CrowdStrike — Blitz Index 60 (B)
A great business — but the blitz phase is over.
Last re-scored: October 11, 2026.
Confidence: Low · S&P 500 · Nasdaq-100 · Category: platforms
Score breakdown
| Section | Score | Detail |
|---|---|---|
| A · Speed | 13 / 25 | Q2 FY27 +25.8% YoY ($1.471B); TTM ~$5.4B — a solid growth machine, not a blitz |
| B · Moat | 37 / 60 | Threat Graph data network + multi-module lock-in; Microsoft Defender bundle pressure caps the section |
| C · Creative destruction | 10 / 15 | Displaced legacy on-prem AV as the enterprise default — Defender remains a giant rival |
| D · BlitzFailing | 0 | No triggers — clean on accounting, governance, regulatory (Jul 2024 outage recovered, noted as worry) |
Think we scored it wrong? Score it yourself →
Radar axes (0–100): Moat 62 · Speed 52 · Creative 67.
Watch item
Gates: G1 ✓ (sustained 20%+ growth) · G2 ✓ (cybersecurity TAM dwarfs the $54B bar). 5 below threshold — joins the mature-SaaS borderline cluster.
Strengths
- Falcon multi-module expansion — land-and-expand growing per-customer revenue
- AI-era attack surface growth → structural cybersecurity TAM expansion
- Threat Graph data network effect — scale is detection quality
- Subscription SaaS structure, zero demerits
Concerns
- Microsoft Defender bundling — a permanent structural rival
- Jul 2024 Falcon outage residue — recovered metrics, but trust scars pushed multi-vendor strategies
- Growth decelerating: +25.8% could drag A1 further
- A2/A3/B4 unconfirmed — thin pack; re-score after Tier 3 pack reinforcement
Research notes
1. Current Position
Current position: CrowdStrike's first blitz — cloud-native endpoint security — is complete (legacy AV flagships sold off and exited); it now prepares the second blitz on the spoils (Threat Graph data effect, multi-module base). The precondition is trust recovery from the July 2024 Falcon outage. At 60/B — 5 points below the threshold — the score is closer to a floor: it rests on a stub pack with key figures unconfirmed, and 12/1 earnings are the full-pack supplementation opportunity.
2. Blitzscaling Lens
Blitzscaling lens: The embodiment of Rules 4 and 5 — the single-agent MVP launch and concentrating on Threat Graph data scale over feature battles. The breaking point is the price of Rule 3: the QA sacrificed for speed exploded in the Falcon outage, and large customers' turn to multi-vendor strategies exceeded Rule 7's permissible range. Post-outage cultural evolution toward efficiency and trust is the test.
3. Competitive Landscape
Competitive landscape: The legacy camp is gone; the structural competitor is Microsoft Defender, whose bundling offensive caps Section B at 37/60. Narrower fratricide with next-generation EDR vendors (SentinelOne and others) turns on Threat Graph scale, not features. The quiet disruptor now faces the quiet structural threat.
4. Inflection Points
Inflection points: (1) Q3 FY27 results (expected 12/1) — numerical confirmation of trust recovery (retention, NRR, modules per customer); (2) defending +25.8% growth, with guidance tone read alongside; (3) B4 margin confirmation, the stub pack's largest variable, worth 2–3 points on scoring.
5. One-Line Risk
One-line risk: Defender's bundling ceiling plus post-outage multi-vendor diversification among large customers could erode the Threat Graph scale advantage.
Latest quarter — Q2 FY2027
CrowdStrike's second quarter of fiscal 2027, reported August 26, 2026, showed revenue of $1.47 billion, up 26%, and ending annual recurring revenue of $5.84 billion, up 25% (SEC 8-K Exhibit 99.1). Net new annual recurring revenue of $332.8 million was a quarterly record, up 51%, and Falcon Flex accounts carry more than $2.29 billion, up 101%.
Reference point: Q3 2026 as of now = Q2 FY27 confirmed results (announced 2026-08, quarter ended July) + developments through T=2026-10-11. Q3 FY27 results not yet released → awaiting Q3 results (expected announcement date 12/1, MarketBeat estimate — needs re-verification). - BlitzLab v1.0 score: 60/B (A 13 + B 37 + C 10 − D 0). 5 points below the success threshold. Direction: rising (recovering — quarterly estimates 59(C)→61(B)). - Confidence: Low (Tier 3 stub pack — A2, A3, B4, D key figures unconfirmed, conservative scoring. Re-scoring after full-pack supplementation is recommended).
Current Position — Preparing the Second Blitz
CrowdStrike's first blitz — the cloud-native transformation of endpoint security — is over. The score file's summary is accurate: "The blitz era has passed. +25.8% on a TTM $5.4B scale — a sturdy growth machine, but not explosive speed." The spoils of that first blitz are clear. The flagships of legacy on-premise AV (Symantec enterprise, McAfee enterprise) were actually sold off and exited, pushed out of the enterprise default choice. In the Ledger's 2×2 matrix, CRWD sits in the "thrived × withered" cell — another case where the quiet disruption cut deep.
CrowdStrike now stands on the spoils of that first blitz (the Threat Graph data effect, the multi-module customer base), opening a second front. Multi-module expansion into Identity, Cloud, and SIEM/LogScale is the candidate second curve, structurally increasing per-customer revenue through the land-and-expand design. The G1 gateway verdict also reads, "the second curve is qualitatively confirmed, but no figures in the pack" — the curve's existence is acknowledged but not yet captured in the score.
But this "preparing the second blitz" has a precondition: the trust wound from the July 2024 Falcon sensor-update outage — the largest IT outage in history. Business metrics recovered (growth continued at +25.8%; judged not a D trigger), but the aftershock remains: large customers moved toward multi-vendor strategies. The direction assessment reads "B1 (Threat Graph trust) recovery is in progress." The score of 60 is 5 points below the threshold, and the score file believes "63–65 is attemptable once B1 fully recovers." In other words, this is the warm-up phase for the second blitz — and simultaneously the phase of working through the trust-recovery homework.
One honest caveat is needed. The score file underlying this research carries "low" confidence. With the Tier 3 pack at stub level, A2, A3, B4, and D key figures were conservatively scored as unconfirmed, and qualitative items rely on public-knowledge-based estimates. So 60/B is closer to a floor — the score file's own diagnosis is that B4 margin confirmation alone could move it 2–3 points. The 12/1 earnings are not just another quarter; they are the opportunity for "full-pack supplementation," and re-scoring then will be closer to the true score. Keep this in mind when reading this document as a verification draft.
Blitzscaling Lens
The embodiment of Rule 4 — "Launch a product that embarrasses you." CrowdStrike entered the market with an MVP of a single lightweight agent. It refused the head-on feature-checklist race with legacy AV vendors' heavy suites and sidestepped with a single core value: cloud-native EDR. The phenomenon of SOC operations being reorganized around cloud-native EDR and adopters not reverting to on-premise AV (the basis of C2's 3 points) is the legacy of that "embarrassing launch."
Rule 5 — "Let fires burn," done by the book. It ignored feature battles with point-solution vendors (small fires) and concentrated on the Falcon Threat Graph's data scale (the big fire). The virtuous cycle of more endpoints → better detection accuracy → more customers grounds B1's 9 points (top of the data-network-effect band), and the proposition that "scale is detection quality" shows blitzscaling's applicability condition ("a business model where speed pays off handsomely") as-is.
The breaking point — the price of Rule 3 ("tolerate 'bad' management"). The process and QA sacrificed for speed exploded in the July 2024 Falcon outage. The textbook side effect of blitzscaling. It was also the moment Rule 5's caveat — "put out only the big fires that can kill the company, leave small fires alone" — collapsed. The sensor-update process, regarded as a "small fire," became a "big fire" that could shake the company. Business metrics recovered, but large customers starting to diversify into multi-vendor strategies is also the price of exceeding Rule 7's ("Ignore your customers") permissible range — core-customer trust was not a small fire to ignore.
The test of Rule 9 (culture evolution). Whether the post-outage organization evolves its culture toward efficiency and trust is the qualitative watch point for B1's recovery. Just as the 10-person culture doesn't fit 1,000, the blitz-era culture cannot equal the harvest-and-trust-era culture. The success of this evolution will determine the execution power of the second blitz (multi-module expansion).
Competitive Landscape
The explicit competitors are the already-departed legacy camp. Symantec enterprise and McAfee enterprise — the flagships of the old era — were actually sold off and exited, and CrowdStrike pushed them out of the enterprise default choice. As the Ledger put it, "the quiet disruption (CRWD→Symantec) cut deep."
The structural competitor is Microsoft Defender. Bundling — security coming along with the OS and the productivity suite in pricing and procurement structure — is a ceiling CrowdStrike struggles to pierce. This is the passage the score file states explicitly: "the structural ceiling of Microsoft Defender's bundling offensive pins Section B at 37/60." It carries a fratricide character: the platform operator internalizing security. The Ledger's insight — "disruptor-vs-disruptor configurations are often the real threat" — appears for CRWD in the form of Defender.
Next-generation EDR vendors (SentinelOne and others) exist as fratricide in the narrower sense, but the structurally score-relevant one is Defender. The narrow-sense fratricide — next-generation EDR vendors like SentinelOne — also exists. These rivals fight in the same cloud-native grammar, and competition with them turns not on features but on the Threat Graph's scale — the critical mass of the data network effect. CrowdStrike's B1 9 points sitting "at the top of the 5–9 band" means, per the score file's verdict that it falls short of the 15–18 anchor tier (CUDA/iOS-class platform lock-in), that it has not yet reached the platform-lock-in league.
Ironically, CrowdStrike was once the "quiet disruptor" but now stands facing a "quiet structural threat" (Defender bundling). The arrow of disruption has come back around.
Inflection Points
① Completion of Falcon trust recovery — Q3 FY27 results (expected 12/1) are judgment day. What to watch: whether trust indicators — retention rates, NRR — are numerically confirmed, and whether multi-module adoption (modules per customer) is rising. This is also the quarter when the stub pack is supplemented and these figures enter the score for the first time. As the direction assessment says ("63–65 attemptable once B1 fully recovers"), numerical evidence of trust recovery is the direct variable for breaking through the threshold. Conversely, signals that large customers are accelerating multi-vendor diversification would damage the B1-recovery hypothesis.
② Defending the growth rate. What to watch: whether quarterly revenue YoY holds at +25.8% (Q2 FY27, $1.471B). The score file warned, "if it falls further from +25.8%, A1 may decline further." Mid-20s growth on a $5B+ scale is sturdy, but one step down shakes A1's 6-point foundation and can push the score into the low 60s. The guidance tone (raise, maintain, cut) must be read alongside.
③ B4 margin confirmation — the stub pack's largest variable. What to watch: confirmation of the gross-margin figure. The current B4 8 points is an estimated score — "mid-70s on public knowledge, but 8 to be conservative since the pack is unconfirmed" — and the score file states it could move 2–3 points on confirmation. If the high-margin structure of the SaaS-subscription-centered model is numerically proven, one axis of the sub-60 failure (one of the two items splitting the threshold alongside A1) is resolved. This is why re-scoring after full Tier 3 pack supplementation is recommended.
One-Line Risk
The structural ceiling of Microsoft Defender's bundling offensive — hard to pierce in pricing and procurement structure, capping Section B's upside (37/60) — combined with large customers' post-Falcon-outage multi-vendor diversification, could erode the Threat Graph virtuous cycle's scale advantage.
CrowdStrike reported second-quarter fiscal 2027 revenue of $1.47 billion, up 26% year over year from $1,169.0 million, with subscription revenue of $1.40 billion, up 27% (SEC 8-K Exhibit 99.1). Ending annual recurring revenue reached $5.84 billion as of July 31, 2026, up 25% year over year, and net new annual recurring revenue was $332.8 million, a quarterly record and up 51% from $221.1 million a year earlier. Management said net new annual recurring revenue exceeded its own guidance by more than $45 million, and the company has now reported five consecutive quarters of accelerating revenue growth (company Q2 FY2027 earnings call). The quarter's growth came with record cash generation: operating cash flow was $530.3 million, up about 59%, and free cash flow was $377.4 million, up 33%, both quarterly records (SEC 8-K Exhibit 99.1).
Falcon Flex is the growth engine inside the quarter. Annual recurring revenue from accounts that have adopted Falcon Flex exceeded $2.29 billion, up 101% year over year, about 39% of total ending annual recurring revenue, and growing roughly four times as fast as total annual recurring revenue (SEC 8-K Exhibit 99.1). The figure counts the annual recurring revenue of Flex-adopting accounts, not Flex product revenue alone. Adoption is deepening across the base: 51% of subscription customers use six or more modules, 35% use seven or more, and 26% use eight or more. The pattern points to consolidation: customers expanding within one platform rather than adding vendors. The next check is whether Flex adoption keeps converting into net new annual recurring revenue at the guided pace.
The quarter also shows the gap between CrowdStrike's two profitability lenses. GAAP operating loss narrowed to $33.2 million from $105.5 million a year earlier, and GAAP net income was $5.3 million, a return to profit from a $70.2 million loss (SEC 8-K Exhibit 99.1). Non-GAAP operating income was $371.6 million, about a 25% margin, and non-GAAP net income was $322.9 million, with non-GAAP diluted earnings per share of $0.31, up about 35% from $0.23. Stock-based compensation of $399.0 million in the quarter, plus related payroll taxes, explains most of the difference between the two measures. Presenting both is more accurate than either alone: the GAAP figures show a business still absorbing the cost of equity compensation, while the non-GAAP figures show the underlying operating leverage. Cash of $5.01 billion at quarter end gives the company room to keep investing while the GAAP line catches up.
Guidance points to the acceleration continuing. For the third quarter of fiscal 2027, CrowdStrike guided ending annual recurring revenue to $6,184.4-$6,188.4 million and total revenue to $1,523.2-$1,529.2 million (SEC 8-K Exhibit 99.1). For the full fiscal year, guidance calls for ending annual recurring revenue of $6,603.0-$6,611.9 million and total revenue of $5,991.1-$6,011.1 million, with net new annual recurring revenue growth of 34% at the midpoint, up 630 basis points from the prior outlook. The third quarter is the first test of that outlook: the company announced on November 4, 2026 that it will report third-quarter fiscal 2027 results on December 1, 2026, after the market close, with a call at 2 p.m. Pacific Time (company announcement). Whether the quarter's net new annual recurring revenue lands near the guided run rate will show whether Flex-driven demand is converting into booked revenue.
Since the quarter, the story has shifted from endpoint security to securing artificial intelligence itself. At Fal.Con 2026 in September, CrowdStrike launched SafeMind, a security model built on NVIDIA Nemotron, alongside Falcon Guardian for AI detection and response, Falcon IQ, and an agentic identity provider, and expanded partnerships with OpenAI, Anthropic, and Google Cloud (company press release, September 1, 2026). In November it expanded a partnership with CoreWeave to protect production AI workloads and a strategic partnership with Dynatrace linking Falcon to AI observability and log management (company announcements, November 2, 2026). In October it completed the acquisition of XM Cyber's technology assets, including more than 45 patents and source code, for about $586 million, reported citing the company's SEC filing. The thread is consistent: the platform is being repositioned from protecting endpoints to protecting AI agents and the infrastructure they run on.
More Platforms companies
Other Platforms names on the Blitz Index, highest score first: Alphabet (83/A), Meta (78/B), Airbnb (76/B).
Next earnings
Dec 1, 2026 · After close · Confirmed
Coverage
As of October 2026 · Model v1.0 (frozen) · Confidence: Low (thin Tier 3 pack, conservative scoring) · Not investment advice — a scholar's assessment.
Embed this score
Copy the HTML below to show this score on your site. The badge links back to this page and updates automatically when the score changes.
Preview:
BlitzLab scores businesses against a scholar’s standard — not investment advice. No price targets, no buy/sell recommendations. Figures are from SEC filings (XBRL) as labeled in the source scorecard.