CrowdStrike (2011-2024): from cloud-native cybersecurity SaaS leader to the largest IT outage in history

The 2011-2019 build and IPO

CrowdStrike was founded in 2011 by George Kurtz and Dmitri Alperovitch. Kurtz had been CTO of McAfee and had founded Foundstone (acquired by McAfee in 2004). The founding thesis was cloud-native endpoint security: replacing legacy on-premises antivirus (signature-based, slow to update, agent-heavy) with a cloud-managed agent that collected endpoint telemetry, analysed it centrally, and pushed real-time threat intelligence to all customers simultaneously. The Falcon platform was designed cloud-first from the start, in contrast to incumbent security vendors who had retrofitted cloud-management onto on-premises products.

CrowdStrike's 2014 detection and attribution of the Sony Pictures hack (publicly linking the attack to North Korea) was a defining brand moment that built credibility with US government and enterprise customers. Through 2014-2019 the company scaled rapidly. The June 12, 2019 IPO priced at $34 per share, well above the marketed range. Day-one trading opened at $63.50 (+87%) and the company reached over $11 billion market cap by close. The IPO was one of the most successful cybersecurity SaaS listings in history.

The 2019-2024 scaling

Through 2019-2024 CrowdStrike scaled to category-leading position in endpoint detection and response (EDR). Revenue grew from approximately $250M in FY2018 to over $3 billion in FY2024. The customer base expanded to over 24,000 customers including most Fortune 500 enterprises, US government agencies, and major banks, healthcare systems, and other critical-infrastructure operators. The Falcon platform expanded beyond endpoint security into broader cybersecurity services (identity protection, cloud workload protection, threat intelligence, managed detection and response).

The competitive position was strong. CrowdStrike won market share from incumbent vendors (Symantec, McAfee, Trend Micro) and competed against fast-growing alternatives (SentinelOne, Microsoft Defender, Palo Alto Cortex XDR). The category-leading EDR position translated into broader cybersecurity platform position and produced strong customer-retention metrics (gross retention above 97% and net retention above 120% across the period). Stock performance through 2019-2024 was substantial, with CrowdStrike reaching a $100+ billion market cap at peaks before the July 2024 outage.

The July 19, 2024 outage

On July 19, 2024 CrowdStrike pushed an update to Falcon Sensor (Channel File 291) that contained mismatched input fields — the Falcon sensor expected 20 input fields but the update provided 21. The mismatch caused an out-of-bounds memory read, which triggered Windows kernel-level crashes (Blue Screen of Death, BSOD) on Falcon-protected systems. Approximately 8.5 million Windows endpoints globally were affected. Because the systems crashed at kernel level, many could not be restarted automatically and required manual intervention from IT staff.

The downstream impact was extraordinary. Airlines were among the most visible affected industries: Delta Air Lines, United, American, and many international carriers had to ground or significantly delay flights. A total of 5,078 flights globally were cancelled that day — approximately 4.6 percent of scheduled flights. Airports, banks, hospitals, retail stores, broadcasting, emergency services, and government agencies all experienced disruptions of varying severity. The total financial damage was estimated in the tens of billions of dollars globally. The event became widely characterised as the largest IT outage in history.

The post-outage response and how RGM thinks about concentration risk

CrowdStrike's response was direct. The company released a root-cause analysis publicly within days. CEO George Kurtz publicly took responsibility and apologized. The company committed to additional pre-release testing and staged-rollout processes for future updates. CrowdStrike appeared before Congress in September 2024 (Kurtz testified before the House Homeland Security Committee). The company faced substantial customer-trust damage, contractual obligations to affected customers, securities litigation, and broader regulatory scrutiny. Stock declined sharply post-outage but has recovered substantially through 2024-2025.

When clients ask about cybersecurity-vendor concentration risk, the July 2024 CrowdStrike outage is the defining recent cautionary example. Three structural lessons. First, the concentration is real and structurally hard to avoid. CrowdStrike Falcon's market-leading position means a large share of Windows endpoints globally rely on Falcon for security; a Falcon failure affects everyone simultaneously. Second, the kernel-level access required for endpoint detection produces both stronger security and higher blast radius from bugs. Vendors with kernel access can detect threats other approaches cannot, but bugs in that code cascade into kernel-level system failures rather than user-space-recoverable failures. Third, the testing-and-rollout discipline required for kernel-level critical software is structurally higher than typical SaaS standards; CrowdStrike's post-outage commitments are intended to elevate that discipline. The pattern is hard to avoid in concentrated critical-infrastructure categories — clients in those categories should think about multi-vendor strategies and contingency plans for vendor-specific failures even when the vendor is otherwise credible.

Frequently asked questions

Related