CrowdStrike

Prospectus Summary

CROWDSTRIKE HOLDINGS, INC. Our Mission

We don't have a mission statement—we are on a mission to protect our customers from breaches.

Overview

We founded CrowdStrike in 2011 to reinvent security for the cloud era. When we started the company, cyberattackers had a decided, asymmetric advantage over existing security products. We turned the tables on the adversaries by taking a fundamentally new approach that leverages the network effects of crowdsourced data applied to modern technologies such as artificial intelligence, or AI, cloud computing, and graph databases. Realizing that the nature of cybersecurity problems had changed but the solutions had not, we built our CrowdStrike Falcon platform to detect threats and stop breaches.

We believe we are defining a new category called the Security Cloud, with the power to transform the security industry much the same way the cloud has transformed the CRM, HR, and service management industries. With our Falcon platform, we created the first multi-tenant, cloud native, intelligent security solution capable of protecting workloads across on-premise, virtualized, and cloud-based environments running on a variety of endpoints such as laptops, desktops, servers, virtual machines, and Internet of Things, or IoT, devices. Our Falcon platform is composed of two tightly integrated proprietary technologies: our easily deployed intelligent lightweight agent and our cloud-based, dynamic graph database called Threat Graph. Our solution benefits from crowdsourcing and economies of scale, which we believe enables our AI algorithms to be uniquely effective. Today, we offer 10 cloud modules on our Falcon platform via a SaaS subscription-based model that spans multiple large security markets, including endpoint security, security and IT operations (including vulnerability management), and threat intelligence.

Organizations everywhere are becoming more distributed as they adopt the cloud, increase workforce mobility, and grow their number of connected devices. They are adding more workloads to a myriad of different endpoints beyond the traditional security perimeter, exposing an increasingly broad attack surface to adversaries. In addition, the sophistication of cyberattacks has increased, often coming from nation-states, well-funded criminal organizations, and hackers using advanced, easily obtained methods of attack. On a number of occasions, adversaries have launched devastating, destructive attacks that have caused significant business disruption and billions of dollars in cumulative losses. The architectural limitations of legacy security products, coupled with a dynamic and intensifying threat landscape, are creating the need for a fundamentally new approach to security.

Our unique approach starts with our single intelligent lightweight agent that enables frictionless deployment of our platform at scale. Our customers can rapidly adopt our technology across any type of workload running on a variety of endpoints. Our lightweight agent offloads computationally intensive tasks to the cloud, while retaining local detection and prevention capabilities that are necessary on the endpoint. The agent is nonintrusive to the end user and continues to protect the endpoint and track activity even when offline. By utilizing a single agent, customers are able to leverage all the capabilities of our platform without burdening the endpoint with multiple agents. Our lightweight agent intelligently streams high fidelity endpoint data to the cloud, where Threat Graph provides a simple, flexible, and scalable way to model highly interconnected data sets. Threat Graph processes, correlates, and analyzes over one trillion endpoint-related events per week in real time and maintains an index of these events for future use. Threat Graph continuously looks for malicious activity by applying graph analytics and AI algorithms to the data streamed from the endpoints.

We founded our company on the principle that the future of security would be driven by AI and that a cloud-native architecture would enable the collection of high fidelity data and scalability necessary for an effective solution. We call this cloud-scale AI. From the beginning, our strategy was focused on collecting data at scale, centrally storing such data in a singular model, and training our algorithms on these vast amounts of high fidelity data, which we believe is a fundamental differentiator from our competitors. Our cloud-scale AI means that the more data that is fed into our Falcon platform, the more intelligent Threat Graph becomes and the more our customers benefit, creating a powerful network effect that increases the overall value we provide. AI is revolutionizing many technology fields, including security solutions. To be truly effective, algorithms that enable artificial intelligence depend on the quality and volume of data that trains them and the selection of the right differentiating features from that data. We are uniquely effective because we have more high fidelity data to train our AI models and more security expertise to guide our feature selection—all resulting in industry-leading efficacy and low false positives. By leveraging a multi-tenant, cloud native solution, the data we analyze to stop breaches is both larger and more meaningful than the data from on-premise or single instance private cloud products. If Threat Graph discovers something in one customer environment, all customers benefit automatically and in real time. Taken together, our platform enables intelligent, dynamic automation at scale to detect threats and stop breaches.

We primarily sell our platform and cloud modules through our direct sales team that leverages our network of channel partners to maximize effectiveness and scale. We amplify our sales presence by leveraging our technology alliance partners that can deliver, embed, or build applications with data and analytics from our Falcon platform. We recently announced a strategic technology and go-to-market partnership with Dell Inc. that will enable Dell's business customers to seamlessly add the Falcon platform to their purchase of Dell hardware. In addition, Dell and SecureWorks Corp. have agreed to take our Falcon platform to market as their preferred endpoint security offering through their global sales organizations. We are also enhancing our go-to-market strategy using a low-touch, trial-to-pay approach. In May 2018, we launched a free trial of Falcon Prevent, our next-generation antivirus module, available from our website or the AWS Marketplace. We are beginning to see a number of these trial users convert to paying customers. We believe this approach will enable a higher velocity of new customer acquisition and expansion, and will extend our reach to customers of all sizes.

We have a low friction land-and-expand sales strategy. When customers deploy our Falcon platform, they can start with any number of cloud modules and we can activate additional cloud modules in real time on the same agent already deployed on the endpoint. Our integrated set of cloud-delivered modules includes next-generation antivirus, endpoint detection and response, or EDR, device control, managed threat hunting, IT hygiene, vulnerability management, and threat intelligence. Once customers experience the benefits of our Falcon platform, they often expand their adoption over time by adding more endpoints or purchasing additional modules. Our dollar-based net retention rate, which measures expansion in existing customers' subscriptions over a 12 month period, was 147% as of January 31, 2019, demonstrating the power of our land-and-expand strategy.

Some of the world's largest enterprises, government organizations, and high profile brands trust us to protect their business. As of January 31, 2019, we had 2,516 subscription customers worldwide, including 44 of the Fortune 100, 37 of the top 100 global companies, and nine of the top 20 major banks. We began as a large enterprise solution, but the flexibility and scalability of our Falcon platform and enhanced go-to-market approach enable us to protect customers of any size—from hundreds of thousands of endpoints to as few as three. We have been recognized by numerous independent third-party analysts, including Gartner, Inc.⁽²⁾⁽³⁾, Forrester Research Inc., and International Data Corporation, or IDC.

We have recently experienced significant growth, with total revenue increasing from $52.7 million for fiscal 2017 to $118.8 million for fiscal 2018, representing year-over-year growth of 125%, and from $118.8 million for fiscal 2018 to $249.8 million for fiscal 2019, representing year-over-year growth of 110%. Subscription revenue grew from $37.9 million for fiscal 2017 to $92.6 million for fiscal 2018, a 144% increase, and from $92.6 million for fiscal 2018 to $219.4 million for fiscal 2019, a 137% increase. Our annual recurring revenue, or ARR, has grown from $58.8 million as of January 31, 2017 to $141.3 million as of January 31, 2018, a 140% increase, and from $141.3 million as of January 31, 2018 to $312.7 million as of January 31, 2019, a 121% increase. Our net loss increased from $91.3 million for fiscal 2017 to $135.5 million for fiscal 2018, and from $135.5 million for fiscal 2018 to $140.1 million for fiscal 2019. We expect to continue to incur net losses for the foreseeable future as we continue to invest in our business, and our sales capabilities in particular, to address our large market opportunity.

Industry Background

Cybersecurity Threats are Greater than Ever

Today's cybersecurity threat landscape is more dangerous than ever. Breaches are complex and often executed over multiple steps known in the industry as the threat lifecycle. The typical threat lifecycle starts with an initial exploit to enter a system, historically using malware, but increasingly using malware-free or fileless methods, to penetrate endpoints and establish a beachhead inside the corporate perimeter. Once inside, adversaries move laterally across the corporate environment where they collect credentials and escalate privileges enabling the typical adversary to download a larger, more destructive malware program or connect with an external control source. At this stage in the threat lifecycle, the adversary is able to encrypt, destroy, or silently exfiltrate sensitive data.

Increasingly, adversaries are well-trained, possess significant technological and human resources, and are highly deliberate and targeted in their attacks. Adversaries today range from militaries and intelligence services of well-funded nation-states to sophisticated criminal organizations who are motivated by financial gains to hackers leveraging readily available advanced techniques. These groups and individuals are responsible for many breaches that involve theft or holding hostage financial data, intellectual property, and trade secrets. On a number of occasions, adversaries have launched devastating, destructive attacks that have caused significant business disruption and billions of dollars in cumulative losses.

Proliferation of Workloads Expanding the Attack Surface

The rise of cloud computing, workforce mobility, and growth in connected devices has created a rapid expansion of workloads across endpoints and industries. According to a 2019 Cisco white paper, the number of connected devices is expected to reach 28.5 billion by 2022, up from 18 billion in 2017. As a result, devices, applications, and data are highly distributed and diverse, challenging organizations to monitor and protect all of their workloads running on various endpoints. The adoption of many of these technologies and the resulting disappearance of the corporate perimeter have expanded the attack surface and left many organizations increasingly vulnerable to breach. Today, workloads running on endpoints, such as laptops and servers, are the primary targets in a security attack since they are vulnerable and frequently are repositories of valuable and sensitive data, including intellectual property, authentication credentials, personally identifiable information, financial information, and other digital assets. As new workloads are provisioned on emerging mobile and IoT devices, oftentimes residing outside of the corporate perimeter, increasingly more sensitive and mission critical data will be generated and stored on these endpoints as well.

On-Premise Security Architectures are Constrained

On-premise products are siloed, lack integration, and have limited ability to collect, process, and analyze vast amounts of data—attributes that are required to be effective in today's increasingly dynamic threat landscape. Legacy vendors often deploy more agents to the endpoint as they layer on a patchwork of additional point product capabilities. This approach burdens endpoints by consuming additional storage space, memory, and processor capacity, degrading end user experience without providing effective security. In addition, integrating and maintaining numerous products, data repositories, and infrastructures across highly distributed enterprise environments is a costly and resource-intensive process for already thinly-staffed security teams.

Other Existing Security Products have Limitations

Legacy Signature-based Products. Signature-based products are designed to detect attacks that are already catalogued in a repository of previously identified threats, but are not capable of preventing unknown threats or stopping associated breaches. Many significant breaches seen in the last two decades have involved a failure of the legacy signature-based antivirus product to detect a previously unknown or modified version of a previously known attack.

Malware-focused Machine Learning Products. Traditionally, organizations have focused on protecting their networks and endpoints against malware-based attacks. These attacks involve malware built for the specific purpose of performing malicious activities, stealing data, or destroying systems. A malware-centric defensive approach will leave the organization vulnerable to attacks that do not leverage malware. According to data from our customer base indexed by Threat Graph, 40% of detections in the second quarter of fiscal 2018 were not malware-based, but instead leveraged legitimate tools built into modern operating systems, enabling attackers to accomplish their objectives without writing files to the endpoint, making them more difficult for a traditional antivirus product to detect.

Application Whitelisting Products. Application whitelisting products resort to an "always allow" or "always block" policy on an endpoint in order to allow or prevent processes from executing. Whitelisting relies in part on manually creating and maintaining a complex list of rules, burdening end users and IT organizations. In order to avoid these management challenges, IT organizations often create special exceptions to the whitelist that attackers leverage to compromise endpoints. Furthermore, fileless attacks can exploit legitimate whitelisted applications, compromising the integrity of the whitelisting product.

Network-centric Security Products. Traditional network security vendors have focused their products on perimeter-based protection. However, these approaches have decreased in relevance and effectiveness as employees and workplace devices have expanded beyond the firewall and the use of encrypted traffic has increased, creating blind spots and vulnerabilities that attackers are able to exploit. As the number of endpoints proliferates, this layer of defense cannot adequately protect information-rich endpoints and workloads that are outside the corporate perimeter.

Bolt-on Cloud Products. Many on-premise vendors have introduced cloud offerings by putting their on-premise products in the cloud. Such single-tenant products were not designed to run in the cloud and therefore continue to be siloed, lack integration, and possess limited scalability to identify threats across their customer base in real time. In addition, such products are complex to deploy, difficult to scale, brittle to maintain, costly to own, and can be ineffective in stopping breaches. Any product that was originally designed for on-premise deployments and migrated to the cloud cannot, by definition, be a cloud native solution.

Creation of the Security Cloud

Over the last 15 years, cloud computing has revolutionized many industries in enterprise software and created significant shifts in market share away from incumbents with on-premise or single instance cloud offerings. The purpose-built, cloud native leaders that began from scratch with multi-tenant architectures, single data models, and SaaS business models have defined entirely new categories such as CRM Cloud, HR Cloud, and Service Management Cloud. We believe we are doing the same for security.

An effective solution to address the modern cybersecurity threat landscape should combine multiple methods into an integrated, data-driven, automated, and open cloud-based platform in order to provide comprehensive breach protection across the entire threat lifecycle. Such a platform requires collecting, processing, analyzing, and correlating vast amounts of high fidelity endpoint events in the cloud. This platform needs to operate at web-scale, process events in real time, possess an open architecture, and benefit from the network effects of crowdsourced data to understand attacks that happen across millions of endpoints. We believe only a cloud native approach can address today's threat landscape.

We believe we are defining a new category called the Security Cloud.

Our Solution

With our Falcon platform, we created the first multi-tenant, cloud native, open, intelligent security solution capable of protecting workloads across on-premise, virtualized, and cloud-based environments running on a variety of endpoints such as laptops, desktops, servers, virtual machines, and IoT devices. Our solution consists of our single intelligent lightweight agent and our powerful and dynamic cloud-based database Threat Graph. These two tightly integrated proprietary technologies continually collect, process, analyze and correlate vast amounts of high fidelity data across the entire threat lifecycle using a combination of AI and behavioral pattern-matching techniques to stop breaches. We implement this approach by crowdsourcing data across our entire customer base and taking advantage of economies of scale, which we believe enables our AI algorithms to be uniquely effective. Our cloud-based AI is also automatically shared with every customer in our community in real time. We combine multiple methods of detection, prevention, and response to known and unknown threats as well as malware and malware-free techniques across the threat lifecycle.

Our Falcon platform integrates 10 cloud modules via a SaaS subscription-based model that spans multiple large security markets, including endpoint security, security and IT operations (including vulnerability management), and threat intelligence to deliver comprehensive breach protection even against today's most sophisticated attacks. Our single data model and open cloud architecture enable us and third-party partners to rapidly innovate, build, and deploy new cloud modules to provide our customers with additional functionality across a myriad of use cases.

Our cloud modules currently span the following categories:

•

Endpoint Security: Our next-generation antivirus, EDR, and device control modules combine machine learning and advanced behavioral techniques to defend against malware and malware-free attacks, allow for continuous and comprehensive visibility and analysis of endpoint activity, and provide administrators with visibility and granular control across USB peripheral devices.


•

Security and IT Operations: We offer modules addressing IT hygiene, scan-less vulnerability management, a turnkey response and remediation solution, as well as a threat hunting solution that is powered by a team of elite security experts leveraging Threat Graph.


•

Threat Intelligence: Our threat research, malware search engine, and malware analysis modules provide automated assistance to review detected threats, conduct malware research, and detonate suspicious files securely.

We recently launched the CrowdStrike Store, which is the first open cloud-based application Platform as a Service, or PaaS, for cybersecurity. The CrowdStrike Store introduces a unified Security Cloud ecosystem of trusted partners and applications to our customers. The CrowdStrike Store allows customers to rapidly and easily discover, try, and purchase applications from both trusted partners and CrowdStrike without needing to deploy and manage additional agents and infrastructures or go through lengthy sales, integration, or implementation processes. The CrowdStrike Store allows partners to bring new security applications to the market and efficiently target our customer base. Leveraging our Falcon platform, partners can develop applications that address our customers' needs without having to develop and support their own agents, invest in underlying infrastructure, or hire additional sales personnel. We believe the CrowdStrike Store will cultivate a rich, innovative, and trusted ecosystem between our partners and customers, increasing the overall value of our Falcon platform.

Earlier this year, we announced CrowdStrike Falcon for Mobile, the first enterprise EDR solution for mobile devices, which we expect will be commercially available later this year. Falcon for Mobile enables security teams to hunt for advanced threats on mobile devices while providing enhanced visibility into malicious, unwanted, or accidental access to sensitive corporate data, while protecting user privacy and without impacting device performance. Falcon for Mobile closes the gap between disparate mobile endpoint and enterprise defense solutions by leveraging our cloud-native platform and single-agent architecture.