CrowdStrike Holdings, Inc. (CRWD)

CrowdStrike was founded in 2011 and sells cybersecurity software as a subscription service. Everything runs on the CrowdStrike Falcon platform, built in the cloud with a single lightweight sensor that collects data from across an enterprise, including endpoints, cloud workloads, identities and third-party sources. That data is ingested once and reused across detection, investigation and response, and it is also used to train the company's AI models. The platform delivered 32 cloud modules as of 31 January 2026 and currently delivers 33, each sold on subscription. The company describes the approach as consolidating and replacing legacy point products and fragmented platforms across security and IT, and calls the resulting category the AI Security Cloud.

What the modules cover

Endpoint security carries next-generation antivirus, endpoint detection and response, and extended detection and response, against malware, fileless attacks and advanced threats, with cross-domain telemetry and unified incident management.

Cloud security protects workloads, containers and applications in real time, with runtime protection, cloud security posture management and application security posture management, integrating into developer workflows so vulnerabilities can be addressed before deployment. Exposure management unifies data from IT hygiene, vulnerability management and external attack surface management, so an organisation can predict attack paths and prioritise remediation.

Falcon Complete Next-Gen MDR is the managed service subscription, combining round-the-clock monitoring, investigation, response and remediation delivered by CrowdStrike's own security experts, extending across cloud security, identity protection, asset visibility and next-generation security information and event management, with managed threat hunting from Falcon Adversary OverWatch. It is backed by an underwritten limited warranty policy. Counter Adversary Operations is the proactive threat hunting and intelligence side, drawing on Threat Graph.

Identity protection defends against identity-based attacks with real-time detection, behavioural analytics and policy enforcement. The next-generation SIEM and log management modules carry AI-driven detection, data pipelining, centralised case management, investigation and response, alongside log management for any data source.

Charlotte AI is the generative AI module, using agentic reasoning to automate time-intensive investigation tasks. On the other side of AI, AI Detection and Response gives visibility and governance over how employees use AI and how AI agents operate, mapping the relationships between users, prompts, models, agents and Model Context Protocol servers and enforcing policy across them, analysing unstructured data for actions such as prompt injection and redacting sensitive data automatically.

Falcon for IT converges security and IT operations, giving visibility into enterprise assets with generative AI workflows and automation. Adaptive Shield, a CrowdStrike company, monitors business-critical software-as-a-service applications for risk from users, devices and non-human identities. Falcon Data Protection gives real-time visibility into sensitive data movement across endpoints, web applications, cloud drives and USB storage devices. Falcon Foundry is a no-code application development platform letting a customer build its own apps against CrowdStrike's data, threat intelligence, automation and infrastructure.

How it reaches customers

The platform is sold mainly through CrowdStrike's own sales teams working with a network of channel partners, on what the company calls a low friction land-and-expand strategy. Customer acquisition runs through channel partnerships and a free trial of Falcon Go downloaded from the company's website, the AWS Marketplace, the Google Marketplace and the Microsoft Marketplace. It also works with managed service providers and managed security service providers, who operate the Falcon platform on a customer's behalf as an outsourced security team.

Expansion inside an existing customer comes from deploying the sensor on more endpoints and cross-selling more cloud modules, helped by in-application trial usage of additional modules. Some new customers deploy across the whole organisation at once while others start in selected business units and add endpoints and modules later. The dollar-based net retention rate was 115% as of 31 January 2026.

The services alongside the software

Beyond the platform, CrowdStrike sells incident response, forensic investigatory and breach recovery services, technical assessment and strategic advisory work, next-generation SIEM consulting, platform deployment and operational services, and training and certifications. An incident response engagement typically begins by deploying the lightweight sensor to a customer's endpoints or cloud workloads, to establish whether an attacker is currently in the environment, which assets have been compromised and how much damage has been done.

From CrowdStrike's annual report on Form 10-K for the year ended 31 January 2026. The filing