Net revenue retention is the single number that tells you whether a subscription software business grows even if it never signs another new customer. In security software it is almost always reported as a dollar-based net retention rate, and it answers a narrow, specific question: take the set of subscription customers a company had twelve months ago, and ask how much recurring revenue that exact same set is producing today. The answer folds in four behaviors at once — customers that renewed, customers that expanded (bought more seats or more modules), customers that contracted (downgraded), and customers that churned (left entirely) — while pointedly leaving out every dollar from customers won during the year. That exclusion is the whole point. New-customer revenue tells you about sales execution; net retention tells you about the durability and expansion of what you already have.

Because it is a company-defined operating metric and not a line on an audited financial statement, the meaning of "net retention" lives in the definition the filer prints. CrowdStrike Holdings, in its Form 10-Q for the quarter ended April 30, 2026, lays the method out in plain terms, and it is worth reading the company's own words rather than a secondhand gloss:

"Our dollar-based net retention rate compares our ARR from a set of subscription customers against the same metric for those subscription customers from the prior year. Our dollar-based net retention rate reflects customer renewals, expansion, contraction, and churn, and excludes revenue from our incident response and proactive services. We calculate our dollar-based net retention rate as of period end by starting with the ARR from all subscription customers as of 12 months prior to such period end, or Prior Period ARR. We then calculate the ARR from these same subscription customers as of the current period end, or Current Period ARR."— CrowdStrike Holdings, Inc., Form 10-Q (quarter ended April 30, 2026), source

Three things in that definition do most of the work. First, the metric is built on ARR — annual recurring revenue — rather than recognized GAAP revenue, so it reflects the contracted run-rate of the subscription book, not the quarter's recognized number. Second, the cohort is frozen: it is the customers that existed twelve months prior, measured then and measured now, so anyone who became a customer in the interim is invisible to the calculation. Third, the filing carves out specific revenue streams — in CrowdStrike's case incident response and proactive services — because those are project-based rather than recurring, and including them would muddy a metric meant to isolate the recurring base. Every filer makes carve-outs like this, and they are not identical from company to company. That is precisely why two vendors quoting "net retention" are not necessarily measuring the same thing.

Why above or below 100% is the line that matters

The arithmetic is a ratio: current-period ARR from the frozen cohort divided by that cohort's prior-period ARR, expressed as a percentage. If the customers who were on the books a year ago are collectively paying more today — because expansion and upsell outran contraction and churn — the rate clears 100%. If downgrades and departures outweighed expansion, it falls below 100%. A rate of, say, 110% means that even with zero new logos, the existing base would have grown the recurring book by 10% over the year. A rate of 95% means the base is leaking, and the company has to win enough new customers just to stand still. For a land-and-expand security platform, where the commercial thesis rests on selling additional modules into an existing footprint, net retention is the most direct quantitative test of whether that thesis is actually playing out.

It is also a metric to read with discipline, because its construction creates predictable distortions. A vendor that has recently signed many large new customers will see those land at full price but expand more slowly at first, which can weigh on the rate even when the business is healthy; the new logos themselves do not help the number because they are outside the cohort. Conversely, a maturing base with little room to expand can drift toward 100% simply because there is less headroom for upsell, not because anything went wrong. The filing's own surrounding language matters here: in the same 10-Q, CrowdStrike notes it has "maintained high dollar-based gross retention rates" while disclosing "delays in creating sales opportunities and longer sales cycles" — a reminder that net retention blends two distinct forces (keeping customers, and growing them) that can move in opposite directions and that the company sometimes reports separately as gross retention.

How to use it without overreading it

The practical discipline is to treat net retention as a directional, definition-bound signal rather than a precise, cross-company yardstick. Read it the way the filing constructs it: ARR-based, cohort-frozen, expansion-and-churn-inclusive, with named exclusions. Compare a company to its own prior quarters first, because the methodology is held constant there. Only then compare across vendors, and only after checking that each defines the cohort window, the revenue base, and the carve-outs the same way — they frequently do not. When a management team highlights net retention on an earnings call, the grounded move is to pull the metric definition from the most recent 10-Q and confirm what the number is actually measuring before drawing any conclusion about the health of the installed base.

Finally, remember what the metric is not. It is not a GAAP figure, it is not audited as a standalone number, and it is not comparable to a competitor's headline by default. It is a constructed operating ratio whose value comes entirely from the consistency of its definition over time within a single filer. The SEC filing is where that definition is fixed and disclosed, which is why the durable, citable answer to "what does net revenue retention mean" for any given security software company is: read that company's own 10-Q, find the dollar-based net retention paragraph, and let the company's stated method define the term.