Arena: Market Conditions Before Secureworks
Security teams at mid-size and large organizations · 2010s · United States
Changing technical requirementsHigh setup and upkeep costsBarriers to participation
In the 2010s a company's computers ran antivirus software that looked for known malware, and breaches kept happening despite heavy security spending SCWX-3. Attackers were turning to methods that used no malware at all: by one vendor's count, 39% of the attacks it observed in 2017 were malware-free intrusions that traditional antivirus missed SCWX-11. Once inside, an intruder took an average of 1 hour and 58 minutes to move from the first compromised machine to others on the network SCWX-11. Antivirus slowed machines, and rolling out a new endpoint product across a large organization could take about two years SCWX-3. Mid-size companies, schools and public agencies often lacked the staff or tools to detect and respond to threats, in a market short of people with security expertise SCWX-9 SW1.
How each step happened
Step 1 of 5 · 1999–2015
Managed security on its own appliances
CrowdStrike's founding choice was to move endpoint security into the cloud. George Kurtz started the company in 2011, arguing that antivirus vendors stopped malware while breaches kept happening SCWX-3. Falcon paired one lightweight agent on each computer with Threat Graph, a cloud database that did the heavy analysis, and the first endpoint product shipped in 2013 SCWX-8. Kurtz refused to build an on-premises version, and a no-reboot install cut deployment at large organizations from roughly two years to about a month SCWX-3.
Secureworks was founded in 1999 in Atlanta; by early 2011 it served more than 2,900 clients in 70 countries under chief executive Michael Cote, with about $120 million of revenue, roughly 90% from services contracts SCWX-10. Its services covered security monitoring, firewalls, network intrusion detection and log retention, delivered through Secureworks hardware appliances SW1. Dell bought it in February 2011 and kept control after the April 2016 IPO, holding 97.7% of the voting power in 2024; agreements limited Secureworks' ability to raise capital, acquire companies or issue stock without Dell's consent SW1. CrowdStrike's software was installed once and updated from the cloud, and the company that owned the agent owned its data SCWX-8.
Rivals CrowdStrike built a cloud-only platform from 2011 around a single lightweight agent and shipped its first endpoint product in 2013 SCWX-8 SCWX-3.
Novel Architecture
Step 2 of 5 · 2018–19
Analytics on CrowdStrike's data
Because every Falcon agent reported to the same cloud, CrowdStrike's data grew with each customer. Its 2019 prospectus describes Threat Graph processing more than one trillion endpoint events a week, and says that what it finds in one customer environment protects all customers automatically SCWX-8. ARR rose from $58.8 million at January 31, 2017 to $312.7 million two years later SCWX-8.
Secureworks chose to work on top of that data. In September 2018 it agreed to apply its Red Cloak behavioral analytics and threat intelligence to telemetry from the Falcon platform; Wendy Thomas, then a Secureworks senior vice president, pitched it as one purchase of a leading endpoint tool and a leading managed provider SCWX-1. In January 2019 Dell launched Dell SafeGuard and Response: CrowdStrike supplied antivirus and endpoint detection, and Secureworks' security operations center monitored them SCWX-9. Dell and Secureworks had spent months vetting endpoint detection systems before selecting CrowdStrike's SCWX-9. The arrangement placed Secureworks' analysts on the layer above the agent, while the sensor and its data stayed with CrowdStrike SCWX-9 SCWX-1.
Rivals CrowdStrike fed every agent's events into Threat Graph, more than one trillion a week by 2019, and supplied the endpoint layer of Dell's bundle SCWX-8 SCWX-9.
Data Exhaust
Step 3 of 5 · 2019–23
Taegis: an open platform, run by Secureworks or the customer
CrowdStrike already sold the service layer itself. In April 2018, five months before the Red Cloak partnership, it launched Falcon Endpoint Protection Complete, in which its own team deployed, configured, monitored and remediated the endpoint for the customer SCWX-5. The analysts worked on CrowdStrike's own agent and data. CrowdStrike ranked first for managed detection and response (MDR) revenue in Gartner's report on 2021 managed security market share, and described Falcon as the platform other MDR providers chose SCWX-2.
Secureworks answered with software of its own. In fiscal 2020 it launched Taegis XDR and Taegis ManagedXDR, in which Secureworks or a partner ran it for the customer SW1. It designed Taegis to be "open without compromise," taking events from many vendors' endpoint, network, cloud and business systems, so a buyer could keep its existing tools and choose how much of the operation to hand over SW1. Taegis also carried Secureworks' own endpoint detection and a next-generation antivirus add-on, so customers could consolidate spending with one vendor SW1, years after Falcon's agent first shipped in 2013 SCWX-8. The open design still tied Taegis to other companies' sensors, and its annual report warned that Taegis would become less competitive if it failed to interoperate with customers' infrastructure SW1. By September 2023 chief executive Wendy Thomas cited a top-three Gartner position in global MDR market share SCWX-6.
Rivals CrowdStrike launched Falcon Endpoint Protection Complete in April 2018 and ranked first in MDR revenue for 2021 in Gartner's share report SCWX-5 SCWX-2.
Managed Service
Step 4 of 5 · 2021–24
Taegis growth slowed as the old business ran off
With its agent installed, CrowdStrike sold more products through it. By January 31, 2025, 67% of its customers used five or more Falcon modules and 48% used six or more; Next-Gen SIEM, cloud security and identity protection together passed $1.3 billion of ending ARR, and total ending ARR reached $4.24 billion, up 23% SCWX-4.
Secureworks spent the same years replacing its own business. From fiscal 2021 it moved subscription customers off its lower-margin legacy managed services and onto Taegis, and by the end of fiscal 2024 most of those services had reached end of life SW1. Taegis ARR grew from $164.7 million to $284.9 million over the two fiscal years ended February 2, 2024, while total ARR fell to $297.3 million from $389.1 million SW1. Fiscal 2024 revenue fell to $365.9 million from $463.5 million as Taegis revenue rose to $265.3 million from $188.1 million SW2. Taegis growth was slowing: year-end ARR rose 9% SW2, and in September 2023 an analyst noted the Taegis customer count had stayed at about 2,000 for three quarters SCWX-6. Its annual report warned that larger competitors' bundles could win customers "even if the competitor's security solutions have more limited functionality" SW1.
Rivals CrowdStrike reached $4.24 billion of ending ARR at January 31, 2025, with 67% of customers on five or more modules SCWX-4.
Multi-ProductPlatformization
Step 5 of 5 · 2024–25
Sold to Sophos for about $859 million
CrowdStrike's hold on customers was tested on July 19, 2024, when a faulty content update to its Falcon sensor crashed certain Windows systems SCWX-4. Kurtz told investors that gross retention in the following quarter was over 97%, down less than half a percentage point, and that the largest customers saw CrowdStrike as technology that stopped breaches and lowered their overall operating costs SCWX-7. At the end of fiscal 2025, dollar-based gross retention was 97% SCWX-4.
Secureworks finished its transition as a smaller company and did not stay independent. Sophos, an endpoint and MDR supplier backed by Thoma Bravo, completed its purchase on February 3, 2025, in an all-cash transaction valuing Secureworks at approximately $859 million; shareholders, including Dell Technologies, received $8.50 a share SW3 SW4. Sophos said the deal made it the leading pure-play provider of MDR services, supporting more than 28,000 organizations, and folded Taegis into what it called a single open platform SW3.
Rivals CrowdStrike kept gross retention over 97% in the quarter after its July 2024 outage and 97% at the end of fiscal 2025 SCWX-7 SCWX-4.