My guesses: -no one really cancels their security vendors since security budgets don't shrink -they have a big moat so their customers won't be able to leave them

I am confused why they are around to begin with.

Companies already trust Microsoft, they buy Windows, Office, Azure.

Why would they bother with a 3rd party here when the low effort low risk solution is to pick the tool made by the OS vendor. I.e. windows defender

It should be a nobody gets fired for picking IBM situation. How did this random place get so much credibility that people trust them over the manufacturer?

crowdstrike has oracle enterprise sales model. have you ever been to one of their events?

Because they provide far more protection than Windows defender. You can write your own custom never-before-seen malware, and CrowdStrike will detect it purely based on behavioral signals. Windows Defender is still largely an antivirus solution.

Microsoft's E5 offerings are a direct competitor to Cloudstrikes threat response products which is a lot more than just Windows Defender on endpoints. I'd imagine many of Cloudstrikes customers will be looking to move this to MS's tools instead as a result of this.

You don’t drop them until budget renewals, at least not for this. Solarwinds comes to mind as a company with a similar kind of thing.

Good news then! You can short it and make a ton of money if you're confident this share price increase is a mistake.

CrowdStrike makes it easy to pass your security audit. That's where the value is.

1. Compliance. No protection at all isn’t a contractual option in many cases.

2. Companies react slowly. When has a vendor paid a high price for failure? Boeing can kill people and fail time after time still sell planes.

Catastrophe always changes less than anticipated.

i replied upthread i think the stock price has bottomed from this event. It's way to hard to switch vendors like this at an enterprise scale. What's going to happen is the cloudstrike account reps are going to get yelled at and abused, some discounts are going to be offered for annual renew, then two years from now all will be forgiven/forgotten. In a year or so the stock price will recover and trend to more or less where it was before this event. I've already bought as much stock as I could.

> It's way to hard to switch vendors like this at an enterprise scale.

Huh? Once you get the control plane/backend of a new AV vendor configured, you just uninstall AppA and deploy AppB on your nodes.

It's not like Crowdstrike is deeply integrated with other systems: it's an agent.

This is massively underselling the kind of change management processes and potential challenges of scale a deployment like this would require at large enterprises. It's never as simple as "deploy app to nodes". Approvals, maintenance windows, deployment in waves (ironic I know, given the nature of the outage in the first place). Most places I've worked would require deployment to many sets lower environment machines of different functions first, then allow time to "bake" and ensure no issues crop up after things have settled. You would NEVER just yeet out a new agent to critical production systems without extensive change management, testing, and validation. I've deployed different AV products multiple times throughout my career (including Crowdstrike). It was never simple, and almost always took months to complete.