Overview
CrowdStrike Holdings is a publicly listed cybersecurity vendor (NASDAQ: CRWD) headquartered in Austin, Texas. The company reported total revenue of US$4.81 billion for fiscal year ended 31 January 2026, of which roughly US$247 million came from professional services. CrowdStrike Services is the consulting and incident-response arm of the company, tightly coupled to the Falcon platform and the Charlotte AI agent layer.
The services practice focuses on incident response, proactive compromise assessment, red team and adversary emulation, threat hunting through OverWatch, and managed detection and response through Falcon Complete. Engagements are typically Falcon-platform-aligned — telemetry is ingested into Falcon during the engagement, which both accelerates investigation and creates pull-through to the subscription business. CrowdStrike maintains a deep threat intelligence function, publishing the annual Global Threat Report and tracking 245+ named adversaries.
Buyers engage CrowdStrike Services when they need fast incident response on endpoint or identity attacks, particularly nation-state and ransomware engagements. The July 2024 Falcon sensor outage prompted scrutiny of release engineering practices; CrowdStrike has since published Resilient by Design controls and a customer-managed deployment ring framework. The firm is less suitable for buyers seeking a platform-agnostic advisor or those committed to a competing EDR.
Services Offered
- Incident response and digital forensics (Services Retainer)
- Compromise assessment and proactive threat hunting
- Red team, purple team, and adversary emulation exercises
- Falcon Complete managed detection and response (MDR)
- Identity threat detection, Active Directory hardening
- Cloud security posture assessment and Falcon Cloud Security deployment
- Tabletop exercises and CISO advisory services
- Ransomware preparedness and recovery readiness assessments
- SOC modernisation and Charlotte AI agentic security operations
- Threat intelligence subscriptions and dark web monitoring
Typical Engagement
| Engagement Type | Model | Typical Range |
|---|---|---|
| Compromise assessment | Fixed-fee project | $75K–$300K (3–8 weeks) |
| Incident response engagement | Time & materials, retainer-drawdown | $250K–$5M+ (incident-dependent) |
| Falcon Complete MDR | Annual subscription, per endpoint | $8–$25 per endpoint/month |
| Services retainer (proactive hours) | Monthly or annual retainer | $15K–$150K per month |
| IR consultant (staff augmentation) | Hourly bill rate | $350–$650/hour |
Pricing verified May 2026 from public procurement data and reference checks; ranges vary by region and engagement structure.
Strengths
- Among the fastest incident response mobilisation times in the market — typical engagement onsite or remote within 24 hours
- Falcon telemetry integration shortens dwell-time investigations compared with tool-agnostic responders
- Deep threat intelligence — 245+ tracked adversary groups, OverWatch human-led hunting
- Strong identity attack-path expertise following the acquisitions of Preempt Security and Reposify
- High consultant retention in the IR practice relative to the consulting tier-1s
- Charlotte AI agentic SOC capability differentiates managed services from pure tooling
Limitations
- Strong commercial tie-in to the Falcon platform — engagements typically push customers toward subscription consumption
- Less suitable for tool-agnostic strategy work or for buyers committed to Microsoft Defender, SentinelOne, or Palo Alto Cortex
- July 2024 Falcon sensor outage continues to raise change-management and release-engineering questions in RFPs
- Smaller advisory bench compared with Big Four and tier-1 SIs — limited reach into governance, GRC, and policy
- Hourly IR rates among the highest in the industry — cost can escalate quickly during prolonged incidents