CRWD · US
CRWD.US: Q1 FY27 $1.39B — record NNARR & 4-for-1 split
CrowdStrike Q1 FY27 revenue $1.39B (+26%), ARR $5.51B, NNARR $256M. OCF $591M / FCF $468M. 4-for-1 split 2026-07-02. Billings previously missed.
Cite a section with a deep link, e.g. /en/r/crwd-us-research#thesis
Snapshot
- Price
- USD 191
- Mkt cap
- USD 194.0B
- Revenue
- USD 4.8B
- ARR (approx)
- USD 6.0B
As-of 2026-09-25 (weekly refresh; equities aligned to §A. Missing series are N/A/null. Not investment advice.)
Thesis
CrowdStrike is the reference cloud-native endpoint/XDR platform: a lightweight Falcon agent feeds telemetry into a security cloud, with Charlotte AI and purpose-built agents for triage and response. The live debate is simple: AI is lifting both the attack surface and security budgets, and FY27 Q2 (ended 31 Jul 2026) just printed record net-new ARR plus a raised guide—yet the multiple still hangs on whether 20%+ growth holds and whether the platform stays up. A 4-for-1 split closed in Jul 2026; read historical prices split-adjusted.
Bull case: enterprises now treat AI agents as identities to secure; Falcon Flex, cloud, next-gen SIEM and identity keep cross-selling; operating cash already funds expansion. Bear case: Microsoft Defender bundling, PANW platformization, or another global outage can reprice the brand overnight. Core AI-security holding to track—not an unconditional compounder.
Business
Model: almost entirely cloud security subscriptions (Falcon modules / seats / workloads), plus light professional services. Revenue is land-and-expand, not perpetual licenses.
Flagships:
- Falcon endpoint / XDR — the install base that sets telemetry scale and brand.
- Cloud security + Next-Gen SIEM + Next-Gen Identity — FY27 Q2 ending ARR: cloud >$905M (+29%), SIEM >$695M (+60%+), identity >$585M (+33%).
- Charlotte AI / AIDR / Continuous Identity for AI Agents — productized “AI as analyst” and “secure the agent.” AIDR ending ARR nearly tripled sequentially (company-reported).
Edge: cloud-native architecture and a threat-graph flywheel. 51% of subscription customers run six or more modules. Gap: the 2024 global configuration incident is still a valuation haircut.
Strategy (12–24m): Falcon as the control plane from GPU to agent to prompt; Falcon Flex already dominated Q2’s top-10 deals; Aug 2026 agreement to buy XM Cyber technology assets for attack-path visualization. Entity: CrowdStrike Holdings (Nasdaq: CRWD).
Value chain
Position: application-layer security (endpoint / cloud workload / identity). Upstream: public-cloud regions and intel; downstream: SOCs, CISOs, and AI platform teams.
| Direction | Parties | Leverage |
|---|---|---|
| Upstream | AWS and other regions, intel feeds | A region outage shows up as a product incident |
| Downstream | Global SOCs; Fortune-scale logos | Large renewals matter; customer count is scaled |
Concentration: no single-customer % disclosed. Demand is diversified across thousands of subscribers, but the top 10 deals can still swing quarterly net-new ARR. Billing is mostly prepaid USD subscriptions.
Supply risks: (1) cloud-region availability; (2) Microsoft OS bundling at the endpoint. Both echo #risks.
Newsflow · last 6 months
Window 1 Feb 2026 – 28 Aug 2026. Use it to judge whether the tape is validating growth or only paying for an AI headline. No unverified rumors.
Last 6 months — events / news
| Date | Type | Event | Why it matters |
|---|---|---|---|
| 2026-08-26 | 财报 / 并购 | FY27 Q2（截至 07-31）：收入 $14.7 亿 +26%；净新增 ARR $3.33 亿纪录；全年收入指引上修至 $59.91–60.11 亿；AIDR 与「AI 智能体持续身份」；同意收购 XM Cyber 技术资产 | 近 6 个月最强基本面脉冲：需求+AI SKU 同时被量化 |
| 2026-08-10 | 市场 | Black Hat：与 PANW 等因 AI 智能体威胁叙事走强、创阶段高点 | 主题 Beta 正向；需用 8-26 财报验证是否只有情绪 |
| 2026-07 | 公司行动 | 普通股四拆一完成；后续 EPS 按拆细后口径重述 | 只改股价刻度；比较历史价格必须复权 |
| 2026-03-03 | 财报 | FY26 全年：收入 $48.1 亿；期末 ARR $52.5 亿；经营/自由现金流创纪录 | 订阅规模上台阶，为 FY27 加速提供基数 |
Read-through: August earnings + Black Hat were a clear positive pulse. The split only changes the price scale. Still missing: durable, standalone ARR for AIDR / agent identity.
Valuation
Valuation snapshot (multi-lens)
| Metric | Value | Note |
|---|---|---|
| TTM PE | N/A | 未接入具名行情源；TTM 盈利≤0 或未核验时不填造倍数 |
| PB | N/A | 待最新净资产与市值核验 |
| 股息率 | N/A | 待分红公告 / IR |
| 现价语境 | 约 191 | CRWD · 以包内 kpi_snapshot 时点为准 |
Valuation & return · ~3y
Interactive chart available in the reader.
The market is paying for “AI-security growth platform”: FY26 revenue $4.81B (+22%); FY27 revenue guide raised to about $5.99–6.01B. The multiple is a function of net-new ARR and guide slope—Q2’s beat popped the stock after hours. Dividend yield ≈ 0. The Jul 2026 4-for-1 split requires split-adjusted PE/price history. KPI prices are approximate; use the latest close.
Share price · ~3y
Interactive chart available in the reader.
Financial trend (~24 months)
The 8Q charts are reconstructed from public disclosures (not audit-line). Near-term facts: FY26 10-K and FY27 Q2 release.
Revenue · last 8Q
Interactive chart available in the reader.
Gross margin · last 8Q
Interactive chart available in the reader.
Net income · last 8Q
Interactive chart available in the reader.
Financial health (§A.7)
Financial health (OCF / debt / liquidity / audit)
| Item | Value | Note |
|---|---|---|
| 财务健康总评 | 稳健偏扩张 | 以最新季报 OCF 与净现金为准 |
| 经营现金流 | 见最新 10-Q | AI 周期龙头通常 OCF 强劲 |
| 净负债 / 现金 | 投资级或净现金 | 详见 table 与 IR |
| 流动性 | 充裕 | Current ratio / cash & equivalents |
| 审计意见 | 无保留（常规预期） | 以最新 10-K 为准 |
Financial health (§A.7)
Operating cash is positive and set a Q2 record (~$530M); cash and equivalents ~$5B. Interest-bearing debt is not a solvency issue versus cash. No going-concern emphasis in the latest 10-K/10-Q. SBC remains heavy—read FCF net of dilution.
Operations
Volume: endpoints / cloud workloads and Flex accounts (Q2: +935 Flex accounts, including all top-10 deals by value). Price: module ASP + Flex consumption. Cost: cloud COGS, S&M, SBC. The platform story is the 6+/7+/8+ module mix.
Key financials
| Item | Value | YoY | Note |
|---|---|---|---|
| FY26 revenue | $4.81B | +22% | Subscription platform |
| Ending ARR | FY26 $5.25B; run-rate ~$6B | Q2 nnARR $333M | FY27 rev guide ~$6.0B |
| Module attach | 51% on 6+ modules | — | Platform flywheel |
| Q2 FY27 OCF | ~$530M | Record | Cash covers expansion |
Competition
Direct peers: Microsoft Defender (bundle), Palo Alto (broader platform + Prisma AIRS), SentinelOne (AI-challenger). CrowdStrike wins on cloud-native brand and module flywheel; it loses if the platform blinks, and it does not own the firewall/network layer.
Peer map
| Company | Share/role | Margin | Strength | Weakness |
|---|---|---|---|---|
| CrowdStrike (self) | Endpoint/XDR | ~78% GM | Cloud-native brand | Outage sensitivity |
| Microsoft Defender | Suite attach | Bundle | Distribution | Best-of-breed fight |
| Palo Alto | Platform | High | Broader stack | Endpoint share |
| SentinelOne | Endpoint peer | High GM | AI messaging | Scale gap |
Management
Management (24m)
| Role | Name | Since | 24m change |
|---|---|---|---|
| CEO | George Kurtz | co-founder | No material change |
| CFO | Burt Podbere | long-tenured | No material change |
| President / field | Field leadership | ongoing | Normal rotations |
Stability: steady. Founder-CEO George Kurtz and CFO Burt Podbere are long-tenured; no control change in 24 months.
Outlook
Watch FY27 net-new ARR (midpoint ~+34%), Flex/AIDR quantification, XM Cyber close, and any availability incident. Q3 revenue guide ~$1.52–1.53B. If net-new ARR stays hot and the platform stays quiet, the premium can hold; if growth looks like “ordinary cyber” and AI SKUs disappoint, the multiple compresses fast.
Scenarios
| Scenario | Condition | Implication |
|---|---|---|
| Bull | Net-new ARR stays elevated; AIDR/agent identity becomes disclosed ARR | Theme premium holds |
| Base | Revenue 20%+, cash solid; AI is incremental | Hold/watch the guide |
| Bear | Growth steps down, or another global outage | Multiple crush, brand repair first |
Risks
- High: another outage / false-positive event (2024 memory is intact).
- High: Defender and PANW platform pressure on net-new ARR.
- Medium: growth-stock beta to software and tiny guide misses.
- Medium: SBC and post-split supply/liquidity.
- Low: single-customer concentration (not disclosed at a dangerous level).
Tracking
- Quarterly net-new ARR vs the Q2 ~$333M record
- Ending ARR for AIDR, Flex, cloud / SIEM / identity
- Whether OCF keeps printing records after SBC
- XM Cyber close and whether attack-path shows up in large deals
- Public availability / false-positive incidents
References
Issuer / key sources:
- https://ir.crowdstrike.com/
- FY27 Q2 results (2026-08-26): https://www.sec.gov/Archives/edgar/data/1535527/000153552726000029/crwd-20260826xex991.htm
- https://www.cnbc.com/2026/08/26/crowdstrike-crwd-earnings-q2-2027.html
- Post-Black Hat tape (2026-08-10): https://www.cnbc.com/2026/08/10/crowdstrike-palo-alto-stock-black-hat.html
- https://www.sec.gov/edgar
Not investment advice; defer to latest filings. News window through 2026-08-28.
Comments
Sign in to comment