CrowdStrike

CrowdStrike Holdings, Inc.
Type	Public
Traded as	Nasdaq: CRWD
Industry	Cybersecurity
Founded	2011
Founder	George Kurtz, Dmitri Alperovitch, Gregg Marston
Headquarters	Austin, Texas, United States
Area served	Worldwide
Key people	George Kurtz (co-founder and CEO)
Products	Falcon platform, Falcon Identity Threat Protection, Charlotte AI
Services	Endpoint detection and response, threat intelligence, incident response, managed hunting
Revenue	US$3.06 billion (2024)
Website	crowdstrike.com

CrowdStrike Holdings, Inc. is an American cybersecurity technology company based in Austin, Texas. It provides endpoint security, threat intelligence and cyberattack response services. It was co-founded in 2011 by George Kurtz, Dmitri Alperovitch and Gregg Marston, went public on the Nasdaq in 2019 and joined the S&P 500 in 2024.

CrowdStrike has investigated many prominent cyberattacks and has frequently attributed them to state-sponsored actors. On 19 July 2024 it issued a faulty update to its security software that caused global computer outages disrupting air travel, banking, broadcasting and other services, with particularly severe effects at Delta Air Lines. The company apologised publicly and announced changes intended to prevent a recurrence, and it and Delta subsequently sued one another over the episode.

History

Founding and early investigations

CrowdStrike was founded in 2011 by George Kurtz as chief executive, Dmitri Alperovitch as chief technology officer and Gregg Marston as chief financial officer. Kurtz had previously been chief technology officer of McAfee, and the company's founding premise was that the antivirus model of matching files against signatures had failed, since attackers could alter a file trivially, and that defence should instead observe behaviour on the endpoint and correlate it centrally.

In 2012 it hired Shawn Henry, a former senior FBI official, to lead CrowdStrike Services, offering security and incident response. Its first product, CrowdStrike Falcon, launched in June 2013 as a cloud-delivered agent rather than software installed and updated locally.

The company established its reputation through attribution. In May 2014 its reporting assisted the United States Department of Justice in charging five Chinese military hackers with economic espionage against American corporations, the first such indictment of uniformed foreign personnel. It also exposed Energetic Bear, a group connected to Russia's Federal Security Service conducting operations against energy sector targets worldwide.

Following the 2014 attack on Sony Pictures, CrowdStrike identified evidence suggesting North Korean involvement and analysed the methods used. It also helped identify members of Putter Panda, a Chinese state group also known as PLA Unit 61486.

In May 2015 it disclosed VENOM, a serious flaw in the QEMU virtualisation software that could allow an attacker to escape a virtual machine and reach data belonging to others on the same host. In October 2015 it reported Chinese intrusions against technology and pharmaceutical companies around the time Barack Obama and Xi Jinping publicly agreed not to conduct economic espionage against each other, which would have breached that understanding.

Growth and flotation

Google invested in the Series C round in July 2015. By 2017 the company was valued above one billion dollars with estimated annual revenue of 100 million dollars, and by June 2018 above three billion dollars, with investors including Telstra, March Capital Partners, Rackspace, Accel Partners and Warburg Pincus. It listed on the Nasdaq in June 2019.

It launched Falcon Identity Threat Protection in 2020, converting it to a managed service in 2022 and adding cloud-based threat hunting the same year. It moved its headquarters from Sunnyvale, California to Austin in December 2021.

CrowdStream, developed with Cribl, followed in 2023, and Charlotte AI, a generative artificial intelligence security analyst, launched in May 2023 to automate triage and response. Falcon Foundry, a no-code application development platform, launched in September 2023, and CrowdStrike Financial Services, offering payment and financing arrangements for the Falcon platform, in September 2024. The company joined the S&P 500 in June 2024. Revenue reached 3.06 billion dollars in 2024, a 36 per cent increase.

Acquisitions

CrowdStrike has grown partly by acquisition: Payload Security, in automated malware analysis, in November 2017; Preempt Security, in zero trust and conditional access, for 96 million dollars in September 2020; the Danish log management platform Humio for 400 million dollars in February 2021; SecureCircle in November 2021; the attack surface management vendor Reposify in October 2022; the Israeli startup Bionic.ai in September 2023; the Israeli cloud security companies Flow Security for 200 million dollars and Adaptive Shield for 300 million dollars in November 2024; the Spanish telemetry pipeline company Onum in August 2025; and, in January 2026, the identity security firm SGNL for 750 million dollars and the browser runtime security company Seraphic Security for 420 million dollars.

The 2024 outage

On 19 July 2024 CrowdStrike released a content configuration update for its Falcon sensor on Windows. A defect in the update caused an out-of-bounds memory read in a kernel-mode driver, producing an immediate system crash. Because the driver loaded at boot, affected machines entered a loop of crashing and restarting and could not be repaired remotely; each required manual intervention, in many cases including the entry of a disk encryption recovery key.

Approximately 8.5 million Windows devices were affected. The consequences were extensive and immediate: airlines grounded flights, hospitals cancelled procedures, broadcasters went off air, banks and payment systems failed, and emergency call handling was disrupted in several jurisdictions. It is generally regarded as the largest information technology outage in history, and it arose not from an attack but from a routine update by a security vendor.

The incident illustrated a structural risk the industry had not adequately confronted. Security software requires privileged access to the operating system in order to work, and it must update frequently to counter new threats, so it combines maximum privilege with maximum change velocity. A defect in such software is therefore capable of doing what an attacker would struggle to achieve.

CrowdStrike published a root cause analysis identifying inadequate validation of the content update and testing that did not exercise the failing condition, and committed to staged deployment, customer control over update timing and improved testing. Microsoft subsequently began work to reduce the need for security vendors to run in kernel mode at all.

Delta Air Lines, which cancelled thousands of flights over several days and estimated its losses at around 500 million dollars, sued CrowdStrike, alleging gross negligence. CrowdStrike counterclaimed, arguing that its contractual liability was limited, that Delta had declined offered assistance and that Delta's own outdated crew scheduling systems had turned a difficult day into a week-long failure while other affected airlines recovered within a day. The litigation continued into 2025.

The share price fell sharply and the company offered customer credits, but its revenue and retention recovered more quickly than many expected, which has itself been cited as evidence of how difficult it is for large organisations to replace an embedded security platform.

Controversies

Attribution of the Democratic National Committee breach

CrowdStrike was retained by the Democratic National Committee in 2016 after the discovery of an intrusion, and attributed it to two Russian state groups it designated Cozy Bear and Fancy Bear. The conclusion was subsequently supported by the United States intelligence community, by the Mueller investigation and by indictments of named officers of Russian military intelligence.

The engagement nonetheless became politically contested, principally because the FBI did not take possession of the DNC servers and relied on forensic images supplied through CrowdStrike, an arrangement critics characterised as inadequate and which the FBI defended as standard practice that provided the necessary evidence.

The Ukraine artillery report

In December 2016 CrowdStrike published research asserting that Fancy Bear had compromised an Android application used by Ukrainian artillery units, contributing to heavy losses of D-30 howitzers. The estimate of losses drew on figures from the International Institute for Strategic Studies, which said its data had been misinterpreted, and Ukrainian authorities disputed the claim. CrowdStrike revised and partly retracted the report.

The episode is cited by critics as evidence of overreach in public attribution, and by defenders as an ordinary correction. Its wider significance is that it fed into the political contestation of the DNC attribution.

Conspiracy theories

CrowdStrike became the subject of a conspiracy theory alleging that a DNC server had been hidden in Ukraine and that the company was Ukrainian-owned, neither of which is true; it is an American company whose co-founder Alperovitch was born in Russia and raised in the United States.

President Donald Trump raised the theory in his July 2019 telephone call with President Volodymyr Zelenskyy, asking him to look into CrowdStrike and a server. The call became central to the first impeachment proceedings, and administration officials including the former homeland security adviser Tom Bossert publicly described the theory as debunked.

Kernel access and systemic concentration

Beyond the 2024 outage, security researchers and regulators have questioned the concentration of endpoint security among a small number of vendors whose software runs with kernel privileges on a large share of the world's business computers. The European Commission's competition arrangements with Microsoft, requiring it to give third-party security vendors the same low-level access as its own products, have been cited both as a cause of the risk and as a necessary protection against Microsoft favouring its own offering.

Attribution and commercial incentive

The practice of naming state actors, which CrowdStrike pioneered commercially with its animal-themed designations for national groupings, has been criticised on the basis that threat intelligence vendors have a commercial interest in dramatic attribution and operate without the disclosure obligations of governments. CrowdStrike's position is that its findings have repeatedly been corroborated by subsequent indictments and government assessments.

References

External links

Official website