CrowdStrike Company Overview

CrowdStrike Holdings, Inc. is a Delaware public holding company trading on Nasdaq as CRWD; operations run through subsidiaries including CrowdStrike, Inc. Co-founded in 2011 by George Kurtz and Dmitri Alperovitch, it is now centered on Falcon, an agentic security platform spanning endpoints, cloud workloads, identity, data and security operations. Its formal mission is stopping breaches. Public shareholders own the company under one-share, one-vote governance, while an independent chair leads board oversight. Revenue is predominantly subscription SaaS, generally priced per endpoint and module, with professional services alongside it. More than 88,000 organizations were covered through direct and MSSP relationships at January 31, 2026; sales combine direct teams with a partner-heavy channel. Microsoft, Palo Alto Networks and SentinelOne are key overlapping alternatives. Growth comes from module expansion, marketplaces, AI security and adjacent workloads. George Kurtz remains CEO. The core capability is cloud-scale telemetry plus AI; the core constraint is maintaining trust across platform reliability, cloud infrastructure and partner execution. Evidence is current through August 15, 2026, with latest reported financial results through April 30, 2026. FY2026 Form 10-K

CrowdStrike’s history is a sequence of architectural expansion rather than a simple antivirus product story: a 2011 cloud-native endpoint thesis became a public company in 2019, then widened Falcon into identity, cloud, data and security operations. The July 2024 outage added a second imperative—resilience must scale with the platform. 2019 registration statement current business filing

The legal boundary matters. CrowdStrike, Inc. was incorporated in Delaware in August 2011. CrowdStrike Holdings, Inc. followed in November 2011 and acquired CrowdStrike, Inc., which became its wholly owned subsidiary. The current listed parent is therefore CrowdStrike Holdings, Inc.; references to “CrowdStrike” below describe the consolidated operating group unless a subsidiary is named specifically. Its principal executive offices are in Austin, Texas, its corporate website is crowdstrike.com, and the business serves customers globally.

Sources: IPO founder account, Falcon growth record and incident report.

Why Was the Original Architecture So Consequential?

The core bet was to collect and analyze security telemetry in the cloud through a lightweight sensor, allowing new protection modules to reuse the same data plane rather than requiring a separate product stack.

• One lightweight sensor can support multiple security use cases.
• Cloud-scale telemetry feeds detection, intelligence and automated response.
• A shared data model lowers friction when customers add modules.
• The same architecture creates concentration risk when shared components fail.

Source: Falcon architecture describes the single-sensor cloud architecture, reusable data model and operating dependencies.

CrowdStrike formally describes its mission as stopping breaches. It does not need an invented vision statement: the better-evidenced long-term direction is to make Falcon a broader operating layer for cybersecurity and, increasingly, an agentic security platform for the AI era. Its stated culture links customer focus, innovation and passion to that mission. mission and values current platform direction

What Is the Formal Purpose?

“Stopping breaches” is the company’s explicit mission. It provides a stable test for product, service and operating choices: whether Falcon helps customers prevent, detect, investigate or recover from security compromise.

What Is the Evidenced Direction?

CrowdStrike increasingly frames Falcon as the operating system and agentic platform for cybersecurity, extending from endpoint defense into cloud, identity, data, SIEM and the protection of AI systems themselves.

Sources: mission language and Agentic Security Platform distinguish the formal mission from current strategic positioning.

The values are more concrete than a generic culture statement. CrowdStrike’s filing names “Fanatical About the Customer,” “Relentlessly Focused on Innovation,” and “Limitless Passion” linked to “Unlimited Potential,” under the “One Team. One Fight.” mantra. The operating evidence is mixed in a useful way: customer advisory boards feed product development, while fiscal 2026 research and development expense reached $1.385 billion; at the same time, the July 2024 incident shows that innovation speed must be balanced by change control and reliability.

That tension is strategically important. A cybersecurity vendor creates value partly by shipping defenses quickly against fast-moving adversaries, yet customers also expect exceptional stability because the software runs deeply inside critical systems. CrowdStrike’s purpose therefore has two operational dimensions: improve security outcomes and preserve enough trust in the delivery mechanism for customers to keep deploying the platform broadly. customer and R&D evidence

The July 19, 2024 incident made software resilience a company-defining constraint. A defective Rapid Response Content configuration update for Windows produced system crashes during a short deployment window. CrowdStrike reversed the update quickly, but the commercial and governance consequences continued into 2026 through remediation, customer commitments, litigation exposure and greater emphasis on controlled release processes. post-incident account latest quarterly filing

The deeper lesson is not that CrowdStrike stopped pursuing rapid updates; that would conflict with the threat environment it is designed to address. Instead, the incident raises the required quality bar for how rapid defenses are validated, deployed, observed and reversible. Because Falcon is embedded across endpoints and other security workflows, a common-platform architecture amplifies both the benefit of fast improvement and the cost of a flawed shared change.

By 2026 the financial disclosures still treated the incident as a live operating factor rather than a closed historical event. Customer commitment packages were expected to continue affecting contraction and upsell values, and filings continued to discuss legal and reputational exposure. This makes resilience a continuing input to retention, sales credibility and platform expansion—not merely an engineering concern. Q1 incident effects

CrowdStrike is owned by public shareholders; neither Nasdaq, the board nor George Kurtz is the legal owner of the corporation. The former dual-class structure ended when Class B shares converted in December 2024. At the April 3, 2026 proxy cutoff, only Class A was outstanding, with one-share, one-vote governance and no disclosed controlling shareholder. 2026 proxy statement

The proxy’s beneficial-ownership table is the best comparable ownership snapshot, but absolute share counts later changed because CrowdStrike completed a four-for-one stock split in July 2026. Percentages below are therefore shown as the economically meaningful proxy-cutoff measure; the split changed the number of shares, not each holder’s proportional ownership at the split moment.

Control is therefore separated across three layers. Shareholders elect directors and vote on matters reserved to them. The board oversees strategy, risk and management; the 2026 proxy reported eight of nine directors as independent and Gerhard Watzinger as independent chair. Management, led by Kurtz, runs day-to-day operations. This separation is especially relevant because the founder remains the most visible executive but does not possess dual-class super-voting rights. board governance structure

CrowdStrike creates value by collecting security and enterprise telemetry through Falcon, enriching it with threat intelligence and AI, turning those signals into prevention, detection, investigation and response, then selling access mainly as recurring software subscriptions. Customers can add modules on the same architecture, so product breadth and recurring revenue are linked through a deliberate land-and-expand model. business model disclosure

Falcon now covers a wider security surface than the company’s endpoint roots. Current disclosed capabilities include endpoint and workspace security, identity threat protection, cloud security, Next-Gen SIEM and log management, data protection, exposure management, IT automation, threat intelligence, SaaS security and application development through Falcon Foundry. Managed offerings and professional services add human expertise where customers need operational help.

Source: Falcon operating model describes the platform architecture, module portfolio, subscription model and expansion motion.

The payer is typically an organization buying cybersecurity capabilities for its workforce, infrastructure or customers; MSSPs can also purchase Falcon and operate it for multiple end organizations. Subscriptions are generally priced per endpoint and module, with a substantial majority lasting more than one year and revenue recognized ratably. Incident-response and proactive services are generally time-and-materials and are used partly to create cross-sell opportunities.

The model also has concentrated dependencies. Its cost structure combines cloud and service delivery with personnel-heavy sales and marketing, research and development, and corporate functions. CrowdStrike must scale compute, storage and data-center capacity as telemetry grows; it specifically identifies AWS as important to cloud-server operations. It must retain scarce security, engineering and sales talent, protect intellectual property, interoperate with external operating-system ecosystems and maintain high-quality customer support. Those inputs sit behind the apparent simplicity of a SaaS subscription. operating dependencies

CrowdStrike serves organizations from large enterprises and governments to smaller businesses, but the buying system changes by segment. Security and IT teams use the platform; CISOs and technology leaders commonly shape the choice; procurement or business owners fund it; and MSSPs may operate it for end customers. Distribution combines direct sales with a channel-heavy partner ecosystem. customer and channel model

At January 31, 2026, CrowdStrike said more than 88,000 organizations trusted its technology, including direct end customers and organizations served through MSSPs. Historically the company concentrated on large organizations, then broadened toward SMBs through inside sales, trial-to-pay motions and managed offerings. Government is another distinct route: CrowdStrike invests in federal, state, local and higher-education programs, where authorization and procurement requirements matter as much as product fit.

Source: sales and marketing model supports the acquisition, distribution and expansion journey.

The channel is not auxiliary. CrowdStrike says the vast majority of Falcon sales flow through channel partners, while direct sales teams leverage that network. Marketplaces add another procurement layer: Falcon Go has been distributed through CrowdStrike’s site and cloud marketplaces, and Falcon became available through Microsoft Marketplace in February 2026 with Azure Consumption Commitment eligibility. This lets some buyers use existing cloud-spend commitments rather than create a separate procurement path.

Retention is economically visible in dollar-based net retention, which was 115% at January 31, 2026 under CrowdStrike’s definition. That means the same cohort’s recurring revenue grew after expansion, contraction and churn, excluding new customers and services. The metric supports the land-and-expand thesis, but it should not be confused with logo retention. It also remains sensitive to the customer commitments and elongated terms created after the 2024 incident. International customers generated about 33% of fiscal 2026 revenue, making localization, regulation, currency and partner execution meaningful growth constraints. retention and geography data

AI is central in three ways: CrowdStrike uses AI to detect and respond to threats, sells controls intended to secure organizations’ AI adoption, and is building agentic workflows for security operations. That broadens Falcon’s role from protecting computers to governing and defending the AI attack surface, while creating new model, data and regulatory dependencies. AI platform strategy

Sources: current AI capabilities and Q1 innovation update support the defense, secure-AI and agentic-workflow themes.

The Q1 FY2027 release shows that this is already a product and ecosystem strategy, not merely messaging. CrowdStrike highlighted Project QuiltWorks with OpenAI and Anthropic, Charlotte AI AgentWorks, AI detection and response, agentic managed detection and response, data security and new integrations. Separately, the 2025 Pangea acquisition added AI detection and response technology to the group’s capability base.

The strategic logic is that the same broad telemetry layer used for traditional security can become more valuable as AI systems create new identities, data flows and automated actions. The constraint is symmetry: the technology that can accelerate defenders can also accelerate attackers, and the use of AI introduces evolving liability, model-behavior and regulatory questions. CrowdStrike’s own risk disclosures explicitly acknowledge competition and a changing AI regulatory landscape. AI risk disclosure

Buyers compare CrowdStrike with vendors that can satisfy the same security decision across endpoint protection, XDR, security operations, cloud or identity. Microsoft, Palo Alto Networks and SentinelOne overlap directly in endpoint/XDR use cases; Comparability weakens as each vendor’s broader installed base and bundle differ. competition categories

The most important competitive boundary is the buyer’s consolidation decision. CrowdStrike argues that one sensor and shared data plane reduce complexity, but larger suite vendors can use existing contracts, infrastructure and bundled economics to lower perceived switching or procurement costs. Legacy antivirus, narrower point products and internally assembled security stacks can also substitute for pieces of Falcon without being full platform equivalents. Technical efficacy is therefore only one dimension; integration, commercial packaging, channel relationships, security-team workflow and trust after incidents also affect the choice.

Competition is increasingly “coopetition.” A vendor can be both substitute and integration point. CrowdStrike’s 2026 product announcements, for example, describe support for Microsoft Defender data in Falcon security operations rather than requiring every customer to replace it. This limits simplistic winner-take-all comparisons and reinforces that CrowdStrike’s growth case depends on becoming useful across heterogeneous enterprise environments. cross-platform integrations

CrowdStrike’s current growth model has four linked engines: win new customers, expand existing accounts with more modules and endpoints, enter adjacent security and IT workloads, and widen distribution through partners, cloud marketplaces and international channels. AI security adds a fifth overlay because it creates both new threats to defend and new automation inside the security operations center. growth strategy

Recent adoption data support the expansion mechanism without proving that every module is equally durable. At April 30, 2026, CrowdStrike reported 51% of subscription customers with six or more modules, 35% with seven or more and 25% with eight or more. Those figures indicate widening product penetration inside the customer base and explain why management emphasizes platform consolidation rather than endpoint replacement alone.

Management’s June 2026 full-year FY2027 outlook should be treated as guidance, not an achieved result. It called for ending ARR of $6.5317–$6.5555 billion and total revenue of $5.9147–$5.9587 billion for the year ending January 31, 2027. The execution dependencies are clear: sustain partner activity, convert pipeline, retain customers, keep Falcon reliable, integrate acquisitions and maintain technical differentiation while entering markets with entrenched vendors. FY2027 guidance

George Kurtz remains CrowdStrike’s top operating authority as CEO and founder, with Michael Sentonas as President and a broad functional executive team beneath them. Oversight is structurally separate: independent chair Gerhard Watzinger leads the board, which supervises strategy and risk while management is responsible for day-to-day execution. That distinction matters more than title prominence. current executive roster board oversight framework

Kurtz has led the company since the 2011 holding-company formation and previously held senior security roles at McAfee after founding Foundstone. That continuity makes him unusually important to corporate identity; CrowdStrike itself says its future success is substantially dependent on management and key employees and identifies Kurtz as critical to vision and strategic direction. This is a key-person dependency even without founder voting control.

The board structure is designed to counterbalance executive concentration. The 2026 proxy reported an independent chair, 89% independent directors and fully independent audit, compensation and nominating/governance committees. It also makes a clean accountability distinction: management handles day-to-day strategic, operational, legal, compliance, cybersecurity and financial risks, while the board and committees oversee the risk-management framework. The annual meeting on June 17, 2026 approved a charter amendment subsequently filed as effective June 22. governance and risk oversight June 2026 charter filing

CrowdStrike today is best understood as a public, founder-led-in-management but shareholder-controlled cybersecurity platform company. Its competitive promise is that one cloud-native data and sensor architecture can support many security outcomes; its economic promise is recurring expansion on that platform; and its operating obligation is to preserve trust while the scope and automation of Falcon keep increasing. current company model

What Compounds Customer Value?

Shared telemetry lets CrowdStrike add security modules without rebuilding the customer architecture, creating a practical expansion loop when new capabilities solve adjacent problems and integrate into existing workflows.

What Must Remain Credible?

Reliability, detection efficacy and partner execution must stay strong because Falcon sits inside critical environments. The 2024 incident showed that platform scale magnifies operational mistakes as well as security benefits.

What Shapes the Next Phase?

Growth depends on converting Falcon from an endpoint anchor into a broader AI-era security layer across identity, cloud, data and SOC workflows while sustaining customer expansion and disciplined governance.

Synthesis source: platform and economics supports the consolidated business, platform, risk and operating logic summarized here.

The company’s strongest strategic flywheel is also its main concentration risk. More modules can produce more telemetry, deeper workflows and stronger switching costs, but a common architecture means reliability, infrastructure capacity, ecosystem interoperability and trust become more consequential as customers consolidate around it. The same logic explains why leadership is pushing AI, marketplaces and adjacent modules while governance and resilience remain material to the story.

In short, CrowdStrike is no longer just an EDR vendor. It is trying to become a general security operating layer for organizations navigating cloud, identity, data and AI complexity. Whether that expansion remains durable will depend less on adding the next feature than on repeatedly proving that a broader Falcon can deliver measurable security outcomes without compromising the reliability and operational confidence that broad deployment requires.