Cyber: who supplies, buys from and competes with CrowdStrike
12 companies in 7 groups, centered on CrowdStrike. Each company below says what it does and why it matters here, and each relationship says what flows between two companies; dollar figures name the filing or release they come from. On the interactive map, prices and company figures refresh with the market.
The Adversary · The Cloud Giants · The Falcon · The Platform War · The Network Guard · The Keys & Vault · The CISO · Relationships
The Adversary
Why this whole map exists — and why the budgets never shrink
The Adversary
Nation-state crews, ransomware gangs, and social-engineering outfits — now armed with AI that writes the phishing and finds the exploits. Every breach headline is a budget line for everyone to the right.
The Cloud Giants
The rails security runs on — and the trillion-dollar rivals who bundle it
AMZN — Amazon (AWS)
The infrastructure and storefront Falcon sells through: CrowdStrike became the first cloud-native cybersecurity ISV to exceed $1B in annual AWS Marketplace sales (CrowdStrike Q4 FY2025 release, 2025-03-04), and Falcon for AWS is sold there with pay-as-you-go metered billing (CrowdStrike 10-K FY2026).
Check the data: Yahoo Finance quote & financials · Find SEC filings
MSFT — Microsoft
The industry’s frenemy: Defender for Endpoint competes with endpoint security vendors (Microsoft 10-K FY2026), and Defender, Sentinel, and Entra ship bundled with Microsoft licenses — the "good enough and already paid for" pitch every pure-play on this map has to beat.
Why it matters: The bundling threat that caps every pure-play’s pricing power — and the operating system the July 19, 2024 Falcon update crashed: Microsoft estimated 8.5 million Windows devices were affected (Microsoft blog, 2024-07-20).
Check the data: Yahoo Finance quote & financials · Find SEC filings
GOOGL — Alphabet (Google Cloud)
Bought its way into the room: Wiz for cloud security — closed March 11, 2026 for $29.5B after adjustments and folded into Google Cloud (Alphabet 10-Q Q2 2026).
Check the data: Yahoo Finance quote & financials · Find SEC filings
The Falcon
The cloud-native endpoint platform that became the industry’s consolidation bet
CRWD — CrowdStrike
The center of the map: the Falcon platform started as a single lightweight sensor and grew into cloud security, identity protection, Next-Gen SIEM, and exposure management sold as modules on one console, with Charlotte AI as the agentic layer on top (CrowdStrike 10-K FY2026).
Why it matters: The cleanest read on whether security consolidates onto a few platforms or stays a hundred point products. Every rival on this map is either trying to bundle Falcon away, out-platform it, or plug into it.
Outlook: ARR grew 25% to $5.84B at July 31, 2026, with a record $333M of net new ARR in the quarter, and ARR from accounts on Falcon Flex, the consumption licensing model, passed $2.29B, up 101% (CrowdStrike Q2 FY2027 release).
Check the data: Yahoo Finance quote & financials · Find SEC filings
The Platform War
Everyone wants to be the one vendor the CISO keeps
PANW — Palo Alto Networks
The other consolidation bet: Nikesh Arora’s "platformization" strategy sells network (Strata), cloud (Prisma), and SOC (Cortex XSIAM) as one stack, and the CyberArk acquisition — closed February 11, 2026 for $21.1B of purchase consideration — added identity security (Palo Alto 10-K FY2026).
Outlook: Revenue grew 24% to $11.48B in fiscal 2026 and next-generation security ARR reached $9.1B (Palo Alto 10-K FY2026), a bet that customers standardizing on two or three platforms will pick Palo Alto for network-plus-SOC.
Check the data: Yahoo Finance quote & financials · Find SEC filings
S — SentinelOne
The endpoint challenger that never caught the leader: Singularity competes head-on with Falcon on EDR, Purple AI is its answer to Charlotte, and it lives off deals where a CISO wants a credible second source — or a cheaper one.
Check the data: Yahoo Finance quote & financials · Find SEC filings
The Network Guard
Firewalls, zero trust, and the edge — where the packets get inspected
FTNT — Fortinet
The firewall maker with a margin structure few on this map match: FortiGate appliances run on Fortinet’s own ASICs, and it earned $1.85B on $6.80B of revenue in 2025, a 27% net margin (Fortinet 10-K 2025).
Check the data: Yahoo Finance quote & financials · Find SEC filings
CSCO — Cisco
The networking incumbent that paid about $27B for Splunk in March 2024 to own the SOC data layer (Cisco 10-K FY2026), then fused it with its firewalls and Hypershield into a security business sold through its enterprise sales force.
Check the data: Yahoo Finance quote & financials · Find SEC filings
ZS — Zscaler
The zero-trust pioneer: the Zero Trust Exchange replaces the corporate firewall perimeter with a cloud proxy that inspects every connection, and the Red Canary acquisition (August 2025) added managed detection to sell the SOC alongside the network (Zscaler 10-K FY2026).
Check the data: Yahoo Finance quote & financials · Find SEC filings
NET — Cloudflare
The "connectivity cloud": a global edge network that started as DDoS protection and CDN and now sells zero-trust access, SASE, and AI-agent security (plus Workers, its developer platform) to the same buyers Zscaler chases.
Check the data: Yahoo Finance quote & financials · Find SEC filings
The Keys & Vault
Who you are and what you can recover — identity and data resilience
OKTA — Okta
The independent identity layer — single sign-on and access management for the workforce and for customer apps — squeezed between Microsoft Entra bundling from above and Palo Alto’s CyberArk push from the side, now pitching identity for AI agents as its next act.
Check the data: Yahoo Finance quote & financials · Find SEC filings
RBRK — Rubrik
Backup reinvented as cyber resilience: it sells the immutable copy of your data that lets a company recover from ransomware without paying.
Check the data: Yahoo Finance quote & financials · Find SEC filings
The CISO
Where the money ultimately comes from
Enterprises
The one budget a board never cuts after a breach. The fight on this map is over how many vendors each CISO keeps.
Governments
The federal channel: FedRAMP authorizations and Pentagon cloud and contractor rules — slow to win, sticky once won.
Relationships on the map
- Amazon (AWS) supplies CrowdStrike — AWS rails & Marketplace
AWS Marketplace is a major Falcon sales channel — CrowdStrike was the first cloud-native cybersecurity ISV to exceed $1B in annual AWS Marketplace sales (CrowdStrike Q4 FY2025 release, 2025-03-04). - Microsoft competes with CrowdStrike — Defender vs Falcon
Defender for Endpoint competes with endpoint security vendors (Microsoft 10-K FY2026); every Falcon renewal is a fight against "we already pay for Microsoft." - Microsoft partners with CrowdStrike — Threat-actor naming alliance
In June 2025 the two agreed to map each other’s adversary names so defenders can match reports across vendors (CrowdStrike release, 2025-06-02). - Alphabet (Google Cloud) competes with CrowdStrike — Wiz cloud security
Google’s $29.5B Wiz purchase, closed in March 2026 (Alphabet 10-Q Q2 2026), turned cloud security into a fight between Wiz and Falcon Cloud Security. - Alphabet (Google Cloud) competes with Palo Alto Networks — Wiz vs Prisma Cloud
Prisma Cloud now competes with a Google-owned Wiz sold through Google Cloud (Alphabet 10-Q Q2 2026). - CrowdStrike competes with Palo Alto Networks — The consolidation war
Falcon Flex vs platformization: both sell the CISO the same dream of fewer vendors, from opposite starting points (endpoint vs network). - CrowdStrike competes with SentinelOne — EDR turf
Singularity is the credible alternative endpoint agent — SentinelOne wins on price and second-source deals, CrowdStrike on platform breadth. - Palo Alto Networks competes with Fortinet — The firewall crown
Palo Alto sells the premium next-gen firewall; Fortinet competes on custom ASICs and price — the oldest rivalry on the map. - Palo Alto Networks competes with Zscaler — SASE & zero trust
Prisma Access vs the Zero Trust Exchange for the corporate network that no longer has a perimeter. - Cisco competes with CrowdStrike — Splunk vs Next-Gen SIEM
Falcon Next-Gen SIEM is built to pull security data — and the budget — out of Splunk, the incumbent Cisco paid about $27B for (Cisco 10-K FY2026). - Zscaler competes with Cloudflare — Zero-trust edge
Two cloud edges selling the same replacement for the VPN and firewall: Zscaler from security, Cloudflare from the network up. - Zscaler partners with CrowdStrike — Zero-trust integration
Zscaler data feeds Falcon Next-Gen SIEM, and Zscaler calls the integration a joint commitment with CrowdStrike (CrowdStrike release, 2024-05-07). - Okta partners with CrowdStrike — Identity signals
Okta’s identity data is one of the named sources integrated into Falcon Next-Gen SIEM (CrowdStrike release, 2024-05-07). - Palo Alto Networks competes with Okta — The CyberArk land grab
Buying CyberArk in February 2026 made Palo Alto an identity-security vendor, putting the platform giant on Okta’s turf (Palo Alto 10-K FY2026). - Rubrik partners with CrowdStrike — Recovery meets detection
Rubrik’s data-security telemetry integrates with Falcon Next-Gen SIEM so a ransomware detection and the clean recovery point live in the same workflow (CrowdStrike release, 2024-05-07). - CrowdStrike supplies Enterprises — Falcon subscriptions (~$5B/yr)
Total revenue of $4,812M in the fiscal year to January 2026, $4,565M of it subscriptions (CrowdStrike 10-K, fiscal 2026). - Palo Alto Networks supplies Enterprises — Platform stack (~$11B/yr)
Firewalls, subscriptions, and now CyberArk identity: total revenue of $11,480M in the fiscal year to July 2026 (Palo Alto 10-K, fiscal 2026). - Fortinet supplies Enterprises — Firewalls & services (~$7B/yr)
Appliance sales plus the security-subscription and support revenue attached to every FortiGate in the field: revenue of $6,799.6M in 2025 (Fortinet 10-K 2025). - Microsoft supplies Enterprises — Bundled security
Defender, Sentinel, Entra and the rest of Microsoft’s security stack, mostly sold attached to its broader licenses. - CrowdStrike supplies Governments — FedRAMP Falcon
Falcon is authorized by several federal agencies under FedRAMP, and Defense Department organizations can rely on its Impact Level 5 provisional authorization (CrowdStrike 10-K FY2026).