CRWD · 10-K filed 5 Mar 2026 · year to 31 Jan 2026

CrowdStrike Holdings

31 named things its latest annual report says its results depend on, each in the company's own words. 20 of them are also named by other companies we've read.

Read the filing on SEC.gov ↗

Customers

U.S. state governments

earns from · 25 of the 50 U.S. states

Further evidence of our progress into these critical markets is demonstrated by virtue of the fact that 25 of the 50 U.S. states have standardized on CrowdStrike’s platform at the enterprise level.Business (Item 1)

U.S. federal government

earns fromnamed as a risk

Our future growth depends, in part, on increasing sales to government organizations.Risk factors (Item 1A)

Also named by ACN, ADSK, AKAM, AMRC, APG, CACI, CBRE, CI and 25 more

U.S. Department of Defense

earns from

Additionally, Department of Defense organizations can rely upon CrowdStrike’s Impact Level 5 provisional authorization to satisfy their cloud-based security requirements.Business (Item 1)

Also named by ACN, ALSN, AVAV, CLS, FLR, HEI, JCI, LMT and 12 more

Cybersecurity and Infrastructure Security Agency (CISA)

earns from

As a result, the Cybersecurity and Infrastructure Security Agency has leveraged a significant investment in our platform to support modernization efforts within the Federal Civilian Executive Branch.Business (Item 1)

Suppliers

Amazon Web Services (AWS)

depends onnamed as a risk

We currently host our Falcon platform and serve our customers using a mix of third-party data centers, primarily Amazon Web Services, Inc., or AWS, and our data centers, hosted in colocation facilities.Risk factors (Item 1A)

Also named by AAON, ABNB, ADSK, AIOT, BLK, CARR, CG, COF and 56 more

Data center equipment component suppliers

depends onnamed as a risk

We rely on a limited number of suppliers for several components of the equipment we use to operate our cloud platform and provide services to our customers.Risk factors (Item 1A)

Partners and platforms

Channel partners

earns fromnamed as a risk

The vast majority of sales of our Falcon platform flow through our channel partners, and we expect this to continue for the foreseeable future.Risk factors (Item 1A)

Also named by DELL, GTLB, KEYS, OKTA, P, QLYS, TEAM, VRNS

AWS Marketplace

earns from

Falcon for AWS, available in the AWS Marketplace, allows customers to easily purchase and take advantage of the metered billing (pay-as-you-go) pricing option to scale their consumption as their business needs change.Business (Item 1)

Also named by CDW

Google Marketplace

earns from

In addition to AWS, we bring CrowdStrike to market through Google Marketplace, and starting fiscal year 2027, the Microsoft Marketplace.Business (Item 1)

Pearson Vue

depends on

CrowdStrike currently offers proctored exam certifications through industry leading training partner Pearson Vue for our CrowdStrike Certified Falcon Administrator, Falcon Responder, Falcon Hunter, Cloud Specialist, Identity Specialist, and Next-Gen SIEM Engineer programs.Business (Item 1)

Other companies

July 19 Incident (Falcon sensor Windows crash)

named as a risk

On July 19, 2024, we released a content configuration update for our Falcon sensor that resulted in system crashes for certain Windows systems (the “July 19 Incident”).Risk factors (Item 1A)

George Kurtz

depends onnamed as a risk

In particular, we are highly dependent on the services of George Kurtz, our President and Chief Executive Officer, who is critical to our future vision and strategic direction.Risk factors (Item 1A)

Places

International markets

earns from · approximately 33%, 32%, and 32% of our total revenuenamed as a risk

We derived approximately 33%, 32%, and 32% of our total revenue from our international customers for fiscal 2026, fiscal 2025, and fiscal 2024, respectively.Risk factors (Item 1A)

Also named by ABNB, ADSK, BSX, CROX, DOCU, DXCM, EFX, FICO and 18 more

Austin, Texas

operates innamed as a risk

Our principal executive offices are located in Austin, Texas, and we also maintain other office locations around the world, including in California and India, that are prone to natural disasters including severe weather and seismic activity.Risk factors (Item 1A)

Also named by MAA, NTRA

Romania, Israel and India R&D centers

operates in

We also maintain research and development centers internationally, including in Romania, Israel and India.Business (Item 1)

United States and Europe data centers

operates in

We have data center co-location facilities throughout the United States and in Europe, and we also utilize third-party data centers located in the United States and Europe.Business (Item 1)

Commodities and inputs

British Pound

exposed to its price · approximately $138.8 millionnamed as a risk

A portion of our operating expenses are incurred outside the United States, denominated in foreign currencies, and subject to fluctuations due to changes in foreign currency exchange rates, particularly changes in the British Pound, Australian Dollar, and Euro.Market risk (Item 7A)

Also named by ABBV, ADBE, AJG, AME, AMP, APA, BF/B, BRO and 39 more

Regulators

Federal Trade Commission (FTC)

subject tonamed as a risk

For example, at the federal level, we are subject to, among other laws and regulations, the rules and regulations promulgated under the authority of the Federal Trade Commission (which has the authority to regulate and enforce against unfair or deceptive acts or practices in or affecting commerce, including acts and practices with respect to data privacy and security), as well as the Electronic Communication Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act, and the Gramm Leach Bliley Act.Risk factors (Item 1A)

Also named by AMZN, AN, AVGO, BJ, CART, CELH, CHD, CHE and 56 more

Laws and programs

EU General Data Protection Regulation (GDPR)

subject to · fines of up to EUR 20 million (or GBP 17.5 million under the U.K. GDPR) or four percent (4%) of annual global revenuenamed as a risk

For example, we are required to comply with the European Union (“EU”) General Data Protection Regulation (“GDPR”) and its equivalent in the U.K. (“U.K. GDPR”), which impose stringent obligations regarding the collection, control, use, sharing, disclosure and other processing of personal data and create mandatory breach notification requirements under certain circumstances.Risk factors (Item 1A)

Also named by ACN, ADSK, AIG, ALK, AMG, ANET, APG, AXON and 61 more

OECD Pillar Two global minimum tax

subject to · 15%named as a risk

The European Union and other countries (including those in which we operate) have enacted or committed to enact Pillar Two into their domestic laws, which may adversely impact our provision for income taxes, existing tax incentives, net income and cash flows.Risk factors (Item 1A)

Also named by ABNB, ACN, ADI, ADM, ADSK, AKAM, ALB, AMAT and 70 more

California Consumer Privacy Act (CCPA)

subject tonamed as a risk

At the state level, we are subject to laws and regulations such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”).Risk factors (Item 1A)

Also named by AAP, AIOT, AKAM, ALL, APP, AYI, BAC, BBSI and 69 more

U.S. Foreign Corrupt Practices Act (FCPA)

subject tonamed as a risk

We are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended (“FCPA”), the U.K. Bribery Act 2010 and other anti-corruption, anti-bribery, anti-money laundering and similar laws in the United States and other countries in which we conduct activities.Risk factors (Item 1A)

Also named by A, ADBE, ADP, AIR, AJG, ALB, AME, AMZN and 112 more

U.S. Export Administration Regulations

subject tonamed as a risk

Our products, services and business activities, including our collection of information about cyber threats, are subject to various restrictions under U.S. export controls and trade and economic sanctions laws, including the U.S. Commerce Department’s Export Administration Regulations and economic and trade sanctions regulations maintained by the U.S. Treasury Department’s Office of Foreign Assets Control.Risk factors (Item 1A)

Also named by ADI, ALAB, AMD, APP, ARW, AVGO, CARR, CDRE and 40 more

EU AI Act

subject tonamed as a risk

For example, in the EU, the first set of provisions under the EU’s AI Act became effective in February 2025, with additional provisions becoming effective on later dates.Risk factors (Item 1A)

Also named by ACN, ADBE, AMD, AXON, CGNX, CRM, CTSH, DOCN and 36 more

EU-U.S. Data Privacy Framework

subject tonamed as a risk

On July 10, 2023, the European Commission adopted an adequacy decision concluding that the U.S. ensures an adequate level of protection for personal data transferred from the EU to the U.S. under the recently adopted EU-U.S. Data Privacy Framework (followed on October 12, 2023 with the adoption of an adequacy decision in the U.K. for the U.K.-U.S. Data Bridge); however, such new adequacy decision has been challenged in EU courts, and is likely to face additional challenges.Risk factors (Item 1A)

Also named by ADBE, APP, CRM, DDOG, DOCN, GTLB, IDXX, INTU and 12 more

FedRAMP

subject tonamed as a risk

For example, although we are currently certified under the U.S. Federal Risk and Authorization Management Program, or FedRAMP, such certification is costly to maintain and if we lose our certification, it would restrict our ability to sell to government customers;Risk factors (Item 1A)

Also named by ADSK, DDOG, DOCU, FTNT, GTLB, MSTR, NET, OKTA and 9 more

EU Digital Operational Resilience Act (DORA)

subject tonamed as a risk

Further, the EU’s Digital Operational Resiliency Act became effective in January 2025 and imposes certain requirements on entities in the financial sector and their third-party cloud service providers related to managing and mitigating information and communication technology risk.Risk factors (Item 1A)

Also named by BKNG, BLK, CRM, DDOG, EQIX, FDS, MCO, MDB and 3 more

EU Network and Information Security Directive II (NIS2)

subject tonamed as a risk

Additionally, the EU’s Network and Information Security Directive II, adopted in 2023, regulates resilience and incident response capabilities of entities operating in a number of sectors, including the digital infrastructure sector and provides for EU member states to have issued implementing legislation by October 2024.Risk factors (Item 1A)

One Big Beautiful Bill Act (OBBBA)

subject to

On July 4, 2025, tax reform legislation included in the One Big Beautiful Bill Act (the “OBBBA”) was enacted in the United States.Risk factors (Item 1A)

Also named by AA, ABR, ADI, ADM, ALB, AMAT, AMGN, AMKR and 121 more

DHS Continuous Diagnostics and Mitigation Program

earns from

We have also successfully been embedded into several strategic government-wide cybersecurity programs and contracts, such as the Department of Homeland Security’s Continuous Diagnostics and Mitigation Approved Products List, which serves to provide federal agencies with innovative security tools.Business (Item 1)

Technology

Microsoft Windows

depends on

Our lightweight sensor is built to support Windows, Mac, and Linux operating systems.Business (Item 1)

Also named by AAPL