Six, Seven, Eight ModulesNarrow moat

CrowdStrike (CRWD) — moat facet

Half of CrowdStrike's subscription customers now run six or more of its modules, and each extra module makes leaving harder.

The evidence that customers buy more than one thing from CrowdStrike is a table the company updates every quarter. At 31 July 2026, 51% of subscription customers had six or more modules, 35% had seven or more and 26% had eight or more1.

Subscription customers with six or more modules (%)24%Jan 202134%Jan 202239%Jan 202343%Jan 202448%Jan 202551%Jul 2026CrowdStrike 10-Ks and results releases; from Q2 FY2026 excludes Falcon Go customers
From a quarter of customers to half in five years.

The path matters more than the level. At 31 January 2021, 24% of customers had six or more modules2. That rose to 34% a year later3, 39% at January 20234 and 43% at January 20245. The eight-module figure, first published at 20% in October 20246, reached 24% at January 20267 and 26% by July8.

A customer with eight modules is a different relationship from a customer with one. It is using CrowdStrike for endpoint protection, cloud workloads, identity and more, and replacing the vendor would mean replacing all of them, on every machine, at the same time. That is the switching cost this business is built on.

The definition changed in the second quarter of fiscal 2026. Since then the percentages divide by subscription customers "excluding Falcon Go customers"9, the bundle for organisations with 100 endpoints or fewer. Leaving the smallest customers out raises the ratios, so the old and new series are not strictly comparable. Under the old definition 48% had six or more modules at January 202510; under the new one the figure was also 48% at July 202511.

The lower tiers have dropped out of the disclosure entirely. At January 2022, 69% of subscription customers had four or more modules and 57% had five or more12. The company has since moved its headline thresholds up to six, seven and eight, which is itself a sign of how far the base has moved.

The trend has slowed. From July 2025 to July 2026 the six-module figure moved only from 48% to 51%1314. The moat argument needs this line to keep rising: a customer at six modules today should be at seven next year. If the six-or-more share stalls at about half for four quarters, the cross-sell that justifies the platform has run into the customers who only want the basics.

Moat trajectory: Widening

Six-or-more share 24% (Jan 2021) to 51% (Jul 2026).

The number that tests this moat
Reported
Customers with six or more modules
51% (Jul 2026), from 48% a year earlier

The cross-sell that makes leaving expensive; four quarters stalled near half would mean the platform has reached the customers who want only the basics.

Source: CrowdStrike Q2 FY2027 results release ↗
⚠ Threats to the moat
⚠ THREAT 01
Falcon Go Left Out of the Denominator
CrowdStrike dropped its smallest customers from the module-adoption base, lifting the ratios without a new sale.
References
  1. ReportedAt 31 July 2026, 51% of subscription customers had six or more modules, 35% had seven or more and 26% had eight or more.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  2. ReportedAt 31 January 2021, 24% of customers had six or more modules.
    CrowdStrike Form 10-K for fiscal 2021 - module adoption, net retention of 125% and revenue by region. — FY2021 · publ. March 2021 · source ↗
  3. ReportedThat rose to 34% a year later, 39% at January 2023 and 43% at January 2024.
    CrowdStrike Form 10-K for fiscal 2022 - revenue by type for fiscal 2020-2022, 16,325 subscription customers, ARR of $1,731.3 million, net retention of 123.9% and revenue by region. — FY2022 · publ. March 2022 · source ↗
  4. ReportedThat rose to 34% a year later, 39% at January 2023 and 43% at January 2024.
    CrowdStrike fourth-quarter and fiscal 2023 results release, Form 8-K exhibit 99.1 - revenue by type and module adoption for fiscal 2023. — Q4 FY2023 · publ. 7 March 2023 · source ↗
  5. ReportedThat rose to 34% a year later, 39% at January 2023 and 43% at January 2024.
    CrowdStrike fourth-quarter and fiscal 2024 results release, Form 8-K exhibit 99.1 - revenue, free cash flow, capital expenditure, interest income and module adoption for fiscal 2024. — Q4 FY2024 · publ. 5 March 2024 · source ↗
  6. ReportedThe eight-module figure, first published at 20% in October 2024, reached 24% at January 2026 and 26% by July.
    CrowdStrike third-quarter fiscal 2025 results release, Form 8-K exhibit 99.1 - over 97% gross retention and 20% of customers with eight or more modules. — Q3 FY2025 · publ. 26 November 2024 · source ↗
  7. ReportedThe eight-module figure, first published at 20% in October 2024, reached 24% at January 2026 and 26% by July.
    CrowdStrike fourth-quarter and fiscal 2026 results release, Form 8-K exhibit 99.1 - fourth-quarter and full-year results, ARR, retention and module adoption. — Q4 FY2026 · publ. 3 March 2026 · source ↗
  8. ReportedThe eight-module figure, first published at 20% in October 2024, reached 24% at January 2026 and 26% by July.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
  9. ReportedSince then the percentages divide by subscription customers "excluding Falcon Go customers", the bundle for organisations with 100 endpoints or fewer.
    CrowdStrike second-quarter fiscal 2026 results release, Form 8-K exhibit 99.1 - ARR of $4.66 billion, net new ARR of $221.1 million, over 1,000 Falcon Flex customers and the module-adoption definition excluding Falcon Go customers. — Q2 FY2026 · publ. 27 August 2025 · source ↗
  10. ReportedUnder the old definition 48% had six or more modules at January 2025; under the new one the figure was also 48% at July 2025.
    CrowdStrike fourth-quarter and fiscal 2025 results release, Form 8-K exhibit 99.1 - 97% gross retention, module adoption and Falcon Flex deal value. — Q4 FY2025 · publ. 4 March 2025 · source ↗
  11. ReportedUnder the old definition 48% had six or more modules at January 2025; under the new one the figure was also 48% at July 2025.
    CrowdStrike second-quarter fiscal 2026 results release, Form 8-K exhibit 99.1 - ARR of $4.66 billion, net new ARR of $221.1 million, over 1,000 Falcon Flex customers and the module-adoption definition excluding Falcon Go customers. — Q2 FY2026 · publ. 27 August 2025 · source ↗
  12. ReportedAt January 2022, 69% of subscription customers had four or more modules and 57% had five or more.
    CrowdStrike Form 10-K for fiscal 2022 - revenue by type for fiscal 2020-2022, 16,325 subscription customers, ARR of $1,731.3 million, net retention of 123.9% and revenue by region. — FY2022 · publ. March 2022 · source ↗
  13. ReportedFrom July 2025 to July 2026 the six-module figure moved only from 48% to 51%.
    CrowdStrike second-quarter fiscal 2026 results release, Form 8-K exhibit 99.1 - ARR of $4.66 billion, net new ARR of $221.1 million, over 1,000 Falcon Flex customers and the module-adoption definition excluding Falcon Go customers. — Q2 FY2026 · publ. 27 August 2025 · source ↗
  14. ReportedFrom July 2025 to July 2026 the six-module figure moved only from 48% to 51%.
    CrowdStrike second-quarter fiscal 2027 results release, Form 8-K exhibit 99.1 - ARR, net new ARR, Falcon Flex, module adoption and retention. — Q2 FY2027 · publ. 26 August 2026 · source ↗
Sources
Generated September 28, 2026