CrowdStrike (CRWD)

Cloud-native endpoint + identity security (Falcon EDR/XDR) — AI threat detection on devices

AI exposure 11% — derived from reported segment revenue, not asserted.

Where it sits

Software Stack → Cybersecurity · figures rebased to Q2 FY2027, reported 2026-08-26

Endpoint + identity security (EDR/XDR, the core Falcon modules) leads 3 businesses in this sub-tier that together are 100% of revenue, so Cybersecurity is effectively the whole company rather than one leg of it.

Reported segments

• Subscription — 95.2% of revenue
• Professional Services — 4.8% of revenue

CrowdStrike ($1,470.9M Q2 FY2027, +25.8% YoY). ONE reportable segment at the consolidated level; the split below is the revenue disaggregation, not an ASC 280 segment split — subscription 95.2% ($1,400.3M) and professional services 4.8% ($70.6M), on GAAP gross margin of 74.6%. CrowdStrike does not break subscription down by module, so the division between the core Falcon protection platform and the LogScale / Next-Gen SIEM / Charlotte AI data layer is an Atlas estimate held at the prior ratio. That matters here: the AI-attributable revenue sits in that second group, and it is the one thing…

How the 11% is built

• Subscription — 95.2% of revenue × 12% AI-driven (disclosed). Security spend is driven by threat and compliance, not by AI adoption. The AI-attributable slice is Charlotte AI and the Next-Gen SIEM analytics layer, sold into an installed base that would buy endpoint protection regardless
• Professional Services — 4.8% of revenue × 0% AI-driven (disclosed). Incident response and proactive assessments — human consulting hours with no AI-driven demand

Investment read

Moat. Single-agent platform plus the Threat Graph data loop and module land-and-expand (~65% of customers on 5+ modules, 97% gross retention, 115% NRR on $5.5B of ARR). Genuine switching costs — but endpoint is the layer with the shortest displacement cycle in security, and Microsoft, SentinelOne and Palo Alto all attack the same base.

Bottleneck / pricing power. Good pricing power at the platform level — record Q1 FY27 net-new ARR of $256M (+32%) and a 520bp raise to FY27 net-new ARR guidance. The qualifier is Falcon Flex: an all-module drawdown structure that went from zero to $1.69B of ARR in about two years may be trading per-module price for consumption growth.

Role in the AI stack. The cloud-native endpoint + AI-security platform layer.

Connected companies

• Palo Alto Networks (PANW) — CRWD competes with: Endpoint/XDR + platform consolidation — CRWD Falcon vs PANW Cortex XSIAM
• Fortinet (FTNT) — CRWD competes with: Falcon vs FortiEDR/FortiXDR overlap in endpoint, but Fortinet is a small EDR player vs CrowdStrike's leadership — marginal rivalry
• Cisco Systems (CSCO) — CRWD competes with: overlap mainly in SIEM/XDR (Splunk vs Falcon Next-Gen SIEM); Cisco is not an endpoint rival to CrowdStrike
• Microsoft (MSFT) — CRWD supplies: Falcon sold through Microsoft Marketplace / Azure commit spend - channel partner and Defender competitor rather than a Microsoft vendor
• Akamai Technologies (AKAM) — CRWD is supplied by: CrowdStrike moved its web security and content delivery to Akamai — disclosed by Akamai management on the Q2 2026 earnings call (Aug 6, 2026) as a named competitive win. Grading as industry-known…
• Alphabet (GOOGL) — CRWD is supplied by: Named as a supplier in CRWD's value chain: CrowdStrike runs Falcon platform workloads on Google Cloud infrastructure
• Zscaler (ZS) — CRWD competes with: Zero-trust integration linking CrowdStrike endpoint telemetry to Zscaler's access engine, extended in 2024 to Falcon Next-Gen SIEM and Risk360
• Okta (OKTA) — CRWD competes with: CrowdStrike endpoint signals feed Okta Identity Threat Protection through the Shared Signals Framework, a jointly documented integration

Others in Cybersecurity

• Palo Alto Networks (PANW)
• Fortinet (FTNT)
• Zscaler (ZS)
• Akamai Technologies (AKAM)
• Okta (OKTA)

All 176 companies · What moved this quarter · How the map is built