Inve US ▾
CRCRWD

CrowdStrike (CRWD) Q1 FY27 earnings call: guidance and Q&A

Earnings call· Apr 2026 (Q1 FY27)· Information Technology· Jun 3, 2026

Source: earnings call transcript

Executive summary

CrowdStrike Q1 FY27 — Post-'Mythos' AI inflection drives raised net-new-ARR guide and first-ever stock split

CrowdStrike frames the post-'Mythos' collision of frontier AI and cybersecurity as a structural, compounding demand inflection, positioning Falcon as critical AI infrastructure and AIDR as a category it argues will eventually eclipse EDR. Management, for the first time, guided full-year net-new-ARR growth to accelerate rather than decelerate, leaning on record Q2 pipeline and Flex-led consolidation while retention specifics stayed qualitative.

Highlights

5

  • Record Q1 net new ARR of $255.8M, up 32% YoY, exceeding the high end of guidance; ending ARR reached $5.51B, +24% YoY and accelerating over a record Q4.

  • Total revenue $1.39B (+26% YoY), beating guidance and accelerating for the fourth consecutive quarter; subscription revenue $1.32B (+26% YoY).

  • Record free cash flow of $468.5M (34% of revenue) and a FCF Rule of 40 of 59% (up 4 quarters running); record non-GAAP operating income of $325.7M at a 24% margin, up 62% YoY.

  • Falcon Flex momentum: 300+ accounts added, subscription-model accounts reached >$1.9B ending ARR (+99% YoY); AIDR ending ARR grew >250% sequentially with a Q2 pipeline already exceeding $50M.

  • Raised FY27 net-new-ARR guidance by $52M (+520 bps of growth) so full-year net-new ARR now accelerates over FY26; announced first-ever 4-for-1 stock split.

Concerns

4

  • Q1 net new ARR ($255.8M) landed only modestly above the guided high end while the full-year raise was large, drawing analyst questions on reconciliation and visibility (Turrin, Tilton); FY confidence rests heavily on a not-yet-converted 'record Q2 pipeline.'

  • Gross and net retention (NRR/NDR) were cited only qualitatively as 'strong,' with no figures disclosed.

  • Escalating adversarial-AI threat — frontier models let 'any human or agent be a vibe hacker,' chaining multiple vulnerabilities into lethal attacks.

  • AIDR / AI-security is still early innings — deals are often division- or geography-level rather than enterprise-wide, and only a low-single-digit % of organizations have an advanced AI security strategy.

Guidance & targets

CategoryTargetConfidence
Full-year FY27 net new ARR growth
$1.279B-$1.303B (27%-29% YoY; 27.7% at midpoint), a $52M raise to $1.291B midpoint
high materiality
High
Full-year FY27 ending ARR
$6.532B-$6.556B (24%-25% YoY)
high materiality
High
Full-year FY27 total revenue
$5.915B-$5.959B (23%-24% YoY)
high materiality
High
Full-year FY27 non-GAAP income from operations
$1.452B-$1.48B
high materiality
High
Full-year FY27 non-GAAP net income attributable to CrowdStrike
$1.263B-$1.285B
medium materiality
High
Full-year FY27 non-GAAP diluted EPS
$4.88-$4.96 (pre-split); ~$1.22-$1.24 split-adjusted
high materiality
High
Full-year FY27 free cash flow margin
At least 30% of revenue
high materiality
High
FY27 net new ARR first-half / second-half seasonality
~42% first half / ~58% second half
low materiality
Medium
FY27 free cash flow dollar first-half / second-half seasonality
~46% first half / ~54% second half
low materiality
Medium
Q2 FY27 ending ARR
$5.793B-$5.795B (24% YoY)
medium materiality
High
Q2 FY27 net new ARR
$284M-$286M (28%-29% YoY)
high materiality
High
Q2 FY27 total revenue
$1.436B-$1.442B (23% YoY)
medium materiality
High
Q2 FY27 non-GAAP income from operations
$346M-$349M
medium materiality
High
Q2 FY27 non-GAAP net income attributable to CrowdStrike
$301M-$303M
medium materiality
High
Q2 FY27 non-GAAP diluted EPS
$1.16-$1.17 (pre-split); ~$0.29 split-adjusted
medium materiality
High
Q2 FY27 free cash flow margin
~24.5% of revenue at midpoint
medium materiality
Medium

Segment performance

SegmentRevenueYoYQoQMargin
Subscription revenue
Subscription is the core recurring business; gross margin at a Q1 record on cloud optimization.
Non-GAAP subscription gross margin: 81% (+90 bps YoY, driven by continued cloud optimization)
$1.32B26%—Non-GAAP subscription gross margin 81% (Q1 record, +90 bps YoY)
Professional services revenue
Remained strong, driven by the elevated threat environment (Mythos-related engagements).
$64.8M23%——
United States (geographic)
US contributed approximately 66% of first-quarter revenue.
~66% of Q1 revenue———
International (geographic)
International was ~34% of revenue, with EMEA and overall international growth accelerating compared to Q4.
~34% of Q1 revenueEMEA and overall international YoY revenue growth accelerated vs Q4——

CRWD operating KPIs by quarter

CRWD operating KPIs stated on its earnings calls, by fiscal quarter
KPI Jan 2025 Q4 FY25 Apr 2025 Q1 FY26 Jul 2025 Q2 FY26 Oct 2025 Q3 FY26 Jan 2026 Q4 FY26This call Apr 2026 Q1 FY27 Jul 2026 Q2 FY27Change vs prior quarter
Annual recurring revenue (ARR)
$4.24B Q4 and FY 2025 highlights include: Q4 net new ARR of $224 million, well ahead of our expectations closing FY 2025 at $4.24 billion in ending ARR. Source: earnings call transcript
$4.44B In Q1, we achieved net new ARR of $194 million, growing ending ARR to $4.44 billion, up 22% over last year. Source: earnings call transcript
$4.66B Highlights included: one, record Q2 net new ARR of $221 million, double-digit millions ahead of our expectations, showcasing accelerating net new ARR; two, ending ARR of $4.66 billion, growing more than 20% year-over-year; three, record Q2 free cash flow of $284 million or 24% of revenue; four, record operating income of $255 million or 22% of revenue; five, total revenue growth of 21% year-over-year, reaching $1.17 billion and exceeding the high end of our guidance; six, cloud, Next-Gen Identity, and Next-Gen SIEM platform solutions are now more than $1.56 billion in ending ARR, growing more than 40% year-over-year; and seven, we surpassed the 1,000 Falcon Flex customer milestone with the average Flex customer representing more than $1 million of ending ARR. Source: earnings call transcript
$4.92B Across the entire CrowdStrike team, I'm extremely proud of our Q3 with highlights including: one, record Q3 net new ARR of $265 million, which grew 73% year-over-year, beating our expectations by more than 10%; two, ending ARR of $4.92 billion, which accelerated to 23% growth year-over-year; three, record Q3 free cash flow of $296 million or 24% of revenue; four, all-time record operating income of $265 million or 21% of revenue, this is the second consecutive quarter of record operating income; five, broad-based ending ARR acceleration across cloud, Next-Gen Identity and Next-Gen SIEM collectively as well as acceleration in our endpoint business; and six, more than $1.35 billion in ending ARR from accounts that have adopted the Falcon Flex subscription model, growing more than 200% year-over-year. Source: earnings call transcript
$5.25B Two, ending ARR of $5.25 billion, crossing the $5 billion milestone, which accelerated to 24% growth year-over-year. Source: earnings call transcript
$5.51B In this new Agentic era, we're now guiding net new ARR acceleration for the full year Q1 highlights included: one, record Q1 net new ARR of $256 million, up 32% year-over-year and exceeding the high end of our guidance; two, ending ARR of $5.51 billion, accelerating over our record Q4 and more than 24% growth; three, total revenue of $1.39 billion, up 26% year-over-year, beating guidance and accelerating for the fourth consecutive quarter; four, all-time record free cash flow of $468 million or 34% of revenue, exceeding our expectations. Source: earnings call transcript
$5.84B Two, ending ARR growth accelerated for the fourth consecutive quarter, reaching $5.84 billion, up more than 25% year-over-year; three, total revenue growth accelerated for the fifth consecutive quarter, reaching $1.47 billion, up 26% year-over-year. Source: earnings call transcript
+6%
Annual recurring revenue (ARR) Identity
$370M+ Moving on to our Identity business, which grew to more than $370 million in ending ARR. Source: earnings call transcript
—————
$585M+ Ending ARR grew 34% year-over-year to more than $585 million driven by strength across our identity product portfolio. Source: earnings call transcript
—
Annual recurring revenue (ARR) Next-Gen SIEM
$330M+ Moving on to our Next-Gen SIEM business, which grew more than 115% year-over-year, finishing the year at more than $330 million in ending ARR. Source: earnings call transcript
———
$585M+ Our Next-Gen SIEM business grew over 75% year-over-year, delivering ending ARR of more than $585 million. Source: earnings call transcript
$600M+ Our next-gen SIEM business exceeded $600 million in ending ARR and has transformed CrowdStrike into the operating system of the AI SOC. Source: earnings call transcript
$695M+ NextGen SIEM ending ARR surpassed $695 million this quarter as both new and existing customers are standardizing on Falcon as the operating system of the SOC. Source: earnings call transcript
—
Gross retention rate
97% Gross retention in Q4 remained high at 97%, and our dollar-based net retention rate was 112%, reflecting the impact of customer commitment packages. Source: earnings call transcript
97% In Q1, where we met or exceeded our key metrics, highlights include: one, Q1 net new ARR of $194 million, double-digit millions ahead of our expectations; two, Q1 ending ARR surpassing $4.4 billion, maintaining our leadership as the only pure-play cybersecurity software company of this size; three, subscription gross margin of 80%, demonstrating our AI platform efficiency; four, sustained 97% gross retention as customers remain firmly committed to Falcon; five, free cash flow of $279 million or 25% of revenue, demonstrating double-digit quarter-on-quarter growth; and six, added $774 million of total Falcon Flex account value, bringing the total deal value of accounts that have adopted Falcon Flex to $3.2 billion, growing 31% sequentially and more than 6x year-over-year. Source: earnings call transcript
——
97% Six, dollar-based net retention of 115% and gross retention of 97%, showcasing best-in-class durability and stickiness, which leads to my final point. Source: earnings call transcript
———
Net revenue retention rate
112% Gross retention in Q4 remained high at 97%, and our dollar-based net retention rate was 112%, reflecting the impact of customer commitment packages. Source: earnings call transcript
———
115% Six, dollar-based net retention of 115% and gross retention of 97%, showcasing best-in-class durability and stickiness, which leads to my final point. Source: earnings call transcript
———
Annual recurring revenue (ARR) Falcon Flex———
$1.35B+ Across the entire CrowdStrike team, I'm extremely proud of our Q3 with highlights including: one, record Q3 net new ARR of $265 million, which grew 73% year-over-year, beating our expectations by more than 10%; two, ending ARR of $4.92 billion, which accelerated to 23% growth year-over-year; three, record Q3 free cash flow of $296 million or 24% of revenue; four, all-time record operating income of $265 million or 21% of revenue, this is the second consecutive quarter of record operating income; five, broad-based ending ARR acceleration across cloud, Next-Gen Identity and Next-Gen SIEM collectively as well as acceleration in our endpoint business; and six, more than $1.35 billion in ending ARR from accounts that have adopted the Falcon Flex subscription model, growing more than 200% year-over-year. Source: earnings call transcript
$1.69B Seven, we delivered $1.69 billion in ending ARR from accounts that have adopted the Falcon Flex subscription model, growing more than 120% year-over-year, turbocharging our land-and-expand motion. Source: earnings call transcript
$1.9B+ Five, record Q1 operating income of $326 million or 24% of revenue, up 62% year-over-year, exceeding guidance and six, we added over 300 Falcon Flex accounts in the quarter with accounts that have adopted the subscription model reaching more than $1.9 billion in ending ARR, growing 99% year-over-year. Source: earnings call transcript
$2.29B+ Seven, all-time record Falcon Flex quarter with ending ARR from accounts that have adopted the Falcon Flex subscription model surpassing $2.29 billion, accelerating to 101% year-over-year growth. Source: earnings call transcript
—
Annual recurring revenue (ARR) Next-Gen Identity, Cloud and Next-Gen SIEM————
$1.9B+ Collectively, our Next-Gen Identity, cloud and Next-Gen SIEM businesses grew more than 45% year-over-year reaching more than $1.9 billion in ending ARR. Source: earnings call transcript
$2B+ Combined, these businesses have now exceeded $2 billion in ending ARR. Source: earnings call transcript
$2.1B When you think about cloud, next-gen SIEM, next-gen identity, ending ARR was $2.1 billion, up 39% year-over-year. Source: earnings call transcript
—
Annual recurring revenue (ARR) Cloud————
$800M+ For the first time, our cloud business exceeded $800 million in ending ARR as our customers look to us to secure the infrastructure powering their AI future. Source: earnings call transcript
—
$905M+ Moving on to cloud, where ending ARR exceeded $905 million, growing more than 29% year-over-year. Source: earnings call transcript
—
Customers Reflex—————
480 The most exciting part is the Reflex dynamic, customers renewing and expanding their investment beyond their first Flex contract with highlights including the number of Reflex customers reached 480, representing nearly 25% of all Flex customers. Source: earnings call transcript
630+ We also saw a record reflex activity for existing Flex customers with more than 630 accounts having reflexed at least once up 6x year-over-year. Source: earnings call transcript
—

Operating figures the company stated on at least two of the calls shown, checked against each call's transcript. Click a figure to read the sentence. A dash means it was not stated that quarter.

Orderbook & backlog

Ending ARR (annual recurring revenue — sector forward-demand measure) $5.51B 2026-04-30 (end of Q1 FY27)

+24% YoY, accelerating over a record Q4

CrowdStrike discloses forward demand as ARR (not RPO/backlog); record Q1 net new ARR of $255.8M added (+32% YoY). Management also cited a separate AIDR Q2 pipeline >$50M. No RPO/cRPO/bookings figure was disclosed on this call.

Product announcements

ProductTypeDetails
AIDR (AI Detection and Response)launch
AgentWorkslaunch
Project QuiltWorksmilestone
Charlotte AIupdate

Deals & partnerships

SGNL acquisition (identity / policy-based authorization) part of $7.8M combined acquired net new ARR (with Seraphic)

SGNL delivers granular, policy-based authorization over agentic workloads in real time; used with AIDR as an identity control plane. Featured in a 7-figure Next-Gen Identity + SGNL expansion at a major American healthcare company.

Seraphic acquisition part of $7.8M combined acquired net new ARR (with SGNL)

Closed alongside SGNL in the first quarter.

Anthropic strategic partnership (Project Glasswing / new-model security)

CrowdStrike collaborated from the start on Anthropic's new model via Project Glasswing and was selected to secure it; Anthropic is also an AgentWorks partner. CrowdStrike says it is the only cybersecurity company selected by both Anthropic and OpenAI from the very start.

OpenAI strategic partnership (Trusted Access for Cyber founding member)

CrowdStrike named a founding member of OpenAI's Trusted Access for Cyber (TAC) program tied to GPT-5.5-Cyber ('Daybreak'); OpenAI is also a QuiltWorks and AgentWorks partner.

Project QuiltWorks coalition (Accenture, EY, IBM, Kroll, OpenAI, Armadin, Cognizant, HCL Tech, Infosys, KPMG, NTT Data, TCS, Wipro; insurers Coalition, Liberty Mutual, Lockton, Resilience, Marsh) industry coalition / go-to-market partnership

Coalition mobilized around Mythos readiness; insurers joined to underwrite frontier-AI-model risk.

AgentWorks partners (Accenture, AWS, Anthropic, Deloitte, NVIDIA, OpenAI, Salesforce) ecosystem / technology partnership

Partners building specialized security agents that operate natively on Falcon data within the AgentWorks ecosystem.

NVIDIA partnership (deepened; senior talent hire)

Dr. Bartley Richardson joined CrowdStrike as Chief AI and Autonomous Systems Officer from NVIDIA, where he led agentic AI and cybersecurity AI; management says this deepens the NVIDIA collaboration. NVIDIA is also an AgentWorks partner.

Risks & headwinds

Adversarial use of frontier AI models ('democratize destruction') Near-term and escalating (post-Mythos)

Unquantified — any human or agent can become a 'vibe hacker,' chaining multiple vulnerabilities into lethal cyber attacks threatening enterprise survival, nation-state continuity and critical infrastructure.

Mitigation:CrowdStrike Falcon/AIDR as the AI-powered defender; Project QuiltWorks continuous vulnerability discovery and remediation.

AI-security adoption gap — protection lags AI adoption Ongoing; early innings of enterprise AI adoption

Only a low-single-digit % of organizations have an advanced AI security strategy against a >$2.5T forecast AI market; adoption 'front runs' security.

Mitigation:Positioning Falcon/AIDR as the enablement layer that lets CISOs approve faster AI deployment; Flex commercial model.

Retention (NRR/NDR) not quantified Q1 FY27

Management cited 'strong gross and net retention rates' but disclosed no figure — non-disclosure is itself a watch item.

Mitigation:None specified; framed as a positive driver of the raised guide.

Guidance dependency on unconverted pipeline / size of raise vs Q1 beat FY27 (H2-weighted, 42%/58% seasonality)

FY net-new-ARR midpoint raised $52M (+520 bps) while Q1 net new ARR ($255.8M) was only modestly above the guided high end; confidence rests on a 'record Q2 pipeline.'

Mitigation:Management points to record pipeline, module adoption, retention and Mythos-driven demand; H2-weighted seasonality embedded in the guide.

Early-stage, still-competitive AI-security (AIDR/AgentWorks) market Near- to medium-term

AIDR went '0 to' a >250% QoQ ARR ramp in under two quarters, but many deals are still division/geography-level rather than enterprise-wide, and some capabilities are in preview mode.

Mitigation:Structural advantage from existing endpoint sensor real estate and EDR leadership; preview engagements with the largest customers.

Q&A highlights

Which AI-related tailwinds most directly prompted the meaningful raise to both Q2 and full-year net new ARR?

Burt Podbere cited AI tailwinds plus strong module adoption rates, strong gross and net retention rates, and a record Q2 pipeline, with the Mythos moment creating an ARR inflection — the combination giving confidence for both the Q2 and full-year guides.

“you combine all those things that gave us confidence for both the Q2 guide as well as the full year guide.”

asked by Meta Marshall · answered by Burt Podbere

4 min read 7 chapters

Detailed narrative

The 'Mythos' inflection point — cybersecurity reframed as AI infrastructure

Management's central thesis is that April brought a step-change ('the Mythos inflection moment') where frontier AI and cybersecurity collided. New model releases from Anthropic (Project Glasswing) and OpenAI (GPT-5.5-Cyber / 'Daybreak,' via the Trusted Access for Cyber program) accelerated vulnerability discovery and, per George Kurtz, made CrowdStrike the only cybersecurity company selected by both labs from the start.

Kurtz dated the demand inflection to RSA in late March, where 'every meeting was literally the same meeting all over — help us protect these AI workloads.' The framing shifted cybersecurity from a risk/compliance lens to a 'strategic accelerator' of AI adoption, with CrowdStrike positioning itself as 'the picks and shovels' for the AI gold rush.

AIDR — a new growth pillar management believes is larger than EDR

AIDR (AI Detection and Response) went 'from 0 to this in under 2 quarters,' with ending ARR growing more than 250% sequentially and a Q2 pipeline already exceeding $50M. Kurtz argues AIDR's TAM is structurally larger than EDR because EDR secured one attack surface (the host) while AIDR secures seven (data, models, prompts, agents, identities, infrastructure, and the interaction layer), and because there will be roughly 90 agents per employee (an industry stat).

The right-to-win claim rests on CrowdStrike's runtime sensor already sitting where AI executes. A named proof point: an automotive/financial-services leader added AIDR to 30,000+ hosts for shadow-AI visibility in a 7-figure win.

Next-gen SIEM, cloud and identity — the AI SOC build-out

The combination of next-gen SIEM, cloud and identity delivered a record Q1 net new ARR and now exceeds $2B in ending ARR combined. Next-gen SIEM alone surpassed $600M ending ARR and is positioned as 'the operating system of the AI SOC,' with Charlotte AI (ending ARR accelerating sequentially over Q4) as the reasoning engine.

The company launched AgentWorks, an ecosystem of purpose-built AI agents built on Falcon with partners including Accenture, AWS, Anthropic, Deloitte, NVIDIA, OpenAI and Salesforce. In identity, Falcon Shield ending ARR grew nearly 4x YoY and the newly acquired SGNL adds granular, policy-based authorization over agentic workloads.

Falcon Flex and the 'Reflex' expansion dynamic

Falcon Flex, the subscription go-to-market model, is 'rapidly approaching $2 billion in ending ARR,' with subscription-model accounts reaching more than $1.9B (+99% YoY) and 300+ Flex accounts added in the quarter. The standout is the 'Reflex' dynamic: 480 customers (nearly 25% of all Flex customers) have re-upped, with the average Reflex uplift of 26% occurring at an average of 7 months — well ahead of renewal.

Over 130 customers have reflexed multiple times, with average ARR uplift over their original Flex reaching 51%. Management frames Flex as 'the commercial harness to drive secure AI adoption,' able to fold in token/credit consumption pricing over time.

Financial performance, capital return and stock split

Total revenue reached $1.39B (+26% YoY), the fourth consecutive quarter of accelerating growth, with subscription revenue of $1.32B (+26%) and professional services of $64.8M (+23%). Non-GAAP gross margin hit a Q1-record 79% (subscription 81%, +90 bps YoY on cloud optimization), and record non-GAAP operating income of $325.7M produced a 24% margin (+530 bps YoY, +62% YoY).

Record free cash flow of $468.5M (34% of revenue) drove a FCF Rule of 40 of 59%. CrowdStrike repurchased $176M of shares at $365.63 (leaving ~$1.3B authorization) and announced its first-ever 4-for-1 stock split, effective around July 1-2, 2026.

Raised FY27 outlook and the visibility debate

For the first time, CrowdStrike guided full-year net-new-ARR growth to accelerate over the prior year, raising the FY27 net-new-ARR midpoint by $52M to $1.291B (+520 bps of growth). Ending ARR guidance rose to $6.532B-$6.556B and revenue to $5.915B-$5.959B. Management repeatedly grounded the raise in a 'record Q2 pipeline,' strong module adoption and retention.

Analysts (Michael Turrin, Josh Tilton) pressed on the gap between a Q1 net-new-ARR beat that was only modestly above the guide and the size of the full-year raise; management pointed to pipeline momentum and post-Mythos executive/board-level demand rather than pulled-forward or previously delayed spend.

Project QuiltWorks and ecosystem mobilization

In response to Mythos, CrowdStrike launched Project QuiltWorks — a phased process of vulnerability discovery, prioritization, remediation and executive communication — and rapidly assembled a coalition. Launch partners Accenture, EY, IBM, Kroll and OpenAI were joined weeks later by Armadin, Cognizant, HCL Tech, Infosys, KPMG, NTT Data, TCS and Wipro, plus insurers Coalition, Liberty Mutual, Lockton, Resilience and Marsh underwriting frontier-model risk.

One EY engagement with a Fortune 100 account uncovered more than 45 million vulnerabilities using Falcon Exposure Management and frontier models, also pulling in next-gen SIEM. Continuous exposure management and Falcon for IT adoption nearly doubled YoY.

Summary of the company's earnings call; see how call summaries are prepared. Not investment advice.