CrowdStrike

“Additionally, if the incidence of cyberattacks were to decline, or be perceived to decline, or if organizations adopt endpoints that use operating systems we do not adequately support, our ability to attract new customers and expand sales of our solutions to existing customers could be adversely affected.”

Annual report 2026A · The company itself

“Real or perceived defects, errors or vulnerabilities in our Falcon platform and cloud modules, the failure of our platform to detect or prevent incidents, including advanced and newly developed attacks, misconfiguration of our solutions, or the failure of customers to take action on attacks identified by our platform could harm our reputation and adversely affect our business, financial position and results of operations. Because our cloud native security platform is complex, it has contained, and may in the future contain defects, errors or vulnerabilities that are not detected until after deployment.”

Annual report 2026A · The company itself

“Moreover, as our cloud native security platform is adopted by an increasing number of enterprises and governments, individuals and organizations behind advanced cyberattacks may intensify their efforts to defeat our security platform. If this happens, our systems and subscription customers could be specifically targeted by attackers and could result in vulnerabilities in our platform or undermine the market acceptance of our Falcon platform and could adversely affect our reputation as a provider of security solutions.”

Annual report 2026A · The company itself

“Organizations are increasingly subject to a wide variety of attacks on their networks, systems, and endpoints. No security solution, including our Falcon platform, can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security incident.”

Annual report 2026A · The company itself

“We are required to comply with stringent, complex and evolving laws, rules, regulations and standards in many jurisdictions, as well as contractual obligations, relating to data privacy and security. Ensuring compliance with such requirements may increase operating costs, impact our data processing practices and policies and the development of new products or services, and reduce operational efficiency, any of which could adversely affect our business and operations.”

Annual report 2026A · The company itself

“The CrowdStrike Store is an open cloud-based application PaaS for cybersecurity and the industry’s first unified security cloud ecosystem of trusted third-party applications.”

Annual report 2026A · The company itself

“Our internal team of security experts, researchers, intelligence analysts, and threat hunters continuously analyzes the evolving global threat landscape to develop products that defend against today’s most sophisticated and stealthy attacks and report on emerging security issues.”

Annual report 2026A · The company itself

“If we are unable to successfully enhance our existing products and services and introduce new products and services in response to rapid technological changes and market developments as well as evolving security threats, our competitive position and prospects will be harmed. Our ability to increase revenue from existing customers and attract new customers will depend in significant part on our ability to anticipate and respond effectively to rapid technological changes and market developments as well as evolving security threats. The success of our Falcon platform depends on our ability to take such changes into account and invest effectively in our research and development organization to increase the reliability, availability and scalability of our existing solutions and introduce new solutions.”

Annual report 2026A · The company itself

“Success in delivering enhancements and new solutions depends on several factors, including the timely completion, introduction and market acceptance of the enhancement or new solution, the risk that such enhancement or new solution may have quality or other defects or deficiencies (such as those experienced in connection with the July 19 Incident), especially in the early stages of introduction, as well as our ability to seamlessly integrate all of our product and service offerings and develop adequate sales capabilities in new markets. Failure to effectively deliver, integrate, and manage perceptions with respect to enhancements and new solutions could erode our competitive position, significantly impair our revenue growth, and negatively impact our operating results.”

Annual report 2026A · The company itself

“Table of Contents If we are not able to maintain and enhance our CrowdStrike and Falcon brands and our reputation as a provider of high-efficacy security solutions, our business and results of operations may be adversely affected. We believe that maintaining and enhancing our CrowdStrike and Falcon brands and our reputation as a provider of high-efficacy security solutions is critical to our relationship with our existing customers, channel partners, and technology alliance partners and our ability to attract new customers and partners.”

Annual report 2026A · The company itself

“Additionally, we have entered, and intend to continue to enter, into technology alliance partnerships with third parties to support our future growth plans.”

Annual report 2026A · The company itself

“We incorporate novel uses of AI technologies, including generative AI, into our products and operations, such as our Falcon platform. AI is complex and rapidly evolving, and we face significant competition from other companies who may incorporate AI into their products more quickly or more successfully than us, as well as an evolving regulatory landscape.”

Annual report 2026A · The company itself

“BUSINESS Overview Founded in 2011, CrowdStrike reinvented cybersecurity for the cloud and artificial intelligence (“AI”) era and transformed the way cybersecurity is delivered and experienced by customers.”

Annual report 2026A · The company itself

“Today, we offer 33 cloud modules on our Falcon platform via a SaaS subscription-based model that spans multiple large markets, including corporate endpoint and cloud workload security, managed security services, security and vulnerability management, IT operations management, identity protection, next-generation security information and event management (“SIEM”) and log management, threat intelligence services, data protection, SaaS security posture management, Security Orchestration, Automation and Response (“SOAR”) and AI powered workflow automation, and security for generative AI and AI-driven systems through AI detection and response.”

Annual report 2026A · The company itself

“Threat Graph also provides query and hunting capability over the full set of high-fidelity events collected in the graph. This correlated data, natively represented in a graph structure, enables new products and cloud modules to be created rapidly since the platform provides the visibility, collection, correlation, and actions over data as reusable building blocks. This collect-once, use repeatedly approach is the reason why we have been able to deliver new cloud modules covering IT hygiene and vulnerability management quickly and enables us to continue expanding the Falcon platform rapidly in the future.”

Annual report 2026A · The company itself

“Asset Graph. Asset Graph dynamically monitors and tracks the complex interactions among enterprise entities, providing a single holistic view of the risks those assets pose. Asset Graph provides graph visualizations of the relationships among entities and assets such as devices, users, accounts, cloud workloads, along with the rich context necessary for proper security hygiene and proactive security posture management to reduce risk in their organizations.”

Annual report 2026A · The company itself

“The Falcon platform management interface gives customers an intuitive and informative view of their complete environment, with timely alerts and detailed search capabilities. We provide real-time endpoint and cloud workload visibility to allow customers to review details and respond to threats instantly and effectively, from anywhere, and maintain an index of these events for future use.”

Annual report 2026A · The company itself

“APIs and Integrations. Our Falcon platform and architecture is built around a rich set of APIs that efficiently and effectively complement and expand a customer’s existing security infrastructure, such as security information event management, or SIEMs, intrusion prevention systems and intrusion detection systems. The platform includes streaming, query and batch APIs allowing customers and partners to integrate a variety of solutions seamlessly.”

Annual report 2026A · The company itself

“Our proactive consulting security services include technical assessment and strategic advisory services designed to help organizations understand their cyber maturity levels. These services include endpoint, identity, and cloud workload compromise assessments, cybersecurity maturity assessments, security program in-depth assessments, service organization control assessments, IT hygiene assessments, and active directory security assessments.”

Annual report 2026A · The company itself

“We also offer AI red-teaming and other AI security services to help organizations understand where these emerging models introduce cyber risk, where they can be exploited, and where to take corrective security actions.”

Annual report 2026A · The company itself

“Our platform deployment and operational services are designed to help customers maximize the value of their investment in the CrowdStrike Falcon platform and transform their Security Operations Centers. These services provide seamless deployment of Falcon modules across endpoint, cloud, identity, Next-Gen SIEM and virtually every other module ensuring rapid time-to-value and alignment to CrowdStrike’s recommended security configurations to prevent breaches.”

Annual report 2026A · The company itself

“When we started CrowdStrike, cyberattackers had an asymmetric advantage over legacy cybersecurity products that could not keep pace with rapid changes in adversary tactics, a dynamic that has intensified as adversaries increasingly leverage automation, identity abuse, and AI to operate at machine speed.”

Annual report 2026A · The company itself

“Conditions in our market are changing rapidly and significantly as a result of technological advancements, including with respect to AI. Our competitors may more successfully incorporate AI into their products, gain or leverage superior access 26 Table of Contents to certain AI technologies, and achieve higher market acceptance of their AI solutions.”

Annual report 2026A · The company itself

“The introduction of AI, and particularly generative AI, a relatively new and emerging technology in the early stages of commercial use, into new or existing products, and our operations, may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results. For example, generative AI has been known to produce false or “hallucinatory” interferences or outputs, and certain generative AI uses machine learning and predictive analytics, which may be flawed, insufficient, of poor quality, reflect unwanted forms of bias, or contain other errors or inadequacies, any of which may not be easily detectable. Our customers or others may rely on or use this flawed content to their detriment, which may expose us to brand or reputational harm, competitive harm, and/or legal liability.”

Annual report 2026A · The company itself

“•Driving AI Innovation and Security: We are a pioneer in leveraging AI to transform cybersecurity, combining AI for cybersecurity with cybersecurity for AI. The Falcon platform’s AI-native architecture uses advanced models and the power of the Security Cloud to detect and stop breaches, while innovations like Charlotte AI represent a significant advancement in agentic AI—delivering autonomous security decisions within customer-defined guardrails to triage detections, reduce noise, and accelerate response.”

Annual report 2026A · The company itself

“Research and Development Our research and development organizations are responsible for the design, architecture, operation and quality of our cloud native Falcon platform. In addition, the research and development organizations work closely with our customer success teams to promote customer satisfaction.”

Annual report 2026A · The company itself

“Our internal team of security experts, researchers, intelligence analysts, and threat hunters continuously analyzes the evolving global threat landscape to develop products that defend against today’s most sophisticated and stealthy attacks and report on emerging security issues.”

Annual report 2026A · The company itself

“If we are unable to successfully enhance our existing products and services and introduce new products and services in response to rapid technological changes and market developments as well as evolving security threats, our competitive position and prospects will be harmed. Our ability to increase revenue from existing customers and attract new customers will depend in significant part on our ability to anticipate and respond effectively to rapid technological changes and market developments as well as evolving security threats. The success of our Falcon platform depends on our ability to take such changes into account and invest effectively in our research and development organization to increase the reliability, availability and scalability of our existing solutions and introduce new solutions.”

Annual report 2026A · The company itself

“Additionally, we have entered, and intend to continue to enter, into technology alliance partnerships with third parties to support our future growth plans.”

Annual report 2026A · The company itself

“As our customers gain more experience with our solutions, the number of endpoints and events, the amount of data transferred, processed and stored by us, the number of locations where our platform and services are being accessed, have in the past, and may in the future, expand rapidly. In order to meet the performance and other requirements of our customers, we intend to continue to make significant investments to increase capacity and to develop and implement new technologies, including those involving AI, in our service and cloud infrastructure operations.”

Annual report 2026A · The company itself

“We incorporate novel uses of AI technologies, including generative AI, into our products and operations, such as our Falcon platform. AI is complex and rapidly evolving, and we face significant competition from other companies who may incorporate AI into their products more quickly or more successfully than us, as well as an evolving regulatory landscape.”

Annual report 2026A · The company itself

“Beyond delivering AI-driven protection, we also secure the AI systems organizations depend on, helping customers safeguard generative AI applications and agents, protect sensitive data, and mitigate the risks posed by AI misconfigurations and vulnerabilities. By advancing AI innovation and security, we empower organizations to stay ahead of adversaries, increase operational efficiency, and securely embrace the AI-driven future.”

Annual report 2026A · The company itself

“We believe our approach has defined a new category called the AI Security Cloud, which has the power to transform the cybersecurity industry the same way the cloud has transformed the customer relationship management, human resources, and service management industries.”

Annual report 2026A · The company itself

“Threat Graph also provides query and hunting capability over the full set of high-fidelity events collected in the graph. This correlated data, natively represented in a graph structure, enables new products and cloud modules to be created rapidly since the platform provides the visibility, collection, correlation, and actions over data as reusable building blocks. This collect-once, use repeatedly approach is the reason why we have been able to deliver new cloud modules covering IT hygiene and vulnerability management quickly and enables us to continue expanding the Falcon platform rapidly in the future.”

Annual report 2026A · The company itself

“We also offer AI red-teaming and other AI security services to help organizations understand where these emerging models introduce cyber risk, where they can be exploited, and where to take corrective security actions.”

Annual report 2026A · The company itself

“The CrowdStrike Falcon Platform: Built to Innovate and Scale Our platform approach allows us to rapidly innovate, build, and deploy highly integrated modules that address critical customer problems and access additional market opportunities. Our Falcon platform is composed of two tightly integrated proprietary technologies: our lightweight sensor and our Security Cloud.”

Annual report 2026A · The company itself

“Ongoing improvements to cloud infrastructure may be more expensive than we anticipate, and may not yield the expected savings in operating costs or the expected performance benefits. In addition, we may be required to re-invest any cost savings achieved from prior cloud infrastructure improvements in future infrastructure projects to maintain the levels of service required by our customers.”

Annual report 2026A · The company itself

“We currently host our Falcon platform and serve our customers using a mix of third-party data centers, primarily Amazon Web Services, Inc., or AWS, and our data centers, hosted in colocation facilities.”

Annual report 2026A · The company itself

“For example, because of the importance of AWS’ services to our business and AWS’ position in the cloud-based server industry, any renegotiation or renewal of our agreement with AWS may be on terms that are significantly less favorable to us than our current agreement. If our cloud-based server costs were to increase, our business, results of operations and financial condition may be adversely affected.”

Annual report 2026A · The company itself

“As our customers gain more experience with our solutions, the number of endpoints and events, the amount of data transferred, processed and stored by us, the number of locations where our platform and services are being accessed, have in the past, and may in the future, expand rapidly. In order to meet the performance and other requirements of our customers, we intend to continue to make significant investments to increase capacity and to develop and implement new technologies, including those involving AI, in our service and cloud infrastructure operations.”

Annual report 2026A · The company itself

“We built the Falcon platform entirely in and for the cloud, enabling collection and analysis of a massive, crowdsourced dataset from all of our customers to stop breaches. Our platform is designed to be redundant, resilient, and high-performing. Delivering security from the cloud enables agility, ease of use, and protection for workloads on a variety of endpoints wherever they are located.”

Annual report 2026A · The company itself

“Sales to such government entities include, but are not limited to, the following risks: •selling to governmental agencies can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that such efforts will generate a sale; •we may be required to obtain personnel security clearances and facility clearances to perform on classified contracts for government agencies, and there is no guarantee that we will be able to obtain or maintain such clearances; •government certification, software supply chain, and source code transparency requirements applicable to us or our products are constantly evolving and, in doing so, restrict our ability to sell to certain government customers until we have attained the new or revised certification or meet other applicable requirements, which we are not guaranteed to do. For example, although we are currently certified under the U.S.”

Annual report 2026A · The company itself

“We continue to invest heavily in the acquisition of customers in the U.S. federal government as well as the state, local, and higher education verticals. Our platform is authorized by several federal agencies via the Federal Risk and Authorization Management Program (“FedRAMP”).”

Annual report 2026A · The company itself

“Our future growth depends, in part, on increasing sales to government organizations. Demand from government organizations is often unpredictable, subject to budgetary uncertainty and typically involves long sales cycles.”

Annual report 2026A · The company itself

“While we initially targeted large sophisticated enterprises, we have expanded our go-to-market efforts to include customers of all sizes with a dedicated inside sales team focused on smaller organizations. We also released Falcon Complete in 2018, our turnkey solution that combines the most popular cloud modules of our Falcon platform with our remediation and response capabilities, to create a solution for customers with limited or no internal security expertise.”

Annual report 2026A · The company itself

“Bringing CrowdStrike to the Market We primarily sell the Falcon platform through our sales and partner teams that leverage our network of channel partners to maximize effectiveness and scale.”

Annual report 2026A · The company itself

“Historically, we and our channel partners have primarily sold to large organizations, but have increasingly focused on selling to small and medium-sized businesses, particularly through our trial-to-pay model.”

Annual report 2026A · The company itself

“Enterprises and governments that use legacy security products, such as signature-based or malware-based products, firewalls, intrusion prevention systems, and antivirus, for their IT security may be hesitant to purchase our Falcon platform if they believe that these products are more cost effective, provide substantially the same functionality as our Falcon platform or provide a level of IT security that is sufficient to meet their needs.”

Annual report 2026A · The company itself

“Economic weakness, customer financial difficulties, constrained spending on security and IT operations, and the impact of the July 19 Incident may result in decreased revenue, reduced sales, an increase in multi-phase subscription start dates, shorter terms for customer subscriptions, lengthened sales cycles, increased churn, lower demand for our products, and adversely affect our results of operations and financial conditions.”

Annual report 2026A · The company itself

“Our customer retention, renewals and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products and services, our customers’ ability to fully utilize their product subscriptions, our pricing, customer security and networking issues and requirements, our customers’ spending levels, decreases in the number of endpoints to which our customers deploy our solutions, mergers and acquisitions involving our customers, industry developments, competition, the impact of the July 19 Incident, including the impact of our customer commitment packages, and general economic and geopolitical conditions.”

Annual report 2026A · The company itself

“We offer our customers compelling business value that includes ease of adoption, rapid time-to-value, superior efficacy rates in detecting threats and preventing breaches, and reduced total cost of ownership by consolidating legacy, siloed, and multi-sensor security products in a single solution.”

Annual report 2026A · The company itself

“Our customer retention, renewals and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products and services, our customers’ ability to fully utilize their product subscriptions, our pricing, customer security and networking issues and requirements, our customers’ spending levels, decreases in the number of endpoints to which our customers deploy our solutions, mergers and acquisitions involving our customers, industry developments, competition, the impact of the July 19 Incident, including the impact of our customer commitment packages, and general economic and geopolitical conditions.”

Annual report 2026A · The company itself

“Conditions in our market could also change rapidly and significantly due to partnering or acquisitions by our competitors or continuing market consolidation. Some of our competitors have recently made acquisitions of businesses or have established cooperative relationships that may allow them to offer more directly competitive and comprehensive solutions than were previously offered and adapt more quickly to new technologies and customer needs.”

Annual report 2026A · The company itself

“Key elements of our growth strategy include: •Growing Our Customer Base by Replacing Legacy and Other Endpoint Security Products. Given the limitations of existing legacy and other endpoint security products, many organizations are replacing their existing legacy and other endpoint security products with our Falcon platform.”

Annual report 2026A · The company itself

“The Falcon platform’s AI-native architecture uses advanced models and the power of the Security Cloud to detect and stop breaches, while innovations like Charlotte AI represent a significant advancement in agentic AI—delivering autonomous security decisions within customer-defined guardrails to triage detections, reduce noise, and accelerate response.”

Annual report 2026A · The company itself

“Generative AI: Innovations like Charlotte AI leverage generative AI and agentic reasoning to automate time-intensive tasks, enabling security analysts to work more efficiently. Charlotte AI transforms hours of routine investigation into minutes, addressing critical skills gaps and enhancing operational efficiency.”

Annual report 2026A · The company itself

“We will continue to invest in customer acquisition programs, including our channel partnerships and new programs, like our free trial program of Falcon Go that is easily downloaded from our website, the AWS Marketplace, the Google Marketplace, and the Microsoft Marketplace.”

Annual report 2026A · The company itself

“We launched the CrowdStrike Marketplace, the first open cloud-based application PaaS for cybersecurity, which allows customers to purchase CrowdStrike products and provides an ecosystem of trusted partners and applications for our customers to choose from. We plan to continue investing in the CrowdStrike Store to empower our partners by making it easier to build applications and to enable our customers to more easily discover, try, and purchase additional cloud modules from both trusted partners and us.”

Annual report 2026A · The company itself

“Therefore, volatility or lack of performance in our stock price could affect our ability to attract and retain our key employees.”

Annual report 2026A · The company itself

“Retaining or expanding our current levels of personnel and product and service offerings may require additional funds to respond to business challenges, including the need to develop new products or services and enhancements to our Falcon platform, improve our operating infrastructure, or acquire complementary businesses and technologies. Our failure to raise additional capital or generate the significant capital necessary to expand our operations and invest in new products or services could reduce our ability to compete and could harm our business.”

Annual report 2026A · The company itself

“•Expanding Our International Footprint. We are expanding our international operations and intend to invest globally to broaden our international footprint.”

Annual report 2026A · The company itself

“We are continuing to adapt to and develop strategies to address international markets and our growth strategy includes expansion into target geographies, but there is no guarantee that such efforts will be successful. We expect that our international activities will continue to grow in the future, as we continue to pursue opportunities in international markets.”

Annual report 2026A · The company itself

“This trend accelerated significantly with the need to support an increasingly remote workforce in 2020 due to the COVID-19 pandemic and we believe this trend continues today. •A Growing Cyber Skills Gap: Trained cybersecurity professionals are in high demand, and organizations continue to face a dire shortage of talent to fill much needed cybersecurity positions.”

Annual report 2026A · The company itself

“Distributed Workforce For CrowdStrike, the ability to work remotely or in a hybrid arrangement is a deliberate strategy that we believe fuels rapid innovation and helps us attract, hire and retain the best and brightest around the world, regardless of their specific location.”

Annual report 2026A · The company itself

“Our future growth depends, in part, on increasing sales to government organizations. Demand from government organizations is often unpredictable, subject to budgetary uncertainty and typically involves long sales cycles.”

Annual report 2026A · The company itself

“We offer training and certification services to customers and partners on CrowdStrike technologies and cybersecurity topics to facilitate the adoption of CrowdStrike and to broaden and deepen their skills. CrowdStrike University is an online learning management system that organizes all CrowdStrike e-learning, instructor-led training and certification preparation courses in one place, providing a personalized learning experience for individuals who have an active training subscription. CrowdStrike currently offers proctored exam certifications through industry leading training partner Pearson Vue for our CrowdStrike Certified Falcon Administrator, Falcon Responder, Falcon Hunter, Cloud Specialist, Identity Specialist, and Next-Gen SIEM Engineer programs.”

Annual report 2026A · The company itself

“According to the CrowdStrike 2026 Global Threat Report, 82% of detections in 2025 were malware-free, reflecting a sustained shift toward hands-on-keyboard operations, abuse of legitimate tools, and credential-driven movement that are difficult to distinguish from normal use behavior.”

Annual report 2026A · The company itself

“Human Capital Resources As of January 31, 2026, we had 10,698 full-time employees.”

Annual report 2026A · The company itself

“Our ability to compete effectively depends upon numerous factors, many of which are beyond our control, including, but not limited to: •product capabilities, including performance and reliability, of our Falcon platform, including our cloud modules, services, and features compared to those of our competitors; •our ability, and the ability of our competitors, to improve existing products, services, and features, or to develop new ones to address evolving customer needs; •our ability to attract, retain, and motivate talented employees; •our ability to establish and maintain relationships with channel partners and direct customers; •the strength of our sales and marketing efforts; •the strength of our reputation and brand, including the impact to our reputation and brand as a result of the July 19 Incident; and •acquisitions or consolidation within our industry, which may result in more formidable competitors.”

Annual report 2026A · The company itself

“We rely on our key technical, sales and management personnel to grow our business, and the loss of one or more key employees could harm our business. Our future success is substantially dependent on our ability to attract, retain, and motivate the members of our management team and other key employees throughout our organization. In particular, we are highly dependent on the services of George Kurtz, our President and Chief Executive Officer, who is critical to our future vision and strategic direction.”

Annual report 2026A · The company itself

“For example, in recent years, recruiting, hiring and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of the recent cybersecurity attacks on global corporations and governments.”

Annual report 2026A · The company itself

“We depend on our direct sales force to obtain new customers and increase sales with existing customers. Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training and retaining sufficient numbers of sales personnel, particularly in international markets.”

Annual report 2026A · The company itself

“We believe that our corporate culture has been a contributor to our success, which we believe fosters innovation, teamwork, passion and focus on building and marketing our Falcon platform. As we grow, we may find it difficult to maintain our corporate culture.”

Annual report 2026A · The company itself

“There is significant competition for personnel with the skills and technical knowledge that we require across our technology, cyber, sales, professional services, and administrative support functions. Competition for these personnel is intense, especially for experienced sales professionals and for engineers experienced in designing and developing cloud applications and security software.”

Annual report 2026A · The company itself

“These include: •The Increasing Speed, Sophistication and Disruption of Cybersecurity Threats: Adversary sophistication continues to increase as militaries and intelligence services of well-funded nation-states, technically advanced criminal organizations and hackers advance their tactics. In addition, the commoditization of technologies like generative AI makes it easier for low-skilled adversaries to move faster and launch more sophisticated attacks.”

Annual report 2026A · The company itself

“Our customer retention, renewals and expansion may decline or fluctuate as a result of a number of factors, including our customers’ satisfaction with our products and services, our customers’ ability to fully utilize their product subscriptions, our pricing, customer security and networking issues and requirements, our customers’ spending levels, decreases in the number of endpoints to which our customers deploy our solutions, mergers and acquisitions involving our customers, industry developments, competition, the impact of the July 19 Incident, including the impact of our customer commitment packages, and general economic and geopolitical conditions.”

Annual report 2026A · The company itself

“In particular, because we have been involved in the identification of organized cybercriminals and nation-state actors, we have been the subject of intense efforts by sophisticated cyber adversaries who seek to compromise our systems. Such efforts may also intensify as geopolitical tensions increase.”

Annual report 2026A · The company itself

“Changing political environments in the United States and abroad may amplify the media and political scrutiny we face. Negative publicity about us, including about our management, the efficacy and reliability of our Falcon platform, our products offerings, our professional services, and the customers we work with, even if inaccurate, has in the past adversely affected, and may in the future adversely affect, our reputation and brand.”

Annual report 2026A · The company itself

“These international operations will require significant management attention and financial resources and are subject to substantial risks, including: •greater difficulty in negotiating contracts with standard terms, enforcing contracts and managing collections, and longer collection periods; 33 Table of Contents •higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations; •management communication and integration problems resulting from cultural and geographic dispersion; •risks associated with trade restrictions and foreign legal requirements, including any importation, certification, and localization of our Falcon platform that may be required in foreign countries; •greater risk of unexpected changes, or threat of changes, in regulatory practices, tariffs, and tax laws and treaties or the application thereof; •compliance with anti-bribery laws, including, without limitation, compliance with the U.S.”

Annual report 2026A · The company itself

“The technology industry has experienced widespread component shortages and delivery delays, including as a result of geopolitical tensions (including actual or threatened changes in tariffs and trade restrictions), public health crises and natural disasters. We may also experience component shortages and pricing increases from certain of our suppliers as a result of increased demand for such components.”

Annual report 2026A · The company itself

“We are subject to anti-corruption, anti-bribery and similar laws, and non-compliance with such laws can subject us to criminal penalties or significant fines and harm our business and reputation. We are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended (“FCPA”), the U.K. Bribery Act 2010 and other anti-corruption, anti-bribery, anti-money laundering and similar laws in the United States and other countries in which we conduct activities.”

Annual report 2026A · The company itself

“Legal developments in the EEA have created complexity and uncertainty regarding processing and transfers of personal data from the EEA to the United States and other so-called third countries outside the EEA, including in the context of website cookies. Similar complexities and uncertainties also apply to transfers from the U.K. to third countries.”

Annual report 2026A · The company itself

“AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity and data protection laws to AI or are considering general legal frameworks for AI. For example, in the EU, the first set of provisions under the EU’s AI Act became effective in February 2025, with additional provisions becoming effective on later dates. The AI Act establishes, among other things, a risk-based governance framework for regulating AI systems in the EU by categorizing AI systems, based on the risks associated with such AI systems’ intended purposes, as creating unacceptable or high risks, with all other AI systems being considered low risk. This regulatory framework is expected to have a material impact on the way AI is regulated in the EU and beyond.”

Annual report 2026A · The company itself

“We are expanding our international operations and intend to invest globally to broaden our international footprint. We grew our international revenue from $1,270.7 million for fiscal 2025 to $1,595.4 million for fiscal 2026, representing an increase of 26%.”

Annual report 2026A · The company itself

“Our research and development leadership team is predominantly located in the United States. We also maintain research and development centers internationally, including in Romania, Israel and India.”

Annual report 2026A · The company itself

“We derived approximately 33%, 32%, and 32% of our total revenue from our international customers for fiscal 2026, fiscal 2025, and fiscal 2024, respectively.”

Annual report 2026A · The company itself

“Consequently, we may be subject to service disruptions as well as failures to provide adequate support for reasons that are outside of our direct control. We have experienced, and expect that in the future we may experience interruptions, delays and outages in service and availability from time to time due to a variety of factors, including infrastructure changes, human or software errors, website hosting disruptions and capacity constraints.”

Annual report 2026A · The company itself

“Table of Contents The adverse effects of any service interruptions on our reputation, results of operations, and financial condition may be disproportionately heightened due to the nature of our business and the fact that our customers have a low tolerance for interruptions of any duration. Interruptions or failures in our service delivery could result in a cyberattack or other security threat to us or to one of our customers during such periods of interruption or failure.”

Annual report 2026A · The company itself

“We rely on external ecosystems, such as operating systems and platforms, to operate and make, in various layers of technology stacks, our products and services available to customers. If we are unable to adapt to product or policy changes in such ecosystems, or if we do not effectively operate with such ecosystems, demand for and availability of our products or services could decline.”

Annual report 2026A · The company itself

“•We rely on third-party data centers, such as Amazon Web Services, and our own colocation data centers to host and operate our Falcon platform, and any disruption of or interference with our use of these facilities may negatively affect our ability to maintain the performance and reliability of our Falcon platform, which could cause our business to suffer.”

Annual report 2026A · The company itself

“We currently host our Falcon platform and serve our customers using a mix of third-party data centers, primarily Amazon Web Services, Inc., or AWS, and our data centers, hosted in colocation facilities.”

Annual report 2026A · The company itself

“In addition, uncertain economic or geopolitical conditions, including in connection with changes in trade policies and tariffs, may lead to additional scrutiny of budgets by current and prospective customers, which has resulted in, for example, longer sales cycles for products and services, and may result in shifting demand for IT products and services, and slower adoption of new technologies.”

Annual report 2026A · The company itself

“These international operations will require significant management attention and financial resources and are subject to substantial risks, including: •greater difficulty in negotiating contracts with standard terms, enforcing contracts and managing collections, and longer collection periods; 33 Table of Contents •higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations; •management communication and integration problems resulting from cultural and geographic dispersion; •risks associated with trade restrictions and foreign legal requirements, including any importation, certification, and localization of our Falcon platform that may be required in foreign countries; •greater risk of unexpected changes, or threat of changes, in regulatory practices, tariffs, and tax laws and treaties or the application thereof; •compliance with anti-bribery laws, including, without limitation, compliance with the U.S.”

Annual report 2026A · The company itself

“The technology industry has experienced widespread component shortages and delivery delays, including as a result of geopolitical tensions (including actual or threatened changes in tariffs and trade restrictions), public health crises and natural disasters. We may also experience component shortages and pricing increases from certain of our suppliers as a result of increased demand for such components.”

Annual report 2026A · The company itself

“Our products, services and business activities, including our collection of information about cyber threats, are subject to various restrictions under U.S. export controls and trade and economic sanctions laws, including the U.S. Commerce Department’s Export Administration Regulations and economic and trade sanctions regulations maintained by the U.S. Treasury Department’s Office of Foreign Assets Control. The U.S. export control laws and U.S. economic sanctions laws include prohibitions on the sale or supply of certain products and services to U.S. embargoed or sanctioned countries, governments, persons and entities and also require authorization for the export of encryption items.”

Annual report 2026A · The company itself

“In addition, our tax obligations and effective tax rates could be adversely affected, among other things, by (i) changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including increases in corporate tax rates and greater taxation of international income and changes relating to income tax nexus, (ii) recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, (iii) changes in foreign currency exchange rates, or (iv) changes in the valuation of our deferred tax assets and liabilities.”

Annual report 2026A · The company itself

“In particular, the EU’s Digital Services Act and the EU’s Data Act both entered into force in 2024 and impose certain content moderation, notice and transparency obligations on digital platforms and intermediaries and certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers (as well as certain requirements concerning cross-border international transfers of non-personal data outside the EEA), respectively.”

Annual report 2026A · The company itself

“Our business is subject to regulation by various federal, state, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing data privacy and security laws and regulations, employment and labor laws, workplace safety, product safety, environmental laws, consumer protection laws, anti-bribery laws, import and export controls, federal securities laws and tax laws and regulations. In certain jurisdictions, these regulatory requirements may be more stringent than in the United States. Increased scrutiny may also lead to new laws and regulations, or new applications of existing laws and regulations, that target topics such as AI, critical infrastructure software resiliency, digital sovereignty requirements and concentration risk.”

Annual report 2026A · The company itself

“The introduction of AI, and particularly generative AI, a relatively new and emerging technology in the early stages of commercial use, into new or existing products, and our operations, may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results. For example, generative AI has been known to produce false or “hallucinatory” interferences or outputs, and certain generative AI uses machine learning and predictive analytics, which may be flawed, insufficient, of poor quality, reflect unwanted forms of bias, or contain other errors or inadequacies, any of which may not be easily detectable. Our customers or others may rely on or use this flawed content to their detriment, which may expose us to brand or reputational harm, competitive harm, and/or legal liability.”

Annual report 2026A · The company itself

“AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity and data protection laws to AI or are considering general legal frameworks for AI. For example, in the EU, the first set of provisions under the EU’s AI Act became effective in February 2025, with additional provisions becoming effective on later dates. The AI Act establishes, among other things, a risk-based governance framework for regulating AI systems in the EU by categorizing AI systems, based on the risks associated with such AI systems’ intended purposes, as creating unacceptable or high risks, with all other AI systems being considered low risk. This regulatory framework is expected to have a material impact on the way AI is regulated in the EU and beyond.”

Annual report 2026A · The company itself

“•Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense. •We face intense competition and could lose market share to our competitors, which could adversely affect our business, financial condition, and results of operations. •If our solutions fail or are perceived to fail to detect or prevent incidents or have or are perceived to have defects, errors, or vulnerabilities, our brand and reputation would be harmed, which would adversely affect our business and results of operations. •As a cybersecurity provider, we have been, and expect to continue to be, a target of cyberattacks.”

Annual report 2026A · The company itself

“If our or our service providers’ internal networks, systems, or data are or are perceived to have been compromised, our reputation may be damaged and our financial results may be negatively affected.”

Annual report 2026A · The company itself

“Because we host customer data on our cloud platform, which in some cases may contain personally-identifiable information or potentially confidential information, a security compromise, or an accidental or intentional misconfiguration or malfunction of our platform or third-party platforms, could result in personally-identifiable 27 Table of Contents information and other customer data being accessible such as to attackers or to other customers.”

Annual report 2026A · The company itself

“We are required to comply with stringent, complex and evolving laws, rules, regulations and standards in many jurisdictions, as well as contractual obligations, relating to data privacy and security. Ensuring compliance with such requirements may increase operating costs, impact our data processing practices and policies and the development of new products or services, and reduce operational efficiency, any of which could adversely affect our business and operations.”

Annual report 2026A · The company itself

“Table of Contents At the state level, we are subject to laws and regulations such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”). The CCPA broadly defines personal information and gives California residents expanded privacy rights and protections, such as affording them the right to access and request deletion of their information and to opt out of certain sharing and sales of personal information. The CCPA provides for severe civil penalties and statutory damages for violations and a private right of action for certain data breaches that result in the loss of unencrypted personal information.”

Annual report 2026A · The company itself

“Our compliance efforts are further complicated by the fact that data privacy and security laws, rules, regulations and standards around the world are rapidly evolving, may be subject to uncertain or inconsistent interpretations and enforcement, and may conflict among various jurisdictions. In many jurisdictions, enforcement actions and consequences for non-compliance with data privacy and security laws, rules, regulations, standards, certifications, contractual requirements or other obligations are rising.”

Annual report 2026A · The company itself

“•An Expanded Attack Surface Driven By Cloud, AI and Distributed Environments: Organizations everywhere are embracing digital transformation and are becoming more distributed as they adopt the cloud, increase workforce mobility, and grow their number of connected devices. They are adding more workloads to a myriad of different endpoints beyond the traditional cybersecurity perimeter, exposing an increasingly broad attack surface to adversaries.”

Annual report 2026A · The company itself

“We rely on external ecosystems, such as operating systems and platforms, to operate and make, in various layers of technology stacks, our products and services available to customers. If we are unable to adapt to product or policy changes in such ecosystems, or if we do not effectively operate with such ecosystems, demand for and availability of our products or services could decline.”

Annual report 2026A · The company itself

“This includes non-malware based attacks like social engineering that exploit user identities and credentials. These attacks are pervasive, targeting a broad range of industries including technology, transportation, healthcare, financial services, governments and political organizations, utility, retail, and public infrastructure.”

Annual report 2026A · The company itself

“These international operations will require significant management attention and financial resources and are subject to substantial risks, including: •greater difficulty in negotiating contracts with standard terms, enforcing contracts and managing collections, and longer collection periods; 33 Table of Contents •higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations; •management communication and integration problems resulting from cultural and geographic dispersion; •risks associated with trade restrictions and foreign legal requirements, including any importation, certification, and localization of our Falcon platform that may be required in foreign countries; •greater risk of unexpected changes, or threat of changes, in regulatory practices, tariffs, and tax laws and treaties or the application thereof; •compliance with anti-bribery laws, including, without limitation, compliance with the U.S.”

Annual report 2026A · The company itself

“In particular, the EU’s Digital Services Act and the EU’s Data Act both entered into force in 2024 and impose certain content moderation, notice and transparency obligations on digital platforms and intermediaries and certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers (as well as certain requirements concerning cross-border international transfers of non-personal data outside the EEA), respectively.”

Annual report 2026A · The company itself

“Our products, services and business activities, including our collection of information about cyber threats, are subject to various restrictions under U.S. export controls and trade and economic sanctions laws, including the U.S. Commerce Department’s Export Administration Regulations and economic and trade sanctions regulations maintained by the U.S. Treasury Department’s Office of Foreign Assets Control. The U.S. export control laws and U.S. economic sanctions laws include prohibitions on the sale or supply of certain products and services to U.S. embargoed or sanctioned countries, governments, persons and entities and also require authorization for the export of encryption items.”

Annual report 2026A · The company itself

“Our business is subject to regulation by various federal, state, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing data privacy and security laws and regulations, employment and labor laws, workplace safety, product safety, environmental laws, consumer protection laws, anti-bribery laws, import and export controls, federal securities laws and tax laws and regulations. In certain jurisdictions, these regulatory requirements may be more stringent than in the United States. Increased scrutiny may also lead to new laws and regulations, or new applications of existing laws and regulations, that target topics such as AI, critical infrastructure software resiliency, digital sovereignty requirements and concentration risk.”

Annual report 2026A · The company itself

“As of January 31, 2026, we had $750.0 million principal amount of indebtedness outstanding (excluding intercompany indebtedness). Our indebtedness could have important consequences, including: •limiting our ability to obtain additional financing to fund future working capital, capital expenditures, acquisitions or other general corporate requirements; •requiring a portion of our cash flows to be dedicated to debt service payments instead of other purposes, thereby reducing the amount of cash flows available for working capital, capital expenditures, acquisitions and other general corporate purposes; 49 Table of Contents •increasing our vulnerability to adverse changes in general economic, industry and competitive conditions; and •increasing our cost of borrowing.”

Annual report 2026A · The company itself

“We rely on a limited number of suppliers for certain components of the equipment we use to operate our cloud platform. Supply chain disruptions could delay our ability to expand or increase the capacity of our global data center network, replace defective equipment in our existing data centers and impact our operating costs.”

Annual report 2026A · The company itself

“Additionally, nearly all of our sales contracts are currently denominated in U.S. dollars. However, a strengthening of the U.S. dollar could increase the cost of our solutions to our international customers, which could adversely affect our business and results of operations.”

Annual report 2026A · The company itself

“•The Need to Reduce Complexity and Simplify Security Operations: Organizations are increasingly looking to reduce the complexity of their security and IT stack. Modern security requires fewer point products, fewer agents and technologies that consume fewer resources. Increasingly, organizations are looking to standardize on trusted platforms that deliver an immediate return on investment and lower total cost of ownership.”

Annual report 2026A · The company itself

“Economic weakness, customer financial difficulties, constrained spending on security and IT operations, and the impact of the July 19 Incident may result in decreased revenue, reduced sales, an increase in multi-phase subscription start dates, shorter terms for customer subscriptions, lengthened sales cycles, increased churn, lower demand for our products, and adversely affect our results of operations and financial conditions.”

Annual report 2026A · The company itself

“In addition, uncertain economic or geopolitical conditions, including in connection with changes in trade policies and tariffs, may lead to additional scrutiny of budgets by current and prospective customers, which has resulted in, for example, longer sales cycles for products and services, and may result in shifting demand for IT products and services, and slower adoption of new technologies.”

Annual report 2026A · The company itself

“We provide financing arrangements for certain of our customers and end-users to purchase our products and services. Such financing activities expose us to the credit risks of our customers and end-users and these risks may be more pronounced if our customers and end-users are negatively impacted by a global economic downturn or periods of economic uncertainty.”

Annual report 2026A · The company itself

“Our principal executive offices are located in Austin, Texas, and we also maintain other office locations around the world, including in California and India, that are prone to natural disasters including severe weather and seismic activity. A significant natural disaster, such as an earthquake, a fire, a flood, or significant power outage and other catastrophic events, including the occurrence of a contagious disease or illness, such as COVID-19, could have a material adverse impact on our business, results of operations, and financial condition.”

Annual report 2026A · The company itself

“In addition, an increasing portion of our operating expenses is incurred outside the United States; is denominated in foreign currencies, such as the Australian Dollar, British Pound, Canadian Dollar, Euro, Indian Rupee, and Japanese Yen; and is subject to fluctuations due to changes in foreign currency exchange rates.”

Annual report 2026A · The company itself

“We offer our Falcon Complete customers a limited warranty, subject to certain conditions. While we maintain insurance relating to our warranty, we cannot be certain that our insurance coverage will be adequate to cover such claims, that such insurance will continue to be available to us on commercially reasonable terms, or at all, or that any insurer will not deny coverage as to any claim.”

Annual report 2026A · The company itself

“In addition, independent industry or financial analysts and research firms often test our solutions and provide reviews of our Falcon platform, as well as the products of our competitors, and perception of our Falcon platform in the marketplace may be significantly influenced by these reviews. If these reviews are negative, or less positive as compared to those of our competitors’ products, our brand may be adversely affected.”

Annual report 2026A · The company itself

“This trend accelerated significantly with the need to support an increasingly remote workforce in 2020 due to the COVID-19 pandemic and we believe this trend continues today. •A Growing Cyber Skills Gap: Trained cybersecurity professionals are in high demand, and organizations continue to face a dire shortage of talent to fill much needed cybersecurity positions.”

Annual report 2026A · The company itself

“Falcon for AWS, available in the AWS Marketplace, allows customers to easily purchase and take advantage of the metered billing (pay-as-you-go) pricing option to scale their consumption as their business needs change.”

Annual report 2026A · The company itself

“In addition to AWS, we bring CrowdStrike to market through Google Marketplace, and starting fiscal year 2027, the Microsoft Marketplace.”

Annual report 2026A · The company itself

“Our research and development leadership team is predominantly located in the United States. We also maintain research and development centers internationally, including in Romania, Israel and India.”

Annual report 2026A · The company itself

“We derived approximately 33%, 32%, and 32% of our total revenue from our international customers for fiscal 2026, fiscal 2025, and fiscal 2024, respectively.”

Annual report 2026A · The company itself

“We grew our international revenue from $1,270.7 million for fiscal 2025 to $1,595.4 million for fiscal 2026, representing an increase of 26%.”

Annual report 2026A · The company itself

“We derived approximately 33%, 32%, and 32% of our total revenue from our international customers for fiscal 2026, fiscal 2025, and fiscal 2024, respectively.”

Annual report 2026A · The company itself

“In addition, our tax obligations and effective tax rates could be adversely affected, among other things, by (i) changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including increases in corporate tax rates and greater taxation of international income and changes relating to income tax nexus, (ii) recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, (iii) changes in foreign currency exchange rates, or (iv) changes in the valuation of our deferred tax assets and liabilities.”

Annual report 2026A · The company itself