Growing organizations keep adding CrowdStrike seats and AI workloads, while a cluster of large enterprises folds security into the stacks they already license.
When technology leaders explain why their CrowdStrike spend is moving, two very different stories emerge. One is about growth: more employees, more endpoints, more AI workloads, and a security platform that scales alongside all of it. The other is about gravity: large enterprises pulling security into the broader technology stacks they already pay for, even when they like the product they are leaving.
ETR's Edge Report on CrowdStrike gathered qualitative commentary from 24 technology leaders, 13 planning to increase spend and 11 planning to decrease it over the next six months. Their reasoning offers a clear view of where CrowdStrike's momentum comes from and where it is most exposed.
Growth drives the gains. Most increasers tie higher spend to business growth, and few are pulling budget from a rival to do it.
AI is a tailwind, with a twist. AI-driven security needs lift spend for some accounts, while AI agents shrink the headcount that seats depend on for others.
Consolidation drives the losses. Most decreasers point to vendor consolidation, often onto Microsoft licenses they already own.
The broader spending data backs up the growth story. In ETR's Technology Spending Intentions Survey (TSIS), CrowdStrike's Net Score has recovered to its highest level since the July 2024 outage.
CrowdStrike Net Score by TSIS survey, January 2024 through October 2026 (October data preliminary). Source: ETR Technology Spending Intentions Survey.
Among increasers, the dominant pattern is organic expansion: more people, more devices, and CrowdStrike spend rising in step. For these organizations, CrowdStrike is less a line item under review than infrastructure that grows with the business.
"It is our primary tool for protecting employees," said a VP at a North American Fortune 1000 IT/TelCo company. Another called CrowdStrike their "main strategic cyber security partner."
Notably, this growth is largely additive, with few accounts pulling budget from rivals. That is healthy for retention, but it also ties CrowdStrike's upside to its customers' own growth.
Others are expanding into additional modules. An Architect at a small North American Healthcare/Pharma company pointed to "rapid return on investment as it provides accelerated incident response."
AI shows up on both sides of the ledger. For some increasers, it is a direct reason to spend more.
A C-level leader at a small North American IT/TelCo company cited an "increase in agents and agentic workload" and the "need for increased security in an AI world." That same leader admitted the company had been shopping for alternatives before choosing to stay: "We were looking for a replacement for a while but have decided to renew. They're the core of our security stack."
On the other side, AI becomes a reason to spend less. Another C-level respondent at a small IT/TelCo company is reducing CrowdStrike spend because the organization is "moving to AI agents so headcount is being reduced." When seats track people, fewer people means fewer seats.
The decreaser side reads very differently. Consolidation dominates, and Microsoft is the most frequently named destination as organizations lean on security licenses they already own.
"This is a long-term objective to put as much as we can with the Microsoft technology stack," said a C-level leader at a large North American Nonprofit organization. For these accounts, the decision often has less to do with CrowdStrike's performance than with the economics of a bundle.
A Director at a large North American Services/Consulting company called CrowdStrike "a well suited solution, one of our favorites," before explaining that "due to commercial negotiations, some BUs decided to move to another."
Cost also plays a role. An Architect at a small North American IT/TelCo company put it plainly: "We are cutting our CrowdStrike spend because the price creeps up fast and starts to feel oversized for what our lean teams actually use. With our budgets tightening, we don't necessarily want or need the Ferrari here."
Even that account did not dismiss the product. The same Architect described CrowdStrike as "basically our 'don't get wrecked at 2am' insurance." Several decreasers also plan to keep CrowdStrike in a narrower role, leaving a foothold for future expansion.
CrowdStrike's position looks strongest where customers are growing and weakest where they are consolidating. The platform continues to earn loyalty on quality, and AI workloads are opening new demand, but bundled licensing from platform giants remains the most persistent threat. The question for investors and vendors alike is whether CrowdStrike's growth accounts can outpace that consolidation pull.
The August 2026 CrowdStrike Edge Report details every account's commentary, including which platforms decreasers are moving to and why. To see where the competitive pressure is coming from, contact service@etr.ai.