Today’s cybersecurity threat landscape is more dangerous than ever. Breaches are complex and often executed over multiple steps, known in the industry as the threat lifecycle. The typical threat lifecycle starts with an initial exploit to enter a system, historically using malware but increasingly using malware-free or fileless methods to penetrate endpoints and establish a beachhead inside the corporate perimeter.
Once inside, adversaries move laterally across the corporate environment, where they collect credentials and escalate privileges enabling the typical adversary to download a larger, more destructive malware program or connect with an external control source. At this stage in the threat lifecycle, the adversary can encrypt, destroy, or silently exfiltrate sensitive data.
Increasingly, adversaries are well-trained, possess significant technological and human resources, are highly deliberate and targeted in their attacks, and are motivated by financial gains to hackers leveraging readily available advanced techniques. These groups and individuals are responsible for many breaches that involve theft or holding hostage financial data, intellectual property, and trade secrets.
On-Premise Security Architectures are siloed, lack integration, and have limited ability to collect, process, and analyze vast amounts of data—attributes required to be effective in today’s increasingly dynamic threat landscape. Legacy vendors often deploy more agents to the endpoint as they layer on a patchwork of additional point product capabilities.
This approach burdens endpoints by consuming additional storage space, memory, and processor capacity, degrading end-user experience without providing effective security. In addition, integrating and maintaining numerous products, data repositories, and infrastructures across highly distributed enterprise environments is a costly and resource-intensive process for already thinly-staffed security teams.
Crowdstrike created the first multi-tenant, cloud-native, open, intelligent security solution capable of protecting workloads across on-premise, virtualized, and cloud-based environments running on various endpoints such as laptops, desktops, servers, virtual machines, and IoT devices.
So as strategy enthusiasts, we decided to analyze the business model of Crowdstrike. We will also learn how does Crowdstrike work and make money. Who are the major competitors of Crowdstrike?
What is Crowdstrike? How doesCrowdstrike work?
CrowdStrike is an American cybersecurity technology company that provides cloud workload and endpoint security, threat intelligence, and cyberattack response services. George Kurtz, Dmitri Alperovitch, and Gregg Marston co-founded CrowdStrike in 2011.
Crowdstrike was founded on the principle that AI would drive the future of security and that a cloud-native architecture would enable the collection of high-fidelity data and scalability necessary for an effective solution.
Crowdstrike took a fundamentally new approach that works on the network effects of crowdsourced data applied to modern technologies such as AI, cloud computing, and graph databases. In June 2013, the company launched its first product, CrowdStrike Falcon, which provided endpoint protection, threat intelligence, and attribution.
Crowdstrike is defining a new category called the Security Cloud, with the power to transform the security industry much the same way the cloud has changed the CRM, HR, and service management industries. Crowdstrike delivers comprehensive breach protection against attacks on the endpoint, where the most valuable corporate data resides.
Crowdstrike’s Falcon platform comprises two tightly integrated proprietary technologies: a lightweight intelligent agent and a cloud-based, dynamic graph database called Threat Graph. Crowdstrike’s approach benefits from crowdsourcing and economies of scale. Crowdstrike calls this cloud-scale AI.
Cloud-scale AI means that the more data that is fed into the Falcon platform, the more intelligent the Threat Graph becomes and the more customers benefit, creating a powerful network effect that increases the overall value. Crowdstrike’s cloud-scale algorithms make over 91 million indicators of attack decisions per minute.
Crowdstrike’s single lightweight agent is installed on each endpoint and provides local detection and prevention capabilities while also intelligently collecting and streaming high-fidelity data to its platform for real-time decision-making. Crowdstrike’s Threat Graph processes, correlates, and analyze this data in the cloud using a combination of AI and behavioral pattern-matching techniques.
By leveraging a multi-tenant, cloud-native solution, the data Crowdstrike analyzes to stop breaches is larger and more meaningful than the data from on-premise or single-instance private cloud products. If Threat Graph discovers something in one customer environment, all customers benefit automatically and in real-time.
How does Crowdstrike make money? What is the business model of Crowdstrike?
Value Proposition
The Power of the Crowd: Crowdstrike’s crowdsourced data enables customers to benefit from contributing to Threat Graph. As more high-fidelity data is fed into the Falcon platform, there is more data to train the AI models with, increasing the overall efficacy of the platform. Threat Graph can then learn and identify warning signs once and rapidly deliver protection to every customer.
High Efficacy with Low False Positives: Crowdstrike’s Falcon platform collects, processes, correlates, and analyzes high-fidelity data on both real-world attacks and benign behavioral patterns to continually train and enhance Crowdstrike’s algorithms resulting in industry-leading threat detection and low false positive rates.
Consolidation of Siloed Products: Crowdstrike’s integrated platform unifies cloud modules addressing next-generation antivirus, EDR, device control, vulnerability management, IT hygiene, threat hunting, and automated threat intelligence, enabling customers to streamline their siloed and layered security products.
Consolidation of Agents: Crowdstrike’s cloud modules are powered by a single intelligent agent, allowing customers to consolidate and remove numerous agents from their infrastructure and restore endpoint performance.
Rapid Time to Value: On-premise security solutions take time to install, configure, deploy, and maintain. Crowdstrike streamlines the deployment process by providing cloud-delivered security with protection policies, eliminating lengthy implementation periods.
Bridging the Security Skills Gap through Automation: Crowdstrike’s solution automates certain previously manual tasks, freeing up personnel to focus on their most important objectives.
Lowering Total Cost of Ownership: Crowdstrike’s cloud-based platform eliminates the need for hardware purchases and does not require personnel to configure, implement or integrate disparate point products.
How does Palantir make money: Business Model & Competitor Analysis
Marketing Strategy of Crowdstrike
The marketing strategy of Crowdstrike focuses on driving market awareness, building a strong sales pipeline, and cultivating customer relationships to drive revenue growth.
Sales: Crowdstrike has a low-friction land-and-expand sales strategy. When customers deploy the Falcon platform, they can start with any number of cloud modules and easily add additional cloud modules. Once customers experience the benefits of the Falcon platform, they often expand their adoption over time by adding more endpoints or purchasing additional modules.
The business model of Crowdstrike primarily sells subscriptions to its Falcon platform and cloud modules through a direct sales team leveraging a network of channel partners. The sales team also identifies current customers who may be interested in free trial of additional cloud modules, which is a powerful driver of its land and expand model.
Marketing: Crowdstrike focuses on building brand reputation, increasing the awareness and reputation of its platform, and driving customer demand. As part of its marketing strategy, Crowdstrike delivers targeted content to demonstrate thought leadership in the security industry, including speaking engagements with the security industry’s foremost organizations to provide expert advice, issuing regular reports on the state of the industry, educating the public about the cybersecurity threats, and identifying and naming adversary groups.
How does Snowflake work: Business Model & Strategy
Crowdstrike also engages in paid media, web marketing, industry and trade conferences, analyst engagements, producing whitepapers, demand generation via digital and web, and targeted displacement campaigns.
Crowdstrike employs a wide range of digital programs, including search engine marketing, online and social media initiatives, and content syndication to increase traffic to its website and encourage new customers to sign up for a free trial of the Falcon platform.
Crowdstrike Competitors
Crowdstrike business model competes with established and emerging security product vendors. Crowdstrike competitors currently include the following by general category:
- Legacy antivirus product providers, such as Trellix (formerly McAfee Enterprise), Broadcom Inc.’s Symantec Enterprise division, and Microsoft Corporation, who offer a broad range of approaches and solutions, including traditional signature-based antivirus protection;
- alternative endpoint security providers, such as Blackberry Cylance, VMware Carbon Black, and SentinelOne, who generally offer a mix of on-premises and cloud-hosted products that rely heavily on malware-only or application whitelisting techniques;
- network security vendors, such as Palo Alto Networks, Inc., who are supplementing their core perimeter-based offerings with endpoint security solutions; and
- professional service providers, such as Mandiant and Microsoft Corporation, who offer cybersecurity response services.
How does Crowdstrike make money: revenue model
Crowdstrike made $1.45 billion in 2021. Crowdstrike makes money primarily from two revenue streams: Subscription fees to its Falcon platform and additional cloud modules and Professional services revenue that includes incident response and proactive services, forensic and malware analysis, and attribution analysis. 93% of revenue is generated through subscriptions.
Subscription Revenue: Subscription revenue primarily consists of subscription fees for its Falcon platform and additional cloud modules that are supported by Falcon’s cloud-based platform. Subscriptions are generally priced on a per-endpoint and per-module basis.
Subscription revenue is driven primarily by the number of subscription customers, the number of endpoints per customer, and the number of cloud modules included in the subscription. As of 2021, Crowdstrike had 16,325 subscribers, a 65% YoY growth from 2020.
Professional Services Revenue: Professional services revenue includes incident response and proactive services, forensic and malware analysis, and attribution analysis. Professional services are available through hourly rate and fixed fee contracts, one-time and ongoing engagements, and retainer-based agreements. Professional services business primarily acts as an opportunity to cross-sell subscriptions to the Falcon platform and cloud modules.
