✦ Identity After SGNLThin moat

CrowdStrike (CRWD) — the future bets

CrowdStrike paid $627.9 million for SGNL to put identity on its platform, a small bet next to Palo Alto's $21 billion CyberArk deal.

Identity is the category CrowdStrike most needs and where rivals are spending most. Its largest acquisition so far, SGNL, cost $627.9 million in cash in February 20261. In the second quarter it "Unveiled Continuous Identity for AI Agents, extending risk-aware authorization across human, non-human, and AI agent identities"2.

Identity acquisitions compared ($M)Palo Alto: CyberArk, booked21,061CrowdStrike: SGNL, cash627.9Palo Alto Networks FY2026 10-K; CrowdStrike Q2 FY2027 10-Q
About three cents for every dollar of the rival bet.

The competition is on a different scale. Palo Alto booked its CyberArk acquisition at $21,061 million3, more than 33 times what CrowdStrike paid for SGNL4. Microsoft Entra, bundled with Microsoft's software, has passed one billion monthly active users5. CrowdStrike's 10-K lists "identity security vendors that seek to identify and secure user accounts and related activities" among its rivals6.

CrowdStrike's argument is architectural. An attacker who steals a password still has to use it from a machine, and the sensor on that machine sees what happens next. Adding authorisation to the platform, rather than buying a separate identity company, keeps the product behind one agent and one console. The company paid for this with a string of deals: $881.4 million of cash on acquisitions in the first half of fiscal 2027 alone7.

The bet can fail in two ways. Customers may prefer an identity specialist or the bundled Microsoft product, leaving CrowdStrike's identity modules as extras. Or the integration may take longer than the market allows. Neither will show in a single figure, because CrowdStrike does not report identity revenue.

The cash going into acquisitions is the proxy. It was $881.4 million in six months; if spending of that size continues without a visible lift in net new ARR above the guided 34% growth8, identity is being bought rather than won.

Moat trajectory: Holding steady

SGNL $627.9M; $881.4M on acquisitions in H1 FY2027.

The number that tests this moat
Reported
Cash spent on acquisitions, latest six months
$881.4M (H1 FY2027)

The price of building identity and other categories by purchase; continued spending without faster net new ARR would mean the categories are bought, not won.

Source: CrowdStrike Q2 FY2027 results release ↗
References
  1. ReportedIts largest acquisition so far, SGNL, cost $627.9 million in cash in February 2026.
    CrowdStrike Form 10-Q for the quarter ended 31 July 2026 - remaining performance obligations of $10.7 billion (46% within twelve months), unbilled backlog of $5.9 billion, the SGNL, Seraphic and XM Cyber transactions, the $750 million 3.00% senior notes, legal proceedings, the DOJ and SEC requests, purchase commitments and the share repurchase programme. — Q2 FY2027 · publ. 27 August 2026 · source ↗
  2. ReportedIn the second quarter it "Unveiled Continuous Identity for AI Agents, extending risk-aware authorization across human, non-human, and AI agent identities".
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - second-quarter results, ARR, net new ARR, margins, module adoption and recent highlights. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  3. ReportedPalo Alto booked its CyberArk acquisition at $21,061 million, more than 33 times what CrowdStrike paid for SGNL.
    Palo Alto Networks Form 10-K for fiscal 2026 - competitors in four categories, naming Alphabet, Cisco and Microsoft among large companies that incorporate security in their products and CrowdStrike, Check Point, Delinea, Fortinet, Okta, SailPoint and Zscaler among independent security vendors; and the CyberArk acquisition, booked at $21,061 million. — FY2026 (year to 31 July 2026) · publ. 10 September 2026 · source ↗
  4. Moat Explorer calcPalo Alto booked its CyberArk acquisition at $21,061 million, more than 33 times what CrowdStrike paid for SGNL.
    Moat Explorer calculation from CrowdStrike's reported figures ($ millions unless stated; fiscal years end 31 January). Revenue growth: FY2019 249.8 / 118.8 - 1 = 110.4%; FY2020 481.4 / 249.8 - 1 = 92.7%; FY2021 874.4 / 481.4 - 1 = 81.6%, about 82%; FY2022 1,451.6 / 874.4 - 1 = 66.0%; FY2023 2,241.2 / 1,451.6 - 1 = 54.4%; FY2024 3,055.6 / 2,241.2 - 1 = 36.3%; FY2025 3,953.6 / 3,055.6 - 1 = 29.4%, about 29%; FY2026 4,812.0 / 3,953.6 - 1 = 21.7%, about 22%; FY2024 to FY2026 4,812.0 / 3,055.6 - 1 = 57.5%, about 57%; compound FY2018-FY2026 (4,812.0 / 118.8)^(1/8) - 1 = 58.8%, about 59%; revenue grew about 40 times in eight years (4,812.0 / 118.8 = 40.5); FY2027 guidance midpoint (5,991.1 + 6,011.1) / 2 = 6,001.1, 6,001.1 / 4,812.0 - 1 = 24.7%, about 25%; H1 FY2027 revenue 2,856.5 / 6,001.1 = 47.6%; trailing revenue to 31 July 2026 4,812.0 - 2,272.4 + 2,856.5 = 5,396.1, about $5.40 billion. Subscription growth: FY2019 219.4 / 92.6 - 1 = 137.0%; FY2020 98.9%; FY2021 804.7 / 436.3 - 1 = 84.4%; FY2022 69.0%; FY2023 2,111.7 / 1,359.5 - 1 = 55.3%; FY2024 35.9%; FY2025 3,761.5 / 2,870.6 - 1 = 31.0%; FY2026 4,564.7 / 3,761.5 - 1 = 21.4%; H1 FY2027 2,721.1 / 2,153.7 - 1 = 26.3%, about 26%; compound FY2018-FY2026 (4,564.7 / 92.6)^(1/8) - 1 = 62.8%. Subscription added: FY2022 1,359.5 - 804.7 = 554.9; FY2023 2,111.7 - 1,359.5 = 752.1; FY2024 2,870.6 - 2,111.7 = 758.9; FY2025 890.9; FY2026 803.2. Subscription share of revenue FY2018 92.6 / 118.8 = 78%. Subscription gross profit FY2026 4,564.7 - 1,015.9 = 3,548.8. Professional services: revenue FY2018 118.8 - 92.6 = 26.2; FY2024 185.0 / 129.6 - 1 = 42.8%; FY2025 192.1 / 185.0 - 1 = 3.9%, about 4%; FY2026 247.3 / 192.1 - 1 = 28.7%, about 29%; compound FY2018-FY2026 (247.3 / 26.2)^(1/8) - 1 = 32.4%; gross profit FY2026 247.3 - 203.0 = 44.3; GAAP gross margin 44.3 / 247.3 = 17.9%, about 18%; share of gross profit 44.3 / 3,593.1 = 1.2%. Region: FY2026 growth United States 3,216.7 / 2,682.9 - 1 = 19.9%; EMEA 782.7 / 619.5 - 1 = 26.3%; Asia Pacific 495.7 / 402.5 - 1 = 23.2%; Other 317.0 / 248.7 - 1 = 27.4%. United States share FY2018 99.2 / 118.8 = 84%. ARR and net new ARR: ARR compound FY2018-FY2026 (5,252.8 / 141.3)^(1/8) - 1 = 57.1%, about 57%; net new ARR FY2026 5,252.8 - 4,241.8 = 1,010.9; FY2026 growth 1,010.9 / 806.7 - 1 = 25.3%, about 25%; FY2025 change 806.7 / 875.5 - 1 = -7.9%; FY2024 875.5 / 828.4 - 1 = 5.7%; FY2023 828.4 / 681.3 - 1 = 21.6%; H1 FY2027 net new ARR 255.8 + 332.8 = 588.6; FY2027 guided net new ARR 6,607.5 - 5,252.8 = 1,354.7; FY2027 ARR guidance midpoints: March (6,465.8 + 6,516.4) / 2 = 6,491.1, June (6,531.7 + 6,555.5) / 2 = 6,543.6, August (6,603.0 + 6,611.9) / 2 = 6,607.5; 6,607.5 / 5,252.8 - 1 = 25.8%, about 26%; FY2036 goal (20,000 / 5,252.8)^(1/10) - 1 = 14.3% a year; average net new ARR (20,000 - 5,252.8) / 10 = 1,474.7, about 1.47 billion. Falcon Flex: share of ARR 2.29 / 5.84 = 39%; Flex-account ARR a year earlier 2.29 / 2.01 = 1.14 billion; ARR outside Flex accounts 4.66 - 1.14 = 3.52 billion (July 2025) and 5.84 - 2.29 = 3.55 billion (July 2026), growth 3.55 / 3.52 - 1 = 0.8%, under 1%; ARR added 5.84 - 4.66 = 1.18 billion, of which Flex accounts 2.29 - 1.14 = 1.15 billion. Contracts: RPO within twelve months 0.46 x 10.7 = 4.9 billion (July 2026) and 0.51 x 9.0 = 4.6 billion (January 2026); RPO after twelve months 0.54 x 10.7 = 5.8 billion, 54% of RPO (July 2026), 0.49 x 9.0 = 4.4 billion (January 2026), 0.47 x 6.5 = 3.1 billion (January 2025), 0.37 x 3.4 = 1.3 billion (January 2023); RPO growth six months to July 2026 10.7 / 9.0 - 1 = 18.9%; FY2026 9.0 / 6.5 - 1 = 38.5%; RPO / trailing revenue 10.7 / 5.40 = about two years; unbilled backlog 5.9 / 2.8 - 1 = 111% in eighteen months. Deferred revenue 31 July 2026 3,497.1 + 1,345.1 = 4,842.2, about $4.84 billion; noncurrent share 1,345.1 / 4,842.2 = 27.8%, just over a quarter; deferred revenue 31 January 2025 2,733.0 + 995.7 = 3,728.7, 31 January 2026 3,421.1 + 1,332.4 = 4,753.4, growth 27.5%. Accounts receivable 1,038.6 / 1,470.9 = 71% of quarterly revenue. Subscription customers 29,000 / 23,019 - 1 = 26.0%, about 26%. H1 FY2027 revenue growth 2,856.5 / 2,272.4 - 1 = 25.7%, about 26%; H1 capital expenditure 222.0 / 116.2 = 1.9 times. Revenue per subscription customer FY2024 3,055.6 / 29,000 = about $105,000. Cash, costs and stock pay: GAAP operating margin FY2026 -293.3 / 4,812.0 = -6.1%; free cash flow margin FY2026 1,235.3 / 4,812.0 = 25.7%; FY2025 1,065.1 / 3,953.6 = 26.9%; FY2024 938.2 / 3,055.6 = 30.7%; free cash flow after stock pay 1,235.3 - 1,096.7 = 138.6, 138.6 / 4,812.0 = 2.9%; stock pay (cash flow) 1,096.7 / 4,812.0 = 22.8% (FY2026), 861.4 / 3,953.6 = 21.8% (FY2025), 648.7 / 3,055.6 = 21.2% (FY2024); stock pay and payroll tax 1,130.6 / 4,812.0 = 23.5% (FY2026), 903.6 / 3,953.6 = 22.9% (FY2025), 399.0 / 1,470.9 = 27.1% (Q2 FY2027), 276.7 / 1,169.0 = 23.7% (Q2 FY2026). Capital expenditure growth FY2024-FY2026 302.1 / 176.5 - 1 = 71.2%, about 71%; capex share of revenue FY2024 176.5 / 3,055.6 = 5.8%, FY2026 302.1 / 4,812.0 = 6.3%. Net cash 5,230.1 - 745.5 = 4,484.6, about $4.5 billion. Non-GAAP operating income guidance midpoint (1,497.2 + 1,508.4) / 2 = 1,502.8, 1,502.8 / 1,050 - 1 = 43%. July 19 incident net costs 60.1 + 117.7 = 177.8 (FY2025-FY2026) and 177.8 + 3.6 = 181.4, about $181 million through July 2026; update live 04:09 to 05:27 UTC = 78 minutes; cash against Delta claim 5,010 / 500 = about 10 times; a $250 million charge against free cash flow 250 / 1,235.3 = 20%, about a fifth. Acquisitions: cash consideration 96.4 + 213.7 + 252.7 + 212.1 + 327.5 + 627.9 = 1,730.3, about $1.7 billion; CyberArk against SGNL 21,061 / 627.9 = 33.5 times. Valuation: market value against Palo Alto Networks 258.72 / 306.54 = 0.84; Palo Alto price to sales 306.54 / 11.48 = 26.7; market value 25 September 2026 against 31 January 2026 258.718 / 111.278 = 2.3 times; price to trailing sales 258.718 / 5.396 = 47.9; analyst target 235.67 / 252.13 - 1 = -6.5%; market value over fiscal revenue 10.25 / 0.4814 = 21.3 (FY2020, December 2019 value), 46.86 / 0.8744 = 53.6 (FY2021, December 2020 value) - valuation, cash flow, stock pay, capital spending, acquisitions and the July 2024 incident. — FY2018-FY2027 · publ. September 2026 · source ↗
    Method: Arithmetic on figures reported in CrowdStrike's Forms 10-K and 10-Q, its results releases and market data; operands shown in the source line.
  5. Third-party estimateMicrosoft Entra, bundled with Microsoft's software, has passed one billion monthly active users.
    Zacks via Yahoo Finance, 30 June 2026, on Microsoft's security business - Microsoft 365 E5 and Copilot bundle security and compliance capabilities, the security stack processes 100 trillion daily signals, Microsoft Entra has passed one billion monthly active users, and neither CrowdStrike nor Palo Alto can pair security with a productivity or hyperscale cloud franchise. — June 2026 · publ. 30 June 2026 · source ↗
  6. ReportedCrowdStrike's 10-K lists "identity security vendors that seek to identify and secure user accounts and related activities" among its rivals.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1A risk factors and Item 3 legal proceedings: competition, the July 19 incident, customer commitment packages, insurance and litigation. — FY2026 · publ. 5 March 2026 · source ↗
  7. ReportedThe company paid for this with a string of deals: $881.4 million of cash on acquisitions in the first half of fiscal 2027 alone.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - fiscal 2027 and third-quarter guidance. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  8. ReportedIt was $881.4 million in six months; if spending of that size continues without a visible lift in net new ARR above the guided 34% growth, identity is being bought rather than won.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - fiscal 2027 and third-quarter guidance. — Q2 FY2027 · publ. 26 August 2026 · source ↗
Sources
Generated September 28, 2026