George Kurtz’s “hyperscaler of security” description is a strategy, not an industry classification. In a November 20, 2025 CRN interview, CrowdStrike’s co-founder and CEO argued that the company is combining a cloud-native security platform, a flexible commitment model called Falcon Flex, AWS procurement and a larger partner-delivery role. The practical question for buyers is whether those pieces reduce procurement and operating friction enough to justify a multiyear commitment, migration work and greater dependence on one vendor.
Since that interview, CrowdStrike has extended Flex to services and reported a $1.69 billion ending-ARR cohort of Flex account value in Q4 FY26, growing more than 120% year over year. That is a CrowdStrike-reported account-value measure, not necessarily recognized revenue or customer spending. The original interview’s claims and the later figures therefore need to be kept in their timeframes.
What Kurtz meant by “hyperscaler of security”
Kurtz’s analogy borrows several AWS-like characteristics: a platform with multiple services, consolidation onto one architecture, an ecosystem of partners and third parties, and a commercial model designed to make adding capabilities easier. CrowdStrike says Falcon has been cloud-native since the company was founded in 2011, using a lightweight agent and a growing set of modules.
That does not make CrowdStrike a public-cloud infrastructure provider. It is a security software company. “First hyperscaler of security” is CrowdStrike’s positioning, reported in CRN, rather than an independently defined market category. The useful test is whether the platform, contracts and ecosystem deliver measurable operational and financial benefits.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Relevant company and partner descriptions are available from the November 2025 interview, CRN’s cover story and CrowdStrike’s Falcon partner program.
Falcon Flex in plain English
Falcon Flex is a negotiated, commitment-based licensing agreement. A customer commits to an agreed amount, then draws that balance down over the contract term across eligible CrowdStrike products. Under the agreement’s rules, products can be added or exchanged as requirements change, including newly released capabilities. The stated purpose is to avoid a new procurement and legal cycle every time the security roadmap changes.
The current Falcon Flex description does not publish a universal price list or a complete eligibility matrix. The customer’s contract controls products, conversion rules, minimums, term, expiration, rollover and services treatment.
What Flex is not
- It is not unlimited use of every CrowdStrike product.
- It is not automatically a pure pay-as-you-go plan.
- It is not a guarantee of savings; utilization, negotiated discounts, implementation and services costs determine the outcome.
- It is not the same as an AWS Marketplace meter, even when both are used in one account.
Flex compared with AWS’s Enterprise Discount Program
| Feature | AWS Enterprise Discount Program | CrowdStrike Falcon Flex |
|---|---|---|
| Core commitment | Generally a commitment to spend on eligible AWS services under an AWS contract. | A negotiated commitment to CrowdStrike security products, subject to the agreement. |
| Where value is consumed | Across eligible AWS services and contractual terms. | Across eligible Falcon modules and, in later developments, separate services entitlements. |
| Billing model | AWS contract and AWS billing mechanisms. | CrowdStrike commercial agreement; it may coexist with AWS Marketplace billing. |
| Relationship | Kurtz said AWS’s approach influenced Flex. “Inspired by” or “modeled partly on” is more accurate than “identical.” | |
Why AWS matters to CrowdStrike
Infrastructure since 2011
CrowdStrike says Falcon has run on AWS since 2011. Kurtz presents that long operating relationship as a reason the company learned to run a security platform at cloud scale.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
AWS as customer and partner
Kurtz said AWS is also a CrowdStrike customer. That is an executive statement, not independent validation of every Falcon capability or a guarantee of a particular AWS deployment.
Marketplace procurement
AWS Marketplace can put eligible CrowdStrike purchases on an AWS bill and support usage-based procurement. CrowdStrike’s December 2025 announcement covered Falcon Next-Gen SIEM and Cloud Security access through AWS Marketplace; availability and terms vary by product and geography. See the company announcement and the Marketplace listing.
In June 2026, CrowdStrike announced expanded protection for AI applications built with AWS technologies, including Amazon Bedrock, plus 30-day trials for selected Falcon Next-Gen SIEM, Cloud Security and Endpoint Security offerings through AWS Marketplace. Those are selected offers, not a universal trial or pricing rule; details are in CrowdStrike’s June 2026 announcement.
Example Marketplace meters
AWS Marketplace’s listing showed $0.00595 per MB for 13-month-retention, non-CrowdStrike data in Falcon Next-Gen SIEM, $0.023 per running host-hour for Cloud Security runtime host protection, $0.054 per running worker-node hour for container protection and $0.01 per Fargate instance-hour on August 16, 2026. Rates can change, and AWS infrastructure charges may also apply. These figures are usage examples, not Flex prices.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
What partners are expected to do
Flex creates commercial room for a multiyear roadmap, but it does not perform the transformation. A capable channel partner may need to:
- Inventory endpoint, identity, SIEM, cloud-security, exposure-management and vulnerability tools.
- Map renewal and license-expiration dates to a phased replacement schedule.
- Match required outcomes to specific Falcon modules and model ingestion, retention and cloud-workload costs.
- Redesign SOC workflows, detections, integrations, runbooks and escalation procedures when replacing a legacy SIEM.
- Configure the platform, train staff, provide managed operations and measure adoption.
- Prevent stranded commitment by setting milestones for each drawdown.
Kurtz gave an illustrative example in which a partner could turn a $5 million deal into a $50 million opportunity by doing this mapping and transformation work. That is his example, not evidence that a typical Flex transaction expands tenfold. He also said roughly one-third of partners had completed a Flex deal in the prior two years; the interview did not supply the denominator, geography or partner-tier methodology.
Potential partner economics
- A larger initial consolidation proposal instead of one-module-at-a-time selling.
- Expansion and adoption work as customers draw down commitments.
- Assessment, migration, configuration, SOC transformation, training and managed-service revenue.
- A strategic, multiyear advisory role with greater responsibility for the account outcome.
The same model can increase presales cost, delivery obligations, customer-success expectations and disputes over whether CrowdStrike’s direct team or the partner owns the relationship. Partner-program benefits such as co-selling, incentives and recurring revenue are vendor claims; actual economics depend on tier, geography, distributor terms and delivery capability. Channel information is published at CrowdStrike’s channel-partner page.
What customers should calculate before committing
Flex may fit when
- Several security contracts expire over different dates and a phased replacement is realistic.
- The organization expects to adopt multiple modules and can forecast a credible multiyear roadmap.
- Procurement speed and pre-approved spending authority have material value.
- A trusted internal team or partner can implement and operate the additional capabilities.
Flex may be a poor fit when
- The need is limited to basic endpoint protection.
- Adoption cannot be forecast or the buyer dislikes a large vendor commitment.
- Data ingestion and retention make SIEM costs volatile.
- The organization prefers best-of-breed competition in each category or has little AWS usage.
- Migration, training, managed services or termination costs erase expected license savings.
Questions for the contract
- Which products and services are eligible, and are there conversion ratios?
- Can unused value roll over? What happens at renewal, termination or a product retirement?
- Are professional services included, separately contracted or available through Flex for Services?
- How are ingestion, retention, host, node and container charges calculated?
- Can AWS Marketplace purchases receive the same commercial treatment?
- What onboarding, support and implementation work is included?
- What safeguards prevent overcommitment, and how will adoption be measured?
- Can a partner own delivery and the commercial relationship?
What the July 2024 outage changed commercially
Kurtz said CrowdStrike’s Customer Commitment Program provided compensation or credits through the Flex model and moved some customers onto Flex faster than ordinary renewal cycles. That describes a remediation mechanism, not a benefit of the outage itself. The July 2024 incident caused operational disruption, reputational risk and potential switching costs; Flex does not solve resilience, update-control or rollback requirements.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
What changed by 2026
Flex for Services
On March 24, 2026, CrowdStrike announced Flex for Services, a services-consumption model operating independently from Falcon platform subscriptions and standard retainers. The announcement included a limited-time Zero Dollar Flex Fund for qualifying new services customers: 200 hours, comprising 160 hours of incident response and 40 hours of proactive services, with no upfront initiation cost. Eligibility and availability must be confirmed before purchase.
Reported Flex scale
CrowdStrike later reported a $1.69 billion ending-ARR cohort of Flex account value in Q4 FY26, up more than 120% year over year. Because this is a company-reported account-value metric, it should not be read as recognized revenue, audited customer spend or proof that every commitment will be fully consumed.
SMB and public-price context
Kurtz said Flex was broadening beyond large enterprises, but negotiated Flex terms are not the same as public self-service bundles. On August 16, 2026, CrowdStrike’s U.S. pricing page listed Falcon Go at $7.99 per device monthly or $59.99 annually, Falcon Pro at $99.99 annually and Falcon Enterprise at $184.99 annually, with a 15-day trial for selected capabilities. Those are public bundle prices, not Flex quotes; currency, taxes, device limits, add-ons and availability require confirmation on the current pricing page.
Consolidation’s trade-offs
Possible benefits
- Fewer consoles and overlapping tools.
- A shared telemetry and policy model across endpoint, identity, cloud and operations.
- Less repeated procurement when risk priorities change.
- One partner roadmap for migration and managed operations.
Risks that remain
- Concentration in one vendor’s availability, roadmap, pricing, support and security practices.
- Migration and workflow redesign costs that a license comparison omits.
- Commitment utilization risk, restrictive drawdown terms or stranded spend.
- Unpredictable data and cloud infrastructure charges for metered SIEM and workload protection.
- Acquired capabilities that are commercially available before they are fully integrated or operationally mature.
Flex can accelerate access to an acquired capability, as Kurtz argued, but commercial availability does not prove technical integration or equivalence to a native Falcon module.
How to choose a buying path
| Situation | Practical next step |
|---|---|
| Small organization needing basic endpoint protection | Compare public Falcon bundle prices and trial terms. |
| AWS-first organization seeking metered procurement | Model Marketplace ingestion, host, node, Fargate and AWS infrastructure costs. |
| Large enterprise consolidating several security domains | Request a Flex proposal with eligibility, drawdown, rollover and exit schedules. |
| Customer needing incident response or advisory work | Compare Flex for Services with a fixed-scope project or response retainer. |
| Channel partner | Review enablement, co-selling, margin, customer ownership and delivery obligations before promising a transformation roadmap. |
Alternatives worth a separate commercial and technical comparison include the AWS-native security stack, Microsoft Security, Palo Alto Networks Cortex and SentinelOne Singularity. Their packaging and pricing are not directly comparable to Flex without vendor-specific quotes.
The Bottom Line
Falcon Flex is best understood as a negotiated security-platform commitment that can simplify expansion, not as unlimited use or automatic savings. AWS adds infrastructure experience, Marketplace procurement and newer AI/cloud options; partners supply the migration and operating work. Buyers should approve Flex only after modeling utilization, data costs, services, renewal and exit terms—and after testing whether consolidation’s operational simplicity outweighs concentration and execution risk.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
