Customers Who Stay and Spend MoreWide moat

CrowdStrike (CRWD) — moat facet

CrowdStrike's customers almost never leave, and they spend about 15% more each year, though that is ten points less extra than in 2023.

A security vendor's moat shows up in two numbers: how much revenue stays, and how much more existing customers buy. On the first CrowdStrike is excellent. Gross retention was 97% at January 20251, and it was reported above 97% four months after the July 2024 outage2.

Retention at the latest disclosed date (%)Gross retention, Jan 202597%Net retention, Jan 2023125.3%Net retention, Jan 2025112%Net retention, Jan 2026115%CrowdStrike Forms 10-K and Q4 FY2025 results release
Almost nothing leaves; expansion has slowed.

On the second it is good but slower than it was. Net retention, the spend of existing customers a year later after losses and upsell, was 125.3% at January 20233, fell to 119% and then 112%45, and recovered to 115% at January 20266.

The recovery is now visible every quarter. Net new ARR was a record $332.8 million in the quarter to 31 July 2026, up 51%7, and ARR reached $5.84 billion, up 25%8. The engine behind much of it is Falcon Flex, where customers commit a budget up front and draw it down across products; accounts using Flex carried more than $2.29 billion of ARR, up 101%9, about 39% of the total10.

Why this is a moat: the sensor sits on every machine, so leaving means reinstalling security across the whole company, and the numbers show customers almost never do. A base that kept about 97% of its revenue through the outage has switching costs that do not depend on goodwill.

Why it is narrower than it looks: net retention is ten points below its 2023 level, and part of the decline came before the outage. The company also publishes less than it used to: the subscription customer count stopped at 29,000 in the fiscal 2024 report11, and gross retention is now described without an exact figure12.

New customers increasingly arrive by a free route. Falcon Go can be downloaded as a trial from CrowdStrike's website and from the AWS, Google and Microsoft marketplaces13, and the company says it now sells to small and medium-sized businesses mainly through this trial-to-pay model14. Those Falcon Go customers are left out of the module ratios15, so the expansion figures describe the larger accounts.

Net retention is the verdict. It was 115% at January 202616; a figure back above 119%, the pre-outage level, would show expansion is fully restored, while a slide below 112% would say the Flex surge borrowed from future spending.

Moat trajectory: Widening

Net retention 112% (Jan 2025) to 115% (Jan 2026).

The number that tests this moat
Reported
Dollar-based net retention
115% (Jan 2026), from 112%

Expansion by existing customers; back above 119% would show it restored, below 112% would mean Flex borrowed from future spending.

Source: CrowdStrike Form 10-K, FY2026 ↗
Aspects of the moat
DIG DEEPER 01
Ninety-Seven Percent Gross Retention
CrowdStrike kept about 97% of its recurring revenue through the year it crashed millions of customer machines.
DIG DEEPER 02
Net Retention From 125% to 115%
CrowdStrike's customers still spend 15% more each year, but the expansion rate fell ten points before the outage finished the job.
DIG DEEPER 03
Falcon Flex: Commit First, Choose Later
Falcon Flex lets customers commit a budget first and pick products later, and accounts using it now carry about 39% of CrowdStrike's ARR.
DIG DEEPER 04
Reinstalling Every Endpoint
Replacing CrowdStrike means reinstalling security software on every machine a company owns, which is why ARR kept growing through the outage.
⚠ Threats to the moat
⚠ THREAT 01
Discounts Dressed as Expansion
Some of CrowdStrike's post-outage module gains came as discounted extras that must now convert to paid.
⚠ THREAT 02
The Customer Count Went Dark
CrowdStrike's last published customer count is 29,000, from January 2024.
References
  1. ReportedGross retention was 97% at January 2025, and it was reported above 97% four months after the July 2024 outage.
    CrowdStrike fourth-quarter and fiscal 2025 results release, Form 8-K exhibit 99.1 - 97% gross retention, module adoption and Falcon Flex deal value. — Q4 FY2025 · publ. 4 March 2025 · source ↗
  2. ReportedGross retention was 97% at January 2025, and it was reported above 97% four months after the July 2024 outage.
    CrowdStrike third-quarter fiscal 2025 results release, Form 8-K exhibit 99.1 - over 97% gross retention and 20% of customers with eight or more modules. — Q3 FY2025 · publ. 26 November 2024 · source ↗
  3. ReportedNet retention, the spend of existing customers a year later after losses and upsell, was 125.3% at January 2023, fell to 119% and then 112%, and recovered to 115% at January 2026.
    CrowdStrike Form 10-K for fiscal 2023 - 23,019 subscription customers, net retention of 125.3%, net new ARR of $828.4 million, RPO of $3.4 billion and revenue by region. — FY2023 · publ. March 2023 · source ↗
  4. ReportedNet retention, the spend of existing customers a year later after losses and upsell, was 125.3% at January 2023, fell to 119% and then 112%, and recovered to 115% at January 2026.
    CrowdStrike Form 10-K for fiscal 2024 - 29,000 subscription customers, net retention of 119%, net new ARR of $875.5 million and RPO of $4.6 billion. — FY2024 · publ. March 2024 · source ↗
  5. ReportedNet retention, the spend of existing customers a year later after losses and upsell, was 125.3% at January 2023, fell to 119% and then 112%, and recovered to 115% at January 2026.
    CrowdStrike Form 10-K for fiscal 2025 - net retention of 112%, RPO of $6.5 billion with 53% due within twelve months, unbilled backlog of $2.8 billion, the Flow Security and Adaptive Shield acquisitions, and revenue and cost changes for fiscal 2025. — FY2025 · publ. March 2025 · source ↗
  6. ReportedNet retention, the spend of existing customers a year later after losses and upsell, was 125.3% at January 2023, fell to 119% and then 112%, and recovered to 115% at January 2026.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1 business: the Falcon platform, modules, markets, customers, channels, managed service providers, public sector, employees and the Onum and Pangea acquisitions. — FY2026 · publ. 5 March 2026 · source ↗
  7. ReportedNet new ARR was a record $332.8 million in the quarter to 31 July 2026, up 51%, and ARR reached $5.84 billion, up 25%.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  8. ReportedNet new ARR was a record $332.8 million in the quarter to 31 July 2026, up 51%, and ARR reached $5.84 billion, up 25%.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  9. ReportedThe engine behind much of it is Falcon Flex, where customers commit a budget up front and draw it down across products; accounts using Flex carried more than $2.29 billion of ARR, up 101%, about 39% of the total.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  10. Moat Explorer calcThe engine behind much of it is Falcon Flex, where customers commit a budget up front and draw it down across products; accounts using Flex carried more than $2.29 billion of ARR, up 101%, about 39% of the total.
    Moat Explorer calculation from CrowdStrike's reported figures ($ millions unless stated; fiscal years end 31 January). Revenue growth: FY2019 249.8 / 118.8 - 1 = 110.4%; FY2020 481.4 / 249.8 - 1 = 92.7%; FY2021 874.4 / 481.4 - 1 = 81.6%, about 82%; FY2022 1,451.6 / 874.4 - 1 = 66.0%; FY2023 2,241.2 / 1,451.6 - 1 = 54.4%; FY2024 3,055.6 / 2,241.2 - 1 = 36.3%; FY2025 3,953.6 / 3,055.6 - 1 = 29.4%, about 29%; FY2026 4,812.0 / 3,953.6 - 1 = 21.7%, about 22%; FY2024 to FY2026 4,812.0 / 3,055.6 - 1 = 57.5%, about 57%; compound FY2018-FY2026 (4,812.0 / 118.8)^(1/8) - 1 = 58.8%, about 59%; revenue grew about 40 times in eight years (4,812.0 / 118.8 = 40.5); FY2027 guidance midpoint (5,991.1 + 6,011.1) / 2 = 6,001.1, 6,001.1 / 4,812.0 - 1 = 24.7%, about 25%; H1 FY2027 revenue 2,856.5 / 6,001.1 = 47.6%; trailing revenue to 31 July 2026 4,812.0 - 2,272.4 + 2,856.5 = 5,396.1, about $5.40 billion. Subscription growth: FY2019 219.4 / 92.6 - 1 = 137.0%; FY2020 98.9%; FY2021 804.7 / 436.3 - 1 = 84.4%; FY2022 69.0%; FY2023 2,111.7 / 1,359.5 - 1 = 55.3%; FY2024 35.9%; FY2025 3,761.5 / 2,870.6 - 1 = 31.0%; FY2026 4,564.7 / 3,761.5 - 1 = 21.4%; H1 FY2027 2,721.1 / 2,153.7 - 1 = 26.3%, about 26%; compound FY2018-FY2026 (4,564.7 / 92.6)^(1/8) - 1 = 62.8%. Subscription added: FY2022 1,359.5 - 804.7 = 554.9; FY2023 2,111.7 - 1,359.5 = 752.1; FY2024 2,870.6 - 2,111.7 = 758.9; FY2025 890.9; FY2026 803.2. Subscription share of revenue FY2018 92.6 / 118.8 = 78%. Subscription gross profit FY2026 4,564.7 - 1,015.9 = 3,548.8. Professional services: revenue FY2018 118.8 - 92.6 = 26.2; FY2024 185.0 / 129.6 - 1 = 42.8%; FY2025 192.1 / 185.0 - 1 = 3.9%, about 4%; FY2026 247.3 / 192.1 - 1 = 28.7%, about 29%; compound FY2018-FY2026 (247.3 / 26.2)^(1/8) - 1 = 32.4%; gross profit FY2026 247.3 - 203.0 = 44.3; GAAP gross margin 44.3 / 247.3 = 17.9%, about 18%; share of gross profit 44.3 / 3,593.1 = 1.2%. Region: FY2026 growth United States 3,216.7 / 2,682.9 - 1 = 19.9%; EMEA 782.7 / 619.5 - 1 = 26.3%; Asia Pacific 495.7 / 402.5 - 1 = 23.2%; Other 317.0 / 248.7 - 1 = 27.4%. United States share FY2018 99.2 / 118.8 = 84%. ARR and net new ARR: ARR compound FY2018-FY2026 (5,252.8 / 141.3)^(1/8) - 1 = 57.1%, about 57%; net new ARR FY2026 5,252.8 - 4,241.8 = 1,010.9; FY2026 growth 1,010.9 / 806.7 - 1 = 25.3%, about 25%; FY2025 change 806.7 / 875.5 - 1 = -7.9%; FY2024 875.5 / 828.4 - 1 = 5.7%; FY2023 828.4 / 681.3 - 1 = 21.6%; H1 FY2027 net new ARR 255.8 + 332.8 = 588.6; FY2027 guided net new ARR 6,607.5 - 5,252.8 = 1,354.7; FY2027 ARR guidance midpoints: March (6,465.8 + 6,516.4) / 2 = 6,491.1, June (6,531.7 + 6,555.5) / 2 = 6,543.6, August (6,603.0 + 6,611.9) / 2 = 6,607.5; 6,607.5 / 5,252.8 - 1 = 25.8%, about 26%; FY2036 goal (20,000 / 5,252.8)^(1/10) - 1 = 14.3% a year; average net new ARR (20,000 - 5,252.8) / 10 = 1,474.7, about 1.47 billion. Falcon Flex: share of ARR 2.29 / 5.84 = 39%; Flex-account ARR a year earlier 2.29 / 2.01 = 1.14 billion; ARR outside Flex accounts 4.66 - 1.14 = 3.52 billion (July 2025) and 5.84 - 2.29 = 3.55 billion (July 2026), growth 3.55 / 3.52 - 1 = 0.8%, under 1%; ARR added 5.84 - 4.66 = 1.18 billion, of which Flex accounts 2.29 - 1.14 = 1.15 billion. Contracts: RPO within twelve months 0.46 x 10.7 = 4.9 billion (July 2026) and 0.51 x 9.0 = 4.6 billion (January 2026); RPO after twelve months 0.54 x 10.7 = 5.8 billion, 54% of RPO (July 2026), 0.49 x 9.0 = 4.4 billion (January 2026), 0.47 x 6.5 = 3.1 billion (January 2025), 0.37 x 3.4 = 1.3 billion (January 2023); RPO growth six months to July 2026 10.7 / 9.0 - 1 = 18.9%; FY2026 9.0 / 6.5 - 1 = 38.5%; RPO / trailing revenue 10.7 / 5.40 = about two years; unbilled backlog 5.9 / 2.8 - 1 = 111% in eighteen months. Deferred revenue 31 July 2026 3,497.1 + 1,345.1 = 4,842.2, about $4.84 billion; noncurrent share 1,345.1 / 4,842.2 = 27.8%, just over a quarter; deferred revenue 31 January 2025 2,733.0 + 995.7 = 3,728.7, 31 January 2026 3,421.1 + 1,332.4 = 4,753.4, growth 27.5%. Accounts receivable 1,038.6 / 1,470.9 = 71% of quarterly revenue. Subscription customers 29,000 / 23,019 - 1 = 26.0%, about 26%. H1 FY2027 revenue growth 2,856.5 / 2,272.4 - 1 = 25.7%, about 26%; H1 capital expenditure 222.0 / 116.2 = 1.9 times. Revenue per subscription customer FY2024 3,055.6 / 29,000 = about $105,000. Cash, costs and stock pay: GAAP operating margin FY2026 -293.3 / 4,812.0 = -6.1%; free cash flow margin FY2026 1,235.3 / 4,812.0 = 25.7%; FY2025 1,065.1 / 3,953.6 = 26.9%; FY2024 938.2 / 3,055.6 = 30.7%; free cash flow after stock pay 1,235.3 - 1,096.7 = 138.6, 138.6 / 4,812.0 = 2.9%; stock pay (cash flow) 1,096.7 / 4,812.0 = 22.8% (FY2026), 861.4 / 3,953.6 = 21.8% (FY2025), 648.7 / 3,055.6 = 21.2% (FY2024); stock pay and payroll tax 1,130.6 / 4,812.0 = 23.5% (FY2026), 903.6 / 3,953.6 = 22.9% (FY2025), 399.0 / 1,470.9 = 27.1% (Q2 FY2027), 276.7 / 1,169.0 = 23.7% (Q2 FY2026). Capital expenditure growth FY2024-FY2026 302.1 / 176.5 - 1 = 71.2%, about 71%; capex share of revenue FY2024 176.5 / 3,055.6 = 5.8%, FY2026 302.1 / 4,812.0 = 6.3%. Net cash 5,230.1 - 745.5 = 4,484.6, about $4.5 billion. Non-GAAP operating income guidance midpoint (1,497.2 + 1,508.4) / 2 = 1,502.8, 1,502.8 / 1,050 - 1 = 43%. July 19 incident net costs 60.1 + 117.7 = 177.8 (FY2025-FY2026) and 177.8 + 3.6 = 181.4, about $181 million through July 2026; update live 04:09 to 05:27 UTC = 78 minutes; cash against Delta claim 5,010 / 500 = about 10 times; a $250 million charge against free cash flow 250 / 1,235.3 = 20%, about a fifth. Acquisitions: cash consideration 96.4 + 213.7 + 252.7 + 212.1 + 327.5 + 627.9 = 1,730.3, about $1.7 billion; CyberArk against SGNL 21,061 / 627.9 = 33.5 times. Valuation: market value against Palo Alto Networks 258.72 / 306.54 = 0.84; Palo Alto price to sales 306.54 / 11.48 = 26.7; market value 25 September 2026 against 31 January 2026 258.718 / 111.278 = 2.3 times; price to trailing sales 258.718 / 5.396 = 47.9; analyst target 235.67 / 252.13 - 1 = -6.5%; market value over fiscal revenue 10.25 / 0.4814 = 21.3 (FY2020, December 2019 value), 46.86 / 0.8744 = 53.6 (FY2021, December 2020 value) - revenue mix, geography, ARR mix and the contract book. — FY2018-FY2027 · publ. September 2026 · source ↗
    Method: Arithmetic on figures reported in CrowdStrike's Forms 10-K and 10-Q, its results releases and market data; operands shown in the source line.
  11. ReportedThe company also publishes less than it used to: the subscription customer count stopped at 29,000 in the fiscal 2024 report, and gross retention is now described without an exact figure.
    CrowdStrike Form 10-K for fiscal 2024 - 29,000 subscription customers, net retention of 119%, net new ARR of $875.5 million and RPO of $4.6 billion. — FY2024 · publ. March 2024 · source ↗
  12. ReportedThe company also publishes less than it used to: the subscription customer count stopped at 29,000 in the fiscal 2024 report, and gross retention is now described without an exact figure.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  13. ReportedFalcon Go can be downloaded as a trial from CrowdStrike's website and from the AWS, Google and Microsoft marketplaces, and the company says it now sells to small and medium-sized businesses mainly through this trial-to-pay model.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1 business: the Falcon platform, modules, markets, customers, channels, managed service providers, public sector, employees and the Onum and Pangea acquisitions. — FY2026 · publ. 5 March 2026 · source ↗
  14. ReportedFalcon Go can be downloaded as a trial from CrowdStrike's website and from the AWS, Google and Microsoft marketplaces, and the company says it now sells to small and medium-sized businesses mainly through this trial-to-pay model.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1 business: the Falcon platform, modules, markets, customers, channels, managed service providers, public sector, employees and the Onum and Pangea acquisitions. — FY2026 · publ. 5 March 2026 · source ↗
  15. ReportedThose Falcon Go customers are left out of the module ratios, so the expansion figures describe the larger accounts.
    CrowdStrike second-quarter fiscal 2026 results release, Form 8-K exhibit 99.1 - ARR of $4.66 billion, net new ARR of $221.1 million, over 1,000 Falcon Flex customers and the module-adoption definition excluding Falcon Go customers. — Q2 FY2026 · publ. 27 August 2025 · source ↗
  16. ReportedIt was 115% at January 2026; a figure back above 119%, the pre-outage level, would show expansion is fully restored, while a slide below 112% would say the Flex surge borrowed from future spending.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1 business: the Falcon platform, modules, markets, customers, channels, managed service providers, public sector, employees and the Onum and Pangea acquisitions. — FY2026 · publ. 5 March 2026 · source ↗
Sources
Generated September 28, 2026