CrowdStrike licensing is the set of terms under which CrowdStrike, Inc. sells access to the Falcon platform, its cloud-delivered security products, and the managed and professional services built on it. A single master agreement, the CrowdStrike Terms and Conditions, covers all CrowdStrike products and services. Its product-specific provisions apply only to the extent a customer has bought, accessed or used those products.[1] Customers subscribe to cloud-based Products for a Subscription/Order Term. Where a Product includes a downloadable object-code component (the Falcon sensor), the customer may install as many copies as the maximum quantity in the Order allows.[1] The quantity is expressed in whichever CrowdStrike license metric the Order names. The Terms list number of Endpoints, company size by number of employees, number of file uploads and number of queries as examples.[1] Endpoint protection is priced per device.[3] Identity protection is licensed per active identity,[7] and Next-Gen SIEM is licensed on data ingestion volume and retention.[8] For the general models, see concurrent and device licensing and subscription and consumption licensing.
Editions
CrowdStrike sells the Falcon platform as modules and as pre-built bundles. Three small-business bundles have public per-device prices and can be bought online. Larger bundles, managed detection and response, and most add-on modules are sold by quote.[3]
| Offering | What it contains (vendor description) | How it is priced |
|---|---|---|
| Falcon Go | Falcon Prevent (next-gen antivirus), Falcon Device Control, Falcon for Mobile, Express Support[16] | Per device, monthly or annual; maximum 100 devices[16] |
| Falcon Pro | Falcon Go modules plus Falcon Firewall Management[3] | Per device, monthly or annual[3] |
| Falcon Enterprise | Falcon Pro modules plus Falcon Insight XDR and Falcon Adversary OverWatch[4] | Per device, monthly or annual[4] |
| Falcon Elite | Named on the pricing page; Express Support is an add-on[3] | By quote |
| Falcon Complete Next-Gen MDR | 24/7 managed detection and response; add-on modules such as Next-Gen Identity Security and Next-Gen SIEM; breach prevention warranty[3] | “Contact sales”[3] |
| Falcon Next-Gen Identity Security | Falcon Identity Threat Detection; Falcon Identity Threat Protection[7] | Per active identity[7] |
| Falcon Next-Gen SIEM | Log ingestion, search, detection and response for third-party data[9] | Ingestion volume and retention[8] |
| Falcon Cloud Security | Six packages, from Proactive Security to CNAPP with Containers[10] | Custom quote[10] |
| Charlotte Agentic SOAR | Essentials and full editions[11] | Credit-based[11] |
The six public price points are recorded as catalog SKUs, for example Falcon Enterprise - annual. CrowdStrike publishes no part numbers. Bundle composition and prices are covered in CrowdStrike Falcon bundles and online subscriptions.
Metrics
| CrowdStrike term | Catalog row | Where it applies | What CrowdStrike says |
|---|---|---|---|
| Endpoint | Endpoint | Falcon sensor-based Products and bundles | Any physical or virtual device, such as a computer, server, laptop, desktop computer, mobile, cellular, container or virtual machine image.[1] Price lists say “per device”.[3] |
| Active identity | Active identity | Falcon Identity Threat Detection and Protection | Accounts that have authenticated in the last 90 days.[7] |
| Data ingestion volume and retention | Data ingestion volume | Falcon Next-Gen SIEM | Licensing based on data ingestion volume and the length of retention.[8] |
| Credit | Charlotte Agentic SOAR credit | Charlotte Agentic SOAR | Credit-based pricing; allotment for Next-Gen SIEM customers based on data ingestion.[11] |
| Size of company, file uploads, queries | Company size (employees), File uploads, Queries | Offerings whose Order names these metrics | Listed as example license metrics in the Terms’ definition of Order.[1] |
| Hours | Service hours (Flex for Services) | CrowdStrike Flex for Services | 160 hours of incident response and 40 hours of proactive services.[17] |
Counting / floors
Quantity in the Order (as retrieved 2026-09-26). The licence is limited to the customer’s Internal Use during the Subscription/Order Term, and to the quantity in the applicable Order.[1] The Falcon Sensor terms repeat the cap: the software may be installed and run up to the validly licensed quantity.[14] Catalog proof: Use limited to the quantity in the Order; Falcon Sensor terms: install up to the validly licensed quantity.
Overages on online orders (as retrieved 2026-09-26). A customer that exceeds the quantities on its online order forms agrees to buy additional co-terminous licences for the overage. These are charged at CrowdStrike’s then-standard price, pro-rated for the rest of the term.[2] The co-terminous licences then carry into the renewal quantity.[2] Catalog proof: Online orders: overages bought as co-terminous licences at then-standard price; Renewal priced on licensed quantity at then-standard price.
Floors and caps. None of the retrieved documents publishes a minimum purchase quantity. Online purchases of Falcon Go are limited to a maximum of 100 devices.[16] Catalog proof: Falcon Go limited to 100 devices.
Identity counting. Active identities include human and service accounts. Hybrid identities synced across on-premises and cloud directories are counted once.[7] Catalog proof: Identity Security counts accounts authenticated in the last 90 days.
SIEM ingestion. Data from licensed Falcon modules reaches Next-Gen SIEM without additional ingestion charges.[9] Falcon Insight XDR customers may ingest up to 10GB of third-party data per day at no additional cost.[8] See CrowdStrike Next-Gen SIEM, identity and cloud security licensing.
Virtualization & partitioning
CrowdStrike’s definition of Endpoint names virtual devices, containers and virtual machine images alongside physical computers, servers and mobile devices.[1] The retrieved terms publish no host-level, processor or core alternative for virtualized estates. They also contain no hard or soft partitioning policy of the kind found in processor and core licensing. For Endpoint-metered Products, each virtual machine or container that runs the sensor is therefore counted as an Endpoint. Falcon Cloud Security is sold as quoted packages, including container and Kubernetes protection, and its pricing page names no metric.[10] Catalog proof: Endpoint includes virtual machines, containers and VM images; Falcon Cloud Security sold as quoted packages. For the cross-vendor background, see virtualization and partitioning.
Cloud / BYOL
The Falcon platform is itself a cloud service. The Terms define Products as CrowdStrike’s cloud-based software, together with accompanying APIs, CrowdStrike Data, Documentation and Updates.[1] No bring-your-own-license mapping applies, because the customer does not host the platform. Workloads in public clouds are covered either by Endpoint-metered sensors or by a quoted Falcon Cloud Security package.[1][10] Purchases through cloud marketplaces are outside the retrieved documents.
Programs
- Falcon Flex. A flexible licensing agreement built on a pre-negotiated commitment that is drawn down over time. It can be applied to new releases, and modules can be swapped during the agreement.[5] Larger multi-year commitments earn larger discounts.[6] See CrowdStrike Falcon Flex.
- Online subscription. Falcon Go, Pro and Enterprise are sold online with monthly or annual billing. Annual subscriptions are billed in full at the start of the period.[3] Online orders renew automatically.[2]
- Falcon Complete Limited Warranty (version effective 2026-01-08). A ransomware response warranty for customers with Falcon Complete EDR, or EDR with Identity Threat Protection. It pays $2,000 per Covered Endpoint, up to a cap of $1,000,000 or $2,000,000.[12]
- Partner programs. The Partner Program Agreement grants MSP Partners access to a customer’s own instance (MSP Partner). It also licenses CrowdStrike Powered Service Providers to bundle Eligible Products into their own services.[13] See CrowdStrike Falcon Complete and service provider licensing.
- Evaluation. Evaluation access lasts 15 days and can be extended by written authorization.[15] Evaluation use is limited to the customer’s employees.[1]
- CrowdStrike Flex for Services. A standalone 12-month pool of incident response and proactive service hours for eligible new customers.[17]
Contract terms
Use rights (as retrieved 2026-09-26). Internal Use means use solely for the customer’s and its Affiliates’ own internal information security purposes. It excludes use for the benefit of any other person and any use to develop a product or service.[1] Affiliates that use an Offering are bound by the Agreement, and the signing customer remains responsible for them.[1] Customer Contractors, meaning third parties other than CrowdStrike Competitors, may use Products solely on the customer’s behalf. They may not be given the intelligence reports in the Products.[1] Where a Product requires user accounts, each account is for one individual.[1] Catalog proof: Internal Use only: no use for third parties or product development; Affiliates may use; signing customer remains responsible; Customer Contractors may use Products for the Customer; no intelligence reports; User accounts are single-person.
Orders, payment and refunds. Orders under the Terms are non-cancellable. Fees are payable within 30 days of invoice and are non-refundable unless the Agreement provides otherwise.[1] Online orders are an exception: termination within 30 days of the start of a term brings a full refund, except for month-to-month subscriptions.[2] Catalog proof: Orders non-cancellable; fees non-refundable; payment in 30 days; Online orders: full refund if terminated within 30 days (not month-to-month).
Renewal. Online orders renew automatically. For terms of 12 months or more, CrowdStrike emails reminders at least 60 and 30 days before renewal. Renewals are priced at the then-standard price, which may differ from the expiring price.[2] If an Offering is renamed, upgraded or replaced during the term, CrowdStrike may move the Order to the new Offering at the next renewal.[2] Catalog proof: Online orders renew automatically; reminders 60 and 30 days ahead; Renamed or replaced offerings substituted at renewal.
Transfer and termination. Assignment needs the other party’s written consent. The exceptions are an assignment to an Affiliate in a corporate reorganization and a merger, acquisition or sale of substantially all of the business or assets.[1] On termination, all use rights end and the customer must de-install all Software Components from its Endpoints.[1] Catalog proof: No assignment without consent except reorganisation or M&A; On termination: stop use and de-install the Falcon sensor.
Benchmarking. Customers may not publish performance data of an Offering or run competitive benchmarking on it. They may compare the Products with other products for Internal Use.[1] Catalog proof: No public benchmarking or performance data.
Audits and compliance
The retrieved CrowdStrike Terms and Conditions contain no clause that lets CrowdStrike audit a direct customer’s usage records.[1] Compliance rests on two contractual mechanisms and on the platform’s own telemetry. First, use is capped at the Order quantity.[1] Second, online customers agree to buy co-terminous licences for any overage and consent to CrowdStrike monitoring their use of the Offerings to detect fraud and abuse.[2] CrowdStrike may also suspend access if a customer breaches the use restrictions.[1] Partners are treated differently. The Partner Program Agreement gives CrowdStrike a right to inspect and audit partner records and the Offerings, and shifts audit costs to the partner if an underpayment exceeds 5%.[13] Catalog proof: CrowdStrike may monitor use of online offerings; CrowdStrike may audit partner records; costs shift above 5% underpayment. A signed enterprise agreement may add terms that the web documents lack. The general discipline is covered in software license audit and license compliance.
Out of scope
- Consumer products. Falcon Prevent for Home Use is licensed only through an employer’s CrowdStrike licence.
- Signed enterprise agreements, public-sector contract vehicles and cloud marketplace private offers, which were not retrievable.
- Prices for Falcon Elite, Falcon Complete, Falcon Cloud Security, Next-Gen SIEM, identity protection and Charlotte Agentic SOAR, which CrowdStrike sells by quote.
- The legacy Humio self-hosted product, which has its own terms.
- CrowdStrike Marketplace listings of third-party products, and CrowdStrike Store terms.