CrowdStrike Holdings, Inc. CRWD

The business

CrowdStrike sells cybersecurity as a subscription. A single lightweight agent sits on every laptop and server a company owns, watching for attacks, and the analysis happens in CrowdStrike's cloud rather than on the machine. Customers add modules over time: endpoint first, then cloud workloads, identity, and increasingly the log management that used to belong to other vendors.

The land-and-expand model is the whole economic engine. Just over half of customers use six or more modules, and each additional one costs CrowdStrike almost nothing to deliver because the agent is already installed. That is why the free cash flow margin keeps rising while the reported operating line stays negative.