Part IThe Story
In 2011, somewhere in an airplane cabin, the chief technology officer of the world's second-largest antivirus company sat beside a stranger and watched him wait. The stranger had a laptop open, and on the laptop McAfee's security software was loading. It took about fifteen minutes. The man did not seem to mind. He chatted with the flight attendant. He read his newspaper. He did, as George Kurtz would remember it nearly a decade later, "all these things while the software is grinding away," and the executive in the next seat, whose job was to know where the technology was going, sat there feeling something close to shame.
— George Kurtz, recalling the 2011 flight, to Forbes (2020)The guy was talking to the flight attendant, he was reading his newspaper, and he's doing all these things while the software is grinding away and I'm just sitting there going, oh my God. I'm the CTO of this company, and this is terrible.
What Kurtz noticed was time. More precisely, he noticed the gap between how fast the threat moved and how slowly the defense arrived. Security software of that era lived on the machine it protected, fat with signature files that had to be downloaded, unpacked and scanned against, and it behaved like a night watchman who has to reread the entire criminal code before he unlocks his booth. Within a few months Kurtz had left McAfee. Within a few more he had $25 million from Warburg Pincus and a company whose founding premise was that the watchman should live in the cloud: light on the device, heavy on the server, updated continuously and instantly, everywhere at once.
That premise made him a billionaire. It made CrowdStrike the company that governments called when Chinese military units, Russian intelligence services and North Korean hackers broke in. It put a CrowdStrike sensor at the kernel of the operating system on millions of machines belonging to more than 24,000 customers, including nearly 60 percent of the Fortune 500. And on July 19, 2024, at 04:09 Coordinated Universal Time, the same premise turned on its author. A single configuration file, pushed everywhere at once as designed, crashed roughly 8.5 million Windows computers in what one security researcher called, the same morning, "the largest IT outage in history." That day 5,078 flights were cancelled worldwide. Airline passengers in Atlanta slept on linoleum.
Some of them, presumably, had laptops.
Kurtz's own priorities on airplanes are a matter of record. He likes to be first aboard; he once told Fortune it was a private game, and that "more than a few folks have had Tumi tracks on their backs" as he hustled to the jet bridge. He likes the seat with nothing in front of it. He keeps an app on his phone that reproduces the departure board of any airport in the world, because, as he put it, "if there is a cancellation people are always running to the board." He has thought harder than most people about what to do when the flights stop. He had not, it seems, fully thought about being the reason they did.
By the Numbers
The Kurtz Ledger
8.5MWindows devices crashed by CrowdStrike's July 19, 2024 update
78 minBetween the faulty push (04:09 UTC) and the rollback (05:27 UTC)
$4.81BCrowdStrike revenue, fiscal year ended January 31, 2026
600,000+Copies sold of Hacking Exposed, co-written in 1999
$25MInitial Warburg Pincus funding for CrowdStrike, 2012
97%Customer renewal rate Kurtz reported after the outage
5,078Flights cancelled worldwide on July 19, 2024
An Accountant in the Security Group
The public record cannot agree on when George Kurtz was born. Wikipedia gives October 14, 1970. His hometown paper in Parsippany, New Jersey, reported that he graduated from high school in 1983, which would make that date impossible. A British newspaper, writing the weekend of the outage, called him 59. A profile site on the internet put his birth in 1975. Seton Hall University, which ought to know, lists him as a member of the class of 1992. It is a small, comic irony that the man who built an industry on verifying identity, on telling the legitimate process from the impostor, has a date of birth that resolves differently depending on which database you query. It is also, maybe, the most New Jersey thing about him.
What is not disputed is the town. Parsippany–Troy Hills sits in Morris County, about thirty miles west of Manhattan, a suburb of office parks and cul-de-sacs, and a 2014 Asbury Park Press profile remembered a boy who spent much of his time fly fishing or playing on the high school football team. He was also, by his own account, programming video games on a Commodore by the fourth grade, and in high school he built bulletin board systems, the dial-up message boards that were the internet before there was an internet. BBS operators in the 1980s learned something early that the rest of the world learned late: if you put a machine on a phone line, strangers will try to get into it.
And then he chose accounting. This is the hinge of the story, and Kurtz has never treated it as an accident. He wanted a business degree; he got a Bachelor of Science in accounting from Seton Hall in South Orange, passed the exam to become a certified public accountant (the World Economic Forum's biography still lists "C.P.A., State of New Jersey, inactive status," as though the license were a reserve commission), and went to work at Price Waterhouse, starting in 1993. The firm put him in front of the drudgery of data entry. He wrote programs to make the drudgery go away. Someone noticed. He was drafted into the firm's new computer security group, where by his telling he was the fifth person on the team, and handed an assignment that sounds quaint now: firewalls were just becoming commercially available, and somebody needed to figure out how to make them work.
He did penetration testing, the then-novel practice of breaking into a client's network on purpose to show them where the holes were. He moved to Ernst & Young and kept doing it. A later account, of uncertain sourcing, holds that he was a senior manager there at 27 and was told he was too young to be considered for partner. It would explain a great deal if true. It is the kind of origin story that the people who tell origin stories tend to prefer.
The accounting matters because it explains the way Kurtz thinks about security, which is not the way most of his peers did. The hacker-founders of his generation came at the problem from the exploit outward: what can I break? Kurtz came at it from the ledger inward: what is this costing, who is responsible, and how do you prove it is under control? An auditor's question. Years later he would summarize his hiring philosophy in a phrase that sounds like it was born in a Price Waterhouse conference room: "We needed a lot more possibilities people and a lot less parameters people." He meant it as praise of possibility. It reads, in hindsight, as a sentence written by a man who had been a parameters person and decided to stop.
The Five-Hundred-Page Business Card
In 1999, the year everyone in America seemed to be starting something, Kurtz did two things. He co-wrote a book, and he started a company.
The book was Hacking Exposed: Network Security Secrets & Solutions, written with Stuart McClure and Joel Scambray, two other practitioners from the consulting world. It was a fat manual for network administrators that explained, in unglamorous technical detail, exactly how attackers footprinted, scanned, enumerated and penetrated corporate networks, and how to stop them. Some in the industry thought it handed the adversary a map. Most readers thought it handed defenders one. It went through dozens of editions, sold more than 600,000 copies, and was translated into more than 30 languages; CrowdStrike's corporate biographies still call it "the best-selling security book of all time," a claim no one appears to have bothered to dispute. Kurtz later offered founders a piece of advice that was both a joke and a strategy: writing a book "will be your best 500-page business card."
The company was Foundstone, based in Mission Viejo, in the beige sprawl of south Orange County. Kurtz was founder and CEO and, by his account, recruited the other six founding team members; McClure became president. The pairing it offered was unusual at the time: software and services under one roof. Foundstone sold an enterprise product that scanned networks for vulnerabilities, and it sold consultants who could tell you what the scans meant, and it sold training, the "Ultimate Hacking" courses built on the book, which turned out a generation of security professionals and, according to Fast Company, counted the NSA, the FBI, the Secret Service and every branch of the U.S. military among its students. In 2003 the magazine put Kurtz on its inaugural Fast 50. The headline on his entry: "Be a security blanket."
His contribution to the field was partly a word. Frustrated by assessment tools that were slow and incomplete, Kurtz pushed Foundstone toward what he called vulnerability management, a continuous program instead of a one-time audit, and the term stuck so thoroughly that it became the name of a product category. In February 2004 he explained the logic to a Southern California tech newsletter with an accountant's taste for denominators: 90 percent of attacks came from known vulnerabilities and misconfigurations, and 15 to 20 new vulnerabilities were being identified every day. "IT departments find it almost impossible to manage," he said. Foundstone's revenue in 2003 split 50/50 between technology and services; he projected 65/35 in favor of software. The direction of travel was clear even then. Services were the way in. Software was the business.
Not everything about Foundstone was a security blanket. The company raised $3.5 million in venture capital and then, in 2001, needed more just as the dot-com collapse turned the funding market into what Kurtz called a "nuclear winter." He pitched and pitched and found the money. There were also uglier episodes, recounted at the time in a Fortune article titled "The Two Faces of Foundstone": a software trade group accused the company of license violations, and a lawsuit Kurtz filed to stop a departing executive from starting a competitor angered people in a security community that prized openness. The record on those disputes is thin and old. What survives is the title, which a profile writer could hardly improve on.
And there was the exit. When McAfee came calling, Kurtz later said, his venture investors wanted to sell, not because selling was right for the company but because their fund needed a win. In 2004 McAfee bought Foundstone for something on the order of $90 million (accounts vary between $86 million and $90 million). Kurtz took the money and took the lesson. When he started his next company, he told the podcaster Logan Bartlett, he vowed never again to take capital from a venture firm that needed him to succeed in order to raise its next fund.
He would go on to apply that rule with a thoroughness that most founders reserve for product decisions.
Three Hundred Thousand Miles
McAfee made Kurtz senior vice president and general manager of risk management, then put him in charge of the enterprise business, and in October 2009 made him executive vice president and worldwide chief technology officer. The job, as he described it later, was mostly airplanes. He had been flying at least 100,000 miles a year since 1993, but the McAfee years were something else: "My highest year I think I did 300,000 miles." On one trip he went from California to Europe, then Israel, then Singapore, then Australia, and back to California, a single circumnavigation of the customer base. What he heard in those meetings, by his own account, was that beleaguered customers did not need more antivirus products. They needed something oriented toward the tradecraft and technique of the people attacking them.
The attackers were changing. On January 12, 2010, Google disclosed that it had been breached in a coordinated campaign, along with dozens of other companies. McAfee named it Operation Aurora, and five days later, on a Sunday afternoon, Kurtz posted to the company's blog. "I believe this is the largest and most sophisticated cyberattack we have seen in years targeted at specific corporations," he wrote. The malware was sophisticated, but sophisticated malware was common. "What really makes this a watershed moment in cybersecurity is the targeted and coordinated nature of the attack." He went on to oversee McAfee research into Night Dragon, a campaign against energy companies, and Shady RAT, a years-long intrusion operation against governments and corporations. The industry was learning that it was facing not viruses but people, patient, salaried people, many of them working for states.
The man who ran that threat research for McAfee was Dmitri Alperovitch, its head of threat intelligence, an analyst whose career was built on the proposition that you defend best when you know precisely who is attacking you and why. He and Kurtz came to the same conclusion from different directions. Kurtz arrived from the customer meeting and the airport lounge; Alperovitch arrived from the forensic report. The conclusion was that an industry organized around catching malicious files was fighting the last war.
On April 21, 2010, three months after the Aurora post, McAfee pushed out a routine virus-definition update numbered DAT 5958. It misidentified
svchost.exe, a core Windows system process, as malicious, and quarantined it. Computers running Windows XP across the world began rebooting endlessly or losing their network connections. ZDNet's headline that day was "Defective McAfee update causes worldwide meltdown of XP PCs." Kurtz had been CTO for six months. The episode would be largely forgotten by everyone except the IT administrators who spent the following days walking from desk to desk. Those people have long memories, and they would remember it on July 19, 2024.McAfee was itself running out of runway as an independent company; Intel bought it, and after the acquisition Kurtz left. He would later describe his frustration with an incumbent that showed no interest in disrupting what it already had, and he would describe the McAfee M&A record with unusual bluntness: "When I was at McAfee, we acquired 21 companies, and never quite got them integrated." On October 18, 2011, the trade press reported that McAfee was looking for a new CTO.
Exactly one month later, on November 18, 2011, an employment agreement was executed between a newly formed Delaware corporation called CrowdStrike, Inc. and George Kurtz.
Breaches, Not Malware
He had spent the intervening weeks at Warburg Pincus, the private equity firm, as an "entrepreneur-in-residence," which in practice meant a desk, a salary and a partner willing to fund a company that did not yet exist. In February 2012, Kurtz, Alperovitch and Gregg Marston, a finance executive who became CFO, formally launched CrowdStrike from Irvine, California, with $25 million from Warburg. The stealth-mode press coverage that week struggled to describe what the company actually did. The early slogan did not: We Stop Breaches.
The phrasing was the thesis. "Stopping breaches, not malware," Kurtz would say over and over for the next decade, and the distinction was not marketing. Malware was an artifact; a breach was an outcome. Signature-based antivirus measured itself by the artifacts it caught, which meant it could report a perfect record while a patient adversary walked through an unlocked door using legitimate credentials and never touched a malicious file. CrowdStrike's own research in 2017 would report that 66 percent of the attacks its responders handled that year were fileless or malware-free. Kurtz's bet was that the customer did not care about the artifact. The customer cared whether the adversary got in.
The second half of the thesis was the architecture. Everything would run from the cloud. A lightweight sensor on each machine would stream behavioral telemetry to CrowdStrike's servers, where the data from every customer would be pooled and analyzed, so that an attack technique spotted at one bank could be blocked at every other customer within moments. CrowdStrike called this "community immunity." The cloud also solved the problem of the man on the airplane. In 2015 Kurtz boasted that his team had gotten one financial services firm with 77,000 devices up and running in two hours flat.
It is hard now to remember how heretical this sounded. "My idea was that it should all be done from the cloud," Kurtz said in 2026. "Now, that may sound obvious in 2026, but it wasn't so obvious in 2011. And in fact, a lot of our competitors, a lot of the big guys just laughed at us when I started the company." Chief information security officers in 2012 were being asked to send data about their most sensitive systems to a startup's servers, in exchange for protection from people who wanted that data. Kurtz later said that fear of the cloud shaped his founding thesis. Customers' resistance told him exactly what he would have to prove.
In April 2012 CrowdStrike hired Shawn Henry to run its services subsidiary. Henry had been one of the most senior cyber officials at the FBI, described in the trade press as the bureau's "top FBI cyber cop," a career investigator who had spent decades treating computer intrusions as crimes with perpetrators rather than as technical malfunctions. His hiring announced what kind of company this would be. It would sell software, but it would also kick in doors. The product, Falcon, launched in June 2013. That year MIT Technology Review put CrowdStrike on its list of 50 disruptive companies.
The structure echoed Foundstone, and Kurtz knew it. Incident response, the forensic teams who arrived after a client was breached, was the services wedge, the 10 percent of the business that he called a triage team. Most of the companies those teams cleaned up, Kurtz said, ended up as subscription customers. The fire department sold sprinkler systems on the way out.
Pandas, Bears and Spiders
CrowdStrike's most effective early marketing was taxonomy. The company gave adversaries animal names keyed to their country of origin: Pandas for China, Bears for Russia, Kittens for Iran, Chollimas for North Korea, Spiders for criminal groups. By 2015 it was tracking more than 50 of them, with names like Ghost Jackal (the Syrian Electronic Army), Viceroy Tiger and Andromeda Spider. The names were memorable, slightly ridiculous, and extremely useful. They turned a diffuse, abstract threat into a cast of recurring villains, and they made CrowdStrike the narrator.
The narrator was often right, and was often in the room when it mattered. In May 2014, CrowdStrike's reporting helped the Justice Department indict five officers of the Chinese People's Liberation Army for economic espionage against American companies; weeks later the company published its work on Putter Panda, which it tied to PLA Unit 61486. It exposed Energetic Bear, a group connected to Russia's Federal Security Service that targeted the energy sector. After the Sony Pictures hack in late 2014 it laid out evidence of North Korean involvement. In 2015 it analyzed the breach of the federal Office of Personnel Management. In October 2015 it reported that Chinese hackers had kept attacking American technology and pharmaceutical companies around the time Barack Obama and Xi Jinping publicly agreed to stop economic espionage.
Kurtz told Fortune a story that year that became company legend. A breached customer had called for help; CrowdStrike deployed its sensors across the victim's network and found Hurricane Panda, a Chinese group the company had been fighting since 2013. The attackers scanned an infected machine, found traces of CrowdStrike, and fled. "We need to work at the same speed they're working," Kurtz said, "and keep up with them." Revenue had grown 142 percent between 2013 and 2014, and the customer base had more than tripled.
Then came 2016. CrowdStrike was hired to investigate the intrusion at the Democratic National Committee and attributed it to two Russian intelligence groups it called Fancy Bear and Cozy Bear. On March 20, 2017, FBI Director James Comey told Congress that CrowdStrike, Mandiant and ThreatConnect had reviewed the evidence and concluded "with high certainty that it was the work of APT 28 and APT 29 who are known to be Russian intelligence services." Comey also testified that the FBI's request for direct access to the DNC's servers had been denied, and that CrowdStrike had agreed to share its information instead, a procedural detail that would later be pulled into a conspiracy theory involving Ukraine and repeated by a sitting president. Forbes, in a 2020 headline, called Kurtz "The Tycoon Hunting Down The World's Hackers—And Fending Off A Trump Ukraine Conspiracy Theory."
Not every attribution held up. In December 2016 CrowdStrike reported that Fancy Bear had compromised an Android artillery-targeting app used by Ukrainian forces and suggested the hack had contributed to heavy Ukrainian artillery losses. The International Institute for Strategic Studies said CrowdStrike had misused its data; Ukraine's defense ministry said the losses were much smaller than reported and had nothing to do with hacking. Later reporting by the Associated Press, based on a list of targets uncovered by the firm SecureWorks, showed that the app's developer had in fact been targeted by Fancy Bear, which, as Radio Free Europe put it, "lends some credence" to the original finding. The core of the report was right; the claimed consequence was not supported. This is how threat intelligence usually goes: confident at the center, uncertain at the edges. It is not how good stories go.
Kurtz has never pretended the work is neutral. "What we do at CrowdStrike is as old as time," he told Fortune in 2025. "It's good versus evil. It's a human nature story embodied in technology." The Manichaean framing is useful in a sales meeting, and it is also, at some level, sincerely held. It would make a particular scene in July 2024 almost unbearably neat. On the day CrowdStrike knocked over a meaningful fraction of the West's computing infrastructure, Russia's digital ministry reported no failures at its airports and seized the moment to recommend "import substitution of foreign software." Russia and Iran, cut off from American software by sanctions, reported no disruptions at all. China, which had pushed for years toward technological self-sufficiency, saw no impact on its airlines or banks. The Bears and the Pandas slept through it.
Investors Who Don't Need You
There is a venture firm in this story that put George Kurtz on a stage in 2005, when CrowdStrike did not exist and there was nothing to invest in. March Capital ran an annual gathering called the Montgomery Summit and gave Kurtz, then a McAfee executive, a speaking slot. "We just knew George was great and so we wanted to keep him close," Melissa Montan, the firm's head of platform, said later. More than a decade after that talk, March invested in CrowdStrike, $66 million in total, which Montan said "generated billions in wealth for our LPs." In March 2020 Kurtz was back at the Montgomery Summit in Santa Monica, on a panel with John Chambers, the former Cisco chief who had bought 180 companies, telling the lunch crowd what he had learned as a CEO. "Not one time have I regretted firing someone too fast," he said. "It's that I waited too long."
The cap table Kurtz assembled for CrowdStrike reads like a deliberate inversion of Foundstone's. Warburg Pincus, a private equity firm with a long horizon and no fund-cycle desperation, led the founding round. Accel's Sameer Gandhi signed on in 2013 after a first meeting that the firm itself describes as going ahead "against all odds." In July 2015, Google Capital, the search company's growth fund, led a $100 million round, its first-ever investment in a computer security company. General Atlantic, IVP and others followed. In 2017 CrowdStrike passed a $1 billion valuation on about $100 million in annual revenue; in June 2018 it raised $200 million at more than $3 billion. When the company filed to go public, the SEC's comment letter noted that its executives, directors and 5 percent holders beneficially owned more than 73 percent of the stock, and its three principal stockholders more than 62 percent.
What he was buying, in other words, was patience, and ballast. His investors did not need CrowdStrike to save their funds. They could afford to let him lose money for a long time in pursuit of a platform, and they did.
On June 12, 2019, CrowdStrike listed on Nasdaq at a valuation of about $6.6 billion and rose more than 70 percent on its first day, closing worth more than $11 billion. Kurtz told the Silicon Valley Business Journal he was not surprised that his company had matched Symantec's market value on its debut. He described the IPO, in a podcast the next year, as the green flag for a company, not the checkered one. Revenue for the fiscal year that ended a few months later was $481.4 million. Five years later it was $3.95 billion, and the year after that $4.81 billion. In June 2024 CrowdStrike joined the S&P 500. Cybercrime Magazine named Kurtz its 2024 Cybersecurity Person of the Year; Fortune put him on its list of the 100 most powerful people in business. His 2024 compensation was $47 million.
Somewhere in there the company moved its headquarters from Sunnyvale, California, to Austin, Texas, in December 2021. Kurtz himself began spending money in Arizona.
Channel File 291
At 04:09 UTC on Friday, July 19, 2024, it was midnight in New York, early morning in London and the middle of the working day in Sydney and Singapore. CrowdStrike pushed a routine content update to the Falcon sensor on Windows machines. The update was a new instance of a template, Channel File 291, which governed how the sensor screened named pipes, a mechanism Windows processes use to talk to one another. The template had been tested and released in March. This instance passed CrowdStrike's content validator because of a bug in the validator itself. When the sensor, which ran at the kernel level of the operating system, read the file, it tried to access memory outside the bounds of what it had been given. In kernel mode there is no polite way to fail. The machines crashed, rebooted, loaded the file, and crashed again.
Customers had no way to delay the update. That was the point of the architecture: the community-immunity model depended on every sensor getting new intelligence at the same moment, because adversaries did not wait. Microsoft Azure's Windows virtual machines began crashing almost immediately. At 05:27 UTC, 78 minutes after the push, CrowdStrike reverted the file. Machines that booted after that were fine. Millions that had already crashed were not, because a computer stuck in a boot loop cannot download a fix. The remedy, published within hours, required someone to boot each machine into safe mode or the Windows recovery environment, navigate to
%windir%\System32\drivers\CrowdStrike, and delete any file beginning with C-00000291- and stamped 04:09 UTC. On machines encrypted with BitLocker, as many corporate machines are, technicians had to type a unique 48-digit recovery key first. Some organizations kept those keys on servers that had also crashed. Microsoft's advice for some cloud machines was to reboot them, possibly as many as fifteen times.Fifteen minutes on the airplane, thirteen years earlier. Fifteen reboots now. And the speed that the cloud had promised gave way, everywhere, to people walking from machine to machine.
The list of what stopped that day reads like an inventory of modern life. Airlines on six continents. 911 service across New Hampshire, and disruptions to emergency call centers in more than a dozen other states. Memorial Sloan Kettering postponed every procedure that required anesthesia; Mass General Brigham cancelled non-emergency visits; Kaiser's San Jose medical center lost access to patient records and to the systems that monitored newborns' vital signs and kept babies from being taken from the ward. Banks in the United States, Canada, the Philippines, Poland, Paraguay. Sky News went off the air in Britain. ESPN could not broadcast SportsCenter. Tesla halted its Berlin factory for about four hours. In Sweden a mine was evacuated as a precaution. In Hungary, at the Grand Prix, the Mercedes Formula One team (CrowdStrike was a sponsor) had to fix every one of its computers by hand before Friday practice.
Kurtz's first public statement went up on X early that morning. "CrowdStrike is actively working with customers impacted by a defect found in a single content update for Windows hosts," it began. "Mac and Linux hosts are not impacted. This is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed." It was accurate. It was also, as almost everyone noticed, missing a word.
Not even an apology? Bold strategy, wrote a reporter for The Verge. Lulu Meservey, a public-relations executive, called it "weapons-grade corpo speak" in a thread liked more than 15,000 times: "The first words should be 'I'm sorry.' This outage knocked out 911 call centres and hospitals." Davia Temin, a crisis-communications consultant, told Fortune that the statement "positions Kurtz almost as an AI voice — automated, soulless. In fact, ChatGPT does a better job of appearing to care than he does." On Reddit, administrators who had spent April 2010 rebooting XP machines pointed out who McAfee's CTO had been.
A few hours later Kurtz went on NBC's Today show. He said the company was "deeply sorry for the impact that we've caused to customers, to travelers, to anyone affected by this, including our companies." A clip of the interview, in which he paused and searched for words while being asked how a single update could take down so much, was posted by an anonymous account with a caption accusing him of panicking, and viewed 2.5 million times. He looked like what he was: an engineer who had not slept, who had spent the night on the technical problem, and who had now been asked to perform an emotion on live television.
It fell to his old FBI hire to find the sentence. Shawn Henry, by then CrowdStrike's chief security officer, posted on LinkedIn the following Monday.
— Shawn Henry, CrowdStrike chief security officer, July 22, 2024On Friday we failed you, and for that I'm deeply sorry. The confidence we built in drips over the years was lost in buckets within hours, and it was a gut punch.
The aftermath had its slapstick. CrowdStrike sent $10 Uber Eats vouchers to some partner employees who had helped customers recover, as a thank-you; the codes were used so heavily that Uber flagged them as fraud and they stopped working for some recipients. A parody site called ClownStrike received a DMCA takedown notice. The company won the 2024 Pwnie Award for Most Epic Fail, and its president, Michael Sentonas, an Australian who had risen through the security industry to become Kurtz's second-in-command, walked onstage at DEF CON in Las Vegas to accept the trophy in person, which was the most graceful thing anyone at CrowdStrike did that summer. Elon Musk posted that CrowdStrike had been "deleted from all our systems." Fifteen months later Apple released an advertisement mocking the episode, set at a fictional trade convention overrun by blue screens.
The stock fell more than 11 percent on Friday and roughly a third from its July peak within days. On July 22, two Republican chairmen on the House Homeland Security Committee, Mark Green and Andrew Garbarino, wrote to Kurtz asking for public testimony. Kurtz posted a letter to customers promising "full transparency on how this occurred and the steps we're taking to prevent anything like this from happening again." The same afternoon the outage began, CrowdStrike Racing withdrew from that weekend's GT World Challenge round at Virginia International Raceway. Kurtz did not race again that season.
The Atlanta Problem
By Saturday, every major American airline but one was recovering. Delta was not.
What happened to Delta was a cascade. The airline's crew-tracking system came back online around 11 a.m. on the 19th but could not process the backlog of changes generated by the shutdown. Pilots and flight attendants were in the wrong cities. Crews that reached the gate hit their legal duty limits before the rest of the crew arrived, and the flight was cancelled, leaving crew and aircraft out of position for the next day. Delta cancelled more than 1,200 flights on Friday, more than 1,400 on Saturday, more than 1,300 on Sunday and more than 1,200 on Monday. Thousands of people slept at Hartsfield–Jackson Atlanta International, the busiest airport in the world, on hard floors without blankets, because the hotels and rental-car counters of metro Atlanta were full. One traveler reported that Amtrak wanted $1,000 for a one-way ticket to Tampa. Delta stopped carrying unaccompanied minors through July 23. Suitcases piled up in terminals around the world. By the time the airline returned to normal operations on July 25, it had cancelled more than 7,000 flights, affected about 1.3 million passengers, and generated more than 5,000 complaints to the Department of Transportation, which opened an investigation.
Delta's chief executive, Ed Bastian, a career finance executive who had spent decades at the airline and had taken it through bankruptcy, apologized to customers on July 21. On July 31 he said the disruption had cost Delta $500 million, and that the airline would sue. In an SEC filing on August 8 Delta put its losses at $380 million in lost revenue and $170 million in expenses. On October 25 it sued CrowdStrike in Georgia state court for gross negligence, breach of contract, computer trespass and deceptive practices. On the same day CrowdStrike filed its own suit in federal court, asking for a declaration that its liability was limited by contract. CrowdStrike's standard terms capped liability at fees paid. The company argued that every other major airline had recovered within a day and that Delta's prolonged collapse came from Delta's own technology choices. In May 2025 a Georgia judge let Delta's gross-negligence and computer-trespass claims proceed. CrowdStrike maintained its exposure would likely not exceed "single-digit millions."
Two numbers sit next to each other in this dispute and do not reconcile. One is the insurance firm Parametrix's estimate that Fortune 500 companies, excluding Microsoft, lost about $5.4 billion. The other is the phrase "single-digit millions." The space between them is a fair measure of how the software industry has priced its own risk for forty years: the vendor's liability is the license fee, and everything downstream belongs to the customer. Kurtz did not invent that bargain. He did, on July 19, test it at a scale nobody had seen.
And Southwest Airlines, the third-largest domestic carrier in the country, was entirely unaffected. A company spokesperson confirmed it had seen no impact from the CrowdStrike outage and declined to confirm speculation among aviation analysts that it had been shielded by its notoriously outdated software.
Flex
Kurtz's recovery strategy was less a public-relations campaign than a pricing scheme.
He took the apology tour where it would be heard by the people who mattered to him. In August he flew to Las Vegas and apologized in person at Black Hat, the security industry's main conference. Then he made the customers an offer. CrowdStrike introduced what it called a "customer commitment package" and expanded a licensing model called Falcon Flex, which let customers draw down additional modules from a prepaid pool of spending and extended subscriptions on flexible terms. Critics called it a discount dressed as contrition. It was also, functionally, a way to deepen the lock-in of exactly the customers who had the most reason to leave. By late 2025 Falcon Flex had accumulated more than $3.2 billion in total deal value. Kurtz told CNBC in August 2025 that customer renewals remained around 97 percent. "Our tech is sticky," the headline read. He told a conference audience that the outage had "helped transform" the company.
The company changed its update practices. Content updates now roll out in stages rather than to every sensor at once, and customers were given more control over when updates land, the very circuit breaker that Falcon's architecture had been designed, in the name of speed, to omit. The rest of the industry absorbed the lesson more broadly. Microsoft blamed a 2009 antitrust settlement with the European Union for keeping its kernel open to third-party security vendors, and the European Commission tartly replied that Microsoft "is free to decide on its business model." Apple, which had begun moving security software out of the macOS kernel in 2019, looked prescient.
CrowdStrike paused acquisitions in the months after the outage, kept talking to founders and venture capitalists, and then started buying again. Onum, a Madrid data-pipeline startup, came in August 2025 for about $290 million; SGNL, an identity company, for $750 million in January 2026; Seraphic Security, an Israeli browser-security firm, for $420 million the same month. Kurtz framed them with McAfee's 21 unintegrated acquisitions as the cautionary tale. "We like to get things at the right stage," he said. "I've seen the movie before." The data was the point. "We started becoming the Reddit of security data for all these AI models," he told Fortune. "The more data we get in, the larger the moat."
He also found a new vocabulary for an old tension. At the RSA Conference in 2026, Kurtz gave a keynote titled "The Crash Test is Over: New Standards of Command for AI Safety." He warned that within about two years the most intelligent "employee" at many companies would be a machine, called himself an "AI safety realist" positioned between the accelerationists and the people who would stop development entirely, and built one section of the talk around a phrase that, coming from him, carried a double meaning he did not need to spell out: seatbelts allow us to go faster. Among the three problems he named with autonomous AI was "the missing circuit breaker."
In the fiscal year that ended January 31, 2026, CrowdStrike reported revenue of $4.81 billion, a net loss of $163 million and 10,698 employees. Its market value had passed $100 billion the previous year.
Twenty-Four Hours
Kurtz began racing seriously relatively late, and in a way that a profile writer must try not to over-read: he drove a Radical SR3, a purpose-built English race car, in something called the Radical Cup, and practiced on a shifter kart, "about two inches off the ground and goes like 80 mph," twice a month. "If you're not in shape, you won't last three laps in one of these karts because your whole body gets thrown around," he told Fortune in 2015. The racing was a McAfee inheritance. One of the company's board members, Denis O'Leary, a former chief information officer at JPMorgan Chase who later joined CrowdStrike's board, was "really a car guy," Kurtz said. "We race together."
He also said the thing that every executive who races says, which in his case may have been unusually true: "When I'm in a racecar I can guarantee you I've never thought about an email or a text or a phone call. Because you can't, right?"
The record since then is a steady progression from amateur to serious. A debut in the Pirelli World Challenge in 2016 in an Aston Martin Vantage GT4; a class title in 2017 in a McLaren 570S GT4; GT3 cars from 2019 with the professional driver Colin Braun, a former prototype champion who became Kurtz's regular co-driver and the closest thing he has on the track to a co-founder. A first overall GT3 win at Virginia International Raceway in 2020. Ten wins in 16 races and an SRO3 title in 2022. Prototypes from 2021: a class win at Sebring in an LMP3 car, then in 2023 a full IMSA season in LMP2 for his own CrowdStrike team, run by Algarve Pro Racing, with the British professional Ben Hanley, winning the season-ending Petit Le Mans and the Michelin Endurance Cup. That June he went to Le Mans for the first time and, with Braun and James Allen, won the LMP2 Pro-Am subclass. That winter he and Braun won the Asian Le Mans Series. He is, in the official categorization of the sport's governing body, an FIA Bronze, an amateur, which is to say a gentleman driver who pays for the car and shares it with professionals. He is very good for a Bronze.
He is not alone. The 2025 IMSA LMP2 grid also included a car shared by Tobias Lütke, the founder of Shopify, and David Heinemeier Hansson, the creator of Ruby on Rails. Endurance racing has become a hobby of a certain kind of software founder, men who made fortunes from abstraction and want to spend some of them on something with physics in it.
Endurance racing rewards a particular temperament. The 24-hour races are not won by the fastest lap. They are won by the car that keeps running: no mistakes in traffic at 3 a.m., no blown gearbox, no misjudged pit stop. Kurtz has compared running a company to running a race car repeatedly, and once gave the analogy a specific mechanical form: if a car's gearbox is rattling, he said, it will not fix itself. He finished second in LMP2 at the Rolex 24 at Daytona in 2023, and second again in 2024, completing 767 laps. At Le Mans in June 2024 his car retired after 149 laps.
The month after that came the outage, and the season ended early. He came back for Daytona in January 2025 and finished sixth. In November 2025 he bought a minority stake in the Mercedes-AMG Petronas Formula One team, through an entity controlled by Toto Wolff, at a valuation of about $6 billion, and joined its strategic steering committee as a technology adviser, with a remit in data security and systems resilience. It was the team whose engineers had fixed their computers one by one in Budapest sixteen months earlier.
In January 2026, at Daytona, the CrowdStrike car won LMP2 at the Rolex 24 after 686 laps. That June, it won LMP2 Pro-Am at Le Mans.
Kurtzdale
Kurtz spends a lot of his money on real estate, and a lot of the real estate is on one road. In Scottsdale, Arizona, his company FalconEye Ventures (founded in 2020, named after the product) owns the Scottsdale Promenade, a 730,000-square-foot shopping center he bought in 2022; the former site of Cracker Jax, an amusement park and driving range; and, as of April 2025, Scottsdale Quarter, a 755,000-square-foot luxury retail and office complex purchased for $645.1 million, $245 million of it in cash, with a promised $100 million in upgrades. The local paper, the Scottsdale Progress, ran a column that began, "Kurtzdale, anyone?" and noted that if Scottsdale were a board game, "anywhere you landed on a stretch of North Scottsdale Road — you'd be paying rent to George Kurtz." It also described him, for readers who had not seen a photograph, as "ginger-haired" and "mustachioed."
The Cracker Jax site is to become The Parque, a mixed-use campus of roughly 2 million square feet: 1,182 apartments and condominiums, a 223-room hotel, offices, restaurants and two acres of green space, with buildings allowed to rise to 117 feet in exchange for $15 million in community benefits. The city council approved it 5–2 in November 2023, over objections from residents and two council members about height near the runways of Scottsdale Airport. "I believe the Parque will be a catalyst that attracts the country's top innovators, technology entrepreneurs, venture capitalists and knowledge workers," Kurtz told the council. He was describing, in stucco, the thing he had already built in software: a single platform where everything happens and everyone pays.
There is one object on his property that tells a different story. Outside the Promenade stands a glowing spire designed by Frank Lloyd Wright in 1957 for a civic project in Phoenix. The city rejected it. It went unbuilt for decades and was finally erected, long after Wright's death, in front of a suburban shopping center. Now it belongs to a man from Parsippany whose own big idea was laughed at by the incumbents of 2011, and who was right.
Row Eleven
In 2015, when he was still mostly a man who flew to customers rather than one who grounded them, Kurtz walked a Fortune writer through his habits as a traveler with the precision of a man explaining a network diagram. The Tumi tracks on the backs of slower passengers. The FlightBoard app, for when the flights are cancelled and everyone runs to the board. The particular seats on American Airlines in coach where the middle is blocked off, which his assistant is instructed to find. And Southwest, which does not let you choose your seat in advance, only the order in which you board, so that the trick is to log in exactly 24 hours before departure and claim the earliest place in line.
"On Southwest Airlines there's always one seat," he said, "it's like row 11 or 12 — that never has a seat in front of it. It's an exit row."
On July 19, 2024, while the departure boards in Atlanta, Edinburgh, Dulles and Boise showed the blue screen, Southwest's planes kept flying, and that seat, the one with nothing in front of it, went out on schedule.
Part IIThe Playbook
The principles below are drawn from three decades of evidence: the accountant who became a penetration tester, the founder who coined a product category, the CTO who watched a stranger wait, the CEO who built the cloud-native security platform and then, on one summer morning, demonstrated its failure mode to the entire world. Some are lessons Kurtz learned and applied. At least two are lessons he learned the hard way, in public. They are offered in that spirit, as an operator's reading of a record that includes both.
The Kurtz Playbook
- 1.Treat the customer's waiting time as your founding document.
- 2.Sell the outcome, not the artifact.
- 3.Build the new architecture outside the old institution.
- 4.Raise from people who don't need you.
- 5.Name the category, then name the enemy.
- 6.Use services as the door and software as the house.
- 7.Make every customer's data protect every other customer.
- 8.Hire people who hate to lose; fire before you're sure.
- 9.Buy young companies and integrate them like a zealot.
- 10.Install the circuit breaker before you need it.
- 11.Apologize first; engineer second.
- 12.Turn the crisis into a contract.
K
Decision Timeline
The inflection points that shaped Kurtz's operating system, including the two outages that bookend his CTO and CEO careers.
1993
Joins the new Price Waterhouse computer security group as, by his account, its fifth member.
1999
Co-writes Hacking Exposed; founds Foundstone in Mission Viejo, recruiting six co-founders.
2004
Sells Foundstone to McAfee; investors' need for a "win" becomes a lesson about capital.
2009
Named McAfee EVP and worldwide CTO.
2010
Writes that Operation Aurora is a "watershed moment"; McAfee's DAT 5958 update cripples Windows XP machines worldwide.
2011
Watches a passenger wait 15 minutes for McAfee to load; leaves McAfee; signs CrowdStrike employment agreement November 18.
2012
CrowdStrike launches with $25M from Warburg Pincus; hires the FBI's Shawn Henry.
2013
Falcon ships; Accel invests.
2015
Google Capital leads $100M round, its first security investment.
2019
IPO on Nasdaq; shares rise more than 70% on the first day.
2024
Joins the S&P 500 in June; Channel File 291 crashes 8.5M machines on July 19.
2025
Falcon Flex passes $3.2B in deal value; Kurtz buys into Mercedes F1.
2026
Revenue reaches $4.81B; CrowdStrike car wins LMP2 at the Rolex 24.
Principle 1
Treat the customer's waiting time as your founding document
CrowdStrike's origin story is not a whiteboard session. It is an executive in an airplane seat watching a stranger read the newspaper while the executive's own product ground away for fifteen minutes. The value of that moment was not the insight that the software was slow; McAfee's engineers knew it was slow. The value was that Kurtz experienced the delay as a customer did, as dead time that the customer had simply learned to tolerate, and recognized that tolerated friction is a market opening that incumbents cannot see because they have priced it in.
Note how specific the observation was. Kurtz did not conclude that "security should be better." He concluded that the work done on the device should be moved somewhere else, that a sensor could be light because the analysis would be heavy elsewhere. The time the customer spent waiting pointed directly at the architecture. In 2015 his proof point was the same unit of measurement turned around: 77,000 devices at one financial services firm, deployed in two hours.
Tactic: Spend an hour watching an actual user wait on your product (or a rival's), write down every minute they absorb without complaint, and ask which architectural choice creates each one.
Principle 2
Sell the outcome, not the artifact
"We Stop Breaches" was a positioning decision that reorganized the whole market. Antivirus vendors measured themselves by the files they caught; Kurtz measured CrowdStrike by whether the adversary got in. The shift mattered because the artifact was becoming less relevant. CrowdStrike's responders found that two-thirds of the attacks they handled in 2017 were fileless or malware-free. A vendor that sold artifact detection could report success while customers were being breached. A vendor that sold breach prevention had aligned its scorecard with the customer's.
The same reframing runs through his whole career. At Foundstone he turned the one-off vulnerability assessment into continuous "vulnerability management." At CrowdStrike he turned malware detection into breach prevention. In 2025 he described the next frontier as securing "every AI agent," which, he argued, has all the exposures of a user and none of the restraints. Each time, he moved the unit of sale up a level of abstraction, closer to the thing the buyer actually fears.
Tactic: Rewrite your headline metric in terms of the event the customer is trying to avoid, then check whether your product roadmap would change if you were paid on that metric alone.
Principle 3
Build the new architecture outside the old institution
Kurtz did not try to rebuild McAfee from the CTO's office. He has described an incumbent that showed no interest in disrupting what it already had, and he drew the conclusion that the new architecture needed a new company, with new incentives and no installed base to protect. The interval between his reported departure from McAfee and his CrowdStrike employment contract was exactly one month.
The decision also governed who he brought along. Dmitri Alperovitch, McAfee's head of threat intelligence, came with him: the person inside the old institution who already believed in the new thesis. Incumbent companies are full of people like that, and the most valuable thing a defecting executive can take is not the IP (which stays) but the conviction of the colleague who reached the same conclusion from a different direction.
Tactic: If the idea requires your employer to cannibalize its largest revenue line, stop drafting the internal memo and start identifying the one colleague who would leave with you.
Principle 4
Raise from people who don't need you
Foundstone taught Kurtz that a venture firm's fund cycle can override a company's interest; his investors, he said, wanted a sale because they needed a win. At CrowdStrike he reversed the arrangement. Warburg Pincus, a private equity firm with a long horizon, led the founding round from an entrepreneur-in-residence desk. Google Capital, Accel, General Atlantic and IVP followed. March Capital had kept him close since putting him on a Montgomery Summit stage in 2005, years before there was anything to buy, and its eventual $66 million position returned billions.
The point is not that big-name investors are good. It is that capital which is not desperate buys time, and time was CrowdStrike's scarcest input; its cloud thesis needed years of losses to compound into a platform. Insiders' 73 percent beneficial ownership at the IPO filing is the result, a cap table that functioned as a strategic moat.
$
Two Cap Tables
How the Foundstone experience shaped CrowdStrike's capital strategy.
| Dimension | Foundstone (1999–2004) | CrowdStrike (2011– ) |
|---|---|---|
| Founding capital | $3.5M venture, then a hard 2001 raise | $25M from Warburg Pincus via EIR |
| Investor posture | Risk Fund needed a win; pushed sale | Scale Long-horizon PE and growth funds |
| Relationship depth | Transactional | March Capital relationship began 2005, years before investing |
| Outcome | ~$90M sale to McAfee | Public company valued above $100B |
Tactic: Before taking a check, ask the partner what their current fund needs to return and when, and treat any answer that depends on your exit timing as a cost of the capital.
Principle 5
Name the category, then name the enemy
Kurtz has a talent for nomenclature that is easy to underrate. He helped coin "vulnerability management," which became the name of the category Foundstone sold into. Hacking Exposed gave a generation of administrators a shared vocabulary for the attack chain. At CrowdStrike, the animal naming scheme (Pandas, Bears, Kittens, Spiders) turned faceless intrusions into recurring characters, and made CrowdStrike the authoritative narrator of a story that boards, journalists and congressional committees wanted to follow.
Naming is market-making. Whoever names the category defines the evaluation criteria, and whoever names the enemy becomes the default source on the enemy. The risk is that a narrator is held to a narrator's standard: the Ukrainian artillery report showed how fast confident attribution can outrun its evidence. The names worked because, most of the time, the underlying work held up.
Tactic: Give your category and your customer's adversary memorable names, and then invest disproportionately in the evidence behind them, because the name will be quoted long after the caveats are forgotten.
Principle 6
Use services as the door and software as the house
Both of Kurtz's companies paired products with services, which venture orthodoxy regards as a margin drag. Foundstone ran 50/50 in 2003 and was planning to go 65/35 in favor of software. CrowdStrike settled at roughly 90 percent subscription and 10 percent services, and Kurtz describes that 10 percent as a triage team: incident responders who arrive after a breach, clean up, and leave behind customers who usually convert to subscriptions.
Hiring Shawn Henry from the FBI in 2012 was part of this design. Breach response produced credibility, front-page attributions, and a stream of first-hand intelligence about adversary technique that fed back into the product. Services were never the business. They were how the business got invited in during the worst week of a customer's year.
Tactic: Keep a small, elite services arm whose explicit mandate is to convert crises into subscriptions and field intelligence into product requirements, and measure it on both.
Principle 7
Make every customer's data protect every other customer
"Community immunity" was the original name for CrowdStrike's network effect: telemetry from every sensor flows into a shared cloud, so that a technique observed at one customer becomes a block at all of them. A decade later Kurtz described the same dynamic in the language of a newer era, calling CrowdStrike "the Reddit of security data for all these AI models" and adding, "The more data we get in, the larger the moat we actually have." The Onum acquisition, a real-time data pipeline, was bought to widen the intake.
This is the deep reason the cloud mattered. On-premise security products get better only when the vendor ships an update; a pooled cloud gets better every time any customer is attacked. The moat is not the code. It is the accumulated record of adversary behavior that no new entrant can reproduce.
Tactic: Design your product so that each new customer measurably improves the product for existing ones, and report that improvement to customers in concrete terms.
Principle 8
Hire people who hate to lose; fire before you're sure
Kurtz's favorite interview question is a diagnostic: "What drives you more, the will to win or the hatred to lose?" In his experience the people who hate losing are the most driven, provided they want to "collectively win with the team," which he describes elsewhere as playing for the name on the front of the jersey. He pairs the selection rule with a removal rule, delivered at the Montgomery Summit in 2020: "Not one time have I regretted firing someone too fast. It's that I waited too long." The test he applies, per his Logan Bartlett conversation, is simple: would you hire this person again today?
The two rules are a system. A company built for loss-aversion and speed cannot tolerate drag in key roles, because drag compounds. Kurtz has also said he still looks at every deal the company closes, which suggests the culture runs on a CEO who keeps his eyes on the details rather than delegating them away.
Tactic: Run the "would I hire them again today?" test on every direct report each quarter, and act within thirty days on any honest "no."
Principle 9
Buy young companies and integrate them like a zealot
Kurtz's acquisition philosophy is defined against a specific memory: "When I was at McAfee, we acquired 21 companies, and never quite got them integrated." At CrowdStrike he bought early-stage companies (Preempt for $96 million, Humio for $400 million, Flow Security for about $200 million, Onum for about $290 million) and folded them into the single Falcon platform and its single agent. He contrasted this explicitly with large acquisitions of "a 20-year-old technology company with a lot of integration risk."
The discipline extends to timing. After the 2024 outage CrowdStrike kept its M&A pipeline warm, talking to founders and investors, but closed nothing until it was confident of execution. Then the Onum deal came together in three months.
Tactic: Before signing, write the integration plan down to the shared agent, data schema and console, and walk away from any target whose product cannot live inside your platform within one release cycle.
Principle 10
Install the circuit breaker before you need it
This is the principle Kurtz learned twice. In April 2010, as McAfee's CTO, he watched a bad definitions update cripple Windows XP machines worldwide. In July 2024, as CrowdStrike's CEO, a bad content file passed a buggy validator, shipped simultaneously to every Windows sensor with no customer-controlled delay, and took down 8.5 million machines in 78 minutes. The architecture's great virtue (instant, universal distribution of protection) and its catastrophic flaw were the same property.
The post-outage fixes were the ones critics had named within hours: staged rollouts, more customer control over update timing, deeper testing of content as well as code. By 2026 Kurtz was preaching the principle about AI, naming "the missing circuit breaker" as a core problem and building a keynote around the idea that seatbelts allow us to go faster. The lesson for operators is that speed and blast radius are a single design decision. If a mechanism can protect everyone in minutes, it can harm everyone in minutes.
!
Two Outages, One Pattern
McAfee DAT 5958 (2010) and CrowdStrike Channel File 291 (2024).
| Element | McAfee, April 2010 | CrowdStrike, July 2024 |
|---|---|---|
| Kurtz's role | EVP and worldwide CTO | Founder and CEO |
| Trigger | Definition update flags svchost.exe as malicious | Content file passes buggy validator; out-of-bounds read in kernel |
| Distribution | Risk Pushed broadly | Risk Pushed to all Windows sensors; no customer delay option |
| Remedy | Manual repair of XP machines | Manual deletion of C-00000291 files, often with 48-digit BitLocker keys |
| Fix adopted | — | Scale Staged rollouts and customer update controls |
Tactic: For every mechanism that can change all customer environments at once, define a staged rollout and a customer-controlled delay now, and test the rollback under live conditions at least once a quarter.
Principle 11
Apologize first; engineer second
Kurtz's first statement on July 19 was technically perfect and humanly absent: the defect was identified, isolated and fixed, and it was not a cyberattack. Every fact was correct. The word "sorry" was missing, and that absence set the story's frame for days. As Davia Temin put it, "What you say first counts double." The apology on Today came hours later, and Shawn Henry's "On Friday we failed you" came three days later; both were better than the original and neither could replace it.
The failure was a category error, and an instructive one: Kurtz wrote for the IT administrators, who needed the technical facts, while the audience was a world whose hospitals and airports had stopped. A Dartmouth communications professor summarized the formula to Fortune: start by saying there was a mistake, and apologize for it. Engineers resist this because it feels like delay before the useful information. It is not a delay. It is the information that the general public needs before it can hear anything else.
Tactic: Pre-write a crisis statement template whose first sentence is an unconditional acknowledgment of responsibility and impact, and require that it precede any technical detail in every channel.
Principle 12
Turn the crisis into a contract
The most consequential decision after the outage was commercial, not rhetorical. Instead of discounting its way back to goodwill, CrowdStrike expanded Falcon Flex, a consumption-based licensing model that let customers draw additional modules from a prepaid pool on extended, flexible terms. The concession was real; it was also structured so that an aggrieved customer, by accepting it, adopted more of the platform for longer. By late 2025 Flex had passed $3.2 billion in deal value and renewals were around 97 percent. Kurtz flew to Black Hat to apologize in person, then reframed the outage as something that "helped transform" the company.
The same instinct showed up in the courtroom. CrowdStrike filed its own suit against Delta on the day Delta sued, asking a federal court to affirm that liability was limited by contract, and argued that Delta's prolonged collapse came from Delta's own systems. Whatever one thinks of the posture, it shows a CEO who treats the contract as the actual instrument of the relationship, and who negotiates the next contract while the last one is still in dispute.
Tactic: When you must make customers whole after a failure, design the remedy so that accepting it deepens product adoption, and make sure the generosity is genuine enough that customers recognize it as such.
Free playbook
Get The Business Model Playbook
58 business models, one visual page each: how the money flows, the metrics that matter, and who runs it. Free when you join the Faster Than Normal email.
Free. No spam. Unsubscribe anytime.
Part IIIQuotes and Maxims
In their words
— George Kurtz, to Sector (March 2026)My idea was that it should all be done from the cloud. Now, that may sound obvious in 2026, but it wasn't so obvious in 2011. And in fact, a lot of our competitors, a lot of the big guys just laughed at us when I started the company.
— George Kurtz, to Fortune (August 2025)What we do at CrowdStrike is as old as time. It's good versus evil. It's a human nature story embodied in technology.
— George Kurtz, Operation Aurora post on McAfee's blog (January 17, 2010)What really makes this a watershed moment in cybersecurity is the targeted and coordinated nature of the attack.
— George Kurtz, Montgomery Summit, Santa Monica (March 2020)Not one time have I regretted firing someone too fast. It's that I waited too long.
— George Kurtz, on LinkedIn (2026)Open models are a security advantage. More teams inspecting them. More teams testing them. More teams hardening the models the world will depend on. Security is how AI scales.
Maxims
- Measure the wait. The friction customers have learned to tolerate is the opening incumbents have stopped seeing.
- Sell what the buyer fears. Price and position against the breach, not the malware.
- Leave to rebuild. An architecture that cannibalizes the incumbent's revenue needs a new company, and the colleague who already believes.
- Buy patience, not just capital. Choose investors whose next fund does not depend on your exit.
- Name the war. Whoever names the category and the enemy becomes the narrator, so make sure the evidence can carry the story.
- Enter through the emergency. Services win the invitation during a crisis; subscriptions keep the relationship.
- Pool the intelligence. A product that gets smarter with each customer becomes a moat that code alone cannot copy.
- Hire for hatred of losing; fire on the first honest no. Hesitation compounds faster than mistakes.
- Speed and blast radius are one decision. Anything that can protect everyone in minutes can break everyone in minutes, so build the circuit breaker first.
- Say sorry before you say anything else. The first sentence counts double, and the facts can wait the length of an apology.
