CrowdStrike was co-founded in 2011 byGeorge Kurtz (CEO),Dmitri Alperovitch (former CTO), and Gregg Marston (CFO, retired).[9][10][11][12] The following year, the company hired Shawn Henry, a formerFederal Bureau of Investigation (FBI) official, to lead the subsidiary CrowdStrike Services, Inc., which offered security and response services.[13][14] The company launched CrowdStrike Falcon, anantivirus package, as its first product in June 2013.[15][16]
After theSony Pictures hack, CrowdStrike uncovered evidence implicating the government ofNorth Korea and demonstrated how the attack was carried out.[19] In 2014, CrowdStrike helped identify members of Putter Panda, the state-sponsored Chinese group of hackers also known asPLA Unit 61486.[20][21]
In May 2015, the company released information aboutVENOM, a critical flaw in an open-sourcehypervisor (hardware or software that runs virtual machines) calledQuick Emulator (QEMU) that allowed hackers to access sensitive personal information.[22][23] In October 2015, the company announced that it had identified Chinese hackers attacking technology and pharmaceutical companies around the time thatU.S. PresidentBarack Obama and China's leaderXi Jinping publicly agreed not to conducteconomic espionage against each other. The alleged hacking would have been in violation of that agreement.[24]
In July 2015,Google invested in the company'sSeries C funding round, which was followed by Series D and Series E, raising a total of $480 million as of May 2019.[25][26][27]
In 2017, Crowdstrike reached a valuation of more than $1 billion with an estimated annual revenue of $100 million.[28] In June 2018, the company said it was valued at more than $3 billion.[26] Investors includeTelstra, March Capital Partners,Rackspace,Accel Partners andWarburg Pincus.[29][30]
CrowdStrike expanded its identity security offerings with Falcon Identity Threat Protection, initially available in 2020, which later evolved into a managed service integrating with Falcon Complete in 2022, and a Cloud Threat Hunting Service in July 2022.[33][34]
In December 2021, the company moved its headquarters location fromSunnyvale, California, to Austin, Texas.[35]
In 2023, CrowdStrike introduced CrowdStream service in collaboration withCribl.io.[36] Charlotte AI, CrowdStrike's generative AI security analyst, was launched in May 2023 as part of Falcon's AI-driven security updates, enhancing automated threat triaging and response.[37]
In September 2023, CrowdStrike launched Falcon Foundry, a no-code application development platform directed at a wider audience,[38] and in September 2024, the company launched CrowdStrike Financial Services, which offers payment solutions and financing to improve access to the Falcon platform.[39]
CrowdStrike joined theS&P 500 index in June 2024.[40]
As of 2024, CrowdStrike spent more than $360,000 on federal lobbying in the first half of 2024, according to OpenSecrets, and $620,000 during 2023.[41] The company has also focused on working with the U.S. government and selling its services to government agencies.[42]
February 2021: Acquired Danishlog management platform Humio for $400 million with plans to integrate Humio's log aggregation into CrowdStrike'sXDR offering.[45]
November 2021: Acquired SecureCircle, a SaaS-based cybersecurity service that extends zero trust endpoint security to include data.[46]
October 2022: Acquired Reposify, an external attack surface management vendor for risk management.[47]
"CrowdStrike,Mandiant, andThreatConnect review[ed] the evidence of the hack and conclude[d] with high certainty that it was the work ofAPT 28 andAPT 29 who are known to be Russian intelligence services."
Comey previously testified in January 2017 that a request forFBI forensics investigators to access the DNC servers was denied, saying Crowdstrike agreed to share information.[59]
In December 2016, CrowdStrike released a report stating that Russian government-affiliated groupFancy Bear had hacked a Ukrainian artillery app.[60] The report concluded that Russia had used the hack to cause large losses to Ukrainian artillery units. The app (called ArtOS) was installed on tablet PCs and used for fire-control.[61] CrowdStrike also found a hacked variation of POPR-D30 being distributed on Ukrainian military forums that utilized anX-Agent implant.[62]
The U.K.-based think tankInternational Institute for Strategic Studies said CrowdStrike’s report wrongly used its data and denied that hacking caused Ukraine’s artillery losses. The Ukrainian Ministry of Defense also rejected the CrowdStrike report, stating that actual artillery losses were much smaller than what was reported by CrowdStrike and were not associated with Russian hacking.[63] Prior to this, CrowdStrike had published a report claiming that malware used in Ukraine and against theDemocratic National Committee (DNC) appeared to be unique and identical, offering it as further evidence for a Russian origin of the DNC attack.[64]
Cybersecurity firm SecureWorks discovered a list of email addresses targeted by Fancy Bear in phishing attacks. The list included the email address of Yaroslav Sherstyuk, the developer of ArtOS.[65] AdditionalAssociated Press research supports CrowdStrike's conclusions about Fancy Bear.[66]Radio Free Europe notes that the AP report "lends some credence to the original CrowdStrike report, showing that the app had, in fact, been targeted."[67]
On 19 July 2024, CrowdStrike released a software configuration file update to the Falconendpoint detection and response agent. Flaws in the update causedblue screens of death onMicrosoft Windows machines, disrupting millions of Windows computers worldwide.[68][69] Affected machines were forced into abootloop, making them unusable. This was caused by an update to a configuration file, Channel File 291, which CrowdStrike says triggered alogic error and caused the operating system to crash.[70] The downtime caused a widespread global impact, grounding commercial airline flights, temporarily takingSky News and other broadcasters offline, and disrupting banking and healthcare services as well as911 emergency call centers.[8][71]
By the end of the day, CrowdStrike shares closed trading at a price of $304.96, down $38.09 or 11.10%.[72]
Although CrowdStrike issued a patch to fix the error, computers stuck in a bootloop were unable to connect to the Internet to download the patch before Falcon would be loaded and crash the device again. The recommended solution from CrowdStrike was to boot intosafe mode or Windows Recovery Mode and manually delete Channel File 291.[73] This requires local administrator access and if the device was encrypted byBitLocker, also required a recovery key.[74] Microsoft reported that some customers were able to remediate the issue solely by rebooting impacted devices up to 15 times.[75]
On 22 July 2024, CrowdStrike shares closed the trading day at a price of $263.91, with a loss of $41.05 or 13.46%.[76] On 24 July 2024, five days after the incident, CrowdStrike published a Post-Incident Review.[77] That same day, CrowdStrike reportedly contacted affected channel partners with apology emails containingUber Eats gift cards worth $10.[78][79][80] On 6 August 2024, Crowdstrike published a Root Cause Analysis to explain the causes of the Channel File 291 Incident, and the mitigation steps the company took to eliminate future incidents.[81] CrowdStrike made several process improvements in response to the 19 July incident. These include: adding new content configuration test procedures; implementing additional deployment layers and acceptance checks for its content configuration system; engaging two third-party vendors to review Falcon sensor code, and the company's quality control and release processes; and staggering update rollouts so that users can select their preferred timing for updates.[82][41] The CrowdStrike incident cost Fortune 500 companies $5.4 billion.[41]
US$3.95 billion (FY25)
US$−120.4 million (FY25)
