CrowdStrike Holdings Stock

CrowdStrike Holdings, Inc. (CrowdStrike) provides cloud-delivered protection of endpoints, cloud workloads, identity, and data via a software as a service (SaaS) subscription-based model that spans multiple security markets, including corporate workload security, security and vulnerability management, managed security services, IT operations management, threat intelligence services, identity protection and log management. The company conducts its business in the United States, as well as locations internationally, including in Australia, Germany, India, Israel, Romania, and the United Kingdom.

The company’s pioneering platform approach keeps customers ahead of attackers by automatically detecting and preventing threats to stop breaches. The company’s approach has defined a new category called the Security Cloud, which has the power to transform the cybersecurity industry the same way the cloud has transformed the customer relationship management, human resources, and service management industries. Using cloud-scale AI, its Security Cloud enriches and correlates trillions of cybersecurity events per week with indicators of attack, threat intelligence and enterprise data (including data from across endpoints, workloads, identities, IT assets and configurations) to create actionable information, identify shifts in adversary tactics and automatically detect and prevent threats in real-time across its customer base.

CrowdStrike: The Architectural Purpose Behind the Platform

The company’s Falcon platform was purpose-built in the cloud to harness the power of data to deliver the next generation of automated protection and provide threat hunters with the intelligence required to stop sophisticated attacks, including non-malware based attacks. This approach has made CrowdStrike an industry leader in protection across endpoints, cloud workloads, identity and data (capable of protecting workloads across on-premise, virtualized, and cloud-based environments running on a variety of endpoints, such as desktops, laptops, servers, virtual machines, cloud workloads, cloud containers, mobile, and IoT devices) and enables the company to rapidly scale this best in class protection across new and emerging areas of enterprise risk.

As of January 31, 2023, the company offered 23 cloud modules on its Falcon platform via a SaaS subscription-based model that spans multiple large markets, including corporate workload security, managed security services, security and vulnerability management, IT operations management, identity protection, log management, threat intelligence services, and data protection.

The company’s Falcon platform is composed of tightly integrated, proprietary technologies that enable it to deliver superior protection and performance, while reducing customer complexity. The company’s Falcon platform consists of its easily deployed, intelligent lightweight agent, and its groundbreaking graph technology.

The company’s single, lightweight-agent approach has changed how organizations experience cybersecurity, delivering protection without impacting the user, resources or productivity. With the lightweight agent installed on each endpoint or cloud workload, the company’s Falcon platform automates detection and prevention capabilities in real time across its entire global customer base. This also enables the company’s Falcon platform to intelligently ingest data once and stream high fidelity data back into the Security Cloud to be re-used for multiple use cases, continuously improve its Falcon platform’s AI algorithms and make its real-time decision-making faster and smarter to keep customers ahead of changing adversary tactics.

The company’s graph technology correlates and contextualizes the vast data of its Security Cloud so it can collect data once and reuse it repeatedly to deliver solutions that solve its customers’ biggest problems. The highly advanced graph technologies underpinning the Falcon platform include:

The company’s Threat Graph, which uses a combination of AI and behavioral pattern-matching techniques to correlate and analyze trillions of cybersecurity events, enriched with threat intelligence, and third-party data to identify and link threat activity together to automatically prevent threats in real time across CrowdStrike’s global customer base. This also provides customers with increased visibility of attacks for proactive threat hunting and timely detection and remediation of novel threats.

The company’s Intel Graph, which analyzes and correlates data and threat intelligence to visualize the connections between adversaries and attacks to help customers prioritize investigations and gain a deep understanding of the threat landscape. The latest intel on adversaries, tactics, techniques, and procedures is delivered seamlessly within the CrowdStrike Falcon platform and is mapped to the MITRE ATT&CK framework.

The company’s Asset Graph, which dynamically monitors and tracks the complex interactions among assets, providing a single holistic view of the risks those assets pose. Asset Graph provides graph visualizations of the relationships among all assets, such as devices, users, accounts, applications, cloud workloads and operations technology (OT), along with the rich context necessary for proper security hygiene and proactive security posture management to reduce risk in their organizations — without impacting IT.

The Falcon platform was purpose-built with the foresight that the future of cybersecurity would need to be cloud-native and AI-driven. While AI is revolutionizing many technology fields, including cybersecurity solutions, to be truly effective, algorithms that enable AI depend on the quality and volume of data that trains them and the selection of the right differentiating features from that data.

By analyzing and correlating information across its massive, crowdsourced dataset, the company is able to deploy its AI algorithms at cloud-scale and build a more intelligent, effective solution to detect threats and stop breaches that on-premise, cloud-hosted and hybrid products cannot match due to the inherent architectural limitations those products have with respect to data storage and analysis.

CrowdStrike Falcon Platform: Cloud Modules

The company’s cloud modules integrate seamlessly with the Falcon platform to provide functionality in the endpoint security, security and IT operations (including vulnerability management), and threat intelligence markets. The company’s cloud modules include:

Cloud Security

Falcon Cloud Workload Protection—Cloud Runtime Protection. Falcon Cloud Workload Protection provides comprehensive breach protection at run-time for workloads and containers, as well as detecting vulnerabilities before services and images are deployed. Falcon Cloud Workload Protection reduces the attack surface by automatically detecting vulnerabilities, hidden malware, secrets, keys, and more, enabling customers to build, run, and deploy secure applications with speed and confidence.

Falcon Horizon—Cloud Security Posture Management. Falcon Horizon delivers unified visibility, threat detection, and continuous monitoring and compliance for multi-cloud environments. Falcon Horizon automates the process to detect cloud related misconfigurations, vulnerabilities, and identity-based risks, providing step-by-step remediation and giving developers guardrails to avoid costly mistakes.

Discover for Cloud and Containers—Cloud Service Discovery. Discover for Cloud and Containers delivers comprehensive visibility of cloud assets, security configurations, workloads and containers across multi-cloud environments so customers can mitigate risks and reduce their attack surface.

Endpoint Security and XDR

Falcon Prevent—Next-Generation Antivirus. Falcon Prevent provides next-generation antivirus capabilities to customers, delivering comprehensive protection to defend customers against both malware and fileless attacks.

Falcon Insight XDR—Endpoint Detection and Response. With industry-leading EDR at its core, Falcon Insight XDR synthesizes cross-domain telemetry and activates extended capabilities with one unified, threat-centric command console to unlock cross-domain detections, investigations and responses across the security stack.

Falcon Device Control—Device Control. Falcon Device Control provides administrators with a high degree of visibility and granular control of USB peripheral devices.

Falcon Firewall Management—Host Firewall Management. Falcon Firewall Management provides centralized management of the firewall capabilities native to the host operating system, allowing customers to create, enforce, and maintain host firewall policies.

Security and IT Operations

Falcon Discover—IT Hygiene and IoT. Falcon Discover identifies rogue systems and applications in the company’s customers’ networks, and monitors the use of privileged user accounts anywhere in a customer’s environments. The module also enables use cases outside of security, such as application license management, Amazon Web Services (“AWS”) spend analysis, and asset inventory. New enhancements in Falcon Discover for IoT minimize risk for IoT/OT (Other Technology) devices with comprehensive asset visibility, monitoring, and security hygiene.

Falcon Spotlight—Vulnerability Management. Falcon Spotlight identifies vulnerabilities in real time that exist across the company’s customer endpoints. The module does not depend on scanning systems for vulnerabilities, a process that can often take days or weeks for an enterprise, and instead leverages data already collected by its agent to provide instant and accurate real-time visibility into an enterprise’s vulnerability exposure.

Falcon Forensics—Forensic Data for Analysis of Cybersecurity Incidents. Based on years of incident response experience and forensics investigative services from CrowdStrike’s leading services team, Falcon Forensics streamlines the collection of point-in-time and historic forensic triage data for robust analysis of cybersecurity incidents, threat hunting, as well as enabling responders to quickly identify relevant evidence of an intrusion with preset dashboards, allowing for rapid investigation, triage and remediation.

Falcon FileVantage—File Integrity Monitoring. Falcon FileVantage reduces compliance complexity by building in the services an additional agent would normally provide, including being able to monitor all files on the protected systems. This in turn provides alerts and reports to help meet various compliance requirements imposed by the Payment Card Industry (PCI), the Center for Internet Security (CIS) Controls, and Sarbanes-Oxley.

Managed Services

Falcon Complete—Turnkey Security Solution. Falcon Complete provides comprehensive monitoring, management, response, and remediation solution to its customers and is designed to bring enterprise level security to companies that may lack enterprise level resources. It is backed by an underwritten limited warranty policy for breaches. The company also offers Falcon Cloud Workload Protection Complete, Falcon Identity Threat Protection Complete, and Falcon Complete LogScale as add-ons to its Falcon Complete solution to extend its capabilities to include its cloud workload protection, identity protection, and log management modules.

Falcon OverWatch—Threat Hunting. Falcon OverWatch is a threat hunting solution that consists of an elite team of dedicated security experts who work with the power of Threat Graph to proactively hunt on telemetry collected in the platform around the clock 24/7/365 to identify novel threats and attacks that might otherwise go unnoticed by security teams and the tools they use to monitor and detect advancing new threats in support of the company’s customers.

Threat Intelligence

Falcon Intelligence—Threat Intelligence. Falcon Intelligence integrates threat intelligence into endpoint protection and provides automated analysis of detected threats to provide insight into the capabilities, motivation and attribution of attacks. In addition to the standard Falcon Intelligence offering, the company also offers premium options that include global threat research and reporting from its team of intelligence analysts.

Falcon Search Engine—Malware Search. Falcon Search Engine enables customers to search in real time across over 8 petabytes of malware collected in the company’s Falcon platform and indexed by its proprietary binary data indexing technology.

Falcon Sandbox—Malware Analysis. Falcon Sandbox allows the company’s customers to analyze unknown files for malicious behavior by detonating them safely in virtual machines.

Falcon Intelligence Recon—Situational Awareness. Falcon Intelligence Recon allows the company’s customers to identify and mitigate digital risks on the hidden areas of the clear, deep and dark web. These risks include, but are not limited to, digital fraud, data theft exposure, social media impersonations.

Falcon Surface—External Attack Surface Management. Falcon Surface (previously, Reposify) allows customers to discover and map all internet-facing assets to shut down potential exposures with guided mitigation plans to reduce the attack surface and organizational risk.

Identity Protection

Falcon Identity Threat Protection—Zero Trust Security. Falcon Identity Threat Protection provides frictionless Zero Trust security with real-time threat prevention and IT policy enforcement using identity, behavioral and risk analytics.

Falcon Identity Threat Detection—Identity Threat Detection. Falcon Identity Threat Detection provides visibility for identity-based attacks and anomalies, comparing live traffic against behavior baselines and rules to detect attacks and lateral movement.

Observability

Falcon LogScale—Log Management. Falcon LogScale is a high-performance, index-free cloud log management solution that allows customers to collect logs from any data source and to search and query streaming data in real-time.

Bringing CrowdStrike to the Market

The company primarily sells the Falcon platform through its direct sales team that leverages its network of channel partners to maximize effectiveness and scale. The company has low friction land-and-expand sales strategy. The key elements of the company’s growth strategy include growing its customer base by replacing legacy and other endpoint security products; further penetrating existing customers; leveraging its falcon platform to enter new markets; broadening its reach into new customer segments; broadening its reach into the U.S. public sector verticals; expanding its international footprint; and extending its falcon platform and ecosystem.

Customers

Some of the world’s largest enterprises, government organizations, and high profile brands trust the company to protect their business. As of January 31, 2023, the company had 23,019 subscription customers worldwide. Historically, the company and its channel partners have primarily sold to large organizations, but have increasingly focused on selling to small and medium-sized businesses, particularly through its trial-to-pay model. The company engages its customers through its global customer and technical advisory boards in which it solicits feedback from its customers on a regular basis allowing it to understand their evolving needs. The company has used this feedback to develop new cloud modules, such as Falcon FileVantage, and it intends to continue to develop new cloud modules based on its customer’s feedback.

Sales and Marketing

The company’s sales and marketing organizations work together closely to drive market awareness, build a strong sales pipeline and cultivate customer relationships to drive revenue growth.

Sales

The company primarily sells subscriptions to its Falcon platform and cloud modules through its world-class, global sales team, which consists of field sales and inside sales professionals who are segmented by a customer’s organizational size. The company’s sales team also leverages a powerful go-to-market sales motion with its vast ecosystem of channel and alliances partners. The company also uses its sales team to identify customers who may be interested in free trials of additional cloud modules, which serves as a powerful driver of its land and expand model. By segmenting its sales teams, the company can deploy a low-touch sales model that efficiently identifies prospective customers.

Marketing

The company’s marketing organization focuses on building its brand reputation, increasing the awareness and reputation of its platform, and driving customer demand. As part of these efforts, the company delivers targeted content to demonstrate thought leadership in the security industry, including speaking engagements with the security industry’s foremost organizations to provide expert advice, issuing regular reports on the state of the industry, educating the public about the cybersecurity threats, and identifying and naming adversary groups. The company also engages in paid media, web marketing, industry and trade conferences (including its annual Fal.Con conference), analyst engagements, whitepaper development, demand generation via digital and web, and targeted displacement campaigns. The company employs a wide range of digital programs, including search engine marketing, online and social media initiatives, and content syndication to increase traffic to its website and encourage prospective customers to sign up for a free trial of the Falcon platform. Additionally, the company engages in joint marketing activities with its channel and technology alliance partners.

Partnership Ecosystem

The company works with a number of technology alliance partners to design go-to-market strategies that combine its platform with products or services provided by its technology alliance partners. These partner integrations deliver more secure solutions and an improved end user experience to their customers. The company’s technology alliance partnerships focus on security analytics, network and infrastructure security, threat platforms and orchestration, and automation. The company launched the CrowdStrike Store, the first open cloud-based application PaaS for cybersecurity and the industry’s first unified security cloud ecosystem of trusted third-party applications. In addition, Falcon for AWS, available in the AWS Marketplace, allows customers to purchase and take advantage of the metered billing (pay-as-you-go) pricing option to scale their consumption as their business needs change.

Seasonality

Given the annual budget approval process of many of the company’s customers, it sees seasonal patterns in its business. Net new ARR generation is typically greater in the second half of the year, particularly in the fourth quarter, as compared to the first half of the year (year ended January 31, 2023). In addition, the company experiences seasonality in its operating margin, typically with a lower margin in the first half of its fiscal year due to a step up in costs for payroll taxes, new hires, and annual sales and marketing events. This also impacts the timing of operating cash flow.

History

CrowdStrike Holdings, Inc. was founded in 2011. The company was incorporated in the state of Delaware in 2011.