[CRWD] CrowdStrike: Q3 Earnings Preview on Net New ARR Growth and Margins

CrowdStrike is a cybersecurity company that sells endpoint, cloud workload, identity and log security to enterprises through its cloud-native Falcon platform, and subscriptions made up 94.9% of its fiscal 2026 revenue[1][2]. The Drillr earnings calendar places its next report, covering the Third quarter of fiscal 2027 (three months ending October 31, 2026), on 2026-12-01, a date the company has not yet confirmed[3]. In the latest disclosed quarter, the three months ended July 31, 2026, total revenue rose 26% to $1.47 billion, subscription revenue rose 27% to $1.40 billion, ending ARR (annual recurring revenue) grew 25% to $5.84 billion and net new ARR reached $332.8 million, up 51% year over year[4][5]; GAAP operating loss was $33.2 million, non-GAAP operating income was $371.6 million and free cash flow was $377.4 million[6][7]. On the second-quarter call, management guided third-quarter net new ARR to $343 million to $347 million, up 29% to 31% year over year, with a free cash flow margin of about 27.5% at the midpoint[8]; the same-day results release set third-quarter guidance at $6.1844 billion to $6.1884 billion of ending ARR, $1.5232 billion to $1.5292 billion of total revenue, $372.7 million to $375.9 million of non-GAAP operating income and $0.31 of non-GAAP diluted EPS[9]. The TipRanks analyst consensus for third-quarter non-GAAP EPS is also $0.31, matching company guidance[10].

Three things matter most in this CrowdStrike Q3 earnings report. The first is whether net new ARR clears the $347 million top of guidance again: the record $332.8 million in the second quarter beat the prior guidance ceiling by about $47 million[11][5], but guided year-over-year growth has already slowed from 51% to 29%-31%[8], so the result can separate genuine AI-security demand from a rebound off a depressed post-incident base. The second is whether the beyond-endpoint business can expand without eroding margin: combined ending ARR for cloud security, next-gen SIEM and identity was about $2.1 billion, up 39%[8], while SIEM's data-volume pricing also lifts hosting costs, and the non-GAAP subscription gross margin was 81% in the second quarter[12]. The third is the quality of the profit improvement: $25.5 million of the 25.3% second-quarter non-GAAP operating margin came from a longer commission amortization period[13], and stock-based compensation plus related employer payroll taxes rose to 27.1% of revenue[14], so third-quarter non-GAAP operating income, the GAAP loss and the roughly 27.5% free cash flow margin will show whether operating leverage holds beyond accounting changes and stock compensation.

Company Background and Business Structure

CrowdStrike is a platform security company headquartered in Austin, Texas, and led by founder and chief executive George Kurtz[15]. Its core product is a lightweight sensor installed on customer devices, paired with a security cloud that aggregates and analyzes the data, so customers can add endpoint, cloud, identity, next-gen SIEM and other modules on the same platform[2][16]. On July 19, 2024, a sensor configuration update crashed large numbers of Windows systems, and the company then introduced customer commitment packages to retain customers, including discounts, additional modules, professional services, flexible payment terms and subscription extensions[17]. As of January 31, 2026, the company had 10,698 full-time employees[18], and it completed a four-for-one stock split after the close of trading on July 1, 2026[7].

CrowdStrike's revenue is almost entirely subscription: fiscal 2026 subscription revenue was $4.565 billion and professional services revenue was $247 million[1], the latter mainly incident response and proactive services priced on a time-and-materials basis to support subscription sales[16]. Subscriptions are priced on the unit most relevant to each product, per endpoint, per identity, per cloud sensor or per gigabyte of daily ingestion for next-gen SIEM[16]; contracts generally run one to three years, are usually invoiced at the start and are recognized ratably over the term[2], which is why remaining performance obligations reached $10.7 billion at the end of July 2026[19]. By region, the United States produced 67% of fiscal 2026 revenue, Europe, the Middle East and Africa 16% and Asia Pacific 10%, and no other single country reached 10%[20]. The company sells mainly through its direct sales team, alongside resellers, managed security service providers and the AWS, Google and Microsoft cloud marketplaces[1].

The growth path is to land with the endpoint module and then sell more modules to the same customer. As of July 31, 2026, 51%, 35% and 26% of subscription customers used six or more, seven or more and eight or more modules, respectively[21]. Large customers increasingly adopt Falcon Flex, which lets them commit to a platform total upfront and draw it down across products as needed[16], and ending ARR from accounts that have adopted Flex exceeded $2.29 billion[15]. In the first half of fiscal 2027 the company acquired identity-authorization company SGNL and browser-security company Seraphic, and goodwill rose from $1.363 billion to $2.251 billion[22]. Because customers buy on annual budgets, net new ARR is usually concentrated in the second half and especially the fourth quarter, and first-half margins run lower because of payroll taxes and annual sales events[18].

Financial History and Current Position

CrowdStrike's annual revenue has kept growing above 20%, but it still reports a GAAP operating loss. Total revenue rose from $3.056 billion in fiscal 2024 (ended January 31, 2024) to $3.954 billion in fiscal 2025 and $4.812 billion in fiscal 2026, up 21.7% in the latest year; GAAP operating losses over the same years were $19.1 million, $116.4 million and $293.3 million, and fiscal 2026 net loss attributable to CrowdStrike was $162.5 million[1]. Stock compensation and incident costs drove the wider loss: fiscal 2026 stock-based compensation was $1.098 billion, or 22.8% of revenue[23], and general and administrative expense tied to the July 19 incident rose by $82.4 million[1].

Cash flow and contract metrics are much stronger than the income statement. Fiscal 2026 operating cash flow was $1.612 billion, and after $302.1 million of property and equipment purchases and $68.8 million of capitalized internal-use software, roughly $1.24 billion remained, about 26% of revenue[24]. Ending ARR at January 31, 2026, was $5.253 billion, up 24%, with about $1.01 billion of net new ARR for the year, and the dollar-based net retention rate was 115%, up from 112% a year earlier[25]. At the same date, remaining performance obligations were $9.0 billion and deferred revenue was $4.753 billion[20].

Growth in the first two quarters of fiscal 2027 was clearly faster than in the prior fiscal year. In the first quarter, ended April 30, 2026, total revenue was about $1.386 billion, up 26%, net new ARR was $255.8 million and free cash flow was $468.5 million[26][6]; against $193.7 million a year earlier, net new ARR grew about 32%[5]. In the second quarter, total revenue was $1.471 billion, up 26%, subscription revenue was $1.400 billion, up 27%, ending ARR was $5.841 billion, up 25%, and net new ARR was $332.8 million, up 51%[4][5]. The same quarter showed a GAAP operating loss of $33.2 million, non-GAAP operating income of $371.6 million, about 25.3% of revenue, and split-adjusted non-GAAP diluted EPS of $0.31[6][4].

The balance sheet carries a large cash pile and little debt, though the company spent part of that cash on acquisitions and buybacks in the first half. Second-quarter operating cash flow was $530.3 million and free cash flow was $377.4 million, about 26% of revenue[7]. At July 31, 2026, cash was $5.014 billion and long-term debt was $746 million; first-half acquisition spending was $881.4 million and share repurchases were $175.6 million[27]. Remaining performance obligations rose to $10.7 billion, about 46% of which the company expects to recognize over the following 12 months[19].

Operating Model

Revenue is set by ARR, and ARR is set by three forces: new customers, expansion by existing customers and contraction at renewal. Net new ARR equals first orders from new customers plus added endpoints and modules from existing customers, including Flex conversions and early expansions, minus renewal contraction and churn; subscription revenue is the ratable recognition of contracts signed over the past one to three years[2][5]. Net new ARR is therefore the leading indicator, and a change in it usually takes one to four quarters to flow fully into subscription revenue: in fiscal 2026 ARR grew 24% and subscription revenue grew 21.4%[25][1], while in the second quarter of fiscal 2027 ARR grew 25% and subscription revenue grew 27%[4]. According to the 10-K, spending per customer depends on the number of customers, endpoints per customer and modules subscribed[2], and the non-endpoint modules, cloud, SIEM and identity, are the part growing faster than the whole[8].

Profit depends on how subscription gross profit grows relative to the three main expense lines. Subscription gross profit equals subscription revenue minus cloud hosting, data center equipment depreciation and operations staff, and the second-quarter non-GAAP subscription gross margin was 81%[12][28]; operating profit then subtracts sales and marketing, including commissions amortized over five years, research and development, and general and administrative expense, which includes legal costs from the July 19 incident[1][29]. On a GAAP basis the company still posts an operating loss because of stock compensation: second-quarter stock-based compensation and related employer payroll taxes were $399.0 million, or 27.1% of revenue[14], and excluding that, non-GAAP operating income was $371.6 million, of which $25.5 million came from extending the commission amortization period from four to five years[6][13]. When revenue grows faster than personnel costs, the non-GAAP margin rises in the same quarter, and when stock compensation grows faster than revenue, the gap between GAAP and non-GAAP profit widens with it.

Cash runs persistently above profit because customers usually pay at the start of a contract. At the end of July 2026, current deferred revenue was $3.497 billion and noncurrent deferred revenue was $1.345 billion; billings concentrate in the fourth quarter and collections in the first, so operating cash flow follows a different seasonal pattern from profit[27][18]. Free cash flow equals operating cash flow minus property and equipment purchases, capitalized internal-use software and net deferred compensation investments, and it was $845.9 million, or 30% of revenue, in the first half of fiscal 2027[7]. Data center capital spending reduces free cash flow first and then enters subscription cost as depreciation over the following years; second-quarter property and equipment purchases were $124.4 million, or 8% of revenue, against 3% a year earlier[7].

Industry and Competitive Position

CrowdStrike competes in a crowded endpoint and extended detection and response market where some rivals have broader resources. The 10-K lists legacy antivirus vendors, alternative endpoint security providers, network security vendors adding endpoint or cloud security to perimeter products, cloud and identity security specialists, incident response service providers and legacy SIEM vendors as competitors[30]. Its differentiation is a single sensor, a unified data platform and modular subscriptions, which lets it expand into cloud, identity, SIEM and exposure management on the same deployment[2][31]. The company's disclosures do not give comparable peer financials, so its gap with specific rivals in share or margin cannot be quantified.

Management treats AI as a new source of demand, while the main constraints come from the incident aftermath, data costs and bundled platform competition. In the second-quarter release, chief executive Kurtz said enterprises broadly accept that AI adoption needs security and called securing AI the largest market opportunity in the company's history[15]; on the call, management said ending ARR for AI Detection and Response (AIDR) nearly tripled from the first quarter, the Project QuiltWorks partner alliance had more than 25 partners generating nearly $400 million of pipeline, and hyperscaler marketplace transaction volume hit a record[31][32]. The constraints are just as clear: the company still faces litigation and regulatory inquiries after the July 19 incident[33], data-heavy modules such as SIEM raise hosting and depreciation costs[28], and better-resourced competitors can bundle several products together[30].

Core Debates

Can CrowdStrike keep third-quarter net new ARR growth near 30% and above the top of its guidance as AI-security demand accelerates?

This question shapes revenue for the next several quarters, because subscriptions made up 94.9% of fiscal 2026 revenue and are recognized ratably over one- to three-year terms[1][2]. Second-quarter net new ARR of $332.8 million, up 51%, was the highest single quarter in the company's history and about $47 million above the $284 million to $286 million guidance given on the first-quarter call[5][11]. The company then raised full-year net new ARR guidance to a midpoint of about $1.355 billion, up 34%[34][15]. With $588.6 million already booked in the first half, the second half needs about $766 million, roughly 29% more than the approximately $596 million added in the second half of fiscal 2026 ($5.253 billion of ARR at January 31, 2026, minus $4.657 billion at July 31, 2025)[5][25].

Management attributes the acceleration to extra security budgets that follow enterprise AI deployments, but an alternative explanation also has support. On the acceleration side, net new ARR from new customers hit a record in the second quarter, Flex account ending ARR exceeded $2.29 billion, up 101%[15], more than 935 Flex accounts were added in the quarter and existing customers saw an average ARR uplift of more than 40% on converting to Flex[32], while 480 customers in the first quarter expanded early, about seven months ahead of formal renewal, with an average 26% uplift[35]. The alternative is a low base and pulled-forward expansion: net new ARR in the second quarter of fiscal 2026 was only $221.1 million[5], depressed that year by contraction and smaller upsells under the customer commitment packages[17]; Flex account ARR includes ARR the customer already had before converting, early expansion moves growth that would have come at renewal into the current period, and the 10-Q warns that customers who cannot use their full commitment may renew with shorter terms or fewer modules[5].

The financial transmission is clear, but which explanation dominates remains unresolved. In management's logic, enterprise deployment of AI agents and models opens new attack surfaces across endpoints, cloud workloads, identities and the AI interaction layer, customers buy AIDR, cloud security and identity modules or commit a larger platform amount through Flex, net new ARR rises, and subscription revenue moves higher over the following one to four quarters[32][16]. If the acceleration mainly reflects the low base and early expansion, year-over-year growth will fade as the base normalizes and some customers will contract at renewal. The company does not disclose quarterly net retention values or customer counts, and single-quarter net new ARR for the third quarter of fiscal 2026 is not directly listed in available company disclosures, so the contribution of new customers versus expansion cannot be separated directly; guided third-quarter growth of 29% to 31% is already clearly slower than in the second quarter[8].

The most direct third-quarter test is where net new ARR lands against the $343 million to $347 million range[8]. Readers can also check whether the company again says net and gross retention improved sequentially, as both did in the second quarter[8]; whether the sequential increase in Flex account ARR holds near $390 million, the step from more than $1.9 billion in the first quarter to more than $2.29 billion in the second[35][15]; and whether full-year guidance is maintained or raised, given that the gap between the full-year and third-quarter ending ARR guidance midpoints in the results release is about $421 million[9]. If net new ARR falls below $343 million, retention stops improving, or later growth slips back to the low 20s, the acceleration will look driven mainly by the low base and early expansion rather than sustained AI-security demand.

Can CrowdStrike keep its beyond-endpoint modules growing near 39% while holding an 81% non-GAAP subscription gross margin?

This question bears on where growth comes from and whether it can coexist with margin, because CrowdStrike began in endpoint protection and increasingly depends on the same customers adding modules on its platform. In the second quarter, combined ending ARR for cloud security, next-gen SIEM and identity was about $2.1 billion, up 39%, faster than the 25% growth of total ARR and about 36% of company ARR[8][4]. Next-gen SIEM is priced on daily data ingestion, so more data means more revenue[16], but cloud hosting, storage and data center depreciation rise with it: second-quarter subscription cost grew 23%, including a $13.9 million increase in cloud hosting and related services and a $10.4 million increase in data center equipment depreciation[28].

Current evidence shows module expansion still speeding up without hurting gross margin, though the module data itself is imprecise. According to the second-quarter call, next-gen SIEM ending ARR passed $695 million, identity grew 34% to more than $585 million, cloud security exceeded $905 million with growth above 29%, and AIDR ending ARR nearly tripled from the first quarter[31]; in the first quarter the three combined exceeded $2 billion and SIEM exceeded $600 million[36]. The share of subscription customers using six or more, seven or more and eight or more modules was 51%, 35% and 26%, with the eight-plus share one point above the first quarter's 25%[21][26], and the non-GAAP subscription gross margin was 81%, one point higher than a year earlier[12]. The alternative reading is that Flex lets customers shift committed spend between modules[16], so one module's growth may simply be budget moved from another; the module ARR figures given on calls are "more than X" approximations, and the identity business includes SGNL, acquired in the first quarter[35].

The transmission in this debate is a race between revenue and hosting cost. Customers land with the endpoint sensor and then add cloud workload protection, identity, next-gen SIEM and AIDR on the same platform, so non-endpoint ARR grows faster than the whole and lifts subscription revenue; at the same time, more data ingestion and storage push up cloud hosting and depreciation, and subscription gross margin depends on the gap between the two growth rates[2][28]. What remains unresolved is how much module growth reflects a larger total budget, how much is budget shifting inside the Flex framework and how much comes from acquisitions; the company does not separately disclose quarterly ARR for its core endpoint business, so none of these can be split out directly.

Four numbers in the third quarter can test this debate. They are whether combined ARR growth for the three non-endpoint modules holds above 35%, whether the sequential increase in next-gen SIEM ending ARR stays near $95 million, the step from more than $600 million to more than $695 million between the first and second quarters[36][31], whether eight-plus module penetration stays above 26%[21], and whether the non-GAAP subscription gross margin holds at 81%[12]. If module ARR keeps growing quickly while total ARR growth does not rise with it, growth is more likely budget shifting; if hosting costs grow faster than SIEM revenue and subscription gross margin falls below 80%, or cloud security and identity growth drops below the company average, the margin cost of expansion is higher than current data suggest.

CrowdStrike's non-GAAP margin is at a record, but does its operating leverage hold up once the commission accounting change and stock compensation are counted?

This question matters because CrowdStrike's cash flow is far stronger than its GAAP profit, and the recent margin improvement mixes in an accounting change. Fiscal 2026 operating cash flow was $1.612 billion and free cash flow was about $1.24 billion, while the GAAP operating loss was $293.3 million and stock-based compensation was $1.098 billion[24][1][23]. The non-GAAP operating margin rose to 25.3% in the second quarter of fiscal 2027 from 21.8% a year earlier[4][6]; but in February 2026 the company extended the commission amortization period from four to five years, which it estimated would improve fiscal 2027 operating results by $85 million to $95 million[29], and which cut second-quarter sales expense by $25.5 million[13]. Over the same period, stock-based compensation plus related employer payroll taxes rose from 23.7% to 27.1% of revenue[14], and property and equipment purchases rose from 3% to 8% of revenue[7].

The current data support two readings at once, that profit is improving and that the improvement is overstated. On the improvement side, the second-quarter GAAP operating loss narrowed from $105.5 million a year earlier to $33.2 million and non-GAAP operating income was $371.6 million[6][4], free cash flow was $377.4 million, or 26% of revenue, and the first-half free cash flow margin was 30%[7]; the company guided third-quarter non-GAAP operating income to $372.7 million to $375.9 million[9], with a third-quarter free cash flow margin of about 27.5% and at least 30% for the full year[34]. The other reading is that, excluding the $25.5 million commission change, the second-quarter non-GAAP margin was about 23.5%, only about 1.7 points above a year earlier[13][6]; stock-based compensation and related payroll taxes grew 44%, far faster than revenue's 26%[14], and part of the narrower GAAP loss reflects strategic plan charges in the prior-year base[12].

The transmission runs through four channels that do not all point the same way. Subscription revenue growing faster than personnel costs lifts the non-GAAP operating margin; the longer commission amortization period lowers sales expense in the current period; stock compensation rises with hiring and the share price and widens the gap between GAAP and non-GAAP profit; and customer prepayments keep deferred revenue and operating cash flow above profit, while data center capital spending first reduces free cash flow and later enters subscription cost as depreciation[29][14][27][7]. What remains unresolved is how much non-GAAP operating leverage is left after the accounting change, and whether the rising stock compensation share means there is almost no operating leverage on a GAAP basis.

The third-quarter checkpoints cover four items. They are whether non-GAAP operating income exceeds the $375.9 million top of guidance and how much the disclosed commission change contributes[9][13]; whether the GAAP operating loss comes in below the $62.2 million of the third quarter of fiscal 2026[37]; whether stock-based compensation and related payroll taxes fall from 27.1% of revenue[14]; and whether the free cash flow margin reaches about 27.5% while capital spending stays around 8% of revenue[8][7]. If the stock compensation ratio keeps rising while the GAAP loss does not narrow, if faster data center spending pushes the free cash flow margin below guidance, or if the margin barely improves once the accounting change is removed, the record non-GAAP margin will look driven mainly by measurement rather than operations.

Risks and Falsifiers

Legal and regulatory fallout from the July 19 incident remains a risk to the credibility of the company's metrics. The July 19, 2024, sensor configuration update crashed some Windows systems, and the company has since faced securities litigation, derivative litigation and putative class actions brought by individual consumers[1]; the U.S. Department of Justice and the Securities and Exchange Commission have also requested information on the company's revenue recognition and ARR reporting for transactions with certain customers, the July 19 incident and related matters, and the company says it is cooperating[33]. The incident-related accrued balance was $13.1 million at July 31, 2026[38], and potential losses cannot currently be reasonably estimated; if the inquiries find that ARR or revenue for some transactions was measured improperly, the comparability of net new ARR and confidence in this core metric would both suffer. If later quarterly reports show no new inquiry developments or corrections related to ARR or revenue recognition, and the litigation produces no material loss requiring an accrual, this risk has not materialized.

The mix of acquired and organic growth makes module ARR growth harder to read. In the first half of fiscal 2027 the company paid $881.4 million in cash for SGNL and Seraphic, goodwill rose from $1.363 billion to $2.251 billion, and in July it signed an agreement to buy the technology assets of XM Cyber for $145.0 million in cash and stock[27][22]. The two first-quarter acquisitions contributed a combined $7.8 million of net new ARR[35], so identity, browser security and other module ARR now include inorganic components, integration costs flow into research and development and general and administrative expense, and goodwill impairment risk rises. If the company keeps disclosing acquired ARR separately and organic net new ARR still meets guidance, this risk will not distort the growth picture.

Flex and early expansion may pull future growth into current ARR. Customers commit platform spend upfront and expand about seven months ahead of renewal[16][35], and if actual deployment lags, they may renew with shorter terms, fewer modules or fewer endpoints[5]. Flex account ARR exceeds $2.29 billion, about 39% of company ARR[15][4], and contraction in that base at renewal would directly reduce net new ARR and slow subscription revenue growth over the following one to four quarters. If third-quarter net new ARR is at least $347 million and the company again reports sequential improvement in net and gross retention, this concern weakens.

Data-intensive modules could pull down subscription gross margin. Next-gen SIEM is priced on data volume, and expanding it requires more cloud hosting, storage and data center capacity; second-quarter subscription cost already rose 23% year over year[16][28]. On second-quarter subscription revenue of $1.400 billion, each one-point drop in subscription gross margin removes about $14 million of gross profit[6]. If the third-quarter non-GAAP subscription gross margin holds at 81% while next-gen SIEM ending ARR keeps growing by about $95 million sequentially, this risk has not appeared[12][31].

Stock compensation dilution and the GAAP profit gap are a persistent cost. Second-quarter stock-based compensation and related employer payroll taxes were $399.0 million, or 27.1% of revenue, leaving a gap of about $400 million between the $33.2 million GAAP operating loss and $371.6 million of non-GAAP operating income[14][6]; first-half buybacks of $175.6 million offset only part of the dilution[27]. If the third-quarter stock compensation ratio falls below 25% and the GAAP operating loss is smaller than the $62.2 million of a year earlier, GAAP results will also be showing operating leverage[37].

What to Watch Next

• Net new ARR acceleration: third-quarter net new ARR against the $343 million to $347 million guidance range, from a second-quarter base of $332.8 million, up 51%[5][8]. Above $347 million with continued retention improvement confirms; below $343 million falsifies.
• Net new ARR acceleration: Flex account ending ARR, above $2.29 billion and up 101%[15], and whether the sequential increase holds near $390 million[35]. A steady increase without renewal contraction confirms; a clear slowdown or falling net retention falsifies.
• Beyond-endpoint modules and margin: combined cloud, SIEM and identity ARR of about $2.1 billion, up 39%[8], and whether growth stays above 35%. Holding that pace with faster total ARR confirms; module growth with flat total ARR falsifies.
• Beyond-endpoint modules and margin: non-GAAP subscription gross margin at 81%[12]. Holding 81% confirms; falling below 80% falsifies.
• Profit and cash conversion: non-GAAP operating income of $371.6 million in the second quarter, including $25.5 million from the commission change[6][13], against the $375.9 million top of third-quarter guidance[9]. Improvement after excluding the commission change confirms; improvement that comes almost entirely from measurement falsifies.
• Profit and cash conversion: stock compensation at 27.1% of revenue and a 26% second-quarter free cash flow margin[14][7], against a third-quarter free cash flow margin of about 27.5%[8]. A falling ratio with free cash flow on target confirms; a rising ratio with free cash flow below guidance falsifies.

Conclusion

CrowdStrike's business is driven by subscription ARR, and it currently combines accelerating growth and ample cash with a continued GAAP loss. Second-quarter ending ARR was $5.84 billion and net new ARR set a record at $332.8 million[4], combined non-endpoint module ARR grew 39%[8], the first-half free cash flow margin was 30% and cash stood at $5.01 billion at the end of July[7][27]; in the same quarter, however, the GAAP operating loss was $33.2 million and stock-based compensation plus related payroll taxes equaled 27.1% of revenue[6][14]. The central unresolved relationship is how much of the net new ARR acceleration comes from AI-security demand versus a low base and early Flex expansion, and whether the improvement in non-GAAP margin still holds after removing the commission amortization change and stock compensation.

Independent analysis published after the second-quarter results is scarce, and the main piece with concrete operating figures is a November 5 article from Trefis. Trefis sees strong growth and cash flow, noting that second-quarter revenue grew 25.8%, up from 21.3% a year earlier, and that operating cash flow equaled 36.1% of revenue; it also states that "Profit is where CrowdStrike falls short," citing a trailing 12-month GAAP operating margin of minus 2.2% against 18.7% for the S&P 500[39]. That view maps directly onto the third core debate by treating the gap between GAAP losses and strong cash flow as the core tension; it does not address the quality of net new ARR or module gross margin, so it serves only as one outside interpretation and cannot substitute for testing the first two debates.

The current understanding would be materially strengthened if several observations hold together: third-quarter net new ARR of at least $347 million with the company again reporting better retention, non-endpoint module ARR growth above 35% with the non-GAAP subscription gross margin at 81%, and a lower stock compensation ratio with a GAAP operating loss smaller than the prior year's $62.2 million[8][12][37]. Conversely, net new ARR below $343 million, a subscription gross margin below 80%, or a non-GAAP margin that barely improves once the commission change is removed would weaken the view that AI-security demand is producing durable acceleration and operating leverage.

Sources

[1] CRWD 10-K filed 2026-03-05 · 2026-03-05 · 10-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000010/crwd-20260131.htm

[2] CRWD 10-K filed 2026-03-05 business model and pricing · 2026-03-05 · 10-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000010/crwd-20260131.htm

[3] Drillr earnings calendar 2026-11-11 CRWD Q3 FY2027 · 2026-11-11 · Drillr earnings calendar

[4] CRWD 8-K filed 2026-08-26 Q2 FY2027 results · 2026-08-26 · 8-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000029/crwd-20260826xex991.htm

[5] CRWD 10-Q filed 2026-08-27 ARR and net retention · 2026-08-27 · 10-Q · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000031/crwd-20260731.htm

[6] CRWD 8-K filed 2026-08-26 income statement · 2026-08-26 · 8-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000029/crwd-20260826xex991.htm

[7] CRWD 8-K filed 2026-08-26 free cash flow · 2026-08-26 · 8-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000029/crwd-20260826xex991.htm

[8] CRWD Q2 FY2027 earnings call 2026-08-26 CFO transcript · 2026-08-26 · earnings-call · https://www.fool.com/earnings/call-transcripts/2026/08/31/crowdstrike-crwd-q2-2027-earnings-call-transcript/

[9] CRWD 8-K filed 2026-08-26 Q3 FY2027 guidance · 2026-08-26 · 8-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000029/crwd-20260826xex991.htm

[10] TipRanks 2026-11-11 CRWD Q3 FY2027 EPS consensus · 2026-11-11 · TipRanks(汇总分析师预期) · https://www.tipranks.com/stocks/crwd/earnings

[11] CRWD Q1 FY2027 earnings call 2026-06-03 guidance · 2026-06-03 · earnings-call · https://gateway.drillr.ai/mcp/private

[12] CRWD 8-K filed 2026-08-26 non-GAAP gross margin · 2026-08-26 · 8-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000029/crwd-20260826xex991.htm

[13] CRWD 10-Q filed 2026-08-27 commission period effect · 2026-08-27 · 10-Q · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000031/crwd-20260731.htm

[14] CRWD 8-K filed 2026-08-26 stock-based compensation · 2026-08-26 · 8-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000029/crwd-20260826xex991.htm

[15] CRWD 8-K filed 2026-08-26 Falcon Flex and net new ARR headline · 2026-08-26 · 8-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000029/crwd-20260826xex991.htm

[16] CRWD 10-Q filed 2026-08-27 Falcon Flex and pricing · 2026-08-27 · 10-Q · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000031/crwd-20260731.htm

[17] CRWD 10-K filed 2026-03-05 July 19 Incident and customer commitment packages · 2026-03-05 · 10-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000010/crwd-20260131.htm

[18] CRWD 10-K filed 2026-03-05 seasonality and employees · 2026-03-05 · 10-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000010/crwd-20260131.htm

[19] CRWD 10-Q filed 2026-08-27 RPO · 2026-08-27 · 10-Q · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000031/crwd-20260731.htm

[20] CRWD 10-K filed 2026-03-05 revenue by region, deferred revenue and RPO · 2026-03-05 · 10-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000010/crwd-20260131.htm

[21] CRWD 8-K filed 2026-08-26 module adoption · 2026-08-26 · 8-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000029/crwd-20260826xex991.htm

[22] CRWD 10-Q filed 2026-08-27 acquisitions · 2026-08-27 · 10-Q · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000031/crwd-20260731.htm

[23] CRWD 10-K filed 2026-03-05 stock-based compensation · 2026-03-05 · 10-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000010/crwd-20260131.htm

[24] CRWD 10-K filed 2026-03-05 cash flows · 2026-03-05 · 10-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000010/crwd-20260131.htm

[25] CRWD 10-K filed 2026-03-05 ARR and net retention · 2026-03-05 · 10-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000010/crwd-20260131.htm

[26] CRWD 8-K filed 2026-06-03 Q1 FY2027 results · 2026-06-03 · 8-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000022/crwd-20260603xex991.htm

[27] CRWD 8-K filed 2026-08-26 balance sheet and cash flow · 2026-08-26 · 8-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000029/crwd-20260826xex991.htm

[28] CRWD 10-Q filed 2026-08-27 cost of revenue and hosting · 2026-08-27 · 10-Q · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000031/crwd-20260731.htm

[29] CRWD 10-K filed 2026-03-05 commission period change · 2026-03-05 · 10-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000010/crwd-20260131.htm

[30] CRWD 10-K filed 2026-03-05 competition · 2026-03-05 · 10-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000010/crwd-20260131.htm

[31] CRWD Q2 FY2027 earnings call 2026-08-26 segments · 2026-08-26 · earnings-call · https://gateway.drillr.ai/mcp/private

[32] CRWD Q2 FY2027 earnings call 2026-08-26 Flex · 2026-08-26 · earnings-call · https://gateway.drillr.ai/mcp/private

[33] CRWD 10-Q filed 2026-08-27 DOJ and SEC inquiries · 2026-08-27 · 10-Q · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000031/crwd-20260731.htm

[34] CRWD Q2 FY2027 earnings call 2026-08-26 guidance · 2026-08-26 · earnings-call · https://gateway.drillr.ai/mcp/private

[35] CRWD Q1 FY2027 earnings call 2026-06-03 Flex and acquisitions · 2026-06-03 · earnings-call · https://gateway.drillr.ai/mcp/private

[36] CRWD Q1 FY2027 earnings call 2026-06-03 segments · 2026-06-03 · earnings-call · https://gateway.drillr.ai/mcp/private

[37] CRWD 10-K filed 2026-03-05 quarterly financial information · 2026-03-05 · 10-K · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000010/crwd-20260131.htm

[38] CRWD 10-Q filed 2026-08-27 July 19 Incident accruals · 2026-08-27 · 10-Q · https://www.sec.gov/Archives/edgar/data/1535527/000153552726000031/crwd-20260731.htm

[39] Trefis 2026-11-05 Can CrowdStrike Stock Rally 50% After This Dip · 2026-11-05 · Trefis · https://www.trefis.com/stock/crwd/articles/622823/can-crowdstrike-stock-rally-50-after-this-dip/2026-11-05