Step 1 of 5 · 2012–16

A model on the device, sold to replace antivirus

Prevention as the whole product

Stuart McClure founded Cylance in 2012 on a claim most of the industry had dismissed: that malware could be stopped before it ran, including files no vendor had seen before CY1. Signature tools could not do that. Cylance trained a machine-learning model to classify executable files from their mathematical properties instead of matching them against a catalog, and ran it on each device as CylancePROTECT CY1 CY2. The product went straight at the weakness customers could see in antivirus: its dependence on a constant stream of signature updates CY1.

The same choice set the first sale. A prevention product does the job the antivirus already on the machine claims to do, so Cylance asked buyers to take McAfee or Symantec out. Alperovitch, CrowdStrike's co-founder, says his company judged that replacing those vendors would take "an enormous amount of effort" and put it off CS2. Cylance took on that harder sale from the start, and in each customer's environment it had to show that the model blocked attacks without blocking legitimate software CY1.

Rivals CrowdStrike launched in June 2013 with a sensor that recorded activity and sent it to its cloud, sold beside antivirus; Alperovitch called it "additive" CS4 CS5. Its founders refused Windows XP support and on-premises builds and lost deals over both CS2.

Product Leadership

Step 2 of 5 · 2013–16

Sold a prevention claim, not breach response

Cylance's buyers had heard "better AV" pitches before CY1. Cylance answered with demonstrations: in controlled tests its model stopped files it had never seen, and a short prevention message made that technical difference clear to executives as well as security teams CY1. Alperovitch credits Cylance with spending "enormous amounts of money on marketing, sort of convincing people that AV was broken", which he calls "what you had to do" before a buyer would consider replacing McAfee or Symantec CS2.

It worked. By mid-2016 Cylance had more than 1,000 customers and a valuation of about $1 billion after a $100 million round, and both it and CrowdStrike projected about $100 million of sales for the year CSX-7 CSX-1. McClure said Cylance was beating CrowdStrike because CrowdStrike did nothing for prevention; Kurtz gave the credit to Cylance's marketing department and said most security companies already used machine learning CSX-1. That was the weakness of the pitch: it sold a category, and any vendor could adopt the same prevention language. Cylance also did breach response, cleaning up after the OPM breach, but it never made response the way it entered customers CSX-1.

Rivals CrowdStrike sold breach response first: Shawn Henry, after more than 20 years at the FBI, joined in April 2012 to run CrowdStrike Services CS6. Its response engagements began by installing its agent, and CrowdStrike says many response customers became subscribers CS15.

How to win

Step 4 of 5 · 2017–19

Opened antivirus replacement for CrowdStrike

Cylance's marketing created the buying moment, and CrowdStrike was placed to take it. Alperovitch says that once CrowdStrike saw Cylance create the opportunity, it pushed its own antivirus product out "in record time" and then had "the full scope solution": antivirus plus what is now called endpoint detection and response CS2. In February 2017 CrowdStrike made Falcon Prevent, its antivirus replacement, a separate module on the agent that customers were already running beside antivirus CS13. A customer Cylance had persuaded to remove McAfee could get the replacement from a vendor already on its machines, together with detection.

Cylance still led on tests. In NSS Labs' February 2017 comparison it scored 99.69%, while CrowdStrike, which had sued to stop publication, scored 74.17% on an incomplete run CS14. But buyers were no longer choosing on one score. Cylance's line was PROTECT and OPTICS plus services CY2, and CrowdStrike's 2020 annual report grouped BlackBerry Cylance with "point products based on malware-only or application whitelisting techniques" CS15.

In November 2018 Cylance agreed to sell to BlackBerry for $1.4 billion in cash. It had raised nearly $300 million, reported more than $130 million of revenue for fiscal 2018, up more than 90%, and had over 4,000 customers CSX-4. The deal closed in February 2019 CY2. It ended the independent test of whether Cylance could grow from one prevention product into the broader set CrowdStrike was already selling.

Rivals CrowdStrike's annual recurring revenue (ARR) grew from $58.8 million in January 2017 to $312.7 million in January 2019 CS3.

Step 5 of 5 · 2019–24

Flat under BlackBerry, resold for $160M

Under BlackBerry, Cylance's first quarter brought $51 million of non-GAAP revenue, 30.8% more than the $39 million Cylance had recorded a year earlier CY2. Growth then stalled. Management had projected 25–30% growth for fiscal 2020; BlackBerry's chief executive, John Chen, described the year's revenue as only slightly up and the latest quarter as flat CSX-5. In the same period CrowdStrike grew quarterly revenue 84% to $199 million CSX-5.

The choices in steps 1 and 3 explain the stall. A product that judged files on each device, with its detection data kept there too, left Cylance nothing already installed and already collecting through which to sell the next product. CrowdStrike, whose agent already sent every event to its cloud, could switch a new module on without a new deployment, and its dollar-based net retention was 147% at the start of 2019 CSX-3 CS3. In December 2024 BlackBerry sold Cylance to Arctic Wolf for $160 million in cash plus about 5.5 million Arctic Wolf shares, to be folded into Arctic Wolf's Aurora platform CSX-6. The prevention model that made Cylance's name now serves as one part of another company's platform.

Rivals CrowdStrike kept adding products to the same agent; Kurtz says a new capability needs only a purchase order, with nothing to deploy CSX-3. Arctic Wolf bought Cylance to add endpoint protection to its own platform CSX-6.