Recapping Our Largest Dedicated CrowdStrike Survey Around Customer Intentions
Our latest CrowdStrike follow-up poll surveyed 200 IT decision makers (ITDMs) who were customers at the time of the outage. In addition to updated views on the significance of the outage, this study focused on new and recurring topics such as the difficulty of replacing the Falcon platform, retention incentives, alternative vendors, and likelihood of churn. We also asked about the expected timing of replacing the platform for both those who indicated they would stop utilizing CrowdStrike products and for current customers who stated they are somewhat or very likely to do so.
Key Takeaways
- One-eighth of ITDMs in this survey were current CrowdStrike customers with firm plans to replace the company as their endpoint security vendor, but indicated that doing so will take several more months.
- Customers without firm plans to replace comprised 82% of this survey, but one-quarter believed that they are somewhat or very likely to replace the platform, pointing to the back half of CY 2025 to do so.
- Microsoft, Palo Alto Networks, and SentinelOne were the most evaluated alternative vendors by current customers, receiving the highest likelihoods of adoption along with Wiz, Fortinet, and Cisco.
ETR Data: ETR’s October 2024 CrowdStrike Drill Down survey asked current customers with no firm plans to churn but were Somewhat, Very Likely, or 100% Certain to replace about the timing of completion to stop using CrowdStrike Products (N = 41).
Recapping our Prior CrowdStrike Surveys
In our first flash survey in July gathering initial customer reactions, we explored IT decision makers' thoughts around CrowdStrike’s response, which saw largely negative degrees of operational impact. The survey also revealed a shift in customer sentiment, with 44% of respondents indicating a potential replacement of the company’s products. In the follow-up survey conducted a month later, negative sentiment towards CrowdStrike remained high. Despite this, we observed a small shift with fewer respondents saying they were somewhat unlikely to replace CrowdStrike and more claiming they were very unlikely to do so, suggesting some level of calmer customer sentiment. While these findings felt more in-line with CrowdStrike’s historically high gross retention rates, the 11% of respondents stating they were very likely or completely certain to churn pointed to friction further down the road around contract renewals. Notably, 40% of ITDMs had evaluated alternative vendors at that point, with nearly a quarter of ITDMs doing so as a direct consequence of the outage.
In our October 2024 Technology Spending Intentions Survey (TSIS), CrowdStrike's forward-looking spending intentions data experienced an unprecedented survey-over-survey decline in Net Score, marking the steepest drop in ETR’s 15-year history. Net Score plummeted from 47% in July to 9% in October, with the company’s Global 2000 Net Score also falling from 50% to 15%. Moving to even larger cuts, the Fortune 500 sample Net Score decreased from 45% to 4%, with Replacement rates quadrupling, while the Fortune 100 group reached all-time lows in negative territory. Our Observatory for Endpoint Security study also saw a major decline versus the prior year where CrowdStrike was the clear leader in the EPP space. While not yet finalized, our January 2025 TSIS data also points to elevated Replacement intentions far above historical rates.
November Drill Down Findings
In our dedicated November Drill Down, the responses remained largely pessimistic, with over 60% stating a somewhat significant or worse operational impact, along with 40% believing it was very or extremely significant. However, this was less negative compared with our first two flash surveys, suggesting that time is indeed healing some wounds related to this summer’s incident. The weighted average of six responses (1 – Totally Insignificant, 6 – Extremely Significant) across the three surveys yields a July score 4.21, August score of 4.34, and October score of 3.87. This improvement was a half-interval gain in our October survey compared with the average of the two earlier surveys.
ETR Data: ETR’s October 2024 CrowdStrike Drill Down survey asked IT decision makers about organizational impacts from the CrowdStrike outage (July and August N = 100 each, October N = 200).
Alternatives Vendors Set to Benefit
Focusing on the 163 respondents in this Drill Down survey who are current customers with no firm plans to leave, 56% of those have evaluated alternative endpoint vendors since the outage, but we note that the majority of those would have done so regardless of the incident. Endpoint products receiving the most looks in this group were led by Palo Alto Networks (Cortex) at 56%, Microsoft (Defender) at 54%, SentinelOne (Singularity) and Fortinet (FortiEDR) each at 39%, and Cisco (Secure Endpoint) at 38% of the total. Results around the likelihood of adoption differed slightly though, with Wiz leading at 54% indicating a likely or very likely switch to it (albeit on a modest 13 citations), followed in order by Microsoft, Fortinet, Palo Alto Networks, and SentinelOne.
Within this same group of respondents without firm plans to leave, 75% believed they were somewhat or very unlikely to see their organizations replace CrowdStrike. However, among the one-quarter of respondents more likely to do so, a majority believed it would occur in 7-12 months from the October 2024 survey date, with 22% indicating it would take over a year to fully complete a replacement.
ETR Data: ETR’s October 2024 CrowdStrike Drill Down survey asked current customers with no plans to replace CrowdStrike yet about alternative vendors they had evaluated (N = 86).
This is just a sneak peek of our extensive data on CrowdStrike and the impacts of the July outage. Reach out if you would like to see more detailed analyses in the full report, or to discuss your additional research needs.
Enterprise Technology Research (ETR) is a technology market research firm that leverages proprietary data from our targeted IT decision maker (ITDM) community to provide actionable insights about spending intentions and industry trends. Since 2010, we have worked diligently at achieving one goal: eliminating the need for opinions in enterprise research, which are often formed from incomplete, biased, and statistically insignificant data. Our community of ITDMs represents $1+ trillion in annual IT spend and is positioned to provide best-in-class customer/evaluator perspectives. ETR’s proprietary data and insights from this community empower institutional investors, technology companies, and ITDMs to navigate the complex enterprise technology landscape amid an expanding marketplace. Discover what ETR can do for you at www.etr.ai