CrowdStrike Holdings, Inc. (CRWD) Earnings

Management highlights

### AI Market Inflection - The "Mythos inflection point" in April 2027 shifted the market narrative from AI disrupting cybersecurity to universal reliance on AI-native cybersecurity to secure frontier AI deployments. CrowdStrike is the only cybersecurity company selected as a founding security partner for both Anthropic and OpenAI's new frontier model introduction programs. - AI adoption has created a structural greenfield demand expansion: AI needs security to operate safely, and new AI infrastructure (GPUs, new data centers, inference-focused Neo Clouds, agentic applications) creates entirely new attack surfaces that require protection. Cybersecurity is now recognized as critical foundational AI infrastructure, shifting from a cost center to a strategic enabler of AI adoption. ### Product and Ecosystem Innovation - Launched Project QuiltWorks, an industry coalition for Mythos AI readiness including system integrators, AI providers, and cyber insurers, to deliver continuous vulnerability discovery and remediation for AI-related threats. Falcon Continuous Exposure Management and Falcon for IT saw adoption nearly double YoY in Q1 from this initiative. - Launched AgentWorks, a partner ecosystem for purpose-built AI agents native to the Falcon platform, with partners including Accenture, AWS, Anthropic, Deloitte, NVIDIA, OpenAI, and Salesforce. Charlotte AI, CrowdStrike's AI SOC reasoning engine, saw accelerating ending ARR growth over Q4. - Added Dr. Bartley Richardson from NVIDIA as Chief AI and Autonomous System Officer to deepen AI and strategic partnership alignment. ### Go-to-Market Momentum - Falcon Flex, CrowdStrike's flexible subscription model, has reached over $1.9 billion in ending ARR across adopting accounts, growing 99% YoY. 480 customers have completed early expansion "Reflex" transactions, with an average 26% ARR uplift 7 months ahead of formal renewal; over 130 customers have expanded multiple times, with an average 51% total uplift over their original contract. - Acquired Signal and Seraphic in Q1, contributing a combined $7.8 million in acquired net new ARR, in line with guidance. The company will continue strategic M&A to complement organic innovation in AI security, with a focus on acquiring strong teams and integrated technology. ### Capital Deployment - Announced a 4-for-1 forward stock split to make CrowdStrike equity more accessible to a broader base of investors. Shares of record as of June 25, 2026 will receive 3 additional shares per 1 held, with split-adjusted trading commencing July 2, 2026. - Repurchased $176 million of outstanding shares in Q1 at an average price of $365.63, with approximately $1.3 billion remaining under the current share repurchase authorization.

Guidance

- Full year FY27 net new ARR guidance was raised by $52 million to a range of $1.279 billion to $1.303 billion, representing 27-29% YoY growth (an acceleration of 520 basis points from prior guidance), with growth expected to accelerate over FY26. Net new ARR seasonality is expected to be 42% in H1 and 58% in H2 FY27. - Full year FY27 total revenue guidance is $5.915 billion to $5.959 billion, representing 23-24% YoY growth. Non-GAAP operating income is expected to be between $1.452 billion and $1.480 billion, with non-GAAP diluted net income per share (split-adjusted) expected to be $1.22 to $1.24. - Full year FY27 free cash flow margin is expected to be at least 30% on the higher revenue base, with 46% of total free cash flow dollars expected in H1 and 54% in H2. - Full year FY27 ending ARR guidance is $6.532 billion to $6.556 billion, representing 24-25% YoY growth. - Q2 FY27 guidance: net new ARR of $284 million to $286 million (28-29% YoY growth), total revenue of $1.436 billion to $1.442 billion (23% YoY growth), ending ARR of $5.793 billion to $5.795 billion (24% YoY growth), non-GAAP operating income of $346 million to $349 million, and non-GAAP diluted net income per share (split-adjusted) of approximately $0.29. Q2 free cash flow margin is expected to be 24.5% at guidance midpoint.

Segment performance

1. Endpoint: Ending ARR growth accelerated for the third consecutive quarter. The segment maintains market leading position, named a Gartner Magic Quadrant leader for 7 consecutive years, with highest positioning for 4 straight years. It benefited from expanded endpoint attack surface driven by AI agent adoption, with an 8-figure new logo win at a major US government agency across 200,000 hosts. AIDR, the new AI detection and response offering built on the endpoint sensor base, saw ending ARR grow over 250% sequentially, with a Q2 pipeline exceeding $50 million. 2. Next Gen SIEM, Cloud, and Identity: Combined ending ARR for these segments exceeded $2 billion. Next Gen SIEM reached over $600 million in ending ARR, with an 8-figure new logo win at a major fuel retailer. Cloud security had another strong quarter, with an 8-figure win at a high performance AI chip company securing rapidly expanding Kubernetes and cloud environments. Next-gen identity net new ARR growth accelerated over Q4 FY27; Falcon for SaaS ending ARR grew nearly 4x year over year, with the recently acquired Signal solution seeing strong early demand for granular, policy-based agentic workload authorization, including a 7-figure expansion win at a major US healthcare company. 3. Overall Company: Q1 FY27 net new ARR was $255.8 million, up 32% year over year. Ending total ARR reached $5.51 billion, growing 24% year over year. Total revenue was $1.39 billion, up 26% year over year. Subscription revenue hit $1.32 billion (up 26% YoY), professional services revenue was $64.8 million (up 23% YoY). Total non-GAAP gross margin hit a Q1 record 79%, non-GAAP subscription gross margin was a Q1 record 81% (up 90 bps YoY). Non-GAAP operating income was a Q1 record $325.7 million (24% margin, up 530 bps YoY). GAAP net income was $27.8 million, non-GAAP net income was $283.4 million ($1.10 diluted per share). Record operating free cash flow was $590.9 million, record free cash flow was $468.5 million (34% of revenue). Revenue contribution by geography: 66% from the US, 34% from international markets, with accelerating YoY growth for EMEA and all international regions compared to Q4 FY26.

Risks & headwinds

The call notes that forward-looking statements are based on current expectations and are subject to inherent risks and uncertainties that could cause actual results to differ materially. Additional risk factors are referenced in CrowdStrike's periodic SEC filings, including the Risk Factors sections of annual and quarterly reports. Key specific risks referenced in the discussion include: the risk of unaddressed AI threat exposure as enterprise adoption outpaces security deployment, and the rapidly evolving nature of adversary AI-powered attack capabilities that create new, untested threat vectors.

Analyst Q&A

• Q: What were the biggest near-term drivers that prompted the meaningful upward revision to full-year net new ARR guidance?

  A: Management cited broad AI-driven demand tailwinds, combined with strong existing fundamentals including high module adoption, strong gross and net retention rates, and a record Q2 pipeline. The April Mythos inflection point created a clear market shift around AI security demand that added further confidence in the revised outlook.

• Q: Where is the incremental AI security budget coming from — is it new spending or reallocation of existing security budgets?

  A: Management noted that frontier AI adoption has created entirely new budgets that did not exist 2 years ago, particularly for large-scale AI and token spending. Most of the current demand growth is incremental new security spending, as enterprises need additional protection to support their AI deployment goals, following the adoption curve of frontier AI model providers.

• Q: How has AI demand impacted cloud security, and what are you seeing for competitive displacement and win rates in the segment?

  A: Traditional cloud security focused on posture management, but AI has shifted demand to runtime protection and control for cloud-hosted AI workloads and long-running agent containers. CrowdStrike's full-stack cloud security built over many years is well-positioned for this shift, making cloud security a bright spot for the business.

• Q: What is the TAM for AIDR (AI Detection and Response), and what gives CrowdStrike a competitive advantage in this new market?

  A: Management expects AIDR's TAM to be larger than the existing EDR market, because industry estimates project 90 AI agents per employee, all requiring protection. As the creator and leading provider of EDR, CrowdStrike already has endpoint sensors deployed at customer environments, giving it a unique structural advantage to monitor and secure AI activity at the runtime layer where AI actually executes.

• Q: What is the status of AI adoption and AI security adoption in enterprises, and are we still in early innings?

  A: We are still in early innings of broad enterprise AI deployment, with adoption currently deepest among developers before expanding across other business functions. AI adoption is currently outpacing AI security deployment, which has created widespread unmet demand for CrowdStrike's solutions, with significant incremental growth opportunity as adoption expands enterprise-wide.