A 2027 U.S.–China conflict with Australia aligned to the U.S. China trade stops immediately, Taiwan exports are slowed/limited, and China launches large-scale cyber disruption in waves. This is a planning scenario, not a forecast. Planning scenario, not a forecast. No end date is set.
The home-market book keeps running if China trade stops. United States customer revenue was 144,546 million dollars and total revenue was 281,724 million dollars in the year ended 30 June 2025. The calculated United States share of Microsoft revenue is 51.3 percent. The same table prints Other countries at 137,178 million dollars and does not print a China line.
Microsoft Cloud revenue was 168.9 billion dollars in fiscal 2025, and that amount is included in the product lines rather than added to them. Server products and cloud services were 98,435 million dollars. Microsoft 365 Commercial products and cloud services were 87,767 million dollars.
United States revenue was 67 percent of CrowdStrike revenue. The shipping-address table prints United States revenue of 3,216,654 thousand dollars inside total revenue of 4,812,005 thousand dollars for the year ended 31 January 2026. No single country other than the United States represented 10 percent or more of total revenue.
The short-horizon outage analog is a public-note gap, not a restoration clock. The calculated span from the initial alert to the recovery-tool note is 2 days. CISA's initial alert is 11:30 a.m. EDT on 19 July 2024 and the recovery-tool note is 9:45 a.m. EDT on 21 July 2024. Microsoft's estimate, as quoted by CISA, is 8.5 million Windows devices.
The product is the attack surface because the Information Technology Sector produces software and IT services, and a single Falcon content update reached Windows hosts. Wave order beyond that observed failure is a planning inference.
A China trade stop removes the unpublished China slice inside Other countries of 137,178 million dollars. The printed United States book of 144,546 million dollars has no China deduction on the page.
Taiwan is not a revenue line in the Microsoft 10-K, Exhibit 21, the Salesforce 10-K, or the CrowdStrike 10-K. A slowed Taiwan export is a device-refresh constraint on Windows and Devices revenue of 17,314 million dollars only if the devices cannot be replaced. The origin share of that revenue line was not on the 10-K. The 2025 Census end-use computers row for Taiwan is 72,296,684,017 dollars. That national import is not an MSP invoice and not a foundry share.
The critical input is the vendor's own update channel. On 19 July 2024 CrowdStrike released a Falcon content configuration update that crashed certain Windows systems. CISA states the outage is due to the Falcon content update and not to malicious cyber activity.
Buyer support is the downstream of that update. CISA's 21 July 2024 note says Microsoft released a USB recovery tool. The calculated span from the initial alert to the recovery-tool note is 2 days.
Named China offices and leased sites are the physical slice a trade stop can reach. Exhibit 21 lists significant subsidiaries as of 30 June 2025 and omits subsidiaries that, in the aggregate, would not be a significant subsidiary. China and Taiwan are absent from that list. Absence is a non-significance statement, not a zero-property statement, because the 10-K still names China properties.
Sanctions and export-control language in the Microsoft 10-K already restricts some products and services. The page does not quantify a China revenue loss under a 2027 stop. Salesforce mentions evolving relations between the United States and China as a geopolitical risk and does not print a China revenue line.
Short-horizon outage analog: the calculated span from the initial alert to the recovery-tool note is 2 days. The dates are 19 July 2024 and 21 July 2024. This is the gap between two CISA notes. It is not full restoration, and it is not the 6 August 2024 root-cause update.
Short-horizon breadth on the same alert: 8.5 million Windows devices, less than one percent of all Windows machines. The cause line is the Falcon content update and not malicious cyber activity.
Expenses incurred in that fiscal year were 60,062 thousand dollars. The table header is thousands, for the fiscal year ended 31 January 2025, net of insurance receivable. Use it as the six-month-scale cash analog. Do not divide it by days.
The calculated increase in incident expenses is 96 percent. Inputs on the same rollforward are 117,730 thousand dollars incurred in the fiscal year ended 31 January 2026 and 60,062 thousand dollars incurred in the fiscal year ended 31 January 2025.
Wave 1 is the widely deployed product: commercial cloud subscriptions and endpoint security agents, direct, plus Windows device refresh as indirect because the crashed host is a Windows machine. The observed analog is the 19 July 2024 Falcon content update, 8.5 million Windows devices, and a 2-day public-note gap. CISA says that update was not malicious cyber activity. Placing a future PRC campaign on this week-1 path is a planning inference. The IT sector page establishes the sector as critical infrastructure and does not publish a wave calendar.
Wave 2 is the enterprise layer: identity and email tenants, CRM subscriptions, large software publishers, direct; the MSP partner channel and China offices, indirect. Salesforce's book and Microsoft 365 Commercial are the scale. The order is a planning inference.
Wave 3 is the distributed set: 11,022 small software firms as a direct target, and buyer support desks as indirect recovery load. The order is a planning inference. The Census size split is 2022 and is not a cyber victim count.
origin sharepercent
The calculated United States share of Microsoft revenue is 51.3 percent.
Microsoft FY2025 Form 10-KUnited States revenue was 67 percent of CrowdStrike revenue.
CrowdStrike FY2026 Form 10-Koutage daysdays
The calculated span from the initial alert to the recovery-tool note is 2 days.
CISA CrowdStrike outage alertincident expense changepercent
The calculated increase in incident expenses is 96 percent.
CrowdStrike FY2026 Form 10-Kus software publisherspeople
Software publishers in this establishment series employed 636,525 people.
BLS QCEW NAICS 513210 2024ratespercent
The dollar-based net retention rate was 115 percent.
CrowdStrike FY2026 Form 10-Kus incident expensethousand dollars
Expenses incurred in that fiscal year were 60,062 thousand dollars.
CrowdStrike FY2026 Form 10-KConfirm whether a Falcon-class content update is still unrepaired after the public-note analog. The calculated span from the initial alert to the recovery-tool note is 2 days. Staff the buyer desk to the vendor portal and the Microsoft recovery tool named on the CISA alert.
Separate China-site work from the subscription bill. China properties are named. United States revenue of 144,546 million dollars is the book that keeps running.
Read any single non-U.S. country share against the printed ceiling. No single country other than the United States represented 10 percent or more of CrowdStrike revenue.
Count incident cash against the first fiscal-year print. Expenses incurred in that fiscal year were 60,062 thousand dollars.
Check renewal quality. The dollar-based net retention rate was 115 percent. A break below that print is the planning line for the subscription buffer, and the filing does not publish it as a covenant.
Keep Windows and Devices revenue of 17,314 million dollars on a separate refresh watch. A Taiwan share of that revenue line is unpublished. The 2025 Census end-use computers row for Taiwan is 72,296,684,017 dollars and is not an MSP invoice.
Days from a bad endpoint update to a published recovery tool. Act when an unrepaired endpoint update runs past 2 days. Two days is the calculated span from the 19 July 2024 initial alert to the 21 July 2024 recovery-tool note. This is a planning line. CISA does not publish it as an operating covenant, and it is not full restoration.
Any non-U.S. country share of CrowdStrike revenue. Act when a non-U.S. country share crosses 10 percent of CrowdStrike revenue. Ten percent is the ceiling the FY2026 10-K prints for fiscal 2026, 2025, and 2024. This is a planning line. The filing is a disclosure threshold, not a debt covenant.
July 19 Incident expenses incurred, thousand dollars. Act when incident expenses incurred in a fiscal year rise above 60,062 thousand dollars. That figure is the fiscal year ended 31 January 2025 print, net of insurance receivable. This is a planning line set at the first observed year. The 10-K does not publish it as a covenant. The following year already printed 117,730 thousand dollars.
Microsoft revenue from United States customers, million dollars. Act when Microsoft United States revenue prints below 144,546 million dollars. That figure is the year ended 30 June 2025. This is a planning line at the latest home-market print. The 10-K does not publish a minimum United States revenue covenant.
Keep the United States revenue line and the Other countries line separate, and leave China unpublished until a filing prints it.
Map China properties as sites, not as a headcount, until a filing prints China employment.
Hold Microsoft Cloud inside the product lines so 168.9 billion dollars is not added twice.
Run a 2-day recovery case from the CISA note dates.
Track incident cash against 60,062 thousand dollars and the following-year 117,730 thousand dollars.
Count MSSP end customers inside the more than 88,000 organizations, not as a second book.
Treat a 12-to-36-month term and unearned revenue of 24,317 million dollars as the buffer.
Do not convert the approximately 93 percent Americas phrase into a United States dollar.
Use the under-20 row of 11,022 firms and employment of 40,923 as the staff baseline.
Keep a manual path for the buyer desk because recovery in the analog depended on a vendor tool.
Unrepaired days after a vendor content update The calculated span from the initial alert to the recovery-tool note is 2 days. A week-one desk tracks days, not a year-over-year revenue print.
United States share of vendor revenue The calculated United States share of Microsoft revenue is 51.3 percent. United States revenue was 67 percent of CrowdStrike revenue. A country line crossing 10 percent at CrowdStrike would be new disclosure.
Incident expense against 60,062 thousand dollars Expenses incurred in that fiscal year were 60,062 thousand dollars. The following year print is 117,730 thousand dollars. The calculated increase in incident expenses is 96 percent.
Dollar-based net retention The dollar-based net retention rate was 115 percent. The prior print on the same table was 112 percent.
The unpublished primary is Microsoft revenue from customers located in China. The geographic table prints United States 144,546 million dollars and Other countries 137,178 million dollars. It does not print China. Categories that need that dollar stay limited.
Also unpublished on the pages opened: China dollars inside CrowdStrike Asia Pacific of 495,701 thousand dollars and inside Salesforce Asia Pacific of 4,315 million dollars; China headcount inside Microsoft's 103,000 international employees; which China properties are offices, datacenters, or research and development; a current BEA computer-services export to China; and an MSP invoice or revenue line that names Taiwan. The 2025 Census end-use computers row for Taiwan is 72,296,684,017 dollars. That national import is not a foundry share and not a share of Windows and Devices revenue. The WITS pages for HS 847130 in 2023, HS 847130 in 2024, and HS 851762 in 2024 returned an error and no partner table. CDW Exhibit 21.1 does not name Taiwan. No MSP Taiwan share is invented. Exhibit 21's silence is non-significance, not zero operations.
sec.govsec.govsec.govsec.govcensus.govsec.govwits.worldbank.orgwits.worldbank.orgwits.worldbank.org
Calculated figures use two numbers from the cited page and are labeled. The 51.3 percent share is 144,546 divided by 281,724. The 96 percent increase is 117,730 minus 60,062, divided by 60,062, rounded to the nearest percent. The 2-day span is the date gap from 19 July 2024 to 21 July 2024. Mid-market employment of 185,171 is 226,094 minus 40,923. Mid-market firms of 2,232 are 13,254 minus 11,022. The approximately 93 percent Salesforce phrase is not multiplied.
SUSB 2022 NAICS 511210 is firm primary industry. QCEW 2024 NAICS 513210 is an establishment series. Employment of 874,707 and employment of 636,525 are not a time series and are not a decline. PAYR and RCPT columns are not converted to dollars because the file header does not print a unit. The 39 percent G&A increase is not the incident share. Wave order is a planning model.
| Node | Primary impact | Time horizon | Cyber wave | Evidence |
|---|---|---|---|---|
| Commercial cloud subscriptions | The subscription keeps running for non-China customers, and the China dollar inside Other countries is unpublished. | 0-3 months | Wave 1 (direct) | Microsoft FY2025 10-K; CISA IT sector |
| Endpoint security agents | A bad content update can crash Windows hosts that already run the agent. | 0-3 months | Wave 1 (direct) | CISA 19 July 2024 alert; CrowdStrike 10-K |
| Identity and email tenants | Microsoft 365 Commercial tenants are the identity and mail layer inside the same cloud book. | 1-6 months | Wave 2 (direct) | Microsoft FY2025 10-K |
| CRM and application subscriptions | CRM billings continue for non-China customers, and Asia Pacific is not a China line. | 1-6 months | Wave 2 (direct) | Salesforce FY2026 10-K |
| MSP partner channel | MSSP end customers sit on the same agent, so a vendor update stops the partner console too. | 1-6 months | Wave 2 (indirect) | CrowdStrike FY2026 10-K |
| Windows and device refresh | Windows and Devices revenue is the refresh the software firm cannot re-order if devices stall. | 0-3 months | Wave 1 (indirect) | Microsoft FY2025 10-K; CISA alert |
| China offices and leased sites | Named China properties lose trade access, and the 10-K does not print China headcount. | 1-6 months | Wave 2 (indirect) | Microsoft FY2025 10-K; Exhibit 21 |
| Small software publishers | Firms with fewer than 20 employees are the distributed publisher set. | 12+ months | Wave 3 (direct) | Census SUSB 2022 |
| Large software publishers | The large-publisher employment block is the home-market book that keeps billing. | 1-6 months | Wave 2 (direct) | Census SUSB 2022; Microsoft, Salesforce, CrowdStrike |
| Buyer support desks | Customer help desks absorb the recovery work after the vendor pushes a fix. | 0-3 months | Wave 3 (indirect) | CISA alert; CrowdStrike incident rollforward |