Thirty-Three Modules on One AgentWide moat

CrowdStrike (CRWD) — moat facet

CrowdStrike sells 33 products through one installed agent, so each new module is a licence change rather than a new deployment.

CrowdStrike's economics start with one piece of software on each computer. The company sells "33 cloud modules on our Falcon platform via a SaaS subscription-based model"1, and all of them run through the same sensor. Its own summary is blunter: "One sensor, one console, one platform covering attack surfaces"2.

Subscription revenue and its cost, fiscal 2026 ($M)4,565Subscription revenue1,016Cost of subscription3,549Subscription gross profitCrowdStrike Q4 FY2026 results release; gross profit calculated
More than three dollars of gross profit for every dollar of cost.

That design is why adding a product is cheap. A customer that already runs the sensor on every laptop and server does not need a second installation, a second agent or a second deployment project to switch on identity protection or cloud security. The new module is a licence change, delivered from CrowdStrike's cloud.

The margin shows it. GAAP subscription gross margin was 78% in both fiscal 2026 and fiscal 2025, and 81% on the company's non-GAAP basis3. In the quarter to 31 July 2026 it was 78%, up from 77% a year earlier4. Cost of subscription revenue was $1,015.9 million in fiscal 2026 against subscription revenue of $4,564.7 million5. A company that had to build and support a separate product for each module would struggle to hold that margin while the module count climbed.

The count has climbed through acquisition as well as development. Identity, SaaS security, data security and browser security each arrived partly through purchases, from Flow Security in March 20246 to Seraphic in February 20267, and each was folded behind the same sensor rather than sold as a separate agent.

The company treats the agent's size as a selling point in itself. Under the heading of reducing sensor bloat, its 10-K says the single lightweight sensor "enables frictionless deployment of our platform at scale"8, across the laptops, servers and cloud workloads a customer runs.

What this page claims is narrow: one agent makes the second, third and eighth module cheaper to sell and to run. It does not claim customers want every module; the adoption figures on the next page show most do not yet. The falsifier is the gross margin. If GAAP subscription gross margin slips below the 77% of a year ago while the module count keeps rising, the single-agent design is costing more to extend than it saves.

Moat trajectory: Holding steady

GAAP subscription gross margin 78% in Q2 FY2027, from 77%.

The number that tests this moat
Reported
GAAP subscription gross margin, latest quarter
78% (Q2 FY2027), from 77%

The cost of extending one agent to more products; a slip below 77% as modules multiply would mean the design costs more than it saves.

Source: CrowdStrike Q2 FY2027 results release ↗
⚠ Threats to the moat
⚠ THREAT 01
One Agent, One Point of Failure
A single sensor means a single update can take down millions of machines, as it did for 78 minutes on 19 July 2024.
References
  1. ReportedThe company sells "33 cloud modules on our Falcon platform via a SaaS subscription-based model", and all of them run through the same sensor.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Items 5 and 7: revenue by type and region, what each line contains, how it is invoiced and recognised, and the share structure. — FY2026 · publ. 5 March 2026 · source ↗
  2. ReportedIts own summary is blunter: "One sensor, one console, one platform covering attack surfaces".
    CrowdStrike Form 10-Q for the quarter ended 31 July 2026 - remaining performance obligations of $10.7 billion (46% within twelve months), unbilled backlog of $5.9 billion, the SGNL, Seraphic and XM Cyber transactions, the $750 million 3.00% senior notes, legal proceedings, the DOJ and SEC requests, purchase commitments and the share repurchase programme. — Q2 FY2027 · publ. 27 August 2026 · source ↗
  3. ReportedGAAP subscription gross margin was 78% in both fiscal 2026 and fiscal 2025, and 81% on the company's non-GAAP basis.
    CrowdStrike fourth-quarter and fiscal 2026 results release, Form 8-K exhibit 99.1 - fourth-quarter and full-year results, ARR, retention and module adoption. — Q4 FY2026 · publ. 3 March 2026 · source ↗
  4. ReportedIn the quarter to 31 July 2026 it was 78%, up from 77% a year earlier.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - second-quarter results, ARR, net new ARR, margins, module adoption and recent highlights. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  5. ReportedCost of subscription revenue was $1,015.9 million in fiscal 2026 against subscription revenue of $4,564.7 million.
    CrowdStrike fourth-quarter and fiscal 2026 results release, Form 8-K exhibit 99.1 - fourth-quarter and full-year results, ARR, retention and module adoption. — Q4 FY2026 · publ. 3 March 2026 · source ↗
  6. ReportedIdentity, SaaS security, data security and browser security each arrived partly through purchases, from Flow Security in March 2024 to Seraphic in February 2026, and each was folded behind the same sensor rather than sold as a separate agent.
    CrowdStrike Form 10-K for fiscal 2025 - net retention of 112%, RPO of $6.5 billion with 53% due within twelve months, unbilled backlog of $2.8 billion, the Flow Security and Adaptive Shield acquisitions, and revenue and cost changes for fiscal 2025. — FY2025 · publ. March 2025 · source ↗
  7. ReportedIdentity, SaaS security, data security and browser security each arrived partly through purchases, from Flow Security in March 2024 to Seraphic in February 2026, and each was folded behind the same sensor rather than sold as a separate agent.
    CrowdStrike Form 10-Q for the quarter ended 31 July 2026 - remaining performance obligations of $10.7 billion (46% within twelve months), unbilled backlog of $5.9 billion, the SGNL, Seraphic and XM Cyber transactions, the $750 million 3.00% senior notes, legal proceedings, the DOJ and SEC requests, purchase commitments and the share repurchase programme. — Q2 FY2027 · publ. 27 August 2026 · source ↗
  8. ReportedUnder the heading of reducing sensor bloat, its 10-K says the single lightweight sensor "enables frictionless deployment of our platform at scale", across the laptops, servers and cloud workloads a customer runs.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1 business: the Falcon platform, modules, markets, customers, channels, managed service providers, public sector, employees and the Onum and Pangea acquisitions. — FY2026 · publ. 5 March 2026 · source ↗
Sources
Generated September 28, 2026