Home / Case Studies / CrowdStrike Falcon Flex Restructure
CrowdStrikeFinancial ServicesFalcon Flex2025 Engagement

Falcon Flex right-sized. $2.9M saved over three years.

A mid-tier financial services group had bought a three-year Falcon Flex commit at the peak of a rapid rollout. Eighteen months in, three of the entitled modules were sitting unused and the renewal team was being told the only way to reduce the commit was to lose the master discount. We rebuilt the position. The client cut the commit by 28%, removed three modules, and kept the original discount intact.

Cybersecurity operations centre
$2.9M
Three-year saving
28%
Reduction in committed spend
3
Modules removed
0%
Loss of master discount
The contract going in

A Falcon Flex commit sized for a different roadmap.

The client had signed a Falcon Flex agreement two years earlier when a security transformation was running at full speed. The commit was sized against an eighteen-month deployment plan that included Identity Threat Protection, Discover and a then-new module for cloud workload protection. By the time we joined, the deployment had narrowed: two of the modules had been parked, one had been replaced by an incumbent tool that the security team preferred, and the seat count had drifted below the entitled level.

  • Three-year commit with eight modules entitled. Three with zero meaningful usage.
  • Annual true-up was treating the commit floor as a price floor, not a ceiling.
  • The account team had positioned any reduction as a structural re-paper that would reset the master discount.
CrowdStrike's opening position

Renew the shape. Add Charlotte AI.

The renewal proposal preserved the commit shape, added Charlotte AI at a preferred Flex rate, and bundled in a small uplift on the per-endpoint rate to fund the AI addition. The proposed alternative for reducing modules was a re-paper at standard pricing.

What we flagged

The Falcon Flex master discount is not legally tied to the module mix. It is tied to the total commit dollars. Restructuring the mix without reducing the floor preserves the discount — vendors do not always lead with that.

The work

Ten weeks. Three workstreams.

The engagement was tight because the renewal anniversary was fixed. We ran three parallel tracks and reconverged before the first commercial round.

1. Consumption truth

We pulled six quarters of Falcon Flex consumption from the client's portal, mapped it module-by-module against the contractual entitlement, and built a single page that the CISO could read at a glance. Three modules came out of that page as “committed but not used.”

2. Commercial structure rebuild

We modelled a Flex restructure that kept the original master discount, removed the three dormant modules, and rebased the commit at a level the consumption truth could support. The model showed that the discount math worked because Flex anchors to total commit, not module count.

3. Charlotte AI evaluation

The proposed Charlotte AI add-on became its own decision. We negotiated a six-month pilot at the same Flex rate, with a contractual right to remove if the operational value did not land.

Lesson

Falcon Flex looks rigid. It is not. The lever is the relationship between the commit floor, the module mix and the discount. Re-shaping the mix without reducing the floor is rarely refused once the consumption evidence is in the room.

The contract going out

Smaller commit. Same discount.

The renegotiated agreement carried a 28% smaller annual commit, removed the three dormant modules, preserved the master discount, and added Charlotte AI as a contractual pilot with a documented exit. The renewal landed inside the original anniversary window.

$2.9M
Saved
Versus the renewal-as-proposed, measured over the three-year term.
3
Modules out
Identity Threat Protection (legacy tier), Discover, and one cloud workload module retired with documented evidence.
6 mo
Charlotte AI pilot
Same Flex rate, contractual exit right, no auto-conversion.
“We were ready to accept that reducing the commit meant losing the discount — that is what we had been told. The advisor disassembled that argument in one meeting and we kept the discount. The pilot terms on Charlotte AI were the second win.”
Head of Security Operations · Financial services group · Anonymised by client request
Related resources

More on CrowdStrike negotiation strategy.

← Back to all case studies

CrowdStrike Falcon Flex up for renewal?

Tell us the renewal date and the module mix. We will respond within one business day with the lead and the most relevant precedent.