Reinstalling Every EndpointWide moat

CrowdStrike (CRWD) — moat facet

Replacing CrowdStrike means reinstalling security software on every machine a company owns, which is why ARR kept growing through the outage.

The switching cost in endpoint security is physical in a way most software is not. CrowdStrike's sensor runs on every laptop, server and cloud workload a customer protects; leaving means removing it from all of them and installing something else, with a security gap in between. For a large customer that is a project measured in months.

ARR growth, year on year (%)20%Jul 202523%Oct 202524%Jan 202624%Apr 202625%Jul 2026CrowdStrike results releases Q2 FY2026 to Q2 FY2027
Five quarters of steady re-acceleration.

The contracts make the timing predictable. Subscriptions have "a typical term of one to three years" and most are non-cancelable1, so a customer can leave only at renewal, and must then plan and staff the migration.

The recurring revenue shows how rarely that happens. Annual recurring revenue grew from $141.3 million at January 20182 to $5.25 billion at January 20263, a compound rate of about 57% a year4, and to $5.84 billion at 31 July 2026, up 25%5. The growth rate has risen each quarter for the past year: 20% at July 20256, 23% at October7, 24% at January and April 202689 and 25% at July10.

Switching cost is only as good as the product it protects. The July 2024 outage was the one event in the company's history most likely to push customers through the pain of migrating, and ARR kept growing through it, though more slowly. That is the strongest evidence that the reinstallation barrier is real.

Outsourcing deepens the barrier further. CrowdStrike increasingly sells through managed service and managed security service providers that run the Falcon platform on the customer's behalf11. A customer whose security is operated by a provider trained on Falcon has two relationships to unwind, not one.

The weakness is that this barrier protects the installed base and does nothing to win new customers, who face no switching cost at all. The number to watch is ARR growth, 25% at July 202612. A fall back below 20%, where it was in the year after the outage, would mean the barrier is holding customers but no longer growing with them.

Moat trajectory: Widening

ARR growth 20% (Jul 2025) to 25% (Jul 2026).

The number that tests this moat
Reported
ARR growth, latest quarter
25% (Jul 2026), to $5.84bn

The switching barrier at work; a fall back below 20% would mean it holds customers but no longer grows with them.

Source: CrowdStrike Q2 FY2027 results release ↗
⚠ Threats to the moat
⚠ THREAT 01
Switching Is Hard Until the Contract Ends
CrowdStrike's switching cost is real, but every one-to-three-year contract ends with a renewal a rival can bid for.
References
  1. ReportedSubscriptions have "a typical term of one to three years" and most are non-cancelable, so a customer can leave only at renewal, and must then plan and staff the migration.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - financial statements and notes: contract terms, deferred revenue, remaining performance obligations, backlog, concentration, revisions and commission amortisation. — FY2026 · publ. 5 March 2026 · source ↗
  2. ReportedAnnual recurring revenue grew from $141.3 million at January 2018 to $5.25 billion at January 2026, a compound rate of about 57% a year, and to $5.84 billion at 31 July 2026, up 25%.
    CrowdStrike Form 10-K for fiscal 2020 - revenue by type and region for fiscal 2018-2020, ARR of $141.3 million (FY2018) to $600.5 million (FY2020) and net retention of 124%. — FY2020 · publ. March 2020 · source ↗
  3. ReportedAnnual recurring revenue grew from $141.3 million at January 2018 to $5.25 billion at January 2026, a compound rate of about 57% a year, and to $5.84 billion at 31 July 2026, up 25%.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Items 5 and 7: revenue by type and region, what each line contains, how it is invoiced and recognised, and the share structure. — FY2026 · publ. 5 March 2026 · source ↗
  4. Moat Explorer calcAnnual recurring revenue grew from $141.3 million at January 2018 to $5.25 billion at January 2026, a compound rate of about 57% a year, and to $5.84 billion at 31 July 2026, up 25%.
    Moat Explorer calculation from CrowdStrike's reported figures ($ millions unless stated; fiscal years end 31 January). Revenue growth: FY2019 249.8 / 118.8 - 1 = 110.4%; FY2020 481.4 / 249.8 - 1 = 92.7%; FY2021 874.4 / 481.4 - 1 = 81.6%, about 82%; FY2022 1,451.6 / 874.4 - 1 = 66.0%; FY2023 2,241.2 / 1,451.6 - 1 = 54.4%; FY2024 3,055.6 / 2,241.2 - 1 = 36.3%; FY2025 3,953.6 / 3,055.6 - 1 = 29.4%, about 29%; FY2026 4,812.0 / 3,953.6 - 1 = 21.7%, about 22%; FY2024 to FY2026 4,812.0 / 3,055.6 - 1 = 57.5%, about 57%; compound FY2018-FY2026 (4,812.0 / 118.8)^(1/8) - 1 = 58.8%, about 59%; revenue grew about 40 times in eight years (4,812.0 / 118.8 = 40.5); FY2027 guidance midpoint (5,991.1 + 6,011.1) / 2 = 6,001.1, 6,001.1 / 4,812.0 - 1 = 24.7%, about 25%; H1 FY2027 revenue 2,856.5 / 6,001.1 = 47.6%; trailing revenue to 31 July 2026 4,812.0 - 2,272.4 + 2,856.5 = 5,396.1, about $5.40 billion. Subscription growth: FY2019 219.4 / 92.6 - 1 = 137.0%; FY2020 98.9%; FY2021 804.7 / 436.3 - 1 = 84.4%; FY2022 69.0%; FY2023 2,111.7 / 1,359.5 - 1 = 55.3%; FY2024 35.9%; FY2025 3,761.5 / 2,870.6 - 1 = 31.0%; FY2026 4,564.7 / 3,761.5 - 1 = 21.4%; H1 FY2027 2,721.1 / 2,153.7 - 1 = 26.3%, about 26%; compound FY2018-FY2026 (4,564.7 / 92.6)^(1/8) - 1 = 62.8%. Subscription added: FY2022 1,359.5 - 804.7 = 554.9; FY2023 2,111.7 - 1,359.5 = 752.1; FY2024 2,870.6 - 2,111.7 = 758.9; FY2025 890.9; FY2026 803.2. Subscription share of revenue FY2018 92.6 / 118.8 = 78%. Subscription gross profit FY2026 4,564.7 - 1,015.9 = 3,548.8. Professional services: revenue FY2018 118.8 - 92.6 = 26.2; FY2024 185.0 / 129.6 - 1 = 42.8%; FY2025 192.1 / 185.0 - 1 = 3.9%, about 4%; FY2026 247.3 / 192.1 - 1 = 28.7%, about 29%; compound FY2018-FY2026 (247.3 / 26.2)^(1/8) - 1 = 32.4%; gross profit FY2026 247.3 - 203.0 = 44.3; GAAP gross margin 44.3 / 247.3 = 17.9%, about 18%; share of gross profit 44.3 / 3,593.1 = 1.2%. Region: FY2026 growth United States 3,216.7 / 2,682.9 - 1 = 19.9%; EMEA 782.7 / 619.5 - 1 = 26.3%; Asia Pacific 495.7 / 402.5 - 1 = 23.2%; Other 317.0 / 248.7 - 1 = 27.4%. United States share FY2018 99.2 / 118.8 = 84%. ARR and net new ARR: ARR compound FY2018-FY2026 (5,252.8 / 141.3)^(1/8) - 1 = 57.1%, about 57%; net new ARR FY2026 5,252.8 - 4,241.8 = 1,010.9; FY2026 growth 1,010.9 / 806.7 - 1 = 25.3%, about 25%; FY2025 change 806.7 / 875.5 - 1 = -7.9%; FY2024 875.5 / 828.4 - 1 = 5.7%; FY2023 828.4 / 681.3 - 1 = 21.6%; H1 FY2027 net new ARR 255.8 + 332.8 = 588.6; FY2027 guided net new ARR 6,607.5 - 5,252.8 = 1,354.7; FY2027 ARR guidance midpoints: March (6,465.8 + 6,516.4) / 2 = 6,491.1, June (6,531.7 + 6,555.5) / 2 = 6,543.6, August (6,603.0 + 6,611.9) / 2 = 6,607.5; 6,607.5 / 5,252.8 - 1 = 25.8%, about 26%; FY2036 goal (20,000 / 5,252.8)^(1/10) - 1 = 14.3% a year; average net new ARR (20,000 - 5,252.8) / 10 = 1,474.7, about 1.47 billion. Falcon Flex: share of ARR 2.29 / 5.84 = 39%; Flex-account ARR a year earlier 2.29 / 2.01 = 1.14 billion; ARR outside Flex accounts 4.66 - 1.14 = 3.52 billion (July 2025) and 5.84 - 2.29 = 3.55 billion (July 2026), growth 3.55 / 3.52 - 1 = 0.8%, under 1%; ARR added 5.84 - 4.66 = 1.18 billion, of which Flex accounts 2.29 - 1.14 = 1.15 billion. Contracts: RPO within twelve months 0.46 x 10.7 = 4.9 billion (July 2026) and 0.51 x 9.0 = 4.6 billion (January 2026); RPO after twelve months 0.54 x 10.7 = 5.8 billion, 54% of RPO (July 2026), 0.49 x 9.0 = 4.4 billion (January 2026), 0.47 x 6.5 = 3.1 billion (January 2025), 0.37 x 3.4 = 1.3 billion (January 2023); RPO growth six months to July 2026 10.7 / 9.0 - 1 = 18.9%; FY2026 9.0 / 6.5 - 1 = 38.5%; RPO / trailing revenue 10.7 / 5.40 = about two years; unbilled backlog 5.9 / 2.8 - 1 = 111% in eighteen months. Deferred revenue 31 July 2026 3,497.1 + 1,345.1 = 4,842.2, about $4.84 billion; noncurrent share 1,345.1 / 4,842.2 = 27.8%, just over a quarter; deferred revenue 31 January 2025 2,733.0 + 995.7 = 3,728.7, 31 January 2026 3,421.1 + 1,332.4 = 4,753.4, growth 27.5%. Accounts receivable 1,038.6 / 1,470.9 = 71% of quarterly revenue. Subscription customers 29,000 / 23,019 - 1 = 26.0%, about 26%. H1 FY2027 revenue growth 2,856.5 / 2,272.4 - 1 = 25.7%, about 26%; H1 capital expenditure 222.0 / 116.2 = 1.9 times. Revenue per subscription customer FY2024 3,055.6 / 29,000 = about $105,000. Cash, costs and stock pay: GAAP operating margin FY2026 -293.3 / 4,812.0 = -6.1%; free cash flow margin FY2026 1,235.3 / 4,812.0 = 25.7%; FY2025 1,065.1 / 3,953.6 = 26.9%; FY2024 938.2 / 3,055.6 = 30.7%; free cash flow after stock pay 1,235.3 - 1,096.7 = 138.6, 138.6 / 4,812.0 = 2.9%; stock pay (cash flow) 1,096.7 / 4,812.0 = 22.8% (FY2026), 861.4 / 3,953.6 = 21.8% (FY2025), 648.7 / 3,055.6 = 21.2% (FY2024); stock pay and payroll tax 1,130.6 / 4,812.0 = 23.5% (FY2026), 903.6 / 3,953.6 = 22.9% (FY2025), 399.0 / 1,470.9 = 27.1% (Q2 FY2027), 276.7 / 1,169.0 = 23.7% (Q2 FY2026). Capital expenditure growth FY2024-FY2026 302.1 / 176.5 - 1 = 71.2%, about 71%; capex share of revenue FY2024 176.5 / 3,055.6 = 5.8%, FY2026 302.1 / 4,812.0 = 6.3%. Net cash 5,230.1 - 745.5 = 4,484.6, about $4.5 billion. Non-GAAP operating income guidance midpoint (1,497.2 + 1,508.4) / 2 = 1,502.8, 1,502.8 / 1,050 - 1 = 43%. July 19 incident net costs 60.1 + 117.7 = 177.8 (FY2025-FY2026) and 177.8 + 3.6 = 181.4, about $181 million through July 2026; update live 04:09 to 05:27 UTC = 78 minutes; cash against Delta claim 5,010 / 500 = about 10 times; a $250 million charge against free cash flow 250 / 1,235.3 = 20%, about a fifth. Acquisitions: cash consideration 96.4 + 213.7 + 252.7 + 212.1 + 327.5 + 627.9 = 1,730.3, about $1.7 billion; CyberArk against SGNL 21,061 / 627.9 = 33.5 times. Valuation: market value against Palo Alto Networks 258.72 / 306.54 = 0.84; Palo Alto price to sales 306.54 / 11.48 = 26.7; market value 25 September 2026 against 31 January 2026 258.718 / 111.278 = 2.3 times; price to trailing sales 258.718 / 5.396 = 47.9; analyst target 235.67 / 252.13 - 1 = -6.5%; market value over fiscal revenue 10.25 / 0.4814 = 21.3 (FY2020, December 2019 value), 46.86 / 0.8744 = 53.6 (FY2021, December 2020 value) - growth rates, margins and guidance. — FY2018-FY2027 · publ. September 2026 · source ↗
    Method: Arithmetic on figures reported in CrowdStrike's Forms 10-K and 10-Q, its results releases and market data; operands shown in the source line.
  5. ReportedAnnual recurring revenue grew from $141.3 million at January 2018 to $5.25 billion at January 2026, a compound rate of about 57% a year, and to $5.84 billion at 31 July 2026, up 25%.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - second-quarter results, ARR, net new ARR, margins, module adoption and recent highlights. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  6. ReportedThe growth rate has risen each quarter for the past year: 20% at July 2025, 23% at October, 24% at January and April 2026 and 25% at July.
    CrowdStrike second-quarter fiscal 2026 results release, Form 8-K exhibit 99.1 - ARR of $4.66 billion, net new ARR of $221.1 million, over 1,000 Falcon Flex customers and the module-adoption definition excluding Falcon Go customers. — Q2 FY2026 · publ. 27 August 2025 · source ↗
  7. ReportedThe growth rate has risen each quarter for the past year: 20% at July 2025, 23% at October, 24% at January and April 2026 and 25% at July.
    CrowdStrike third-quarter fiscal 2026 results release, Form 8-K exhibit 99.1 - ARR of $4.92 billion, net new ARR of $265.3 million and more than $1.35 billion of ending ARR in Falcon Flex accounts. — Q3 FY2026 · publ. 2 December 2025 · source ↗
  8. ReportedThe growth rate has risen each quarter for the past year: 20% at July 2025, 23% at October, 24% at January and April 2026 and 25% at July.
    CrowdStrike fourth-quarter and fiscal 2026 results release, Form 8-K exhibit 99.1 - fourth-quarter and full-year results, ARR, retention and module adoption. — Q4 FY2026 · publ. 3 March 2026 · source ↗
  9. ReportedThe growth rate has risen each quarter for the past year: 20% at July 2025, 23% at October, 24% at January and April 2026 and 25% at July.
    CrowdStrike first-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - record Q1 net new ARR of $255.8 million, up 32%, record free cash flow of $468.5 million, the four-for-one stock split, Project QuiltWorks, Project Glasswing and OpenAI Trusted Access for Cyber, and the Charlotte AI AgentWorks ecosystem. — Q1 FY2027 · publ. 3 June 2026 · source ↗
  10. ReportedThe growth rate has risen each quarter for the past year: 20% at July 2025, 23% at October, 24% at January and April 2026 and 25% at July.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - second-quarter results, ARR, net new ARR, margins, module adoption and recent highlights. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  11. ReportedCrowdStrike increasingly sells through managed service and managed security service providers that run the Falcon platform on the customer's behalf.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1 business: the Falcon platform, modules, markets, customers, channels, managed service providers, public sector, employees and the Onum and Pangea acquisitions. — FY2026 · publ. 5 March 2026 · source ↗
  12. ReportedThe number to watch is ARR growth, 25% at July 2026.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
Sources
Generated September 28, 2026