⚠ The Next Bad UpdateModerate threat

CrowdStrike (CRWD) — threat to the moat

CrowdStrike's value lies in pushing updates to millions of machines fast, which is exactly how it failed in 2024.

The July 2024 outage came from a configuration update pushed to a sensor running on customer machines1. That delivery model has not changed, because it is the product: CrowdStrike's value comes from updating protection on millions of devices quickly.

Net new ARR, latest quarters ($M)221.1Q2 FY2026265.3Q3 FY2026330.7Q4 FY2026255.8Q1 FY2027332.8Q2 FY2027CrowdStrike results releases Q2 FY2026 to Q2 FY2027
The baseline a second incident would be measured against.

A second incident would land differently from the first. Customers accepted discounts, extra modules and longer terms after July 20242; they would be less likely to accept an apology twice. And the courts that dismissed the first wave of suits34 would face plaintiffs arguing that the risk was now known.

The company does not publish metrics on update testing or staged rollout in its financial reports, so outsiders cannot track the engineering changes directly.

Microsoft drew the wider lesson at the time: the incident, it wrote, "demonstrates the interconnected nature of our broad ecosystem"5. A second event would test not only CrowdStrike's customers but the partners whose platforms its sensor runs inside.

The sign would be immediate: any outage attributed to a CrowdStrike update. After the first, net new ARR fell about 7.9% for a year6; after a second, a similar fall in the following quarter's net new ARR, from $332.8 million in the latest one7, should be expected.

References
  1. ReportedThe July 2024 outage came from a configuration update pushed to a sensor running on customer machines.
    CrowdStrike Form 8-K on the 19 July 2024 sensor configuration update - released at 04:09 UTC and reverted at 05:27 UTC; not caused by a cyberattack. — July 2024 · publ. 22 July 2024 · source ↗
  2. ReportedCustomers accepted discounts, extra modules and longer terms after July 2024; they would be less likely to accept an apology twice.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - financial statements and notes: contract terms, deferred revenue, remaining performance obligations, backlog, concentration, revisions and commission amortisation. — FY2026 · publ. 5 March 2026 · source ↗
  3. ReportedAnd the courts that dismissed the first wave of suits would face plaintiffs arguing that the risk was now known.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1A risk factors and Item 3 legal proceedings: competition, the July 19 incident, customer commitment packages, insurance and litigation. — FY2026 · publ. 5 March 2026 · source ↗
  4. ReportedAnd the courts that dismissed the first wave of suits would face plaintiffs arguing that the risk was now known.
    CrowdStrike Form 10-Q for the quarter ended 31 July 2026 - remaining performance obligations of $10.7 billion (46% within twelve months), unbilled backlog of $5.9 billion, the SGNL, Seraphic and XM Cyber transactions, the $750 million 3.00% senior notes, legal proceedings, the DOJ and SEC requests, purchase commitments and the share repurchase programme. — Q2 FY2027 · publ. 27 August 2026 · source ↗
  5. Third-party estimateMicrosoft drew the wider lesson at the time: the incident, it wrote, "demonstrates the interconnected nature of our broad ecosystem".
    Microsoft blog, 20 July 2024 - CrowdStrike's update affected an estimated 8.5 million Windows devices, less than one percent of all Windows machines. — July 2024 · publ. 20 July 2024 · source ↗
  6. Moat Explorer calcAfter the first, net new ARR fell about 7.9% for a year; after a second, a similar fall in the following quarter's net new ARR, from $332.8 million in the latest one, should be expected.
    Moat Explorer calculation from CrowdStrike's reported figures ($ millions unless stated; fiscal years end 31 January). Revenue growth: FY2019 249.8 / 118.8 - 1 = 110.4%; FY2020 481.4 / 249.8 - 1 = 92.7%; FY2021 874.4 / 481.4 - 1 = 81.6%, about 82%; FY2022 1,451.6 / 874.4 - 1 = 66.0%; FY2023 2,241.2 / 1,451.6 - 1 = 54.4%; FY2024 3,055.6 / 2,241.2 - 1 = 36.3%; FY2025 3,953.6 / 3,055.6 - 1 = 29.4%, about 29%; FY2026 4,812.0 / 3,953.6 - 1 = 21.7%, about 22%; FY2024 to FY2026 4,812.0 / 3,055.6 - 1 = 57.5%, about 57%; compound FY2018-FY2026 (4,812.0 / 118.8)^(1/8) - 1 = 58.8%, about 59%; revenue grew about 40 times in eight years (4,812.0 / 118.8 = 40.5); FY2027 guidance midpoint (5,991.1 + 6,011.1) / 2 = 6,001.1, 6,001.1 / 4,812.0 - 1 = 24.7%, about 25%; H1 FY2027 revenue 2,856.5 / 6,001.1 = 47.6%; trailing revenue to 31 July 2026 4,812.0 - 2,272.4 + 2,856.5 = 5,396.1, about $5.40 billion. Subscription growth: FY2019 219.4 / 92.6 - 1 = 137.0%; FY2020 98.9%; FY2021 804.7 / 436.3 - 1 = 84.4%; FY2022 69.0%; FY2023 2,111.7 / 1,359.5 - 1 = 55.3%; FY2024 35.9%; FY2025 3,761.5 / 2,870.6 - 1 = 31.0%; FY2026 4,564.7 / 3,761.5 - 1 = 21.4%; H1 FY2027 2,721.1 / 2,153.7 - 1 = 26.3%, about 26%; compound FY2018-FY2026 (4,564.7 / 92.6)^(1/8) - 1 = 62.8%. Subscription added: FY2022 1,359.5 - 804.7 = 554.9; FY2023 2,111.7 - 1,359.5 = 752.1; FY2024 2,870.6 - 2,111.7 = 758.9; FY2025 890.9; FY2026 803.2. Subscription share of revenue FY2018 92.6 / 118.8 = 78%. Subscription gross profit FY2026 4,564.7 - 1,015.9 = 3,548.8. Professional services: revenue FY2018 118.8 - 92.6 = 26.2; FY2024 185.0 / 129.6 - 1 = 42.8%; FY2025 192.1 / 185.0 - 1 = 3.9%, about 4%; FY2026 247.3 / 192.1 - 1 = 28.7%, about 29%; compound FY2018-FY2026 (247.3 / 26.2)^(1/8) - 1 = 32.4%; gross profit FY2026 247.3 - 203.0 = 44.3; GAAP gross margin 44.3 / 247.3 = 17.9%, about 18%; share of gross profit 44.3 / 3,593.1 = 1.2%. Region: FY2026 growth United States 3,216.7 / 2,682.9 - 1 = 19.9%; EMEA 782.7 / 619.5 - 1 = 26.3%; Asia Pacific 495.7 / 402.5 - 1 = 23.2%; Other 317.0 / 248.7 - 1 = 27.4%. United States share FY2018 99.2 / 118.8 = 84%. ARR and net new ARR: ARR compound FY2018-FY2026 (5,252.8 / 141.3)^(1/8) - 1 = 57.1%, about 57%; net new ARR FY2026 5,252.8 - 4,241.8 = 1,010.9; FY2026 growth 1,010.9 / 806.7 - 1 = 25.3%, about 25%; FY2025 change 806.7 / 875.5 - 1 = -7.9%; FY2024 875.5 / 828.4 - 1 = 5.7%; FY2023 828.4 / 681.3 - 1 = 21.6%; H1 FY2027 net new ARR 255.8 + 332.8 = 588.6; FY2027 guided net new ARR 6,607.5 - 5,252.8 = 1,354.7; FY2027 ARR guidance midpoints: March (6,465.8 + 6,516.4) / 2 = 6,491.1, June (6,531.7 + 6,555.5) / 2 = 6,543.6, August (6,603.0 + 6,611.9) / 2 = 6,607.5; 6,607.5 / 5,252.8 - 1 = 25.8%, about 26%; FY2036 goal (20,000 / 5,252.8)^(1/10) - 1 = 14.3% a year; average net new ARR (20,000 - 5,252.8) / 10 = 1,474.7, about 1.47 billion. Falcon Flex: share of ARR 2.29 / 5.84 = 39%; Flex-account ARR a year earlier 2.29 / 2.01 = 1.14 billion; ARR outside Flex accounts 4.66 - 1.14 = 3.52 billion (July 2025) and 5.84 - 2.29 = 3.55 billion (July 2026), growth 3.55 / 3.52 - 1 = 0.8%, under 1%; ARR added 5.84 - 4.66 = 1.18 billion, of which Flex accounts 2.29 - 1.14 = 1.15 billion. Contracts: RPO within twelve months 0.46 x 10.7 = 4.9 billion (July 2026) and 0.51 x 9.0 = 4.6 billion (January 2026); RPO after twelve months 0.54 x 10.7 = 5.8 billion, 54% of RPO (July 2026), 0.49 x 9.0 = 4.4 billion (January 2026), 0.47 x 6.5 = 3.1 billion (January 2025), 0.37 x 3.4 = 1.3 billion (January 2023); RPO growth six months to July 2026 10.7 / 9.0 - 1 = 18.9%; FY2026 9.0 / 6.5 - 1 = 38.5%; RPO / trailing revenue 10.7 / 5.40 = about two years; unbilled backlog 5.9 / 2.8 - 1 = 111% in eighteen months. Deferred revenue 31 July 2026 3,497.1 + 1,345.1 = 4,842.2, about $4.84 billion; noncurrent share 1,345.1 / 4,842.2 = 27.8%, just over a quarter; deferred revenue 31 January 2025 2,733.0 + 995.7 = 3,728.7, 31 January 2026 3,421.1 + 1,332.4 = 4,753.4, growth 27.5%. Accounts receivable 1,038.6 / 1,470.9 = 71% of quarterly revenue. Subscription customers 29,000 / 23,019 - 1 = 26.0%, about 26%. H1 FY2027 revenue growth 2,856.5 / 2,272.4 - 1 = 25.7%, about 26%; H1 capital expenditure 222.0 / 116.2 = 1.9 times. Revenue per subscription customer FY2024 3,055.6 / 29,000 = about $105,000. Cash, costs and stock pay: GAAP operating margin FY2026 -293.3 / 4,812.0 = -6.1%; free cash flow margin FY2026 1,235.3 / 4,812.0 = 25.7%; FY2025 1,065.1 / 3,953.6 = 26.9%; FY2024 938.2 / 3,055.6 = 30.7%; free cash flow after stock pay 1,235.3 - 1,096.7 = 138.6, 138.6 / 4,812.0 = 2.9%; stock pay (cash flow) 1,096.7 / 4,812.0 = 22.8% (FY2026), 861.4 / 3,953.6 = 21.8% (FY2025), 648.7 / 3,055.6 = 21.2% (FY2024); stock pay and payroll tax 1,130.6 / 4,812.0 = 23.5% (FY2026), 903.6 / 3,953.6 = 22.9% (FY2025), 399.0 / 1,470.9 = 27.1% (Q2 FY2027), 276.7 / 1,169.0 = 23.7% (Q2 FY2026). Capital expenditure growth FY2024-FY2026 302.1 / 176.5 - 1 = 71.2%, about 71%; capex share of revenue FY2024 176.5 / 3,055.6 = 5.8%, FY2026 302.1 / 4,812.0 = 6.3%. Net cash 5,230.1 - 745.5 = 4,484.6, about $4.5 billion. Non-GAAP operating income guidance midpoint (1,497.2 + 1,508.4) / 2 = 1,502.8, 1,502.8 / 1,050 - 1 = 43%. July 19 incident net costs 60.1 + 117.7 = 177.8 (FY2025-FY2026) and 177.8 + 3.6 = 181.4, about $181 million through July 2026; update live 04:09 to 05:27 UTC = 78 minutes; cash against Delta claim 5,010 / 500 = about 10 times; a $250 million charge against free cash flow 250 / 1,235.3 = 20%, about a fifth. Acquisitions: cash consideration 96.4 + 213.7 + 252.7 + 212.1 + 327.5 + 627.9 = 1,730.3, about $1.7 billion; CyberArk against SGNL 21,061 / 627.9 = 33.5 times. Valuation: market value against Palo Alto Networks 258.72 / 306.54 = 0.84; Palo Alto price to sales 306.54 / 11.48 = 26.7; market value 25 September 2026 against 31 January 2026 258.718 / 111.278 = 2.3 times; price to trailing sales 258.718 / 5.396 = 47.9; analyst target 235.67 / 252.13 - 1 = -6.5%; market value over fiscal revenue 10.25 / 0.4814 = 21.3 (FY2020, December 2019 value), 46.86 / 0.8744 = 53.6 (FY2021, December 2020 value) - growth rates, margins and guidance. — FY2018-FY2027 · publ. September 2026 · source ↗
    Method: Arithmetic on figures reported in CrowdStrike's Forms 10-K and 10-Q, its results releases and market data; operands shown in the source line.
  7. ReportedAfter the first, net new ARR fell about 7.9% for a year; after a second, a similar fall in the following quarter's net new ARR, from $332.8 million in the latest one, should be expected.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
Sources
Generated September 28, 2026