling competing capabilities for "free" as part of broader software suites.