Net Retention From 125% to 115%Narrow moat

CrowdStrike (CRWD) — moat facet

CrowdStrike's customers still spend 15% more each year, but the expansion rate fell ten points before the outage finished the job.

Net retention measures what existing customers spend a year later, after upsell and after losses. CrowdStrike's figure has told a clear story: 124% at January 20201, 125% at January 20212, 123.9% at January 20223 and 125.3% at January 20234. Then it fell to 119% at January 20245 and 112% at January 20256, before recovering to 115% at January 20267.

Dollar-based net retention at 31 January (%)124%2020125%2021123.9%2022125.3%2023119%2024112%2025115%2026CrowdStrike Forms 10-K FY2020-FY2026
Down ten points in two years, up three since.

Two things drove the fall and only one of them is the outage. The drop from 125.3% to 119% happened before July 2024. The drop from 119% to 112% came in the year of the incident, when the customer commitment packages offered discounts, extra modules and longer terms.

The recovery is visible in net new ARR, the annual recurring revenue added in a period after churn. It was $332.8 million in the quarter to 31 July 2026, a record and up 51% on the $221.1 million a year earlier89. The chief financial officer said the quarter brought "increased dollar-based gross and net retention rates"10.

For the moat this is a qualified yes. A 115% net retention rate means the average existing customer spends 15% more each year, which is the expansion engine working. But the engine now runs at a lower speed than it did before fiscal 2024, and the company has not said whether it can get back to 125%.

The measure is built on ARR. CrowdStrike compares the ARR of a set of subscription customers with the same customers' ARR a year earlier, so the rate captures renewals, expansion, contraction and churn together11. A customer that leaves, one that downgrades and one that buys three new modules all land in the same figure.

Net new ARR is the quarterly read on it. A return to year-on-year declines, like the fall from $875.5 million in fiscal 2024 to $806.7 million in fiscal 20251213, would mean the recovery was a rebound from the outage rather than a return of the old expansion rate.

Moat trajectory: Widening

NRR 112% (Jan 2025) to 115% (Jan 2026); net new ARR +51% in Q2 FY2027.

The number that tests this moat
Reported
Net new ARR, latest quarter
$332.8M (Q2 FY2027), up 51%

The quarterly read on expansion; a return to year-on-year declines would mean the recovery was a rebound, not the old engine.

Source: CrowdStrike Q2 FY2027 results release ↗
⚠ Threats to the moat
⚠ THREAT 01
Expansion Slowed Before the Outage
CrowdStrike's net retention fell six points in the year before the outage, so the incident is not the whole story.
References
  1. ReportedCrowdStrike's figure has told a clear story: 124% at January 2020, 125% at January 2021, 123.9% at January 2022 and 125.3% at January 2023.
    CrowdStrike Form 10-K for fiscal 2020 - revenue by type and region for fiscal 2018-2020, ARR of $141.3 million (FY2018) to $600.5 million (FY2020) and net retention of 124%. — FY2020 · publ. March 2020 · source ↗
  2. ReportedCrowdStrike's figure has told a clear story: 124% at January 2020, 125% at January 2021, 123.9% at January 2022 and 125.3% at January 2023.
    CrowdStrike Form 10-K for fiscal 2021 - module adoption, net retention of 125% and revenue by region. — FY2021 · publ. March 2021 · source ↗
  3. ReportedCrowdStrike's figure has told a clear story: 124% at January 2020, 125% at January 2021, 123.9% at January 2022 and 125.3% at January 2023.
    CrowdStrike Form 10-K for fiscal 2022 - revenue by type for fiscal 2020-2022, 16,325 subscription customers, ARR of $1,731.3 million, net retention of 123.9% and revenue by region. — FY2022 · publ. March 2022 · source ↗
  4. ReportedCrowdStrike's figure has told a clear story: 124% at January 2020, 125% at January 2021, 123.9% at January 2022 and 125.3% at January 2023.
    CrowdStrike Form 10-K for fiscal 2023 - 23,019 subscription customers, net retention of 125.3%, net new ARR of $828.4 million, RPO of $3.4 billion and revenue by region. — FY2023 · publ. March 2023 · source ↗
  5. ReportedThen it fell to 119% at January 2024 and 112% at January 2025, before recovering to 115% at January 2026.
    CrowdStrike Form 10-K for fiscal 2024 - 29,000 subscription customers, net retention of 119%, net new ARR of $875.5 million and RPO of $4.6 billion. — FY2024 · publ. March 2024 · source ↗
  6. ReportedThen it fell to 119% at January 2024 and 112% at January 2025, before recovering to 115% at January 2026.
    CrowdStrike Form 10-K for fiscal 2025 - net retention of 112%, RPO of $6.5 billion with 53% due within twelve months, unbilled backlog of $2.8 billion, the Flow Security and Adaptive Shield acquisitions, and revenue and cost changes for fiscal 2025. — FY2025 · publ. March 2025 · source ↗
  7. ReportedThen it fell to 119% at January 2024 and 112% at January 2025, before recovering to 115% at January 2026.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Item 1 business: the Falcon platform, modules, markets, customers, channels, managed service providers, public sector, employees and the Onum and Pangea acquisitions. — FY2026 · publ. 5 March 2026 · source ↗
  8. ReportedIt was $332.8 million in the quarter to 31 July 2026, a record and up 51% on the $221.1 million a year earlier.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - second-quarter results, ARR, net new ARR, margins, module adoption and recent highlights. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  9. ReportedIt was $332.8 million in the quarter to 31 July 2026, a record and up 51% on the $221.1 million a year earlier.
    CrowdStrike second-quarter fiscal 2026 results release, Form 8-K exhibit 99.1 - ARR of $4.66 billion, net new ARR of $221.1 million, over 1,000 Falcon Flex customers and the module-adoption definition excluding Falcon Go customers. — Q2 FY2026 · publ. 27 August 2025 · source ↗
  10. ReportedThe chief financial officer said the quarter brought "increased dollar-based gross and net retention rates".
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  11. ReportedCrowdStrike compares the ARR of a set of subscription customers with the same customers' ARR a year earlier, so the rate captures renewals, expansion, contraction and churn together.
    CrowdStrike Form 10-K for fiscal 2026 (year ended 31 January 2026) - Items 5 and 7: revenue by type and region, what each line contains, how it is invoiced and recognised, and the share structure. — FY2026 · publ. 5 March 2026 · source ↗
  12. ReportedA return to year-on-year declines, like the fall from $875.5 million in fiscal 2024 to $806.7 million in fiscal 2025, would mean the recovery was a rebound from the outage rather than a return of the old expansion rate.
    CrowdStrike Form 10-K for fiscal 2024 - 29,000 subscription customers, net retention of 119%, net new ARR of $875.5 million and RPO of $4.6 billion. — FY2024 · publ. March 2024 · source ↗
  13. ReportedA return to year-on-year declines, like the fall from $875.5 million in fiscal 2024 to $806.7 million in fiscal 2025, would mean the recovery was a rebound from the outage rather than a return of the old expansion rate.
    CrowdStrike Form 10-K for fiscal 2025 - net retention of 112%, RPO of $6.5 billion with 53% due within twelve months, unbilled backlog of $2.8 billion, the Flow Security and Adaptive Shield acquisitions, and revenue and cost changes for fiscal 2025. — FY2025 · publ. March 2025 · source ↗
Sources
Generated September 28, 2026