CrowdStrike Holdings, Inc. (CRWD)

CrowdStrike protects endpoints from the cloud: an agent on the device, the analysis on the platform side.

The model is subscription-based and modular: the customer installs one agent and then adds modules — intrusion protection, threat hunting, vulnerability management, cloud posture monitoring. Hence the key growth metric is not new customer count but how many modules an existing customer takes on average.

Platform value grows with the number of connected devices: agents send telemetry, detection models train on it, and a large vendor's protection is better by construction. This is the rare case where network effects work in enterprise software.

The industry-specific risk is one's own mistake: a faulty agent update can halt customers' operations worldwide, and the reputational cost of such an outage exceeds the direct one. Competition is dense — Microsoft sells comparable protection inside its enterprise bundle. The company pays no dividend.