In July, CrowdStrike said it was buying XM Cyber’s intellectual property for $145 million in cash and stock, plus more shares at close. On Oct 13, Ctech and Globes put a harder number on the filing: about $586 million. That is not a tuck-in. That is what a platform pays when it wants an attack-path graph and is willing to leave the customers behind.
Read the structure carefully. CrowdStrike closed an IP-only deal. It took more than 45 patents and proprietary source code. It did not take XM Cyber’s revenue or customer base. XM Cyber keeps operating under Schwarz Digits, with a license back from CrowdStrike, while XM customers get a path onto Falcon through Falcon Flex (CrowdStrike IR, Jul 16, 2026; Ctech, Oct 13).
How the $586 million is built. At signing, CrowdStrike disclosed $145 million in mixed cash and shares, with additional shares to be set at closing. A later SEC filing showed it issued 2,118,022 Class A shares to a Schwarz Group affiliate when the deal closed on Sept 8. Ctech valued those shares at about $441 million at $208 apiece and added them to the $145 million for an implied total near $586 million. Ctech also flags the caveat: the $145 million already mixed cash and stock, so treat $586 million as the street’s working figure, not a clean cash price (Ctech).
Schwarz Group bought the whole company for $700 million in 2021 (TechCrunch / Ctech). Now it has sold the code and patents for something near that again, kept the operating business, and deepened a Falcon-on-STACKIT sovereign-cloud partnership. That is a second bite of the apple. Early XM investors who exited in 2021 already got paid. Schwarz Digits just got paid again for the IP layer.
What CrowdStrike is actually buying. XM Cyber’s product maps how an attacker could move through an environment and ranks the paths most likely to reach critical assets. CrowdStrike’s July release framed that as fuel for Falcon Exposure Management: continuous visibility, exploitability-driven prioritization, and a single remediation path instead of chasing every CVE in a scanner dump (CrowdStrike IR). The thesis is straightforward. Vulnerability counts are noise. Attack paths are signal. Platforms that already sit on the endpoint want the graph that tells them which findings matter today.
That is also why the “no customers” clause matters. CrowdStrike is not buying ARR. It is buying the right to rebuild the capability inside Falcon and invite XM customers onto Flex over time. The operating company stays sovereign-friendly in Europe. The platform gets the patents. Schwarz Digits gets Falcon on STACKIT. Everyone claims a win on paper.
The valuation question. Roughly $586 million for code and patents, with zero disclosed revenue attached to the asset CrowdStrike took, is a platform multiple, not a software one. Compare it to the company’s full $700 million sale in 2021: CrowdStrike is paying in the same zip code for the IP alone. Either the attack-path category is that strategic, or CrowdStrike is paying a premium to keep a European exposure player from landing inside another platform first. Both can be true.
What buyers should ask. If you run XM Cyber today, get the license terms in writing: how long the product is supported, what happens to roadmaps, and whether Falcon Flex pricing is a migration incentive or a tax. If you are evaluating exposure management against Wiz, Qualys, Tenable, or a pure-play attack-path vendor, ask CrowdStrike when XM’s path-ranking shows up as a Falcon module, not a press-release roadmap. And if you are a European buyer who cared about XM staying inside Schwarz Digits, notice the partnership cut the other way: Falcon is coming onto STACKIT. Sovereignty is becoming a hosting choice, not a product choice.
The read. Platforms do not buy exposure graphs for the book. They buy them so the next renewal conversation is about paths, not finding counts. At ~$586 million for IP, CrowdStrike just told the category what that conversation is worth.