CRWD (CrowdStrike Holdings, Inc.): Themes, ETFs, and Basket Ideas
Last updated June 2026
Short answer
What does CrowdStrike Holdings, Inc. do?
CrowdStrike is a leading cloud-native cybersecurity company best known for endpoint protection: software that secures laptops, servers, cloud workloads, and other devices against malware, ransomware, and intrusions. Its Falcon platform uses a single lightweight agent and a cloud-delivered model that collects vast amounts of threat telemetry, applies AI and machine learning to detect attacks, and lets customers add modules across many security categories. Beyond endpoint, CrowdStrike has expanded into cloud security, identity protection, threat intelligence, security operations and log management (Next-Gen SIEM after acquiring Humio/LogScale), exposure management, and managed detection and response. It makes money primarily through recurring subscriptions, with customers often adopting more Falcon modules over time, driving strong net revenue retention. CrowdStrike is one of the fastest-growing large cybersecurity vendors and a platform-consolidation play, helping enterprises replace multiple point tools. It is headquartered in Austin, Texas, and serves enterprises and governments worldwide.
Where is CrowdStrike Holdings, Inc. heading?
1. Platform consolidation and module land-and-expand.
CrowdStrike's Falcon platform lets customers start with endpoint and add modules across cloud, identity, SIEM, and more from a single agent and console. This land-and-expand motion drives high net revenue retention as existing customers buy more, and positions CrowdStrike to win as enterprises consolidate fragmented security tools onto one platform to cut cost and complexity.
2. AI-driven detection and data advantage.
Falcon ingests enormous volumes of threat telemetry across its customer base, and CrowdStrike applies AI and machine learning to detect and stop attacks in real time. Its Charlotte AI and AI-native SIEM extend this advantage. The scale of its data and the speed of cloud-delivered detection create a flywheel that is hard for smaller rivals to match.
3. Large, growing market and new modules.
Cybersecurity spending grows structurally as threats intensify and attack surfaces expand with cloud and AI. CrowdStrike keeps adding modules (cloud security, exposure management, data protection, Next-Gen SIEM) that enlarge its addressable market and average revenue per customer, supporting durable, high-rate subscription growth and a long runway toward its multi-billion-dollar ARR targets.
4. Strong unit economics and cash flow.
CrowdStrike combines rapid growth with high subscription gross margins and strong free cash flow generation, an unusual mix in high-growth software. Improving operating leverage and robust free-cash-flow margins demonstrate that its model can scale profitably, which underpins investor confidence in its long-term earnings power despite a premium valuation.
Risks worth tracking: CrowdStrike trades at a very high valuation that prices in sustained rapid growth, leaving little room for disappointment. The July 2024 faulty software update that triggered a massive global IT outage damaged trust, prompted customer commitment packages and incentives that pressured near-term metrics, and raised litigation and reputational risk; rebuilding full confidence takes time. Competition is fierce from Microsoft (Defender, bundled with its broad suite), Palo Alto Networks, SentinelOne, Zscaler, and others, and Microsoft's bundling can pressure pricing. A slowdown in IT and security spending, execution missteps, or any major security failure could compress the multiple sharply. Stock-based compensation and rich expectations are ongoing concerns.
Earnings and valuation (approximate, early 2026)
A simple financial snapshot. These are approximations and refresh quarterly; for current figures see CrowdStrike Holdings, Inc.'s investor relations page or your broker.
- Revenue (TTM): ~$4 billion
- Annual recurring revenue (ARR): ~$4 billion+, growing rapidly
- Revenue growth: high growth, often ~20-30%+
- GAAP profitability: modest; strong on adjusted and free-cash-flow basis
- Dividend: none; reinvests for growth
- Valuation: premium; high price-to-sales multiple
- Net revenue retention: high, reflecting module expansion
CrowdStrike trades at one of the richer valuations in software, on a high multiple of revenue and free cash flow, reflecting its rapid growth, platform-consolidation story, and strong cash generation for a high-growth name. The premium embeds expectations of years of sustained expansion; the valuation is the key debate, balancing best-in-class growth against limited tolerance for any stumble.
CRWD's competitors
Endpoint and XDR
Competes with Microsoft Defender, SentinelOne, Palo Alto Networks (Cortex), and Trend Micro in endpoint detection and response and extended detection.
Cloud and identity security
Competes with Palo Alto Networks (Prisma), Wiz, Zscaler, Microsoft, and Okta across cloud workload protection and identity security.
SIEM and security operations
Through Next-Gen SIEM (LogScale), competes with Splunk (Cisco), Microsoft Sentinel, Palo Alto Networks, and Datadog in log management and security analytics.
Using CRWD in a Walnut basket
The most useful question to ask about a single stock is rarely “will it go up?”. It's “does this fit a thesis I actually believe in, and how do I size it alongside other stocks that fit the same thesis?” That's what Walnut is built for.
Open the AI assistant on Walnut and describe a thesis (for example: “the AI infrastructure buildout”, “dividend growth large-caps”, “global semiconductors”) where CRWD would naturally fit. The AI proposes 5 to 6 constituents with target weights, you review, and you can fund the basket through your broker once you're ready.
Build a basket around CRWD with Walnut
Use CrowdStrike Holdings, Inc. as one constituent in a thematic basket Walnut's AI helps you assemble. Describe a thesis you believe in, the AI proposes the holdings and weights, and you approve before any broker order.
FAQ
What is CRWD's ticker symbol?
+
CRWD, listed on Nasdaq. The company is CrowdStrike Holdings, headquartered in Austin, Texas. It trades during US market hours and is available at every major US brokerage.
What does CrowdStrike do?
+
CrowdStrike is a cloud-native cybersecurity company. Its Falcon platform protects endpoints, cloud workloads, and identities using a single lightweight agent and AI-driven detection, and spans modules for cloud security, identity, threat intelligence, and SIEM. It earns recurring subscription revenue.
Who are CrowdStrike's main competitors?
+
In endpoint, Microsoft Defender, SentinelOne, and Palo Alto Networks. In cloud and identity, Palo Alto, Wiz, Zscaler, and Okta. In SIEM, Splunk (Cisco) and Microsoft Sentinel. Microsoft is the most significant broad competitor.
What happened with the CrowdStrike outage in 2024?
+
In July 2024, a faulty CrowdStrike Falcon sensor update caused a massive global IT outage, crashing many Windows systems and disrupting airlines, banks, and other services. It damaged trust, led to customer incentive packages and litigation, and pressured near-term growth metrics as the company worked to rebuild confidence.
How does CrowdStrike make money?
+
CrowdStrike earns recurring subscription revenue from its Falcon platform, billed per endpoint and per module. Customers typically start with endpoint protection and add more modules over time, driving high net revenue retention and expansion revenue as adoption deepens.
Is CrowdStrike profitable?
+
CrowdStrike has modest GAAP profitability, weighed down by stock-based compensation, but it generates strong free cash flow and solid adjusted earnings. Its combination of rapid growth and high free-cash-flow margins is unusual for a high-growth software company.
Is CRWD a Technology stock?
+
Yes. Under GICS classification, CrowdStrike is in the Information Technology sector, within software and cybersecurity. It is held across technology and cybersecurity ETFs and broad market index funds.
Which ETFs hold CRWD?
+
Cybersecurity ETFs such as CIBR, HACK, and BUG hold CRWD at high weights. It is also held in QQQ (Nasdaq-100), broad technology ETFs like XLK and VGT, and many growth-focused funds.
Is CRWD in the S&P 500 and Nasdaq-100?
+
Yes to both. CrowdStrike was added to the S&P 500 and is a Nasdaq-100 constituent given its Nasdaq listing and large market cap, making it widely held across index funds tracking either benchmark.
What is CrowdStrike's market cap?
+
Roughly $80-110 billion as of early 2026, large for a cybersecurity company and reflecting its rapid growth and premium valuation. The market cap can be volatile given the high multiple investors assign to its growth.
Which thematic baskets typically include CRWD?
+
CrowdStrike commonly appears in cybersecurity, cloud-software, and artificial-intelligence baskets. It is also used in high-growth or disruptive-technology themes given its rapid expansion and platform-consolidation story.
Is CRWD a good stock to buy?
+
Descriptive, not a recommendation. The bull case is a leading cloud-native security platform, strong land-and-expand module growth, an AI and data-scale advantage, high net revenue retention, and strong free cash flow. The bear case is a very high valuation with little margin for error, lingering trust and litigation effects from the 2024 outage, intense competition (especially Microsoft's bundling), and sensitivity to any growth slowdown. Whether it fits any portfolio depends on individual goals and risk tolerance. Walnut is informational, not investment advice.
Walnut is informational, not investment advice. Financial figures on this page are approximations; always verify current numbers with CrowdStrike Holdings, Inc.'s investor relations page or your broker before making investment decisions.