How CrowdStrike Makes its Money: Revenue Breakdown

Key Takeaways

• CrowdStrike generated $3.95 billion in total revenue in FY2025 (fiscal year ending January 31, 2025), up +25.4% year-over-year
• Annual Recurring Revenue (ARR) of $4.24 billion (+23% YoY) is the primary forward-looking health metric — it already exceeds trailing revenue
• Subscription revenue is 95% of total — one of the purest recurring SaaS revenue profiles in enterprise technology
• Subscription gross margin: 79.4%; blended gross margin: 73.2% — scaling efficiently as the cloud platform amortizes over a growing customer base
• First full year of GAAP net profitability in FY2025: $300M net income, $358M operating income (9.1% margin)
• Free cash flow of ~$1.26B (32% FCF margin) — CrowdStrike generates substantially more cash than its GAAP earnings suggest
• Net revenue retention ~115% — existing customers alone grow the business; new customer additions are pure upside
• The July 2024 global IT outage was a reputational crisis; FY2025 results show resilience but the incident introduced competitive vulnerability

How Does CrowdStrike Make its Money?

CrowdStrike is a cybersecurity company built around a single strategic insight: the security data needed to detect and stop breaches must be collected, analyzed, and acted upon in the cloud — not on the endpoint device itself. This cloud-native architecture, embodied in the Falcon platform, is the foundation of CrowdStrike’s business model, competitive moat, and revenue structure.

The company earns nearly all of its revenue from annual recurring subscriptions to the Falcon platform. Customers — ranging from small businesses using Falcon Go to the largest Fortune 500 companies and government agencies — pay annual SaaS fees for access to the Falcon modules they’ve licensed. In FY2025, CrowdStrike generated $3.95 billion in total revenue, with $3.76 billion (95%) from subscriptions and $0.19 billion (5%) from professional services.

The business model is a textbook SaaS subscription structure with a particularly powerful land-and-expand dynamic. Customers typically start with a core endpoint product (Falcon Prevent or Falcon Insight) and expand into additional modules over time — identity protection, cloud security, SIEM, exposure management, and IT automation. As of FY2025, 66% of CrowdStrike’s customers use 5 or more Falcon modules; 32% use 7 or more. Each additional module adds incremental ARR at near-zero marginal cost to CrowdStrike, since the platform infrastructure already exists.

CrowdStrike’s Annual Recurring Revenue (ARR) of $4.24 billion — which already exceeds its trailing annual revenue of $3.95 billion — is the forward-looking signal that matters most. ARR measures the annualized value of all active subscriptions and predicts near-term revenue with high accuracy given the multi-year contract structure of enterprise security agreements.

CrowdStrike (CRWD) Business Model

The Falcon Platform: One Agent, Many Modules

The Falcon platform is architected around a single lightweight agent — the Falcon sensor — that is installed on an endpoint (a laptop, a server, a cloud virtual machine, a container). The sensor collects security telemetry data: process activity, network connections, file operations, authentication events, and hundreds of other signals. This data streams continuously to CrowdStrike’s cloud — the Threat Graph — where machine learning models analyze it in real time to detect threats.

The architectural elegance of this model is critical to CrowdStrike’s business:

• One agent, multiple modules: Once the Falcon sensor is deployed on an endpoint, activating additional modules (identity, cloud security, SIEM) is a software configuration change — not a new hardware deployment. The friction of adding a new CrowdStrike module is dramatically lower than replacing one security tool with a different vendor’s product.
• Cloud delivery = continuous improvement: Because the intelligence runs in CrowdStrike’s cloud rather than on the endpoint, new threat detection models can be deployed globally without any customer action. Every CrowdStrike customer benefits immediately from threat intelligence gathered from any other CrowdStrike customer’s environment.
• The Threat Graph: CrowdStrike’s proprietary cloud database processes over 2 trillion security events per week across its global customer base. This dataset is a structural competitive advantage — the more endpoints CrowdStrike protects, the richer the threat intelligence, the better the detection quality, the more valuable the platform. New entrants cannot replicate this dataset.

The Land-and-Expand Revenue Engine

CrowdStrike’s customer acquisition strategy is built around selling one Falcon module to a new customer, then systematically expanding the relationship over time. The metrics tell the story:

Each module expansion increases ARR, deepens switching costs (the more of a customer’s security stack runs on Falcon, the harder it is to replace CrowdStrike), and improves gross margin (the incremental module revenue requires minimal additional cloud infrastructure cost once the base agent is deployed).

Net Revenue Retention (NRR) of ~115% quantifies this expansion dynamic: even if CrowdStrike never added another new customer, existing customers’ contract expansions would grow total subscription revenue by approximately 15% per year. This is among the highest NRR figures in enterprise security.

The Subscription Revenue Model: ARR Over Everything

CrowdStrike manages its business to Annual Recurring Revenue (ARR) rather than quarterly revenue because ARR is the leading indicator of business health. Key ARR mechanics:

• Annual contracts: Enterprise customers typically sign 1–3 year subscription agreements. Revenue is recognized ratably over the contract period — not all upfront — meaning a large Q4 new booking won’t fully hit the income statement until subsequent quarters.
• ARR leads revenue: Because subscriptions are recognized over time, ARR always runs ahead of trailing annual revenue in a growing business. CrowdStrike’s $4.24B ARR vs. $3.95B trailing revenue means the recognized revenue will “catch up” to the ARR level over the next 12 months.
• Ending ARR as the primary metric: Management, analysts, and investors focus on ending-period ARR rather than quarterly revenue. ARR growth acceleration or deceleration is the most important signal of business momentum.

Professional Services: The Customer Acquisition Tool

Professional services revenue ($190M in FY2025, 5% of total) comes from:

• Incident response (IR): CrowdStrike’s Falcon OverWatch and Services team responds to active breaches. IR engagements are high-urgency situations where the client is experiencing a cyberattack — the most persuasive possible product demonstration.
• Proactive security assessments: Red team exercises, penetration testing, compromise assessments
• Managed detection and response (MDR): Managed threat hunting through Falcon Complete and OverWatch

Professional services margins are lower than subscription (~30–40% vs. 79.4%). CrowdStrike views services strategically: a company that experiences a breach, calls CrowdStrike for incident response, and sees firsthand how quickly Falcon detects and contains threats is highly likely to become a long-term subscription customer. Services is a customer acquisition funnel, not a margin driver.

The Network Effect Moat: Threat Graph Scale

CrowdStrike’s most defensible competitive advantage is not its product features — features can be copied — but its Threat Graph dataset. The Threat Graph processes 2+ trillion security events per week from CrowdStrike’s global customer base. This data trains the AI models that detect threats across all customer environments.

The network effect works as follows: each new CrowdStrike customer contributes their endpoint telemetry to the Threat Graph. This data improves detection models. Better detection models make CrowdStrike more effective for all existing customers. More effective protection attracts more customers, who contribute more telemetry, further improving the models. A new entrant — even one with comparable software quality — cannot replicate years of cumulative threat telemetry.

This is structurally similar to the network effect advantages described in Cloudflare’s network intelligence model and Datadog’s observability data flywheel.

CrowdStrike’s Platform Expansion Strategy

CrowdStrike is executing a deliberate strategy to expand the Falcon platform’s addressable market by adding modules that compete with standalone vendors in adjacent security categories:

• Falcon Next-Gen SIEM (LogScale): Competes with Splunk, IBM QRadar, and Microsoft Sentinel in the $10B+ SIEM market. CrowdStrike’s SIEM advantage: native integration with Falcon endpoint data eliminates the need for separate data connectors.
• Falcon Identity Protection: Competes with Okta, Microsoft Entra, and Ping Identity in identity security. Protects Active Directory, detects identity-based attacks (credential theft, lateral movement).
• Falcon Cloud Security (CNAPP): Competes with Wiz, Orca Security, and Palo Alto Prisma Cloud in cloud-native application protection — securing AWS, Azure, and GCP workloads.
• Falcon Exposure Management: Attack surface management and vulnerability prioritization, competing with Tenable and Qualys.
• Falcon for IT / IT Automation: Competes with ServiceNow and Tanium in IT operations automation — using the same Falcon agent for patching, software deployment, and device management.
• Charlotte AI: Generative AI security assistant that synthesizes Falcon data to answer analyst queries, investigate incidents, and generate threat reports — competing with AI copilot features from Microsoft Security.

Each new module expands the total addressable market CrowdStrike can pursue while leveraging the existing installed base of Falcon agents for immediate distribution.

CrowdStrike Competitors

Palo Alto Networks is CrowdStrike’s most direct large-cap competitor. Palo Alto’s Cortex XDR (endpoint/cloud security) and XSIAM (AI-driven SOC platform) compete directly with Falcon across multiple modules. Palo Alto’s “platformization” strategy — offering free or discounted modules to customers who consolidate their security stack — is a direct competitive response to CrowdStrike’s land-and-expand model. See the CrowdStrike vs. Palo Alto Networks comparison for a detailed head-to-head.

Microsoft Defender is CrowdStrike’s most significant competitive threat from a market share perspective. Microsoft bundles Defender for Endpoint with Microsoft 365 E3/E5 enterprise licensing — effectively offering a “good enough” endpoint security product at no incremental cost to the ~300 million organizations already paying for Microsoft 365. Customers who accept Microsoft’s bundled security save budget but accept a product that security professionals generally rate below CrowdStrike in detection quality and response capabilities.

SentinelOne is CrowdStrike’s most direct pure-play EDR/XDR competitor. SentinelOne’s Singularity platform is architecturally similar (cloud-native, AI-powered, single agent) and competes in the same enterprise segments. SentinelOne is smaller (~$800M ARR) but growing faster as a percentage, targeting the same customer profile.

Fortinet competes primarily in network security (firewalls, SD-WAN) but has been expanding into endpoint and cloud security. Fortinet’s Security Fabric platform competes with CrowdStrike in organizations seeking a single vendor across network and endpoint security. Fortinet has stronger SMB and mid-market penetration than CrowdStrike.

Okta competes with Falcon Identity Protection in identity security and zero trust. Okta’s identity-first approach versus CrowdStrike’s endpoint-first approach represents two philosophies for stopping the same threat (credential-based attacks).

Microsoft (more broadly), Cisco, and IBM are larger platform competitors that offer security as part of broader technology ecosystems. These companies compete more on procurement convenience (existing vendor relationships) than on technical differentiation.

For context on the broader cybersecurity competitive landscape, see CrowdStrike vs. Palo Alto Networks.

Revenue Breakdown

FY2025 = fiscal year ending January 31, 2025.

The revenue mix — 95% subscription, 5% services — is the hallmark of a mature SaaS model. Subscription revenue growing +25.8% at a $3.76B base is exceptional performance for enterprise security at this scale. The ARR figure ($4.24B) exceeding trailing revenue ($3.95B) confirms the business is still accelerating its recognized revenue base.

Subscription Revenue Deep-Dive

CrowdStrike’s subscription revenue is generated across its Falcon module portfolio. Key modules and their competitive context:

Falcon Prevent (NGAV) — Next-generation antivirus. The entry-level module and the most common initial purchase. Replaces traditional antivirus (Symantec, McAfee) using AI behavioral detection rather than signature-based scanning. Falcon Prevent is typically the “land” component of the land-and-expand model.

Falcon Insight (EDR) — Endpoint detection and response. Records every process, file, network connection, and registry change on the endpoint in a searchable timeline. Security analysts can investigate an incident by rewinding endpoint activity to the moment of compromise. EDR is CrowdStrike’s core differentiation and the product that built the company’s reputation.

Falcon Identity Threat Protection — Protects Active Directory (the authentication backbone of most enterprise networks) and detects identity-based attacks: credential theft, pass-the-hash, golden ticket attacks, and lateral movement. Competes with Okta’s identity security portfolio and Microsoft Entra.

Falcon Cloud Security (CNAPP) — Cloud-native application protection platform. Secures containerized workloads, Kubernetes clusters, and cloud infrastructure configurations across AWS, Azure, and GCP. Competes with Wiz (the dominant cloud security startup) and Palo Alto’s Prisma Cloud.

Falcon Next-Gen SIEM (LogScale) — Security information and event management. Ingests, stores, and queries security log data from all sources (not just CrowdStrike endpoints). CrowdStrike’s SIEM differentiation is speed (petabyte-scale ingestion with sub-second query response) and native integration with Falcon endpoint data. Competes with Splunk (acquired by Cisco for $28B in 2024), Microsoft Sentinel, and IBM QRadar.

Falcon Exposure Management — Continuously discovers and prioritizes vulnerabilities and attack surface exposure across the enterprise. Competes with Tenable and Qualys.

Charlotte AI — Generative AI assistant for security operations center (SOC) analysts. Analysts can query Charlotte in natural language (“show me all processes that ran from a temp directory in the last 24 hours”) and receive synthesized answers from Falcon data. Competes with Microsoft Security Copilot.

Falcon for IT — Uses the same Falcon agent for IT operations: software deployment, patch management, device inventory, and configuration management. Competes with ServiceNow, Tanium, and Ivanti.

CrowdStrike (CRWD) Income Statement

All values in billions unless noted. Financial data sourced from CrowdStrike SEC Filings.

The FY2025 income statement documents CrowdStrike’s transition from a growth-at-all-costs model to a profitable growth model. Operating income more than doubled (+114%) on revenue growth of +25.4% — operating expenses grew +19.3%, significantly slower than revenue. This operating leverage gap (revenue growing ~6 percentage points faster than operating costs) drove 380 basis points of operating margin expansion.

The divergence between GAAP profitability metrics (net income: $300M, 7.6% margin) and free cash flow (~$1.26B, 32% FCF margin) is notable and warrants explanation: CrowdStrike’s GAAP earnings are significantly depressed by non-cash stock-based compensation (~$750M in FY2025). FCF adds back this non-cash charge, making it a more accurate representation of the cash the business actually generates.

CrowdStrike (CRWD) Key Financial Metrics

Key Metric Observations

ARR of $4.24B growing at 23% on a base of this size is exceptional. For context, most enterprise software companies at $4B+ ARR grow at 10–15%. CrowdStrike’s above-average growth rate reflects: (1) the continued expansion of the cybersecurity market, (2) module expansion into new TAM categories (SIEM, identity, cloud), and (3) competitive wins against legacy vendors and point products.

FCF margin of 32% vs. operating margin of 9.1% — the 2,300 bps gap is almost entirely explained by stock-based compensation (SBC). CrowdStrike compensates its engineers and sales force heavily with equity. This is a cash cost in an economic sense (dilution) but not a cash cost in the FCF calculation. Investors in high-growth SaaS companies must decide whether to use operating margin (which penalizes SBC) or FCF margin (which ignores it) as the profitability benchmark. The answer depends on whether SBC is viewed as temporary (it will decline as a % of revenue as the company matures) or permanent (management will always use high equity comp).

Net Revenue Retention of ~115% is a fundamental SaaS quality indicator. It means CrowdStrike’s existing customer cohort grows its ARR contribution by 15% annually through module expansion, seat count growth, and contract upgrades. This metric declined from ~120%+ in earlier years as the customer base matured — meaning there is inherently less “easy” expansion left with long-tenured customers. Monitoring NRR trajectory is critical: sustained NRR above 110% is healthy; NRR falling toward 100% would signal that the land-and-expand engine is losing steam.

Is CrowdStrike Profitable?

Yes — and FY2025 marked a significant milestone: CrowdStrike’s first full fiscal year of GAAP net profitability since going public in 2019.

• GAAP net income: $300 million (7.6% net margin)
• GAAP operating income: $358 million (9.1% operating margin)
• Gross margin: 73.2% (subscription: 79.4%)
• Free cash flow: ~$1.26 billion (32% FCF margin)

The company was unprofitable on a GAAP basis for years as it invested aggressively in sales force expansion, R&D, and international infrastructure to capture market share during the cloud security transition. That investment phase is now yielding operating leverage: revenue is growing faster than costs, and the fixed cost base of the Falcon cloud platform is being amortized over an ever-larger subscriber base.

The 32% FCF margin is the metric that most clearly shows the underlying economics of CrowdStrike’s model. SaaS businesses with strong network effects and high switching costs can sustain FCF margins in the 30–40% range at scale — CrowdStrike is already there, even while still investing heavily in new modules.

Where Does CrowdStrike Spend its Money?

Cost of Revenue (~$1.06B, 26.8% of revenue)

• Cloud infrastructure (~$700M): Running the Falcon platform on AWS. CrowdStrike processes 2+ trillion security events per week, requiring massive cloud compute and storage. As the customer base scales, these costs grow sub-linearly — driving gross margin expansion
• Professional services delivery costs (~$130M): Personnel costs for incident responders, assessors, and managed service analysts
• Amortization of acquired technology: Capitalized costs from platform development amortized over useful life

Research & Development (~$1.05B, 26.6% of revenue)

R&D covers CrowdStrike’s engineering organization — building new Falcon modules, improving detection models, developing Charlotte AI, maintaining the Threat Graph, and building integrations with third-party security tools. R&D as a percentage of revenue has been declining slowly as the module portfolio matures — a sign of R&D leverage as existing investments compound.

Sales & Marketing (~$1.14B, 28.9% of revenue)

CrowdStrike’s go-to-market model is enterprise direct sales supplemented by channel partners (MSSPs, VARs, GSIs like Accenture). Sales cycles for enterprise security are long (3–12+ months for large deals) and require significant sales engineering support. Sales & Marketing is the largest operating expense line and the primary area where CrowdStrike has been seeking efficiency. S&M as a percentage of revenue has been declining — improving sales efficiency as the brand and customer success motion matures.

General & Administrative (~$0.34B, 8.6% of revenue)

G&A covers CrowdStrike’s ~10,000+ employee global workforce, legal, regulatory compliance, and executive functions. G&A is growing slower than revenue — contributing to the operating leverage story.

CrowdStrike vs. Comparable Cybersecurity Companies

CrowdStrike’s profile — high ARR growth, strong gross margins, rapidly expanding operating margins, and exceptional FCF — is the combination that justifies its premium valuation. Palo Alto Networks has higher absolute margins but slower growth; SentinelOne is growing faster but losing money on an operating basis. CrowdStrike sits in the value-creation sweet spot of profitable growth.

CrowdStrike History and Milestones

CrowdStrike (CRWD): What to Watch

1. Post-Outage Customer Retention and New Logo Recovery The July 2024 outage was the most significant business risk event in CrowdStrike’s history. FY2025 results showed ARR growth continued at +23% and NRR stayed above 115% — indicating most customers retained their subscriptions. However, the outage introduced competitive vulnerability in new business sales: prospects evaluating CrowdStrike against SentinelOne or Palo Alto Cortex XDR now have a concrete safety argument for diversification. Monitoring new logo ARR additions per quarter (vs. pre-outage trend) will show whether the reputational damage has been fully absorbed.

2. ARR Growth Rate Trajectory CrowdStrike’s ARR growth has decelerated from 50%+ in 2020–2021 to 23% in FY2025 — a natural consequence of operating on a larger base. The key question is whether growth stabilizes at ~20–25% (healthy for a $4B+ ARR business) or continues to decelerate toward 15%. The next generation of growth catalysts — Next-Gen SIEM displacing Splunk, Falcon for IT competing with ServiceNow, Charlotte AI driving new seat expansion — must activate before the core endpoint market reaches saturation.

3. Next-Gen SIEM: The $10B+ Opportunity Cisco’s $28B acquisition of Splunk in 2024 validated the SIEM market’s strategic importance and disrupted the competitive landscape. CrowdStrike’s LogScale/Next-Gen SIEM is positioned as the faster, cheaper, AI-native alternative to legacy SIEMs. Winning SIEM displacement deals is the largest near-term ARR growth opportunity available to CrowdStrike — and a category where the native integration of Falcon endpoint data into the SIEM creates a genuine differentiator vs. Microsoft Sentinel and IBM QRadar. SIEM ARR contribution in quarterly disclosures will be the leading indicator.

4. Microsoft Bundling Threat Microsoft’s strategy of including Defender for Endpoint within M365 E3/E5 licensing at no additional cost creates a structural price-to-zero dynamic in enterprise endpoint security. CrowdStrike’s defense: Defender’s detection quality and response capabilities are consistently rated below Falcon in independent evaluations (MITRE ATT&CK evaluations, Gartner Magic Quadrant). As long as CrowdStrike can demonstrate measurably better security outcomes, the premium is defensible. If Microsoft improves Defender to near-parity, CrowdStrike’s pricing power erodes.

5. Palo Alto Networks “Platformization” Competition Palo Alto Networks has been aggressively offering free or steeply discounted modules to customers who commit to consolidating their security stack on Palo Alto’s platform — a direct response to CrowdStrike’s land-and-expand model. This strategy temporarily compresses Palo Alto’s billings while building platform lock-in. If Palo Alto’s platformization strategy succeeds in large enterprise accounts where CrowdStrike and Palo Alto compete, it could slow CrowdStrike’s module expansion in those accounts. See CrowdStrike vs. Palo Alto Networks for the competitive breakdown.

6. Gross Margin Expansion Runway Subscription gross margin at 79.4% has room to expand toward 82–85% as cloud infrastructure costs scale sub-linearly with revenue growth. CrowdStrike’s multi-year cloud infrastructure commitment with AWS provides cost predictability. Monitoring quarterly gross margin trend — especially whether subscription gross margin crosses 80% — indicates whether the platform economics are improving as forecasted.

7. Charlotte AI and Generative AI Monetization CrowdStrike’s Charlotte AI is positioned as an AI-powered SOC analyst that can dramatically reduce the time security analysts spend on routine investigation tasks. The monetization question: will Charlotte AI be a module that generates incremental ARR, or a platform feature included in higher-tier bundles? If Charlotte AI becomes a paid add-on at meaningful ARR contribution, it represents a new expansion vector within the existing customer base without requiring new endpoint deployments.

8. Regulatory and Legal Overhang from the July 2024 Outage The July 2024 outage triggered significant litigation: Delta Air Lines filed a lawsuit claiming $500M+ in damages from cancelled flights. Multiple other organizations are pursuing legal claims. Regulatory investigations in the U.S. and Europe regarding software update safety practices are ongoing. While CrowdStrike has contested these claims, the legal and regulatory uncertainty represents a financial contingency and distraction for management. Resolution of major lawsuits — through settlement or adjudication — will remove an overhang on the stock.

CrowdStrike (CRWD) Financial Summary

CrowdStrike (CRWD) is a Cybersecurity company that generated $3.95 billion in total revenue in FY2025 (fiscal year ending January 31, 2025) — up +25.4% year-over-year. Annual Recurring Revenue of $4.24 billion (+23% YoY) is the primary forward-looking health metric for the business.

Gross margin reached 73.2% (subscription gross margin: 79.4%) and operating margin reached 9.1% — FY2025 was CrowdStrike’s first full year of GAAP net profitability. Free cash flow of ~$1.26 billion at a 32% FCF margin demonstrates the operating leverage embedded in a SaaS subscription model with 79% gross margins and a land-and-expand revenue engine.

The Falcon platform’s net revenue retention of ~115% means existing customers alone grow the subscription revenue base by ~15%/year. Combined with new logo additions and TAM expansion into SIEM, identity, and cloud security, CrowdStrike has multiple simultaneous growth vectors.

Key forward drivers: Next-Gen SIEM displacement of Splunk, Charlotte AI monetization, Falcon for IT competing with ServiceNow, and continued cloud security growth. Key risks: Microsoft bundling headwind, Palo Alto platformization competition, post-outage reputational recovery in new business, and ARR growth deceleration.

For a direct competitor comparison, see CrowdStrike vs. Palo Alto Networks. For related platform companies, see Palo Alto Networks, Cloudflare, Okta, Fortinet, and Datadog.

Frequently Asked Questions

How does CrowdStrike make money? Primarily through annual SaaS subscriptions to Falcon modules — 95% of FY2025 revenue ($3.76B of $3.95B total). The remaining 5% ($190M) is professional services (incident response, assessments). ARR was $4.24B at fiscal year end.

Is CrowdStrike profitable? Yes — FY2025 was the first full year of GAAP profitability: $300M net income (7.6% margin), $358M operating income (9.1% margin). Free cash flow was ~$1.26B (32% margin) — the cleaner cash profitability metric given ~$750M in non-cash stock-based compensation.

What is CrowdStrike’s Falcon platform? A cloud-native cybersecurity platform built on a single lightweight endpoint agent. One Falcon sensor → 28+ modules covering EDR, NGAV, identity protection, cloud security, SIEM, exposure management, and IT automation.

What is CrowdStrike’s ARR? $4.24 billion as of January 31, 2025 — up 23% year-over-year. ARR is the annualized value of all active subscriptions and is the primary forward-looking health metric.

What is the land-and-expand model? Sell one Falcon module to a new customer (land), then sell additional modules over subsequent quarters and years (expand). 66% of customers use 5+ modules; 32% use 7+. Net revenue retention of ~115% quantifies the expansion.

Who are CrowdStrike’s competitors? Palo Alto Networks (Cortex XDR/XSIAM), Microsoft Defender (bundled with M365), SentinelOne (direct EDR peer), Fortinet (network + endpoint), Okta (identity security overlap).

What happened in the July 2024 CrowdStrike outage? A faulty Falcon sensor content update crashed 8.5 million Windows systems globally on July 19, 2024 — disrupting airlines, hospitals, banks, and broadcasters. FY2025 results showed resilient ARR and NRR, but the incident introduced legal liability and reputational headwinds in new business sales.

What is CrowdStrike’s gross margin? 73.2% blended; 79.4% on subscription revenue alone. The gap reflects lower-margin professional services. Subscription gross margin has been expanding as cloud infrastructure costs scale sub-linearly with revenue.

What is CrowdStrike’s free cash flow? ~$1.26 billion in FY2025 (32% FCF margin) — substantially above GAAP net income because the FCF calculation adds back ~$750M in non-cash stock-based compensation.

What is CrowdStrike’s total addressable market? CrowdStrike estimates its TAM at ~$100B currently, expanding to $225B+ by 2028 as it adds module categories (SIEM, IT automation, identity governance, data protection). The TAM expansion is the core rationale for the aggressive module development investment.