What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2024-03-07 compared with 2023-03-09 · 145 added, 117 removed, 408 unchanged (39% of the section changed)

1 unchanged sentence

When we started CrowdStrike, cyberattackers had an asymmetric advantage over legacy cybersecurity products that could not keep pace with rapid changes in adversary tactics.

We took a fundamentally different approach to solve this problem with the CrowdStrike Falcon platform – the first, true cloud-native platform capable of harnessing vast amounts of security and enterprise data to deliver highly modular solutions through a single lightweight agent.

Our pioneering platform approach keeps customers ahead of attackers by automatically detecting and preventing threats to stop breaches.

We took a fundamentally different approach to solve this problem with the AI-native CrowdStrike Falcon XDR platform – the first, true, cloud-native platform built with artificial intelligence (“AI”) at the core, capable of harnessing vast amounts of security and enterprise data to deliver highly modular solutions through a single lightweight agent.

The CrowdStrike Falcon platform is designed to be the definitive platform for cybersecurity consolidation, purpose-built to stop breaches.

The platform’s single, lightweight agent collects and integrates data from across the enterprise, including endpoints, cloud workloads, identities, and third-party sources.

We use this to train our AI to detect and prevent threats and drive workflow automation to give security teams machine speed advantage to stop adversaries.

By consolidating and replacing legacy point products and fragmented platforms across key areas of security and IT, the Falcon platform delivers a unified, modern approach that increases capability while reducing complexity and cost – all while stopping breaches.

We believe our approach has defined a new category called the Security Cloud, which has the power to transform the cybersecurity industry the same way the cloud has transformed the customer relationship management, human resources, and service management industries.

Using cloud-scale AI, our Security Cloud enriches and correlates trillions of cybersecurity events per week with indicators of attack, threat intelligence and enterprise data (including data from across endpoints, workloads, identities, IT assets and configurations) to create actionable information, identify shifts in adversary tactics and automatically detect and prevent threats in real-time across our customer base.

Using cloud-scale AI, our Security Cloud enriches and correlates trillions of cybersecurity events per week with indicators of attack, threat intelligence, and enterprise data (including data from across endpoints, workloads, identities, DevOps, IT assets, and configurations) to create actionable data, identify shifts in adversary tactics, and automatically prevent threats in real-time across our customer base.

The more data that is fed into our Falcon platform, the more intelligent our Security Cloud becomes, and the more our customers benefit, creating a powerful network effect that increases the overall value we provide.

The Architectural Purpose Behind the Platform

Our Falcon platform was purpose-built in the cloud to harness the power of data to deliver the next generation of automated protection and provide threat hunters with the intelligence required to stop sophisticated attacks, including non-malware based attacks.

Our Falcon platform was purpose-built in the cloud to harness the power of data and AI to deliver the next generation of automated protection and provide threat hunters with the intelligence required to stop sophisticated attacks, including malware-free and fileless attacks.

This approach has made CrowdStrike an industry leader in protection across endpoints, cloud workloads, identity and data (capable of protecting workloads across on-premise, virtualized, and cloud-based environments running on a variety of endpoints such as desktops, laptops, servers, virtual machines, cloud workloads, cloud containers, mobile, and IoT devices) and enables us to rapidly scale this best in class protection across new and emerging areas of enterprise risk.

Today, we offer 23 cloud modules on our Falcon platform via a SaaS subscription-based model that spans multiple large markets, including corporate workload security, managed security services, security and vulnerability management, IT operations management, identity protection, log management, threat intelligence services, and data protection.

Our Falcon platform is composed of tightly integrated, proprietary technologies that enable us to deliver superior protection and performance, while reducing customer complexity.

Today, we offer 27 cloud modules on our Falcon platform via a SaaS subscription-based model that spans multiple large markets, including corporate endpoint and cloud workload security, managed security services, security and vulnerability management, IT operations management, identity protection, next-generation SIEM and log management, threat intelligence services, data protection, Security Orchestration, Automation and Response (“SOAR”) and AI powered workflow automation, and securing generative AI workloads.

Our Falcon platform is composed of tightly integrated, proprietary technologies that enable us to deliver superior protection and performance, while reducing complexity for our customers.

Our Falcon platform consists of our easily deployed, intelligent lightweight agent, and our groundbreaking graph technology.

Our single, lightweight-agent approach has changed how organizations experience cybersecurity, delivering protection without impacting the user, resources or productivity.

With the lightweight agent installed on each endpoint or cloud workload, our Falcon platform automates detection and prevention capabilities in real time across our entire global customer base.

With the lightweight agent installed on each endpoint and cloud workload, our Falcon platform automates detection and prevention capabilities in real time across our entire global customer base.

This also enables our Falcon platform to intelligently ingest data once and stream high fidelity data back into the Security Cloud to be re-used for multiple use cases, continuously improve our Falcon platform’s AI algorithms and make its real-time decision-making faster and smarter to keep customers ahead of changing adversary tactics.

Our graph technology correlates and contextualizes the vast data of our Security Cloud so we can collect data once and reuse it repeatedly to deliver solutions that solve our customers’ biggest problems.

The highly advanced graph technologies underpinning the Falcon platform now include:

The highly advanced graph technologies underpinning the Falcon platform include:

• Our Threat Graph, which uses a combination of AI and behavioral pattern-matching techniques to correlate and analyze trillions of cybersecurity events, enriched with threat intelligence, and third-party data to identify and link threat activity together to automatically prevent threats in real time across CrowdStrike’s global customer base.

17 unchanged sentences

• The Increasing Sophistication and Disruption of Cybersecurity Threats:

The sophistication of adversaries continues to increase as militaries and intelligence services of well-funded nation-states, technically advanced criminal organizations and hackers use advanced, easily obtained methods of attack – including non-malware based attacks that exploit user identities and credentials.

Adversary sophistication continues to increase as militaries and intelligence services of well-funded nation-states, technically advanced criminal organizations and hackers advance their tactics.

In addition, the commoditization of technologies like generative AI make it easier for low-skilled adversaries to move faster and launch more sophisticated attacks.

This includes non-malware based attacks like social engineering that exploit user identities and credentials.

These attacks are pervasive, targeting a broad range of industries including technology, transportation, healthcare, financial services, governments and political organizations, utility, retail, and public infrastructure.

6 unchanged sentences

They are adding more workloads to a myriad of different endpoints beyond the traditional cybersecurity perimeter, exposing an increasingly broad attack surface to adversaries.

This existing trend was accelerated significantly with the need to support an increasingly remote workforce in 2020 due to the COVID-19 pandemic and we believe this trend continues today.

In addition, technologies like Cloud and Containers are being adopted quickly, but rather than becoming full-scale replacements, they are often being used as supplements to existing on-premise, bare metal, and virtualized workloads.

This trend accelerated significantly with the need to support an increasingly remote workforce in 2020 due to the COVID-19 pandemic and we believe this trend continues today.

• A Growing Cyber Skills Gap:

8 unchanged sentences

Existing Security Solutions Are Limited and Exacerbate Ongoing Trends:

We believe the aforementioned trends are exacerbated by the architectural limitations of legacy cybersecurity products, which are characterized by:

We believe the aforementioned trends are exacerbated by the architectural limitations of legacy cybersecurity products and fragmented platforms, which are characterized by:

• On-Premise Security and Bolt-On Cloud Products That Lead to Constrained and Impacted Users :

1 unchanged sentence

Meanwhile, these solutions often require more agents on the endpoint as new capabilities are patchworked together, which can have a dramatic negative impact on user performance.

Many on-premise vendors have since tried to solve this problem by simply extending on-premise products to the cloud.

Since their products were not purpose built to run in the cloud, traditional on-premise issues – complex to deploy, siloed nature, lack of integration, limited ability to scale, costly to maintain – continue to manifest.

Many on-premise vendors have tried to solve this problem by simply extending on-premise products to the cloud.

Since their products were not purpose built to run in the cloud, traditional on-premise issues such as complex deployments, data silos, lack of integrations, limited scalability, and high maintenance costs continue to manifest.

We believe that any product that was originally designed for on-premise deployments and migrated to the cloud cannot by definition be a cloud native solution.

Some other vendors attempt to solve this problem by acquiring disparate products and stitching them together into fragmented platforms.

This can force customers to focus on implementing integrations, not security outcomes and stopping the breach.

The resulting complexity can impede workflows and slow down response time.

• Legacy Signature-Based Products That Are Not Effective Against Unknown Threats :

1 unchanged sentence

As a result, such products are fundamentally unable to prevent unknown threats resulting from shifts in attacker tradecraft.

It often only takes a slight modification on the part of the attacker to bypass signatures.

An attacker may be able to bypass a signature-based defense with just a slight modification to an existing attack.

Many significant breaches seen in the last two decades have involved the failure of a legacy signature-based antivirus product to detect a previously unknown or modified version of a previously known attack.

• Malware-Focused Machine Learning Products That Miss Sophisticated Attacks:

• Malware-Focused Products That Miss Sophisticated Attacks:

Traditionally, organizations have focused on protecting their networks and endpoints against malware-based attacks.

These attacks involve malware built for the specific purpose of performing malicious activities, stealing data, or destroying systems.

We have observed that over 60% of attacks comprise non-malware, hands-on-keyboard activity.

Our 2024 Global Threat Report observed that over 70% of attacks comprise non-malware, hands-on-keyboard activity.

Additionally, we found that eight out of 10 attacks involve compromised or stolen credentials, with these identity-based attacks easily able to bypass legacy approaches to protection.

Therefore, a malware-centric defensive approach will leave the organization vulnerable to attacks that do not leverage malware.

12 unchanged sentences

As more high fidelity data is fed into our Security Cloud, our AI models continue to train and improve, increasing the overall efficacy of the Falcon platform.

This creates a powerful network effect that is a key differentiator in our efforts to gain more customers.

The Threat Graph is able to contextualize and turn this data into action, automatically delivering protection to every customer.

This unique data layer is powered and turned into action by three complementary graph databases (Threat Graph, Asset Graph, and Intel Graph) to put threats, adversaries, and assets into the context needed to make the rapid, informed decisions that stop breaches.

• High Efficacy, Low False Positives :

3 unchanged sentences

Our cloud-native platform approach gives customers a unified approach to address their most critical areas of risk seamlessly.

We empower customers to rapidly deploy and scale industry leading technologies across endpoint detection and response (“EDR”) and Extended Detection and Response (“XDR”), Identity Threat Protection, Threat Intelligence, ITSecOps and Risk, Cloud Security, and Modern Log Management from a single platform.

We empower customers to rapidly deploy and scale industry leading technologies across endpoint detection and response (“EDR”) and Extended Detection and Response (“XDR”), Identity Threat Protection, Threat Intelligence, Exposure Management, Cloud Security, Application Security Posture Management, Next-Generation SIEM and Modern Log Management, and IT Automation from a single platform.

• Reducing Agent Bloat :

5 unchanged sentences

• Rapid Time to Value :

Our cloud-native platform was built to rapidly scale industry leading protection across the entire enterprise, eliminating the lengthy implementation periods, and professional services engagements that next-gen and legacy competitors require.

Our single agent approach enables us to activate new modules in real time.

Our cloud-native platform was built to rapidly scale industry leading protection across the entire enterprise, eliminating lengthy implementation periods and professional services engagements that next-gen and legacy competitors may require.

Our single agent, collect once and re-use many times approach enables us to activate new modules in real time.

• Elite Security Teams as a Force Multiplier:

As adversaries continue to employ sophisticated non-malware attacks that exploit user credentials and identities, automation and autonomous security are no longer sufficient on their own.

As adversaries continue to employ sophisticated malwareless attacks that exploit user credentials and identities, automation and autonomous security are no longer sufficient on their own.

Stopping today’s sophisticated attacks requires a combination of powerful automation and elite threat hunting.

Falcon Complete provides a comprehensive monitoring, management, response, and remediation solution to our customers and is designed to bring enterprise level security to companies that may lack enterprise level resources.

CrowdStrike Falcon OverWatch combines world-class human intelligence from our elite security experts with the power of the Security Cloud.

CrowdStrike Falcon OverWatch, part of CrowdStrike Counter Adversary Operations, combines world-class human intelligence from our elite security experts with the power of the Falcon platform.

OverWatch is a force multiplier that extends the capabilities and improves the productivity of our customers’ security teams.

3 unchanged sentences

CrowdStrike automates manual tasks to free security teams to focus on their most important job – stopping the breach.

Our Falcon Fusion module automates workflows to reduce the need to switch between different security tools and tasks, while our Falcon Insight XDR module provides a unified solution that enables security teams to rapidly and efficiently identify, hunt, and eliminate threats across multiple security domains.

Our Falcon Fusion capability automates workflows to reduce the need to switch between different security tools and tasks, while our Falcon Insight XDR module provides a unified solution that enables security teams to rapidly and efficiently identify, hunt, and eliminate threats across multiple security domains using first and third party datasets.

• Lower Total Cost of Ownership :

1 unchanged sentence

Additionally, our comprehensive platform reduces overall personnel costs associated with ongoing maintenance, as well as the need for software patches and upgrades for separate products.

Enforcing Zero Trust Across the Pillars of Modern Enterprise Security

Securing Identities and Data Across the Pillars of Modern Enterprise Security

As modern attacks and adversaries grow more sophisticated, CrowdStrike believes that stopping breaches in the modern era requires security that delivers unified visibility and protection across three critical areas:

Endpoint and Cloud workloads, Identity Threat Protection and Data Protection.

Eighty percent of breaches today use stolen credentials and identities.

Stopping these advanced attacks requires a Zero Trust approach that delivers true end-to-end protection across workloads, identities, and data.

CrowdStrike is able to natively enforce Zero Trust protection at the device layer, the identity layer, and the data layer, extending our bold vision for security by driving modern Defense in Depth to the enterprise.

By delivering these powerful capabilities through a unified platform, CrowdStrike is able to connect the endpoint and workload to user identity, and the data that is being used and accessed.

Approximately eighty percent of breaches today use stolen credentials and identities.

Stopping these advanced attacks requires a holistic approach that delivers true end-to-end protection across workloads, identities, and data.

CrowdStrike is able to natively enforce protection at the device layer, the identity layer, and the data layer, extending our bold vision for security by driving modern Defense in Depth to the enterprise.

By delivering these powerful capabilities through a unified platform with a single agent, CrowdStrike is able to connect the endpoint and workload to user identity, and the data that is being used and accessed.

Customers can see the full health and state of endpoints and workloads, in context with the identity that is using and accessing them, aligned with where data is being created, who is using it, where it flows and how it is protected.

1 unchanged sentence

This is how CrowdStrike believes security should and must be delivered today to combat advanced adversaries and stop breaches in the modern era.

This means security solutions that are:

a) Easy to deploy;

b) Easy to manage;

and c) Highly effective, without interference on good user behavior.

This means security solutions that are easy to deploy, easy to manage, and highly effective.

The CrowdStrike Falcon Platform:

1 unchanged sentence

Our platform approach allows us to rapidly innovate, build, and deploy highly integrated modules that address critical customer problems and access additional market opportunities.

Our cloud modules integrate seamlessly with the Falcon platform that addresses use cases across corporate workload security, security and vulnerability management, managed security services, IT operations management, threat intelligence services, identity protection, and log management.

Our Falcon platform is composed of two tightly integrated proprietary technologies:

our lightweight agent and our Security Cloud.

The Falcon platform offers a unified set of cloud-delivered technologies that power a wide range of modules across EDR and XDR, Identity Threat Protection, Threat Intelligence, ITSecOps and Risk, Cloud Security, and Modern Log Management.

Our cloud-delivered modules integrate seamlessly within the Falcon platform to provide customers with a unified set of cloud-delivered technologies across EDR and XDR, Identity Threat Detection and Response Protection, Threat Intelligence, Exposure ManagementITSecOps and Risk, Cloud Security, Application Security Posture Management, IT Automation, as well as Next-Generation SIEM and Modern Log Management.

The Falcon platform also encompasses recently acquired technologies where integration may be ongoing.

We can rapidly and cost effectively develop and deliver additional cloud modules on our Falcon platform without the need for additional agents, and are expanding options for our new customers to test modules on a trial basis and in-application trials for existing customers.

Our expanding set of open APIs allows customers and partners to build their own capabilities on top of the Falcon platform.

With our Falcon platform, we can crowdsource data and deliver a variety of cloud modules to detect and stop breaches.

Our modules address the most critical areas of enterprise risk and friction.

Our expanding set of open APIs and the Foundry app development platform will allow customers and partners to build their own capabilities on top of the Falcon platform.

Unifying data from our modules and customers into a single cloud infrastructure gives us significant advantages in developing and delivering innovative AI capabilities to detect and prevent threats, as well as improving user productivity and efficiency through cutting-edge generative AI systems such as our Charlotte AI module.

CrowdStrike Falcon Platform:

Our Cloud Modules

Our cloud modules integrate seamlessly with the Falcon platform to provide functionality in the endpoint security, security and IT operations (including vulnerability management), and threat intelligence markets.

Today, our cloud modules include:

Our Cloud Delivered Modules

Our cloud delivered modules integrate seamlessly with the Falcon platform and our single agent to provide functionality in the endpoint security, security and IT operations (including vulnerability management), and threat intelligence markets.

Today, our modules include:

Cloud Security

• Falcon Cloud Workload Protection—Cloud Runtime Protection.

Falcon Cloud Workload Protection provides comprehensive breach protection at run-time for workloads and containers as well as detecting vulnerabilities before services and images are deployed.

Falcon Cloud Workload Protection reduces the attack surface by automatically detecting vulnerabilities, hidden malware, secrets, keys, and more, enabling customers to build, run, and deploy secure applications with speed and confidence.

Falcon Cloud Workload Protection provides comprehensive breach protection at run-time for workload and container events and instance metadata, enabling faster and more accurate detection, response, threat hunting and investigation, and enabling customers to run and deploy secure applications with speed and confidence.

• Falcon Horizon—Cloud Security Posture Management .

1 unchanged sentence

Falcon Horizon automates the process to detect cloud related misconfigurations, vulnerabilities, and identity-based risks, providing step-by-step remediation and giving developers guardrails to avoid costly mistakes.

• Discover for Cloud and Containers—Cloud Service Discovery.

Discover for Cloud and Containers delivers comprehensive visibility of cloud assets, security configurations, workloads and containers across multi-cloud environments so customers can mitigate risks and reduce their attack surface.

Horizon also integrates with modern continuous integration/continuous delivery developer pipelines, with capabilities such as infrastructure as code scanning and container image assessment to shift secure design further left.

• Bionic, a CrowdStrike company—Application Security Posture Management.

Through our acquisition of Bionic, a pioneer of ASPM, we have further extended our capabilities in securing and providing cloud native applications.

Bionic gives security teams and developers visibility to their cloud applications, including interactions between cloud and on-premise microservices, third party dependencies, data flows, APIs and Software Bill of Materials— all without requiring access to source code.

This information empowers teams with an understanding of their risk landscape in the cloud, and is used together with Cloud Security Posture Management data to enhance context and prioritize remediation of misconfigurations.

Endpoint Security and XDR

2 unchanged sentences

• Falcon Insight XDR—Endpoint Detection and Response .

With industry-leading EDR at its core, Falcon Insight XDR synthesizes cross-domain telemetry and activates extended capabilities with one unified, threat-centric command console to unlock cross-domain detections, investigations and responses across the security stack.

With industry-leading EDR at its core, Falcon Insight XDR synthesizes cross-domain telemetry and activates extended triage and response capabilities with one unified, threat-centric incident workbench to unlock cross-domain detections, investigations and responses across the security stack.

• Falcon Insight XDR for IoT—Endpoint Detection and Response for Extended Internet of Things (XIoT) devices .

Falcon Insight XDR for IoT brings CrowdStrike’s renowned protection, detection and response to IoT, OT, medical devices, Industrial IoT, and connected devices across the enterprise.

• Falcon Device Control—Device Control .

2 unchanged sentences

Falcon Firewall Management provides centralized management of the firewall capabilities native to the host operating system, allowing customers to create, enforce, and maintain host firewall policies.

Security and IT Operations

• Falcon Data Protection—Data Loss Prevention .

Falcon Data Protection stops adversaries and malicious insiders from stealing sensitive information with automated policy enforcement that follows content, even as it moves across files.

Exposure Management

• Falcon Exposure Management—Exposure Management .

Falcon Exposure Management unifies real-time security and IT data sets from Falcon Discover (Asset, Account and App Discovery), Falcon Spotlight (Vulnerability Management), and Falcon Surface (External Attack Surface Management), as well as CrowdStrike’s renowned threat intelligence, endpoint, and XDR telemetry, to predict attack paths and guide risk mitigation actions that stop breaches before they happen.

• Falcon Discover—IT Hygiene and IoT .

Falcon Discover identifies rogue systems and applications in our customers’ networks, and monitors the use of privileged user accounts anywhere in a customer’s environments.

The module also enables use cases outside of security, such as application license management, Amazon Web Services (“AWS”) spend analysis, and asset inventory.

New enhancements in Falcon Discover for IoT minimize risk for IoT/OT (“Other Technology”) devices with comprehensive asset visibility, monitoring, and security hygiene.

Falcon Discover identifies managed, unmanaged, and rogue systems as well as applications and their usage in our customers’ networks, and monitors the use of privileged user accounts anywhere in a customer’s environments.

The module also enables use cases outside of security, such as application license management, Amazon Web Services (“AWS”) spend analysis, and asset inventorying.

New enhancements in Falcon Discover for IoT minimize risk for IoT/OT devices with comprehensive asset visibility, monitoring, and security hygiene.

• Falcon Spotlight—Vulnerability Management .

1 unchanged sentence

The module does not depend on scanning systems for vulnerabilities, a process that can often take days or weeks for an enterprise, and instead leverages data already collected by our agent to provide instant and accurate real-time visibility into an enterprise’s vulnerability exposure.

• Falcon Surface—External Attack Surface Management .

Falcon Surface allows customers to discover and map all internet-facing assets to shut down potential exposures with guided mitigation plans to reduce the attack surface and organizational risk.

• Falcon Forensics—Forensic Data for Analysis of Cybersecurity Incidents .

1 unchanged sentence

• Falcon FileVantage—File Integrity Monitoring .

Falcon FileVantage reduces compliance complexity by building in the services an additional agent would normally provide, including being able to monitor all files on the protected systems.

This in turn provides alerts and reports to help meet various compliance requirements imposed by the Payment Card Industry (“PCI”), the Center for Internet Security (“CIS”) Controls, and Sarbanes-Oxley.

Falcon FileVantage reduces compliance complexity by building in the services an additional agent would normally provide, including being able to monitor any file or registry key for changes on the protected systems.

This in turn provides alerts and reports to help meet various compliance requirements imposed by the Payment Card Industry, the Center for Internet Security Controls, and Sarbanes-Oxley.

Managed Services

• Falcon Complete—Turnkey Security Solution .

Falcon Complete provides comprehensive monitoring, management, response, and remediation solution to our customers and is designed to bring enterprise level security to companies that may lack enterprise level resources.

It is backed by an underwritten limited warranty policy for breaches.

We also offer Falcon Cloud Workload Protection Complete, Falcon Identity Threat Protection Complete, and Falcon Complete LogScale as add-ons to our Falcon Complete solution to extend its capabilities to include our cloud workload protection, identity protection, and log management modules.

Falcon Complete provides comprehensive monitoring, management, response, and remediation solutions to our customers and is designed to bring enterprise level security to companies that may lack enterprise level resources.

Falcon Complete offers a growing number of managed services that extend across Falcon platform modules, including Falcon Cloud Workload Protection Complete, Falcon Identity Threat Protection Complete, and Falcon Complete LogScale, augmenting core Falcon Complete Managed Detection and Response capabilities with managed cloud workload protection, identity threat protection, threat hunting, Log management and Next-Gen SIEM.

Falcon Complete is backed by an underwritten limited warranty policy for breaches.

Counter Adversary Operations

• Falcon OverWatch—Threat Hunting .

Falcon OverWatch is a threat hunting solution that consists of an elite team of dedicated security experts who work with the power of Threat Graph to proactively hunt on telemetry collected in the platform around the clock 24/7/365 to identify novel threats and attacks that might otherwise go unnoticed by security teams and the tools they use to monitor and detect advancing new threats in support of our customers.

Threat Intelligence

Falcon OverWatch is a threat hunting solution that consists of an elite team of dedicated security experts who work with the power of Threat Graph to proactively hunt on telemetry collected in the platform 24/7/365 to identify novel threats and attacks that might otherwise go unnoticed by security teams and the tools they use to monitor and detect advancing new threats in support of our customers.

• Falcon Intelligence—Threat Intelligence .

2 unchanged sentences

• Falcon Search Engine—Malware Search .

Falcon Search Engine enables customers to search in real time across over 8 petabytes of malware collected in our Falcon platform and indexed by our proprietary binary data indexing technology.

Falcon Search Engine enables customers to search in real time for malware collected in our Falcon platform and indexed by our proprietary binary data indexing technology.

• Falcon Sandbox—Malware Analysis .

3 unchanged sentences

These risks include, but are not limited to, digital fraud, data theft exposure, social media impersonations.

• Falcon Surface—External Attack Surface Management.

Falcon Surface (previously, Reposify) allows customers to discover and map all internet-facing assets to shut down potential exposures with guided mitigation plans to reduce the attack surface and organizational risk.

Identity Protection

• Falcon Identity Threat Protection—Zero Trust Security .

Falcon Identity Threat Protection provides frictionless Zero Trust security with real-time threat prevention and IT policy enforcement using identity, behavioral and risk analytics.

• Falcon Identity Threat Detection—Identity Threat Detection .

• Falcon Identity Threat Protection—Identity Threat Detection and Response .

Falcon Identity Threat Protection stops identity-based attacks with real-time threat prevention and IT policy enforcement using identity, behavioral and risk analytics.

• Falcon Identity Threat Detection—Identity Threat Detection and Response .

Falcon Identity Threat Detection provides visibility for identity-based attacks and anomalies, comparing live traffic against behavior baselines and rules to detect attacks and lateral movement.

Observability

• Falcon LogScale—Log Management .

Falcon LogScale is a high-performance, index-free cloud log management solution that allows customers to collect logs from any data source and to search and query streaming data in real-time.

Next-Generation SIEM and Log Management

• Falcon LogScale Next-Gen SIEM—Security Information & Event Management, Log Management .

Falcon LogScale Next-Gen SIEM is a complete SOC platform designed to stop breaches with AI-native detection, investigation and response, as well as delivering high-performance log management for any data source.

IT Automation

• Falcon for IT—IT Automation .

Falcon for IT converges security and IT operations with a single agent and unified platform.

Teams can use native generative AI workflows to get complete visibility into any asset to understand the asset’s state and take quick actions across the Enterprise to rapidly resolve issues.

Generative AI

• Charlotte AI—Generative AI .

Charlotte AI is a conversational assistant for security operations that can turn hours of work into minutes or seconds by harnessing the power of generative AI and natural language processing to help security analysts make faster, more accurate decisions with simple, plain language questions.

Application Development

• Falcon Foundry —Application Development .

The Falcon Foundry no-code application development platform allows customers to quickly create their own apps to solve custom security and IT use-cases with full access to CrowdStrike’s data, threat intelligence, automation, and cloud-scale infrastructure.

Bringing CrowdStrike to the Market

37 unchanged sentences

We grew our international revenue from $677.7 million for fiscal 2023 to $967.5 million for fiscal 2024, representing an increase of 43%.

We intend to grow our international customer base by increasing our investments in our overseas operations, including adding headcount in Europe, the Middle East, Asia-Pacific, including Japan, and expanding current data centers overseas.

• Extending Our Falcon Platform and Ecosystem.

2 unchanged sentences

We plan to continue investing in the CrowdStrike Store to empower our partners by making it easier to build applications and to enable our customers to more easily discover, try, and purchase additional cloud modules from both trusted partners and us.

We have experienced significant growth, with revenue increasing from $1.5 billion in fiscal 2022 to $2.2 billion in fiscal 2023, representing year-over-year growth of 54%, and from $874.4 million in fiscal 2021 to $1.5 billion in fiscal 2022, representing year-over-year growth of 66%.

Subscription revenue grew from $1.4 billion in fiscal 2022 to $2.1 billion in fiscal 2023, a 55% increase, and from $804.7 million in fiscal 2021 to $1.4 billion in fiscal 2022, a 69% increase.

We have experienced significant growth, with revenue increasing from $2.2 billion in fiscal 2023 to $3.1 billion in fiscal 2024, representing year-over-year growth of 36%, and from $1.5 billion in fiscal 2022 to $2.2 billion in fiscal 2023, representing year-over-year growth of 54%.

Subscription revenue grew from $2.1 billion in fiscal 2023 to $2.9 billion in fiscal 2024, a 36% increase, and from $1.4 billion in fiscal 2022 to $2.1 billion in fiscal 2023, a 55% increase.

Our Annual Recurring Revenue (“ARR”) has grown from $2.6 billion as of January 31, 2023 to $3.4 billion as of January 31, 2024, a 34% increase, and from $1.7 billion as of January 31, 2022 to $2.6 billion as of January 31, 2023, a 48% increase.

We had net losses of $183.2 million, $234.8 million, and $92.6 million in fiscal 2023, fiscal 2022, and fiscal 2021, respectively.

We expect to continue to incur net losses for the foreseeable future as we continue to invest in our business, and in particular, our sales and research and development capabilities, to address our large market opportunity.

We had net income of $89.3 million in fiscal 2024, and net losses of $183.2 million and $234.8 million in fiscal 2023 and fiscal 2022, respectively.

We have designed an innovative architecture from the ground up to overcome the limitations of existing security products and deliver cloud-based solutions.

7 unchanged sentences

We designed an intelligent lightweight agent that is installed on each endpoint or cloud workload.

This agent incorporates identification and prevention of known malware, machine learning for unknown malware, exploit blocking and advanced behavioral techniques, to protect workloads across all endpoints while capturing and recording high fidelity endpoint data.

Our agent continues to protect workloads running on endpoints even when offline.

This agent incorporates identification and prevention of known and unknown malware and fileless attacks using machine learning, AI, exploit blocking, and advanced behavioral techniques, to protect workloads across all endpoints while capturing and recording high fidelity endpoint data.

Our agent is capable of acting autonomously and continues to collect data and protect workloads running on endpoints even when offline.

The agent recommences transmitting data to our Falcon platform when the connection to the cloud has been re-established.

Our lightweight agent is built to support Windows, Mac, and Linux operating systems.

The agent is hardened against attacks and uses a combination of kernel and user-mode modules to collect high fidelity endpoint events as they take place on a system.

It correlates these events with a local situational model on the endpoint, analyzes via agent-based machine learning models and is capable of taking a variety of preventative and responsive actions on the endpoint, either automatically or via human control.

The agent is hardened against attacks and uses a combination of kernel and user-mode modules to collect and transmit high fidelity endpoint events as they take place on a system.

It correlates these events using a local situational model on the endpoint, analyzes via agent-based AI models and is capable of taking a variety of preventative and responsive actions on the endpoint, either automatically or via human control.

Events are streamed by the agent to the cloud in real time in order to be further analyzed in the Threat Graph, where additional correlation and AI algorithms can be applied.

The agent is also capable of being remotely reconfigured in real time based on analytics in our cloud platform in order to collect and analyze different events or take other actions.

The agent is also capable of being remotely reconfigured in real time based on analytics in our cloud platform to collect and analyze different events or take other actions as risk and threat postures change.

Threat Graph.

Threat Graph is our proprietary, powerful, and dynamic graph database.

Threat Graph continually looks for malicious activity by combining AI with behavioral pattern-matching techniques to look beyond file features and track the behaviors of every software program executed on an endpoint in a customer’s network environment.

Threat Graph is our proprietary, powerful, scalable, and dynamic graph database.

Threat Graph continually looks for malicious activity by combining AI with behavioral pattern-matching techniques to look beyond file features and track the behaviors of every OS process and software program executed on an endpoint in a customer’s network environment.

By applying powerful graph analytics and AI algorithms to cybersecurity, we enrich the data collected with our proprietary and third-party threat intelligence, such as adversary capabilities, motivations, attributions, and threat indicators.

1 unchanged sentence

We believe that our AI algorithms are advantaged by the rich proprietary dataset that we use to train them.

Threat Graph provides customers with complete real time and historical visibility and insight into events occurring on their endpoints for hunting and searching.

Threat Graph provides customers with complete real time and historical visibility and insight into events occurring on their endpoints for hunting and searching, even if the endpoint is unreachable or no longer exists.

Threat Graph also provides query and hunting capability over the full set of high fidelity events collected in the graph.

1 unchanged sentence

This collect-once, use repeatedly approach is the reason why we have been able to deliver new cloud modules covering IT hygiene and vulnerability management quickly and enables us to continue expanding the Falcon platform rapidly in the future.

Intel Graph analyzes and correlates massive amounts of data on adversaries, their victims and their tools, providing unrivaled insights into the shifts in tactics and techniques, powering our adversary-focused approach with world-class threat intelligence.

Asset Graph dynamically monitors and tracks the complex interactions among assets, providing a single holistic view of the risks those assets pose.

Asset Graph provides graph visualizations of the relationships among all assets such as devices, users, accounts, cloud workloads, and OT along with the rich context necessary for proper security hygiene and proactive security posture management to reduce risk in their organizations.

Intel Graph analyzes and correlates massive amounts of data on adversaries, their victims and their tools, providing extraordinary insights into shifting adversary tactics and techniques, powering our adversary-focused approach with world-class threat intelligence.

Asset Graph dynamically monitors and tracks the complex interactions among enterprise entities, providing a single holistic view of the risks those assets pose.

Asset Graph provides graph visualizations of the relationships among entities and assets such as devices, users, accounts, cloud workloads, along with the rich context necessary for proper security hygiene and proactive security posture management to reduce risk in their organizations.

High Fidelity Data and Smart Filtering.

Absent an intelligent agent, a typical endpoint generates approximately 100 gigabytes of unfiltered system event data per day.

After this data is compressed, or data shaped, a typical enterprise organization with 100,000 endpoints would generate over one petabyte of endpoint events daily.

The presence of a local graph model in our agent enables it to track the state of the machine in real time, perform rapid machine learning and behavioral analysis, and provide efficient event streaming to the cloud.

We call this “smart filtering.” This allows us to keep performance overhead on the endpoint to a minimum, dramatically reduce the bandwidth required for agent-cloud communication, efficiently process large volumes of data, and separate signals from noise.

The Falcon agent collects and analyzes unfiltered data with local machine learning and behavioral algorithms on the endpoint but only streams high fidelity endpoint events to the cloud to only send what is necessary for detection, prevention and investigation of attacks.

This smart filtering architecture allows us to reduce network load for customers on average between five to eight megabytes per endpoint per day.

The Falcon agent collects and analyzes unfiltered data with local machine learning and behavioral algorithms on the endpoint but only streams high fidelity endpoint events to the cloud to just send what is necessary for detection, prevention and investigation of attacks.

This smart filtering architecture allows us to reduce network load for our customers.

The Falcon platform collects an array of high fidelity endpoint events, such as code execution, network, file system and user activity.

4 unchanged sentences

APIs and Integrations.

Our Falcon platform and architecture is built around a rich set of APIs that efficiently and effectively complement and expand a customer’s existing security infrastructure, such as security information event management, or SIEMs, and intrusion prevention systems and intrusion detection systems.

Our Falcon platform and architecture is built around a rich set of APIs that efficiently and effectively complement and expand a customer’s existing security infrastructure, such as security information event management, or SIEMs, intrusion prevention systems and intrusion detection systems.

The platform includes streaming, query and batch APIs allowing customers and partners to integrate a variety of solutions seamlessly.

3 unchanged sentences

Data Center Operations

We have data center co-location facilities throughout the United States and in Europe, and we also utilize AWS data centers located in the United States and Europe.

Our technology infrastructure, combined with select use of AWS resources, provides us with a distributed and scalable architecture on a global scale.

We have data center co-location facilities throughout the United States and in Europe, and we also utilize third-party data centers located in the United States and Europe.

Our technology infrastructure, combined with select use of third-party resources, provides us with a distributed, resilient and scalable architecture on a global scale.

Professional Services

In addition to our Falcon platform and cloud modules, we also offer incident response and forensic investigatory services, technical assessment and strategic advisory services, as well as training to assist organizations that have experienced a breach or are assessing their security posture and ability to respond to breaches.

• Incident Response and Forensics Services.

In addition to our Falcon platform and cloud modules, we also offer incident response, forensic investigatory, and breach recovery services;

technical assessment and strategic advisory services;

as well as training to assist organizations that have experienced a breach or who are assessing their security posture and ability to respond to breaches.

• Incident Response, Forensics, and Recovery Services.

Our incident response services typically begin by deploying our lightweight agent to a customer’s endpoints or cloud workloads to provide comprehensive visibility in order to determine if an attacker is currently in the environment, what assets have been compromised, and how much damage has been done.

The full suite of Falcon platform’s next-gen prevention capabilities, cloud posture management, vulnerability/asset management, identity protection and now attack surface management offerings can also be leveraged to enrich the response team’s visibility and understanding of the attack as well as help to slow down and prevent an active attacker from moving at-will throughout a compromised customer’s environment, increasing the risk and potential damage to the customer.

We also provide customized surgical remediation services by providing the tools and staffing to eject attackers out of the network, lock down credentials from further use, remediate impacted systems and ensure adversaries stay out.

In addition to enriching the response team’s understanding of the attack, the full suite of Falcon platform’s next-gen prevention capabilities, cloud security, exposure management, and identity protection offerings can also be leveraged to help to slow down and prevent an active attacker from moving at-will throughout a compromised customer’s environment, increasing the risk and potential damage to the customer.

We also provide customized surgical recovery services by providing the tools and staffing to eject attackers out of the network, lock down credentials from further use, remediate impacted systems and ensure adversaries stay out.

In addition to providing valuable breach remediation to our customers, our incident response services also act as a strong lead generation engine for our Falcon platform and cloud modules.

After experiencing the benefits of our platform firsthand, many of our incident response customers become subscription customers.

Among organizations who first became a customer after February 1, 2021, for each $1.00 spent by those

customers on their initial engagement for our incident response or proactive services, as of January 31, 2023, we derived an average of $6.07 in ARR from those subscription contracts.

• Technical Assessment and Strategic Advisory Services .

3 unchanged sentences

These services are designed to evaluate our customers’ security profile so they can identify areas of vulnerability, secure their network, and improve their response if their defenses are breached.

Our services also align to executive and board level cybersecurity training and awareness, including by helping public companies more confidently comply with public disclosure requirements relating to assessing, identifying and managing material cybersecurity risks, and reporting material cyber incidents.

Our programs are designed to help organizations effectively achieve cybersecurity risk reduction objectives and to maximize investments.

We offer training and certification services to customers and partners on CrowdStrike technologies and cybersecurity topics to facilitate the adoption of CrowdStrike and to broaden and deepen their skills.

CrowdStrike University is an online learning management system that organizes all CrowdStrike e-learning, instructor-led training and certification preparation courses in one place, providing a personalized learning experience for individuals who have an active training subscription.

CrowdStrike currently offers proctored exam certifications through industry leading training partner Pearson Vue for its CrowdStrike Certified Falcon Administrator (“CCFA”), CrowdStrike Certified Falcon Responder (“CCFR”), and CrowdStrike Certified Falcon Hunter (“CCFH”) programs.

CrowdStrike currently offers proctored exam certifications through industry leading training partner Pearson Vue for its CrowdStrike Certified Falcon Administrator, CrowdStrike Certified Falcon Responder, CrowdStrike Certified Falcon Hunter, CrowdStrike Certified Cloud Specialist, and CrowdStrike Certified Identity Specialist programs.

Some of the world’s largest enterprises, government organizations, and high profile brands trust us to protect their business.

11 unchanged sentences

Our marketing organization is focused on building our brand reputation, increasing the awareness and reputation of our platform, and driving customer demand.

As part of these efforts, we deliver targeted content to demonstrate thought leadership in the security industry, including speaking engagements with the security industry’s foremost organizations to provide expert advice, issuing regular reports on the state of the industry, educating the public about the cybersecurity threats, and identifying and naming adversary groups.

As part of these efforts, we deliver targeted content to demonstrate thought leadership in the security industry, including speaking engagements with the security industry’s foremost organizations to provide expert advice, issuing regular reports on the state of the industry, educating the public about cybersecurity threats, and identifying and naming adversary groups.

We also engage in paid media, web marketing, industry and trade conferences (including our annual Fal.Con conference), analyst engagements, whitepaper development, demand generation via digital and web, and targeted displacement campaigns.

We employ a wide range of digital programs, including search engine marketing, online and social media initiatives, and content syndication to increase traffic to our website and encourage prospective customers to sign up for a free trial of the Falcon platform.

free trial of the Falcon platform.

Additionally, we engage in joint marketing activities with our channel and technology alliance partners.

6 unchanged sentences

Research and Development

Our research and development organization is responsible for the design, architecture, operation and quality of our cloud native Falcon platform.

In addition, the research and development organization works closely with our customer success teams to ensure customer satisfaction is the top priority.

Our research and development organizations are responsible for the design, architecture, operation and quality of our cloud native Falcon platform.

In addition, the research and development organizations work closely with our customer success teams to promote customer satisfaction.

Our success is a result of our continuous drive for innovation.

Our internal team of security experts, researchers, intelligence analysts, and threat hunters continuously analyzes the evolving global threat landscape to develop products that defend against today’s most sophisticated and stealthy attacks and reports on emerging security issues.

We invest substantial resources in research and development to enhance our Falcon platform, and develop new cloud modules, features and functionality.

5 unchanged sentences

Our research and development leadership team is located in Seattle, Washington and Sunnyvale, California.

We also maintain research and development centers in Irvine, California, and Israel.

We also maintain research and development centers in Irvine, California, Minneapolis, Minnesota, Bucharest, Romania, Israel and India.

We employ subject matter experts in a number of jurisdictions around the world.

7 unchanged sentences

• alternative endpoint security providers who generally offer a mix of on-premises and cloud-hosted products that rely heavily on malware-only or application whitelisting techniques;

• network security vendors who are supplementing their core perimeter-based offerings with endpoint security solutions;

• network security vendors who are supplementing their core perimeter-based offerings with endpoint or cloud security solutions;

• cloud security vendors, including those who focus on public cloud infrastructure and services;

• identity security vendors that seek to identify and secure user accounts and related activities;

• professional service providers who offer cybersecurity response services.

12 unchanged sentences

Though we rely in part upon these legal and contractual protections, we believe that factors such as the skills and ingenuity of our employees and the functionality and frequent enhancements to our solutions are larger contributors to our success in the marketplace.

We continue to grow our global portfolio and intellectual property rights in connection with our products, services, research and development, and other activities to protect our proprietary technology relevant to our business.

We continue to grow our global portfolio of intellectual property rights in connection with our products, services, research and development, and other activities to protect our proprietary technology relevant to our business.

We file patent applications to protect our intellectual property and believe that the duration of our issued patents is sufficient when considering the expected lives of our products.

17 unchanged sentences

Net new ARR generation is typically greater in the second half of the year, particularly in the fourth quarter, as compared to the first half of the year.

In addition, we also experience seasonality in our operating margin, typically with a lower margin in the first half of our fiscal year due to a step up in costs for payroll taxes, new hires, and annual sales and marketing events.

In addition, we also experience seasonality in our operating margin, typically with a lower margin in the first half of our fiscal year due to a step up in costs for payroll taxes and annual sales and marketing events.

This also impacts the timing of operating cash flow.

7 unchanged sentences

Supporting our people is a foundational value for CrowdStrike.

We believe the company’s success depends on our ability to attract, develop and retain key personnel.

The skills, experience and industry knowledge of key employees significantly benefit our customers, operations and performance.

We believe the company’s success depends on our ability to attract, retain and develop employees.

The skills, experience and industry knowledge of key employees significantly benefit our customers, operations and our overall company performance.

Our talent sourcing is aligned to our organizational strategy to provide the expertise and skills needed to move our mission forward.

We have created a high performance talent model that pinpoints the top traits and qualities we look for in talent and that may already exist within the organization, then consistently use that model to develop interview questions, screen candidates, and make hiring decisions.

We continue to market to and recruit technical talent in diverse communities by engaging as a high-level sponsor or partner of professional conferences and organizations such as Grace Hopper, Society of Women Engineers, Afrotech - Blavity World, Hire Military, Black Girls Code, Thurgood Marshall College Foundation, and others.

We continue to market to and recruit technical talent in diverse communities by engaging as a high-level sponsor or partner of professional conferences and organizations such as Grace Hopper, Women in Cyber Security, AfroTech, American Corporate Partners, American Indian Science and Engineering Society, Out in Tech, and others.

To attract high performers, we have a team dedicated to building and promoting our employer brand focused on creating a strong employer value proposition:

5 unchanged sentences

We provide robust compensation and benefits programs to help meet the needs of our employees.

In addition to base salary, these programs (which vary by country/region) include annual bonuses or commission plans, equity awards, an employee stock purchase plan, a 401(k) plan, healthcare and insurance benefits, health savings and flexible spending accounts, paid time off, family leave, family care resources, flexible work schedules, adoption and infertility assistance, and employee assistance programs.

In addition to base salary, these programs (which vary by country/region) include annual bonuses or commission plans, equity awards, an employee stock purchase plan, a 401(k) plan or pension schemes internationally, healthcare and insurance benefits, health savings and flexible spending accounts, paid time off, family leave, family care resources, flexible work schedules, adoption and infertility assistance, and employee assistance programs.

We invest resources to develop the talent needed to remain a leader in cybersecurity.

2 unchanged sentences

For CrowdStrike, the ability to work remotely or in a hybrid arrangement is a deliberate strategy that we believe fuels rapid innovation and helps us attract, hire and retain the best and brightest around the world, regardless of their specific location.

Our culture is purpose-built around this ability, creating a competitive advantage for both the company and its customers and minimizing disruption from localized issues such as natural disasters, political events, or health emergencies, such as the COVID-19 pandemic.

CrowdStrike has had a distributed workforce since its inception.

3 unchanged sentences

Part of supporting our remote and hybrid culture also involves actively encouraging personal well-being through initiatives, including wellness programs, engagement programs (speaker series, employee resource groups, gift exchanges, mentorship opportunities, virtual events, etc.), community outreach activities, recognition programs, and groups to connect people, no matter where they are geographically, with similar interests, life circumstances or backgrounds.

We continue to find ways to bring our employees together to build community and camaraderie.

Diversity, Equity, and Inclusion

7 unchanged sentences

Employee Resource Groups are an integral component of our commitment to foster community, promote a sense of belonging, facilitate organizational change, and drive a greater understanding of the diversity of perspectives we have across CrowdStrike.

In addition to the Embracing Equity majority ally group, we have seven official Employee Resource Groups and we anticipate additional groups in the future:

In addition to the Embracing Equity majority ally group, we have nine official Employee Resource Groups and Affiliate Groups, and we anticipate additional groups in the future:

• Women of CrowdStrike

5 unchanged sentences

• Communidad (Latine and Hispanic employees)

• Embracing Equity

• Mazel (Jewish community)

Our Employee Resource Groups are employee led, self-directed, voluntary groups that align with our organizational mission, values, and goals that offer opportunities for groups to network, recommend business initiatives and process improvements, increase organizational awareness and allyship, and create opportunities for talent development.

18 unchanged sentences

in October 2004.

Since November 2017, he has also served as Chairman as a board member, and as President for the CrowdStrike Foundation, a nonprofit established to support the next generation of talent and research in cybersecurity and artificial intelligence through scholarships, grants, and other activities.

He has also served on the board of directors of Hewlett Packard Enterprise, an enterprise information technology company, since June 2019.

Since November 2017, he has also served as Chairman of the Board, and as President for the CrowdStrike Foundation, a nonprofit established to support the next generation of talent and research in cybersecurity and artificial intelligence through scholarships, grants, and other activities.

He also served on the board of directors of Hewlett Packard Enterprise, an enterprise information technology company, from June 2019 to April 2023.

Kurtz holds a B.S.

21 unchanged sentences

Henry has served as a director of ShoulderUp Technology Acquisition Corp., a blank check company that completed its initial public offering in November 2021.

Henry also serves on the board of directors of the Global Cyber Alliance, a nonprofit organization dedicated to making the Internet a safer place by reducing cyber risk, and on the advisory board of several organizations, including Hofstra University’s School of Engineering and Applied Science.

Henry also serves on the board of directors of CLEAR, a biometric travel document verification company, and Global Cyber Alliance, a nonprofit organization dedicated to making the Internet a safer place by reducing cyber risk.

Additionally, Mr.

Henry serves on the advisory boards of several organizations.

Henry holds a B.B.A.

10 unchanged sentences

He is an active public speaker on security issues and advises government and business communities on global and local cyber security threats.

Sentonas holds a bachelor’s degree in computer science from Edith Cowan University, Western Australia.

Sentonas holds a B.S.

in computer science from Edith Cowan University, Western Australia.

Corporate Information

9 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business