One Sensor, One PlatformNarrow moat

CrowdStrike (CRWD) — moat facet

CrowdStrike sells a growing list of products through one agent already installed on every customer machine, and a quarter of customers now run eight or more of them.

CrowdStrike's moat begins with a small program. The Falcon sensor sits on a customer's laptops, servers and cloud workloads, sends what it sees to CrowdStrike's cloud, and acts as the delivery channel for everything else the company sells. It now offers 33 cloud modules on that platform1, and in its own words: "One sensor, one console, one platform covering attack surfaces"2.

Subscription customers with eight or more modules (%)20%Oct 202421%Jan 202523%Jul 202524%Jan 202626%Jul 2026CrowdStrike results releases; from Q2 FY2026 excludes Falcon Go customers
A quarter of customers now run eight or more modules.

The business logic is land and expand. A customer starts with endpoint protection and adds modules over time, each one a subscription switched on from the cloud rather than a new installation. At 31 July 2026, 51% of subscription customers had six or more modules and 26% had eight or more3. Five years earlier only 24% had six or more4.

That expansion is cheap to deliver. GAAP subscription gross margin was 78% in fiscal 20265 and in the latest quarter6, even as the product list lengthened through development and acquisitions, from Flow Security and Adaptive Shield in fiscal 20257 to Onum and Pangea in fiscal 20268.

Why this is a moat: once eight modules run through one agent on every machine, replacing CrowdStrike means replacing eight products at once, across the whole estate, with the security gap that migration opens. Contracts typically run one to three years and most are non-cancelable9, but the real lock is operational.

Why it may not be: the same single agent concentrates risk, as 19 July 2024 showed, and the adoption curve is flattening. The six-or-more share moved from 48% to 51% in the year to July 20261011, a slower climb than in earlier years, and the base now excludes the smallest customers.

The markets the one sensor reaches are listed in the 10-K: endpoint protection, security and IT operations, managed detection and response, Next-Gen SIEM, cloud and identity security, threat intelligence, data protection, exposure management and AI security12. Each has specialist rivals of its own. The single agent is what lets one company sell into all of them without asking the customer for a separate deployment each time.

The page to watch is the eight-or-more figure, the deepest level of lock-in the company reports. It was 26% at July 202613; if it stops rising while CrowdStrike keeps adding modules, the platform is growing in breadth faster than customers are willing to follow.

Moat trajectory: Widening

Eight-or-more module share 20% (Oct 2024) to 26% (Jul 2026).

The number that tests this moat
Reported
Customers with eight or more modules
26% (Jul 2026), from 23% a year earlier

The deepest lock-in the company reports; a stall while modules keep being added would mean breadth is outrunning demand.

Source: CrowdStrike Q2 FY2027 results release ↗
Aspects of the moat
DIG DEEPER 01
Thirty-Three Modules on One Agent
CrowdStrike sells 33 products through one installed agent, so each new module is a licence change rather than a new deployment.
DIG DEEPER 02
Six, Seven, Eight Modules
Half of CrowdStrike's subscription customers now run six or more of its modules, and each extra module makes leaving harder.
DIG DEEPER 03
The Data Behind the Console
CrowdStrike's move into security data and AI is lifting its capital spending to 8% of revenue from 3%.
DIG DEEPER 04
A Platform the Company Says Nobody Matches
CrowdStrike says no rival has an equivalent platform, but its annual report names no competitor and gives no market share.
⚠ Threats to the moat
⚠ THREAT 01
Competitive Pricing Pressure
CrowdStrike's 78% subscription margin is the room rivals would use to undercut it, and the company warns it may have to respond.
⚠ THREAT 02
The Adoption Curve Is Flattening
CrowdStrike's cross-sell is still rising, but the six-module share gained only three points in the latest year.
References
  1. ReportedIt now offers 33 cloud modules on that platform, and in its own words: "One sensor, one console, one platform covering attack surfaces".
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1 business: the Falcon platform, modules, markets, customers, channels, managed service providers, public sector, employees and the Onum and Pangea acquisitions. — FY2026 · publ. 5 March 2026 · source ↗
  2. ReportedIt now offers 33 cloud modules on that platform, and in its own words: "One sensor, one console, one platform covering attack surfaces".
    CrowdStrike Form 10-Q for the quarter ended 31 July 2026 - remaining performance obligations of $10.7 billion (46% within twelve months), unbilled backlog of $5.9 billion, the SGNL, Seraphic and XM Cyber transactions, the $750 million 3.00% senior notes, legal proceedings, the DOJ and SEC requests, purchase commitments and the share repurchase programme. — Q2 FY2027 · publ. 27 August 2026 · source ↗
  3. ReportedAt 31 July 2026, 51% of subscription customers had six or more modules and 26% had eight or more.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  4. ReportedFive years earlier only 24% had six or more.
    CrowdStrike Form 10-K for fiscal 2021 - module adoption, net retention of 125% and revenue by region. — FY2021 · publ. March 2021 · source ↗
  5. ReportedGAAP subscription gross margin was 78% in fiscal 2026 and in the latest quarter, even as the product list lengthened through development and acquisitions, from Flow Security and Adaptive Shield in fiscal 2025 to Onum and Pangea in fiscal 2026.
    CrowdStrike fourth-quarter and fiscal 2026 results release, Form 8-K exhibit 99.1 - fourth-quarter and full-year results, ARR, retention and module adoption. — Q4 FY2026 · publ. 3 March 2026 · source ↗
  6. ReportedGAAP subscription gross margin was 78% in fiscal 2026 and in the latest quarter, even as the product list lengthened through development and acquisitions, from Flow Security and Adaptive Shield in fiscal 2025 to Onum and Pangea in fiscal 2026.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - balance sheet and cash flow statement. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  7. ReportedGAAP subscription gross margin was 78% in fiscal 2026 and in the latest quarter, even as the product list lengthened through development and acquisitions, from Flow Security and Adaptive Shield in fiscal 2025 to Onum and Pangea in fiscal 2026.
    CrowdStrike Form 10-K for fiscal 2025 - net retention of 112%, RPO of $6.5 billion with 53% due within twelve months, unbilled backlog of $2.8 billion, the Flow Security and Adaptive Shield acquisitions, and revenue and cost changes for fiscal 2025. — FY2025 · publ. March 2025 · source ↗
  8. ReportedGAAP subscription gross margin was 78% in fiscal 2026 and in the latest quarter, even as the product list lengthened through development and acquisitions, from Flow Security and Adaptive Shield in fiscal 2025 to Onum and Pangea in fiscal 2026.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Items 5 and 7: revenue by type and region, what each line contains, how it is invoiced and recognised, and the share structure. — FY2026 · publ. 5 March 2026 · source ↗
  9. ReportedContracts typically run one to three years and most are non-cancelable, but the real lock is operational.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - financial statements and notes: contract terms, deferred revenue, remaining performance obligations, backlog, concentration, revisions and commission amortisation. — FY2026 · publ. 5 March 2026 · source ↗
  10. ReportedThe six-or-more share moved from 48% to 51% in the year to July 2026, a slower climb than in earlier years, and the base now excludes the smallest customers.
    CrowdStrike second-quarter fiscal 2026 results release, Form 8-K exhibit 99.1 - ARR of $4.66 billion, net new ARR of $221.1 million, over 1,000 Falcon Flex customers and the module-adoption definition excluding Falcon Go customers. — Q2 FY2026 · publ. 27 August 2025 · source ↗
  11. ReportedThe six-or-more share moved from 48% to 51% in the year to July 2026, a slower climb than in earlier years, and the base now excludes the smallest customers.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - second-quarter results, ARR, net new ARR, margins, module adoption and recent highlights. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  12. ReportedThe markets the one sensor reaches are listed in the 10-K: endpoint protection, security and IT operations, managed detection and response, Next-Gen SIEM, cloud and identity security, threat intelligence, data protection, exposure management and AI security.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1 business: the Falcon platform, modules, markets, customers, channels, managed service providers, public sector, employees and the Onum and Pangea acquisitions. — FY2026 · publ. 5 March 2026 · source ↗
  13. ReportedIt was 26% at July 2026; if it stops rising while CrowdStrike keeps adding modules, the platform is growing in breadth faster than customers are willing to follow.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
Sources
Generated September 28, 2026