Salesforce Inc (CRM)

How it makes money

Almost everything is subscription revenue. Customers sign multi-year contracts for a number of user licences or a volume of usage, pay in advance (usually annually), and the revenue is recognised evenly over the life of the contract. In fiscal 2026 subscription and support brought in $39.4 billion of the $41.5 billion total — roughly 95% — and the remaining $2.1 billion came from professional services: consulting, implementation and training, a lower-margin business that mostly exists to get the subscriptions live. The model produces very visible forward revenue: the company reported approximately $72.4 billion of total remaining performance obligation at 31 January 2026, that is, contracted business not yet recognised, up 14% year over year. Growth comes from three places: new customers, more seats inside existing customers, and selling additional clouds or AI add-ons to accounts that already use one.

Revenue by segment

Once a company runs its sales pipeline, its service cases and its custom-built applications on Salesforce, moving away means re-training every user, rebuilding integrations to the rest of the IT estate and migrating years of customer history. That cost is what keeps renewal rates high and lets the company sell additional products into accounts it already has. Two things reinforce it: the ecosystem of consultants, independent developers and third-party apps built around the platform, and the fact that MuleSoft and Slack sit in the plumbing between Salesforce and everything else a company uses. It is not an unassailable position — the company itself lists customer attrition and the possible withdrawal of third-party developers among its risk factors — but the evidence of a 14% increase in contracted, not-yet-recognised revenue points to customers who stay.

Demand is neither defensive nor sharply cyclical. The stabiliser is the contract structure: multi-year subscriptions paid in advance, with about $72.4 billion of contracted revenue already booked but not yet recognised at 31 January 2026, so a downturn cannot remove revenue quickly — it slows the rate at which new revenue is added. The cyclical part is that Salesforce sells per user. Demand tracks corporate IT budgets and, more directly, corporate headcount: when clients stop hiring or cut staff, seat counts fall at renewal even if nobody cancels. The company names weakened economic conditions among its risk factors. Fiscal 2026 growth of 10%, with Marketing and Commerce up only about 3% while Platform, Slack and Other grew sharply, also shows demand shifting between product lines rather than moving as one block.

Key risks

• Security breaches and cybersecurity incidents — Salesforce holds its customers' commercial and personal data on its own systems. The company lists breaches, unauthorised access and incidents affecting its infrastructure among its principal risks: such an event could expose customer data, trigger liability and regulatory action, and damage the brand on which sales depend.
• Intense competition, including from AI-native entrants — The filing describes a market contested by large diversified software vendors and, explicitly, by 'AI-native companies and emerging startups that leverage generative AI and large language models as core foundation of their architecture, offering specialized, autonomous, or automated solutions'. Competitors may price more aggressively or move faster.
• Social, ethical and regulatory issues around artificial intelligence — The company flags the development, deployment, use and capabilities of AI in its offerings as a risk in its own right: evolving rules, unintended outputs and public scrutiny could constrain the products it is now building its strategy around.
• Acquisition integration — Salesforce lists the challenges of integrating acquired businesses among its risks. This is not abstract: Informatica closed in November 2025 and contributed $388 million of subscription revenue in fiscal 2026, and Slack, Tableau and MuleSoft all arrived the same way.
• Privacy laws and restrictions on cross-border data transfer — As a custodian of personal data operating worldwide, the company is exposed to privacy legislation and to rules restricting where data may be stored and moved — a category of risk it lists separately, alongside industry-specific regulation of its customers.
• Customer attrition and long, complex enterprise sales cycles — The subscription model only works if customers renew. The filing lists customer attrition, disruption in the sales organisation and the length and complexity of enterprise sales cycles as distinct risks — revenue is recognised over time, so a bad selling year shows up slowly and then persists.
• Weakened economic conditions — Among its general risks the company lists weakened economic conditions, which reach it through customers' IT budgets and headcount: fewer employees at a client means fewer licences to renew.
• Service defects, outages and dependence on third parties — Because everything runs on Salesforce's own infrastructure, defects or disruptions in the service — including interruptions at the third-party providers it relies on — hit every customer at once.

There is no concentration to speak of. The 10-K states plainly: 'None of our customers accounted for more than ten percent of our revenues in fiscal years 2026, 2025 or 2024.' The filing does not disclose a combined share for the largest customers, so no number can be given. The revenue base is spread across businesses of every size and essentially every industry and geography — the exposure is to the corporate spending cycle as a whole, not to any one account.