What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-03-09 compared with 2022-03-16 · 130 added, 115 removed, 749 unchanged (25% of the section changed)

5 unchanged sentences

Below is a summary of some of these risks.

This summary is not complete, and should be read together with the entire section titled “Risk Factors” in this Annual Report on Form 10-K, as well as the other information in this Annual Report on Form 10-K and the other filings that we make with the SEC.

This summary is not complete, and should be read together with the entire section titled “Risk Factors” in this Annual Report on

Form 10-K, as well as the other information in this Annual Report on Form 10-K and the other filings that we make with the SEC.

• We have experienced rapid growth in recent periods, and if we do not manage our future growth, our business and results of operations will be adversely affected.

• We have a history of losses and may not be able to achieve or sustain profitability in the future.

• The COVID-19 pandemic could adversely affect global economic conditions and our business, operating results and future revenue.

• If organizations do not adopt cloud-based SaaS-delivered endpoint security solutions, our ability to grow our business and results of operations may be adversely affected.

2 unchanged sentences

• If our customers do not renew their subscriptions for our products and add additional cloud modules to their subscriptions, our future results of operations could be harmed.

• Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense,

• We face intense competition and could lose market share to our competitors, which could adversely affect our business, financial condition, and results of operations.

26 unchanged sentences

We experienced net losses of $183.2 million, $234.8 million, and $92.6 million for fiscal 2023, fiscal 2022, and fiscal 2021, respectively.

As of January 31, 2022, we had an accumulated deficit of $964.9 million.

While we have experienced

significant growth in revenue in recent periods, we cannot assure you when or whether we will reach or maintain profitability.

As of January 31, 2023, we had an accumulated deficit of $1.1 billion.

While we have experienced significant growth in revenue in recent periods, we cannot assure you when or whether we will reach or maintain profitability.

We also expect our operating expenses to increase in the future as we continue to invest for our future growth, which will negatively affect our results of operations if our total revenue does not increase.

2 unchanged sentences

Any failure to increase our revenue as we invest in our business or to manage our costs could prevent us from achieving or maintaining profitability or positive cash flow.

The COVID-19 pandemic could adversely affect our business, operating results and future revenue.

The COVID-19 pandemic continues to impact worldwide economic activity and financial markets.

In light of the uncertain and rapidly evolving situation relating to the spread of COVID-19, we have taken precautionary measures intended to mitigate the spread of the virus and minimize the risk to our employees, customers, partners, and the communities in which we operate.

These precautionary measures could negatively affect our customer success efforts, delay and lengthen our sales cycles, impact our sales and marketing efforts, reduce employee efficiency and productivity, increase employee attrition, slow our international expansion efforts, increase cybersecurity risks, and create operational or other challenges, any of which could harm our business and results of operations.

As we monitor the situation, taking into account uncertainties with respect to vaccination progress, disease variants and the efficacy of vaccines and treatments relating to such variants, infection rates and evolving public health guidance at local, state and country levels, planning and risk management relating to our work policies and office operations will require time from management and other employees, which may reduce the amount of time available for other initiatives.

Moreover, due to our subscription-based business model, the effect of the COVID-19 pandemic may not be fully reflected in our results of operations until future periods, if at all.

In addition, the COVID-19 pandemic may disrupt the operations of our customers and partners for an indefinite period of time.

Some of our customers have been negatively impacted by the COVID-19 pandemic which could result in delays in accounts receivable collection, or result in decreased technology spending which could negatively affect our revenues.

More generally, the COVID-19 pandemic has adversely affected economies and financial markets globally, and continued uncertainty could lead to a prolonged economic downturn, which could result in a larger customer churn than we currently anticipate and reduced demand for our products and services, in which case our revenues could be significantly impacted.

The impact of the COVID-19 pandemic may also exacerbate other risks discussed in this “Risk Factors” section and elsewhere in this Annual Report on Form 10-K.

It is not possible at this time to estimate the impact that the COVID-19 pandemic could have on our business, as the impact will depend on future developments, which are highly uncertain and cannot be predicted.

If organizations do not adopt cloud-based SaaS-delivered endpoint security solutions, our ability to grow our business and results of operations may be adversely affected.

1 unchanged sentence

The use of SaaS solutions to manage and automate security and IT operations is at an early stage and rapidly evolving.

As such, it is difficult to predict its potential growth, if any, customer adoption and retention rates, customer demand for our solutions, or the success of existing competitive products.

As such, it is difficult to predict its potential growth, if any, customer adoption and retention rates, customer demand for our solutions, customer consolidation on our platform, or the success of existing competitive products.

Any expansion in our market depends on a number of factors, including the cost, performance, and perceived value associated with our solutions and those of our competitors.

1 unchanged sentence

We do not know whether the trend in adoption of cloud-based SaaS-delivered endpoint security solutions we have experienced in the past will continue in the future.

Furthermore, if we or other SaaS security providers experience security incidents, loss or disclosure of customer data, disruptions in delivery, or other problems, the market for SaaS solutions as a whole, including our security solutions, could be negatively affected.

Furthermore, if we or other SaaS security providers experience security incidents, loss or disclosure of customer data, disruptions in delivery, or other problems, the market for SaaS solutions as a

whole, including our security solutions, could be negatively affected.

You should consider our business and prospects in light of the risks and difficulties we encounter in this new and evolving market.

12 unchanged sentences

Even if we are successful in convincing prospective customers that a cloud native platform like ours is critical to protect against cyberattacks, they may not decide to purchase our Falcon platform for a variety of reasons, some of which are out of our control.

For example, any deterioration in general economic conditions, including a downturn due to the outbreak of diseases such as COVID-19, may cause our current and prospective customers to cut their overall security and IT operations spending, and such cuts may fall disproportionately on cloud-based security solutions like ours.

Economic weakness, customer financial difficulties, and constrained spending on security and IT operations may result in decreased revenue, reduced sales, lengthened sales cycles, increased churn, lower demand for our products, and adversely affect our results of operations and financial conditions.

For example, any deterioration in general economic conditions, including as a result of the geopolitical environment, the outbreak of diseases such as COVID-19 or inflation (as well as government policies such as raising interest rates in response to inflation), have in the past and may in the future cause our current and prospective customers to delay or cut their overall security and IT operations spending, and such delays or cuts may fall disproportionately on cloud-based security solutions like ours.

Economic weakness, customer financial difficulties, and constrained spending on security and IT operations may result in decreased revenue, reduced sales, an increase in multi-phase subscription start dates, shorter terms for customer subscriptions, lengthened sales cycles, increased churn, lower demand for our products, and adversely affect our results of operations and financial conditions.

Furthermore, we may need to exercise more flexibility in customer payment terms as customers navigate a more challenging economic environment.

Additionally, if the incidence of cyberattacks were to decline, or be perceived to decline, or if organizations adopt endpoints that use operating systems we do not adequately support, our ability to attract new customers and expand sales of our solutions to existing customers could be adversely affected.

3 unchanged sentences

Our customers have no obligation to renew their subscription for our Falcon platform after the expiration of their contractual subscription period, which is generally one year, and in the normal course of business, some customers have elected not to renew.

In addition, our customers may renew for shorter contract subscription lengths or cease using certain cloud modules.

Our customer retention and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our services, our pricing, customer security and networking issues and requirements, our customers’ spending levels, decreases in the number of endpoints to which our customers deploy our solutions, mergers and acquisitions involving our customers, industry developments, competition and general economic conditions.

In addition, customers that previously signed multi-year subscription contracts may renew for shorter contract subscription lengths, and customers may cease using certain cloud modules altogether.

Even if customers choose to renew their subscription of certain cloud modules, they may decline to purchase additional cloud modules or choose not to consolidate onto our Falcon platform.

If our efforts to maintain and expand our relationships with our existing customers are not successful, our business, results of operations, and financial condition may materially suffer.

Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense.

Our revenue recognition is difficult to predict because of the length and unpredictability of the sales cycle for our Falcon platform.

Customers often view the subscription to our Falcon platform as a significant strategic decision and, as a result, frequently require considerable time to evaluate, test and qualify our Falcon platform prior to entering into or expanding a relationship with us.

Large enterprises and government entities in particular often undertake a significant evaluation process that further lengthens and adds uncertainty to our sales cycle.

In addition, uncertain economic conditions may lead to additional scrutiny of budgets by current and prospective customers, which has resulted in, for example, longer sales cycles for products and services, and may result in shifting demand for IT products and services, and slower adoption of new technologies.

Our direct sales team develops relationships with our customers, and works with our channel partners on account penetration, account coordination, sales and overall market development.

We spend substantial time and resources on our sales efforts without any assurance that our efforts will produce a sale.

Security solution purchases are frequently subject to budget constraints, multiple approvals and unanticipated administrative, processing and other delays.

As a result, it is difficult to predict whether and when a sale will be completed.

The failure of our efforts to secure sales after investing resources in a lengthy sales process could adversely affect our business and results of operations.

We face intense competition and could lose market share to our competitors, which could adversely affect our business, financial condition, and results of operations.

The market for security and IT operations solutions is intensely competitive, fragmented, and characterized by rapid changes in technology, customer requirements, industry standards, increasingly sophisticated attackers, and by frequent

introductions of new or improved products to combat security threats.

We expect to continue to face intense competition from current competitors, as well as from new entrants into the market.

8 unchanged sentences

Our competitors include the following by general category:

• legacy antivirus product providers, such as Trellix (formerly McAfee Enterprise), Broadcom Inc.’s Symantec Enterprise division, and Microsoft Corporation, who offer a broad range of approaches and solutions including traditional signature-based anti-virus protection;

• alternative endpoint security providers, such as Blackberry Cylance, VMware Carbon Black and SentinelOne, who generally offer a mix of on-premise and cloud-hosted products that rely heavily on malware-only or application whitelisting techniques;

• network security vendors, such as Palo Alto Networks, Inc., who are supplementing their core perimeter-based offerings with endpoint security solutions;

• professional service providers, such as Mandiant and Microsoft Corporation, who offer cybersecurity response services.

• legacy antivirus product providers who offer a broad range of approaches and solutions including traditional signature-based anti-virus protection;

• alternative endpoint security providers who generally offer a mix of on-premise and cloud-hosted products that rely heavily on malware-only or application whitelisting techniques;

• network security vendors who are supplementing their core perimeter-based offerings with endpoint security solutions;

• professional service providers who offer cybersecurity response services.

Many of our competitors have greater financial, technical, marketing, sales, and other resources, greater name recognition, longer operating histories, and a larger base of customers than we do.

33 unchanged sentences

As a cybersecurity provider, we have been, and expect to continue to be, a target of cyberattacks.

If our internal networks, systems, or data are or are perceived to have been compromised, our reputation may be damaged and our financial results may be negatively affected.

If our or our service providers’ internal networks, systems, or data are or are perceived to have been compromised, our reputation may be damaged and our financial results may be negatively affected.

As a provider of security solutions, we have in the past been, and may in the future be, specifically targeted by bad actors for attacks intended to circumvent our security capabilities or to exploit our Falcon platform as an entry point into customers’ endpoints, networks, or systems.

2 unchanged sentences

We are also susceptible to inadvertent compromises of our systems and data, including those arising from process, coding, or human errors.

We also utilize third-party service providers to host, transmit, or otherwise process electronic data in connection with our business activities, including our supply chain, operations, and communications.

We also utilize third-party service providers to, among other things, host, transmit, or otherwise process electronic data in connection with our business activities, including our supply chain, operations, and communications.

Our third-party service providers and other vendors have faced and may continue to face cyberattacks, compromises, interruptions in service, or other security incidents from a variety of sources.

A successful attack or other incident that compromises our or our customers’ data or results in an interruption of service could have a significant negative effect on our operations, reputation, financial resources, and the value of our intellectual property.

A successful attack or other incident that results in an interruption of service or that compromises our or our service providers’ internal networks, systems, or data could have a significant negative effect on our operations, reputation, financial resources, and the value of our intellectual property.

We cannot assure you that any of our efforts to manage this risk, including adoption of a comprehensive incident response plan and process for detecting, mitigating, and investigating security incidents that we regularly test through table-top exercises, testing of our security protocols through additional techniques, such as penetration testing, debriefing after security incidents, to improve our security and responses, and regular briefing of our directors and officers on our cybersecurity risks, preparedness, and management, will be effective in protecting us from such attacks.

2 unchanged sentences

Furthermore, employee error or malicious activity could compromise our systems.

As a result, we may be unable to anticipate these techniques or implement adequate measures to prevent an intrusion into our networks, which could result in unauthorized access to customer data, intellectual property including access to our source code, and information about vulnerabilities in our product, which in turn, could reduce the effectiveness of our solutions, or lead to cyberattacks or other intrusions of our customers’ networks, litigation, governmental audits and investigations and significant legal fees, any or all of which could damage our relationships with our existing customers and could have a negative effect on our ability to attract and retain new customers.

damage our relationships with our existing customers and could have a negative effect on our ability to attract and retain new customers.

We have expended, and anticipate continuing to expend, significant resources in an effort to prevent security breaches and other security incidents impacting our systems and data.

36 unchanged sentences

We have from time to time experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications.

For example, in recent years, recruiting, hiring and retaining employees

with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of the recent cybersecurity attacks on global corporations and governments.

For example, in recent years, recruiting, hiring and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of the recent cybersecurity attacks on global corporations and governments.

Additionally, our incident response and proactive services team is small and comprised of personnel with highly technical skills and experience, who are in high demand, and who would be difficult to replace.

28 unchanged sentences

Our results of operations may vary significantly from period to period, which could adversely affect our business, financial condition and results of operations.

Our results of operations have varied significantly from period to period, and we expect that

our results of operations will continue to vary as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including:

• the impact of the COVID-19 pandemic on our operations, financial results, and liquidity and capital resources, including on customers, sales, expenses, and employees;

Our results of operations have varied significantly from period to period, and we expect that our results of operations will continue to vary as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including:

• our ability to attract new and retain existing customers;

• the budgeting cycles, seasonal buying patterns, and purchasing practices of customers;

• economic difficulties confronting our customers, which may impact the number of modules or endpoint deployments they are willing or able to purchase;

• the timing and length of our sales cycles;

10 unchanged sentences

• extraordinary expenses such as litigation or other dispute-related settlement payments or outcomes;

• general economic conditions, both domestic and in our foreign markets;

• future accounting pronouncements or changes in our accounting policies or practices;

3 unchanged sentences

• increases or decreases in our expenses caused by fluctuations in foreign currency exchange rates;

• significant natural disasters and other catastrophic events, including the occurrence of a contagious disease or illness, such as COVID-19.

Furthermore, our business and revenues are impacted by global economic and geopolitical conditions.

Volatile financial markets, inflation, rising interest rates, supply chain challenges, political turmoil and other disruptions to global and regional economies and markets continue to add uncertainty to macroeconomic conditions.

Any continued or further uncertainty, weakness or deterioration in economic conditions or the geopolitical environment could harm our business and results of operations.

In addition, we experience seasonal fluctuations in our financial results as we typically receive a higher percentage of our annual orders from new customers, as well as renewal orders from existing customers, in the second half of the fiscal year as compared to the first half of the year due to the annual budget approval process of many of our customers.

In addition, we also experience seasonality in our operating margin, with a lower margin in the first half of our fiscal year.

In addition, we also experience seasonality in our operating margin, typically with a lower margin in the first half of our fiscal year.

Any of the above factors, individually or in the aggregate, may result in significant fluctuations in our financial and other results of operations from period to period.

2 unchanged sentences

If we fail to meet such expectations for these or other reasons, our stock price could fall substantially, and we could face costly lawsuits, including securities class action suits.

Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense.

Our revenue recognition is difficult to predict because of the length and unpredictability of the sales cycle for our Falcon platform, particularly with respect to large organizations and government entities.

Large enterprises and government entities in particular often undertake a significant evaluation process that further lengthens our sales cycle.

Our direct sales team develops relationships with our customers, and works with our channel partners on account penetration, account coordination, sales and overall market development.

We spend substantial time and resources on our sales efforts without any assurance that our efforts will produce a sale.

Security solution purchases are frequently subject to budget constraints, multiple approvals and unanticipated administrative, processing and other delays.

As a result, it is difficult to predict whether and when a sale will be completed.

The failure of our efforts to secure sales after investing resources in a lengthy sales process could adversely affect our business and results of operations.

If we are not able to maintain and enhance our CrowdStrike and Falcon brand and our reputation as a provider of high-efficacy security solutions, our business and results of operations may be adversely affected.

4 unchanged sentences

If these reviews are negative, or less positive as compared to those of our competitors’ products, our brand may be adversely affected.

Our solutions may fail to detect or prevent threats in any particular test for a number of reasons that may or may not be related to the efficacy of our solutions in real world environments.

Our solutions may fail to detect or prevent threats in any particular

test for a number of reasons that may or may not be related to the efficacy of our solutions in real world environments.

To the extent potential customers, industry analysts or testing firms believe that the occurrence of a failure to detect or prevent any particular threat is a flaw or indicates that our solutions or services do not provide significant value, we may lose customers, and our reputation, financial condition and business would be harmed.

6 unchanged sentences

In addition to our direct sales force, we rely on our channel partners to sell and support our Falcon platform.

A vast majority of sales of our Falcon platform flow through our channel partners, and we expect this to continue for the foreseeable future.

The vast majority of sales of our Falcon platform flow through our channel partners, and we expect this to continue for the foreseeable future.

Additionally, we have entered, and intend to continue to enter, into technology alliance partnerships with third parties to support our future growth plans.

3 unchanged sentences

Our international operations and plans for future international expansion expose us to significant risks, and failure to manage those risks could adversely impact our business.

We derived approximately 28%, 28%, and 26% of our total revenue from our international customers for fiscal 2022, fiscal 2021, fiscal 2020, respectively.

We derived approximately 30%, 28%, and 28% of our total revenue from our international customers for fiscal 2023, fiscal 2022, and fiscal 2021, respectively.

We are continuing to adapt to and develop strategies to address international markets and our growth strategy includes expansion into target geographies, but there is no guarantee that such efforts will be successful.

8 unchanged sentences

Foreign Corrupt Practices Act of 1977, as amended, or FCPA, the U.S.

Travel Act and the UK Bribery Act 2010, or Bribery Act, violations of which could lead to significant fines, penalties, and collateral consequences for our company;

Travel Act and the U.K.

Bribery Act 2010, or Bribery Act, violations of which could lead to significant fines, penalties, and collateral consequences for our company;

• heightened risk of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements;

4 unchanged sentences

• double taxation of our international earnings and potentially adverse tax consequences due to changes in the tax laws of the United States or the foreign jurisdictions in which we operate;

• unexpected costs for the localization of our services, including translation into foreign languages and adaptation for local practices and regulatory requirements;

• unexpected costs for the localization of our services, including translation into foreign languages and adaptation for local practices and regulatory requirements (including, but not limited to data localization requirements);

• requirements to comply with foreign privacy, data protection, and information security laws and regulations and the risks and costs of noncompliance;

6 unchanged sentences

dollar could increase the cost of our solutions to our international customers, which could adversely affect our business and results of operations.

In addition, an increasing portion of our operating expenses is incurred outside the United States, is denominated in foreign currencies, such as the Australian Dollar, British Pound, Canadian Dollar, Euro, and Indian Rupee, is subject to fluctuations due to changes in foreign currency exchange rates.

In addition, an increasing portion of our operating expenses is incurred outside the United States;

is denominated in foreign currencies, such as the Australian Dollar, British Pound, Canadian Dollar, Euro, Indian Rupee, and Japanese Yen;

and is subject to fluctuations due to changes in foreign currency exchange rates.

If we become more exposed to currency fluctuations and are not able to successfully hedge against the risks associated with currency fluctuations, our results of operations could be adversely affected.

35 unchanged sentences

Ongoing improvements to cloud infrastructure may be more expensive than we anticipate, and may not yield the expected savings in operating costs or the expected performance benefits.

In addition, we may be required to re-invest any cost savings achieved from prior cloud infrastructure improvements in future infrastructure

projects to maintain the levels of service required by our customers.

In addition, we may be required to re-invest any cost savings achieved from prior cloud infrastructure improvements in future infrastructure projects to maintain the levels of service required by our customers.

We may not be able to maintain or achieve cost savings from our investments, which could harm our financial results.

18 unchanged sentences

If we experience any of these effects in connection with future growth, it could impair our ability to attract new customers, retain existing customers and expand their use of our Falcon platform, all of which would adversely affect our business, financial condition and results of operations.

Public health crises, such as the COVID-19 pandemic could adversely affect our business, operating results and future revenue.

We are subject to public health crises, such as the COVID-19 pandemic, which has impacted and continues to impact worldwide economic activity and financial markets.

We have previously taken and may in the future take precautionary measures intended to mitigate the spread of the COVID-19 virus and minimize the risk to our employees, customers, partners, and the communities in which we operate to respond to developments relating to the pandemic, including developments relating to infection rates, disease variants, vaccination progress and efficacy, and evolving public health guidance.

These measures could, for example, negatively affect our customer success efforts, delay and lengthen our sales cycles, impact our sales and marketing efforts, slow our international expansion efforts, increase cybersecurity risks, and create operational or other challenges, any of which could harm our business and results of operations.

In addition, public health crises may disrupt the operations of our customers and partners for an indefinite period of time.

Some of our customers have been negatively impacted by the COVID-19 pandemic, which could result in delays in accounts receivable collection, or result in decreased technology spending which could negatively affect our revenues.

More generally, the COVID-19 pandemic adversely affected economies and financial markets globally.

Uncertainty caused by public health crises could lead to prolonged economic downturns, which could result in a larger customer churn than we can anticipate and reduce demand for our products and services, in which case our revenues could be significantly impacted.

The lasting impact of the public health crises, including the COVID-19 pandemic, may also exacerbate other risks discussed in this “Risk Factors” section and elsewhere in this Annual Report on Form 10-K.

We rely on a limited number of suppliers for certain components of the equipment we use to operate our cloud platform.

4 unchanged sentences

If we experience disruption or delay from our suppliers, we may not be able to obtain supplies or components from alternative suppliers on a timely basis or on terms that are favorable to us, if at all.

The technology industry has recently experienced widespread component shortages and delivery delays, including as a result of the COVID-19 pandemic and natural disasters.

The technology industry has recently experienced widespread component shortages and delivery delays, including as a result of geopolitical tensions, the COVID-19 pandemic and natural disasters.

While we have taken steps to mitigate our supply chain risk, supply chain disruptions and delays could nevertheless adversely impact our operations by, among other things, causing us to delay opening new data centers, delay increasing capacity or replacing defective equipment at existing data centers, and experience increased operating costs.

3 unchanged sentences

We rely on a combination of patent, copyright, trademark and trade secret laws, as well as confidentiality procedures and contractual provisions, to establish and protect our intellectual property rights in the United States and abroad, all of which provide only limited protection.

The efforts we have taken to protect our intellectual property may not be sufficient or effective, and our trademarks, copyrights and patents may be held invalid or unenforceable.

The efforts we have taken to protect our

intellectual property may not be sufficient or effective, and our trademarks, copyrights and patents may be held invalid or unenforceable.

Moreover, we cannot assure you that any patents will be issued with respect to our currently pending patent applications in a manner that gives us adequate defensive protection or competitive advantages, or that any patents issued to us will not be challenged, invalidated or circumvented.

15 unchanged sentences

A number of companies in our industry hold a large number of patents and also protect their copyright, trade secret and other intellectual property rights, and companies in the networking and security industry frequently enter into litigation based on allegations of patent infringement or other violations of intellectual property rights.

For example, in March 2022, Webroot, Inc.

and Open Text, Inc.

filed a lawsuit against us alleging that certain of our products infringe on patents held by them.

As we face increasing competition and grow, the possibility of intellectual property rights claims against us also grows.

1 unchanged sentence

From time to time, third parties have in the past and may in the future assert claims of infringement of intellectual property rights against us.

For example, we are currently involved in proceedings before the Trademark Trial and Appeal Board at the U.S.

Patent and Trademark Office regarding our U.S.

trademark registrations for CrowdStrike Falcon and our U.S.

application to register our Falcon OverWatch trademark.

Fair Isaac Corporation, or FICO, petitioned to cancel our trademark registrations and opposed our application.

If the appeal board were to find against us, it would cancel our trademark registrations for CrowdStrike Falcon and reject our application to register Falcon OverWatch.

If FICO were to file an infringement action in court and if we do not prevail in that action, we could ultimately be required to change the names of our solutions, which would force us to incur significant marketing expense in establishing an alternative brand to our existing Falcon brand.

We cannot assure you that we will be successful in these rebranding efforts.

Third parties may in the future also assert claims against our customers or channel partners, whom our standard license and other agreements obligate us to indemnify against claims that our solutions infringe the intellectual property rights of third

As the number of products and competitors in the security and IT operations market increases and overlaps occur, claims of infringement, misappropriation, and other violations of intellectual property rights may increase.

6 unchanged sentences

or we may be required to obtain a license, which may not be available on reasonable terms, or at all, to use the relevant technology.

If we are prevented from using certain technology or intellectual property, we may be required to develop alternative, non-infringing technology, which could require significant time, during which we could be unable to continue to offer our affected services or features, effort and expense and may ultimately not be successful.

If we are prevented from using certain technology or

intellectual property, we may be required to develop alternative, non-infringing technology, which could require significant time, effort and expense and may ultimately not be successful.

Additionally, we may be unable to continue to offer our affected services or features while developing such technology.

Although third parties may offer a license to their technology or other intellectual property, the terms of any offered license may not be acceptable, and the failure to obtain a license or the costs associated with any license could cause our business, financial condition and results of operations to be adversely affected.

1 unchanged sentence

If a third party does not offer us a license to its technology or other intellectual property on reasonable terms, or at all, we could be enjoined from continued use of such intellectual property.

As a result, we may be required to develop alternative, non-infringing technology, which could require significant time, during which we could be unable to continue to offer our affected products, subscriptions or services, effort, and expense and may ultimately not be successful.

Furthermore, a successful claimant could secure a judgment or we may agree to a settlement that prevents us from distributing certain products, providing certain subscriptions or performing certain services or that requires us to pay substantial damages, royalties or other fees.

As a result, we may be required to develop alternative, non-infringing technology, which could require significant time, effort and expense and may ultimately not be successful.

Additionally, we may be unable to continue to offer our affected products, subscriptions or services, while developing such technology.

Any such judgment or settlement could also require us to pay substantial damages, royalties or other fees.

Any of these events could harm our business, financial condition and results of operations.

11 unchanged sentences

Ensuring that our collection, use, transfer, storage and other processing of personal information complies with such requirements can increase operating costs, impact the development of new products or services, and reduce operational efficiency.

information, including federal and state data privacy laws, data breach notification laws, and data disposal laws.

In the United States, there are numerous federal, state and local data privacy and security laws, rules, and regulations governing the collection, sharing, use, retention, disclosure, security, transfer, storage and other processing of personal information, including federal and state data privacy and security laws, data breach notification laws, and data disposal laws.

For example, at the federal level, we are subject to, among other laws and regulations, the rules and regulations promulgated under the authority of the Federal Trade Commission (which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including acts and practices with respect to data privacy and security), as well as the Electronic Communication Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act, and the Gramm Leach Bliley Act.

The United States Congress also has considered, and may in the future consider, various proposals from time to time for comprehensive federal data privacy legislation to which we may become subject if passed.

If we are found to have violated applicable laws or regulations, we may also be subject to penalties, fines, damages, injunctions or other outcomes that may adversely affect our operations and financial results.

At the state level, we are subject to laws and regulations such as the California Consumer Privacy Act (“CCPA”), which became effective on January 1, 2020.

The United States Congress also has considered, is currently considering, and may in the future consider, various proposals for comprehensive federal data privacy and security legislation, to which we may become subject if passed.

If we are found to have violated applicable laws or regulations, we also may be subject to penalties, fines, damages, injunctions or other outcomes that may adversely affect our operations and financial results.

At the state level, we are subject to laws and regulations such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”).

The CCPA broadly defines personal information and gives California residents expanded privacy rights and protections, such as affording them the right to access and request deletion of their information and to opt out of certain sharing and sales of personal information.

The CCPA also prohibits covered businesses from discriminating against California residents for exercising any of their CCPA rights.

The CCPA also prohibits covered businesses

from discriminating against California residents for exercising any of their CCPA rights.

The CCPA provides for severe civil penalties and statutory damages for violations and a private right of action for certain data breaches that result in the loss of unencrypted personal information.

This private right of action is expected to increase the likelihood of, and risks associated with, data breach litigation.

Additionally, in November 2020, California voters passed the California Privacy Rights Act of 2020 (“CPRA”).

Effective in most material respects starting on January 1, 2023, the CPRA imposes additional obligations on companies covered by the legislation and will significantly modify the CCPA, including by expanding the CCPA with additional data privacy compliance requirements that may impact our business.

The CPRA also establishes a regulatory agency dedicated to enforcing the CCPA and the CPRA.

Numerous other states, including Virginia and Colorado, have also enacted or are in the process of enacting or considering comprehensive state-level data privacy and security laws, rules and regulations.

Numerous other states have also enacted, or are in the process of enacting or considering, comprehensive state-level data privacy and security laws, rules, and regulations that share similarities with the CCPA.

At least four such laws, in Virginia, Colorado, Connecticut, and Utah, have taken effect, or are scheduled to take effect, in 2023.

Moreover, laws in all 50 U.S.

2 unchanged sentences

Internationally, virtually every jurisdiction in which we operate has established its own data privacy and security legal framework with which we must comply.

For example, we are required to comply with the European Union (“EU”) General Data Protection Regulation (“GDPR”), which became effective on May 25, 2018 and imposes stringent obligations regarding the collection, control, use, sharing, disclosure and other processing of personal data.

For example, we are required to comply with the European Union (“EU”) General Data Protection Regulation (“GDPR”), which imposes stringent obligations regarding the collection, control, use, sharing, disclosure and other processing of personal data.

Additionally, following the United Kingdom’s withdrawal from the EU, we also are subject to the U.K.

1 unchanged sentence

GDPR”), a version of the GDPR as implemented into the laws of the United Kingdom (“U.K.”).

While the GDPR and U.K.

GDPR remain substantially similar for the time being, the U.K.

government has announced that it would seek to chart its own path on data protection and reform its relevant laws, including in ways that may differ from the GDPR.

While these developments increase uncertainty with regard to data protection regulation in the U.K., even in their current, substantially similar form, the GDPR and U.K.

GDPR can expose businesses to divergent parallel regimes that may be subject to potentially different interpretations and enforcement actions for certain violations and related uncertainty.

Failure to comply with the GDPR or the U.K.

GDPR can result in significant fines and other liability, including, under the GDPR, fines of up to EUR 20 million (or GBP 17.5 million under the U.K.

GDPR) or four percent (4%) of global revenue, whichever is greater.

GDPR) or four percent (4%) of annual global revenue, whichever is greater.

The cost of compliance, and the potential for fines and penalties for non-compliance, with GDPR and U.K.

GDPR may have a significant adverse effect on our business and operations.

Recent legal developments in the European Economic Area (“EEA”), including recent rulings from the Court of Justice of the European Union and from various EU member state data protection authorities, have created complexity and uncertainty regarding transfers of personal data from the EEA to the United States and other so-called third countries outside the EEA.

Legal developments in the European Economic Area (“EEA”), including recent rulings from the Court of Justice of the European Union (“CJEU”) and from various EU member state data protection authorities, have created complexity and uncertainty regarding processing and transfers of personal data from the EEA to the United States and other so-called third countries outside the EEA, including in the context of website cookies.

Similar complexities and uncertainties also apply to transfers from the U.K.

1 unchanged sentence

While we have taken steps to mitigate the impact on us, such as implementing the European Commission’s standard contractual clauses (“SCCs”), the efficacy and longevity of these mechanisms remains uncertain.

Moreover, on June 4, 2021, the European Commission adopted new SCCs, which impose on companies additional obligations relating to personal data transfers out of the EEA, including the obligation to update internal privacy practices, conduct transfer impact assessments and, as required, to implement additional security measures.

Moreover, in 2021, the European Commission adopted new SCCs, which impose on companies additional obligations relating to personal data transfers out of the EEA, including the obligation to update internal privacy practices, conduct transfer impact assessments and, as required, implement additional security measures.

The new SCCs may increase the legal risks and liabilities under EU laws associated with cross-border data transfers, and result in material increased compliance and operational costs.

If we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

While we have implemented new controls and procedures to comply with the requirements of the GDPR, U.K.

While the European Commission announced in March 2022 that an agreement in principle had been reached between EU and U.S.

authorities regarding a new transatlantic data privacy framework, no formal agreement has been finalized, and any such agreement, if formalized, is likely to face challenge at the CJEU.

Moreover, although the U.K.

currently has an adequacy decision from the European Commission, such that SCCs are not required for the transfer of personal data from the EEA to the U.K., that decision will sunset in June 2025 unless extended and it may be revoked in the future by the European Commission if the U.K.

data protection regime is reformed in ways that deviate substantially from the GDPR.

Adding further complexity for international data flows, in March 2022, the U.K.

adopted its own International Data Transfer Agreement (“IDTA”) for transfers of personal data out of the U.K.

to so-called third countries, as well as an international data transfer addendum (U.K.

Addendum) that can be used with the SCCs for the same purpose.

The EU has also proposed legislation that would regulate non-personal data and establish new cybersecurity standards, and other countries, including the U.K., may similarly do so in the future.

If we are otherwise unable to transfer data, including personal data, between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

While we have implemented new controls and procedures designed to comply with the requirements of the GDPR, U.K.

GDPR and the data privacy and security laws of other jurisdictions in which we operate, such procedures and controls may not be effective in ensuring compliance or preventing unauthorized transfers of personal data.

Moreover, while we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, rules regulations and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to data privacy and security.

relating to data privacy and security.

Although we endeavor to comply with our privacy policies, we may at times fail to do so or be alleged to have failed to do so.

1 unchanged sentence

Our compliance efforts are further complicated by the fact that data privacy and security laws, rules, regulations and standards around the world are rapidly evolving, may be subject to uncertain or inconsistent interpretations and enforcement, and may conflict among various jurisdictions.

Any failure or perceived failure by us to comply with our privacy policies, or applicable data privacy and security laws, rules, regulations, standards or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release or transfer of personal information, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, governmental investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions and costly litigation (including class actions).

Any failure or perceived failure by us to comply with our privacy policies, or applicable data privacy and security laws, rules, regulations, standards, certifications or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release or transfer of personal information, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, governmental investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions and costly litigation (including class actions).

Any of the foregoing could harm our reputation, distract our management and technical personnel, increase our costs of doing business, adversely affect the demand for our products and services, and ultimately result in the imposition of liability, any of which could have a material adverse effect on our business, financial condition and results of operations.

18 unchanged sentences

These laws and regulations impose added costs on our business, and failure by us, our employees, representatives, contractors, channel partners, agents, intermediaries, or other third parties to comply with these or other applicable regulations and requirements could lead to claims for damages, penalties, termination of contracts, loss of exclusive rights in our intellectual property and temporary suspension or permanent debarment from government contracting.

Any such damages, penalties, disruptions or limitations in our ability to do business with customers, including those in the public sector, and could result in reduced sales of our products, substantial product inventory write-offs, reputational damage, penalties, and other sanctions, any of which could harm our business, reputation, and results of operations.

Any such damages, penalties, disruptions or limitations in our ability to do business with customers, including those in the public sector, could result in reduced sales of our products, substantial product inventory write-offs, reputational damage, penalties, and other sanctions, any of which could harm our business, reputation, and results of operations.

We are subject to laws and regulations, including governmental export and import controls, sanctions, and anti-corruption laws, that could impair our ability to compete in our markets and subject us to liability if we are not in full compliance with applicable laws.

8 unchanged sentences

export control laws and economic sanctions prohibit the shipment of certain cloud-based solutions to countries, governments, and persons targeted by U.S.

We also collect information about cyber threats from open sources, intermediaries, and third parties that we make available to our customers in our threat industry publications.

While we have implemented certain procedures to facilitate compliance with applicable laws and regulations in connection with the collection of this information, we cannot assure you that these procedures have been effective or that we, or third parties, many of whom we do not control, have complied with all laws or regulations in this regard.

Failure by our employees, representatives, contractors, channel partners, agents, intermediaries, or other third parties to comply with applicable laws and regulations in the collection of this information also could have negative consequences to us, including reputational harm, government investigations and penalties.

Although we take precautions to prevent our information collection practices and services from being provided in violation of such laws, our information collection practices and services may have been in the past, and could in the future be, provided in violation of such laws.

If we or our employees, representatives, contractors, channel partners, agents, intermediaries, or other third parties fail to comply with these laws and regulations, we could be subject to civil or criminal penalties, including the possible loss of export privileges and fines.

We may also be adversely affected through reputational harm, loss of access to certain markets, or otherwise.

Obtaining the necessary authorizations, including any required license, for a particular transaction may be time-consuming, is not guaranteed and may result in the delay or loss of sales opportunities.

We also collect information about cyber threats from open sources, intermediaries, and third parties, which we use and make available to our customers in our threat industry publications.

Although we take precautions and have implemented certain procedures to prevent our information collection practices and services from being provided in violation of applicable laws and regulations, our information collection practices and services may have been in the past, and could in the future be, provided in violation of such laws and regulations.

In addition, we cannot assure you that third parties, many of whom we do not control, have complied with all such laws or regulations.

Failure by our employees, representatives, contractors, agents, intermediaries, or other third parties to comply with such laws and regulations in the collection of this information could adversely affect us, through reputational harm, loss of access to certain markets, government investigations, and civil and criminal penalties.

Various countries regulate the import of certain encryption technology, including through import permit and license requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers’ ability to implement our products in those countries.

Obtaining the necessary authorizations, including any required license, for a particular transaction may be time consuming, is not guaranteed and may result in the delay or loss of sales opportunities.

Changes in our products or changes in export and import regulations may create delays in the introduction of our products into international markets, prevent our customers with international operations from deploying our products globally or, in some cases, prevent the export or import of our products to certain countries, governments or persons altogether.

5 unchanged sentences

and abroad, to sell subscriptions to our Falcon platform and to collect information about cyber threats.

these third-party business partners and intermediaries, our employees, representatives, contractors, channel partners, agents, intermediaries, and other third parties, even if we do not explicitly authorize such activities.

While we have policies and procedures to address compliance with the FCPA, the Bribery Act and other anti-corruption, sanctions, anti-bribery, anti-money laundering and similar laws, we cannot assure you that they will be effective, or that all of our employees, representatives, contractors, channel partners, agents, intermediaries, or other third parties have taken, or will not take actions, in violation of our policies and applicable law, for which we may be ultimately held responsible.

We and these third-parties may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities and we may be held liable for the corrupt or other illegal activities of these third-party business partners and intermediaries, our employees, representatives, contractors, channel partners, agents, intermediaries, and other third parties, even if we do not authorize such activities.

channel partners, agents, intermediaries, or other third parties have taken, or will not take actions, in violation of our policies and applicable law, for which we may be ultimately held responsible.

As we increase our international sales and business, our risks under these laws may increase.

32 unchanged sentences

Our revenue, other results of operations and financial condition could be harmed if we suffer performance issues or downtime that exceeds the service level commitments under our agreements with our customers.

We may become involved in litigation that may adversely affect us.

We are currently, and may in the future become, involved in litigation that may adversely affect us.

We are regularly subject to claims, suits, and government investigations and other proceedings including patent, product liability, class action, whistleblower, personal injury, property damage, labor and employment (including allegations of wage and hour violations), commercial disputes, compliance with laws and regulatory requirements and other matters, and we may become subject to additional types of claims, suits, investigations and proceedings as our business develops.

18 unchanged sentences

We may also have to seek a license for the technology.

Such license may not be available on reasonable terms, if at all, and may significantly increase our operating expenses or may require us to restrict our business activities and limit our ability to deliver certain solutions or features.

Such license may not

be available on reasonable terms, if at all, and may significantly increase our operating expenses or may require us to restrict our business activities and limit our ability to deliver certain solutions or features.

We may also be required to develop alternative non-infringing technology, which could require significant effort and expense and/or cause us to alter our products and services, which could harm our business.

49 unchanged sentences

If any of the analysts who cover us issues an inaccurate or unfavorable opinion regarding our stock price, our stock price would likely decline.

In addition, the stock prices of many companies in the technology industry have declined significantly after those

companies have failed to meet, or significantly exceed, the financial guidance publicly announced by the companies or the expectations of analysts.

If our financial results fail to meet, or significantly exceed, our announced guidance or the expectations of analysts or public investors, analysts could downgrade our Class A common stock or publish unfavorable research about us.

In addition, the stock prices of many companies in the technology industry have declined significantly after those companies have failed to meet, or significantly exceed, the financial guidance publicly announced by the companies or the expectations of analysts.

research about us.

If one or more of these analysts cease coverage of our company or fail to publish reports on us regularly, our visibility in the financial markets could decrease, which in turn could cause our stock price or trading volume to decline.

40 unchanged sentences

Our indebtedness could adversely affect our financial condition.

As of January 31, 2022, we had $750.0 million of indebtedness outstanding (excluding intercompany indebtedness) and there is additional availability under our revolving facility of up to $750.0 million (excluding issued but undrawn letters of credit).

As of January 31, 2023, we had $750.0 million principal amount of indebtedness outstanding (excluding intercompany indebtedness), and there is additional availability under our revolving facility of up to $750.0 million (excluding issued but undrawn letters of credit).

Our indebtedness could have important consequences, including:

59 unchanged sentences

The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting.

We are continuing to develop and refine our disclosure controls, internal control over financial reporting and other procedures that are designed to ensure information required to be disclosed by us in our financial statements and in the reports that we file with the SEC is recorded, processed, summarized and reported within the time periods specified in SEC rules and forms, and information required to be disclosed in reports under the Exchange Act is accumulated and communicated to our principal executive and financial officers.

We are continuing to develop and refine our disclosure controls, internal control over financial reporting and other procedures that are designed to ensure information required to be disclosed by us in our consolidated financial statements and in the reports that we file with the SEC is recorded, processed, summarized and reported within the time periods specified in SEC rules and forms, and information required to be disclosed in reports under the Exchange Act is accumulated and communicated to our principal executive and financial officers.

Our current controls and any new controls we develop may become inadequate because of changes in conditions in our business.

1 unchanged sentence

Weaknesses in our internal controls may be discovered in the future.

Any failure to develop or maintain effective controls, or any difficulties encountered in their implementation or improvement, could harm our results of operations, may result in a restatement of our financial statements for prior periods, cause us to fail to meet our reporting obligations, and could result in an adverse opinion regarding our internal control over financial reporting from our independent registered public accounting firm, and lead to investigations or sanctions by regulatory authorities.

Any failure to develop or maintain effective controls, or any difficulties encountered in their implementation or improvement, could harm our results of operations, may result in a restatement of our consolidated financial statements for prior periods, cause us to fail to meet our reporting obligations, and could result in an adverse opinion regarding our internal control over financial reporting from our independent registered public accounting firm, and lead to investigations or sanctions by regulatory authorities.

Section 404 of the Sarbanes-Oxley Act requires our management to certify financial and other information in our quarterly and annual reports and provide an annual management report on the effectiveness of our internal control over financial reporting.

42 unchanged sentences

In addition, the Organization for Economic Cooperation and Development (“OECD”) has published proposals covering a number of issues, including country-by-country reporting, permanent establishment rules, transfer pricing rules, tax treaties and taxation of the digital economy.

A significant majority of countries in the OECD’s Inclusive Framework have agreed in principle to a proposed solution to address the tax challenges arising from the digitalization of the economy.

Most recently, 137 jurisdictions joined a two-pillar plan to reform international taxation rules and ensure that multinational enterprises pay a fair share of tax wherever they operate.

The first pillar is focused on the allocation of taxing rights between countries for in-scope multinational enterprises that sell goods and services into countries with little or no local physical presence and is intended to apply to multinational enterprises with global turnover above 20 billion euros.

A significant majority of countries in the OECD’s Inclusive Framework have agreed in principle to a proposed solution to address the tax challenges arising from the digitalization of the economy, including joining a two-pillar plan to reform international taxation rules and ensure that multinational enterprises pay a fair share of tax wherever they operate.

The second pillar is focused on developing a global minimum tax rate of at least 15 percent applicable to in-scope multinational enterprises and is intended to apply to multinational enterprises with annual consolidated group revenue in excess of 750 million euro.

7 unchanged sentences

If not utilized, the federal and California net operating loss carryforwards will begin to expire in fiscal 2031.

As of January 31, 2022, we had net operating loss carryforwards for other states of $868.0 million that will begin to expire in fiscal 2023.

As of January 31, 2023, we had net operating loss carryforwards for other states of $1.0 billion that will begin to expire in fiscal 2024.

As of January 31, 2023, we had federal and California research and development credit carryforwards of $87.4 million and $18.8 million, respectively.

36 unchanged sentences

Further, valuations of non-marketable equity investments are inherently complex due to the lack of readily available market data.

In addition, we may experience additional volatility to our statements of operations due to changes in market prices of our

marketable equity investments, the valuation and timing of observable price changes or impairments of our non-marketable equity investments, and changes in the proportionate share of earnings and losses or impairment of our equity investments accounted for under the equity method.

In addition, we may experience additional volatility to our statements of operations due to changes in market prices of our marketable equity investments, the valuation and timing of observable price changes or impairments of our non-marketable equity investments, and changes in the proportionate share of earnings and losses or impairment of our equity investments accounted for under the equity method.

This volatility could be material to our results in any given quarter and may cause our stock price to decline.

2 unchanged sentences

A significant natural disaster, such as an earthquake, a fire, a flood, or significant power outage and other catastrophic events, including the occurrence of a contagious disease or illness, such as COVID-19, could have a material adverse impact on our business, results of operations, and financial condition.

The outbreak of a contagious disease like COVID-19 has, among other things, prompted responses such as government-imposed travel restrictions, the grounding of flights, and the shutdown of workplaces.

Natural disasters and other catastrophic events such as COVID-19, could affect our personnel, recovery of our assets, data centers, supply chain, manufacturing vendors, or logistics providers’ ability to provide materials and perform services such as manufacturing products or assisting with shipments on a timely basis.

9 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors