CrowdStrike — How Far Should Falcon Flex Go?
Download case PDF (4 pages)Request teacher’s pack
Decision date and information cutoff: 4 June 2024
Decision scope: Commercial design and rollout of Falcon Flex
Case convention: This is an author-created strategy exercise. The alternatives and assignment are hypothetical; company disclosures and reported results are historical. The case does not represent private deliberations or a decision announced by CrowdStrike.
A platform built to expand
CrowdStrike’s Falcon platform brought together cloud-delivered cybersecurity and IT modules through a single lightweight agent and cloud console. The company said its architecture allowed customers to begin with selected modules and later add modules or endpoints. CrowdStrike sold subscriptions through a direct sales organization working with channel and technology partners. It described this approach as “land and expand.” [S1], Item 1, “Overview,” “Bringing CrowdStrike to the Market,” and “Partnership Ecosystem,” pp. 7–16.
The company had grown quickly. Its fiscal 2024 subscription customer count rose to 29,000 from 23,019 a year earlier. Dollar-based net retention was 119% at 31 January 2024. These company-wide measures reflected new and existing customers, endpoints and modules; neither isolates the effect of a particular licensing offer. [S1], Item 1, pp. 11–13.
CrowdStrike’s fiscal first-quarter 2025 results, released on 4 June 2024, reported $3.65 billion in ending annual recurring revenue (ARR), including $211.7 million of net new ARR in the quarter. Revenue was $921 million, of which $872.2 million was subscription revenue. Subscription gross margin was 78% under GAAP. Management said customers were increasingly consolidating on the platform. The reported financials described the whole business, not Falcon Flex customer economics. [S2], “Financial Highlights.”
A new commercial model
In September 2023, CrowdStrike introduced Falcon Flex. The company described it as a flexible consumption model that gave customers access to the complete Falcon portfolio and allowed them to expand usage, adopt modules or swap modules as needs changed, without a separate procurement and budget cycle for each change. The announcement positioned Flex as replacing a legacy, inflexible bundling model. It also claimed that the shared agent and console reduced provisioning, deployment and switching costs. Those are CrowdStrike’s product and value claims; the release did not publish customer-level proof or detailed contract terms. [S3], “FalconFlex Licensing Program.”
By 30 April 2024, CrowdStrike reported that 65% of subscription customers had five or more modules, 44% had six or more and 28% had seven or more. The denominator excluded customers on Falcon Go, a package for organizations with 100 or fewer endpoints. The company did not say what share of these customers used Flex, how the module counts changed after adoption, or how active each subscribed module was. [S2], “Recent Highlights” and “Definition of Module Adoption Rates.”
The public record left several commercial questions open. CrowdStrike did not disclose Flex eligibility, minimum commitments, contract duration, module-level entitlements, discounts, usage thresholds, renewal mechanics, customer counts, or cohort margins. It did not reconcile any Flex deal value to ARR, billings, cash received or recognized revenue. This case therefore asks students to choose a direction without treating company-wide growth as evidence that Flex caused it.
The choice
Assume that CrowdStrike’s leadership asks you, on 4 June 2024, to recommend how the company should sell Flex over the next year. This request is hypothetical. Choose one approach:
- Make Flex the leading proposal. Direct the sales organization to lead with Flex in most eligible new-customer and expansion opportunities, presenting broad portfolio access as the simplest route to platform consolidation.
- Keep Flex as a selective option. Lead with the customer’s identified security needs and retain module-by-module purchasing as an equal route. Offer Flex when the customer values broader access, simplified procurement or the ability to adjust module use.
- Refine before broader rollout. Keep Flex available but limit its expansion while defining customer-level usage reviews, renewal checkpoints, sales and customer-success responsibilities, and channel-partner terms. Broaden it after evidence shows which customers benefit.
The company has not publicly disclosed these as alternatives or provided internal results that choose among them. Do not assume that Flex requires customers to use every module or that customers have unlimited use. Treat its actual commercial mechanics as a question for management.
The trade-off is not simply platform versus point products. A flexible offer could reduce friction and make module trials or expansion easier. A broader commitment could also include modules customers do not use, reduce price realization, make value harder to demonstrate, or add pressure to customer-success and channel teams. Keeping product selection open may preserve fit and price clarity, but could leave procurement delays and fragmented deployments unresolved.
CrowdStrike itself described competition across endpoint, network, cloud, identity and services categories. Its 10-K said competitors might have broader portfolios, lower prices or bundle competing products, and warned that discounts can pressure subscription prices and margins. The company also listed platform integration, time to value, price and total cost of ownership among its competition factors. [S1], Item 1, “Competition,” pp. 16–17; Item 1A, “Risk Factors,” pp. 25–26.
The route to market added another consideration. CrowdStrike sold through channel partners and described an open ecosystem of technology integrations. In the June release, it said Falcon for Defender would augment Microsoft Defender deployments, and announced expanded work with AWS, Google Cloud, TCS and HCLTech. Platform expansion could therefore involve partners and incumbent tools as well as a direct customer contract. [S1], “Partnership Ecosystem,” p. 16; [S2], “Recent Highlights.”
Research perspectives
Two studies offer mechanisms to consider; neither estimates Falcon Flex’s effect.
Van der Borgh, Nijssen and Schepers studied post-deployment cross-selling in a survey of 220 U.S. firms that sold business solutions. Their path model associated solution offerings with more cross-selling opportunities, and cross-selling opportunities with higher reported customer satisfaction and financial firm performance. Sales-service cooperation strengthened the relationship between solution offerings and cross-selling; value-assessment tools attenuated it. A negative squared term suggested diminishing satisfaction returns as cross-selling opportunities increased. The study used manager survey measures and a cross-sectional design despite an endogeneity correction; it does not establish a causal effect for security software, a subscription bundle or Flex. [S4], §§3.1–3.7 and Table 2, pp. 126–130.
Chen, Yi, Li and Tong studied when mobile-app developers published on both iOS and Google Play. Their panel covered 138 newly launched health and fitness apps, with 997 app-month observations. In complementary log-log hazard models, Table 3 reports model-specific marginal effects: greater relative ecosystem complexity was associated with lower multihoming, while destination-platform experience and modular complements weakened that relationship. The setting was app-store entry, not enterprise cybersecurity buying, pricing or contract bundling. The results suggest questions about integration costs and complementor incentives; they do not predict CrowdStrike partner or customer behavior. [S5], research setting and data pp. 636–637; estimation and Table 3 pp. 641–643.
Your assignment
Prepare a two-page memo recommending one approach for Falcon Flex. Address:
- Which customer needs or buying situations make Flex valuable, and where should module-by-module choice remain available?
- How should CrowdStrike demonstrate customer value and avoid equating portfolio access with actual adoption or security outcomes?
- What should sales, customer success and channel partners do before and after a Flex contract?
- What evidence should management review before broadening, revising or limiting the offer?
Use information available by 4 June 2024. Distinguish company claims from measured outcomes and state what evidence would change your recommendation.
Sources
[S1] CrowdStrike Holdings, Inc., Form 10-K for the fiscal year ended 31 January 2024, filed 7 March 2024, SEC accession 0001535527-24-000007. Filing index; 10-K. Sections and printed-page locators cited in text.
[S2] CrowdStrike, “CrowdStrike Reports First Quarter Fiscal Year 2025 Financial Results,” 4 June 2024. Official release. Sections cited in text.
[S3] CrowdStrike, “CrowdStrike Unveils New Data Protection, Exposure Management and IT Automation Innovations to Drive Platform Consolidation,” 19 September 2023. Official release, “FalconFlex Licensing Program.”
[S4] van der Borgh, M., Nijssen, E. J., & Schepers, J. J. L. (2023). “Unleash the Power of the Installed Base: Identifying Cross-selling Opportunities from Solution Offerings.” Industrial Marketing Management, 108, 122–133. Published version, open PDF. https://doi.org/10.1016/j.indmarman.2022.11.010.
[S5] Chen, L., Yi, J., Li, S., & Tong, T. W. (2022). “Platform Governance Design in Platform Ecosystems: Implications for Complementors’ Multihoming Decision.” Journal of Management, 48(3), 630–656. Publisher PDF. https://doi.org/10.1177/0149206320988337.