CRWD

MKT CAP $245.1BP/E 1087.9DIV YIELD —FCF YIELD 0.66%REV TTM —NET INCOME $58.5MNET CASH $4.3B52W 87.56 – 278.86NEXT EARNINGS Dec 1SEC XBRL · TTM TO Invalid Date

How CRWD rewrote its risk factors

10-K ITEM 1A · FY2025 → FY2026

Text kept

79%

of sentences unchanged

Added

new sentences

Dropped

sentences removed

Length

+322

words, now 27,029

New in FY2026

We have incurred, and expect to continue to incur, significant costs and expenses related to the incident.
As a result of the July 19 Incident, certain of our existing or prospective customers have deferred or decided against purchases of our products and services and terminated or chosen not to renew their contracts with us, and others may take similar actions in the future.
Certain of our competitors have aggressively approached our current and prospective customers and partners to attempt to capitalize on the July 19 Incident, and may continue to do so.
Additional negative media coverage and publicity, whether directly or indirectly related to the July 19 Incident, may harm our reputation and brand further, exacerbating the effects discussed herein.
We experienced net losses of $162.5 million and $15.2 million for fiscal 2026 and 2025, respectively, and net income of $72.2 million for fiscal 2024 .
As of January 31, 2026, we had an accumulated deficit of $1.3 billion.
For example, any deterioration in general economic conditions, including as a result of the geopolitical environment or changes and uncertainty regarding trade policies or tariffs, the outbreak of diseases or other public health crises, volatility in the banking and financial services sector, or inflation (as well as government policies such as raising interest rates in response to inflation), have in the past and may in the future cause our current and prospective customers to delay or cut their overall security and IT operations spending, and such delays or cuts may fall disproportionately on cloud-based security solutions like ours.
Any such impacts on customer renewals may result from a variety of different factors, including customers electing to renew with shorter subscription periods, fewer cloud modules, fewer endpoints or smaller contract values.
In addition, uncertain economic or geopolitical conditions, including in connection with changes in trade policies and tariffs, may lead to additional scrutiny of budgets by current and prospective customers, which has resulted in, for example, longer sales cycles for products and services, and may result in shifting demand for IT products and services, and slower adoption of new technologies.
We have also experienced, and may continue to experience, longer sales cycles in connection with the July 19 Incident.
Conditions in our market are changing rapidly and significantly as a result of technological advancements, including with respect to AI.
In addition, the Strategic Plan (as defined in the notes to our consolidated financial statements) could negatively affect our ability to recruit and retain skilled personnel .
Our results of operations have varied significantly from period to period, and we expect that our results of operations will continue to vary as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including: • our ability to attract new and retain existing customers; • the budgeting cycles, seasonal buying patterns, and purchasing practices of customers; • economic difficulties confronting our customers, which may impact the number of modules or endpoint deployments they are willing or able to purchase; • insolvency or credit difficulties confronting our customers, affecting their ability to purchase or pay for our solutions, including in connection with our customer and end-user financing arrangements; • the timing and length of our sales cycles; • changes in customer or channel partner requirements or market needs; • any disruption in our relationship with channel partners; • changes in the growth rate of the cloud-based SaaS-delivered endpoint security solutions market; • the timing and success of new product and service introductions by us or our competitors or any other competitive developments, including consolidation among our customers or competitors; • decisions by organizations to purchase security solutions from larger, more established security vendors or from their primary IT equipment vendors; • changes in our pricing policies or those of our competitors; • the level of awareness of cybersecurity threats, particularly advanced cyberattacks, and the market adoption of our Falcon platform; • significant security breaches of, technical difficulties with or interruptions to, the use of our Falcon platform; • the impact to our business from the July 19 Incident; • negative media coverage or publicity; • our ability to successfully expand our business domestically and internationally; • the amount and timing of operating costs (including new hires), tightening of labor markets and capital expenditures related to the expansion of our business; • extraordinary expenses such as litigation, regulatory or other dispute-related settlement payments or outcomes; • increases or decreases in our expenses caused by fluctuations in foreign currency exchange rates; • future accounting pronouncements or changes in our accounting policies or practices; • developments relating to our valuation allowances for our deferred tax assets; • deteriorating or volatile conditions in the global economy and financial markets, including as a result of weak or negative gross domestic product growth, uncertainty or disruptions in the capital and credit markets, changing interest rates, inflation, tariffs and trade restrictions, bank failures or adverse conditions impacting financial institutions, and supply-chain disruptions; and • political events, geopolitical unrest or tension, acts of war and terrorism.
We derived approximately 33%, 32%, and 32% of our total revenue from our international customers for fiscal 2026, fiscal 2025, and fiscal 2024, respectively.
These international operations will require significant management attention and financial resources and are subject to substantial risks, including: • greater difficulty in negotiating contracts with standard terms, enforcing contracts and managing collections, and longer collection periods; • higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations; • management communication and integration problems resulting from cultural and geographic dispersion; • risks associated with trade restrictions and foreign legal requirements, including any importation, certification, and localization of our Falcon platform that may be required in foreign countries; • greater risk of unexpected changes, or threat of changes, in regulatory practices, tariffs, and tax laws and treaties or the application thereof; • compliance with anti-bribery laws, including, without limitation, compliance with the U.S.
Bribery Act 2010, or Bribery Act, violations of which could lead to significant fines, penalties, and collateral consequences for our company; • heightened risk of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements; • the uncertainty of protection for intellectual property rights in some countries; • general economic and political conditions in these foreign markets; • foreign exchange controls or tax regulations that might prevent us from repatriating cash earned outside the United States; • political and economic instability in some countries; • double taxation of our international earnings and potentially adverse tax consequences due to changes in the tax laws of the United States or the foreign jurisdictions in which we operate; • unexpected costs for the localization of our services, including translation into foreign languages and adaptation for local practices and regulatory requirements (including, but not limited to data localization requirements, digital sovereignty requirements and other restrictions, such as those emerging in the EU); • requirements to comply with foreign privacy, data protection, and information security laws and regulations and the risks and costs of noncompliance; • greater difficulty in identifying, attracting and retaining local qualified personnel, and the costs and expenses associated with such activities; • greater difficulty identifying qualified channel partners and maintaining successful relationships with such partners; • differing employment practices and labor relations issues; and • difficulties in managing and staffing international offices and increased travel, infrastructure, and legal compliance costs associated with multiple international locations.
Sales to such government entities include, but are not limited to, the following risks: • selling to governmental agencies can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that such efforts will generate a sale; • we may be required to obtain personnel security clearances and facility clearances to perform on classified contracts for government agencies, and there is no guarantee that we will be able to obtain or maintain such clearances; • government certification, software supply chain, and source code transparency requirements applicable to us or our products are constantly evolving and, in doing so, restrict our ability to sell to certain government customers until we have attained the new or revised certification or meet other applicable requirements, which we are not guaranteed to do.
In order to meet the performance and other requirements of our customers, we intend to continue to make significant investments to increase capacity and to develop and implement new technologies, including those involving AI, in our service and cloud infrastructure operations.
We rely on external ecosystems, such as operating systems and platforms, to operate and make, in various layers of technology stacks, our products and services available to customers.
We expect that the combination of our existing cash and cash equivalents and cash flows from operations will be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 12 months.
Such risks may become more pronounced as we continue to scale our business.
The technology industry has experienced widespread component shortages and delivery delays, including as a result of geopolitical tensions (including actual or threatened changes in tariffs and trade restrictions), public health crises and natural disasters.
We may also experience component shortages and pricing increases from certain of our suppliers as a result of increased demand for such components.
The United States Congress also has considered, and in the future will likely consider, proposals from time to time for comprehensive federal data privacy and security legislation, to which we may become subject if passed.
GDPR remain substantially similar for the time being, the U.K. government has adopted reforms to its data protection legal framework in its Data Use and Access Act 2025, which became law on June 19, 2025 (phasing in between June 2025 and June 2026) and will introduce significant changes from the GDPR.
This may lead to additional compliance costs and could increase overall risk exposure as businesses may no longer be able to take a unified approach across the European Economic Area (“EEA”) and the U.K., and such businesses may need to amend their processes and procedures to align with the new framework.
Implementing mechanisms to endeavor to ensure compliance with the GDPR and the U.K.
GDPR may be onerous and expose businesses to divergent parallel regimes that may be subject to potentially different interpretations and enforcement actions for certain violations and related uncertainty.
Legal developments in the EEA have created complexity and uncertainty regarding processing and transfers of personal data from the EEA to the United States and other so-called third countries outside the EEA, including in the context of website cookies.
Moreover, although the U.K. currently has an adequacy decision from the European Commission, such that SCCs are not required for the transfer of personal data from the EEA to the U.K., that decision will sunset in December 2031 unless extended or renewed and it may be revoked in the future by the European Commission if the U.K. data protection regime is reformed in ways that deviate substantially from the GDPR.
The EU has also enacted legislation that would regulate non-personal data and establish new cybersecurity standards, and other countries, including the U.K., may similarly do so in the future.
In particular, the EU’s Digital Services Act and the EU’s Data Act both entered into force in 2024 and impose certain content moderation, notice and transparency obligations on digital platforms and intermediaries and certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers (as well as certain requirements concerning cross-border international transfers of non-personal data outside the EEA), respectively.
Additionally, the EU’s Network and Information Security Directive II, adopted in 2023, regulates resilience and incident response capabilities of entities operating in a number of sectors, including the digital infrastructure sector and provides for EU member states to have issued implementing legislation by October 2024.
Further, the EU’s Digital Operational Resiliency Act became effective in January 2025 and imposes certain requirements on entities in the financial sector and their third-party cloud service providers related to managing and mitigating information and communication technology risk.
If we are unable to transfer data, including personal data, between and among countries and regions in which we operate, or are otherwise required to modify our practices, including our data privacy and security controls and procedures, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.
Increased scrutiny may also lead to new laws and regulations, or new applications of existing laws and regulations, that target topics such as AI, critical infrastructure software resiliency, digital sovereignty requirements and concentration risk.
Our efforts to comply with applicable laws and regulations may increase operating costs, which could adversely affect our business and operations.
For example, generative AI has been known to produce false or “hallucinatory” interferences or outputs, and certain generative AI uses machine learning and predictive analytics, which may be flawed, insufficient, of poor quality, reflect unwanted forms of bias, or contain other errors or inadequacies, any of which may not be easily detectable.
Further, the use of AI presents emerging ethical, social, legal and other issues, and if we enable or offer solutions that draw scrutiny or controversy due to perceived or actual risks or impacts on customers or on society as a whole, we may experience brand or reputational harm, competitive harm, delays in customer purchasing decisions and/or legal liability.
Our continued incorporation of AI, including generative AI, into our products and operations requires us to expend significant resources.

and 46 more.

Gone since FY2025

We have incurred, and expect to continue to incur, significant costs and expenses related to the incident, including in connection with remediation efforts, customer and partner relations, measures taken to address the damage to our reputation, and other measures taken in response to the incident.
Our management and other personnel have devoted, and may continue to devote, significant time and resources to address the impacts of the July 19 Incident.
We also have hired, and in the future may hire, additional personnel to assist with our ongoing efforts.
Any real or perceived failure, by us or the third-party service providers we engage, to remediate and respond to the July 19 Incident could adversely impact our business.
As a result of the incident, certain of our existing or prospective customers have elected to, and may in the future elect to, defer purchasing decisions relating to our products and services or not purchase our products and services at all.
Customers have also decided, and may in the future decide, to terminate or not renew their agreements with us.
Certain of our competitors have aggressively approached our current and prospective customers and partners to attempt to capitalize on the incident, and may continue to do so.
If we are unable to regain the trust of our current and prospective customers and partners, or if negative media coverage and publicity continues, our reputation and brand may suffer further, exacerbating the effects discussed herein.
For example, our headcount grew from 7,273 employees as of January 31, 2023, to 10,118 employees as of January 31, 2025.
We experienced net losses of $19.3 million and $183.2 million for fiscal 2025 and 2023, respectively, and net income of $89.3 million for fiscal 2024.
As of January 31, 2025, we had an accumulated deficit of $1.1 billion.
We cannot assure you that these investments will result in substantial increases in our total revenue or improvements in our results of operations.
For example, any deterioration in general economic conditions, including as a result of the geopolitical environment, the outbreak of diseases or other public health crises, volatility in the banking and financial services sector, or inflation (as well as government policies such as raising interest rates in response to inflation), have in the past and may in the future cause our current and prospective customers to delay or cut their overall security and IT operations spending, and such delays or cuts may fall disproportionately on cloud-based security solutions like ours.
Any such impacts on customer renewals may be associated with a variety of different factors, including customers electing to renew with shorter subscription periods, fewer cloud modules, fewer endpoints or smaller contract values.
In addition, uncertain economic conditions may lead to additional scrutiny of budgets by current and prospective customers, which has resulted in, for example, longer sales cycles for products and services, and may result in shifting demand for IT products and services, and slower adoption of new technologies.
We have also experienced, and expect to continue to experience, longer sales cycles in connection with the July 19 Incident.
Conditions in our market could change rapidly and significantly as a result of technological advancements, including with respect to AI.
Our results of operations have varied significantly from period to period, and we expect that our results of operations will continue to vary as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including: • our ability to attract new and retain existing customers; • the budgeting cycles, seasonal buying patterns, and purchasing practices of customers; • economic difficulties confronting our customers, which may impact the number of modules or endpoint deployments they are willing or able to purchase; • insolvency or credit difficulties confronting our customers, affecting their ability to purchase or pay for our solutions, including in connection with our customer and end-user financing arrangements; • the timing and length of our sales cycles; • changes in customer or channel partner requirements or market needs; • any disruption in our relationship with channel partners; • changes in the growth rate of the cloud-based SaaS-delivered endpoint security solutions market; • the timing and success of new product and service introductions by us or our competitors or any other competitive developments, including consolidation among our customers or competitors; • decisions by organizations to purchase security solutions from larger, more established security vendors or from their primary IT equipment vendors; • changes in our pricing policies or those of our competitors; • the level of awareness of cybersecurity threats, particularly advanced cyberattacks, and the market adoption of our Falcon platform; • significant security breaches of, technical difficulties with or interruptions to, the use of our Falcon platform; • the impact to our business from the July 19 Incident; • negative media coverage or publicity; • our ability to successfully expand our business domestically and internationally; • the amount and timing of operating costs (including new hires), tightening of labor markets and capital expenditures related to the expansion of our business; • extraordinary expenses such as litigation, regulatory or other dispute-related settlement payments or outcomes; • increases or decreases in our expenses caused by fluctuations in foreign currency exchange rates; • future accounting pronouncements or changes in our accounting policies or practices; • developments relating to our valuation allowances for our deferred tax assets; • deteriorating or volatile conditions in the global economy and financial markets, including as a result of weak or negative gross domestic product growth, uncertainty or disruptions in the capital and credit markets, changing interest rates, inflation, bank failures or adverse conditions impacting financial institutions, and supply-chain disruptions; and • political events, geopolitical unrest or tension, acts of war and terrorism.
We derived approximately 32%, 32%, and 30% of our total revenue from our international customers for fiscal 2025, fiscal 2024, and fiscal 2023, respectively.
These international operations will require significant management attention and financial resources and are subject to substantial risks, including: • greater difficulty in negotiating contracts with standard terms, enforcing contracts and managing collections, and longer collection periods; • higher costs of doing business internationally, including costs incurred in establishing and maintaining office space and equipment for our international operations; • management communication and integration problems resulting from cultural and geographic dispersion; • risks associated with trade restrictions and foreign legal requirements, including any importation, certification, and localization of our Falcon platform that may be required in foreign countries; • greater risk of unexpected changes in regulatory practices, tariffs, and tax laws and treaties; • compliance with anti-bribery laws, including, without limitation, compliance with the U.S.
Bribery Act 2010, or Bribery Act, violations of which could lead to significant fines, penalties, and collateral consequences for our company; • heightened risk of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements; • the uncertainty of protection for intellectual property rights in some countries; • general economic and political conditions in these foreign markets; • foreign exchange controls or tax regulations that might prevent us from repatriating cash earned outside the United States; • political and economic instability in some countries; • double taxation of our international earnings and potentially adverse tax consequences due to changes in the tax laws of the United States or the foreign jurisdictions in which we operate; • unexpected costs for the localization of our services, including translation into foreign languages and adaptation for local practices and regulatory requirements (including, but not limited to data localization requirements); • requirements to comply with foreign privacy, data protection, and information security laws and regulations and the risks and costs of noncompliance; • greater difficulty in identifying, attracting and retaining local qualified personnel, and the costs and expenses associated with such activities; • greater difficulty identifying qualified channel partners and maintaining successful relationships with such partners; • differing employment practices and labor relations issues; and • difficulties in managing and staffing international offices and increased travel, infrastructure, and legal compliance costs associated with multiple international locations.
Sales to such government entities include, but are not limited to, the following risks: • selling to governmental agencies can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that such efforts will generate a sale; • we may be required to obtain personnel security clearances and facility clearances to perform on classified contracts for government agencies, and there is no guarantee that we will be able to obtain or maintain such clearances; • government certification, software supply chain, or source code transparency requirements applicable to us or our products are constantly evolving and, in doing so, restrict our ability to sell to certain government customers until we have attained the new or revised certification or meet other applicable requirements, which we are not guaranteed to do.
In order to meet the performance and other requirements of our customers, we intend to continue to make significant investments to increase capacity and to develop and implement new technologies in our service and cloud infrastructure operations.
We rely on external ecosystems, such as operating systems, to operate and make our products and services available to customers.
We expect that the combination of our existing cash and cash equivalents, cash flows from operations, and our revolving facility will be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 12 months.
The technology industry has experienced widespread component shortages and delivery delays, including as a result of geopolitical tensions, public health crises and natural disasters.
The United States Congress also has considered, is currently considering, and may in the future consider, various proposals for comprehensive federal data privacy and security legislation, to which we may become subject if passed.
GDPR remain substantially similar for the time being, the U.K. government has announced plans and introduced legislative proposals to chart its own path on data protection and reform its relevant laws, including in ways that may differ from the GDPR.
While these developments increase uncertainty with regard to data protection regulation in the U.K., even in their current, substantially similar form, the GDPR and U.K.
GDPR can expose businesses to divergent parallel regimes that may be subject to potentially different interpretations and enforcement actions for certain violations and related uncertainty.
Legal developments in the European Economic Area (“EEA”) have created complexity and uncertainty regarding processing and transfers of personal data from the EEA to the United States and other so-called third countries outside the EEA, including in the context of website cookies.
Moreover, although the U.K. currently has an adequacy decision from the European Commission, such that SCCs are not required for the transfer of personal data from the EEA to the U.K., that decision will sunset in June 2025 unless extended and it may be revoked in the future by the European Commission if the U.K. data protection regime is reformed in ways that deviate substantially from the GDPR.
The EU has also proposed legislation that would regulate non-personal data and establish new cybersecurity standards, and other countries, including the U.K., may similarly do so in the future.
If we are otherwise unable to transfer data, including personal data, between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.
Increased scrutiny may also lead to new laws and regulations, or new applications of existing laws and regulations, that target topics such as AI, critical infrastructure software resiliency and concentration risk.
For example, generative AI has been known to produce a false or “hallucinatory” interferences or output, and certain generative AI uses machine learning and predictive analytics, which may be flawed, insufficient, of poor quality, reflect unwanted forms of bias, or contain other errors or inadequacies, any of which may not be easily detectable.
Further, the use of AI presents emerging ethical and social issues, and if we enable or offer solutions that draw scrutiny or controversy due to their perceived or actual impact on customers or on society as a whole, we may experience brand or reputational harm, competitive harm, and/or legal liability.
For example, in Europe, the EU’s AI Act was published in the Official Journal of the EU on July 12, 2024 and entered into force on August 1, 2024.
Kurtz; • effects of public health crises, pandemics and epidemics; • the emergence of new or different information relating to the impact of the July 19 Incident; • general economic conditions and slow or negative growth of our markets; and • other events or factors, including those resulting from war, incidents of terrorism or responses to these events.
As of February 28, 2025, we had 247,873,415 shares of common stock outstanding.

and 44 more.

Sentence-level comparison of Item 1A in the two most recent 10-Ks (FY2025 ↗, FY2026 ↗). A reworded sentence counts as one dropped and one added, so heavy edits read as low “kept”. Headings and page furniture are stripped; nothing is summarised by a model.

Watch CRWD. Know when insiders buy.

One email the day a filing lands. Free.