Cloud-native endpoint + identity security (Falcon EDR/XDR) — AI threat detection on devices
AI exposure 11% — derived from reported segment revenue, not asserted.
Software Stack → Cybersecurity · figures rebased to Q2 FY2027, reported 2026-08-26
Endpoint + identity security (EDR/XDR, the core Falcon modules) leads 3 businesses in this sub-tier that together are 100% of revenue, so Cybersecurity is effectively the whole company rather than one leg of it.
CrowdStrike ($1,470.9M Q2 FY2027, +25.8% YoY). ONE reportable segment at the consolidated level; the split below is the revenue disaggregation, not an ASC 280 segment split — subscription 95.2% ($1,400.3M) and professional services 4.8% ($70.6M), on GAAP gross margin of 74.6%. CrowdStrike does not break subscription down by module, so the division between the core Falcon protection platform and the LogScale / Next-Gen SIEM / Charlotte AI data layer is an Atlas estimate held at the prior ratio. That matters here: the AI-attributable revenue sits in that second group, and it is the one thing…
Moat. Single-agent platform plus the Threat Graph data loop and module land-and-expand (~65% of customers on 5+ modules, 97% gross retention, 115% NRR on $5.5B of ARR). Genuine switching costs — but endpoint is the layer with the shortest displacement cycle in security, and Microsoft, SentinelOne and Palo Alto all attack the same base.
Bottleneck / pricing power. Good pricing power at the platform level — record Q1 FY27 net-new ARR of $256M (+32%) and a 520bp raise to FY27 net-new ARR guidance. The qualifier is Falcon Flex: an all-module drawdown structure that went from zero to $1.69B of ARR in about two years may be trading per-module price for consumption growth.
Role in the AI stack. The cloud-native endpoint + AI-security platform layer.
All 174 companies · What moved this quarter · How the map is built