CrowdStrike
Subscription SaaS: module-based Falcon platform ARR plus Falcon Flex consumption-style contracts; land-and-expand across the multi-module Falcon platform with professional/managed services (MDR, OverWatch) attach
Earnings, margins, COGS & capex
CrowdStrike compounds ARR at scale: FY26 was its first year above $1B net new ARR ($1.01B, ending ARR $5.25B, +24%), and Q1 FY27 accelerated with record Q1 net new ARR of $255.8M (+32% YoY) to $5.51B ending ARR. Revenue grew 22% in FY26 to $4.81B and 26% YoY in Q1 FY27 to $1.386B. Quarterly GAAP profitability returned in Q4 FY26 ($38.7M net income) and held in Q1 FY27 ($27.8M), though FY26 as a whole was a GAAP net loss of $162.5M with a $293.3M GAAP operating loss - driven primarily by $1.13B of stock-based compensation plus $117.7M of July-19-incident-related costs and $44.8M of strategic plan charges; non-GAAP operating income was $1.05B FY26 and $325.7M in Q1 FY27. Cash generation is elite: record FY26 operating cash flow of $1.61B and FCF of $1.24B, then record Q1 FY27 OCF of $590.9M and FCF of $468.5M. Management targets $20B ending ARR by FY2036.
Income statement — where each revenue dollar goes
% of revenueOf every $1 of revenue, ~22¢ is cost of goods and ~78¢ operating expense, and the remainder is an operating loss.
Revenue trend
Margins
up from 77% in Q1 FY26; 79% in Q4 FY26
up from 80% in FY25
improving sharply from -10.8% in Q1 FY26 as July-19-incident costs roll off
up from 18.2% in Q1 FY26; FY27 guide implies ~24.7% at midpoint
record; FY26 full year was 26% ($1.24B)
COGS structure
COGS is cloud hosting and data-processing for the Falcon platform (substantially AWS, plus GCP expansion), threat-intel and telemetry pipeline costs, support, and amortization; subscription COGS ran ~22% of subscription revenue in Q1 FY27 ($288.5M on $1,320.9M; GAAP subscription gross margin 78%), with lower-margin professional/managed services a small slice of total revenue ($64.8M of $1.386B in Q1 FY27).
Capex
Capex is data-center/cloud capacity and capitalized internal-use software: Q1 FY27 PP&E purchases $97.6M plus $22.6M capitalized software (~$120M, ~8.7% of revenue; FY26 full year ~7.7%); intensity is structurally modest for a software model and FCF conversion remains high.
Latest earnings
Beat - company states it exceeded expectations across all guided metrics and raised FY27 net new ARR growth guidance by 520bps at the midpoint; the stock nonetheless sold off ~11% post-print on elevated expectations and valuation (press coverage, 2026-06)
FY27 (ending 2027-01-31) raised: revenue $5,914.7-5,958.7M, ending ARR $6,531.7-6,555.5M (net new ARR growth ~27.7% at midpoint, an acceleration vs FY26), non-GAAP operating income $1,452.3-1,480.3M, non-GAAP net income $1,263.1-1,285.2M, non-GAAP diluted EPS $4.88-4.96 (pre-split; ~$1.22-1.24 split-adjusted). Q2 FY27: revenue $1,436.0-1,442.0M, ARR $5,792.6-5,794.6M
- Ending ARR
- $5.51B, +24% YoY (2026-04-30)
- Net new ARR
- $255.8M, +32% YoY (record Q1)
- Falcon Flex account ARR
- $1.69B, +120%+ YoY (2026-01-31)
- Module adoption (6+/7+/8+)
- 51% / 35% / 25% (2026-04-30)
- Free cash flow
- $468.5M, 34% margin (Q1 FY27)
- Long-term target
- $20B ending ARR by FY2036 (management, 2026-03-03)
Growth drivers
- Falcon Flex consumption contracts — $1.69B ending ARR from Falcon Flex accounts as of FY26 close (2026-01-31), up over 120% YoY - the primary expansion vehicle, now extended to services via Flex for Services and the Zero Dollar Flex Fund
- Platform consolidation — module adoption of 51% / 35% / 25% for 6+ / 7+ / 8+ modules (2026-04-30), up from 50% / 34% / 24% at 2026-01-31
- AI security wave — Falcon AI Detection and Response (AIDR) GA, Charlotte AI AgentWorks ecosystem built with AWS, NVIDIA, and OpenAI, Project QuiltWorks coalition featuring OpenAI and Anthropic, and Agentic MDR
- Next-Gen SIEM displacing legacy SIEM (Splunk/Elastic estates), including Falcon OverWatch for Defender and Next-Gen SIEM ingestion of third-party telemetry inside Microsoft Defender environments
- Cloud security (CNAPP, Cloud Detection and Response now on Google Cloud) and identity (FalconID GA, SGNL acquisition) plus new Falcon Data Security expanding TAM beyond endpoint
- Public sector — FedRAMP High expansion (Charlotte AI for Gov, Falcon for XIoT, External Attack Surface Management) and sovereign-cloud distribution (Schwarz Digits / STACKIT in Europe; new regional clouds planned for Saudi Arabia, India, UAE)
Reported financials — SEC EDGAR
Audited GAAP figures pulled from SEC filings · latest filing 2026-03-05. The audited primary-source spine — not financial advice.
Revenue — annual (GAAP)
Margins & balance sheet — FY’26
Bull & bear
The bull case: CrowdStrike is the consolidating platform winner in security at the exact moment AI creates a new, mandatory security budget line - net new ARR is reaccelerating (+32% YoY) off a $5.5B base, Falcon Flex is compounding at 120%+, and the FY36 $20B ARR target implies roughly 14% compounded ARR growth for a decade that current momentum suggests is beatable, with FCF margins already at 26% annually.
- Growth is reaccelerating, not decaying: record Q1 net new ARR of $255.8M (+32% YoY) and FY27 net new ARR growth guidance raised 520bps to ~27.7% at the midpoint - an acceleration over FY26 (Q1 FY27 release, 2026-06-03)
- Falcon Flex is a proven expansion engine: $1.69B ending ARR from Flex accounts, +120% YoY (FY26 close), pulling customers into multi-module commitments ahead of usage
- AI security is a new TAM where CRWD has pole position: only cybersecurity launch partner in both OpenAI's Trusted Access for Cyber and Anthropic's Project Glasswing, the QuiltWorks coalition, AIDR GA, and an agent ecosystem built with AWS, NVIDIA, and OpenAI (Q1 FY27 release)
- Profitability inflection is real: GAAP net income positive two straight quarters (Q4 FY26 $38.7M, Q1 FY27 $27.8M), non-GAAP operating margin 23.5% and rising, record $468.5M Q1 FCF (34% margin)
- Post-outage resilience is proven: the company grew ARR 24% and retained its Gartner MQ endpoint leadership through the worst self-inflicted incident in industry history - evidence of genuine switching costs
- Balance sheet optionality: ~$3.8B net cash plus ~$949M remaining buyback authorization funds tuck-in M&A (SGNL, Seraphic Security) and share-count discipline
The bear case: CRWD trades at roughly 32x forward EV/revenue and ~150-155x forward non-GAAP earnings for a business decelerating toward low-20s revenue growth at scale, with Microsoft structurally underpricing it, GAAP economics still SBC-heavy (FY26 was a GAAP net loss), kernel-access and single-vendor-concentration risks unresolved since the 2024 outage, and a price that already discounts execution well beyond the $20B FY36 ARR goal.
- Extreme valuation: ~$195B market cap on $5.94B guided FY27 revenue midpoint (~32x EV/forward revenue) and ~$1.27B guided FY27 non-GAAP net income (~150-155x) - a beat-and-raise quarter still produced an ~11% selloff (2026-06), showing expectations are priced beyond guidance
- Microsoft bundling: Defender + Sentinel ride E5 licensing at near-zero marginal cost; CRWD itself now ships Falcon OverWatch for Defender, tacitly acknowledging Defender-standardized estates it cannot displace
- Law of large numbers: revenue growth decelerated 36% -> 29% -> 22% across FY24-FY26; sustaining ~27.7% net new ARR growth off a $5.25B base requires new franchises (SIEM, cloud, identity, data) to outgrow rising churn risk in core endpoint
- GAAP quality gap: FY26 GAAP operating loss of $293.3M vs $1.05B non-GAAP operating profit - $1.13B of SBC plus incident/legal costs; SBC-driven dilution partially offsets buybacks
- Unresolved concentration/kernel risk: the July 2024 outage litigation tails on (Delta's negligence and computer-trespass claims proceed even after its fraud claims were dismissed in May 2025), and Microsoft's Windows security architecture changes could narrow the sensor moat that justifies premium pricing
- AI cuts both ways: if autonomous SOC tooling commoditizes detection/response, or hyperscalers (Microsoft, Google/Wiz) vertically integrate AI security, CRWD's premium-priced modules face margin and win-rate pressure
What it is worth
EV/forward-revenue comps vs security-platform peer set (PANW, ZS, FTNT, S, MSFT security implied) plus reverse-DCF sanity check on guided FY27 financials; scenario values are split-adjusted per-share (post 4-for-1, 2026-07 basis)
~$110-130 split-adjusted
growth decelerates to high-teens on Microsoft bundling pressure and AI commoditization, GAAP margin progress stalls, multiple compresses to ~15-18x EV/revenue - still a premium software multiple
~$180-200 split-adjusted (near current ~$190): FY27 guidance delivered (~23-24% revenue growth, ~27.7% NNARR growth), multiple drifts to high-20s EV/forward-revenue as growth and rate environment offset
~$240-260 split-adjusted
net new ARR sustains ~30%+ growth, AIDR/agentic-SOC becomes a >$1B ARR franchise, FY28 revenue growth holds >25%, multiple holds ~30x EV/revenue on raised numbers
At ~$195B market cap and ~$3.8B net cash (EV ~$191B), CRWD trades at ~32x guided FY27 revenue ($5.94B midpoint) and ~150-155x guided FY27 non-GAAP net income ($1.27B midpoint; ~$1.23 split-adjusted EPS) - the premium multiple of the entire large-cap security set (PANW and ZS trade at a fraction of this on EV/revenue). Illustrative reverse-DCF: the price roughly implies ~25% revenue CAGR for a decade with terminal FCF margins in the low-30s - i.e., meaningfully beating management's own $20B-ARR-by-FY36 path (~14% ARR CAGR). The market is paying today for the AI-security TAM materializing on top of the stated plan. Sustained ~30% net new ARR growth would justify the premium; reversion to high-teens growth would not.
SWOT
Strengths
- Category leader in endpoint — Leader in the 2026 Gartner Magic Quadrant for Endpoint Protection for the 7th consecutive time, positioned highest on ability to execute and furthest on completeness of vision
- Single lightweight-agent, cloud-native architecture spanning a broad module portfolio - genuine platform consolidation economics (51% of customers on 6+ modules, 2026-04-30)
- Elite financial profile at scale — 24% ARR growth with 81% non-GAAP subscription gross margin, 23.5% non-GAAP operating margin (Q1 FY27), and $1.24B FY26 FCF
- Net cash balance sheet (~$3.8B net cash, 2026-04-30) funding M&A (SGNL, Seraphic Security) and a ~$949M remaining buyback authorization (2026-03-02)
- Deep AI positioning — only cybersecurity company selected as a launch partner in both Anthropic's Project Glasswing and OpenAI's Trusted Access for Cyber; Project QuiltWorks coalition; Falcon AIDR GA
- Brand and incident-response franchise (OverWatch, threat intel, MDR) that drives high-trust enterprise and federal relationships
Weaknesses
- July 19, 2024 global outage legacy — $117.7M of incident-related costs hit FY26 GAAP results, and Delta Air Lines litigation plus residual customer-commitment costs still tail through the P&L
- GAAP profitability is thin and recent (Q1 FY27 — $27.8M net income on $1.386B revenue; FY26 was still a $162.5M GAAP net loss) - heavy stock-based compensation ($1.13B FY26) keeps the GAAP/non-GAAP gap wide
- Premium pricing invites displacement attempts by cheaper bundled alternatives (Microsoft E5) in cost-constrained accounts
- Revenue concentration in endpoint-anchored subscriptions — newer franchises (SIEM, cloud, identity, data) must keep scaling to sustain 20%+ growth off a $5.5B ARR base
- Windows kernel-level dependency — Microsoft's post-outage Windows security architecture changes could constrain the deepest sensor advantages over time
Opportunities
- AI-agent security (AIDR, agentic SOC, Charlotte AI AgentWorks) — management frames the AI revolution as a new, generational growth opportunity with CrowdStrike securing AI from GPU to agent to prompt
- Legacy SIEM displacement — Next-Gen SIEM against Splunk (Cisco) and Elastic estates, now including third-party telemetry ingestion inside Microsoft Defender shops
- Federal/public sector expansion via the FedRAMP High portfolio (Charlotte AI for Gov, Falcon for XIoT, EASM) and GovCloud, plus European sovereign cloud via Schwarz Digits/STACKIT
- Falcon Flex extending into services (Flex for Services, Zero Dollar Flex Fund) deepening wallet share and contract stickiness
- Consolidation tailwind — CISOs reducing vendor count favors the broadest single-agent platform; the $20B FY36 ARR goal implies management sees a long runway
- Data security and identity (FalconID, SGNL, Falcon Data Security) opening adjacent budgets beyond core endpoint
Threats
- Microsoft (MSFT) bundling Defender/Sentinel into E5/Azure at marginal cost - the single biggest structural competitive threat
- Palo Alto Networks (PANW) platformization push and Google (GOOGL) post-Wiz cloud-security aggression compressing platform-consolidation win rates
- Another operational failure would be existential for trust — the 2024 outage proved single-vendor concentration risk to customers and regulators
- Valuation risk — at ~32x forward EV/revenue, even modest growth deceleration produces outsized drawdowns (the stock fell ~11% on a beat-and-raise in 2026-06)
- AI could commoditize parts of detection/response or empower attackers faster than defenders; open agent ecosystems may erode proprietary-data moats
- Macro/budget scrutiny lengthening large-deal cycles, and FX/geopolitical exposure in international expansion
Moats, dependencies & bottlenecks
Moats
51% of customers on 6+ modules (2026-04-30); replacing the agent means ripping out endpoint, identity, cloud, and SIEM at once - switching costs compound with each module
Telemetry at trillions-of-events scale across the installed base (company-claimed) trains detection models every customer benefits from; scale advantage grows with ARR
7x consecutive Gartner MQ Endpoint Protection leader; OverWatch/MDR and IR relationships create board-level trust - though the 2024 outage showed trust can be dented
$1.69B ARR +120% YoY (FY26 close): pre-committed consumption pools lock multi-year spend and lower friction to adopt new modules
FedRAMP High across an expanding portfolio (Charlotte AI for Gov, Falcon for XIoT, EASM) is a multi-year barrier for smaller rivals
Launch-partner slots with OpenAI (TAC) and Anthropic (Glasswing) plus the QuiltWorks coalition; too early to call durable but a real head start in AI-agent security
Dependencies
infrastructure supplier Falcon platform is hosted substantially on AWS; hyperscaler cost and capacity shape gross margin - partially diversified via GCP expansion
platform dependency Deep kernel-level sensor access on Windows underpins the endpoint moat; Microsoft is simultaneously CRWD's biggest competitor and controls the OS surface post-outage
technology partner AI-security positioning (QuiltWorks, TAC, Glasswing) leans on privileged access to frontier labs; terms and exclusivity can shift
GPU-to-agent AI security stack (NVIDIA) and AI-PC silicon-level telemetry collaboration (Intel) extend the platform to new form factors
Partner-led motion drives SMB and international reach; Charlotte AI integration with IBM ATOM extends agentic SOC distribution
customer concentration Growing GovCloud/FedRAMP franchise exposes a rising ARR slice to appropriations timing and policy shifts
Advantages
- Fastest and only pure-play cybersecurity software company to surpass $5B ending ARR (company claim, FY26 release, 2026-03-03)
- Best-in-class growth-plus-FCF compounding — 24% ARR growth with 26% annual FCF margin and a net cash balance sheet
- Single-agent architecture yields real consolidation economics competitors assembled via M&A struggle to match
- First-mover slots in frontier-AI security programs (OpenAI TAC, Anthropic Glasswing) ahead of every security peer
- Threat-intel and adversary-attribution franchise that feeds product, brand, and federal credibility simultaneously
Weaknesses
- Valuation leaves no room for error (~32x forward EV/revenue, 2026-07)
- SBC-heavy GAAP economics — GAAP operating margin still slightly negative (-2.2% Q1 FY27) and FY26 was a GAAP net loss
- Outage litigation tail (Delta et al.) and residual customer-commitment costs
- Premium price point vs bundled Microsoft E5 alternative in cost-down cycles
- Endpoint-anchored mix means newer franchises must scale fast to hold growth
Bottlenecks
- Windows kernel-access policy — Microsoft's post-2024 security architecture changes gate how deep third-party sensors can sit
- Net-new-logo capacity at the high end — most of the Global 2000 already has an endpoint vendor, so growth increasingly depends on displacement and expansion, which are slower motions
- Legacy SIEM migration friction — displacing Splunk/Elastic estates requires long data-migration projects that pace Next-Gen SIEM ARR
- Elite security-analyst and AI-engineering talent supply for OverWatch/MDR and Charlotte AI scale-out
- Large-deal scrutiny — CFO-level review of 7-figure platform consolidations lengthens sales cycles in tight budget environments
Top signals & trends
Top signals
Growth inflection off a $5.25B base; FY27 NNARR growth guide raised 520bps to ~27.7% at the midpoint
The expansion engine is compounding; Flex now extends to services (Flex for Services, Zero Dollar Flex Fund)
July-19-incident cost drag rolling off ($18.1M in Q1 FY27 vs $39.7M a year earlier); watch for full-year GAAP profitability in FY27
Cosmetic, but signals management confidence; split-adjusted price ~$190 and a post-split rally to a $199.53 52-week high
Expectations exceed guidance; the multiple is the risk, not the business
Platform consolidation thesis confirmed in the KPI that matters most
Fraud/intentional-misrepresentation claims dismissed (Fulton County, May 2025); negligence and computer-trespass claims proceed - CRWD's outside counsel projects a single-digit-millions worst case, but the damages precedent for software operational failures still matters
Implies ~14% compounded ARR growth for a decade; credible if the AI security TAM materializes
Trends
strong tailwind · AIDR, Agentic MDR, and Charlotte AI AgentWorks position CRWD to tax enterprise AI adoption; QuiltWorks/TAC/Glasswing give frontier-lab proximity
CISOs cutting vendor count favors broad single-agent platforms; CRWD and PANW are the two consolidation poles outside Microsoft
Next-Gen SIEM attacks the Splunk (CSCO) install base; Defender-environment ingestion widens the funnel
Microsoft E5 bundling and Google's Wiz acquisition put the two deepest pockets in CRWD's cloud and endpoint markets
Adds friction but CRWD is monetizing it (Schwarz Digits/STACKIT partnership, regional CDR on Google Cloud, planned regional clouds in Saudi Arabia, India, UAE)
Regulators and Microsoft OS changes could cap agent depth and encourage dual-vendor strategies
Ecosystem & competitor graph
Suppliers feed the company; customers pull from it. Line thickness shows the strength of each tie (supply-chain dependency, customer earnings contribution). Hover to isolate a tie.
Primary cloud infrastructure for the Falcon platform; also a key AI-ecosystem partner
Expanding hosting/CDR footprint for data-sovereignty coverage; 2026 Google Cloud Security Partner of the Year for Infrastructure Protection, second consecutive year
GPU/AI compute stack underpinning Charlotte AI and AIDR capabilities
Silicon-level telemetry collaboration for AI-PC endpoint protection
US federal agencies (via GovCloud / FedRAMP High) Fast-growing public-sector franchise incl. Charlotte AI for Gov and Falcon for XIoT
Publicly known enterprise customer, now adverse litigant over the July 2024 outage
Customer count no longer disclosed; majority-of-Fortune-500 penetration per historical company statements - concentration is low, with no customer over 10% of revenue per SEC filings
Bundles endpoint + SIEM into E5/Azure at marginal cost; the structural threat
Platformization strategy (Cortex XSIAM) is the closest like-for-like consolidation rival
Direct endpoint/XDR competitor, competes on price and autonomous-agent positioning
Post-Wiz, the strongest cloud-security (CNAPP) competitor with hyperscaler distribution
Incumbent SIEM estate CRWD's Next-Gen SIEM attacks; defends with bundling
Adjacent zero-trust network security; overlaps increasingly in data security
Value-priced converged security platform, stronger in mid-market/OT
Identity incumbent as CRWD pushes FalconID/ITDR into identity budgets