Can you elaborate on the 10 other agents besides Charlotte and recent acquisitions like SGNL.ai and Seraphic? Where are customers in their agentic journey, and is identity a main hurdle?

Identity is a major threat vector, with 80% of breaches being non-malware based. SGNL.ai is game-changing for zero standing privileges and protecting human/nonhuman identities. Seraphic provides browser security, protecting the "front door" for AI apps. AIDR is seen as a future "must-have" like EDR, driven by compliance. “identity is one of the biggest threat vectors right now that we see. In fact, 1 of our latest threat reports, 80% of the breaches are non-malware-based, right? So a lot of it is around identity.”

How does CrowdStrike's next-gen SIEM opportunity hold up against potential commoditization from frontier labs/models? What is the relationship with frontier labs, and how durable is the moat?

CrowdStrike is a net data creator with unique telemetry from agents and Threat Graph, enabling real-time prevention, which differs from LLM providers. They leverage frontier models and their own bespoke models. The platform drives consolidation, sticky workflows, and compliant outcomes. An open model allows customers to leverage their own agents and technologies. “we're a net data creator, right? We have telemetry that we create from our agents and from other parts of our platform that is unique. We put it into various data stores, including next-gen SIEM and our Threat Graph. And we're able to understand the threats in real time with real-time prevention. That's vastly different than what the LLM providers and frontier models do.”

How do you see the competitive environment in cloud security, and what about the longevity of its growth?

CrowdStrike's cloud security execution is strong, particularly with runtime protection for breach prevention. The integrated CSPM, CIEM, CDR, and OverWatch threat hunting provide better outcomes at lower cost than competitors, driving customer adoption and growth. “One of the areas that we focused on, as you know, for a long time, is runtime protection, and that's the technology that really is focused on stopping breaches. And I think customers have realized just by having the ability to understand sort of exposures doesn't mean you're going to stop the breach.”

CRWD

CrowdStrike (CRWD) Q4 FY26 earnings call: guidance and Q&A

Earnings call· Jan 2026 (Q4 FY26)· Information Technology· Mar 3, 2026

Source: earnings call transcript

Executive summary

CrowdStrike Q4 FY26 — Record Net New ARR and AI-Driven Demand

CrowdStrike delivered a blockbuster Q4 FY26, driven by record net new ARR and strong platform adoption, particularly with the Falcon Flex model. The company is capitalizing on AI-driven demand, positioning itself as critical infrastructure for securing AI while leveraging its proprietary data and agentic technologies to maintain a competitive advantage. This strong momentum and record pipeline provide confidence for continued profitable growth into FY27.

Highlights

Achieved all-time record net new ARR of $331 million for the quarter, growing 47% year-over-year.
Ending ARR reached $5.25 billion, crossing the $5 billion milestone and accelerating to 24% growth year-over-year.
Delivered record free cash flow of $376 million for the quarter, representing 29% of revenue.
Reported all-time record operating income of $326 million for the quarter, or 25% of revenue.
Ending ARR from the Falcon Flex subscription model grew more than 120% year-over-year to $1.69 billion.

Guidance & targets

Category	Target	Timeline	Confidence
Q1 FY27 Annual Recurring Revenue (ARR)	$5.502 billion to $5.504 billion high materiality	Q1 · FY27	High
Q1 FY27 Net New Annual Recurring Revenue (ARR)	$249 million to $251 million high materiality	Q1 · FY27	High
Q1 FY27 Total Revenue	$1.360 billion to $1.364 billion high materiality	Q1 · FY27	High
Q1 FY27 Non-GAAP Income from Operations	$308 million to $310 million medium materiality	Q1 · FY27	High
Q1 FY27 Non-GAAP Net Income Attributable to CrowdStrike	$275 million to $277 million medium materiality	Q1 · FY27	High
Q1 FY27 Diluted Non-GAAP Net Income Per Share	$1.06 to $1.07 medium materiality	Q1 · FY27	High
Full Fiscal Year 2027 Annual Recurring Revenue (ARR)	$6.466 billion to $6.516 billion high materiality	FY27	High
Full Fiscal Year 2027 Net New Annual Recurring Revenue (ARR)	$1.213 billion to $1.264 billion high materiality	FY27	High
Full Fiscal Year 2027 Total Revenue	$5.868 billion to $5.928 billion high materiality	FY27	High
Full Fiscal Year 2027 Non-GAAP Income from Operations	$1.422 billion to $1.462 billion medium materiality	FY27	High
Full Fiscal Year 2027 Non-GAAP Net Income Attributable to CrowdStrike	$1.241 billion to $1.271 billion medium materiality	FY27	High
Full Fiscal Year 2027 Diluted Non-GAAP Net Income Per Share	$4.78 to $4.90 medium materiality	FY27	High
Full Fiscal Year 2027 Free Cash Flow Margin	at least 30% medium materiality	FY27	High
Q1 FY27 Free Cash Flow Margin	approximately 33% medium materiality	Q1 · FY27	High
Full Fiscal Year 2027 Capital Expenditures as a Percentage of Revenue	7% to 8% medium materiality	FY27	High
Full Fiscal Year 2027 Interest Income	$160 million to $170 million low materiality	FY27	High
FY27 Non-GAAP Operating Income Benefit from Sales Commission Amortization Change	$85 million to $95 million medium materiality	FY27	High
FY27 Operating Expenses from Recent Acquisitions Integration	$74 million to $80 million medium materiality	FY27	High
Q1 FY27 Acquired Net New ARR (SGNL & Seraphic)	$5 million to $8 million low materiality	Q1 · FY27	High
FY27 Partner Rebates as Percentage of Total Revenue	approximately 0.8% low materiality	FY27	High
FY27 Net New ARR Seasonality	41% in H1, 59% in H2 low materiality	FY27	High
FY27 Free Cash Flow Dollars Seasonality	43% in H1, 57% in H2 low materiality	FY27	High

Segment performance

Segment	Revenue	YoY	QoQ	Margin
Next-Gen Identity Experienced double-digit acceleration versus two quarters ago, driven by strong performance in privileged account security and Falcon Shield, which grew more than 5x since the acquisition of Adaptive Shield. Ending ARR: $520 millionPrivileged account security growth: more than 170% sequentiallyFalcon Shield ARR growth: more than 300% year-over-year	—	more than 34%	—	—
Cloud Business Net new ARR growth accelerated for the second consecutive quarter, exceeding $800 million in ending ARR for the first time as customers secure AI infrastructure. Ending ARR: $800 million	—	more than 35%	—	—
Next-Gen SIEM Delivered a record quarter, proving itself as a scaled market disruptor with significant performance and cost advantages over legacy competitors. Ending ARR: $585 million	—	over 75%	—	—
U.S. Exceeded expectations in Q4 FY26.	66% of total revenue	—	—	—
International Showed broad strength across all major geographic markets, with EMEA and APAC exceeding expectations.	34% of total revenue	accelerating compared to Q3	—	—

CRWD operating KPIs by quarter

CRWD operating KPIs stated on its earnings calls, by fiscal quarter
KPI	Jan 2025 Q4 FY25	Apr 2025 Q1 FY26	Jul 2025 Q2 FY26	Oct 2025 Q3 FY26	This call Jan 2026 Q4 FY26	Apr 2026 Q1 FY27	Jul 2026 Q2 FY27	Change vs prior quarter
Annual recurring revenue (ARR)	$4.24B Q4 and FY 2025 highlights include: Q4 net new ARR of $224 million, well ahead of our expectations closing FY 2025 at $4.24 billion in ending ARR. Source: earnings call transcript	$4.44B In Q1, we achieved net new ARR of $194 million, growing ending ARR to $4.44 billion, up 22% over last year. Source: earnings call transcript	$4.66B Highlights included: one, record Q2 net new ARR of $221 million, double-digit millions ahead of our expectations, showcasing accelerating net new ARR; two, ending ARR of $4.66 billion, growing more than 20% year-over-year; three, record Q2 free cash flow of $284 million or 24% of revenue; four, record operating income of $255 million or 22% of revenue; five, total revenue growth of 21% year-over-year, reaching $1.17 billion and exceeding the high end of our guidance; six, cloud, Next-Gen Identity, and Next-Gen SIEM platform solutions are now more than $1.56 billion in ending ARR, growing more than 40% year-over-year; and seven, we surpassed the 1,000 Falcon Flex customer milestone with the average Flex customer representing more than $1 million of ending ARR. Source: earnings call transcript	$4.92B Across the entire CrowdStrike team, I'm extremely proud of our Q3 with highlights including: one, record Q3 net new ARR of $265 million, which grew 73% year-over-year, beating our expectations by more than 10%; two, ending ARR of $4.92 billion, which accelerated to 23% growth year-over-year; three, record Q3 free cash flow of $296 million or 24% of revenue; four, all-time record operating income of $265 million or 21% of revenue, this is the second consecutive quarter of record operating income; five, broad-based ending ARR acceleration across cloud, Next-Gen Identity and Next-Gen SIEM collectively as well as acceleration in our endpoint business; and six, more than $1.35 billion in ending ARR from accounts that have adopted the Falcon Flex subscription model, growing more than 200% year-over-year. Source: earnings call transcript	$5.25B Two, ending ARR of $5.25 billion, crossing the $5 billion milestone, which accelerated to 24% growth year-over-year. Source: earnings call transcript	$5.51B In this new Agentic era, we're now guiding net new ARR acceleration for the full year Q1 highlights included: one, record Q1 net new ARR of $256 million, up 32% year-over-year and exceeding the high end of our guidance; two, ending ARR of $5.51 billion, accelerating over our record Q4 and more than 24% growth; three, total revenue of $1.39 billion, up 26% year-over-year, beating guidance and accelerating for the fourth consecutive quarter; four, all-time record free cash flow of $468 million or 34% of revenue, exceeding our expectations. Source: earnings call transcript	$5.84B Two, ending ARR growth accelerated for the fourth consecutive quarter, reaching $5.84 billion, up more than 25% year-over-year; three, total revenue growth accelerated for the fifth consecutive quarter, reaching $1.47 billion, up 26% year-over-year. Source: earnings call transcript	+6%
Annual recurring revenue (ARR) Identity	$370M+ Moving on to our Identity business, which grew to more than $370 million in ending ARR. Source: earnings call transcript	—	—	—	—	—	$585M+ Ending ARR grew 34% year-over-year to more than $585 million driven by strength across our identity product portfolio. Source: earnings call transcript	—
Annual recurring revenue (ARR) Next-Gen SIEM	$330M+ Moving on to our Next-Gen SIEM business, which grew more than 115% year-over-year, finishing the year at more than $330 million in ending ARR. Source: earnings call transcript	—	—	—	$585M+ Our Next-Gen SIEM business grew over 75% year-over-year, delivering ending ARR of more than $585 million. Source: earnings call transcript	$600M+ Our next-gen SIEM business exceeded $600 million in ending ARR and has transformed CrowdStrike into the operating system of the AI SOC. Source: earnings call transcript	$695M+ NextGen SIEM ending ARR surpassed $695 million this quarter as both new and existing customers are standardizing on Falcon as the operating system of the SOC. Source: earnings call transcript	—
Gross retention rate	97% Gross retention in Q4 remained high at 97%, and our dollar-based net retention rate was 112%, reflecting the impact of customer commitment packages. Source: earnings call transcript	97% In Q1, where we met or exceeded our key metrics, highlights include: one, Q1 net new ARR of $194 million, double-digit millions ahead of our expectations; two, Q1 ending ARR surpassing $4.4 billion, maintaining our leadership as the only pure-play cybersecurity software company of this size; three, subscription gross margin of 80%, demonstrating our AI platform efficiency; four, sustained 97% gross retention as customers remain firmly committed to Falcon; five, free cash flow of $279 million or 25% of revenue, demonstrating double-digit quarter-on-quarter growth; and six, added $774 million of total Falcon Flex account value, bringing the total deal value of accounts that have adopted Falcon Flex to $3.2 billion, growing 31% sequentially and more than 6x year-over-year. Source: earnings call transcript	—	—	97% Six, dollar-based net retention of 115% and gross retention of 97%, showcasing best-in-class durability and stickiness, which leads to my final point. Source: earnings call transcript	—	—	—
Net revenue retention rate	112% Gross retention in Q4 remained high at 97%, and our dollar-based net retention rate was 112%, reflecting the impact of customer commitment packages. Source: earnings call transcript	—	—	—	115% Six, dollar-based net retention of 115% and gross retention of 97%, showcasing best-in-class durability and stickiness, which leads to my final point. Source: earnings call transcript	—	—	—
Annual recurring revenue (ARR) Falcon Flex	—	—	—	$1.35B+ Across the entire CrowdStrike team, I'm extremely proud of our Q3 with highlights including: one, record Q3 net new ARR of $265 million, which grew 73% year-over-year, beating our expectations by more than 10%; two, ending ARR of $4.92 billion, which accelerated to 23% growth year-over-year; three, record Q3 free cash flow of $296 million or 24% of revenue; four, all-time record operating income of $265 million or 21% of revenue, this is the second consecutive quarter of record operating income; five, broad-based ending ARR acceleration across cloud, Next-Gen Identity and Next-Gen SIEM collectively as well as acceleration in our endpoint business; and six, more than $1.35 billion in ending ARR from accounts that have adopted the Falcon Flex subscription model, growing more than 200% year-over-year. Source: earnings call transcript	$1.69B Seven, we delivered $1.69 billion in ending ARR from accounts that have adopted the Falcon Flex subscription model, growing more than 120% year-over-year, turbocharging our land-and-expand motion. Source: earnings call transcript	$1.9B+ Five, record Q1 operating income of $326 million or 24% of revenue, up 62% year-over-year, exceeding guidance and six, we added over 300 Falcon Flex accounts in the quarter with accounts that have adopted the subscription model reaching more than $1.9 billion in ending ARR, growing 99% year-over-year. Source: earnings call transcript	$2.29B+ Seven, all-time record Falcon Flex quarter with ending ARR from accounts that have adopted the Falcon Flex subscription model surpassing $2.29 billion, accelerating to 101% year-over-year growth. Source: earnings call transcript	—
Annual recurring revenue (ARR) Next-Gen Identity, Cloud and Next-Gen SIEM	—	—	—	—	$1.9B+ Collectively, our Next-Gen Identity, cloud and Next-Gen SIEM businesses grew more than 45% year-over-year reaching more than $1.9 billion in ending ARR. Source: earnings call transcript	$2B+ Combined, these businesses have now exceeded $2 billion in ending ARR. Source: earnings call transcript	$2.1B When you think about cloud, next-gen SIEM, next-gen identity, ending ARR was $2.1 billion, up 39% year-over-year. Source: earnings call transcript	—
Annual recurring revenue (ARR) Cloud	—	—	—	—	$800M+ For the first time, our cloud business exceeded $800 million in ending ARR as our customers look to us to secure the infrastructure powering their AI future. Source: earnings call transcript	—	$905M+ Moving on to cloud, where ending ARR exceeded $905 million, growing more than 29% year-over-year. Source: earnings call transcript	—
Customers Reflex	—	—	—	—	—	480 The most exciting part is the Reflex dynamic, customers renewing and expanding their investment beyond their first Flex contract with highlights including the number of Reflex customers reached 480, representing nearly 25% of all Flex customers. Source: earnings call transcript	630+ We also saw a record reflex activity for existing Flex customers with more than 630 accounts having reflexed at least once up 6x year-over-year. Source: earnings call transcript	—

Operating figures the company stated on at least two of the calls shown, checked against each call's transcript. Click a figure to read the sentence. A dash means it was not stated that quarter.

Orderbook & backlog

Q1 FY27 Pipeline 49% Q4 FY26

year-over-year growth

Record pipeline entering FY27.

Product announcements

Product	Type	Timeline	Details
AIDR (AI-powered Incident Detection and Response)	launch	available for a few weeks

Deals & partnerships

SGNL.ai acquisition

Brings zero standing privilege for all identities to the Falcon platform, enabling high fidelity, content-driven, real-time authorization to rapidly reduce identity attack surface.

Seraphic acquisition

Turns any browser into a secure enterprise browser without impacting user behavior, addressing the browser as the front door for AI applications and providing real-time visibility and protection.

Microsoft partnership

Partnership to make the world safer, reflecting a clear evolution in how the companies see each other. George Kurtz and Satya Nadella spoke to CrowdStrike's go-to-market team together.

Q&A highlights

When will securing AI meaningfully contribute to ARR, and how much of this new market will go to pure-play cyber vendors versus hyperscalers?

AI is already driving ARR growth, with AIDR up 5x QoQ. AI also drives growth in cloud, next-gen SIEM, and other areas. Hyperscalers didn't take over cloud security, and the same will happen with "AI hyperscalers"; CrowdStrike partners with them and leverages their LLMs while providing its own platform as the system of record.

“when I started the company in 2011, we pioneered cloud-delivered security. And over the years, as cloud was maturing, I heard a lot about the hyperscalers actually providing all the security services. Well, that didn't happen. In fact, as you've seen with our results and our partnership with AWS, as an example, we transact billions through these platforms, and they're a great partner, and there's a lot more exposure in the cloud. So we see the same thing happening what I call AI hyperscalers”

asked by Joe Gallo · answered by George Kurtz

3 min read 6 chapters

Detailed narrative

AI as a Business Accelerant

AI is driving elevated demand for the Falcon platform and is a key accelerant for CrowdStrike's business. The company sees the AI revolution creating two distinct groups of software companies: those existentially vulnerable and those that will thrive. CrowdStrike positions itself in the latter, as a mission-critical, trusted infrastructure technology necessary for global continuity with deep IP, producing novel, fresh, and proprietary data that fuels agentic business outcomes.

Competitive Moat and Data Advantage

CrowdStrike's Falcon platform is a vertically integrated net data creator and third-party data aggregator, generating unique real-time data from customer environments and world-class threat intelligence. Threat Graph correlates over 1 trillion security events per day across approximately 2 trillion vertices, analyzing 15+ petabytes of structured, queryable security signals at a scale no one can replicate.

This proprietary data, combined with expert-labeled data from MDR analysts and incident responders, creates a structural flywheel and network effect that ensures superior outcomes in stopping breaches.

Securing the AI Stack

Falcon is purpose-built for securing AI at every layer of the new AI stack, which represents the attack surface of the future. This includes securing GPU foundations (partnering with NVIDIA, AMD, Intel), hardware and infrastructure OEMs (Dell, HPE, Super Micro), neoclouds and hyperscalers (AWS, OCI, GCP, Azure), token factories (Anthropic, OpenAI, Google Gemini), and AI applications/agents.

CrowdStrike secures nearly all of these companies themselves, positioning it as a key player in securing the world's AI future.

Falcon Flex Model Success

The revolutionary Falcon Flex subscription model has been a smashing success, with over 1,600 customers adopting it and adding more than 350 Flex customers in Q4. The average Flex customer's ending ARR is greater than $1 million. More than 380 Flex accounts have already re-Flexed, representing over 23% of the Flex customer base, up from 5% in Q1, with an average ARR lift of 26% within 7 months.

Nearly 100 customers have re-Flexed multiple times, showing an additional 48% ARR lift from their initial Flex subscription, demonstrating strong platform adoption and expansion.

Strategic Acquisitions and Product Expansion

CrowdStrike recently closed the acquisitions of SGNL.ai and Seraphic, enhancing its identity and endpoint security offerings. SGNL.ai brings zero standing privilege for all identities to the Falcon platform, enabling high-fidelity, real-time authorization to rapidly reduce identity attack surface. Seraphic turns any browser into a secure enterprise browser, addressing the browser as the front door for AI applications and providing real-time visibility and protection for human and nonhuman users.

These acquisitions are expected to contribute $5 million to $8 million of acquired net new ARR in Q1 FY27.

Partner Ecosystem and Hyperscaler Leadership

CrowdStrike's partner go-to-market strategy delivered beyond expectations, with growing practices across major consulting firms like EY, Accenture, and Deloitte, focused on next-gen SIEM migrations. The MSSP business grew from sub-$100 million to over $1.3 billion in 3 years. The company transacted nearly $1.5 billion of total contract value on the AWS marketplace, growing nearly 50% YoY, and is now open for business on the Microsoft marketplace, allowing customers to use Azure consumption commitment dollars on Falcon, reflecting a significant evolution in strategic partnerships.

Summary of the company's earnings call; see how call summaries are prepared. Not investment advice.