CRWD · CIK 1535527
What CrowdStrike Holdings, Inc. told the SEC could break it.
CrowdStrike's disclosures cluster on the foundations its Falcon platform runs on and the rules that govern it. It relies on third-party data centers such as Amazon Web Services, alongside its own colocation facilities in the U.S. and Europe, to host and operate Falcon, so disruption there could degrade performance and reliability. Because its products, services and collection of cyber-threat information involve encryption and threat intelligence, they are subject to U.S. export controls and OFAC sanctions — including bars on sales to embargoed countries and authorization requirements for encryption items — plus foreign licensing rules. It also flags an international footprint, with about 33% of fiscal 2026 revenue from overseas customers and R&D centers in Romania, Israel and India, and a dependence on founder-CEO George Kurtz.
4 self-disclosed vulnerabilities, pulled from its own filings — each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Regulatory & policy
- U.S. export controls (EAR) and OFAC trade/economic sanctions on encryption/cyber-threat productsmedium
CrowdStrike's products, services and collection of cyber-threat information are subject to U.S. export controls (Commerce EAR) and OFAC economic/trade sanctions — including prohibitions on sales to embargoed/sanctioned countries and authorization requirements for exporting encryption items — plus foreign import/licensing requirements.
“Our products, services and business activities, including our collection of information about cyber threats, are subject to various restrictions under U.S. export controls and trade and economic sanctions laws, including the U.S. Commerce Department's Export Administration Regulations and economic and trade sanctions regulations maintained by the U.S. Treasury Department's Office of Foreign Assets Control.”
SEC filing →As of 2026
Supplier concentration
- Falcon platform hosted on third-party data centers (AWS) and own colocation facilitiesmedium
CrowdStrike relies on third-party data centers such as AWS and its own colocation data centers (in the U.S. and Europe) to host and operate the Falcon platform; disruption or interference with these facilities could degrade platform performance and reliability and harm the business.
“We rely on third-party data centers, such as Amazon Web Services, and our own colocation data centers to host and operate our Falcon platform, and any disruption of or interference with our use of these facilities may negatively affect our ability to maintain the performance and reliability of our Falc[on platform]”
SEC filing →As of 2026
Geographic concentration
- ~33% of revenue international; R&D centers in Romania, Israel, Indialow
CrowdStrike derived ~33% of total revenue from international customers in fiscal 2026 and is expanding overseas; its R&D leadership is predominantly U.S.-based but it maintains R&D centers in Romania, Israel and India, exposing it to international operational and geopolitical risk.
“We derived approximately 33%, 32%, and 32% of our total revenue from our international customers for fiscal 2026, fiscal 2025, and fiscal 2024, respectively.”
SEC filing →As of 2026
Key person
- dependence on CEO/President George Kurtzlow
CrowdStrike is highly dependent on the services of George Kurtz, its President and CEO, who is described as critical to its future vision and strategic direction; key personnel work on an at-will basis despite employment agreements.
“we are highly dependent on the services of George Kurtz, our President and Chief Executive Officer, who is critical to our future vision and strategic direction.”
SEC filing →As of 2026
The hidden graph
Who it depends on, and who depends on it.
Relationships surfaced from filings — including ones disclosed by the other side, which is how the non-obvious ones come to light.
Its suppliers
Amazon Web Services (Amazon.com, Inc.)
“We rely on third-party data centers, such as Amazon Web Services, and our own colocation data centers to host and operate our Falcon platform, and any disruption of or interference with our use of these facilities may negatively affect our ability to maintain the performance and reliability of our Falc[on platform]”
Cited →
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch