CrowdStrike Holdings, Inc.

Previous wording

We have incurred net losses each year prior to fiscal 2024, and we may not achieve or maintain profitability in the future. We experienced net losses of $162.5 million and $15.2 million for fiscal 2026 and 2025, respectively, and net income of $72.2 million for fiscal 2024. As of April 30, 2026, we had an accumulated deficit of $1.3 billion. While we have experienced significant growth in revenue in recent periods, and have achieved profitability during certain periods, including the first quarter of fiscal 2027 and fiscal 2024, we cannot assure you when or whether we will reach sustained profitability. We also expect our operating expenses to increase in the future as we continue to invest for our future growth, which will negatively affect our results of operations if our total revenue does not increase. We also have incurred and expect to continue to incur significant additional legal, accounting, and other expenses as a public company. Any failure to increase our revenue as we invest in our business or to manage our costs could prevent us from achieving or maintaining profitability or positive cash flow.

Current wording

We have incurred net losses each year prior to fiscal 2024, and we may not achieve or maintain profitability in the future. We experienced net losses of $162.5 million and $15.2 million for fiscal 2026 and 2025, respectively, and net income of $72.2 million for fiscal 2024. As of July 31, 2026, we had an accumulated deficit of $1.2 billion. While we have experienced significant growth in revenue in recent periods, and have achieved profitability during certain periods, including the first and second quarters of fiscal 2027 and fiscal 2024, we cannot assure you when or whether we will reach sustained profitability. We also expect our operating expenses to increase in the future as we continue to invest for our future growth, which will negatively affect our results of operations if our total revenue does not increase. We also have incurred and expect to continue to incur significant additional legal, accounting, and other expenses as a public company. Any failure to increase our revenue as we invest in our business or to manage our costs could prevent us from achieving or maintaining profitability or positive cash flow.

Previous wording

Real or perceived defects, errors or vulnerabilities in our Falcon platform and cloud modules, the failure of our platform to detect or prevent incidents, including advanced and newly developed attacks, misconfiguration of our solutions, or the failure of customers to take action on attacks identified by our platform could harm our reputation and adversely affect our business, financial position and results of operations. Because our cloud native security platform is complex, it has contained, and may in the future contain defects, errors or vulnerabilities that are not detected until after deployment. For example, the July 19 Incident harmed our brand and reputation, business and results of operations. In addition, we identified a transport layer security issue that impacted certain Falcon Linux sensors, which led us to release a security fix and publish a security advisory to remediate the matter in February 2025. If we fail to timely detect defects or errors before deployment in the future, our brand and reputation, business and results of operations will suffer further. We cannot assure you that our products will detect all cyberattacks, especially in light of the rapidly changing security threat landscape that our solution seeks to address. Due to a variety of both internal and external factors, including, without limitation, defects or misconfigurations of our or third-party solutions, our solutions could be or become vulnerable to security incidents (both from intentional attacks and accidental causes) that cause them to fail to secure endpoints and detect and block attacks. Furthermore, any defects, errors or vulnerabilities in third-party technology or solutions we rely on could result in disruptions to our operations and adversely impact our business, financial condition and results of operations. In addition, because the techniques used by computer hackers to access or sabotage networks and endpoints change frequently and generally are not recognized until launched against a target, there is a risk that an advanced attack could emerge that our cloud native security platform is unable to detect or prevent until after some of our customers are affected. Additionally, our Falcon platform may falsely indicate a cyberattack or threat that does not actually exist, which may lessen customers’ trust in our solutions.

Current wording

Real or perceived defects, errors or vulnerabilities in our Falcon platform and cloud modules, the failure of our platform to detect or prevent incidents, including advanced and newly developed attacks, misconfiguration of our solutions, or the failure of customers to take action on attacks identified by our platform could harm our reputation and adversely affect our business, financial position and results of operations. Because our cloud native security platform is complex, it has contained, and may in the future contain defects, errors or vulnerabilities that are not detected until after deployment. For example, the July 19 Incident harmed our brand and reputation, business and results of operations. As another example, we identified a path traversal vulnerability that impacted certain versions of LogScale, which led us to release a security fix and publish a security advisory to remediate the matter in April 2026. If we fail to timely detect defects or errors before deployment in the future, our brand and reputation, business and results of operations will suffer further. We cannot assure you that our products will detect all cyberattacks, especially in light of the rapidly changing security threat landscape that our solution seeks to address. Due to a variety of both internal and external factors, including, without limitation, defects or misconfigurations of our or third-party solutions, our solutions could be or become vulnerable to security incidents (both from intentional attacks and accidental causes) that cause them to fail to secure endpoints and detect and block attacks. Furthermore, any defects, errors or vulnerabilities in third-party technology or solutions we rely on could result in disruptions to our operations and adversely impact our business, financial condition and results of operations. In addition, because the techniques used by computer hackers to access or sabotage networks and endpoints change frequently and generally are not recognized until launched against a target, there is a risk that an advanced attack could emerge that our cloud native security platform is unable to detect or prevent until after some of our customers are affected. Additionally, our Falcon platform may falsely indicate a cyberattack or threat that does not actually exist, which may lessen customers’ trust in our solutions.

Previous wording

It is virtually impossible for us to entirely eliminate the risk of such attacks, compromises, interruptions in service, or other security incidents affecting our internal systems or data, or that of our third-party service providers and vendors. Organizations are subject to a wide variety of attacks on their supply chain, networks, systems, and endpoints, and techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently. Furthermore, employee error or malicious activity could compromise our systems. As a result, we may be unable to anticipate these techniques or implement adequate measures to prevent an intrusion into our networks, which could result in unauthorized access to customer data, intellectual property including access to our source code, and information about vulnerabilities in our product, which in turn, could reduce the effectiveness of our solutions, or lead to cyberattacks or other intrusions of our customers’ networks, litigation, governmental audits and investigations and significant legal fees, any or all of which could damage our relationships with our existing customers and could have a negative effect on our ability to attract and retain new customers. We have expended, and anticipate continuing to expend, significant resources in an effort to prevent security breaches and other security incidents impacting our systems and data. Since our business is focused on providing reliable security services to our customers, we believe that an actual or perceived security incident affecting our internal systems or data or data of our customers would be especially detrimental to our reputation, customer confidence in our solution, and our business.

Current wording

It is virtually impossible for us to entirely eliminate the risk of such attacks, compromises, interruptions in service, or other security incidents affecting our internal systems or data, or that of our third-party service providers and vendors. Organizations are subject to a wide variety of attacks on their supply chain, networks, systems, and endpoints, and techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently. Such attacks are becoming increasingly more sophisticated as threat actors leverage AI technologies. Furthermore, employee error or malicious activity could compromise our systems. As a result, we may be unable to anticipate these techniques or implement adequate measures to prevent an intrusion into our networks, which could result in unauthorized access to customer data, intellectual property including access to our source code, and information about vulnerabilities in our product, which in turn, could reduce the effectiveness of our solutions, or lead to cyberattacks or other intrusions of our customers’ networks, litigation, governmental audits and investigations and significant legal fees, any or all of which could damage our relationships with our existing customers and could have a negative effect on our ability to attract and retain new customers. We have expended, and anticipate continuing to expend, significant resources in an effort to prevent security breaches and other security incidents impacting our systems and data. Since our business is focused on providing reliable security services to our customers, we believe that an actual or perceived security incident affecting our internal systems or data or data of our customers would be especially detrimental to our reputation, customer confidence in our solution, and our business.

Previous wording

We derived approximately 32%, 32%, 33% and 34% of our total revenue from our international customers for fiscal 2024, fiscal 2025, fiscal 2026 and the three months ended April 30, 2026, respectively. We are continuing to adapt to and develop strategies to address international markets and our growth strategy includes expansion into target geographies, but there is no guarantee that such efforts will be successful. We expect that our international activities will continue to grow in the future, as we continue to pursue opportunities in international markets. These international operations will require significant management attention and financial resources and are subject to substantial risks, including:

Current wording

We derived approximately 32%, 32%, 33% and 35% of our total revenue from our international customers for fiscal 2024, fiscal 2025, fiscal 2026 and the six months ended July 31, 2026, respectively. We are continuing to adapt to and develop strategies to address international markets and our growth strategy includes expansion into target geographies, but there is no guarantee that such efforts will be successful. We expect that our international activities will continue to grow in the future, as we continue to pursue opportunities in international markets. These international operations will require significant management attention and financial resources and are subject to substantial risks, including:

Previous wording

Additionally, nearly all of our sales contracts are currently denominated in U.S. dollars. However, a strengthening of the U.S. dollar could increase the cost of our solutions to our international customers, which could adversely affect our business and results of operations. In addition, an increasing portion of our operating expenses is incurred outside the United States; is denominated in foreign currencies, such as the Australian Dollar, British Pound, Canadian Dollar, Euro, Indian Rupee, and Japanese Yen; and is subject to fluctuations due to changes in foreign currency exchange rates. If we become more exposed to currency fluctuations and are not able to successfully hedge against the risks associated with currency fluctuations, our results of operations could be adversely affected.

Current wording

Additionally, nearly all of our sales contracts are currently denominated in U.S. dollars. However, a strengthening of the U.S. dollar could increase the cost of our solutions to our international customers, which could adversely affect our business and results of operations. In addition, an increasing portion of our operating expenses is incurred outside the United States; is denominated in foreign currencies, such as the Australian Dollar, British Pound, Canadian Dollar, Euro, Indian Rupee, and Japanese Yen; and is subject to fluctuations due to changes in foreign currency exchange rates. As part of our efforts to manage the variability of foreign currency-denominated operating expenses, we have entered into, and may in the future enter into, foreign currency forward contracts intended to hedge a portion of these expenses. However, our hedging activities may not be effective in meaningfully offsetting the adverse financial impact of foreign currency rate fluctuations. In addition, foreign currency derivative transactions involve risks, including counterparty credit risk, potential cash flow impact upon settlement, and the risk that foreign currency movements differ from our expectations or historical trends, which could render our hedging strategies ineffective or result in losses. If we become more exposed to currency fluctuations and are not able to successfully hedge against the risks associated with currency fluctuations, our results of operations could be adversely affected.

Previous wording

Internationally, virtually every jurisdiction in which we operate has established its own data privacy and security legal framework with which we must comply. For example, we are required to comply with the European Union (“EU”) General Data Protection Regulation (“GDPR”) and its equivalent in the U.K. (“U.K. GDPR”), which impose stringent obligations regarding the collection, control, use, sharing, disclosure and other processing of personal data and create mandatory breach notification requirements under certain circumstances. While the GDPR and U.K. GDPR remain substantially similar for the time being, the U.K. government has adopted reforms to its data protection legal framework in its Data Use and Access Act 2025, which became law on June 19, 2025 (phasing in between June 2025 and June 2026) and will introduce significant changes from the GDPR. This may lead to additional compliance costs and could increase overall risk exposure as businesses may no longer be able to take a unified approach across the European Economic Area (“EEA”) and the U.K., and such businesses may need to amend their processes and procedures to align with the new framework. Implementing mechanisms to endeavor to ensure compliance with the GDPR and the U.K. GDPR may be onerous and expose businesses to divergent parallel regimes that may be subject to potentially different interpretations and enforcement actions for certain violations and related uncertainty. Failure to comply with the GDPR or the U.K. GDPR can result in significant fines and other liability, including, under the GDPR, fines of up to EUR 20 million (or GBP 17.5 million under the U.K. GDPR) or four percent (4%) of annual global revenue, whichever is greater. European data protection authorities have already imposed fines for GDPR violations of up to, in some cases, hundreds of millions of Euros.

Current wording

Internationally, virtually every jurisdiction in which we operate has established its own data privacy and security legal framework with which we must comply. For example, we are required to comply with the European Union (“EU”) General Data Protection Regulation (“GDPR”) and its equivalent in the U.K. (“U.K. GDPR”), which impose stringent obligations regarding the collection, control, use, sharing, disclosure and other processing of personal data and create mandatory breach notification requirements under certain circumstances. While the GDPR and U.K. GDPR remain substantially similar for the time being, the U.K. government has adopted reforms to its data protection legal framework in its Data Use and Access Act 2025, which became law on June 19, 2025 (phased in between June 2025 and June 2026) and introduced significant changes from the GDPR. This may lead to additional compliance costs and could increase overall risk exposure as businesses may no longer be able to take a unified approach across the European Economic Area (“EEA”) and the U.K., and such businesses may need to amend their processes and procedures to align with the new framework. Implementing mechanisms to endeavor to ensure compliance with the GDPR and the U.K. GDPR may be onerous and expose businesses to divergent parallel regimes that may be subject to potentially different interpretations and enforcement actions for certain violations and related uncertainty. Failure to comply with the GDPR or the

Previous wording

We incorporate novel uses of AI technologies, including generative AI, into our products and operations, such as our Falcon platform. AI is complex and rapidly evolving, and we face significant competition from other companies who may incorporate AI into their products more quickly or more successfully than us, as well as an evolving regulatory landscape. The introduction of AI, and particularly generative AI, a relatively new and emerging technology in the early stages of commercial use, into new or existing products, and our operations, may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results. For example, generative AI has been known to produce false or “hallucinatory” interferences or outputs, and certain generative AI uses machine learning and predictive analytics, which may be flawed, insufficient, of poor quality, reflect unwanted forms of bias, or contain other errors or inadequacies, any of which may not be easily detectable. Our customers or others may rely on or use this flawed content to their detriment, which may expose us to brand or reputational harm, competitive harm, and/or legal liability. In addition, the use of AI by other companies has resulted in, and may in the future result in, data breaches and cybersecurity incidents that implicate the personal information of AI users. Further, the use of AI presents emerging ethical, social, legal and other issues, and if we enable or offer solutions that draw scrutiny or controversy due to perceived or actual risks or impacts on customers or on society as a whole, we may experience brand or reputational harm, competitive harm, delays in customer purchasing decisions and/or legal liability. Our continued incorporation of AI, including generative AI, into our products and operations requires us to expend significant resources. If such investments do not deliver anticipated benefits or are not otherwise successful, our business and results of operations may be harmed.

Current wording

We incorporate novel uses of AI technologies, including generative and agentic AI, into our products and operations, such as our Falcon platform. AI is complex and rapidly evolving, and we face significant competition from other companies who may incorporate AI into their products more quickly or more successfully than us, as well as an evolving regulatory landscape. The introduction of AI, and particularly generative and agentic AI, relatively new and emerging technologies in the early stages of commercial use, into new or existing products, and our operations, may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results. For example, generative AI has been known to produce false or “hallucinatory” interferences or outputs, and certain generative AI uses machine learning and predictive analytics, which may be flawed, insufficient, of poor quality, reflect unwanted forms of bias, or contain other errors or inadequacies, any of which may not be easily detectable. Our customers or others may rely on or use this flawed content to their detriment, which may expose us to brand or reputational harm, competitive harm, and/or legal liability. In addition, the use of AI by other companies has resulted in, and may in the future result in, data breaches and cybersecurity incidents that implicate the personal information of AI users. Further, the use of AI presents emerging ethical, social, legal and other issues, and if we enable or offer solutions that draw scrutiny or controversy due to perceived or actual risks or impacts on customers or on society as a whole, we may experience brand or reputational harm, competitive harm, delays in customer purchasing decisions and/or legal liability. Our continued incorporation of AI, including generative and agentic AI, into our products and operations requires us to expend significant resources. If such investments do not deliver anticipated benefits or are not otherwise successful, our business and results of operations may be harmed.

Previous wording

The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, privacy, data protection cybersecurity, consumer protection, competition, and equal opportunity laws and regulations, and are expected to be subject to new laws and regulations or new applications of existing laws and regulations. AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity and data protection laws to AI or are considering general legal frameworks for AI. For example, in the EU, the first set of provisions under the EU’s AI Act became effective in February 2025, with additional provisions becoming effective on later dates. The AI Act establishes, among other things, a risk-based governance framework for regulating AI systems in the EU by categorizing AI systems, based on the risks associated with such AI systems’ intended purposes, as creating unacceptable or high risks, with all other AI systems being considered low risk. This regulatory framework is expected to have a material impact on the way AI is regulated in the EU and beyond. As further indication of a trend in increased regulatory and legislative oversight of the use and development of AI, in 2024, California enacted a range of laws regulating the use and development of AI, which generally relate to transparency, privacy and fairness, among other concerns. Other states, including Texas, Colorado and Utah, have also enacted AI-related laws, and several more have proposed enacting such laws.

Current wording

The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, privacy, data protection cybersecurity, consumer protection, competition, and equal opportunity laws and regulations, and are expected to be subject to new laws and regulations or new applications of existing laws and regulations. AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity and data protection laws to AI or are considering general legal frameworks for AI. For example, in the EU, the first set of provisions under the EU’s AI Act became effective in February 2025, with additional provisions becoming effective on later dates. The AI Act establishes, among other things, a risk-based governance framework for regulating AI systems in the EU by categorizing AI systems, based on the risks associated with such AI systems’ intended purposes, as creating unacceptable or high risks, with all other AI systems being considered low risk. This regulatory framework is expected to have a material impact on the way AI is regulated in the EU and beyond. As further indication of a trend in increased regulatory and legislative oversight of the use and development of AI, in 2024, California enacted a range of laws regulating the use and development of AI, which generally relate to transparency, privacy and fairness, among other concerns. Other states, including Texas, Colorado, Illinois, New York, and Utah, have also enacted AI-related laws, and there have been widespread proposals to enact such laws.

Previous wording

Sales of a substantial number of shares of our common stock in the public market, particularly sales by our directors, executive officers and significant stockholders, or the perception that these sales could occur, could adversely affect the market price of our common stock. As of May 28, 2026, we had 254,564,820 shares of common stock outstanding.

Current wording

Sales of a substantial number of shares of our common stock in the public market, particularly sales by our directors, executive officers and significant stockholders, or the perception that these sales could occur, could adversely affect the market price of our common stock. As of August 20, 2026, we had 1,023,934,842 shares of common stock outstanding.

Previous wording

On July 4, 2025, tax reform legislation included in the One Big Beautiful Bill Act (the “OBBBA”) was enacted in the United States. The tax effects of the OBBBA have been accounted for in the second quarter of the fiscal year 2026. The OBBBA includes significant corporate tax reforms, including (i) the permanent reinstatement of deducting domestic research and development expenditures as incurred beginning in fiscal 2026 (under prior law such expenditures were capitalized and amortized over five years); (ii) the option to claim 100% accelerated depreciation deductions on qualified property; and (iii) international tax provisions modifying global intangible low-taxed income (“GILTI”), foreign-derived intangible income (“FDII”), and base erosion and anti-abuse tax (“BEAT”).

Current wording

On July 4, 2025, tax reform legislation included in the One Big Beautiful Bill Act (the “OBBBA”) was enacted in the United States. The tax effects of the OBBBA have been accounted for in the second quarter of the fiscal 2026. The OBBBA includes significant corporate tax reforms, including (i) the permanent reinstatement of deducting domestic research and development expenditures as incurred beginning in fiscal 2026 (under prior law such expenditures were capitalized and amortized over five years); (ii) the option to claim 100% accelerated depreciation deductions on qualified property; and (iii) international tax provisions modifying global intangible low-taxed income (“GILTI”), foreign-derived intangible income (“FDII”), and base erosion and anti-abuse tax (“BEAT”).