How CrowdStrike went to market

PrimarySupportingTried, then dropped

1. 2012 to 2017

   Intelligence, incident response, then one EDR product

   CrowdStrike launched its threat intelligence product in July 2012 and provided intelligence and incident response services while it built Falcon, which first shipped EDR as a single solution in June 2013.

   • Brand narrative

     Intelligence and services came before the platform, and the S-1 lists identifying and naming adversary groups, alongside regular industry reports, as a marketing activity.^[1]

   • Sales-led

     The S-1 says CrowdStrike began as a large enterprise solution, and the FY2020 10-K says it and its channel partners historically sold primarily to large organizations.^[1],[2]

2. 2017 to 2020

   Modules, trial-to-pay, marketplace and channel

   In February 2017 the platform moved from a single offering to multiple cloud module SKUs on one agent. A website trial followed in December 2017 and AWS Marketplace in May 2018.

   • Land and expand

     Customers start with any number of modules, and more are activated in real time on the agent already deployed. Net retention was 104%, 119% and 147% at January 2017, 2018 and 2019, and 47% of customers had four or more modules by January 2019.^[1]

   • Sales-led

     Field and inside sales, segmented by a customer's number of endpoints, sell most subscriptions, and sales also finds existing customers for free trials of more modules. Incident response and proactive services are described as a way to cross-sell subscriptions.^[1],[2]

   • Partner channel

     Sales leans on channel partners, and Dell and SecureWorks agreed to sell Falcon as their preferred endpoint security offering. Kurtz says the revenue scale needs a great reseller channel.^[1],[17]

   • Product-led

     From December 2017 a 15-day free trial of Falcon Prevent was offered directly from the website, which the S-1 says should extend reach to customers of all sizes.^[1],[2]

   • Cloud marketplace

     Falcon Prevent became available for trial and purchase on AWS Marketplace in May 2018, and Falcon for AWS later offered metered pay-as-you-go billing there.^[2]

   • Owned events

     Fal.Con is the annual user conference. The September 2018 edition in Miami was announced as the second annual Fal.Con, with sessions for executives and IT professionals.^[1],[18]

   • Brand narrative

     Naming adversary groups and publishing industry reports sit alongside paid media, web marketing, analyst work, demand generation and targeted displacement campaigns in the marketing mix.^[1]

3. 2020 to 2024

   Platform scale and module depth

   ARR grew from $600.5M at January 2020 to $3.44B at January 2024 as module depth rose, sales was reorganised by organizational size, and Falcon Flex launched at Fal.Con 2023.

   • Land and expand

     Customers with five or more modules went from 33% at January 2020 to 57% at January 2022 and 64% at January 2024, the last excluding Falcon Go bundles. Falcon Flex replaced fixed bundles with a model where customers expand, adopt and swap modules without new procurement cycles.^{[7],[8],[9],[19]}

   • Sales-led

     The global sales team of field and inside sales is now segmented by a customer's organizational size rather than endpoint count.^[4]

   • Partner channel

     The FY2020 10-K says sales leverages a network of channel partners; by FY2024 it describes a powerful go-to-market sales motion with a vast ecosystem of channel and alliances partners.^[2],[4]

   • Product-led

     The 10-K names the trial-to-pay model as the main way it increasingly sells to small and medium-sized businesses, and a Falcon Go bundle serves organizations with 100 endpoints or fewer.^[3],[9]

   • Owned events

     Fal.Con is where pricing and products launch: Falcon Flex was introduced at Fal.Con 2023 in Las Vegas in September 2023.^[19]

   • Brand narrative

     The company blog explains the adversary naming scheme behind names such as FANCY BEAR and WIZARD SPIDER, which also appear on CrowdStrike t-shirts, and the 10-K still lists naming adversary groups as marketing.^[16],[4]

4. 2024 to now

   After the July 2024 incident: Flex and partner-first

   After the July 19, 2024 incident the company introduced customer commitment packages. It now describes a partner-first go-to-market strategy, and Falcon Flex accounts carry a growing share of ARR.

   • Land and expand

     The 10-K says customer commitment packages included discounting, additional modules, professional services, flexible payment terms or subscription extensions, and have increased contraction and decreased upsell dollar values. Guidance in August 2024 included an estimated $30M subscription revenue impact in each remaining FY2025 quarter from those incentives. ARR from Falcon Flex accounts reached $1.69B at January 2026 and over $2.29B at July 2026.^{[5],[10],[11],[14],[15],[22]}

   • Partner channel

     The 10-K describes a partner-first go-to-market strategy to land new logos and expand in existing accounts, working with resellers, distributors, MSSPs, MSPs and global system integrators.^[5],[6]

   • Cloud marketplace

     Beyond AWS, CrowdStrike sells through Google Marketplace and, from FY2027, Microsoft Marketplace, where buyers can use an existing Azure consumption commitment. AWS named it Global Marketplace Partner of the Year.^{[6],[13],[14]}

   • Owned events

     Fal.Con 2024 in Las Vegas sold out with 6,000 attendees, and the first Fal.Con Europe opened with a partner summit of more than 400 participants.^[20]

   • Sales-led

     A Zero Dollar Flex Fund gives qualifying new services customers 200 hours of services with no up-front cost, framed as a path to broader platform adoption. The 10-K still calls services an opportunity to cross-sell subscriptions.^[21],[6]

   • Product-led

     The free Falcon Go trial is offered from the website and three cloud marketplaces. The trial page offers 15 days with no credit card and says it is not intended for partners or MSSPs.^[6],[23]

   • Brand narrative

     Identifying and naming adversary groups is still listed in the marketing section of the FY2026 10-K.^[6]

“Reported” figures come from trade press, not the company, and are shown with their date.

• “CrowdStrike sells mostly to large enterprises.”

  Partly true

  It began as a large enterprise solution and had 44 of the Fortune 100 in January 2019, but about two-thirds of its subscription customers then had fewer than 1,000 employees. The 10-Ks say it has increasingly focused on small and medium-sized businesses through trial-to-pay, and a Falcon Go bundle serves 100 endpoints or fewer. No filing read splits revenue by customer size, so the revenue mix is unverified.^{[1],[3],[6],[9]}

• “The July 2024 outage broke CrowdStrike's growth.”

  Not supported

  The FY2025 10-K reports longer sales cycles, delayed purchasing decisions, and contraction from commitment packages; net new ARR fell to $806.7M from $875.5M and net retention to 112% from 119%. ARR still grew 23% that year, then 24% in FY2026 with a record $1.0B net new ARR and net retention of 115%. Gross retention was 97%, and ARR reached $5.84B by July 2026.^{[5],[6],[12],[15]}

• “There's no way that you're going to get to the revenue scale that we're at without having, No. 1, a great reseller channel.”

  George Kurtz, Co-founder and CEO, CrowdStrike^[17]

  Section "Partnerships are Key", quoting his POD 2112 podcast answers

• “Every enterprise will run on AI, and securing it is the largest market opportunity in our history.”

  George Kurtz, Co-founder and CEO, CrowdStrike^[15]

  Q2 FY2027 earnings release

• “We view our professional services business primarily as an opportunity to cross-sell subscriptions to our Falcon platform and cloud modules.”

  CrowdStrike, S-1 registration statement^[1]

  MD&A, "Our Go-To-Market Strategy"

• Sell the adversary, not the product category.

  Works when: The buyer faces an intelligent opponent (security, fraud, compliance enforcement) and your telemetry or services work lets you see that opponent before others do.

  Backfires when: There is no human adversary to name, or you cannot back the narrative with original research, so it reads as fear marketing with no proof.

  Based on: Intelligence, incident response, then one EDR product, Brand narrative; Platform scale and module depth, Brand narrative

• One agent, many modules: make the second purchase a switch, not a deployment.

  Works when: The expensive step for the buyer is deployment, and additional products can share the same footprint, data, and console.

  Backfires when: Each new product needs its own install, integration, or buyer, so platform pricing is just bundling.

  Based on: Modules, trial-to-pay, marketplace and channel, Land and expand; Platform scale and module depth, Land and expand

• Use paid services as the front door for an enterprise subscription.

  Works when: There is an urgent, high-trust moment (a breach, an audit, a migration) where the vendor's people are in the customer's environment.

  Backfires when: Services become a margin business of their own, or services staff are rewarded for billable hours rather than subscription conversion.

  Based on: Modules, trial-to-pay, marketplace and channel, Sales-led; After the July 2024 incident: Flex and partner-first, Sales-led

• Recover from a trust failure by trading price for depth.

  Works when: The product is deeply deployed and switching is costly, so a concession that adds modules locks in more surface area than it gives away.

  Backfires when: The product is easy to replace, or the concessions are cash refunds that add nothing to the footprint.

  Based on: After the July 2024 incident: Flex and partner-first, Land and expand

Compare with every other company on the GTM matrix.

1. [1]SEC filingCrowdStrike Holdings Form S-1 (May 14, 2019)
2. [2]SEC filingForm 10-K, fiscal year ended January 31, 2020 (March 23, 2020)
3. [3]SEC filingForm 10-K, fiscal year ended January 31, 2022 (March 16, 2022)
4. [4]SEC filingForm 10-K, fiscal year ended January 31, 2024 (March 7, 2024)
5. [5]SEC filingForm 10-K, fiscal year ended January 31, 2025 (March 10, 2025)
6. [6]SEC filingForm 10-K, fiscal year ended January 31, 2026 (March 5, 2026)
7. [7]EarningsCrowdStrike Q4 and fiscal 2020 results (8-K exhibit) (March 19, 2020)
8. [8]EarningsCrowdStrike Q4 and fiscal 2022 results (8-K exhibit) (March 9, 2022)
9. [9]EarningsCrowdStrike Q4 and fiscal 2024 results (8-K exhibit) (March 5, 2024)
10. [10]EarningsCrowdStrike Q2 fiscal 2025 results (8-K exhibit) (August 28, 2024)
11. [11]EarningsCrowdStrike Q3 fiscal 2025 results (8-K exhibit) (November 26, 2024)
12. [12]EarningsCrowdStrike Q4 and fiscal 2025 results (8-K exhibit) (March 4, 2025)
13. [13]EarningsCrowdStrike Q3 fiscal 2026 results (8-K exhibit) (December 2, 2025)
14. [14]EarningsCrowdStrike Q4 and fiscal 2026 results (8-K exhibit) (March 3, 2026)
15. [15]EarningsCrowdStrike Q2 fiscal 2027 results (8-K exhibit) (August 26, 2026)
16. [16]CompanyNaming Adversaries and Why It Matters to Your Security Team (May 31, 2022)
17. [17]CompanyPodcast Features George Kurtz on What it Takes to Build a Unicorn (September 17, 2018)
18. [18]CompanyCrowdStrike Announces Agenda and Sponsors for its Second Annual User Conference "Fal.Con POWER UP 2018" (September 5, 2018)
19. [19]CompanyCrowdStrike Unveils New Data Protection, Exposure Management and IT Automation Innovations to Drive Platform Consolidation (September 19, 2023)
20. [20]CompanyCrowdStrike's Premier Fal.Con Conference Expands to Europe (October 30, 2024)
21. [21]CompanyCrowdStrike Launches Flex for Services (March 24, 2026)
22. [22]CompanyCrowdStrike Falcon Flex (pricing page) (October 18, 2026)
23. [23]CompanyCrowdStrike Falcon Free Trial (October 18, 2026)

Every phase, motion, and myth verdict cites a filing, the company's own pages, or a founder speaking on the record. See the methodology.