What happened with CRWD today?
No read yet
Uses news and trading volume to explain the day’s move and how it relates to the market.
Stop guessing. Get the call, a three-month target price, the best and worst cases, and a source for every claim.
CrowdStrike Holdings helps organizations detect, investigate and stop cyberattacks. Its Falcon platform combines lightweight software installed on customers’ devices with its cloud-based Security Cloud. Data collected by that software supports multiple security functions, so customers can add Falcon modules without installing another sensor for each function.
Subscriptions supply nearly all revenue. Customers pay for the endpoints—devices or computing systems—covered and the modules they select, with billing generally at the start of the subscription term. CrowdStrike grows accounts by extending coverage and selling additional modules, often after free trials. It also charges for incident response and other professional services, which can lead to subscription sales. Most Falcon sales flow through channel partners, although the business does not depend on any particular end customer.
The business depends on customers renewing and expanding their subscriptions and on partners continuing to sell and deploy Falcon. Platform delivery also relies heavily on Amazon Web Services infrastructure. A faulty Falcon update in 2024 caused crashes on some Windows systems and led some customers to defer purchases, end contracts or decline renewals. Privacy and cross-border data rules constrain data handling, while export controls and sanctions restrict whom CrowdStrike can serve.
The risk section is the longest, dullest part of the filing. This keeps only what can really hurt you: where it hits, how hard, when it plays out.
Every company claims an edge. Each one is checked against hard numbers like margins and returns: which hold, and which line gives way first.
SentinelOne competes directly with CrowdStrike for organizations’ subscriptions to endpoint protection, cloud security and security operations through Singularity versus Falcon. Watch customer adoption of Singularity’s broader tiers, which extend beyond basic endpoint protection.
Palo Alto Networks challenges CrowdStrike’s effort to bring enterprise endpoint, cloud and security-operations spending onto one platform. Watch its success in replacing customers’ separate security tools with integrated platforms—the same consolidation opportunity Falcon pursues.
Microsoft competes for CrowdStrike’s security customers: Defender rivals Falcon in endpoint protection, while Sentinel rivals tools that collect and analyze security events, including Next-Gen SIEM. Security is only part of Microsoft’s business, so its company-wide results are not a direct read on this rivalry.
Zscaler and CrowdStrike both depend on enterprises buying cloud-delivered security subscriptions, but Zscaler mainly secures application access while CrowdStrike protects endpoints and workloads. Zscaler’s subscription growth offers another read on enterprise cloud-security demand.
Fortinet competes with CrowdStrike for enterprise security accounts, including tools that use AI to detect and respond to threats, although its focus is more on network security. Watch adoption of AI-driven security operations within its Security Fabric rather than treating all network-security sales as overlap with Falcon.
Elastic N.V. competes with CrowdStrike for subscriptions that analyze security data and detect threats, including security information and event management, or SIEM. Watch customers expanding their use of Elastic Security, not just growth across Elastic’s search and observability offerings.
Rapid7’s Command Platform competes with CrowdStrike for enterprise security teams buying tools to find weaknesses, detect threats and respond to attacks. Watch adoption of Command’s combined exposure-management, detection and response capabilities, where the platforms overlap.
Tenable Holdings, Inc. competes with CrowdStrike to help enterprises find and prioritize weaknesses across endpoints, cloud assets and identity systems. Watch adoption of Tenable One’s combined vulnerability coverage and guidance on which attack paths to address first.
Qualys, Inc. competes with CrowdStrike for enterprise spending on seeing what assets they have, managing vulnerabilities, detecting threats and securing the cloud. Customers adding Qualys Cloud Apps are worth watching because Falcon also grows by selling more modules to existing customers.
Cisco competes for CrowdStrike’s endpoint-protection customers and, through Splunk, for customers buying security-data analytics. Splunk’s tools for collecting and analyzing security events compete with CrowdStrike’s Next-Gen SIEM.
Check Point Software Technologies competes for customers buying CrowdStrike’s endpoint and workload protection: Harmony protects endpoints, while CloudGuard provides cloud security.
Okta and CrowdStrike both depend on enterprise identity-security investment: Okta checks who can sign in and what they can access, while CrowdStrike protects endpoints and detects identity threats. Watch existing customers adding users and products to Okta subscriptions, while distinguishing workforce changes from additional security purchases.
Netskope, Inc. and CrowdStrike both sell subscriptions to organizations upgrading their defenses, with Netskope supplying cloud security and networking and CrowdStrike protecting endpoints and workloads. Netskope One subscription revenue offers another view of spending on cloud-delivered threat protection.
Palo Alto Networks, Inc. earningsPANW
Palo Alto Networks' report will show whether enterprises are consolidating separate security tools onto a platform, competing for spending CrowdStrike also seeks.
Look at Palo Alto Networks' disclosures on customer adoption of its platform and its account of customers bringing separate security tools together. Broader adoption would suggest it may be taking more of the security budgets CrowdStrike is also pursuing; weaker progress would point to less pressure from this particular platform-consolidation effort, not prove that CrowdStrike is winning customers.
CrowdStrike Holdings, Inc. earningsThis company
CrowdStrike's report will show whether existing customers adding endpoints and modules are still outweighing subscription losses and reductions.
Read net new ARR alongside dollar-based net retention. ARR is the annualized value of subscription contracts; net new ARR measures additions, while dollar-based net retention tracks how much subscription value remains from customers who were already subscribed a year earlier, after expansion, reductions and churn. Strength in both would show existing customers are adding more than they take away; weaker retention or lower net new ARR would show that expansion is losing force, even if current revenue still reflects contracts signed earlier.
SentinelOne, Inc. earningsS
SentinelOne's report will show whether customers are adopting broader security offerings that compete directly with CrowdStrike's Falcon subscriptions.
Read SentinelOne's disclosures about adoption of broader tiers alongside its subscription or customer growth. Broader-tier adoption with stronger subscription growth would suggest it is gaining traction in areas that overlap with Falcon, raising competition for similar customers; weaker adoption would show less momentum from this direct rival, not establish that CrowdStrike's own demand has improved.
