Capitalizing On CrowdStrike’s Execution Of The New Subscription Business Model
How FalconFlex is bringing cybersecurity into a new era of growth
A few weeks ago, I provided an overview of the shift happening within the cloud subscription sales world. I asserted that while it wasn’t necessarily a new phenomenon in the technology sales space, cybersecurity had just begun adopting the new paradigm, and with great success early on. While I named a few companies, CrowdStrike CRWD 0.00%↑ was the leader of the pack, already two years into this transition. And before you say, “Two years? My investment is already behind the curve!” recall my comment saying these transitions take time, as long as two to three years. Therefore, CrowdStrike is on the cusp of seeing this new business model turn from headwinds to tailwinds. Thus, there has never been a more appropriate time to analyze this opportunity.
Let's first review this new sales model type. Here’s how I explained the model in my last article introducing this series:
…what if a vendor allowed you to use all of their products at any given time for one negotiated subscription cost?
…
Financially, this works similarly to a credit line you’d get with a credit card. A company says your credit limit is $5,000, and each of the products costs $150 per seat, device, or the license metric (like a server, processor, database, etc.). Meaning ten users or devices would consume $1,500 of a product, leaving you with $3,500 in credit to spend on other products or additional usage of the same product. In some instances, you can return the usage and switch it for something else, and move the credit around. Some companies utilize a token system where each product’s value is worth a certain number of tokens, and when in use, it pulls those tokens from the pool and uses them. Many times, they can be returned when the usage of that product has stopped for the moment (perhaps after an hour), and the tokens are returned to the pool, ready to be drawn again to any product. This model enables flexibility in launching new apps and utilizing new tools without a sales cycle - a win-win for both the customer and the vendor.
With this high-level understanding in mind, let’s dig into CrowdStrike's approach to this new sales model, what it has dubbed FalconFlex.
The company launched FalconFlex in the October quarter of 2023 at its Fal.Con conference (FQ3 2024), and without more than a brief mention of it during its earnings call that quarter. Not much fanfare for investors. Nevertheless, FalconFlex began to gain traction in the ensuing quarters as the company struck deals with existing customers to transition them to FalconFlex upon renewal or upsells, while onboarding new customers from the start.
The Pros And Few Immediate Cons Of The Model
What’s crucial to understand is the financial impact. As customers switch to this new model or go directly to it as net-new customers, CrowdStrike recognizes less upfront revenue. This harkens back to the transition the industry underwent from perpetual licensing, where the entire contract is paid upfront (with small, ongoing maintenance costs each year thereafter), to subscription licensing, where payments are made over time. However, with this latest transition toward offering a wider range of the company’s products for a set price with FalconFlex, there’s no opportunity to pay for each product separately, which would otherwise result in the stacking of similar subscriptions and, thus, provide further increased upfront revenue.
One might say, “Well, that doesn’t seem very business savvy, essentially giving away your portfolio of products and taking a hit on revenue growth.”
But this is about enhancing the long-term retention and predictability of the business. By providing access to all of its portfolio within one sales cycle, CrowdStrike enables customers to quickly become embedded in the CrowdStrike cybersecurity ecosystem. With this model, the company can offer longer contracts with a credit line of sorts for all products, thereby creating a more robust entrenchment within the company's portfolio of services. The more products available without the friction of a sales cycle, the more apt a customer is to use them and transform their environment, creating an investment in CrowdStrike’s ecosystem.
Think of it like Apple’s AAPL 0.00%↑ product ecosystem for consumers. If you have a Mac and an iPhone, chances are you’re going to buy an iPad when you need a tablet because they all run the same type of operating system and can seamlessly communicate with each other; you’re already in the ecosystem. Similarly, if a customer purchases an initial FalconFlex license quantity, they have no barriers to using the entire suite of apps, thus creating a “customer for life.”
Once entrenched, it’s challenging to switch to another vendor, a process we refer to in the industry as a “rip and replace.”
Furthermore, a customer has no technical or financial roadblock to using up its licenses quickly. It’s like having to pay with only a gift card on Amazon. You start with a $50 gift card, but you soon realize, even though you can buy anything on the website, $50 isn’t going to be enough to purchase this $30 gadget and that $40 computer upgrade. This is the key.
Let’s look at how this plays out practically.
Customers are enticed to adopt this model as it initially offers a better deal and remains competitive in the medium term. But for CrowdStrike, it also creates a self-fulfilling sales cycle. There’s no need to hawk a pitch, establish a new sales cycle, and a new procurement process at the customer’s end, all to release the licensing for a new product each time a customer wants to add more products to their contract (all known as “expansion” to the vendor). Instead, the customer is already aware of what is available to them and has been freely able to use it; they simply want to grow the overall ability (i.e., more users, devices, and/or multiple products simultaneously). Thus, the sales cycle jumps straight to “how much more?” Using my Amazon example, the customer responds, “$20 more.”
In the Flex model, this returning for more is referred to by CrowdStrike as a Re-Flex. Here’s an example from the company of this playing out this past quarter:
…39 Flex customers have already deployed their initial contract demand plan and have returned to us for a re-Flex. These customers' initial Flex contracts were 35 months, nearly 3 years on average, and within just 5 months, they came back to CrowdStrike wanting more of the Falcon platform to achieve their cybersecurity consolidation goals. (bold emphasis mine)
-George Kurtz, CEO, CrowdStrike’s FQ1 ‘26 Earnings Call
The model is clearly selling itself much like a shopper on Amazon, and this past quarter proves it’s finding momentum. This is why now is an important time to understand how this affects the financials.
Revenue: Slowing First, Then Accelerating
I’ll start by setting the stage with CrowdStrike’s revenue growth over the last three years.
What stands out to me in the chart below is the fairly orderly and consistent deceleration in revenue growth. But you’ll notice it picks up speed downhill a bit more around the FQ3 ‘25 quarter. While some are right to argue this may be due to customers fleeing after the worldwide IT outage last July, I’ve argued recently in my work on Seeking Alpha that may not be the case.
I can more clearly tie the quickened growth deceleration to FalconFlex. FQ3 '25 appeared to have the greatest acceleration in the adoption of Flex contracts, aligning with the largest headwind to revenue growth compared to prior quarters.
We saw remarkable and accelerating Falcon Flex adoption in Q3, bolstered by our customer commitment packages, with over 150 Falcon Flex deals in the quarter. Unpacking this momentum, we did two Falcon Flex deals every business day of the quarter on average. Accounts that have adopted the Falcon Flex model now represent more than $1.3 billion of total deal value, with the average Falcon Flex subscription being multiples larger than our typical contract value.
-George Kurtz, CEO, CrowdStrike’s FQ3 ‘25 Earnings Call
The reason why this transition, which otherwise appears to be a great business move, is seeing less revenue growth is due to the shift toward bigger commitments over longer time periods. The revenue recognition upfront is smaller, but the overall deals are bigger and for longer periods, with more lock-in (moat) than subscriptions alone. Moreover, the key is the return of customers to expand those deals (already happening, as I pointed out earlier), which provides a longer revenue growth runway ahead of us.
To further drive the point home, this “extra” slowing of revenue growth closely mirrors what all companies that transitioned from perpetual licensing to subscription licensing have experienced. As I mentioned in my introductory article to this series, CyberArk CYBR 0.00%↑ was one of the easiest to follow through its transition, and it faced the same headwinds to growth upfront, but experienced significant tailwinds on the backend.
CrowdStrike is now approaching the tipping point of this sales model transition from headwinds to tailwinds. The momentum has increased since FQ3 ‘25, adding $600M in total deal value during that quarter, to two quarters later, adding $774M in total deal value in FQ1 ‘26. This is what’s driving much of the company’s net-ARR growth expectations:
Seeing our customers and ecosystem embrace Falcon Flex at this speed and scale gives me confidence, confidence in improving sequential net new ARR growth next quarter and accelerating back-half net new ARR.
-George Kurtz, CEO, CrowdStrike’s FQ1 ‘26 Earnings Call
We’ll begin to see this acceleration in net-new annual recurring revenue (ARR), the annual metric showing the quarterly additions of new revenue each quarter; however, this will also coincide with the lapping of its incentive program to keep customers following its IT outage incident last year. Nonetheless, this sales model will also factor into it as more current customers move to it or as new logo additions happen (net new customers).
What you need to know here is net-new ARR is the first sign of future revenue growth. With expectations for accelerating net-new ARR in the second half of FY26, the company will begin to see an acceleration in year-over-year revenue growth in the quarters following that, putting us approximately three quarters away from it happening.
But this isn’t in a vacuum. As momentum continues to build for FalconFlex, headwinds will persist, especially if the growth in total deal value continues to increase quarter over quarter. The difference is the tailwinds for revenue growth will begin to pick up after the next three quarters and start a cascading momentum chain that builds for the next two years (eight quarters). Moreover, as re-Flexes occur, only tailwinds are recognized, as that revenue is additive, not replacing higher near-term revenue like the initial Flex deals did. This is a key difference from the perpetual to subscription transition of years past, and it’s what could inflect companies’ growth who adopt this new sales model beyond what we’ve seen with prior sales models.
The bottom line is there are several variables at play within the new sales model itself, but the overarching principle is headwinds will shift to tailwinds in the next few quarters, as net new ARR is the canary in the coal mine for revenue growth. From then on, tailwinds could be instant with re-Flexes. Overall, I like where CrowdStrike is headed as it adopts this new sales model and I like where we’re positioned on the timeline to see it before it happens.
Next, I’ll analyze a company much earlier in this transition, but without the headwinds of an IT outage.