CrowdStrike installs a lightweight monitoring program on company computers and servers, catches hackers breaking in and blocks them in real time using cloud AI, and charges companies a monthly subscription fee for that protection.
How CrowdStrike makes money
Customer companies install CrowdStrike's Falcon sensor — a lightweight monitoring program — on their computers and servers. That sensor feeds data to CrowdStrike's cloud AI, which detects and blocks intrusions in real time. A successful block builds trust, which drives customers to add more Falcon modules over time — a "land and expand" loop reflected in a 115% net revenue retention rate.
Professional services are also sold separately to breached customers, and often double as a sales channel for new subscriptions. Source: 10-K FY2026, p.61, p.64.
Where the revenue comes from
| Type | Revenue | Share | Gross margin |
|---|---|---|---|
| Subscription | $4.56B | 94.9% | 77.7% |
| Professional services | $0.25B | 5.1% | 17.9% |
| Total | $4.81B | 100% | 74.7% |
Source: 10-K FY2026, p.64.
Regionally: US 67%, EMEA 16%, Asia-Pacific 10%, other 7%. International revenue (33%) exposes results to currency swings.
Source: 10-K FY2026, p.112.
Customers and competitors
A B2B subscription business sold to companies and governments worldwide. No single customer or channel partner has exceeded 10% of revenue or receivables in any of the past three fiscal years — customer concentration risk is low.
- Microsoft — can bundle its Defender security feature into existing Office 365 contracts at low incremental cost, a structural pricing advantage.
- Palo Alto Networks — competes directly through an integrated security platform.
- SentinelOne — smaller in scale, using a similar cloud-endpoint-security approach.
Note: CrowdStrike's 10-K doesn't name competitors directly, describing them only by category. Source: 10-K FY2026, p.26, p.87.
The metric that matters most in this sector
Annual Recurring Revenue (ARR) shows how much subscription revenue is already locked in on an annualized basis, ahead of when it's recognized as GAAP revenue. Net Revenue Retention (NRR) shows how much more existing customers are spending year over year, even after accounting for churn — the clearest signal of whether the business grows on its own, without new customers.
| FY2022 | FY2023 | FY2024 | FY2025 | FY2026 | |
|---|---|---|---|---|---|
| ARR | $1.73B | $2.56B | $3.44B | $4.24B | $5.25B |
| NRR | 123.9% | 125% | 119% | 112% | 115% |
NRR declined steadily from a 125% peak to 112%, then ticked back up to 115% — a trend worth watching for continued recovery.
Source: 10-K FY2022 p.57, FY2024 p.60-61, FY2026 p.61-62.
Leadership and ownership
CEO George Kurtz is the co-founder and has led the company since its 2011 founding (about 15 years) — a security-industry veteran who previously founded Foundstone (sold to McAfee in 2004) and served as McAfee's CTO. The founder still actively runs the company. Officers and directors together hold 1.67% of shares (as of April 3, 2026); the largest 5%-plus holders are institutional — Vanguard (7.27%) and BlackRock (6.70%).
Source: DEF 14A 2026.
Capital returns
No dividend — a growth-investment-first company. The board approved a $1 billion buyback program in June 2025, but only about $50.6 million (144,000 shares) had actually been repurchased as of March 4, 2026 — $949 million remains unused.
Source: 10-K FY2026, p.100, p.83.
How this company could fail
- The July 19, 2024 outage (the "July 19 Incident") — a software update error caused widespread Windows system outages worldwide. Related securities and class-action lawsuits, plus DOJ and SEC investigations, remain ongoing and could bring further costs and customer attrition.
- Microsoft-driven price competition — Microsoft can bundle Defender into existing Office 365 contracts at low incremental cost, a structural pricing disadvantage for CrowdStrike, while Palo Alto Networks and others accelerate competition through integrated platforms.
- Earnings quality — the company has posted a GAAP operating loss for five straight years, driven by heavy stock-based compensation, while NRR has also declined from the 124-125% range to 112-115%. Whether growth quality is holding up needs continued monitoring.
Source: 10-K FY2026, risk factors and legal proceedings sections.
Five-year financials
| FY2022 | FY2023 | FY2024 | FY2025 | FY2026 | |
|---|---|---|---|---|---|
| Revenue | 1,452 | 2,241 | 3,056 | 3,954 | 4,812 |
| YoY growth | — | +54% | +36% | +29% | +22% |
| Operating income | -143 | -190 | -19 | -116 | -293 |
| Free cash flow | 442 | 677 | 940 | 1,068 | 1,242 |
| Net cash (cash − debt) | 1,257 | 1,714 | 2,633 | 3,579 | 4,485 |
Source: 10-K FY2024 p.79, p.82; 10-K FY2026 p.64, p.83, p.81; 10-K FY2022 p.74.
What we still don't know
- The final cost (settlements, fines) of July 19 incident-related lawsuits and DOJ/SEC investigations isn't knowable from this data — future 10-Qs are the place to check.
- The most recent FY2027 (Feb 2026 onward) results and company guidance aren't in this 10-K — check the latest earnings call.
- Product/module-level revenue breakdown (endpoint, cloud security, identity protection, etc.) isn't disclosed, since the company reports as a single segment.
Frequently asked questions
How does CrowdStrike make money?
CrowdStrike installs a lightweight monitoring program (the Falcon sensor) on company computers and servers, catches hackers breaking in and blocks them in real time using cloud AI, and charges companies a monthly subscription fee for that protection.
What is CrowdStrike's market cap?
As of this article's data, CrowdStrike's market cap was about $193.8B, on FY2026 revenue of $4.81B.
What is net revenue retention and why does it matter for CrowdStrike?
Net revenue retention (115% here) measures how much more existing customers spend year over year, even after accounting for churn — it's the clearest signal of whether CrowdStrike's business grows on its own, without needing new customers.