CrowdStrike Holdings (NASDAQ: CRWD) is a cybersecurity company that delivers cloud-native endpoint, workload, identity, and threat intelligence protection through its Falcon platform. Revenue comes primarily from subscriptions to the Falcon platform and its cloud modules, sold directly through field and inside sales teams and through channel partners, with a land-and-expand model that grows contract value as customers add endpoints and modules. Annual recurring revenue (ARR) and dollar-based net retention rate are the primary operating metrics disclosed in the FY2026 10-K (filed 2026-03-05). The Falcon platform processes trillions of cybersecurity events per week and benefits from a network effect: each additional endpoint added to the platform increases the breadth of the shared threat dataset, which improves detection for all customers. A content configuration update on July 19, 2024 caused system crashes on certain Windows systems, adversely affecting sales cycles and financial results. CrowdStrike acquired SGNL.AI for approximately $627.9 million and Seraphic Algorithms for approximately $327.4 million, both closing in early 2026.

Revenue model

Subscription fees for access to the Falcon platform and individual cloud modules, with professional services (incident response and proactive services) as a secondary revenue stream. The go-to-market model is land-and-expand: initial deployments are expanded to more endpoints and additional modules over time. Channel partners supplement the direct sales force but are not counted as customers for retention metric purposes.

Products and services

Falcon platform (cloud-native security platform); Falcon Sensor (lightweight endpoint agent supporting Windows, Mac, and Linux); cloud modules covering endpoints, cloud workloads, identities, DevOps, IT asset management, and configurations; Next-Gen SIEM; incident response and proactive professional services; CrowdStrike University training and certification programs (including Falcon Administrator, Falcon Responder, Falcon Hunter, Cloud Specialist, Identity Specialist, and Next-Gen SIEM Engineer certifications delivered through Pearson Vue).

Customers and end markets

Organizations across multiple industries and sizes worldwide, including large enterprises, government organizations, and managed security service providers (MSSPs). Customers are segmented by endpoint count for sales coverage. No single customer concentration figures are disclosed in the provided excerpts. The July 19, 2024 incident adversely affected customer purchasing decisions and elongated sales cycles, though dollar-based gross retention rates remained high following the incident.

Value-chain role

Security platform vendor and data aggregator sitting between enterprise IT environments and threat actors. CrowdStrike operates as both a software subscription provider and a threat intelligence aggregator, using crowdsourced endpoint telemetry across its customer base to train detection models. Channel partners handle distribution; CrowdStrike retains the platform, sensor, and intelligence layers.

Geographic exposure

Global customer base referenced in the FY2026 10-K (filed 2026-03-05); specific regional revenue breakdowns are not disclosed in the provided excerpts.

Source: SEC 10-K, filed 2026-03-05

Industry: Services-Prepackaged Software Peers: Microsoft Corp Fortinet Inc GitLab Inc McAfee Corp. Gen Digital Inc Oracle Corp Palo Alto Networks Inc ServiceNow Inc VMWARE LLC Zscaler Inc