CRWD 10-K & 10-Q changes, risk factors and insider trading

On July 19, 2024, we released a content configuration update for our Falcon sensor that resulted in system crashes for certain Windows systems (the “July 19 Incident”). We have incurred, and expect to continue to incur, significant costs and expenses related to the incident. The July 19 Incident has harmed, and is expected to continue to harm, our business, sales, customer and partner relations, and our reputation. As a result of the incident,July 19 Incident, certain of our existing or prospective customers have electeddeferred to,or anddecided mayagainst inpurchases the future elect to, defer purchasing decisions relating toof our products and services and terminated or chosen not purchaseto ourrenew productstheir contracts with us, and services at all. Customers have also decided, andothers may take similar actions in the future decide, to terminate or not renew their agreements with us.future. The July 19 Incident has negatively impacted, and may in the future negatively impact, our existing or prospective partners’ ability or willingness to promote our products or services. Certain of our competitors have aggressively approached our current and prospective customers and partners to attempt to capitalize on the incident,July 19 Incident, and may continue to do so. Furthermore, we have agreed to, and expect to agree to in the future, provide incentives in connection with our commercial arrangements with our customers, including subscription period extensions, discounts or promotional modules. The July 19 Incident has received negative media coverage and harmed our reputation and brand. Additional negative media coverage and publicity, whether directly or indirectly related to the July 19 Incident, may harm our reputation and brand further, exacerbating the effects discussed herein. These factors may result in harm to our business, results of operations and financial condition. While we are investing in enhancements to software resiliency, testing and customer controls following the July 19 Incident, we cannot guarantee that such enhancements will be effective, or that our products do not have or will not have defects, errors, or vulnerabilities.

We have experienced rapid revenue growth in recent periods and we expect to continue to invest broadly across our organization to support our growth. For example, our headcount grew from 7,273 employees as of January 31, 2023, to 10,118 employees as of January 31, 2025. Although we have experienced rapid growth historically, we may not sustain our current growth rates and our investments to support our growth may not be successful. The growth and expansion of our business will require us to invest significant financial and operational resources and the continuous dedication of our management team. Our future success will depend in part on our ability to manage our growth effectively, which will require us to, among other things:

We have incurred net losses each year prior to fiscal 2024, and we may not achieve or maintain profitability in the future. We experienced net losses of $19.3$162.5 million and $183.2$15.2 million for fiscal 20252026 and 2023,2025, respectively, and net income of $89.3$72.2 million for fiscal 2024. As of January 31, 2025,2026, we had an accumulated deficit of $1.1$1.3 billion. While we have experienced significant growth in revenue in recent periods, and have achieved profitability during certain periods, including fiscal 2024, we cannot assure you when or whether we will reach sustained profitability. We also expect our operating expenses to increase in the future as we continue to invest for our future growth, which will negatively affect our results of operations if our total revenue does not increase. We cannot assure you that these investments will result in substantial increases in our total revenue or improvements in our results of operations. We also have incurred and expect to continue to incur significant additional legal, accounting, and other expenses as a public company. Any failure to increase our revenue as we invest in our business or to manage our costs could prevent us from achieving or maintaining profitability or positive cash flow.

To expand our customer base, we need to convince potential customers to allocate a portion of their discretionary budgets to purchase our Falcon platform. Our sales efforts often involve educating our prospective customers about the uses and benefits of our Falcon platform. Enterprises and governments that use legacy security products, such as signature-based or malware-based products, firewalls, intrusion prevention systems, and antivirus, for their IT security may be hesitant to purchase our Falcon platform if they believe that these products are more cost effective, provide substantially the same functionality as our Falcon platform or provide a level of IT security that is sufficient to meet their needs. We may have difficulty convincing prospective customers of the value of adopting our solution. Even if we are successful in convincing prospective customers that a cloud native platform like ours is critical to protect against cyberattacks, they may not decide to purchase our Falcon platform for a variety of reasons, some of which are out of our control. For example, any deterioration in general economic conditions, including as a result of the geopolitical environment,environment or changes and uncertainty regarding trade policies or tariffs, the outbreak of diseases or other public health crises, volatility in the banking and financial services sector, or inflation (as well as government policies such as raising interest rates in response to inflation), have in the past and may in the future cause our current and prospective customers to delay or cut their overall security and IT operations spending, and such delays or cuts may fall disproportionately on cloud-based security solutions like ours. Economic weakness, customer financial difficulties, constrained spending on security and IT operations, and the impact of the July 19 Incident may result in decreased revenue, reduced sales, an increase in multi-phase subscription start dates, shorter terms for customer subscriptions, lengthened sales cycles, increased churn, lower demand for our products, and adversely affect our results of operations and financial conditions. Furthermore, we may need to exercise more flexibility in customer payment terms as customers navigate a more challenging economic environment. Additionally, if the incidence of cyberattacks were to decline, or be perceived to decline, or if organizations adopt endpoints that use operating systems we do not adequately support, our ability to attract new customers and expand sales of our solutions to existing customers could be adversely affected. If organizations do not continue to adopt our Falcon platform, our sales will not grow as quickly as anticipated, or at all, and our business, results of operations, and financial condition would be harmed.

In order for us to maintain or improve our results of operations, it is important that our customers renew their subscriptions for our Falcon platform when existing contract terms expire, and that we expand our commercial relationships with our existing customers by selling additional cloud modules and by deploying to more endpoints in their environments. Our customers have no obligation to renew their subscription for our Falcon platform after the expiration of their contractual subscription period, which is generally one to three years, and in the normal course of business, some customers have elected not to renew. In addition, customers that previously signed multi-year subscription contracts may renew for shorter contract subscription lengths, and customers may cease using certain cloud modules altogether. Even if customers choose to renew their subscription of certain cloud modules, they may decline to purchase additional cloud modules or choose not to consolidate onto our Falcon platform. Our customer retention, renewals and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products and services, our customers’ ability to fully utilize their product subscriptions, our pricing, customer security and networking issues and requirements, our customers’ spending levels, decreases in the number of endpoints to which our customers deploy our solutions, mergers and acquisitions involving our customers, industry developments, competition, the impact of the July 19 Incident, including the impact of our customer commitment packages, and general economic and geopolitical conditions. Any such impacts on customer renewals may beresult associated withfrom a variety of different factors, including customers electing to renew with shorter subscription periods, fewer cloud modules, fewer endpoints or smaller contract values. If our efforts to maintain and expand our relationships with our existing customers are not successful, our business, results of operations, and financial condition may materially suffer.

Our revenue recognition is difficult to predict because of the length and unpredictability of the sales cycle for our Falcon platform. Customers often view the subscription to our Falcon platform as a significant strategic decision and, as a result, frequently require considerable time to evaluate, test and qualify our Falcon platform prior to entering into or expanding a relationship with us. Large enterprises and government entities in particular often undertake a significant evaluation process that further lengthens and adds uncertainty to our sales cycle. In addition, uncertain economic conditionsor geopolitical conditions, including in connection with changes in trade policies and tariffs, may lead to additional scrutiny of budgets by current and prospective customers, which has resulted in, for example, longer sales cycles for products and services, and may result in shifting demand for IT products and services, and slower adoption of new technologies. We have also experienced, and expect tomay continue to experience, longer sales cycles in connection with the July 19 Incident. We may also experience longer sales cycles as customers seek to consolidate on our Falcon platform and negotiate larger deals, including in connection with our flexible subscription offering.

Many of our competitors have greater financial, technical, marketing, sales, and other resources, greater name recognition, longer operating histories, and a larger base of customers than we do. They may be able to devote greater resources to the development, promotion, and sale of services than we can, and they may offer lower pricing than we do. Further, they may have greater resources for research and development of new technologies, the provision of customer support, and the pursuit of acquisitions. Our larger competitors have substantially broader and more diverse product and services offerings as well as routes to market, which allows them to leverage their relationships based on other products or incorporate functionality into existing products to gain business in a manner that discourages users from purchasing our platform, including our cloud modules. Conditions in our market couldare changechanging rapidly and significantly as a result of technological advancements, including with respect to AI. Our competitors may more successfully incorporate AI into their products, gain or leverage superior access to certain AI technologies, and achieve higher market acceptance of their AI solutions. Conditions in our market could also change rapidly and significantly due to partnering or acquisitions by our competitors or continuing market consolidation. Some of our competitors have recently made acquisitions of businesses or have established cooperative relationships that may allow them to offer more directly competitive and comprehensive solutions than were previously offered and adapt more quickly to new technologies and customer needs. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, increased net losses and loss of market share. Further, competitors that specialize in providing protection from a single type of security threat may be able to deliver these targeted security products to the market quicker than we can or convince organizations that these limited products meet their needs. Even if there is significant demand for cloud-based security solutions like ours, if our competitors include functionality that is, or is perceived to be, equivalent to or better than ours in legacy products that are already generally accepted as necessary components of an organization’s IT security architecture, we may have difficulty increasing the market penetration of our solutions. Furthermore, even if the functionality offered by other security and IT operations providers is more limited than the functionality of our platform, organizations may elect to accept such limited functionality in lieu of adding products from additional vendors like us. If we are unable to compete successfully, or if competing successfully requires us to take aggressive pricing or other actions, our business, financial condition, and results of operations would be adversely affected.

Real or perceived defects, errors or vulnerabilities in our Falcon platform and cloud modules, the failure of our platform to detect or prevent incidents, including advanced and newly developed attacks, misconfiguration of our solutions, or the failure of customers to take action on attacks identified by our platform could harm our reputation and adversely affect our business, financial position and results of operations. Because our cloud native security platform is complex, it has contained, and may in the future contain defects, errors or vulnerabilities that are not detected until after deployment. For example, the July 19 Incident harmed our brand and reputation, business and results of operations. In addition, we identified a transport layer security issue that impacted certain Falcon Linux sensors, which led us to release a security fix and publish a security advisory to remediate the matter in February 2025. If we fail to timely detect defects or errors before deployment in the future, our brand and reputation, business and results of operations will suffer further. We cannot assure you that our products will detect all cyberattacks, especially in light of the rapidly changing security threat landscape that our solution seeks to address. Due to a variety of both internal and external factors, including, without limitation, defects or misconfigurations of our or third-party solutions, our solutions could be or become vulnerable to security incidents (both from intentional attacks and accidental causes) that cause them to fail to secure endpoints and detect and block attacks. Furthermore, any defects, errors or vulnerabilities in third-party technology or solutions we rely on could result in disruptions to our operations and adversely impact our business, financial condition and results of operations. In addition, because the techniques used by computer hackers to access or sabotage networks and endpoints change frequently and generally are not recognized until launched against a target, there is a risk that an advanced attack could emerge that our cloud native security platform is unable to detect or prevent until after some of our customers are affected. Additionally, our Falcon platform may falsely indicate a cyberattack or threat that does not actually exist, which may lessen customers’ trust in our solutions.

Moreover, as our cloud native security platform is adopted by an increasing number of enterprises and governments, individuals and organizations behind advanced cyberattacks may intensify their efforts to defeat our security platform. If this happens, our systems and subscription customers could be specifically targeted by attackers and could result in vulnerabilities in our platform or undermine the market acceptance of our Falcon platform and could adversely affect our reputation as a provider of security solutions. Because we host customer data on our cloud platform, which in some cases may contain personally-identifiable information or potentially confidential information, a security compromise, or an accidental or intentional misconfiguration or malfunction of our platform or third-party platforms, could result in personally-identifiable information and other customer data being accessible such as to attackers or to other customers. Further, if a high profile security breach occurs with respect to another next-generation or cloud-based security system, our customers and potential customers may lose trust in cloud solutions generally, and cloud-based security solutions such as ours in particular.

It is virtually impossible for us to entirely eliminate the risk of such attacks, compromises, interruptions in service, or other security incidents affecting our internal systems or data, or that of our third-party service providers and vendors. Organizations are subject to a wide variety of attacks on their supply chain, networks, systems, and endpoints, and techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently. Furthermore, employee error or malicious activity could compromise our systems. As a result, we may be unable to anticipate these techniques or implement adequate measures to prevent an intrusion into our networks, which could result in unauthorized access to customer data, intellectual property including access to our source code, and information about vulnerabilities in our product, which in turn, could reduce the effectiveness of our solutions, or lead to cyberattacks or other intrusions of our customers’ networks, litigation, governmental audits and investigations and significant legal fees, any or all of which could damage our relationships with our existing customers and could have a negative effect on our ability to attract and retain new customers. We have expended, and anticipate continuing to expend, significant resources in an effort to prevent security breaches and other security incidents impacting our systems and data. Since our business is focused on providing reliable security services to our customers, we believe that an actual or perceived security incident affecting our internal systems or data or data of our customers would be especially detrimental to our reputation, customer confidence in our solution, and our business.

In addition, job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment. Therefore, volatility or lack of performance in our stock price could affect our ability to attract and retain our key employees. Also, many of our employees have become, or will soon become, vested in a substantial amount of equity awards, which may give them a substantial amount of personal wealth. This may make it more difficult for us to retain and motivate these employees, and this wealth could affect their decision about whether or not they continue to work for us. In addition, the Strategic Plan (as defined in the notes to our consolidated financial statements) could negatively affect our ability to recruit and retain skilled personnel. Any failure to successfully attract, integrate or retain qualified personnel to fulfill our current or future needs could adversely affect our business, results of operations and financial condition.

•deteriorating or volatile conditions in the global economy and financial markets, including as a result of weak or negative gross domestic product growth, uncertainty or disruptions in the capital and credit markets, changing interest rates, inflation, tariffs and trade restrictions, bank failures or adverse conditions impacting financial institutions, and supply-chain disruptions; and

•greater risk of unexpected changeschanges, or threat of changes, in regulatory practices, tariffs, and tax laws and treaties or the application thereof;

•unexpected costs for the localization of our services, including translation into foreign languages and adaptation for local practices and regulatory requirements (including, but not limited to data localization requirements, digital sovereignty requirements and other restrictions, such as those emerging in the EU);

•government certification, software supply chain, orand source code transparency requirements applicable to us or our products are constantly evolving and, in doing so, restrict our ability to sell to certain government customers until we have attained the new or revised certification or meet other applicable requirements, which we are not guaranteed to do. For example, although we are currently certified under the U.S. Federal Risk and Authorization Management Program, or FedRAMP, such certification is costly to maintain and if we lose our certificationcertification, it would restrict our ability to sell to government customers;

Our future growth is dependent upon our ability to continue to meet the needs of new customers and the expanding needs of our existing customers as their use of our solutions grow. As our customers gain more experience with our solutions, the number of endpoints and events, the amount of data transferred, processed and stored by us, the number of locations where our platform and services are being accessed, have in the past, and may in the future, expand rapidly. In order to meet the performance and other requirements of our customers, we intend to continue to make significant investments to increase capacity and to develop and implement new technologiestechnologies, including those involving AI, in our service and cloud infrastructure operations. These technologies, which include databases, applications and server optimizations, network and hosting strategies, and automation, are often advanced, complex, new and untested. We may not be successful in developing or implementing these technologies. In addition, as our business grows, we must continue to improve and expand our information technology infrastructure. It takes a significant amount of time to plan, develop and test improvements to our technologies and infrastructure, and we may not be able to accurately forecast demand or predict the results we will realize from such improvements. We rely on external ecosystems, such as operating systems,systems and platforms, to operate and makemake, in various layers of technology stacks, our products and services available to customers. If we are unable to adapt to product or policy changes in such ecosystems, or if we do not effectively operate with such ecosystems, demand for and availability of our products or services could decline. To the extent that we do not effectively scale our operations and infrastructure to meet the needs of our business, our growing customer base and to maintain performance as our customers expand their use of our solutions, we may not be able to grow as quickly as we anticipate, our customers may reduce or cancel use of our solutions and we may be unable to compete as effectively and our business and results of operations may be harmed.

We expect that the combination of our existing cash and cash equivalents,equivalents and cash flows from operations, and our revolving facilityoperations will be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 12 months. Retaining or expanding our current levels of personnel and product and service offerings may require additional funds to respond to business challenges, including the need to develop new products or services and enhancements to our Falcon platform, improve our operating infrastructure, or acquire complementary businesses and technologies. Our failure to raise additional capital or generate the significant capital necessary to expand our operations and invest in new products or services could reduce our ability to compete and could harm our business. Accordingly, we may need to engage in additional equity or debt financings to secure additional funds. If we raise additional equity financing, our stockholders may experience significant dilution of their ownership interests and the market price of our common stock could decline. If we engage in additional debt financing, the holders of such debt would have priority over the holders of our common stock, and we may be required to accept terms that further restrict our operations or our ability to incur additional indebtedness or to take other actions that would otherwise be in the interests of the debt holders. Any of the above could harm our business, results of operations, and financial condition.

We rely on a limited number of suppliers for several components of the equipment we use to operate our cloud platform and provide services to our customers. We generally purchase these components on a purchase order basis, and do not have long-term contracts guaranteeing supply. Our reliance on these suppliers exposes us to risks, including reduced control over production costs and constraints based on the then current availability, terms and pricing of these components. If we experience disruption or delay from our suppliers, we may not be able to obtain supplies or components from alternative suppliers on a timely basis or on terms that are favorable to us, if at all. Such risks may become more pronounced as we continue to scale our business. The technology industry has experienced widespread component shortages and delivery delays, including as a result of geopolitical tensions,tensions (including actual or threatened changes in tariffs and trade restrictions), public health crises and natural disasters. We may also experience component shortages and pricing increases from certain of our suppliers as a result of increased demand for such components. While we have taken steps to mitigate our supply chain risk, supply chain disruptions and delays could nevertheless adversely impact our operations by, among other things, causing us to delay opening new data centers, delay increasing capacity or replacing defective equipment at existing data centers, and experience increased operating costs.

In the United States, there are numerous federal, state and local data privacy and security laws, rules, and regulations governing the collection, sharing, use, retention, disclosure, security, transfer, storage and other processing of personal information, including federal and state data privacy and security laws, data breach notification laws, and data disposal laws. For example, at the federal level, we are subject to, among other laws and regulations, the rules and regulations promulgated under the authority of the Federal Trade Commission (which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including acts and practices with respect to data privacy and security), as well as the Electronic Communication Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act, and the Gramm Leach Bliley Act. The United States Congress also has considered, is currently considering, and may in the future will likely consider, variousproposals proposalsfrom time to time for comprehensive federal data privacy and security legislation, to which we may become subject if passed.

Internationally, virtually every jurisdiction in which we operate has established its own data privacy and security legal framework with which we must comply. For example, we are required to comply with the European Union (“EU”) General Data Protection Regulation (“GDPR”) and its equivalent in the U.K. (“U.K. GDPR”), which impose stringent obligations regarding the collection, control, use, sharing, disclosure and other processing of personal data and create mandatory breach notification requirements under certain circumstances. While the GDPR and U.K. GDPR remain substantially similar for the time being, the U.K. government has announcedadopted plans and introduced legislative proposalsreforms to chart its own path on data protection andlegal reformframework in its relevantData laws,Use includingand Access Act 2025, which became law on June 19, 2025 (phasing in waysbetween thatJune may2025 differand June 2026) and will introduce significant changes from the GDPR. WhileThis thesemay developmentslead to additional compliance costs and could increase uncertaintyoverall withrisk regardexposure as businesses may no longer be able to datatake protectiona regulationunified inapproach across the European Economic Area (“EEA”) and the U.K., evenand insuch businesses may need to amend their current,processes substantiallyand similarprocedures form,to align with the new framework. Implementing mechanisms to endeavor to ensure compliance with the GDPR and the U.K. GDPR canmay be onerous and expose businesses to divergent parallel regimes that may be subject to potentially different interpretations and enforcement actions for certain violations and related uncertainty. Failure to comply with the GDPR or the U.K. GDPR can result in significant fines and other liability, including, under the GDPR, fines of up to EUR 20 million (or GBP 17.5 million under the U.K. GDPR) or four percent (4%) of annual global revenue, whichever is greater. European data protection authorities have already imposed fines for GDPR violations of up to, in some cases, hundreds of millions of Euros.

Legal developments in the European Economic Area (“EEA”) have created complexity and uncertainty regarding processing and transfers of personal data from the EEA to the United States and other so-called third countries outside the EEA, including in the context of website cookies. Similar complexities and uncertainties also apply to transfers from the U.K. to third countries. While we have taken steps to mitigate the impact on us, such as implementing the European Commission’s standard contractual clauses (“SCCs”) and the U.K.’s international Data Transfer Agreement (or the U.K.’s international data transfer addendum that can be used with the SCCs), the efficacy and longevity of these mechanisms remains uncertain. On July 10, 2023, the European Commission adopted an adequacy decision concluding that the U.S. ensures an adequate level of protection for personal data transferred from the EU to the U.S. under the recently adopted EU-U.S. Data Privacy Framework (followed on October 12, 2023 with the adoption of an adequacy decision in the U.K. for the U.K.-U.S. Data Bridge); however, such new adequacy decision has been challenged in EU courts, and is likely to face additional challenges. Moreover, although the U.K. currently has an adequacy decision from the European Commission, such that SCCs are not required for the transfer of personal data from the EEA to the U.K., that decision will sunset in JuneDecember 20252031 unless extended or renewed and it may be revoked in the future by the European Commission if the U.K. data protection regime is reformed in ways that deviate substantially from the GDPR. The EU has also proposedenacted legislation that would regulate non-personal data and establish new cybersecurity standards, and other countries, including the U.K., may similarly do so in the future. In particular, the EU’s Digital Services Act and the EU’s Data Act both entered into force in 2024 and impose certain content moderation, notice and transparency obligations on digital platforms and intermediaries and certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers (as well as certain requirements concerning cross-border international transfers of non-personal data outside the EEA), respectively. Additionally, the EU’s Network and Information Security Directive II, adopted in 2023, regulates resilience and incident response capabilities of entities operating in a number of sectors, including the digital infrastructure sector and provides for EU member states to have issued implementing legislation by October 2024. Further, the EU’s Digital Operational Resiliency Act became effective in January 2025 and imposes certain requirements on entities in the financial sector and their third-party cloud service providers related to managing and mitigating information and communication technology risk. If we are otherwise unable to transfer data, including personal data, between and among countries and regions in which we operate, or are otherwise required to modify our practices, including our data privacy and security controls and procedures, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. While we have implemented new controls and procedures designed to comply with the requirements of the GDPR, U.K. GDPR and the data privacy and security laws of other jurisdictions in which we operate, such procedures and controls may not be effective in ensuring compliance or preventing unauthorized transfers of personal data.

Moreover, while we strive to publish and prominently display privacy policies that are accurate, comprehensive, and compliant with applicable laws, rulesrules, regulations and industry standards, we cannot ensure that our privacy policies and other statements regarding our practices will be sufficient to protect us from claims, proceedings, liability or adverse publicity relating to data privacy and security. Although we endeavor to comply with our privacy policies, we may at times fail to do so or be alleged to have failed to do so. If our public statements about our use, collection, disclosure and other processing of personal information, whether made through our privacy policies, information provided on our website, press statements or otherwise, are alleged to be deceptive, unfair or misrepresentative of our actual practices, we may be subject to potential government or legal investigation or action, including by the Federal Trade Commission or applicable state attorneys general.

Our business is subject to regulation by various federal, state, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing data privacy and security laws and regulations, employment and labor laws, workplace safety, product safety, environmental laws, consumer protection laws, anti-bribery laws, import and export controls, federal securities laws and tax laws and regulations. In certain jurisdictions, these regulatory requirements may be more stringent than in the United States. Increased scrutiny may also lead to new laws and regulations, or new applications of existing laws and regulations, that target topics such as AI, critical infrastructure software resiliencyresiliency, digital sovereignty requirements and concentration risk. Our efforts to comply with applicable laws and regulations may increase operating costs, which could adversely affect our business and operations. Noncompliance by us, our employees, representatives, contractors, channel partners, agents, intermediaries, or other third parties with applicable regulations or requirements could subject us to:

We incorporate novel uses of AI technologies, including generative AI, into our products and operations, such as our Falcon platform. AI is complex and rapidly evolving, and we face significant competition from other companies who may incorporate AI into their products more quickly or more successfully than us, as well as an evolving regulatory landscape. The introduction of AI, and particularly generative AI, a relatively new and emerging technology in the early stages of commercial use, into new or existing products, and our operations, may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results. For example, generative AI has been known to produce a false or “hallucinatory” interferences or output,outputs, and certain generative AI uses machine learning and predictive analytics, which may be flawed, insufficient, of poor quality, reflect unwanted forms of bias, or contain other errors or inadequacies, any of which may not be easily detectable. Our customers or others may rely on or use this flawed content to their detriment, which may expose us to brand or reputational harm, competitive harm, and/or legal liability. In addition, the use of AI by other companies has resulted in, and may in the future result in, data breaches and cybersecurity incidents that implicate the personal information of AI users. Further, the use of AI presents emerging ethicalethical, social, legal and socialother issues, and if we enable or offer solutions that draw scrutiny or controversy due to their perceived or actual impactrisks or impacts on customers or on society as a whole, we may experience brand or reputational harm, competitive harm, delays in customer purchasing decisions and/or legal liability. Our continued incorporation of AI, including generative AI, into our products and operations requires us to expend significant resources. If such investments do not deliver anticipated benefits or are not otherwise successful, our business and results of operations may be harmed.

The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, privacy, data protection,protection cybersecurity, consumer protection, competition, and equal opportunity laws and regulations, and are expected to be subject to new laws and regulations or new applications of existing laws and regulations. AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity and data protection laws to AI or are considering general legal frameworks for AI. For example, in Europe,the EU, the first set of provisions under the EU’s AI Act wasbecame publishedeffective in theFebruary Official2025, Journalwith ofadditional theprovisions EUbecoming effective on Julylater 12, 2024 and entered into force on August 1, 2024.dates. The AI Act establishes, among other things, a risk-based governance framework for regulating AI systems in the EU by categorizing AI systems, based on the risks associated with such AI systems’ intended purposes, as creating unacceptable or high risks, with all other AI systems being considered low risk. This regulatory framework is expected to have a material impact on the way AI is regulated in the EU and beyond. As further indication of a trend in increased regulatory and legislative oversight of the use and development of AI, in 2024, California enacted a range of laws regulating the use and development of AI, which generally relate to transparency, privacy and fairness, among other concerns. Other states, including Texas, Colorado and Utah, have also enacted AI-related laws, and several more have proposed enacting such laws.

Sales of a substantial number of shares of our common stock in the public market, particularly sales by our directors, executive officers and significant stockholders, or the perception that these sales could occur, could adversely affect the market price of our common stock. As of February 28, 2025,2026, we had 247,873,415253,614,090 shares of Class A common stock outstanding.

We have never declared or paid any cash dividends on our capital stock. We currently intend to retain all available funds and any future earnings for use in the operation of our business and do not anticipate paying any dividends in the foreseeable future. Any determination to pay dividends in the future will be at the discretion of our board of directors. Additionally, our ability to pay dividends ismay become limited by restrictions on our ability to pay dividends or make distributions under the terms of ourany future credit facility. Accordingly, investors must rely on sales of their common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

As of January 31, 2025,2026, we had $750.0 million principal amount of indebtedness outstanding (excluding intercompany indebtedness), and there is additional availability under our revolving facility of up to $750.0 million (excluding issued but undrawn letters of credit). Our indebtedness could have important consequences, including:

We may not be able to generate sufficient cash to service all of our indebtedness, including the notes,Senior Notes, and may be forced to take other actions to satisfy our obligations under our indebtedness, which may not be successful.

Our ability to make scheduled payments on or to refinance our debt obligations, including the Senior Notes, depends on our financial condition and results of operations, which in turn are subject to prevailing economic and competitive conditions and to certain financial, business and other factors beyond our control. We may not be able to maintain a level of cash flows from operating activities sufficient to permit us to pay the principal, premium, if any, and interest on our indebtedness, including the notes.Senior Notes.

If we cannot make scheduled payments on our indebtedness, we will be in default and holders of our Senior Notes could declare all outstanding principal and interest to be due and payable,payable. Such a default could result in material adverse consequences that negatively impact our business, the lendersmarket underprice for our revolvingcommon facilitystock, couldand terminateour their commitmentsability to loanobtain money,financing our secured lenders could foreclose againstin the assets securing their borrowings and we could be forced into bankruptcy or liquidation.future. If we breach the covenants under our debt instruments, we would be in default under such instruments. The holders of such indebtedness could exercise their rights, as described above, and we could be forced into bankruptcy or liquidation.

Our revolving facility and theThe indenture that governs our Senior Notes containcontains, and future credit agreements may contain, terms which restrict our current and future operations, particularly our ability to respond to changes or to take certain actions.

Our revolving facility and theThe indenture that governs our Senior Notes containcontains a number of restrictive covenants that impose significant operating and financial restrictions on us and may limit our ability to engage in acts that may be in our long-term best interest, including, among other things, restrictions on our ability to:

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with the consolidated financial statements and related notes thereto included in Item 8 “Financial Statements and Supplementary Data” in this Annual Report on Form 10-K. This section of this Form 10-K generally discusses fiscal 2026 and 2025 items and year-over-year comparisons between fiscal 2026 and 2025. Discussions of fiscal 2024 items and year-over-year comparisons between fiscal 2025 and 2024. Discussions of fiscal 2023 items and year-over-year comparisons between fiscal 2024 and 2023 are not included in this Form 10-K, and can be found in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part II, Item 7 of our Annual Report on Form 10-K for the fiscal year ended January 31, 2024.2025. As discussed in Note 1 and Note 16 to the Consolidated Financial Statements included in this report, the Company revised its fiscal 2025 and 2024 financial results to correct for an immaterial error discovered during the fourth quarter of fiscal 2026. The revisions are intended to ensure comparability across all periods reflected herein. Some of the information contained in this discussion and analysis or set forth elsewhere in this Annual Report on Form 10-K, including information with respect to our plans and strategy for our business, includes forward-looking statements that involve risks and uncertainties, including those described under the heading “Special Note Regarding Forward-Looking Statements.” You should review the disclosure under Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K for a discussion of important factors that could cause actual results to differ materially from the results described in or implied by the forward-looking statements contained in the following discussion and analysis. Our fiscal years ended January 31, 2025,2026, January 31, 2024,2025, and January 31, 2023,2024, are referred to herein as fiscal 2026, fiscal 2025, and fiscal 2024, and fiscal 2023, respectively.

Founded in 2011, CrowdStrikewe reinvented cybersecurity for the cloud era and transformed the way cybersecurity is delivered and experienced by customers. When we started CrowdStrike, cyberattackers had an asymmetric advantage over legacy cybersecurity products that could not keep pace with the rapid changes in adversary tactics. We took a fundamentally different approach to solve this problem with the AI-native CrowdStrike Falcon platform – the first, true cloud-native unified platform built with artificial intelligence (“AI”) at the core, capable of harnessing vast amounts of security and enterprise data to deliver highly modular solutions through a single lightweight agent.sensor.

Invest in Growth. We believe that our market opportunity is large and requires us to continue to invest significantly in sales and marketing efforts to further grow our customer base, both domestically and internationally. Our open cloud architecture and single data model have allowed us to rapidly build and deploy new cloud modules, and we expect to continue investing in those efforts to further enhance our technology platform and product functionality. In addition to our ongoing investment in research and development, we may also pursue acquisitions of businesses, technologies, and assets that complement and expand the functionality of our Falcon platform, add to our technology or security expertise, or bolster our leadership position by gaining access to new customers or markets. Furthermore, we expect our general and administrative expenses to increase in dollar amount for the foreseeable future given the additional expenses for accounting, compliance, and investor relations as we grow as a public company.grow.

July 19 Incident. On July 19, 2024, we released a content configuration update for our Falcon sensor that resulted in system crashes for certain Windows systems (the “July 19 Incident”). As a result of the July 19 Incident, we are subject to lawsuits, claims and inquiries as described in Note 10, Commitments and Contingencies, in Part II, Item 8 of this Annual Report on Form 10-K. We have incurred, and expect to continue to incur, significant legal and professional services and other general and administrative expenses associated with the July 19 Incident in future periods. It is not reasonably possible to quantify the precise impact of the July 19 Incident, but the incident has adversely affected our results of operations, and we currently expect a number of factors relating to the incident to adversely affect our key metrics and results of operations in future periods. While we have maintained high dollar-based gross retention rates following the incident, we have experienced delays in creating sales opportunities and longer sales cycles, including delays in customer purchasing decisions. We expect salesSales cycles to continue tomay be elongated in future periods. In addition, because our customers typically sign contracts with terms ofover twelveone months or longer,year, customer churn and any corresponding impact to our key metrics and revenue may occur in future periods. Customer commitment packages introduced following the July 19 Incident have included discounting, additional modules, professional services, flexible payment terms or subscription period extensions. Our customer commitment packages have resulted, and are expected to continue to result, in increased contraction, due to elongated subscription terms, and decreased upsell dollar values.

ARR increased 24% year-over-year and grew to $5.3 billion as of January 31, 2026, of which $1.0 billion was net new ARR added during fiscal 2026. ARR increased 23% year-over-year and grew to $4.2 billion as of January 31, 2025, of which $806.7 million was net new ARR added during fiscal 2025. ARR increased 34% year-over-year and grew to $3.4 billion as of January 31, 2024, of which $875.5 million was net new ARR added during fiscal 2024.

Our operating expenses consist of sales and marketing, research and development, and general administrative expenses. For each of these categories of expense, employee-related expenses are the most significant component, which include salaries, employee bonuses, sales commissions, and employer payroll tax. Operating expenses also include an allocated portion of overhead costs for facilities and other administrative functions.

We expect general and administrative expenses to increase in dollar amount over time. We expect to incur significant legal and professional services and other expenses associated with the July 19 Incident and related matters in future periods. General and administrative expenses may fluctuate as a percentage of our total revenue from period to period depending on the timing of these expenses.

Interest Expense. Interest expense consists primarily of amortization of debt issuance costs, contractual interest expense for our Senior Notes issued in January 2021, and amortization of debt issuance costs on our secured revolving creditfacility, facilitywhich (“Revolvingexpired Facility”).in January 2026.

Interest Income. Interest income consists primarily of income earned on our cash,cash and cash equivalents, and short-term investments.equivalents.

Other Income,Income (Expense), Net. Other income,income (expense), net consists primarily of gains and losses on strategic investments and foreign currency transaction gains and losses.

Total revenue increased by $898.1$858.4 million, or 29%,22%, in fiscal 2025,2026, as compared to fiscal 2024.2025. Subscription revenue accounted for 95% and 94% of our total revenue infor each of fiscal 20252026 and fiscal 2024, respectively.2025. Professional services revenue accounted for 5% and 6% of our total revenue infor each of fiscal 20252026 and fiscal 2024, respectively.2025.

Subscription revenue increased by $890.9$803.2 million, or 31%21% in fiscal 2025,2026, as compared to fiscal 2024,2025, which was primarily driven by a combination of the addition of new customers and the sale of additional sensors and modules to existing customers.

Professional services revenue increased by $7.1$55.2 million, or 4%,29%, in fiscal 2025,2026, as compared to fiscal 2024,2025, which was primarily attributable to an increase in the number of professional service hours.

Total cost of revenue increased by $235.8$228.8 million, or 31%,23%, in fiscal 2025,2026, as compared to fiscal 2024.2025. Subscription cost of revenue increased by $204.8$181.3 million, or 32%,22%, in fiscal 2025,2026, as compared to fiscal 2024.2025. The increase in subscription cost of revenue was primarily due to an increase in cloud hosting and related services costs of $46.4 million, an increase in employee-related expenses of $55.6$43.1 million driven by a 28%16% increase in average headcount, an increase in depreciation of data center equipment of $38.4 million, an increase in stock-based compensation expense of $29.7 million, an increase in cloud hosting and related services costs of $28.5 million, an increase in allocated overhead costs of $20.3$33.4 million, an increase in amortization of internal-use software of $17.6$24.9 million, an increase in hardwarestock-based maintenancecompensation costsexpense of $5.4$18.1 million, and an increase in employeeallocated benefitsoverhead costs of $4.2$16.8 million, and charges related to the Strategic Plan of $3.4 million, partially offset by a decrease in other labor expenses of $2.8 million and a decrease in company events expenses of $1.2 million.

Professional services cost of revenue increased by $31.0$47.4 million, or 25%,30%, in fiscal 2025,2026, as compared to fiscal 2024.2025. The increase in professional services cost of revenue was primarily due to an increase in consulting expenses of $18.7 million, an increase in employee-related expenses of $13.1$15.5 million driven by ana 20%12% increase in average headcount, an increase in stock-based compensation expense of $8.8$5.7 million, charges related to the Strategic Plan of $3.3 million, and an increase in allocated overhead costs of $5.0 million, an increase in consulting expense of $2.2 million, and an increase in employee benefits of $1.0$2.6 million.

Subscription gross margin was flat in fiscal 2025,2026, as compared to fiscal 2024.2025.

Professional services gross margin decreased by 13%1% in fiscal 2025,2026, as compared to fiscal 2024.2025. The decrease in professional services gross margin was primarily due to an increase in consulting expense and decreasedan utilizationincrease in stock-based compensation expense during fiscal 20252026, as compared to fiscal 2024.2025.

Sales and marketing expenses increased by $382.8$308.3 million, or 34%,20%, in fiscal 2025,2026, as compared to fiscal 2024.2025. The increase in sales and marketing expenses was primarily due to an increase in employee-related expenses of $159.0$168.4 million driven by a 14%12% increase in average headcount, an increase in stock-based compensation expense of $59.7$48.2 million, an increase in marketing programs of $55.5$29.2 million, an increase in allocated overhead costs of $28.4 million, $21.4 million of expenses relating to the July 19 Incident, an increase in travel expenses of $13.1 million, an increase in company events expenses of $8.6$20.2 million, an increase in employee benefits of $6.3$16.5 million, an increase in term-basedtravel software licensesexpenses of $5.4$11.2 million, charges related to the Strategic Plan of $9.0 million, an increase in cloud hosting and related costs of $4.2$6.2 million, an increase in term-based software licenses of $3.2 million, an increase in other labor expenses of $2.8$2.1 million, and an increase in consulting expenseexpenses of $2.5$1.7 million, partially offset by a decrease in expenses associated with the July 19 Incident and related matters of $20.3 million.

Research and development expenses increased by $308.4$309.2 million, or 40%29% in fiscal 2025,2026, as compared to fiscal 2024.2025. This increase was primarily due to an increase in stock-based compensation expense of $131.7 million, an increase in employee-related expenses of $119.3$116.8 million driven by a 18%20% increase in average headcount, an increase in stock-based compensation expense of $94.0 million, an increase in cloud hosting and related costs of $64.2$46.4 million, $6.8an millionincrease in allocated overhead costs of expenses$27.6 relatingmillion, charges related to the JulyStrategic 19Plan Incident,of $16.6 million, and an increase in term-based software licenses of $6.4 million, an increase in employee benefits of $5.1 million, an increase in travel expenses of $3.2 million, and an increase in consulting expense of $1.7$3.5 million, partially offset by a decrease in allocated engineering and overhead costs of $27.5 million, an increase in software capitalization of $11.4$9.8 million, and a decrease in otherexpenses laborassociated expenseswith the July 19 Incident and related matters of $9.7$4.4 million.

Interest Expense, Interest Income and Other Income,Income (Expense), Net

The following shows interest expense, interest income, and other income,income (expense), net, for fiscal 2025,2026, as compared to fiscal 20242025 (in thousands, except percentages):

Interest expense consists primarily of amortization of debt issuance costs, contractual interest expense, accretion of debt discount for our Senior Notes issued in January 2021, and amortization of debt issuance costs on our Revolvingrevolving Facility.facility, which expired in January 2026.

The increasedecrease in interest income during fiscal 20252026 compared to fiscal 20242025 was driven by anlower increasemarket inrates, ourpartially offset by higher cash and cash equivalents.balances.

The increasedecrease in other income,income (expense), net during fiscal 20252026 compared to fiscal 20242025 was primarily due to an increase in net foreign currency transaction losses of $3.5 million, a decrease in net realized gains on our strategic investments of $2.4$2.2 million, aand decreasean increase in downward markadjustments toand market adjustmentsimpairment of $0.5$0.6 million onof our strategic investments, andpartially offset by an increase in gains onfrom deferred compensation assets of $0.4$0.8 million.

The increasedecrease in provision for income taxes during fiscal 20252026 compared to fiscal 20242025 was primarily attributable to a decrease in tax on intercompany salessale of intellectual property from acquired entities, pre-taxpartially offset by an increase in tax on foreign earnings,earnings and withholding taxes related to customer payments in certain foreign jurisdictions, and change in the realizability of deferred tax assets in certain foreign jurisdictions.

Our primary sources of liquidity as of January 31, 2025,2026, consisted of: (i) $4.3$5.2 billion in cash and cash equivalents, which mainly consists of cash on hand and highly liquid investments in money market funds andfunds, U.S. Treasury bills, and time deposits, and (ii) cash we expect to generate from operations, and (iii) available capacity under our $750.0 million Revolving Facility.operations. It is not currently possible to reasonably estimate the amount of loss or range of possible loss that might result from adverse judgments, settlements, penalties, or other resolution of proceedings resulting from the July 19 Incident.Incident or related matters. However, despite such uncertainties, we expect that the combination of our existing cash and cash equivalents,equivalents and cash flows from operations, and the Revolving Facilityoperations will be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 12 months. Our Revolving Facility matures on January 2, 2026.

We have historicallya generatedhistory operatingof losseslosses, priorand towhile we have achieved profitability in certain periods, including fiscal 2024 and during fiscal 2025, as reflected in2024, our accumulated deficit ofis $1.1$1.3 billion as of January 31, 2025.2026. We expect to continue to make investments, particularly in sales and marketing and research and development. As a result, we may require additional capital resources in the future to execute strategic initiatives to grow our business.

Net cash provided by operating activities during fiscal 20252026 was $1.4$1.6 billion, which resulted from net loss of $16.6$161.2 million, adjusted for non-cash charges of $1.4$1.8 billion and net cash outflow of $6.0$59.3 million from changes in operating assets and liabilities. Non-cash charges primarily consisted of $865.4$1.1 millionbillion in stock-based compensation expense, $318.8$449.4 million of amortization of deferred contract acquisition costs, $188.0$250.2 million of depreciation and amortization, $26.0$31.2 million of amortization of intangibles assets, $15.3$17.2 million of non-cash operating lease costs, $3.8$5.4 million of non-cash interest expense, and $2.3$1.6 million ofchange accretionin fair value of short-termstrategic investments purchased at a discount,investments, partially offset by $9.9$14.8 million of deferred income taxes and $6.3$4.2 million of realized gains on strategic investments. The net cash outflow from changes in operating assets and liabilities was primarily due to aan $584.5increase of $703.7 million increase in deferred contract acquisition costs, aan $274.2increase of $232.5 million increase in accounts receivable, net,an aincrease $190.2of $206.2 million increase in prepaid expenses and other assets, and a $15.7decrease of $13.7 million decrease in operating lease liabilities, and a decrease of $11.3 million in accounts payable, partially offset by a $669.3 millionan increase of $1.0 billion in deferred revenue, a $218.5 millionan increase inof accrued expenses and other liabilities, an $85.9$61.6 million increase in accrued payroll and benefits, and an $84.9increase of $22.6 million increase in accountsaccrued payable.expenses and other liabilities.

Net cash provided by operating activities during fiscal 20242025 was $1.2$1.4 billion, which resulted from net incomeloss of $90.6$12.6 million, adjusted for non-cash charges of $1.0$1.4 billion and net cash inflowoutflow of $51.5$6.0 million from changes in operating assets and liabilities. Non-cash charges primarily consisted of $631.5$861.4 million in stock-based compensation expense, $238.9$318.8 million of amortization of deferred contract acquisition costs, $126.8$188.0 million of depreciation and amortization, $18.4$26.0 million of amortization of intangibles assets, $13.4$15.3 million of non-cash operating lease costs, and $3.2$3.8 million of non-cash interest expense, and $2.3 million of accretion of short-term investments purchased at a discount, partially offset by $3.9$9.9 million of deferred income taxes and $6.3 million of realized gains on strategic investments and a $3.4 million change in deferred income taxes.investments. The net cash inflowoutflow from changes in operating assets and liabilities was primarily due to a $696.6$584.5 million increase in deferred contract acquisition costs, a $274.2 million increase in accounts receivable, net, a $190.2 million increase in prepaid expenses and other assets, and a $15.7 million decrease in operating lease liabilities, partially offset by a $669.3 million increase in deferred revenue, a $65.1 million increase in accrued payroll and benefits, a $14.6$218.5 million increase in accrued expenses and other liabilities, partiallyan offset by a $371.6$85.9 million increase in deferredaccrued contractpayroll acquisitionand costs,benefits, aand $217.7an $84.9 million increase in accounts receivable, net, a $102.5 million increase in prepaid expenses and other assets, a $18.9 million decrease in accounts payable, and a $14.0 million decrease in operating lease liabilities.payable.

We conduct our operations almost entirely through our subsidiaries. Accordingly, the Obligor Group’s cash flows and ability to service the notesSenior Notes will depend on the earnings of our subsidiaries and the distribution of those earnings to the Obligor Group, whether by dividends, loans, or otherwise. Holders of the guaranteed registered debt securities will have a direct claim only against the Obligor Group.

Our commitments consist of obligations under non-cancellablenon-cancelable real estate arrangements on an undiscounted basis, of which $14.1$16.9 million is due in the next 12 months and $35.6$65.8 million is due thereafter. In addition, we have debt obligations related to $750.0 million aggregate principal amount of the Senior Notes due in fiscal 2030 and the interest payments associated with the Senior Notes of $22.5 million due in the next 12 months and $78.8$56.3 million due thereafter. We have non-cancellablenon-cancelable purchase commitments with various parties to purchase products and services entered in the normal course of business totaling $2.7$2.8 billion as of January 31, 2025,2026, with remaining terms in excess of 12 months. We expect to fund these obligations with cash flows from operations and cash on our balance sheet.

As of January 31, 2025,2026, we had non-cancellablenon-cancelable unfunded commitments from our financing arrangements totaling approximately $94.2$89.9 million.

We allocate the purchase price of acquired companies to the tangible and intangible assets acquired and liabilities assumed based on their estimated fair values at the acquisition date. The excess of the fair value of purchase consideration over the fair values of these identifiable assets and liabilities is recorded as goodwill. The purchase price allocation process requires management to make significant estimates and assumptions with respect to intangible assets. Although we believe the assumptions and estimates we have made are reasonable, they are based in part on historical experience, market conditions, and information obtained from management of the acquired companies and are inherently uncertain. Examples of judgments used to estimate the fair value of intangibles assets include, but are not limited to, future expected cash flows, expected customer attrition rates, estimated obsolescence rates, and discount rates. These estimates are inherently uncertain and unpredictable and, as a result, actual results may differ from estimates.

On July 19, 2024, we released a content configuration update for our Falcon sensor that resulted in system crashes for certain Windows systems (the “July 19 Incident”). We have incurred, and expect to continue to incur, significant costs and expenses related to the incident. The July 19 Incident has harmed, and is expected to continue to harm, our business, sales, customer and partner relations, and our reputation. As a result of the July 19 Incident, certain of our existing or prospective customers have deferred or decided against purchases of our products and services and terminated or chosen not to renew their contracts with us, and others may take similar actions in the future. The July 19 Incident has negatively impacted, and may in the future negatively impact, our existing or prospective partners’ ability or willingness to promote our products or services. Certain of our competitors have aggressively approached our current and prospective customers and partners to attempt to capitalize on the July 19 Incident, and may continue to do so. Furthermore, we have agreed to, and expect to agree to in the future, provide incentives in connection with our commercial arrangements with our customers, including subscription period extensions, discounts or promotional modules. The July 19 Incident has received negative media coverage and harmed our reputation and brand. Additional negative media coverage and publicity, whether directly or indirectly related to the July 19 Incident, may harm our reputation and brand further, exacerbating the effects discussed herein. These factors may result in harm to our business, results of operations and financial condition. While we are investing in enhancements to software resiliency, testing and customer controls following the July 19 Incident, we cannot guarantee that such enhancements will be effective, or that our products do not have or will not have defects, errors, or vulnerabilities.

We have incurred net losses each year prior to fiscal 2024, and we may not achieve or maintain profitability in the future. We experienced net losses of $162.5 million and $15.2 million for fiscal 2026 and 2025, respectively, and net income of $72.2 million for fiscal 2024. As of AprilJuly 30,31, 2026, we had an accumulated deficit of $1.3$1.2 billion. While we have experienced significant growth in revenue in recent periods, and have achieved profitability during certain periods, including the first quarterand second quarters of fiscal 2027 and fiscal 2024, we cannot assure you when or whether we will reach sustained profitability. We also expect our operating expenses to increase in the future as we continue to invest for our future growth, which will negatively affect our results of operations if our total revenue does not increase. We also have incurred and expect to continue to incur significant additional legal, accounting, and other expenses as a public company. Any failure to increase our revenue as we invest in our business or to manage our costs could prevent us from achieving or maintaining profitability or positive cash flow.

To expand our customer base, we need to convince potential customers to allocate a portion of their discretionary budgets to purchase our Falcon platform. Our sales efforts often involve educating our prospective customers about the uses and benefits of our Falcon platform. Enterprises and governments that use legacy security products, such as signature-based or malware-based products, firewalls, intrusion prevention systems, and antivirus, for their IT security may be hesitant to purchase our Falcon platform if they believe that these products are more cost effective, provide substantially the same functionality as our Falcon platform or provide a level of IT security that is sufficient to meet their needs. We may have difficulty convincing prospective customers of the value of adopting our solution. Even if we are successful in convincing prospective customers that a cloud native platform like ours is critical to protect against cyberattacks, they may not decide to purchase our Falcon platform for a variety of reasons, some of which are out of our control. For example, any deterioration in general economic conditions, including as a result of the geopolitical environment or changes and uncertainty regarding trade policies or tariffs, the outbreak of diseases or other public health crises, volatility in the banking and financial services sector, or inflation (as well as government policies such as raising interest rates in response to inflation), have in the past and may in the future cause our current and prospective customers to delay or cut their overall security and IT operations spending, and such delays or cuts may fall disproportionately on cloud-based security solutions like ours. Economic weakness, customer financial difficulties, constrained spending on security and IT operations, and the impact of the July 19 Incident may result in decreased revenue, reduced sales, an increase in multi-phase subscription start dates, shorter terms for customer subscriptions, lengthened sales cycles, increased churn, lower demand for our products, and adversely affect our results of operations and financial conditions. Furthermore, we may need to exercise more flexibility in customer payment terms as customers navigate a more challenging economic environment. Additionally, if the incidence of cyberattacks were to decline, or be perceived to decline, or if organizations adopt endpoints that use operating systems we do not adequately support, our ability to attract new customers and expand sales of our solutions to existing customers could be adversely affected. If organizations do not continue to adopt our Falcon platform, our sales will not grow as quickly as anticipated, or at all, and our business, results of operations, and financial condition would be harmed.

Our direct sales team develops relationships with our customers, and works with our channel partners on account penetration, account coordination, sales and overall market development. We spend substantial time and resources on our sales efforts without any assurance that our efforts will produce a sale. Security solution purchases are frequently subject to budget constraints, multiple approvals and unanticipated administrative, processing and other delays. As a result, it is difficult to predict whether and when a sale will be completed. The failure of our efforts to secure sales after investing resources in a lengthy sales process could adversely affect our business and results of operations.

Many of our competitors have greater financial, technical, marketing, sales, and other resources, greater name recognition, longer operating histories, and a larger base of customers than we do. They may be able to devote greater resources to the development, promotion, and sale of services than we can, and they may offer lower pricing than we do. Further, they may have greater resources for research and development of new technologies, the provision of customer support, and the pursuit of acquisitions. Our larger competitors have substantially broader and more diverse product and services offerings as well as routes to market, which allows them to leverage their relationships based on other products or incorporate functionality into existing products to gain business in a manner that discourages users from purchasing our platform, including our cloud modules. Conditions in our market are changing rapidly and significantly as a result of technological advancements, including with respect to AI. Our competitors may more successfully incorporate AI into their products, gain or leverage superior access to certain AI technologies, and achieve higher market acceptance of their AI solutions. Conditions in our market could also change rapidly and significantly due to partnering or acquisitions by our competitors or continuing market consolidation. Some of our competitors have recently made acquisitions of businesses or have established cooperative relationships that may allow them to offer more directly competitive and comprehensive solutions than were previously offered and adapt more quickly to new technologies and customer needs. These competitive pressures in our market or our failure to compete effectively may result in price reductions, fewer orders, reduced revenue and gross margins, increased net losses and loss of market share. Further, competitors that specialize in providing protection from a single type of security threat may be able to deliver these targeted security products to the market quicker than we can or convince organizations that these limited products meet their needs. Even if there is significant demand for cloud-based security solutions like ours, if our competitors include functionality that is, or is perceived to be, equivalent to or better than ours in legacy products that are already generally accepted as necessary components of an organization’s IT security architecture, we may have difficulty increasing the market penetration of our solutions. Furthermore, even if the functionality offered by other security and IT operations providers is more limited than the functionality of our platform, organizations may elect to accept such limited functionality in lieu of adding products from additional vendors like us. If we are unable to compete successfully, or if competing successfully requires us to take aggressive pricing or other actions, our business, financial condition, and results of operations would be adversely affected.

Real or perceived defects, errors or vulnerabilities in our Falcon platform and cloud modules, the failure of our platform to detect or prevent incidents, including advanced and newly developed attacks, misconfiguration of our solutions, or the failure of customers to take action on attacks identified by our platform could harm our reputation and adversely affect our business, financial position and results of operations. Because our cloud native security platform is complex, it has contained, and may in the future contain defects, errors or vulnerabilities that are not detected until after deployment. For example, the July 19 Incident harmed our brand and reputation, business and results of operations. InAs addition,another example, we identified a transportpath layertraversal security issuevulnerability that impacted certain Falconversions Linuxof sensors,LogScale, which led us to release a security fix and publish a security advisory to remediate the matter in FebruaryApril 2025.2026. If we fail to timely detect defects or errors before deployment in the future, our brand and reputation, business and results of operations will suffer further. We cannot assure you that our products will detect all cyberattacks, especially in light of the rapidly changing security threat landscape that our solution seeks to address. Due to a variety of both internal and external factors, including, without limitation, defects or misconfigurations of our or third-party solutions, our solutions could be or become vulnerable to security incidents (both from intentional attacks and accidental causes) that cause them to fail to secure endpoints and detect and block attacks. Furthermore, any defects, errors or vulnerabilities in third-party technology or solutions we rely on could result in disruptions to our operations and adversely impact our business, financial condition and results of operations. In addition, because the techniques used by computer hackers to access or sabotage networks and endpoints change frequently and generally are not recognized until launched against a target, there is a risk that an advanced attack could emerge that our cloud native security platform is unable to detect or prevent until after some of our customers are affected. Additionally, our Falcon platform may falsely indicate a cyberattack or threat that does not actually exist, which may lessen customers’ trust in our solutions.

Moreover, as our cloud native security platform is adopted by an increasing number of enterprises and governments, individuals and organizations behind advanced cyberattacks may intensify their efforts to defeat our security platform. If this happens, our systems and subscription customers could be specifically targeted by attackers and could result in vulnerabilities in our platform or undermine the market acceptance of our Falcon platform and could adversely affect our reputation as a provider of security solutions. Because we host customer data on our cloud platform, which in some cases may contain personally-identifiable information or potentially confidential information, a security compromise, or an accidental or intentional misconfiguration or malfunction of our platform or third-party platforms, could result in personally-identifiable information and other customer data being accessible such as to attackers or to other customers. Further, if a high profile security breach occurs with respect to another next-generation or cloud-based security system, our customers and potential customers may lose trust in cloud solutions generally, and cloud-based security solutions such as ours in particular.

It is virtually impossible for us to entirely eliminate the risk of such attacks, compromises, interruptions in service, or other security incidents affecting our internal systems or data, or that of our third-party service providers and vendors. Organizations are subject to a wide variety of attacks on their supply chain, networks, systems, and endpoints, and techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently. Such attacks are becoming increasingly more sophisticated as threat actors leverage AI technologies. Furthermore, employee error or malicious activity could compromise our systems. As a result, we may be unable to anticipate these techniques or implement adequate measures to prevent an intrusion into our networks, which could result in unauthorized access to customer data, intellectual property including access to our source code, and information about vulnerabilities in our product, which in turn, could reduce the effectiveness of our solutions, or lead to cyberattacks or other intrusions of our customers’ networks, litigation, governmental audits and investigations and significant legal fees, any or all of which could damage our relationships with our existing customers and could have a negative effect on our ability to attract and retain new customers. We have expended, and anticipate continuing to expend, significant resources in an effort to prevent security breaches and other security incidents impacting our systems and data. Since our business is focused on providing reliable security services to our customers, we believe that an actual or perceived security incident affecting our internal systems or data or data of our customers would be especially detrimental to our reputation, customer confidence in our solution, and our business.

The adverse effects of any service interruptions on our reputation, results of operations, and financial condition may be disproportionately heightened due to the nature of our business and the fact that our customers have a low tolerance for interruptions of any duration. Interruptions or failures in our service delivery could result in a cyberattack or other security threat to us or to one of our customers during such periods of interruption or failure. Additionally, interruptions or failures in our service could cause customers to terminate their subscriptions with us, adversely affect our renewal rates, and harm our ability to attract new customers. Our business would also be harmed if our customers believe that a cloud-based SaaS-delivered endpoint security solution is unreliable. We have experienced, and may in the future experience, service interruptions and other performance problems due to a variety of factors. The occurrence of any of these factors, or if we are unable to rapidly and cost-effectively fix such errors or other problems that may be identified, could damage our reputation, negatively affect our relationship with our customers or otherwise harm our business, results of operations and financial condition.

We depend on our direct sales force to obtain new customers and increase sales with existing customers. Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training, incentivizing and retaining sufficient numbers of sales personnel, particularly in international markets. We have expanded our sales organization significantly in recent periods and expect to continue to add additional sales capabilities in the near term. There is significant competition for sales personnel with the skills and technical knowledge that we require. New hires require significant training and may take significant time before they achieve full productivity, and this delay is accentuated by our long sales cycles. Our recent hires and planned hires may not become productive as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals in the markets where we do business or plan to do business. In addition, a large percentage of our sales force is new to our company and selling our solutions, and therefore this team may be less effective than our more seasoned sales personnel. Furthermore, hiring sales personnel in new countries, or expanding our existing presence, requires upfront and ongoing expenditures that we may not recover if the sales personnel fail to achieve full productivity. We cannot predict whether, or to what extent, our sales will increase as we expand our sales force or how long it will take for sales personnel to become productive. If we are unable to hire and train a sufficient number of effective sales personnel, or the sales personnel we hire are not successful in obtaining new customers or increasing sales to our existing customer base, our business and results of operations will be adversely affected.

We believe that maintaining and enhancing our CrowdStrike and Falcon brands and our reputation as a provider of high-efficacy security solutions is critical to our relationship with our existing customers, channel partners, and technology alliance partners and our ability to attract new customers and partners. The successful promotion of our CrowdStrike and Falcon brands depends on a number of factors, including our marketing efforts, our ability to continue to develop additional cloud modules and features for our Falcon platform, our ability to successfully differentiate our Falcon platform from competitive cloud-based or legacy security solutions and, ultimately, our ability to detect and stop breaches. Although we believe it is important for our growth, our brand promotion activities may not be successful or yield increased revenue.

In addition, independent industry or financial analysts and research firms often test our solutions and provide reviews of our Falcon platform, as well as the products of our competitors, and perception of our Falcon platform in the marketplace may be significantly influenced by these reviews. If these reviews are negative, or less positive as compared to those of our competitors’ products, our brand may be adversely affected. Our solutions may fail to detect or prevent threats in any particular test for a number of reasons that may or may not be related to the efficacy of our solutions in real world environments. To the extent potential customers, industry analysts or testing firms believe that the occurrence of a failure to detect or prevent any particular threat is a flaw or indicates that our solutions or services do not provide significant value, we may lose customers, and our reputation, financial condition and business would be harmed. Additionally, the performance of our channel partners and technology alliance partners may affect our brand and reputation if customers do not have a positive experience with these partners. In addition, we have in the past worked, and continue to work, with high profile private and public customers as well as assist in analyzing and remediating high profile cyberattacks, which sometimes involve nation-state actors. Our work with such customers has exposed us to publicity and media coverage. Changing political environments in the United States and abroad may amplify the media and political scrutiny we face. Negative publicity about us, including about our management, the efficacy and reliability of our Falcon platform, our products offerings, our professional services, and the customers we work with, even if inaccurate, has in the past adversely affected, and may in the future adversely affect, our reputation and brand. For example, the July 19 Incident, which received significant media attention and negative publicity, harmed our reputation and brand.

We derived approximately 32%, 32%, 33% and 34%35% of our total revenue from our international customers for fiscal 2024, fiscal 2025, fiscal 2026 and the threesix months ended AprilJuly 30,31, 2026, respectively. We are continuing to adapt to and develop strategies to address international markets and our growth strategy includes expansion into target geographies, but there is no guarantee that such efforts will be successful. We expect that our international activities will continue to grow in the future, as we continue to pursue opportunities in international markets. These international operations will require significant management attention and financial resources and are subject to substantial risks, including:

Additionally, nearly all of our sales contracts are currently denominated in U.S. dollars. However, a strengthening of the U.S. dollar could increase the cost of our solutions to our international customers, which could adversely affect our business and results of operations. In addition, an increasing portion of our operating expenses is incurred outside the United States; is denominated in foreign currencies, such as the Australian Dollar, British Pound, Canadian Dollar, Euro, Indian Rupee, and Japanese Yen; and is subject to fluctuations due to changes in foreign currency exchange rates. As part of our efforts to manage the variability of foreign currency-denominated operating expenses, we have entered into, and may in the future enter into, foreign currency forward contracts intended to hedge a portion of these expenses. However, our hedging activities may not be effective in meaningfully offsetting the adverse financial impact of foreign currency rate fluctuations. In addition, foreign currency derivative transactions involve risks, including counterparty credit risk, potential cash flow impact upon settlement, and the risk that foreign currency movements differ from our expectations or historical trends, which could render our hedging strategies ineffective or result in losses. If we become more exposed to currency fluctuations and are not able to successfully hedge against the risks associated with currency fluctuations, our results of operations could be adversely affected.

Our future growth is dependent upon our ability to continue to meet the needs of new customers and the expanding needs of our existing customers as their use of our solutions grow. As our customers gain more experience with our solutions, the number of endpoints and events, the amount of data transferred, processed and stored by us, the number of locations where our platform and services are being accessed, have in the past, and may in the future, expand rapidly. In order to meet the performance and other requirements of our customers, we intend to continue to make significant investments to increase capacity and to develop and implement new technologies, including those involving AI, in our service and cloud infrastructure operations. These technologies, which include databases, applications and server optimizations, network and hosting strategies, and automation, are often advanced, complex, new and untested. We may not be successful in developing or implementing these technologies. In addition, as our business grows, we must continue to improve and expand our information technology infrastructure. It takes a significant amount of time to plan, develop and test improvements to our technologies and infrastructure, and we may not be able to accurately forecast demand or predict the results we will realize from such improvements. We rely on external ecosystems, such as operating systems and platforms, to operate and make, in various layers of technology stacks, our products and services available to customers. If we are unable to adapt to product or policy changes in such ecosystems, or if we do not effectively operate with such ecosystems, demand for and availability of our products or services could decline. To the extent that we do not effectively scale our operations and infrastructure to meet the needs of our business, our growing customer base and to maintain performance as our customers expand their use of our solutions, we may not be able to grow as quickly as we anticipate, our customers may reduce or cancel use of our solutions and we may be unable to compete as effectively and our business and results of operations may be harmed.

We expect that the combination of our existing cash and cash equivalents and cash flows from operations will be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 12 months. Retaining or expanding our current levels of personnel and product and service offerings may require additional funds to respond to business challenges, including the need to develop new products or services and enhancements to our Falcon platform, improve our operating infrastructure, or acquire complementary businesses and technologies. Our failure to raise additional capital or generate the significant capital necessary to expand our operations and invest in new products or services could reduce our ability to compete and could harm our business. Accordingly, we may need to engage in additional equity or debt financings to secure additional funds. If we raise additional equity financing, our stockholders may experience significant dilution of their ownership interests and the market price of our common stock could decline. If we engage in additional debt financing, the holders of such debt would have priority over the holders of our common stock, and we may be required to accept terms that further restrict our operations or our ability to incur additional indebtedness or to take other actions that would otherwise be in the interests of the debt holders. Any of the above could harm our business, results of operations, and financial condition.

We believe our intellectual property is an essential asset of our business, and our success and ability to compete depend in part upon protection of our intellectual property rights. We rely on a combination of patent, copyright, trademark and trade secret laws, as well as confidentiality procedures and contractual provisions, to establish and protect our intellectual property rights in the United States and abroad, all of which provide only limited protection. The efforts we have taken to protect our intellectual property may not be sufficient or effective, and our trademarks, copyrights and patents may be held invalid or unenforceable. Moreover, we cannot assure you that any patents will be issued with respect to our currently pending patent applications in a manner that gives us adequate defensive protection or competitive advantages, or that any patents issued to us will not be challenged, invalidated or circumvented. We have filed for patents in the United States and in certain non-U.S. jurisdictions, but such protections may not be available in all countries in which we operate or in which we seek to enforce our intellectual property rights, or may be difficult to enforce in practice. For example, many foreign countries have compulsory licensing laws under which a patent owner must grant licenses to third parties. In addition, many countries limit the enforceability of patents against certain third parties, including government agencies or government contractors. In these countries, patents may provide limited or no benefit. Moreover, we may need to expend additional resources to defend our intellectual property rights in these countries, and our inability to do so could impair our business or adversely affect our international expansion. Our currently issued patents and any patents that may be issued in the future with respect to pending or future patent applications may not provide sufficiently broad protection or they may not prove to be enforceable in actions against alleged infringers.

Although third parties may offer a license to their technology or other intellectual property, the terms of any offered license may not be acceptable, and the failure to obtain a license or the costs associated with any license could cause our business, financial condition and results of operations to be adversely affected. In addition, some licenses may be nonexclusive, and therefore our competitors may have access to the same technology licensed to us. If a third party does not offer us a license to its technology or other intellectual property on reasonable terms, or at all, we could be enjoined from continued use of such intellectual property. As a result, we may be required to develop alternative, non-infringing technology, which could require significant time, effort and expense and may ultimately not be successful. Additionally, we may be unable to continue to offer our affected products, subscriptions or services, while developing such technology. Furthermore, a successful claimant could secure a judgment or we may agree to a settlement that prevents us from distributing certain products, providing certain subscriptions or performing certain services. Any such judgment or settlement could also require us to pay substantial damages, royalties or other fees. Any of these events could harm our business, financial condition and results of operations.

Internationally, virtually every jurisdiction in which we operate has established its own data privacy and security legal framework with which we must comply. For example, we are required to comply with the European Union (“EU”) General Data Protection Regulation (“GDPR”) and its equivalent in the U.K. (“U.K. GDPR”), which impose stringent obligations regarding the collection, control, use, sharing, disclosure and other processing of personal data and create mandatory breach notification requirements under certain circumstances. While the GDPR and U.K. GDPR remain substantially similar for the time being, the U.K. government has adopted reforms to its data protection legal framework in its Data Use and Access Act 2025, which became law on June 19, 2025 (phasingphased in between June 2025 and June 2026) and will introduceintroduced significant changes from the GDPR. This may lead to additional compliance costs and could increase overall risk exposure as businesses may no longer be able to take a unified approach across the European Economic Area (“EEA”) and the U.K., and such businesses may need to amend their processes and procedures to align with the new framework. Implementing mechanisms to endeavor to ensure compliance with the GDPR and the U.K. GDPR may be onerous and expose businesses to divergent parallel regimes that may be subject to potentially different interpretations and enforcement actions for certain violations and related uncertainty. Failure to comply with the GDPR or the U.K. GDPR can result in significant fines and other liability, including, under the GDPR, fines of up to EUR 20 million (or GBP 17.5 million under the U.K. GDPR) or four percent (4%) of annual global revenue, whichever is greater. European data protection authorities have already imposed fines for GDPR violations of up to, in some cases, hundreds of millions of Euros.

Our compliance efforts are further complicated by the fact that data privacy and security laws, rules, regulations and standards around the world are rapidly evolving, may be subject to uncertain or inconsistent interpretations and enforcement, and may conflict among various jurisdictions. In many jurisdictions, enforcement actions and consequences for non-compliance with data privacy and security laws, rules, regulations, standards, certifications, contractual requirements or other obligations are rising. Data subjects may also have a private right of action, as well as support from consumer privacy advocates or organizations, to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of applicable data privacy and security laws, rules and regulations. In addition, privacy advocates and industry groups have proposed, and may propose in the future, self-regulatory standards that may legally or contractually apply to us or be alleged to apply to us. Any failure or perceived failure by us or any third parties with which we do business to comply with applicable privacy policies, data privacy or security laws, rules, regulations, standards, certifications or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release, transfer or other processing of personal information, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, governmental investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions and costly litigation (including class actions). There also has been increased regulatory scrutiny from the SEC with respect to adequately

have proposed, and may propose in the future, self-regulatory standards that may legally or contractually apply to us or be alleged to apply to us. Any failure or perceived failure by us or any third parties with which we do business to comply with applicable privacy policies, data privacy or security laws, rules, regulations, standards, certifications or contractual obligations, or any compromise of security that results in unauthorized access to, or unauthorized loss, destruction, use, modification, acquisition, disclosure, release, transfer or other processing of personal information, may result in requirements to modify or cease certain operations or practices, the expenditure of substantial costs, time and other resources, proceedings or actions against us, legal liability, governmental investigations, enforcement actions, claims, fines, judgments, awards, penalties, sanctions and costly litigation (including class actions). There also has been increased regulatory scrutiny from the SEC with respect to adequately disclosing risks concerning cybersecurity and data privacy. Such scrutiny from the SEC increases the risk of investigations into the cybersecurity practices, and related disclosures, of companies within its jurisdiction. Any of the foregoing could harm our reputation, distract our management and technical personnel, increase our costs of doing business, adversely affect the demand for our products and services, and ultimately result in the imposition of liability, any of which could have a material adverse effect on our business, financial condition and results of operations.

These laws and regulations impose added costs on our business, and failure by us, our employees, representatives, contractors, channel partners, agents, intermediaries, or other third parties to comply with these or other applicable regulations and requirements could lead to claims for damages, penalties, termination of contracts, loss of exclusive rights in our intellectual property and temporary suspension or permanent debarment from government contracting. Any such damages, penalties, disruptions or limitations in our ability to do business with customers, including those in the public sector, could result in reduced sales of our products or services, substantial product inventory write-offs, reputational damage, penalties, and other sanctions, any of which could harm our business, reputation, and results of operations.

Our products and subscriptions contain third-party open source software components, and failure to comply with the terms of the underlying open source software licenses could restrict our ability to sell our products and subscriptions. The use and distribution of open source software may entail greater risks than the use of third-party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code and they can change the license terms on which they offer the open source software. Many of the risks associated with use of open source software cannot be eliminated and could negatively affect our business. In addition, the wide availability of source code used in our solutions could expose us to security vulnerabilities.

We incorporate novel uses of AI technologies, including generative and agentic AI, into our products and operations, such as our Falcon platform. AI is complex and rapidly evolving, and we face significant competition from other companies who may incorporate AI into their products more quickly or more successfully than us, as well as an evolving regulatory landscape. The introduction of AI, and particularly generative and agentic AI, a relatively new and emerging technologytechnologies in the early stages of commercial use, into new or existing products, and our operations, may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results. For example, generative AI has been known to produce false or “hallucinatory” interferences or outputs, and certain generative AI uses machine learning and predictive analytics, which may be flawed, insufficient, of poor quality, reflect unwanted forms of bias, or contain other errors or inadequacies, any of which may not be easily detectable. Our customers or others may rely on or use this flawed content to their detriment, which may expose us to brand or reputational harm, competitive harm, and/or legal liability. In addition, the use of AI by other companies has resulted in, and may in the future result in, data breaches and cybersecurity incidents that implicate the personal information of AI users. Further, the use of AI presents emerging ethical, social, legal and other issues, and if we enable or offer solutions that draw scrutiny or controversy due to perceived or actual risks or impacts on customers or on society as a whole, we may experience brand or reputational harm, competitive harm,

flawed content to their detriment, which may expose us to brand or reputational harm, competitive harm, and/or legal liability. In addition, the use of AI by other companies has resulted in, and may in the future result in, data breaches and cybersecurity incidents that implicate the personal information of AI users. Further, the use of AI presents emerging ethical, social, legal and other issues, and if we enable or offer solutions that draw scrutiny or controversy due to perceived or actual risks or impacts on customers or on society as a whole, we may experience brand or reputational harm, competitive harm, delays in customer purchasing decisions and/or legal liability. Our continued incorporation of AI, including generative and agentic AI, into our products and operations requires us to expend significant resources. If such investments do not deliver anticipated benefits or are not otherwise successful, our business and results of operations may be harmed.

The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, privacy, data protection cybersecurity, consumer protection, competition, and equal opportunity laws and regulations, and are expected to be subject to new laws and regulations or new applications of existing laws and regulations. AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity and data protection laws to AI or are considering general legal frameworks for AI. For example, in the EU, the first set of provisions under the EU’s AI Act became effective in February 2025, with additional provisions becoming effective on later dates. The AI Act establishes, among other things, a risk-based governance framework for regulating AI systems in the EU by categorizing AI systems, based on the risks associated with such AI systems’ intended purposes, as creating unacceptable or high risks, with all other AI systems being considered low risk. This regulatory framework is expected to have a material impact on the way AI is regulated in the EU and beyond. As further indication of a trend in increased regulatory and legislative oversight of the use and development of AI, in 2024, California enacted a range of laws regulating the use and development of AI, which generally relate to transparency, privacy and fairness, among other concerns. Other states, including Texas, ColoradoColorado, Illinois, New York, and Utah, have also enacted AI-related laws, and several morethere have proposedbeen enactingwidespread proposals to enact such laws.

We are regularly subject to claims, suits, and government investigations and other proceedings including patent, product liability, class action, whistleblower, personal injury, property damage, labor and employment (including allegations of wage and hour violations), commercial disputes, securities litigation, compliance with laws and regulatory requirements and other matters, and we may become subject to additional types of claims, suits, investigations and proceedings as our business develops or in connection with the July 19 Incident. Such claims, suits, and government investigations and proceedings are inherently uncertain and their results cannot be predicted with certainty. Regardless of the outcome, any of these types of legal proceedings can have an adverse impact on us because of legal costs and diversion of management attention and resources, and could cause us to incur significant expenses or liability, adversely affect our brand recognition, and/or require us to change our business practices. The expense of litigation and the timing of this expense from period to period are difficult to estimate, subject to change and could adversely affect our results of operations. It is possible that a resolution of one or more such proceedings could result in substantial damages, settlement costs, fines and penalties that could adversely affect our business, condensed consolidated financial position, results of operations, or cash flows in a particular period. These proceedings could also result in reputational harm, sanctions, consent decrees, or orders requiring a change in our business practices. Because of the potential risks, expenses and uncertainties of litigation, we may, from time to time, settle disputes, even where we have meritorious claims or defenses, by

We maintain insurance to mitigate potential losses arising from certain claims associated with the use of our products, but our insurance coverage may not adequately cover all claims asserted against us, including our liability related to the July 19 Incident. In addition, even claims that ultimately are unsuccessful could result in our expenditure of funds in litigation, divert management’s time and other resources, and harm our business and reputation. We offer our Falcon Complete customers a limited warranty, subject to certain conditions. While we maintain insurance relating to our warranty, we cannot be certain that our insurance coverage will be adequate to cover such claims, that such insurance will continue to be available to us on commercially reasonable terms, or at all, or that any insurer will not deny coverage as to any claim. Any failure or refusal of our insurance providers to provide the expected insurance benefits to us after we have paid the warranty claims would cause us to incur significant expense or cause us to cease offering this warranty which could damage our reputation, cause us to lose customers, expose us to liability claims by our customers, negatively impact our sales and marketing efforts, and have an adverse effect on our business, financial condition and results of operations.

Sales of a substantial number of shares of our common stock in the public market, particularly sales by our directors, executive officers and significant stockholders, or the perception that these sales could occur, could adversely affect the market price of our common stock. As of MayAugust 28,20, 2026, we had 254,564,8201,023,934,842 shares of common stock outstanding.

As of AprilJuly 30,31, 2026, we had $750.0 million principal amount of indebtedness outstanding (excluding intercompany indebtedness). Our indebtedness could have important consequences, including:

On July 4, 2025, tax reform legislation included in the One Big Beautiful Bill Act (the “OBBBA”) was enacted in the United States. The tax effects of the OBBBA have been accounted for in the second quarter of the fiscal year 2026. The OBBBA includes significant corporate tax reforms, including (i) the permanent reinstatement of deducting domestic research and development expenditures as incurred beginning in fiscal 2026 (under prior law such expenditures were capitalized and amortized over five years); (ii) the option to claim 100% accelerated depreciation deductions on qualified property; and (iii) international tax provisions modifying global intangible low-taxed income (“GILTI”), foreign-derived intangible income (“FDII”), and base erosion and anti-abuse tax (“BEAT”).

As of January 31, 2026, we had aggregate U.SU.S. federal and California net operating loss carryforwards of $2.6 billion and $417.4 million, respectively, which may be available to offset future taxable income for income tax purposes. The federal net operating losses are carried forward indefinitely, and California net operating loss carryforwards begin to expire in fiscal 2034 through fiscal 2046. As of January 31, 2026, net operating loss carryforwards for other states totaled $998.3 million, which begin to expire in fiscal 2027 through fiscal 2046. As of January 31, 2026, net operating loss carryforwards for the U.K. totaled $84.2 million, which are carried forward indefinitely, and net operating loss carryforwards totaled immaterial amounts in certain foreign jurisdictions. As of January 31, 2026, we had U.SU.S. federal and California research and development (“R&D”) credit carryforwards of $227.0 million and $59.8 million, respectively. The federal R&D credit carryforwards begin to expire in fiscal 2037 though fiscal 2046. The California R&D credits are carried forward indefinitely. Realization of these net operating loss and R&D credit carryforwards depends on future income, and there is a risk that our existing carryforwards could expire unused and be unavailable to offset future income tax liabilities, which could adversely affect our results of operations.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with the condensed consolidated financial statements and related notes thereto included elsewhere in this Quarterly Report on Form 10-Q and our Annual Report on Form 10-K for the year ended January 31, 2026, filed with the SEC. Some of the information contained in this discussion and analysis or set forth elsewhere in this Quarterly Report on Form 10-Q, including information with respect to our plans and strategy for our business, includes forward-looking statements that involve risks and uncertainties as described under the heading Special Note Regarding Forward-Looking Statements following the Table of Contents of this Quarterly Report on Form 10-Q. As discussed in Note 1 and Note 1617 to the unaudited Condensed Consolidated Financial Statements included in this report, the Company revised its previously issued unaudited Condensed Consolidated Financial Statements as of and for the three and six months ended AprilJuly 30,31, 2025 to correct for an immaterial error discovered during the fourth quarter of fiscal 2026. The revisions are intended to ensure comparability across all periods reflected herein. You should review the disclosure under Part II, Item 1A, “Risk Factors” in this Quarterly Report on Form 10-Q for a discussion of important factors that could cause actual results to differ materially from the results described in or implied by the forward-looking statements contained in the following discussion and analysis.

We have a land-and-expand sales strategy where customers start with any number of modules and can easily add capabilities over time. Our AI security advantage begins with our platform breadth and single sensor visibility — delivering unified protection across endpoints, cloud workloads, identities, SaaS environments, browsers, and the prompt and agentic interaction layer. One sensor, one console, one platform covering all attack surfaces.

Our dollar-based net retention rate continuedimproved tosequentially beas strongof duringJuly the three months ended April 30,31, 2026. Our dollar-based net retention rate can fluctuate from period to period due to large customer contracts in a given period and incentives provided, which may reduce our dollar-based net retention rate in subsequent periods. In addition, if our customers are not able to fully utilize their product subscriptions (including in connection with our flexible subscription offering), we may experience increased contraction as such customers may elect to renew with shorter subscription periods, fewer cloud modules, fewer endpoints or smaller contract values, which may reduce our dollar-based net retention rate.

Our operating expenses consist of sales and marketing, research and development, and general and administrative expenses. For each of these categories of expense, employee-related expenses are the most significant component, which include salaries, employee bonuses, sales commissions, and employer payroll tax. Operating expenses also include an allocated portion of overhead costs for facilities and other administrative functions.

Provision (Benefit) for Income Taxes. Provision (benefit) for income taxes consists of income tax benefits recognized in the current period resulting from the realization of deferred tax assets in connection with recent acquisitions,acquisitions and excess tax benefits related to stock-based awards, partially offset by state income taxes inon the United States, foreign income taxes, and withholding taxes related to customer paymentsearnings in certain foreign jurisdictions in which we conduct business. We maintain a full valuation allowance on our U.S. federal and state and certain foreign deferred tax assets, including net operating loss carryforwards and tax credits, which we have determined are not realizable on a more-likely-than-not basis. We evaluate the need for a valuation allowance on a quarterly basis.

Comparison of the Three Months Ended AprilJuly 30,31, 2026 and 2025

The following shows total revenue from subscriptions and professional services for the three months ended AprilJuly 30,31, 2026 as compared to the three months ended AprilJuly 30,31, 2025 (in thousands, except percentages):

Total revenue increased by $282.2$301.9 million, or 26%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025. Subscription revenue accounted for 95% and 94% of total revenue for each of the three months ended AprilJuly 30,31, 2026 and AprilJuly 30,31, 2025.2025, respectively. Professional services revenue accounted for 5% and 6% of our total revenue for each of the three months ended AprilJuly 30,31, 2026 and AprilJuly 30,31, 2025.2025, respectively.

Subscription revenue increased by $270.1$297.3 million, or 26%,27%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025, which was primarily driven by a combination of the addition of new customers and the sale of additional sensors and modules to existing customers.

Professional services revenue increased by $12.1$4.6 million, or 23%,7%, for the three months ended AprilJuly 30,31, 2026, compared to the three months ended AprilJuly 30,31, 2025, which was primarily attributable to an increase in the number of professional service hours.

The following shows cost of revenue related to subscriptions and professional services for the three months ended AprilJuly 30,31, 2026 as compared to the three months ended AprilJuly 30,31, 2025 (in thousands, except percentages):

Total cost of revenue increased by $54.4$65.5 million, or 19%,21%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025. Subscription cost of revenue increased by $47.1$58.2 million, or 20%,23%, for the three months ended AprilJuly 30,31, 2026, compared to the three months ended AprilJuly 30,31, 2025. The increase in subscription cost of revenue was primarily due to an increase in cloud hosting and related services costs of $10.9$13.9 million, an increase in depreciation of data center equipment of $9.7$10.4 million, an increase in employee-related expenses of $8.9$9.4 million driven by a 6%9% increase in average headcount, an increase in stock-based compensation expense of $6.9 million, an increase in allocated overhead costs of $5.6 million, an increase in employee benefits of $4.0 million, an increase in amortization of internal-use software of $6.0 million, an increase in allocated overhead costs of $4.5$3.8 million, and an increase in employeeterm-based benefitssoftware licenses of $2.1$1.6 million, partially offset by a decrease in charges related to the Strategic Plan of $3.6 million.

Professional services cost of revenue increased by $7.3$7.2 million, or 16%,13%, for the three months ended AprilJuly 30,31, 2026, compared to the three months ended AprilJuly 30,31, 2025. The increase in professional services cost of revenue was primarily due to an increase in consulting expenses of $5.3 million, an increase in employee-related expenses of $0.9$5.6 million driven by a 1%12% increase in average headcount, andan increase in stock-based compensation expense of $4.1 million, an increase in allocated overhead costs of $0.7$1.7 million, and an increase in employee benefits of $1.0 million, partially offset by a decrease in charges related to the Strategic Plan of $3.3 million and a decrease in consulting expenses of $2.3 million.

The following shows gross profit and gross margin for subscriptions and professional services for the three months ended AprilJuly 30,31, 2026 as compared to the three months ended AprilJuly 30,31, 2025 (in thousands, except percentages):

Subscription gross margin increased by one percentage point for the three months ended AprilJuly 30,31, 2026, compared to the three months ended AprilJuly 30,31, 2025. The increase in subscription gross margin was primarily attributable to hostinghiring efficiencies.

Professional services gross margin increaseddecreased by five percentage points for the three months ended AprilJuly 30,31, 2026, compared to the three months ended AprilJuly 30,31, 2025. The increasedecrease in professional services gross margin was primarily driven by higher employee-related expenses due to no corresponding Strategic Plan impact, and an increase in utilization,stock-based compensation expense, partially offset by ana increasedecrease in consulting expenseexpenses during the three months ended AprilJuly 30,31, 2026.

The following shows sales and marketing expenses for the three months ended AprilJuly 30,31, 2026 as compared to the three months ended AprilJuly 30,31, 2025 (in thousands, except percentages):

Sales and marketing expenses increased by $49.5$63.4 million, or 11%,14%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025. The increase in sales and marketing expenses was primarily due to an increase in stock-based compensation expense of $22.6 million, an increase in employee-related expenses of $14.9$17.7 million driven by a 3%10% increase in average headcount, an increase in marketingallocated programsoverhead costs of $8.3$10.0 million, an increase in allocatedmarketing overhead costsprograms of $6.1 million, an increase in stock-based compensation expense of $5.1 million, an increase in company event expenses of $5.1 million, an increase in travel expenses of $3.9$6.7 million, an increase in employee benefits of $3.6$5.9 million, and an increase in cloudtravel hosting and related costsexpenses of $0.9$4.4 million, andpartially offset by a decrease of $3.4 million in sales commission expensecharges related to the changeStrategic in estimated periodPlan of benefit,$8.7 partially offset by an increase in capitalized sales commissions.million.

The following shows research and development expenses for the three months ended AprilJuly 30,31, 2026 as compared to the three months ended AprilJuly 30,31, 2025 (in thousands, except percentages):

Research and development expenses increased by $77.4$101.7 million, or 23%,30%, for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025. This increase was primarily due to an increase in stock-based compensation expense of $48.5 million, an increase in employee-related expenses of $33.3$40.1 million driven by a 13%17% increase in average headcount, an increase in stock-based compensation expense of $21.7 million, an increase in allocated overhead costs of $9.2 million, an increase in cloud hosting and related costs of $7.5$12.5 million, an increase in allocated overhead costs of $11.8 million, an increase in employee benefits of $5.7 million, an increase in term-based software licenses of $3.9 million, an increase in employee benefits of $3.3$3.8 million, and an increase in depreciation of data center equipment of $1.6$1.4 million, partially offset by a decrease in charges related to the Strategic Plan of $16.7 million and an increase in software capitalization of $4.2$6.8 million.

The following shows general and administrative expenses for the three months ended AprilJuly 30,31, 2026 as compared to the three months ended AprilJuly 30,31, 2025 (in thousands, except percentages):

General and administrative expenses increasedstayed bylargely $12.8 million, or 8%,flat for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025. The increasenet in general and administrative expensesdecrease was primarily due to an increase in stock-based compensation expense of $23.9 million, an increase in consulting expense of $13.1 million, and an increase in legal expense of $1.8 million unrelated to the July 19 Incident or related matters, partially offsetdriven by alower decrease in expensescosts associated with the July 19 Incident and related matters of $20.5 million and a decrease inreduced charges related to the Strategic PlanPlan, ofpartially $6.6offset million.by higher stock-based compensation expense.

The following shows interest expense, interest income, and other income (expense), net for the three months ended AprilJuly 30,31, 2026 as compared to the three months ended AprilJuly 30,31, 2025 (in thousands, except percentages):

The decrease in interest expense for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025 was primarily due to no amortization of debt issuance costs in the current period related to our secured revolving credit facility, which expired in January 2026.

The decrease in interest income for the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025 was driven by lower market rates and a lower cash balance.rates.

The following shows the provision (benefit) for income taxes for the three months ended AprilJuly 30,31, 2026 as compared to the three months ended AprilJuly 30,31, 2025 (in thousands, except percentage):

The $7.3 million change offrom $28.0 million inan income tax provision to an income tax benefit during the three months ended AprilJuly 30,31, 2026 compared to the three months ended AprilJuly 30,31, 2025 was primarily driven by incomeexcess tax benefits related to stock-based awards recognized in the current periodperiod, resultingpartially fromoffset theby realizationincome oftaxes deferredon tax assetsearnings in connectionjurisdictions within recentwhich acquisitionswe conduct business and the application of interim period tax accounting methodology with our return to profitability.methodology.