CrowdStrike Holdings, Inc. CRWD
NasdaqInfrastructure softwareFinancials to Jul 31, 2026 · Updated Oct 9, 2026
Moat ranks
Balance sheet
| $B | Jan 31 | Jul 31 |
|---|---|---|
| Cash | 5.2 | 5.0 |
| Securities | 0.0 | 0.0 |
| Restricted cash | 0.1 | 0.2 |
| Debt | 0.7 | 0.7 |
| Net cash | 4.5 | 4.3 |
| Equity | 4.4 | 5.1 |
- Debt / EBITDA
- 3.74×
- Debt / equity
- 0.15×
- Leases (7/31/26)
- $74M
- Diluted shares
- 1,044M
- Book value / share
- $4.88
- Price / book
- 52.9×
- Net cash / share
- $4.09
- Market cap
- $269.9B
- Enterprise value
- $265.6B
Per-share record
Key indicators
| Indicator | Latest | Vs year ago | Last 8 quarters |
|---|---|---|---|
| Revenue growth | 25.8% | +4.6 pts | |
| Operating margin | -2.3% | +6.8 pts | |
| FCF margin | 25.6% | +1.2 pts | |
| Capex / revenue | 10.5% | +6.4 pts | |
| Annual recurring revenue | $5.8B | +25% | |
| Customers using 6 or more modules | 51.0% | +3.0 pts | |
| Customers using 7 or more modules | 35.0% | +2.0 pts | |
| Customers using 8 or more modules | 26.0% | +3.0 pts | |
| ARR from Falcon Flex accounts | ≥$2.3B | – |
Margins and growth from reported quarters; company KPIs as reported in results releases.
About CRWD
CrowdStrike sells the Falcon cybersecurity platform for endpoints, cloud workloads, identities, data and security operations. Subscriptions supplied about 95% of FY2026 revenue; incident response and other professional services supplied the rest.
- Data Network Effects
Falcon shares attack telemetry across customers, which can improve detection rules and speed the response to new threats.
- Suite Bundling
A common sensor and data model let customers buy more security functions without deploying separate systems.
- Switching Costs General
Replacing Falcon requires new sensors, detection rules and incident-response workflows across deployed endpoints.
- Oct 8, 2026
CrowdStrike joined Anthropic's Critical Infrastructure Defense Program, gaining frontier-model research and engineering support for protecting industrial and public-service systems. Eleven founding partners share the program, including rival security vendors and consultancies; participation has no disclosed paid revenue. Source: https://www.crowdstrike.com/en-us/blog/crowdstrike-anthropic-critical-infrastructure-defense-program/
- Oct 7, 2026
CrowdStrike and CyberCert partnered to link Falcon with SMB security certification in Australia and New Zealand, adding a channel to smaller businesses; customer uptake and paid revenue are not disclosed. Source: https://www.crowdstrike.com/en-us/press-releases/crowdstrike-cybercert-partner-to-advance-cybersecurity-for-smbs-across-australia-and-new-zealand/
- Sep 29, 2026
Falcon became available through the OpenAI Marketplace, letting eligible customers use existing commitments to buy security and easing access to enterprise budgets.
- Sep 15, 2026
CrowdStrike published a high-severity Windows sensor vulnerability affecting Office macro removal and provided fixes. It reported no known exploitation in the wild. Customers must install the fixes, reinforcing the need to test protection and reliability together. Sources: https://www.crowdstrike.com/en-us/security-advisories/cve-2026-40058/ and https://www.cve.org/CVERecord?id=CVE-2026-40058
- Sep 14, 2026
Airline passengers asked the Supreme Court to review dismissal of their outage claims; the October 16 response deadline extends one legal uncertainty. Source: https://www.supremecourt.gov/docket/docketfiles/html/public/26-355.html
Ownership
Go deeper on CRWD
- Compare stock research toolsFundamentals, valuation and screening platforms for CRWD.19 tools
- See CRWD's price chartNo price chart here yet. See price history and indicators.17 tools
- Read CRWD's earnings callsTranscripts and audio of results calls, with management's own words.15 tools
- Investing tool dealsCurrent discounts on research, charting and tracking tools.81 deals
On this page
Financial record
| Fiscal year | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 | 2023 | 2024 | 2025 | 2026 | TTM | Trend | Change 2017–26 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Per share ($) | |||||||||||||
| Revenue | 0.33 | 0.71 | 1.39 | 0.81 | 1.00 | 1.60 | 2.40 | 3.14 | 4.04 | 4.80 | 5.17 | +34.6%/yr | |
| Cash flow | -0.33 | -0.35 | -0.13 | 0.17 | 0.41 | 0.63 | 1.01 | 1.20 | 1.41 | 1.61 | 1.93 | – | |
| Earnings | -0.58 | -0.81 | -0.78 | -0.24 | -0.11 | -0.26 | -0.20 | 0.07 | -0.02 | -0.16 | 0.04 | – | |
| Free cash flow | -0.41 | -0.53 | -0.37 | 0.02 | 0.34 | 0.49 | 0.72 | 0.95 | 1.09 | 1.24 | 1.46 | – | |
| Capex | 0.08 | 0.18 | 0.24 | 0.15 | 0.07 | 0.15 | 0.29 | 0.24 | 0.32 | 0.37 | 0.47 | +18.6%/yr | |
| Dividends | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | 0.00 | – | |
| Book value | -1.53 | -2.21 | -2.72 | 1.25 | 1.00 | 1.13 | 1.57 | 2.36 | 3.35 | 4.42 | 4.88 | – | |
| Diluted shares (M) | 159 | 168 | 179 | 592 | 871 | 909 | 933 | 975 | 979 | 1,002 | 1,044 | +22.7%/yr | |
| Totals ($B) | |||||||||||||
| Revenue | 0.1 | 0.1 | 0.2 | 0.5 | 0.9 | 1.5 | 2.2 | 3.1 | 4.0 | 4.8 | 5.4 | +65.1%/yr | |
| Operating income | -0.1 | -0.1 | -0.1 | -0.1 | -0.1 | -0.1 | -0.2 | -0.0 | -0.1 | -0.3 | -0.1 | – | |
| Net income | -0.1 | -0.1 | -0.1 | -0.1 | -0.1 | -0.2 | -0.2 | 0.1 | -0.0 | -0.2 | 0.0 | – | |
| Free cash flow | -0.1 | -0.1 | -0.1 | 0.0 | 0.3 | 0.4 | 0.7 | 0.9 | 1.1 | 1.2 | 1.5 | – | |
| Buybacks | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | 0.2 | – | |
| Dividends | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | 0.0 | – | |
| Net cash | – | 0.0 | 0.2 | 0.9 | 1.2 | 1.3 | 2.0 | 2.7 | 3.6 | 4.5 | 4.3 | – | |
| Margins & returns (%) | |||||||||||||
| Gross margin | 35.5 | 54.1 | 65.1 | 70.6 | 73.7 | 73.6 | 73.2 | 75.2 | 75.0 | 74.7 | 75.2 | +39.1 pts | |
| Operating margin | -171.7 | -110.7 | -54.8 | -30.3 | -10.6 | -9.8 | -8.5 | -0.6 | -2.9 | -6.1 | -2.5 | +165.6 pts | |
| Net margin | -173.2 | -114.1 | -56.1 | -29.5 | -10.6 | -16.2 | -8.2 | 2.4 | -0.4 | -3.4 | 0.8 | +169.8 pts | |
| FCF margin | -122.6 | -74.5 | -26.3 | 2.6 | 33.5 | 30.4 | 30.1 | 30.4 | 27.0 | 25.8 | 28.2 | +148.4 pts | |
| ROIC | – | – | – | – | – | – | – | – | – | – | -10.6 | – | – |
| Return on equity | – | – | – | -19.1 | -10.6 | -22.9 | -12.5 | 3.1 | -0.5 | -3.7 | 0.9 | – | |
| R&D % of revenue | 74.2 | 49.6 | 33.8 | 27.0 | 24.5 | 25.6 | 27.1 | 25.5 | 27.2 | 28.8 | 29.0 | -45.4 pts | |
| Stock pay % of revenue | 3.8 | 10.4 | 8.2 | 16.6 | 17.1 | 21.4 | 23.5 | 21.2 | 21.8 | 22.8 | 23.1 | +19.0 pts | |
| Capex % of revenue | 24.0 | 25.1 | 17.1 | 18.2 | 7.3 | 9.2 | 11.9 | 7.8 | 7.9 | 7.7 | 9.2 | -16.3 pts | |
Change uses 2017 and 2026 only: compound annual growth for amounts, points for margins and returns, and the change in amount for net cash. A dash means no 2017 base. Trend shows the fiscal years.
Moat
Moat scorecard
- Strength
- Confidence
- Structure
- Competitive
- Durability
- medium
- Trajectory
- stable
- Pricing power
- moderate
- Falcon Platform Subscriptions94.9%3 claims
- Professional Services (Incident Response & Proactive Services)5.1%No moat
Moat claims
- Applies to
- Falcon Platform Subscriptions
- Confidence
- Durability
- medium
- Trajectory
- stableas of Jul 31, 2026
Falcon shares attack telemetry across customers, which can improve detection rules and speed the response to new threats. The FY2026 filing describes trillions of events each week. This is a plausible learning advantage, but public data does not isolate the benefit of additional data from product design and analyst work; Microsoft also has a large telemetry base.
July 2026 ARR reached $5.84 billion, expanding the customer footprint, but public evidence does not isolate a rising detection advantage from additional telemetry.
- Annual recurring revenue$5.8B+25%
- Daily security events processed≥4,000.00B
- Modern endpoint security market share17.7%
- Competitors with huge footprints (notably Microsoft) can generate comparable telemetry
- Privacy/regulatory changes reduce data collection or sharing
- Model commoditization reduces incremental advantage from more data
- Applies to
- Falcon Platform Subscriptions
- Confidence
- Durability
- medium
- Trajectory
- wideningas of Jul 31, 2026
A common sensor and data model let customers buy more security functions without deploying separate systems. ARR reached $5.84 billion in July 2026, with 51% of subscription customers using at least six modules and 26% using at least eight. Flexible purchasing helps consolidation, although more modules can reflect discounts as well as useful products.
Eight-or-more-module adoption rose from 21% in January 2025 to 26% in July 2026, while ARR from Falcon Flex accounts exceeded $2.29 billion.
- Annual recurring revenue$5.8B+25%
- Dollar-based net retention115.0%+3.0 pts
- Customers using 6 or more modules51.0%+3.0 pts
- Customers using 7 or more modules35.0%+2.0 pts
- Customers using 8 or more modules26.0%+3.0 pts
- ARR from Falcon Flex accounts≥$2.3B
- Net new annual recurring revenue~$333M+51%
- Falcon Flex customers≥2,900
- Customers making another Falcon Flex commitment≥630
- Hyperscaler bundling (especially Microsoft security) pressures consolidation decisions
- Customers prefer best-of-breed point solutions for specific controls
- Trust shocks from major incidents increase willingness to re-platform
- NewsCrowdStrike introduces an identity provider for AI agentsSep 2, 2026
- FilingCrowdStrike Form 10-K (FY ended Jan 31, 2026) - module breadthMar 5, 2026
- FilingCrowdStrike Form 10-K (FY ended Jan 31, 2026) - Dollar-based net retentionMar 5, 2026
- NewsCrowdStrike Q1 FY2027 results release - ARR and module adoptionJun 3, 2026
- Applies to
- Falcon Platform Subscriptions
- Confidence
- Durability
- medium
- Trajectory
- stableas of Jul 31, 2026
Replacing Falcon requires new sensors, detection rules and incident-response workflows across deployed endpoints. Net retention rose from 112% in January 2025 to 115% in January 2026, and the July 2026 filing reports further sequential improvement. The 2024 outage still exposes limits to that protection: customers can leave or demand incentives when reliability fails.
Annual net retention recovered from 112% to 115% and improved again by July 2026, while the filing still warns that outage incentives and delayed renewals can weaken retention.
- Annual recurring revenue$5.8B+25%
- Dollar-based net retention115.0%+3.0 pts
- Customers using 6 or more modules51.0%+3.0 pts
- Customers using 7 or more modules35.0%+2.0 pts
- Customers using 8 or more modules26.0%+3.0 pts
- Net new annual recurring revenue~$333M+51%
- Gross retention97.0%
- Falcon Flex customers≥2,900
- Customers making another Falcon Flex commitment≥630
- Standard telemetry formats reduce migration friction
- Customers multi-home agents/tools, reducing dependence on a single vendor
- Reliability incidents lower tolerance for switching friction
Profile change log
- Oct 9, 2026 · analyst revision
The customer-retention evidence now includes the proxy's 97% gross retention in all four FY2026 quarters, quarterly net-retention history, and more than 630 customers making another Falcon Flex commitment. The debate and both end markets identify shared access to frontier AI as a competitive limit. Moat strengths and the professional-services assessment are unchanged.
- Oct 9, 2026 · business change
CrowdStrike joined Anthropic's Critical Infrastructure Defense Program, gaining frontier-model research and engineering support for protecting industrial and public-service systems. Eleven founding partners share the program, including rival security vendors and consultancies; participation has no disclosed paid revenue. Source: https://www.crowdstrike.com/en-us/blog/crowdstrike-anthropic-critical-infrastructure-defense-program/
- Oct 8, 2026 · business change
CrowdStrike and CyberCert partnered to link Falcon with SMB security certification in Australia and New Zealand, adding a channel to smaller businesses; customer uptake and paid revenue are not disclosed. Source: https://www.crowdstrike.com/en-us/press-releases/crowdstrike-cybercert-partner-to-advance-cybersecurity-for-smbs-across-australia-and-new-zealand/
- Oct 8, 2026 · analyst revision
The incident-response market lists PwC once, after removing a duplicate entry; the competitive assessment and services moat status are unchanged.
- Oct 8, 2026 · analyst revision
The Seraphic remeasurement gain is corrected from after-tax to non-operating because it is reported before tax; the $15.5 million parent-attributable amount and unknown tax effect are stated separately. The profit debate now also identifies Q2 outage-cost recoveries.
- Oct 8, 2026 · analyst revision
FY2022 tax restructuring changes from the rounded $57.2 million to the reported $57.236 million. The $49.883 million FY2025 foreign-transaction tax charge now covers the full fiscal year because its annual source does not report a quarterly allocation. The currency assessment now reflects the July 2026 cost hedges.
- Oct 8, 2026 · business change
Airline passengers asked the Supreme Court to review dismissal of their outage claims; the October 16 response deadline extends one legal uncertainty. Source: https://www.supremecourt.gov/docket/docketfiles/html/public/26-355.html
- Oct 8, 2026 · business change
CrowdStrike completed its purchase of XM Cyber technology assets, adding attack-path and exposure-management technology and issuing 2,118,022 shares. Source: https://www.sec.gov/Archives/edgar/data/1535527/000110465926107123/tm2625079-1_s3asr.htm
- Oct 8, 2026 · business change
DOJ prosecutors closed the customer-deal accounting probe without further action, according to Bloomberg reporting on September 25. The SEC outcome was unknown, and this does not settle outage litigation. Source: https://ca.finance.yahoo.com/news/us-justice-department-closes-investigation-171512426.html
- Oct 8, 2026 · business change
The Fifth Circuit denied rehearing of the airline-passenger outage case, leaving dismissal in place at that court. Source: https://www.sec.gov/Archives/edgar/data/1535527/000153552726000031/crwd-20260731.htm
- Oct 8, 2026 · analyst revision
The incident-response leader list adds PwC from the same IDC worldwide study. Its customer feedback shows the benefit of installed Falcon telemetry and the risk of delayed final reports; the existing services moat assessment is unchanged.
- Oct 8, 2026 · analyst revision
The May 20 ruling is corrected from securities litigation to airline-passenger claims. The current legal debate now includes the September Supreme Court petition and separates reported DOJ customer-deal closure from unresolved SEC and outage matters.
- Oct 8, 2026 · business change
CrowdStrike introduced an identity provider for AI agents, extending Falcon into registration and short-lived authorization of autonomous software identities.
- Oct 8, 2026 · business change
Falcon became available through the OpenAI Marketplace, letting eligible customers use existing commitments to buy security and easing access to enterprise budgets.
- Oct 8, 2026 · business change
CrowdStrike reported $5.84 billion of ARR and raised FY2027 net new ARR growth guidance to 34% at the midpoint, supporting a wider suite-adoption trajectory.
- Oct 8, 2026 · business change
CrowdStrike effected a four-for-one stock split, changing per-share presentation without changing business earnings.
- Oct 8, 2026 · business change
The Fifth Circuit affirmed dismissal of airline passengers' outage claims, reducing one route for customer-related damages. This ruling concerns passengers, rather than the separate securities litigation. Source: https://www.sec.gov/Archives/edgar/data/1535527/000153552726000031/crwd-20260731.htm
- Oct 8, 2026 · business change
CrowdStrike raised its share-repurchase authorization by $500 million to $1.5 billion, allowing more cash to offset dilution or return to shareholders.
- Oct 8, 2026 · business change
CrowdStrike bought SGNL for $627.9 million cash net of acquired cash plus replacement awards, adding continuous authorization for human and AI identities.
- Oct 8, 2026 · business change
CrowdStrike bought the remaining 90.6% of Seraphic for $327.5 million cash net of acquired cash plus replacement awards, adding browser runtime protection and creating a $15.5 million gain attributable to CrowdStrike.
- Oct 8, 2026 · business change
CrowdStrike announced a workforce plan affecting about 500 roles; final FY2026 charges were $44.8 million, adding near-term cost to its efficiency effort.
- Oct 8, 2026 · business change
A faulty Falcon content update crashed customer Windows systems, damaging trust and causing concessions, litigation and remediation costs.
- Oct 8, 2026 · analyst revision
Three moat trajectories, operating-KPI histories, management, investor debate and two sourced end-market profiles now explain adoption, competition, macro sensitivity and reported-profit distortions.
- Oct 8, 2026 · analyst revision
Telemetry claim strength falls from 5 to 3, confidence from 4 to 3 and durability from durable to medium because public scale evidence does not establish a dominant detection advantage. Professional services are now verified as having no separate moat, based on hourly competition, current service economics and several IDC worldwide leaders.
- Oct 8, 2026 · analyst revision
Subscription and services weights now use FY2026 revenue instead of one quarter. The old 17.7% endpoint share is shown only as a dated KPI; it does not cover the entire Falcon suite. Industry, sector and profile timestamps stay unchanged.
- Oct 8, 2026 · business change
CrowdStrike published a high-severity Windows sensor vulnerability affecting Office macro removal and provided fixes. It reported no known exploitation in the wild. Customers must install the fixes, reinforcing the need to test protection and reliability together. Sources: https://www.crowdstrike.com/en-us/security-advisories/cve-2026-40058/ and https://www.cve.org/CVERecord?id=CVE-2026-40058
- Oct 8, 2026 · business change
CrowdStrike appointed former Splunk Security product chief AJ Shipley as Chief Product Officer, putting product expansion and AI security under new leadership. Source: https://www.crowdstrike.com/en-us/press-releases/crowdstrike-appoints-aj-shipley-as-chief-product-officer/
- Oct 8, 2026 · analyst revision
The telemetry claim now cites the October daily-event evidence alongside the annual filing. The security-software market and investor debate add the patched September Windows sensor flaw; the existing moat strengths, services assessment and profile timestamps are unchanged.
- Oct 8, 2026 · analyst revision
FY2025 first-through-third-quarter gross profit, operating income and parent earnings are restored from the revised annual-report quarterly table. Pretax income uses consolidated earnings plus reported tax. The $0.466 million FY2026 third-quarter workforce charge stays in collection notes because it is too small for a separate profit adjustment.
Industry & peers
Peer map
Hover a point for its values; click a peer to compare. Dashed lines: industry medians.
Global security software
Worldwide spending on security software for enterprises and consumers, including endpoint, identity, cloud, application and data protection and security analytics. Excludes network-security hardware and separate consulting or incident-response services; this is broader than Falcon's enterprise platform.
- Microsoft
- Cisco
- CrowdStrike
- Okta
| Stocks | Moat | Gross m. | Op. m. | |
|---|---|---|---|---|
| CRWD | 68 | 75.2% | -2.5% | |
| Industry median | 7 | 84 | 67.9% | 32.1% |
| Sector median | 77 | 75 | 64.9% | 23.6% |
| All stocks median | 398 | 76 | 52.9% | 19.6% |
Moat medians cover every stock. Margin medians count only stocks with collected numbers and need at least three.
Drivers & risks
- More cloud workloads, remote access and AI agents expand the assets and identities that need protection.
- Faster attacks and board-level responsibility support recurring security budgets even when other technology spending slows.
- Customers seek fewer consoles and better shared incident context, supporting suite consolidation and cross-selling.
- Regulation and sovereign hosting requirements can increase demand for documented controls and local delivery.
- Microsoft and other large platforms can bundle security into broader commitments, reducing stand-alone pricing and sales opportunities.
- High rates, weak growth and constrained IT headcount can delay new projects and encourage discounts, despite recurring renewal demand.
- Cloud processing, storage and specialist wages raise costs; rapid telemetry growth can require capex and long-term infrastructure commitments.
- Product failures and privacy rules can weaken trust, restrict data sharing and create liability or re-engineering costs.
- AI brings demand but also faster feature imitation and more capable attackers. Rival vendors share access to frontier models, so a durable advantage needs better security outcomes, deployment and customer context.
Bulls & bears
Can Falcon turn broader customer adoption into durable operating profit while keeping customer trust and avoiding reliance on discounts or accounting changes?
Arguments
What to watch
- 1Net new ARR, dollar-based net retention and renewal incentives
- 2Adoption of six and eight modules, and ARR from Falcon Flex accounts
- 3GAAP operating income, stock compensation, capex and outage-related costs
Next check: The airline-passenger Supreme Court petition has a response due October 16, 2026. At Q3 FY2027 results for the quarter ending October 31, watch retention, commission expense, Delta litigation and the SEC inquiry. The results date is not confirmed.
Sources: company filings and dated sources collected for Find My Moat; market cap as of Oct 8, 2026. Not investment advice.
Free to reuse, commercially too, with a credit link. See the data license.
Moat Score 68/100 by <a href="https://www.findmymoat.com/stocks/XNAS:CRWD">Find My Moat</a> (as of September 2026)Request update
Spot something outdated? Send a quick note and source so we can refresh this profile.
Curation & Accuracy
This directory blends AI‑assisted discovery with human curation. Entries are reviewed, edited, and organized with the goal of expanding coverage and sharpening quality over time. Your feedback helps steer improvements (because no single human can capture everything all at once).
Details change. Pricing, features, and availability may be incomplete or out of date. Treat listings as a starting point and verify on the provider’s site before making decisions. If you spot an error or a gap, send a quick note and I’ll adjust.