CrowdStrike Holdings, Inc. (CRWD): Business Model Canvas [Dec-2025 Updated]

You're digging into the core engine of CrowdStrike Holdings, Inc., and what you find is a subscription-driven powerhouse built on platform consolidation. Honestly, this isn't just another security vendor; it's a masterclass in sticky recurring revenue, pulling in $3.76 billion in subscription sales for fiscal year 2025 alone. Their model thrives on customer trust, evidenced by a 97% gross retention rate, which means they are incredibly effective at keeping and expanding their base. This success is fueled by continuous AI innovation on the Falcon platform and deep alliances, like being named Amazon Web Services Global Security Partner of the Year. Here's the quick math: it's a platform play that's winning on speed and consolidation.

CrowdStrike Holdings, Inc. (CRWD) - Canvas Business Model: Key Partnerships

You're looking at how CrowdStrike Holdings, Inc. (CRWD) builds scale and trust through its external relationships, which is critical for a platform-centric security model. These alliances aren't just marketing fluff; they translate directly into revenue and market penetration, especially as AI adoption accelerates.

Amazon Web Services (AWS)

The relationship with Amazon Web Services (AWS) is clearly a cornerstone, moving well beyond standard co-selling. CrowdStrike was recognized as the AWS 2025 Global Security Partner of the Year and the Global Marketplace Partner of the Year at AWS re:Invent 2025. This deep integration is paying off financially; in 2025, CrowdStrike became the first cloud-native cybersecurity Independent Software Vendor (ISV) to surpass $1 billion in AWS Marketplace sales within a single calendar year. To be fair, Amazon uses CrowdStrike technology to secure its own infrastructure, which is a powerful proof point for any customer.

The strategic depth is evident in product placement, too. Earlier in 2025, the companies announced that Falcon Go, CrowdStrike's AI-powered security offering, would be included in every Amazon Business Prime subscription.

Here's a quick look at the financial impact of the Marketplace success:

Global System Integrators

For large-scale enterprise deployments and complex digital transformations, the major Global System Integrators (GSIs) are essential for driving adoption and implementation services. Ernst & Young LLP (EY US) received the Global System Integrator of the Year award at the 2025 Americas Partner Awards. Accenture was named Partner of the Year, and Deloitte secured the Canada Partner of the Year award in the same 2025 recognition cycle. These firms help customers consolidate their security spend onto the Falcon platform.

The key GSI partners recognized in the 2025 Americas Partner Awards include:

• Accenture: Partner of the Year
• Ernst & Young LLP (EY US): Global System Integrator of the Year
• Deloitte: Canada Partner of the Year

Strategic Technology Alliances

CrowdStrike is aggressively embedding its platform across the technology stack, particularly to secure the emerging AI workloads. The collaboration with NVIDIA is focused on securing the entire AI lifecycle, including Large Language Models (LLMs) and Enterprise AI Factories, from build to runtime. CrowdStrike also announced innovations with Intel, focusing on protecting data at the source using Intel NPU technology. Google Cloud was recognized as the Breakout Partner of the Year in the 2025 Americas Partner Awards.

The focus on AI security drives these alliances:

• NVIDIA: Securing the full AI lifecycle for LLMs and Enterprise AI Factories
• Google Cloud: Recognized as Breakout Partner of the Year in 2025
• Intel: Protecting data at the source with Falcon Data Protection on Intel NPU technology

Managed Security Service Providers (MSSPs)

MSSPs are critical for delivering managed detection and response (MDR) services, often leveraging CrowdStrike's Falcon Complete offering. This is a major area for driving platform consolidation. Kroll, for instance, signed a multi-year deal to migrate over 500,000 endpoints to the Falcon platform to serve as the backbone for its global MDR offering. Asper was named the MSSP Partner of the Year in the 2025 Americas awards. The partnership with Kroll is a defining moment for the MDR market, blending AI-native tooling with human expertise.

Channel Partners/Resellers

Channel partners and resellers are the engine for driving net-new business and accelerating the adoption of the flexible Falcon Flex licensing model. The Falcon Flex model itself is a massive driver, generating over $1.35 billion in Annual Recurring Revenue (ARR) as of the end of the latest reported quarter, which was more than 200 percent year-over-year growth for that segment. GuidePoint Security won the Falcon Flex Partner of the Year award in 2025, showing the importance of this specific licensing motion for the channel. CDW was recognized as the Resell Partner of the Year. It's worth noting that in a prior quarter, nearly 70% of new subscription business came through partners, underscoring their central role in growth.

Channel partner performance metrics as of late 2025:

CrowdStrike Holdings, Inc. (CRWD) - Canvas Business Model: Key Activities

You're focused on the engine room of CrowdStrike Holdings, Inc., the core activities that translate their technology into financial results. Honestly, the numbers coming out of their Q3 FY2026 report, covering the period ending October 31, 2025, show a company executing hard on platform expansion and AI integration.

AI-Native Platform Development: Continuous innovation of the Falcon platform and Charlotte AI

The continuous innovation cycle is clearly visible in the product announcements and the growth of their AI capabilities. CrowdStrike Holdings, Inc. unveiled several new and enhanced offerings at the Fal.Con and Fal.Con Europe conferences, including Falcon Next-Gen Identity Security, Falcon Data Protection, Falcon for IT, and Falcon for XIoT. Furthermore, they acquired Pangea, a leader in AI security, to bolster their capabilities.

The AI assistant, Charlotte AI, is showing structural growth, posting a 85% sequential growth last quarter, and is now deeply embedded across Falcon modules. This development is a direct response to the threat landscape, where adversaries are weaponizing generative AI. For instance, AI-generated phishing emails have demonstrated a 54% click-through rate, significantly higher than the 12% seen with human-written attempts. One high-profile incident involved a $25.6 million fraudulent wire transfer that leveraged deepfake video technology.

Key Activity Metrics for AI and Platform Innovation:

• Charlotte AI sequential growth (last quarter): 85%.
• AI-generated phishing click-through rate: 54%.
• Human-composed phishing click-through rate: 12%.
• Reported value of a deepfake-enabled fraudulent wire transfer: $25.6 million.

Threat Intelligence & Hunting: Operating Counter Adversary Operations and publishing the 2025 Global Threat Report

The intelligence derived from operating Counter Adversary Operations and publishing the 2025 Global Threat Report directly informs platform development and sales messaging. The data from 2024 and early 2025 shows adversaries are faster and more reliant on stealth and identity.

The average time for an adversary to move laterally across a network, or breakout time, fell to just 48 minutes in 2024, down from 62 minutes in 2023, with the fastest recorded time being only 51 seconds. This speed necessitates the real-time capabilities of the Falcon platform. A major trend is the shift away from malware; 79% of CrowdStrike Holdings, Inc.'s detections in 2024 were malware-free, relying on hands-on-keyboard techniques and credential abuse.

Nation-state activity escalated, with China-nexus adversary activity surging 150% across all sectors in 2024 compared to 2023. Certain targeted industries, like financial services, media, and manufacturing, saw intrusion spikes between 200% and 300%. Furthermore, the market for initial access is booming, evidenced by a 50% year-over-year rise in advertisements for access brokers.

Key Threat Intelligence Findings (Reflecting 2024/Early 2025):

Sales and Marketing: Driving platform consolidation and cross-selling new modules

The sales and marketing focus is clearly on driving platform consolidation, which is reflected in the deepening module adoption rates and the success of the Falcon Flex subscription model. CrowdStrike Holdings, Inc. reported record Q3 net new Annual Recurring Revenue (ARR) of $265 million, a 73% year-over-year increase, showing strong demand for their expanded offerings.

The platform strategy is working, as evidenced by the module penetration metrics as of October 31, 2025:

• 49% of subscription customers used six or more modules.
• 34% of subscription customers used seven or more modules.
• 24% of subscription customers used eight or more modules.
• 60% of customers with $100K+ ARR adopted eight or more modules.

The Falcon Flex model is a significant driver, with ARR from customers adopting it exceeding $1.35 billion. The stickiness of this model is apparent, as re-Flex deals deliver approximately a 50% ARR uplift. The Next-Gen SIEM solution alone saw its ARR grow 95% year-over-year to $430 million, and the three key solutions-Cloud Security, Next-Gen Identity, and LogScale Next-Gen SIEM-now combine for $1.56 billion in ARR, growing over 40% year-over-year.

Cloud Infrastructure Management: Maintaining the massive, real-time Threat Graph data set

Managing the massive, real-time Threat Graph data set is a foundational activity that powers the entire AI-native platform. This infrastructure correlates trillions of data points from multiple telemetry sources to enable hyper-accurate detections and automated protection across the global customer base. The efficiency of this cloud-native architecture is key to maintaining margins while scaling.

Financial results from Q3 FY2026 underscore the scalability and cash generation supporting this infrastructure investment. CrowdStrike Holdings, Inc. achieved a record Free Cash Flow of $296 million, which represented a 24% Free Cash Flow Margin for the quarter. Operating Cash Flow reached a record $397.5 million. Furthermore, strategic acquisitions, like Onum, are aimed at improving infrastructure efficiency, delivering 5x faster throughput and 50% lower storage costs for data pipelines. As of October 31, 2025, the company held $4.8 billion in cash and cash equivalents to fund these ongoing operations.

CrowdStrike Holdings, Inc. (CRWD) - Canvas Business Model: Key Resources

You're looking at the engine room of CrowdStrike Holdings, Inc., the foundational assets that let them operate at this scale. Honestly, it all comes down to the platform and the data it generates.

CrowdStrike Falcon Platform: The core, single-agent, cloud-native security architecture. This platform is the delivery mechanism, the single agent that plugs into customer environments. Its success is reflected in the sheer scale of committed revenue; as of October 31, 2025, CrowdStrike Holdings, Inc. reported an Ending Annual Recurring Revenue (ARR) of $4.92 billion, growing 22.5% year-over-year. The platform's stickiness is also a key resource, with customer commitment packages driving adoption across more services.

Real-Time Threat Graph: Massive data set fueling AI-powered threat detection. This is where the data from every Falcon agent feeds into a consolidated, real-time graph, which is the brain for their AI defenses. The intelligence derived from this massive data set is crucial for anticipating threats. CrowdStrike Intelligence team tracks more than 265 named adversaries. This intelligence informs proactive threat hunting across the customer base.

Financial Capital: $4.32 billion in cash and equivalents as of January 31, 2025. Having this much liquidity on the balance sheet provides operational flexibility and a buffer, especially given the company's history of GAAP losses in certain periods. This capital supports continued investment in R&D and strategic acquisitions.

Cybersecurity Talent: Elite threat hunters and AI/ML engineering teams. The platform is only as good as the people refining the models and interpreting the threat landscape. The elite CrowdStrike Counter Adversary Operations team is responsible for tracking and analyzing the named adversaries. This specialized human capital directly feeds the intelligence loop that powers the Falcon platform's detection capabilities.

The depth of platform adoption shows how critical these resources are to the customer base:

• Customers using six or more modules: 49% as of October 31, 2025.
• Customers using eight or more modules: 24% as of October 31, 2025.
• Net new ARR added in Q3 FY2026: $265 million.
• Non-GAAP subscription gross margin: 81% for Q3 FY2026.

Here's a breakdown of the platform's penetration across the customer base as of the latest reported periods:

The growth in module adoption, especially for seven or more modules increasing from 32% to 34% between January and October 2025, shows customers are consolidating onto the platform, which is a key strategic resource for CrowdStrike Holdings, Inc. Finance: review the cash burn rate against the $4.32 billion on hand as of January 31, 2025, for the next 13-week forecast by end of day Tuesday.

CrowdStrike Holdings, Inc. (CRWD) - Canvas Business Model: Value Propositions

Unified Security Consolidation: Replacing multiple point products with one platform

CrowdStrike Holdings, Inc. drives consolidation by making its platform the foundational operating system for cybersecurity, appealing to enterprises battling tool sprawl. The Falcon Flex subscription model is key to this, with ARR from Flex accounts growing more than 200% year over year to more than $1.35 billion as of the third quarter of fiscal year 2025. This single-agent approach absorbs more workloads, with subscription revenue growing 21% to $1.17 billion in one recent quarter as customers consolidated endpoint, cloud workload, and identity protection. Platform stickiness is evident in module adoption rates.

The extent of platform adoption as of late 2025 fiscal year reporting:

AI-Powered Speed: Stopping breaches with one of the fastest recorded eCrime breakout times

The value proposition here is stopping intrusions before they spread, which is critical given the speed of modern threats. The fastest recorded eCrime breakout time observed was a mere 51 seconds. This rapid response capability is powered by the AI-native Falcon platform.

Key speed and threat statistics:

• Fastest recorded eCrime breakout time: 51 seconds.
• Average eCrime breakout time (2024): Fell to 48 minutes.
• Malware-free detections (2024): Accounted for 79% of detections.
• Growth in vishing operations (H1 to H2 2024): 442%.

Cloud and Identity Protection: Securing hybrid environments across endpoint, cloud, and identity

CrowdStrike Holdings, Inc. is securing the expanding attack surface across hybrid environments. The combined ending Annual Recurring Revenue (ARR) for the Next-Gen SIEM, Cloud Security, and Identity Protection businesses surpassed $1.3 billion as of January 31, 2025. The company was recognized as the Overall Leader in the 2025 KuppingerCole Identity Threat Detection and Response (ITDR) Leadership Compass. Furthermore, the newly launched Falcon Shield recorded sequential growth of nearly 50%, showing elevated demand for SaaS and identity risk mitigation.

High Customer Trust: Retention and willingness to recommend score

Customer commitment is quantified by exceptionally high retention figures, showing customers are not only staying but expanding their use of the platform. Gross retention was reported at 97% across multiple periods near late 2025. Dollar-based net retention, which measures spending expansion from existing customers, stood at 115% in the third quarter of fiscal year 2025.

Customer loyalty metrics:

• Gross Retention Rate (GRR): 97%.
• Dollar-Based Net Retention Rate (Q3 FY2025): 115%.
• Ending ARR (as of Jan 31, 2025): Grew to $4.24 billion.

CrowdStrike Holdings, Inc. (CRWD) - Canvas Business Model: Customer Relationships

You're managing a security portfolio where customer retention and expansion are everything, especially after a major industry event. CrowdStrike Holdings, Inc. focuses its customer relationships on a tiered approach, balancing high-touch support for strategic accounts with scalable digital engagement for the broader base.

Dedicated Account Management: For large enterprise and strategic Falcon Flex customers

The Falcon Flex subscription model is central to deepening relationships with large, strategic customers. This model is designed to accelerate platform consolidation, making it easier for customers to adopt multiple modules upfront in exchange for preferred pricing and flexibility over time. This approach clearly signals a commitment to the customer's long-term security architecture, not just a single product sale.

The traction here is significant. As of the third quarter of fiscal year 2026, accounts on the Falcon Flex model represented over $1.35 billion in ending Annual Recurring Revenue (ARR), showing growth of more than 200% year-over-year. During that same quarter, CrowdStrike Holdings, Inc. closed more than 150 Falcon Flex deals, collectively valued at over $600 million in total contract value. Honestly, this model turns a contract into a partnership, with Flex customers adopting an average of nine or more modules. This dedicated, high-value engagement is what drives the platform stickiness you're looking for.

Automated/Digital Service: Self-service module adoption within the Falcon console

For day-to-day management and adoption across the platform, the focus is on consolidation into a single interface. CrowdStrike Holdings, Inc. pushes the narrative of its unified platform, which consolidates security across endpoint, identity, and cloud using a single agent. This architecture supports a self-service mentality by presenting a comprehensive view within the Falcon console. For instance, the platform's ability to consolidate SaaS Security Posture Management (SSPM) with other disciplines into one console helps reduce operational overhead for the customer. The goal here is to make module adoption feel like a natural expansion within a familiar environment, not a separate procurement headache.

High-Touch Professional Services: Incident response and proactive security consulting

When things go wrong, or when complex new technologies like SIEM or advanced identity protection are deployed, the high-touch professional services team steps in. These services, which include incident response and proactive consulting, are a smaller but critical part of the revenue mix. For the full fiscal year 2025, GAAP professional services revenue was $192.14 million, making up 4.86% of total revenue. More recently, in the third quarter of fiscal year 2026, professional services revenue specifically clocked in at $65.5 million. This high-touch support is also deeply integrated with the partner ecosystem; an independent study found that partners can generate up to $7 in services revenue for every $1 a customer spends directly on the Falcon platform, illustrating the value placed on implementation and managed services.

Community-Driven Trust: Demonstrated by the willingness to recommend score

The ultimate measure of customer relationship health is advocacy, and CrowdStrike Holdings, Inc. consistently posts high scores here. This trust is vital, especially following the operational incident in mid-2024, as it shows customers believe in the recovery and the platform's core value. In the 2025 Gartner Peer Insights reports, the company achieved a 97% Willingness to Recommend score. Specifically, one report cited this score based on 601 overall responses as of January 2025, while another cited 206 responses as of February 28, 2025. You can see the high satisfaction reflected in the ratings, such as 4.8/5 for Product Capabilities in one report.

Here's a quick look at the key customer-facing metrics we've discussed:

The move to Falcon Flex, often tied to Customer Commitment Packages (CCPs) to help customers recover from the July 2024 incident, has been a defintely successful strategy to reinforce relationships and drive multi-module adoption.

• Flex customers adopt an average of nine or more modules.
• The company completed over 150 Falcon Flex deals in Q3.
• The unified platform consolidates security disciplines into a single console.
• The high recommendation score is based on hundreds of customer responses.

Finance: draft 13-week cash view by Friday.

CrowdStrike Holdings, Inc. (CRWD) - Canvas Business Model: Channels

You're looking at how CrowdStrike Holdings, Inc. gets its Falcon platform into the hands of customers, and it's a multi-pronged effort designed to capture everything from the largest global firms to smaller businesses. It's not just one path; it's a coordinated push across direct engagement, hyperscaler integration, and a vast partner ecosystem.

Direct Sales Force: Handling complex, large-scale enterprise contracts.

The direct sales team is definitely still key for those massive, complex enterprise deals, especially those involving the full platform consolidation CrowdStrike pushes. While the exact revenue split isn't public, the scale of their wins suggests this team closes the largest contracts. For instance, in Q4 of their last reported fiscal year, they closed over 20 deals greater than $10 million and over 350 deals greater than $1 million. That kind of deal velocity requires seasoned direct engagement to navigate procurement and architecture sign-offs at the highest levels.

Cloud Marketplaces: AWS Marketplace sales surpassed $1 billion in 2025.

The hyperscaler marketplaces are a massive channel for CrowdStrike Holdings, Inc., simplifying procurement for cloud-native customers. CrowdStrike Holdings, Inc. became the first cloud-native cybersecurity Independent Software Vendor (ISV) to surpass $1 billion in AWS Marketplace sales within a single calendar year in 2025. This channel is clearly working for scale; the transaction value through AWS Marketplace alone rose over 100% year-over-year in Q3 FY2025. It's a clear signal that customers prefer to consolidate security spend through their existing cloud relationships.

Global Channel Partner Network: Driving adoption in midmarket and SMB segments.

The partner network, managed through the expanded Accelerate program, is crucial for reaching the midmarket and SMBs, and for driving volume. To be fair, this channel is responsible for a huge chunk of new business; in Q3 FY2025, nearly 70% of new subscriptions came through partners. This network includes resellers, system integrators, and Managed Security Service Providers (MSSPs). CrowdStrike Holdings, Inc. recognized top performers like TD SYNNEX, naming them the 2025 Global Distributor Partner of the Year. The strategy relies on partners leveraging flexible licensing like Falcon Flex to deliver tailored solutions.

Falcon Platform Console: Direct in-product upsell of new security modules.

This is where the platform strategy really pays off, turning initial endpoint protection customers into multi-module subscribers right through the Falcon console. The adoption rates show this is happening fast. As of October 31, 2025, module adoption looked like this:

• 49% of customers used six or more modules.
• 34% used seven or more modules.
• 24% used eight or more modules.

The Falcon Flex subscription model is the engine for this, allowing customers to easily add modules without new procurement cycles. This model alone drove over $1.35 billion in ending Annual Recurring Revenue (ARR) as of the end of Q3 FY2026, representing growth of more than 200% year-over-year in that segment. That's how you expand within the installed base.

Here's a quick look at how the key components of the revenue base and channel success stack up as of late 2025:

Finance: draft 13-week cash view by Friday.

CrowdStrike Holdings, Inc. (CRWD) - Canvas Business Model: Customer Segments

You're looking at how CrowdStrike Holdings, Inc. segments its market as of late 2025. The strategy clearly leans into platform consolidation, using flexible licensing to drive deeper adoption across its customer base, which spans from the largest global entities to smaller organizations.

Large Enterprises/Global 2000: Seeking security platform consolidation.

This segment is heavily targeted by the push for a unified, AI-native Security Operations Center (SOC). The success of platform consolidation is directly measurable through module adoption rates, showing customers are moving away from point products. The Falcon Flex subscription model is a key enabler here, driving significant Annual Recurring Revenue (ARR) growth from existing customers expanding their footprint.

The data on deep module adoption illustrates this consolidation:

• Customers using six or more modules reached 49% as of the third quarter of fiscal 2026.
• Customers using seven or more modules stood at 34%.
• Customers using eight or more modules reached 24%.

This deep adoption is quantified by the financial impact of the flexible licensing:

The company's total ending ARR reached $4.92 billion as of October 31, 2025, showing the scale of the customer base these consolidation efforts are impacting.

Midmarket and Small-to-Medium Businesses (SMBs): Targeted via Falcon Go and Falcon Flex.

CrowdStrike Holdings, Inc. is seeing momentum across customers of all sizes, moving from enterprise down to the midmarket and SMB space. While specific revenue figures for the Falcon Go offering aren't broken out, the broad-based momentum suggests successful penetration into these smaller segments, often using the flexibility of Falcon Flex to manage costs and scale security needs efficiently. The overall subscription revenue, which services all customer sizes, was $1.17 billion in the third quarter of fiscal 2026, up 21% year-over-year.

Public Sector/Government: Recognized as a key segment in the 2025 Gartner report.

The public sector is explicitly called out as a segment achieving strong performance. This includes notable traction within U.S. federal agencies and higher education institutions. While a specific dollar amount for this segment isn't provided, its mention as a strong performer alongside the enterprise segment confirms its strategic importance to CrowdStrike Holdings, Inc.'s overall business mix. The U.S. market overall accounted for approximately 67% of the third quarter fiscal 2026 revenue.

Cloud-First Organizations: High growth in Next-Gen SIEM and Cloud Security adoption.

Growth in cloud-native and AI-driven security is a major driver, evidenced by the acceleration across specific product areas. The combined ending ARR for the Next-Gen SIEM, Cloud Security, and Identity Protection businesses surpassed $1.3 billion as of the fiscal year 2025 reporting period. Furthermore, the company reported record net new ARR for its Falcon Next-Gen SIEM offering in the third quarter of fiscal 2026. This focus on the modern security stack is what underpins the overall platform consolidation narrative, as these workloads require unified defense architecture.

CrowdStrike Holdings, Inc. (CRWD) - Canvas Business Model: Cost Structure

You're looking at where CrowdStrike Holdings, Inc. is putting its money to work to fuel that massive platform expansion. Honestly, the cost structure tells a clear story of aggressive growth investment, which is typical for a market leader scaling rapidly.

High Sales and Marketing (S&M) Costs: Necessary for land-and-expand strategy and new customer acquisition.

The go-to-market engine is definitely a major cost center, which makes sense when you are trying to capture market share and get customers to adopt more modules on the Falcon platform. You see this investment reflected in both GAAP and Non-GAAP figures for fiscal year 2025.

Here are the percentages of revenue for the full fiscal year 2025:

• GAAP Sales and Marketing operating expenses as a percentage of revenue: 39%
• Non-GAAP Sales and Marketing operating expenses as a percentage of revenue: 32%

When you look at the total Selling, General, and Administrative (SG&A) spend, it clocked in around 51% of revenue for FY2025, highlighting that continued sales and channel investment to convert those large enterprise deals globally.

Research and Development (R&D) Investment: Continuous funding for AI and platform innovation.

CrowdStrike Holdings, Inc. keeps pouring resources into the platform, especially around AI and security analytics, which is key to maintaining that technological lead. This is a non-negotiable cost for staying ahead in the security space.

For fiscal year 2025, the R&D investment was substantial:

That R&D intensity of approximately 27% is high compared to many other Software as a Service peers, showing the commitment to product expansion.

Low Cost of Goods Sold (COGS): Reflected in the non-GAAP subscription gross margin of 80% for FY2025.

The subscription business model itself is incredibly efficient once the customer is onboarded. This is where you see the real operating leverage start to kick in, even while S&M and R&D are high.

The key metric here for the full fiscal year 2025 is the Non-GAAP subscription gross margin, which hit 80%. That's a strong indicator of the underlying economics of delivering the Falcon platform service.

Cloud Infrastructure Costs: Running the massive, global Falcon platform and Threat Graph.

The cost to run the global Falcon platform and the massive Threat Graph is baked into COGS, which is why that 80% Non-GAAP subscription gross margin is so important. It shows that despite the massive scale and data processing required, the cost to serve each additional customer or data point remains relatively low, supporting the land-and-expand motion. You see the result of this efficiency in the record full year operating cash flow of $1.38 billion and free cash flow of $1.07 billion for FY2025.

Here's a quick look at how the major operating expense categories stacked up as a percentage of revenue for FY2025:

Finance: draft 13-week cash view by Friday.

CrowdStrike Holdings, Inc. (CRWD) - Canvas Business Model: Revenue Streams

You're looking at the engine that powers CrowdStrike Holdings, Inc.'s growth, which is heavily weighted toward recurring revenue. Honestly, the numbers show a clear preference for long-term commitments over one-off sales.

Subscription Revenue is the bedrock here. This is the predictable, high-margin income from customers using the Falcon platform on an ongoing basis. For the full fiscal year 2025, this primary stream totaled $3.76 billion, marking a 31% year-over-year increase. To give you a sense of the quarterly cadence leading up to this, Q3 FY2025 subscription revenue was $962.7 million, and by Q4 FY2025, it hit $1.01 billion. The momentum carried into the next fiscal year, with Q3 FY2026 subscription revenue reaching $1.17 billion, a 21% jump from the prior year's quarter.

The Annual Recurring Revenue (ARR) metric is what really shows the forward momentum of the business. As of the end of Q3 FY2026 (October 31, 2025), the ending ARR stood at $4.92 billion, accelerating to 23% growth year-over-year. That quarter alone added a record $265 million in net new ARR. For context, the ending ARR for the full fiscal year 2025 was $4.24 billion.

Here's a quick look at the key revenue figures from the most recent reporting periods:

The Professional Services Revenue stream, which covers things like incident response and consulting, is smaller but still important for customer success and initial platform deployment. In Q3 FY2026, this revenue component was $65.5 million (or $65.54 million, depending on the filing). This contrasts with the subscription side, which is clearly the dominant revenue driver.

The Land-and-Expand Model is how CrowdStrike Holdings, Inc. drives that high subscription revenue growth. They get customers in the door, often with a core module, and then sell more capabilities. The Falcon Flex subscription model is the key lever here, designed to make it easier for customers to adopt multiple modules. The success is clear in the numbers:

• Ending ARR from accounts using Falcon Flex exceeded $1.35 billion as of Q3 FY2026.
• ARR from Flex accounts grew more than 200% year-over-year in that quarter.
• In fiscal year 2025, accounts adopting Falcon Flex added over $1 billion of in-quarter deal value.
• The average Falcon Flex customer represents over $1 million in ending ARR, showing significant expansion potential per account.

Module adoption is high; for instance, as of October 31, 2024, module adoption rates showed that customers were using six or more modules at a rate of 47%.

Finance: draft 13-week cash view by Friday.