CrowdStrike Holdings 10-K 2022-01-31

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

___________________________________________________________________________________________________

FORM 10-K

___________________________________________________________________________________________________

(Mark One)

For the fiscal year ended January 31, 2022

OR

For the transition period from to

Commission File Number: 001-38933

___________________________________________________________________________________________________

CROWDSTRIKE HOLDINGS, INC.

(Exact Name of Registrant as Specified in Its Charter)

___________________________________________________________________________________________________

206 E. 9th Street, Suite 1400, Austin, Texas 78701

(Address of principal executive offices)

Registrant’s telephone number, including area code: (888) 512-8906

Securities registered pursuant to Section 12(b) of the Act:

Securities registered pursuant to Section 12(g) of the Act:

None.

___________________________________________________________________________________________________

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act of 1933, as amended. Yes ☑ No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15(d) of the Act. Yes ☐ No ☑

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☑ No ☐

Indicate by check mark whether the registrant has submitted electronically every interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files) Yes ☑ No ☐

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company” and “emerging growth company” in Rule 12b-2 of the Exchange Act.

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant has filed a report on and attestation to its management’s assessment of the effectiveness of its internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act (15 U.S.C. 7262(b)) by the registered public accounting firm that prepared or issued its audit report. ☑

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☑

The aggregate market value of the common stock held by non-affiliates of the registrant, based on the closing price of a share of the registrant’s common stock on July 31, 2021 (the last business day of the registrant’s most recently completed second fiscal quarter) as reported by the Nasdaq Global Select Market on such date was approximately $51.5 billion.

As of February 28, 2022, the number of shares of the registrant’s Class A common stock outstanding was 210,058,133, and the number of shares of the registrant’s Class B common stock outstanding was 20,709,727.

DOCUMENTS INCORPORATED BY REFERENCE

Portions of the registrant’s definitive Proxy Statement relating to its 2022 Annual Meeting of Stockholders are incorporated by reference into Part III of this Form 10-K where indicated. Such Proxy Statement will be filed with the United States Securities and Exchange Commission within 120 days after the end of the fiscal year to which this Annual Report on Form 10-K relates.

Table of Contents

CROWDSTRIKE HOLDINGS, INC.

TABLE OF CONTENTS

Table of Contents

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Annual Report on Form 10-K contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. All statements contained in this Annual Report on Form 10-K other than statements of historical fact, including statements regarding our future operating results and financial position, our business strategy and plans and our objectives for future operations, are forward-looking statements. The words “believe,” “may,” “will,” “potentially,” “estimate,” “continue,” “anticipate,” “intend,” “could,” “would,” “project,” “plan,” “expect” and similar expressions that convey uncertainty of future events or outcomes are intended to identify forward-looking statements.

These forward-looking statements include, but are not limited to, statements concerning the following:

• our future financial performance, including our expectations regarding our revenue, cost of revenue, gross profit or gross margin, operating expenses (including changes in sales and marketing, research and development, and general and administrative expenses), and our ability to achieve, and maintain, future profitability;

• the impact of the COVID-19 pandemic on our operations, financial results, and liquidity and capital resources, including on customers, sales, expenses, and employees;

• market acceptance of our cloud platform;

• the effects of increased competition in our markets and our ability to compete effectively;

• our ability to maintain the security and availability of our cloud platform;

• our ability to maintain and expand our customer base, including by attracting new customers;

• our ability to develop new solutions, or enhancements to our existing solutions, and bring them to market in a timely manner;

• anticipated trends, growth rates and challenges in our business and in the markets in which we operate;

• our business plan and our ability to effectively manage our growth and associated investments;

• beliefs and objectives for future operations;

• our relationships with third parties, including channel partners and technology alliance partners;

• our ability to maintain, protect and enhance our intellectual property rights;

• our ability to successfully defend litigation brought against us;

• our ability to successfully expand in our existing markets and into new markets;

• sufficiency of cash and cash equivalents to meet cash needs for at least the next 12 months;

• our ability to expand internationally;

• our ability to comply with laws and regulations that currently apply or become applicable to our business both in the United States and internationally;

• our ability to develop, maintain, and improve our internal control over financial reporting;

• instability in the global credit and financial markets;

• our ability to successfully close and integrate acquisitions to contribute to our growth objectives; and

• the attraction and retention of qualified employees and key personnel.

Table of Contents

These statements are based on our current plans, estimates and projections in light of information currently available to us. These forward-looking statements may be affected by risks, uncertainties and other factors discussed elsewhere in this Annual Report on Form 10-K, including under “Risk Factors.” Furthermore, new risks and uncertainties emerge from time to time, and it is impossible for us to predict all risks and uncertainties or how they may affect us. If any of these risks or uncertainties occurs, our business, revenue and financial results could be harmed, and the trading price of our Class A common stock could decline. Forward-looking statements made in this Annual Report on Form 10-K speak only as of the date on which such statements are made, and we undertake no obligation to update them in light of new information or future events, except as required by law.

We intend to announce material information to the public through the CrowdStrike Investor Relations website ir.crowdstrike.com, SEC filings, press releases, public conference calls, and public webcasts. We use these channels, as well as social media and our blog, to communicate with our investors, customers, and the public about our company, our offerings, and other issues. It is possible that the information we post on social media and our blog could be deemed to be material information. As such, we encourage investors, the media, and others to follow the channels listed above, including the social media channels listed on our investor relations website, and to review the information disclosed through such channels. Any updates to the list of disclosure channels through which we will announce information will be posted on the investor relations page on our website.

Table of Contents

PART I

Overview

Founded in 2011, CrowdStrike reinvented cybersecurity for the cloud era and transformed the way cybersecurity is delivered and experienced by customers. When we started CrowdStrike, cyberattackers had an asymmetric advantage over legacy cybersecurity products that could not keep pace with the rapid changes in adversary tactics. We took a fundamentally different approach to solve this problem with the CrowdStrike Falcon platform – the first, true cloud-native platform capable of harnessing vast amounts of security and enterprise data to deliver highly modular solutions through a single lightweight agent. Our pioneering platform approach keeps customers ahead of attackers by automatically detecting and preventing threats to stop breaches.

We believe our approach has defined a new category called the Security Cloud, which has the power to transform the cybersecurity industry the same way the cloud has transformed the customer relationship management, human resources, and service management industries. Using cloud-scale AI, our Security Cloud enriches and correlates trillions of cybersecurity events per week with indicators of attack, threat intelligence and enterprise data (including data from across endpoints, workloads, identities, DevOps, IT assets and configurations) to create actionable data, identify shifts in adversary tactics and automatically prevent threats in real-time across our customer base. The more data that is fed into our Falcon platform, the more intelligent our Security Cloud becomes, and the more our customers benefit, creating a powerful network effect that increases the overall value we provide.

CrowdStrike: The Architectural Purpose Behind the Platform

Our Falcon platform was purpose-built in the cloud to harness the power of our Security Cloud to deliver the next generation of automated protection and provide threat hunters with the intelligence required to stop sophisticated attacks, including non-malware based attacks. This approach has made CrowdStrike an industry leader in endpoint and cloud workload protection (capable of protecting workloads across on-premise, virtualized, and cloud-based environments running on a variety of endpoints such as desktops, laptops, servers, virtual machines, cloud workloads, cloud containers, mobile, and IoT devices) and enables us to rapidly scale this best in class protection across new and emerging areas of enterprise risk.

Today, we offer 22 cloud modules on our Falcon platform via a SaaS subscription-based model that spans multiple large markets, including corporate workload security, security and vulnerability management, managed security services, IT operations management, threat intelligence services, identity protection, and log management.

Our Falcon platform is composed of tightly integrated, proprietary technologies that enable us to deliver superior protection and performance, while reducing customer complexity. Our Falcon platform consists of our easily deployed, intelligent lightweight agent, and our groundbreaking graph technology.

Our single, lightweight-agent approach has changed how organizations experience cybersecurity, delivering protection without impacting the user, resources or productivity. With the lightweight agent installed on each endpoint or cloud workload, our Falcon platform automates detection and prevention capabilities in real time across our entire global customer base. This also enables our Falcon platform to intelligently ingest and stream high fidelity data back into the Security Cloud to continuously improve our Falcon platform’s AI algorithms and make its real-time decision-making faster and smarter to keep customers ahead of changing adversary tactics.

Our graph technology correlates and contextualizes the vast data of our Security Cloud so we can collect data once and reuse it repeatedly to deliver solutions that solve our customers’ biggest problems. Our Threat Graph uses a combination of AI and behavioral pattern-matching techniques to correlate and analyze trillions of cybersecurity events, enriched with threat intelligence, and third-party data to identify and link threat activity together to automatically prevent threats in real time across CrowdStrike’s global customer base. This also provides customers with increased visibility of attacks for proactive threat hunting and timely detection and remediation of novel threats.

The Falcon platform was purpose-built with the foresight that the future of cybersecurity would need to be cloud-native and AI-driven. While AI is revolutionizing many technology fields, including cybersecurity solutions, to be truly effective,

Table of Contents

algorithms that enable AI depend on the quality and volume of data that trains them and the selection of the right differentiating features from that data.

This is why we believe our Security Cloud and our cloud-native architecture creates a fundamental differentiator from our competitors. The expansive amount of high fidelity data crowdsourced and captured in our Security Cloud enables the continuous training of our algorithms. We call this cloud-scale AI. Our technology is uniquely effective because we not only have a massive amount of high fidelity data to continuously train our AI models but also because of our deep cybersecurity expertise, which supports our industry-leading efficacy and low false positives.

By analyzing and correlating information across our massive, crowdsourced dataset, we are able to deploy our AI algorithms at cloud-scale and build a more intelligent, effective solution to detect threats and stop breaches that on-premise, cloud-hosted and hybrid products cannot match due to the inherent architectural limitations those products have with respect to data storage and analysis. The more data that is fed into our Falcon platform, the more intelligent the Security Cloud becomes, and the more our customers benefit, creating a powerful network effect that increases the overall value we provide.

Industry Background: The Trends Driving a Need for a New Approach to Security

We believe there are a number of important macro trends that drive the need for a new approach to security. These include:

• Cybersecurity Threats are More Sophisticated and More Damaging:** The sophistication of adversaries continues to increase as militaries and intelligence services of well-funded nation-states, technically advanced criminal organizations and hackers use advanced, easily obtained methods of attack - including non-malware based attacks that exploit user identities and credentials. These attacks are pervasive, targeting a broad range of industries including technology, transportation, healthcare, financial services, governments and political organizations, utility, retail, and public infrastructure. The number and scale of attacks continue to increase. The typical attack cycle starts with attackers attempting to penetrate endpoints to establish a beachhead. Once inside, adversaries steal and exploit legitimate credentials to escalate privileges, move laterally and progress and attack, often downloading malware or ransomware. At this stage in the threat lifecycle, the adversary is able to encrypt, destroy, or silently exfiltrate sensitive data. In 2021 alone, adversaries launched multiple, destructive attacks that disrupted business and resulted in significant cumulative losses.

• Hybrid, Remote Workforces and the Proliferation of Workloads Expands the Attack Surface:** Organizations everywhere are embracing digital transformation and are becoming more distributed as they adopt the cloud, increase workforce mobility, and grow their number of connected devices. They are adding more workloads to a myriad of different endpoints beyond the traditional cybersecurity perimeter, exposing an increasingly broad attack surface to adversaries. This existing tr

Showing the first 8K of 70K characters. Open the full section

A description of the risks and uncertainties associated with our business is set forth below. You should carefully consider the risks and uncertainties described below, as well as the other information in this Annual Report on Form 10-K, including our consolidated financial statements and the related notes and “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” The occurrence of any of the events or developments described below, or of additional risks and uncertainties not presently known to us or that we currently deem immaterial, could materially and adversely affect our business, results of operations, financial condition and growth prospects. In such an event, the market price of our Class A common stock could decline, and you could lose all or part of your investment.

Summary of Risk Factors

Our business is subject to numerous risks and uncertainties, any one of which could materially adversely affect our business, results of operations, financial condition and growth prospects. Below is a summary of some of these risks. This summary is not complete, and should be read together with the entire section titled “Risk Factors” in this Annual Report on Form 10-K, as well as the other information in this Annual Report on Form 10-K and the other filings that we make with the SEC.

• We have experienced rapid growth in recent periods, and if we do not manage our future growth, our business and results of operations will be adversely affected.

• We have a history of losses and may not be able to achieve or sustain profitability in the future.

• The COVID-19 pandemic could adversely affect global economic conditions and our business, operating results and future revenue.

• If organizations do not adopt cloud-based SaaS-delivered endpoint security solutions, our ability to grow our business and results of operations may be adversely affected.

• If we are unable to successfully enhance our existing products and services and introduce new products and services in response to rapid technological changes and market developments as well as evolving security threats, our competitive position and prospects will be harmed.

• If we are unable to attract new customers, our future results of operations could be harmed.

• If our customers do not renew their subscriptions for our products and add additional cloud modules to their subscriptions, our future results of operations could be harmed.

• We face intense competition and could lose market share to our competitors, which could adversely affect our business, financial condition, and results of operations.

• If our solutions fail or are perceived to fail to detect or prevent incidents or have or are perceived to have defects, errors, or vulnerabilities, our brand and reputation would be harmed, which would adversely affect our business and results of operations.

• As a cybersecurity provider, we have been, and expect to continue to be, a target of cyberattacks. If our internal networks, systems, or data are or are perceived to have been breached, our reputation may be damaged and our financial results may be negatively affected.

Table of Contents

• We rely on third-party data centers, such as Amazon Web Services, and our own colocation data centers, to host and operate our Falcon platform, and any disruption of or interference with our use of these facilities may negatively affect our ability to maintain the performance and reliability of our Falcon platform, which could cause our business to suffer.

• We rely on our key technical, sales and management personnel to grow our business, and the loss of one or more key employees could harm our business.

• If we are unable to attract and retain qualified personnel, our business could be harmed.

• Our results of operations may fluctuate significantly, which could make our future results difficult to predict and could cause our results of operations to fall below expectations.

• Claims by others that we infringe their proprietary technology or other intellectual property rights could result in significant costs and substantially harm our business, financial condition, results of operations, and prospects.

• If we are not able to comply with applicable data protection, security, privacy, and other government- and industry-specific laws, regulations, standards or requirements, our business, results of operations, and financial condition could be harmed.

• Future acquisitions, strategic investments, partnerships, or alliances could be difficult to identify and integrate, divert the attention of key management personnel, disrupt our business, dilute stockholder value and adversely affect our results of operations and financial condition.

Risks Related to Our Business and Industry

We have experienced rapid growth in recent periods, and if we do not manage our future growth, our business and results of operations will be adversely affected.

We have experienced rapid revenue growth in recent periods and we expect to continue to invest broadly across our organization to support our growth. For example, our headcount grew from 2,309 employees as of January 31, 2020, to 4,965 employees as of January 31, 2022. Although we have experienced rapid growth historically, we may not sustain our current growth rates and our investments to support our growth may not be successful. The growth and expansion of our business will require us to invest significant financial and operational resources and the continuous dedication of our management team. Our future success will depend in part on our ability to manage our growth effectively, which will require us to, among other things:

• effectively attract, integrate, and retain a large number of new employees, particularly members of our sales and marketing and research and development teams;

• further improve our Falcon platform, including our cloud modules, and IT infrastructure, including expanding and optimizing our data centers, to support our business needs;

• enhance our information and communication systems to ensure that our employees and offices around the world are well coordinated and can effectively communicate with each other and our growing base of channel partners and customers; and

• improve our financial, management, and compliance systems and controls.

If we fail to achieve these objectives effectively, our ability to manage our expected growth, ensure uninterrupted operation of our Falcon platform and key business systems, and comply with the rules and regulations applicable to our business could be impaired. Additionally, the quality of our platform and services could suffer and we may not be able to adequately address competitive challenges. Any of the foregoing could adversely affect our business, results of operations, and financial condition.

We have a history of losses and may not be able to achieve or sustain profitability in the future.

We have incurred net losses in all periods since our inception, and we may not achieve or maintain profitability in the future. We experienced net losses of $234.8 million, $92.6 million, and $141.8 million for fiscal 2022, fiscal 2021, and fiscal 2020, respectively. As of January 31, 2022, we had an accumulated deficit of $964.9 million. While we have experienced

Table of Contents

significant growth in revenue in recent periods, we cannot assure you when or whether we will reach or maintain profitability. We also expect our operating expenses to increase in the future as we continue to invest for our future growth, which will negatively affect our results of operations if our total revenue does not increase. We cannot assure you that these investments will result in substantial increases in our total revenue or improvements in our results of oper

Showing the first 8K of 167K characters. Open the full section

None.

Our principal executive offices occupy approximately 36,385 square feet in Austin, Texas under a lease that expires in 2024. We also lease office space for our operations in various locations throughout the United States as well as office space in a number of countries in Europe, the Middle East, and the Asia-Pacific region.

We believe that our existing facilities are sufficient for our current needs. In the future, we may need to add new facilities and expand our existing facilities as we add employees, grow our infrastructure and evolve our business, and we believe that suitable additional or substitute space will be available on commercially reasonable terms to meet our future needs.

We are currently a party to, and may from time to time in the future be involved in, various litigation matters and subject to claims that arise in the ordinary course of business, including claims asserted by third parties in the form of letters and other communications. For information regarding legal proceedings and other claims in which we are involved, see Note 11, Commitments and Contingencies, in Part II, Item 8 of this Annual Report on Form 10-K.

Table of Contents

For any claims for which we believe a liability is both probable and reasonably estimable, we record a liability in the period for which it makes this determination. There is no pending or threatened legal proceeding to which we are a party that, in our opinion, is likely to have a material adverse effect on our business and our consolidated financial statements; however, the results of litigation and claims are inherently unpredictable. Regardless of the outcome, litigation can have an adverse impact on our business because of defense and settlement costs, diversion of management resources, and other factors. In addition, the expense of litigation and the timing of this expense from period to period are difficult to estimate, subject to change and could adversely affect our consolidated financial statements.

Not applicable.

Table of Contents

Part II

Market Information for Common Stock

Our Class A common stock has been listed and traded on the Nasdaq Global Select Market under the symbol “CRWD” since June 12, 2019. Prior to that date, there was no public market for our Class A common stock. There is no public market for our Class B common stock.

Holders of Record

As of January 31, 2022, we had 34 holders of record of our Class A common stock and 84 holders of record of our Class B common stock. The actual number of stockholders is greater than this number of record holders and includes stockholders who are beneficial owners but whose shares are held in street name by brokers and other nominees.

Dividend Policy

We have never declared or paid any cash dividends on our capital stock. We currently intend to retain all available funds and any future earnings for use in the operation of our business and do not expect to pay any dividends on our capital stock in the foreseeable future. Additionally, our ability to pay dividends is limited by restrictions on our ability to pay dividends or make distributions under the terms of our credit facility. Any future determination to declare dividends will be made at the discretion of our board of directors, subject to applicable laws, and will depend on a number of factors, including our financial condition, results of operations, capital requirements, contractual restrictions, general business conditions, and other factors that our board of directors may deem relevant.

Securities Authorized for Issuance under Equity Compensation Plans

The information required by this item with respect to our equity compensation plans is incorporated by reference to our Proxy Statement for the 2022 Annual Meeting of Stockholders to be filed with the Securities and Exchange Commission within 120 days of the fiscal year ended January 31, 2022.

Recent Sales of Unregistered Equity Securities and Use of Proceeds

(a) Sale of Unregistered Equity Securities

On November 29, 2021, we agreed to issue $10.7 million of shares of our Class A common stock, subject to service-based vesting and other conditions, to certain individual interest holders of Secure Circle LLC (“SecureCircle”) in connection with our acquisition of SecureCircle. The transaction was exempt from registration under Section 4(a)(2) of the Securities Act.

(b) Use of Proceeds from Public Offering of Common Stock

None.

Issuer Purchases of Equity Securities

None.

Stock Performance Graph

This performance graph shall not be deemed “soliciting material” or to be “filed” with the SEC for purposes of Section 18 of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), or otherwise subject to the liabilities under that Section, and shall not be deemed to be incorporated by reference into any filing of CrowdStrike Holdings, Inc. under the Securities Act or the Exchange Act.

Table of Contents

We have presented below the cumulative total return to our stockholders between June 12, 2019 (the date our common stock commenced trading on the Nasdaq) through January 31, 2022 in comparison to the Standard & Poor’s 500 Index, Standard & Poor Information Technology Index, and the Nasdaq 100 Index. All values assume a $100 initial investment and data for the Standard & Poor’s 500 Index, Standard & Poor Information Technology Index and the Nasdaq 100 Index assume reinvestment of dividends. The comparisons are based on historical data and are not indicative of, nor intended to forecast, the future performance of our common stock.

Table of Contents

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with the consolidated financial statements and related notes thereto included in Item 8 “Financial Statements and Supplementary Data” in this Annual Report on Form 10-K. This section of this Form 10-K generally discusses fiscal 2022 and 2021 items and year-over-year comparisons between fiscal 2022 and 2021. Discussions of fiscal 2020 items and year-over-year comparisons between fiscal 2021 and 2020 are not included in this Form 10-K, and can be found in “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Part II, Item 7 of our Annual Report on Form 10-K for the fiscal year ended January 31, 2021. Some of the information contained in this discussion and analysis or set forth elsewhere in this Annual Report on Form 10-K, including information with respect to our plans and strategy for our business, includes forward-looking statements that involve risks and uncertainties, including those described under the heading “Special Note Regarding Forward-Looking Statements.” You should review the disclosure under Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K for a discussion of important factors that could cause actual results to differ materially from the results described in or implied by the forward-looking statements contained in the following discussion and analysis. Our fiscal years ended January 31, 2022, January 31, 2021, and January 31, 2020, are referred to herein as fiscal 2022, fiscal 2021, and fiscal 2020, respectively.

Overview

Founded in 2011, CrowdStrike reinvented cybersecurity for the cloud era and transformed the way cybersecurity is delivered and experienced by customers. When we started CrowdStrike, cyberattackers had an asymmetric advantage over legacy cybersecurity products that could not keep pace with the rapid changes in adversary tactics. We took a fundamentally different approach to solve this problem with the CrowdStrike Falcon platform – the first, true cloud-native platform capable of harnessing vast amounts of security and enterprise data to deliver highly modular solutions through a single lightweight agent. Our pioneering platform approach keeps customers ahead of attackers by automatically detecting and preventing threats to stop breaches.

We believe our approach has defined a new category called the Security Cloud, which has the power to transform the cybersecurity industry the same way the cloud has transformed the customer relationship management, human resources, and service management industries. Using cloud-scale AI, our Security Cloud enriches and correlates trillions of cybersecurity events per week with indicators of attack, threat intelligence and enterprise data (including data from across endpoints, workloads, identities, DevOps, IT assets and configurations) to create actionable data, identify shifts in adversary tactics and automatically prevent threats in real-time across our customer base. The more data that is fed into our Falcon platform, the more intelligent our Security Cloud becomes, and the more our customers benefit, creating a powerful network effect that increases the overall value we provide.

In March 2020, the World Health Organization declared the COVID-19 outbreak to be a pandemic. Since then, the COVID-19 pandemic has rapidly spread across the globe and has already resulted in significant volatility, uncertainty, and economic disruption. Since the pandemic commenced, we have implemented several measures to help protect the health and safety of our employees around the globe. In addition, in response to the uncertain macroeconomic environment, we converted all of our marketable securities to cash and cash equivalents during the three months ended April 30, 2020 and all of our investments were classified as cash and cash equivalents as of January 31, 2022. Thus far, the impact of the pandemic has been modest. Our gross retention rate for fiscal 2022 remained consistently high and our dollar-based net retention rate was above 120 percent throughout fiscal year 2022 as we continued to expand the number of endpoints and modules within existing customers.

We continue to actively monitor the situation and may take further actions that alter our business operations as may be required by federal, state, or local authorities, or that we determine are in the best interests of our employees, customers, partners, suppliers, and stockholders. The extent to which the COVID-19 pandemic may impact our longer-term operational and financial performance remains uncertain. Furthermore, due to our subscription-based business model, the effect of the COVID-19 pandemic may not be fully reflected in our results of operations until future periods, if at all. The extent of the impact of the COVID-19 pandemic will depend on several factors, including the pace of reopening the economy around the world; the possible resurgence in the spread of the virus; the development cycle of therapeutics and vaccines; the impact on our

Table of Contents

customers and our sales cycles; the impact on our customer, employee, and industry events; and the effect on our vendors. Please see Part I, Item IA, “Risk Factors” for a further description of the material risks we currently face, including risks related to the COVID-19 pandemic.

On March 5, 2021, we acquired Humio Limited (“Humio”), a privately-held company that is a leading provider of high-performance cloud log management and observability technology. The acquisition was accounted for as a business combination. The total consideration transferred was $370.3 million which consisted of $353.8 million in cash, net of $12.5 million cash acquired, and $4.0 million representing the fair value of replacement equity awards attributable to pre-acquisition service. The purchase price was allocated to identified intangible assets, which include developed technology, customer relationships and trade names, of $75.6 million, net tangible assets acquired of $3.4 million and goodwill of $291.3 million, representing the excess of the purchase price over the fair value of net tangible and intangible assets acquired.

On November 29, 2021, we acquired Secure Circle, LLC (“SecureCircle”), a SaaS-based cybersecurity service that extends Zero Trust security to data on, from and to the endpoint. The acquisition was accounted for as a business combination. The total consideration transferred was $60.8 million, which consisted solely of cash.. The purchase price was allocated, on a preliminary basis, to identified intangible assets, which include developed technology and customer relationships of $18.3 million, net tangible assets acquired of $(0.5) million and goodwill of $43.0 million, representing the excess of the purchase price over the fair value of net tangible and intangible assets acquired.

Our Go-To-Market Strategy

We sell subscriptions to our Falcon platform and cloud modules to organizations across multiple industries. We primarily sell subscriptions to our Falcon platform and cloud modules through our direct sales team that leverages our network of channel partners. Our direct sales team is comprised of field sales and inside sales professionals who are segmented by a customer’s number of endpoints.

We have a low friction land-and-expand sales strategy. When customers deploy our Falcon platform, they can start with any number of cloud modules and easily add additional cloud modules. Once customers experience the benefits of our Falcon platform, they often expand their adoption over time by adding more endpoints or purchasing additional modules. We also use our sales team to identify current customers who may be interested in free trials of additional cloud modules, which serves as a powerful driver of our land-and-expa

Showing the first 8K of 71K characters. Open the full section

We have operations in the United States and internationally, and we are exposed to market risk in the ordinary course of business.

Interest Rate Risk

Our cash and cash equivalents primarily consist of cash on hand and highly liquid investments in bank deposits and money market funds. Our investments are exposed to market risk due to fluctuations in interest rates, which may affect our interest income and the fair value of our investments. As of January 31, 2022, we had cash and cash equivalents of $2.0 billion and no marketable securities. The carrying amount of our cash equivalents reasonably approximates fair value due to the short maturities of these instruments. The primary objectives of our investment activities are the preservation of capital, the fulfillment of liquidity needs, and the fiduciary control of cash and investments. We do not enter into investments for trading or speculative purposes. Due to the short-term nature of our investment portfolio, the effect of a hypothetical 100 basis point change in interest rates would not have had a material effect on the fair market value of our portfolio as of January 31, 2022. We therefore do not expect our results of operations or cash flows to be materially affected by a sudden change in market interest rates.

Our debt obligations consist of a variety of financial instruments that expose us to interest rate risk, including, but not limited to our revolving credit facility and the Senior Notes. The interest on the revolving credit facility is tied to short term interest rate benchmarks including the Term SOFR. The interest rate on the Senior Notes is fixed.

Foreign Currency Risk

To date, nearly all of our sales contracts have been denominated in U.S. dollars. A portion of our operating expenses are incurred outside the United States, denominated in foreign currencies and subject to fluctuations due to changes in foreign currency exchange rates, particularly changes in the British Pound, Australian Dollar, and Euro. The functional currency of our foreign subsidiaries is that country’s local currency. Foreign currency transaction gains and losses are recorded to Other income (expense), net. A hypothetical 10% adverse change in the U.S. dollar against other currencies would have resulted in an increase in operating loss of approximately $36.3 million and $17.2 million for the fiscal years ended January 31, 2022 and January 31, 2021, respectively. We have not entered into derivative or hedging transactions, but we may do so in the future if our exposure to foreign currency becomes more significant.

Inflation Rate Risk

We do not believe that inflation had a material effect on our business, financial conditions or results of operations during the fiscal year ended January 31, 2022. If our costs were to become subject to significant inflationary pressures, we may not be able to fully offset such higher costs through price increases. Our inability or failure to do so could harm our business, financial condition and results of operations.

Table of Contents

Index to Consolidated Financial Statements

Table of Contents

Report of Independent Registered Public Accounting Firm

To the Board of Directors and Stockholders of CrowdStrike Holdings, Inc.

Opinions on the Financial Statements and Internal Control over Financial Reporting

We have audited the accompanying consolidated balance sheets of CrowdStrike Holdings, Inc. and its subsidiaries (the “Company”) as of January 31, 2022 and 2021, and the related consolidated statements of operations, of comprehensive loss, of redeemable convertible preferred stock and stockholders’ equity (deficit) and of cash flows for each of the three years in the period ended January 31, 2022, including the related notes (collectively referred to as the “consolidated financial statements”). We also have audited the Company’s internal control over financial reporting as of January 31, 2022, based on criteria established in Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of the Company as of January 31, 2022 and 2021, and the results of its operations and its cash flows for each of the three years in the period ended January 31, 2022 in conformity with accounting principles generally accepted in the United States of America. Also in our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of January 31, 2022, based on criteria established in Internal Control - Integrated Framework (2013) issued by the COSO.

Changes in Accounting Principles

As discussed in Note 1 to the consolidated financial statements, the Company changed the manner in which it accounts for leases in 2021 and the manner in which it accounts for revenues from contracts with customers in 2020.

Basis for Opinions

The Company’s management is responsible for these consolidated financial statements, for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, included in Management’s Report on Internal Control Over Financial Reporting appearing under Item 9A. Our responsibility is to express opinions on the Company’s consolidated financial statements and on the Company’s internal control over financial reporting based on our audits. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) (PCAOB) and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the consolidated financial statements are free of material misstatement, whether due to error or fraud, and whether effective internal control over financial reporting was maintained in all material respects.

Our audits of the consolidated financial statements included performing procedures to assess the risks of material misstatement of the consolidated financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the consolidated financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the consolidated financial statements. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audits also included performing such other procedures as we considered necessary in the circumstances. We believe that our audits provide a reasonable basis for our opinions.

Definition and Limitations of Internal Control over Financial Reporting

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures

Table of Contents

that (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Critical Audit Matters

The critical audit matter communicated below is a matter arising from the current period audit of the consolidated financial statements that was communicated or required to be communicated to the audit committee and that (i) relates to accounts or disclosures that are material to the consolidated financial statements and (ii) involved our especially challenging, subjective, or complex judgments. The communication of critical audit mat

Showing the first 8K of 183K characters. Open the full section

None.

Evaluation of Disclosure Controls and Procedures

We maintain “disclosure controls and procedures,” as defined in Rule 13a–15(e) and Rule 15d–15(e) under the Exchange Act that are designed to provide reasonable assurance that information required to be disclosed by us in the reports that we file or submit under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to provide reasonable assurance that information required to be disclosed by us in the reports that we file or submit under the Exchange Act is accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure.

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of our disclosure controls and procedures as of January 31, 2022. Based on such evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that, as of such date, our disclosure controls and procedures were effective at the reasonable assurance level.

CrowdStrike Holdings, Inc.

Notes to Consolidated Financial Statements

Management**’**s Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate “internal control over financial reporting,” as defined in Rule 13a-15(f) and Rule 15d-15(f) under the Exchange Act. Our management conducted an evaluation of the effectiveness of our internal control over financial reporting as of January 31, 2022 based on the criteria established in Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

Based on the results of its evaluation, management concluded that our internal control over financial reporting was effective as of January 31, 2022. The effectiveness of our internal control over financial reporting as of January 31, 2022 has been audited by PricewaterhouseCoopers LLP, an independent registered public accounting firm, as stated in its report which is included in Part II, Item 8 of this Annual Report on Form 10-K.

Changes in Internal Control Over Financial Reporting

There was no change in our internal control over financial reporting identified in connection with the evaluation required by Rule 13a-15(d) and Rule 15d-15(d) of the Exchange Act that occurred during the fiscal quarter ended January 31, 2022 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

Inherent Limitations on Effectiveness of Controls

Our management, including our Chief Executive Officer and Chief Financial Officer, believes that our disclosure controls and procedures and internal control over financial reporting are designed to provide reasonable assurance of achieving their objectives and are effective at the reasonable assurance level. However, our management does not expect that our disclosure controls and procedures or our internal control over financial reporting will prevent or detect all errors and all fraud. A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, have been detected. These inherent limitations include the realities that judgments in decision making can be faulty, and that breakdowns can occur because of a simple error or mistake. Additionally, controls can be circumvented by the individual acts of some persons, by collusion of two or more people or by management override of the controls. The design of any system of controls also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions; over time, controls may become inadequate because of changes in conditions, or the degree of compliance with policies or procedures may deteriorate. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected.

None.

Not applicable.

PART III

We have adopted a code of business conduct and ethics (the “Code of Conduct”) that applies to all of our employees, executive officers and directors. The full text of the Code of Conduct is available on our website at ir.crowdstrike.com. The nominating and corporate governance committee of our board of directors is responsible for overseeing the Code of Conduct and must approve any waivers of the Code of Conduct for employees, executive officers and directors. We expect that any amendments to the Code of Conduct, or any waivers of its requirements, will be disclosed on our website, as required by applicable law or the listing standards of The Nasdaq Global Select Market.

Certain information required by this Item with respect to our executive officers is set forth under Item 1 of Part I of this Annual Report on Form 10-K under the section entitled “Executive Officers.”

The information otherwise required by this Item will be included in our definitive proxy statement for our 2022 annual meeting of stockholders (the “2022 Proxy Statement”), which will be filed with the SEC within 120 days after the end of our fiscal year ended January 31, 2022, and is incorporated herein by reference.

The information required by this item is incorporated herein by reference to our 2022 Proxy Statement.

The information required by this item is incorporated herein by reference to our 2022 Proxy Statement.

The information required by this item is incorporated herein by reference to our 2022 Proxy Statement.

The information required by this item is incorporated herein by reference to our 2022 Proxy Statement.

PART IV

(a)(1) Financial Statements

See Index to consolidated financial statements in Part II, Item 8 of this Annual Report on Form 10-K.

(a)(2) Financial Statement Schedule

All financial statement schedules have been omitted as the information is not required under the related instructions or is not applicable or because the information required is already included in the financial statements or the notes to those financial statements.

(a)(3) Exhibits

We have filed the exhibits listed on the accompanying Exhibit Index, which is incorporated herein by reference.

None.

EXHIBIT INDEX

_______________________________________

†Indicates management contract or compensatory plan, contract or agreement.

*The certifications furnished in Exhibit 32.1 hereto are deemed to accompany this Annual Report on Form 10-K and will not be deemed “filed” for purposes of Section 18 of the Securities Exchange Act of 1934, as amended, except to the extent that the registrant specifically incorporates it by reference.

SIGNATURES

Pursuant to the requirements of the Securities Act of 1934, the Registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized, in Austin, Texas, on the day of March 16, 2022.

POWER OF ATTORNEY

KNOW ALL THESE PERSONS BY THESE PRESENTS, that each person whose signature appears below constitutes and appoints George Kurtz and Burt W. Podbere, and each of them, as his or her true and lawful attorney-in-fact and agent, with full power of substitution and resubstitution, for him or her and in his or her name, place and stead, in any and all capacities, to sign any and all amendments to this Annual Report on Form 10-K, and to file the same, with all exhibits thereto, and other documents in connection therewith, with the Securities and Exchange Commission, granting unto said attorneys-in-fact and agents, and each of them, full power and authority to do and perform each and every act and thing requisite and necessary to be done in connection therewith, as fully to all intents and purposes as he or she might or could do in person, hereby ratifying and confirming all that said attorneys-in-fact and agents, or any of them, or their, his or her substitutes, may lawfully do or cause to be done by virtue thereof.

Pursuant to the requirements of the Securities Exchange Act of 1934, this report has been signed below by the following persons on behalf of the Registrant and in the capacities and on the dates indicated.