CrowdStrike Holdings, Inc. (CRWD) — Coverage File

Data as of: Q2 FY2027 (quarter ended July 31, 2026; 10-Q filed Aug 27, 2026). Fiscal year ends January 31; FY2026 = year ended Jan 31, 2026 File last updated: October 12, 2026 (initial build)

---

0. 30-second reopen

• Business: One sensor on each endpoint feeding a cloud platform, onto which customers switch on paid modules; ARR $5.84B (+25%), 95% of revenue is subscription.
• Core debate: Is the post-"Mythos" AI-security surge a lasting budget that Falcon Flex converts into multi-module spend, and can that reach owners per share through ~23%-of-revenue stock compensation and a price of ~48x ARR?
• Base thesis: The sensor is already where AI agents run; Flex turns each new security problem into another module; net new ARR grew 51% in Q2 and free cash flow is heading to 30% of revenue.
• Main bear case: ARR, the metric the DOJ and SEC are asking about, overstates durable demand once Flex commitments renew, while SBC absorbs almost all free cash flow and compute commitments climb.
• What to watch: Net new ARR growth against guidance, net and gross retention, Flex renewals, cloud/identity/SIEM ARR, SBC as a share of revenue, FCF minus SBC, purchase commitments, the DOJ/SEC inquiry.
• Valuation: ~$282B market cap at the Oct 9, 2026 close (web): ~46x FY2027 revenue guidance, ~182x trailing free cash flow and ~1,000x trailing FCF after SBC. The price assumes years of mid-20s ARR growth and a steep fall in SBC intensity.

---

1. Business snapshot

CrowdStrike sells subscriptions to the Falcon platform: a single lightweight agent on each endpoint sends telemetry to a cloud system, and customers turn on modules for endpoint protection, cloud workloads, identity, next-gen SIEM, exposure management, data protection and, since FY2027, AI detection and response (AI-DR) [FY2026 10-K; Q2 FY27 10-Q]. Pricing is per endpoint, identity, cloud sensor, user or gigabyte ingested; subscriptions run one to three years, are mostly billed upfront and are recognised ratably [Q2 FY27 10-Q]. Professional services (incident response, proactive services) are 5% of revenue and run at a 10–18% gross margin; management treats them as a lead source for subscriptions [FY2026 10-K; Q2 FY27 10-Q].

Falcon Flex is the enterprise licence: a customer commits a budget upfront and draws it down across modules. Accounts on Flex carry $2.29B of ending ARR, up 101% y/y [Q2 FY27 call]. Sales run through a direct team and partners (resellers, MSSPs, systems integrators and the AWS, Google and Microsoft marketplaces); marketplace deal value was over $600M in Q2 alone [Q2 FY27 call].

Q2 FY2027 revenue was $1,470.9M (+26%), subscription $1,400.3M (+27%); roughly 65% came from the US [Q2 FY27 10-Q; Q2 FY27 call]. ARR was $5,841.4M (+25%) and RPO $10.7B, 46% due within 12 months [Q2 FY27 10-Q]. Headcount was 11,706 [Q2 FY27 10-Q]. The company does not report segments, customer counts or ARR by product in its filings; product ARR comes only from calls.

2. Core debate

The first question is whether AI has created a durable new security budget or a one-time scramble. Management dates an "inflection" to RSA in late March 2026 and the April "Mythos moment", when frontier AI models showed they could find and exploit vulnerabilities at machine speed [Q1 FY27 call]. Net new ARR then rose 51% in Q2 to $332.8M and FY2027 guidance went from +22.5% to +34% [Q2 FY27 10-Q; Q2 FY27 call]. But the Q3 guide already implies growth of 29–31%, and an analyst on the Q1 call called the post-Mythos spending "a bit of panic spending" [Q1 FY27 call; Q2 FY27 call].

The second question is whether the growth reaches owners. Non-GAAP operating margin is 25% and FY2027 free cash flow is guided at 30% or more [Q2 FY27 call]. But SBC was $1.24B over the last twelve months, 23% of revenue, against $1.53B of free cash flow (author's arithmetic) [FY2026 10-K; Q2 FY27 10-Q]. At ~46x revenue guidance (§8) the stock needs both: years of growth and a large fall in SBC intensity.

3. Base thesis

CrowdStrike's sensor already sits on the endpoints where AI agents now run, and every customer's data is already in its platform. So each new security problem that AI creates (agents acting on laptops, shadow AI, exploits arriving faster than patches) becomes another module to switch on through Flex, with no new deployment. That lets a $5.8B-ARR company grow faster again: ending ARR growth has accelerated four quarters running [Q2 FY27 call]. Because billing is upfront and hosting costs scale slower than revenue, the free cash margin rises with scale.

Assumptions this rests on:

1. Flex turns the endpoint base into multi-module budgets: DBNR recovers from 115% toward the 119–125% of FY2022–FY2024, with gross retention near 97% [FY2026 10-K; Q4 FY26 call].
2. Cloud, identity and next-gen SIEM ($2.1B ARR, +39%) keep growing far faster than endpoint and approach half of ARR [Q2 FY27 call].
3. AI enlarges the security budget and CrowdStrike, not frontier labs or Microsoft, captures it: FY2027 net new ARR of ~$1.355B (+34%) is met and growth in FY2028 stays well above 20% [Q2 FY27 call].
4. Operating leverage reaches owners: FCF stays at 30% of revenue or more while SBC falls as a share of revenue and the share count stops rising.

4. Main bear case

The most likely loss comes from paying ~48x ARR for a metric that proves softer than reported. ARR assumes every contract renews on current terms, and Flex-account ARR counts committed budgets whether or not modules are used; the 10-K warns that customers who cannot use their "flexible subscription" entitlements may renew smaller [FY2026 10-K]. Since December 2025 the company has disclosed DOJ and SEC requests about its "recognition of revenue and reporting of ARR for transactions with certain customers" [Q3 FY26 10-Q; Q2 FY27 10-Q]. Meanwhile SBC grows faster than revenue (+28% vs +26% in H1 FY2027) and shares outstanding rose 4.9% from February 2024 to February 2026 despite a buyback [Q2 FY27 10-Q; FY2024 and FY2026 10-K covers].

How it breaks: the first large Flex cohorts renew smaller and DBNR stalls at 112–115%; the AI surge fades and net new ARR growth falls below 20% in FY2028; non-cancellable purchase commitments (up from $2.8B in January to $4.1B in July, plus $2.9B signed after the quarter) leave fixed compute costs behind; or the DOJ/SEC inquiry ends in a revision of ARR or revenue. Any one of these lowers the multiple on every ARR dollar; the first and last also damage management credibility.

5. Business quality

The moat is the installed sensor plus the data behind it. One agent, one console, and the data needed for most modules already in the platform make cross-sell a licence change. Every customer is "next-gen SIEM enabled", and SIEM can be priced below incumbents because CrowdStrike generates the endpoint data itself [Q3 FY26 call; Q2 FY27 call]. Retention shows the stickiness: gross retention was 97% at FY2026 year-end and held "high" through the July 2024 outage, and 51% of subscription customers use six or more modules [FY2026 10-K; Q4 FY26 call; Q2 FY27 call]. The incident-response business sees breaches first and feeds both threat data and leads.

The weaknesses are concentration and reported profitability. The same single agent was the failure point on July 19, 2024, when one content update crashed Windows systems worldwide; it cost free "customer commitment packages" of about $80M of ARR value and $82M more incident-related G&A in FY2026 [FY2026 10-K; Q4 FY26 call]. GAAP operating income has been negative in every fiscal year shown (FY2026: $(293.3)M), and net income has been positive only in FY2024 and the last three quarters [FY2026 10-K; Q2 FY27 10-Q]. DBNR has fallen from 125.3% (FY2023) to 115% (FY2026) as the base matured [FY2023 and FY2026 10-K].

6. Key value drivers

• Flex adoption and re-Flex: conversions lift account ARR >40%; first re-Flex adds 25%; 630+ accounts have re-Flexed; 935+ Flex accounts added in Q2; Flex new logos were 34% of Q2 net new ARR [Q2 FY27 call].
• Newer modules: next-gen SIEM ~$695M ARR (+60$905M (+29%), identity >$585M (+34%) [Q2 FY27 call]. Together ~36% of ARR (author's arithmetic).
• AI-DR: priced separately with token packs; ARR "nearly tripled" q/q in Q2; amounts not disclosed [Q2 FY27 call].
• Endpoint: accelerated four straight quarters; management says about half the market still runs legacy antivirus [Q2 FY27 call].
• Channels: MSSP business >$1.3B; GSI business up ~50%; Microsoft marketplace open since early 2026 [Q4 FY26 call; Q2 FY27 call].
• Cost lines that swing margin: cloud hosting and data-centre depreciation (subscription cost of revenue +23% in Q2); capex nearly doubled in H1 FY2027 to $222.0M; commission amortisation lengthened from four to five years from FY2027, worth $85–95M of FY2027 operating income [Q2 FY27 10-Q; FY2026 10-K].

7. Financial profile

Revenue grew from $1,451.6M (FY2022) to $2,241.2M, $3,055.6M, $3,953.6M and $4,812.0M (FY2026), with growth slowing from 54% to 22% before re-accelerating to 26% in H1 FY2027 [FY2024 and FY2026 10-K; Q2 FY27 10-Q]. ARR went from $1.73B (Jan 2022) to $5.25B (Jan 2026) and $5.84B (Jul 2026) [FY2022–FY2026 10-Ks; Q2 FY27 10-Q]. GAAP gross margin has held at 75%; subscription gross margin at 78% [FY2026 10-K; Q2 FY27 10-Q].

Free cash flow (operating cash flow less capex and capitalised software; author's arithmetic) was $940M in FY2024 (31% of revenue), $1,068M in FY2025 (27%) and $1,241M in FY2026 (26%); trailing twelve months to July 2026 it was $1,526M (28%). SBC over the same periods was $649M, $861M, $1,097M and $1,244M. FCF minus SBC was therefore about $292M, $206M, $145M and $281M [FY2026 10-K; Q2 FY27 10-Q]. Non-GAAP figures are from the calls, because the earnings-release exhibits are not in sources: Q2 non-GAAP operating margin 25% and FY2027 guidance of revenue $5.99–6.01B, non-GAAP operating income ~$1.50B and FCF margin of at least 30% [Q2 FY27 call].

The FY2026 10-K revised FY2024 and FY2025 for an immaterial SBC error found in Q4 FY2026. As a result FY2024's operating loss reads $(2.0)M in the FY2024 10-K and $(19.1)M in the FY2026 10-K [FY2024 10-K; FY2026 10-K]. The note puts the FY2025 impact at $4.0M; the FY2024 gap is larger than that note explains (see §13).

Balance sheet at July 31, 2026: cash $5.01B; $750M of senior notes due FY2030 (carried at $746M); deferred revenue $4.8B ($3.5B current); backlog not yet billed ~$5.9B [Q2 FY27 10-Q]. H1 FY2027 cash went to acquisitions ($881M: SGNL $628M, Seraphic $327M), capex and a $176M buyback [Q2 FY27 10-Q; FY2026 10-K].

8. Valuation

There is no meaningful GAAP earnings base, so the price rests on ARR duration and on SBC intensity falling. At the October 9 close the equity is worth about $282B, roughly 46x FY2027 revenue guidance, 48x July ARR, 182x trailing free cash flow and around 1,000x trailing free cash flow after SBC. On guidance (≥30$6.0B revenue), forward free cash flow of ~$1.8B puts the multiple near 155x. The stock has risen about three times since the company bought back shares at an average $365.63 pre-split (~$91 split-adjusted) in Q1 FY2027 [Q1 FY27 call].

Market data callout — as of market close October 9, 2026 (source: stockanalysis.com web market data, outside sources/; not company filings). Share price $275.04 (split-adjusted); 52-week range $85.68–$286.99; shares outstanding ~1.03B; market capitalisation ~$282.2B. Derived using filings: cash of $5.01B less $0.75B of senior notes at July 31, 2026 gives net cash of ~$4.3B, so EV ≈ $277.9B → ~46x FY2027 revenue guidance midpoint ($6.0B), ~51x TTM revenue ($5.40B), ~48x July ARR ($5.84B), ~182x TTM FCF ($1.53B), ~990x TTM FCF minus SBC ($0.28B). Market data is not a company source and is used nowhere else in this file.

9. Management & capital allocation

George Kurtz co-founded the company in 2011 and is CEO; Burt Podbere is CFO and Michael Sentonas President [FY2026 10-K; Q2 FY27 call]. A CTO transition is under way: Bartley Richardson, formerly of NVIDIA, joined as Chief AI and Autonomous Systems Officer [Q2 FY27 call]. Kurtz owned 2.38M shares pre-split (under 1%); directors and officers as a group held 1.67% [2026 proxy]. CEO total compensation for FY2026 was $247.6M, against $35.2M in FY2025; $242.1M was stock awards, including a December 2025 PSU grant (300,000 target PSUs pre-split, up to 600,000) that pays on CrowdStrike's three-year TSR relative to the S&P 500 [2026 proxy; 8-K Dec 29, 2025]. Sentonas received a similar award in April 2026 [8-K Apr 21, 2026]. The awards reward share price, not ARR quality or per-share cash flow. At the June 2026 meeting 39% of votes cast were withheld from one director, shareholders rejected the supermajority provisions (advisory) and approved officer exculpation [8-K Jun 22, 2026].

Capital allocation has three uses. Tuck-in acquisitions are frequent and growing: Flow Security and Adaptive Shield ($310M, FY2025), Onum and Pangea ($382M, FY2026), SGNL and Seraphic ($955M, closed February 2026) and XM Cyber's technology assets ($145M plus shares, pending) [FY2026 10-K; Q2 FY27 10-Q]. Acquired ARR is not disclosed. Buybacks are small and opportunistic: $1.5B authorised, $176M spent, all in Q1 FY2027, with $1.3B remaining [8-K Apr 6, 2026; Q2 FY27 10-Q]. Compute capacity is the new use: capex nearly doubled in H1 and purchase commitments rose sharply (§4). There is no dividend, and the only debt is the $750M notes.

Claims to verify over time: non-GAAP subscription gross margin of 82–85% by FY2029 [Q2 FY27 call]; the path to $10B and then $20B of ending ARR [Q4 FY26 call]; CCP accounts retaining better than average and having expanded more than twice the $80M granted [Q4 FY26 call]; AI-DR "can be bigger than the EDR business" [Q2 FY27 call].

10. Risks ranked by damage

1. ARR and Flex overstate durable demand Damage rank: High · Permanence: High · Fixability: Low Mechanism: ARR annualises contracts and assumes renewal on existing terms; Flex counts committed budgets whether or not they are used, so a Flex-heavy base can look larger than consumption. Evidence today: DOJ and SEC requests on revenue recognition and ARR reporting for certain customer transactions, first disclosed in the Q3 FY2026 10-Q, unresolved; the 10-K's warning on unused flexible-subscription entitlements; Flex-account ARR (+101%) growing four times faster than total ARR [Q2 FY27 10-Q; FY2026 10-K; Q2 FY27 call]. What would confirm it: a revision, a changed ARR definition, or DBNR stuck at 112–115% as Flex cohorts renew. Impact on value: lowers the multiple on every ARR dollar and damages management credibility; undermines §3 assumptions 1 and 2.

2. SBC absorbs the cash flow owners are paying for Damage rank: High · Permanence: High · Fixability: Medium Mechanism: SBC at ~23% of revenue is a real cost paid in shares; if it grows with revenue, per-share value lags the business. Evidence today: TTM SBC $1.24B against TTM FCF $1.53B; H1 FY2027 SBC +28% vs revenue +26%; basic weighted shares +2.0% y/y in Q2; part of the margin gain is an accounting change worth $85–95M [Q2 FY27 10-Q; FY2026 10-K]. What would confirm it: SBC above ~23% of revenue in FY2027 and share count still rising ~2% a year. Impact on value: at ~1,000x FCF after SBC, the valuation depends on this ratio falling; undermines §3 assumption 4.

3. The AI surge proves a pull-forward and leaves fixed compute costs Damage rank: High · Permanence: Medium · Fixability: Medium Mechanism: a burst of board-driven spending after the Mythos moment fades, or frontier labs and Microsoft bundle adequate AI security, while CrowdStrike has committed to data-centre capacity through FY2034. Evidence today: Q3 guide implies net new ARR growth slowing to 29–31% from 51%; purchase commitments $4.1B plus $2.9B signed after quarter end; capex $222.0M in H1 vs $116.2M a year earlier [Q2 FY27 call; Q2 FY27 10-Q]. What would confirm it: net new ARR growth below ~20% in FY2028 with subscription gross margin flat. Impact on value: growth and gross margin fall together; undermines §3 assumptions 3 and 4.

4. A second platform-wide outage Damage rank: Medium · Permanence: Medium · Fixability: Medium Mechanism: the single agent that makes upsell frictionless also concentrates failure; consolidation is sold on trust. Evidence today: the July 19, 2024 incident; Delta's suit (computer trespass, gross negligence, fraud claims) partly survived dismissal and is in discovery; the airline-passenger class action was dismissed and affirmed on appeal [Q2 FY27 10-Q]. What would confirm it: another global incident, a material Delta judgment, or gross retention below ~97%. Impact on value: customers add a second vendor and resist consolidation; undermines §3 assumption 1.

5. Acquisition-led growth with no disclosure Damage rank: Medium · Permanence: Low · Fixability: High Mechanism: rising tuck-in spend can flatter ARR and add SBC through retention awards without shareholders seeing the returns. Evidence today: $881M of acquisitions in H1 FY2027 against $382M in all of FY2026; no acquired-ARR split [Q2 FY27 10-Q; FY2026 10-K]. What would confirm it: larger deals, or organic growth disclosed below reported growth. Impact on value: lowers return on capital; fixable by disclosure.

11. Metrics to monitor

12. Thesis tripwires

13. Open questions

• How does CrowdStrike count Flex commitments in ARR, and how much of Flex ARR is drawn down versus committed but unused? Not disclosed.
• What transactions do the DOJ and SEC requests cover, and in which periods? The 10-Q gives no detail (see §10 risk 1).
• What are the $2.9B of post-quarter purchase commitments for (GPU or data-centre capacity, a cloud provider contract), and over what years do they fall due?
• Why does FY2024 operating loss differ by ~$17M between the FY2024 and FY2026 10-Ks when the revision note cites a $4.0M FY2025 impact? Needs the full Note 16 reconciliation.
• How much ARR did SGNL, Seraphic, Onum and Pangea bring? No acquired-ARR split is disclosed.
• What are AI-DR's ARR and gross margin once token costs are included? Only growth rates are given on calls.

14. Update log

15. Source map