Detailed Narrative
The 'Mythos' inflection point — cybersecurity reframed as AI infrastructure
Management's central thesis is that April brought a step-change ('the Mythos inflection moment') where frontier AI and cybersecurity collided. New model releases from Anthropic (Project Glasswing) and OpenAI (GPT-5.5-Cyber / 'Daybreak,' via the Trusted Access for Cyber program) accelerated vulnerability discovery and, per George Kurtz, made CrowdStrike the only cybersecurity company selected by both labs from the start. Kurtz dated the demand inflection to RSA in late March, where 'every meeting was literally the same meeting all over — help us protect these AI workloads.' The framing shifted cybersecurity from a risk/compliance lens to a 'strategic accelerator' of AI adoption, with CrowdStrike positioning itself as 'the picks and shovels' for the AI gold rush.
AIDR — a new growth pillar management believes is larger than EDR
AIDR (AI Detection and Response) went 'from 0 to this in under 2 quarters,' with ending ARR growing more than 250% sequentially and a Q2 pipeline already exceeding $50M. Kurtz argues AIDR's TAM is structurally larger than EDR because EDR secured one attack surface (the host) while AIDR secures seven (data, models, prompts, agents, identities, infrastructure, and the interaction layer), and because there will be roughly 90 agents per employee (an industry stat). The right-to-win claim rests on CrowdStrike's runtime sensor already sitting where AI executes. A named proof point: an automotive/financial-services leader added AIDR to 30,000+ hosts for shadow-AI visibility in a 7-figure win.
Next-gen SIEM, cloud and identity — the AI SOC build-out
The combination of next-gen SIEM, cloud and identity delivered a record Q1 net new ARR and now exceeds $2B in ending ARR combined. Next-gen SIEM alone surpassed $600M ending ARR and is positioned as 'the operating system of the AI SOC,' with Charlotte AI (ending ARR accelerating sequentially over Q4) as the reasoning engine. The company launched AgentWorks, an ecosystem of purpose-built AI agents built on Falcon with partners including Accenture, AWS, Anthropic, Deloitte, NVIDIA, OpenAI and Salesforce. In identity, Falcon Shield ending ARR grew nearly 4x YoY and the newly acquired SGNL adds granular, policy-based authorization over agentic workloads.
Falcon Flex and the 'Reflex' expansion dynamic
Falcon Flex, the subscription go-to-market model, is 'rapidly approaching $2 billion in ending ARR,' with subscription-model accounts reaching more than $1.9B (+99% YoY) and 300+ Flex accounts added in the quarter. The standout is the 'Reflex' dynamic: 480 customers (nearly 25% of all Flex customers) have re-upped, with the average Reflex uplift of 26% occurring at an average of 7 months — well ahead of renewal. Over 130 customers have reflexed multiple times, with average ARR uplift over their original Flex reaching 51%. Management frames Flex as 'the commercial harness to drive secure AI adoption,' able to fold in token/credit consumption pricing over time⏳.
Financial performance, capital return and stock split
Total revenue reached $1.39B (+26% YoY), the fourth consecutive quarter of accelerating growth, with subscription revenue of $1.32B (+26%) and professional services of $64.8M (+23%). Non-GAAP gross margin hit a Q1-record 79% (subscription 81%, +90 bps YoY on cloud optimization), and record non-GAAP operating income of $325.7M produced a 24% margin (+530 bps YoY, +62% YoY). Record free cash flow of $468.5M (34% of revenue) drove a FCF Rule of 40 of 59%. CrowdStrike repurchased $176M of shares at $365.63 (leaving ~$1.3B authorization) and announced its first-ever 4-for-1 stock split, effective around July 1-2, 2026.
Raised FY27 outlook and the visibility debate
For the first time, CrowdStrike guided full-year net-new-ARR growth to accelerate over the prior year, raising the FY27 net-new-ARR midpoint by $52M to $1.291B (+520 bps of growth). Ending ARR guidance rose to $6.532B-$6.556B and revenue to $5.915B-$5.959B. Management repeatedly grounded the raise in a 'record Q2 pipeline,' strong module adoption and retention. Analysts (Michael Turrin, Josh Tilton) pressed on the gap between a Q1 net-new-ARR beat that was only modestly above the guide and the size of the full-year raise; management pointed to pipeline momentum and post-Mythos executive/board-level demand rather than pulled-forward📎 or previously delayed spend.
Project QuiltWorks and ecosystem mobilization
In response to Mythos, CrowdStrike launched Project QuiltWorks — a phased process of vulnerability discovery, prioritization, remediation and executive communication — and rapidly assembled a coalition. Launch partners Accenture, EY, IBM, Kroll and OpenAI were joined weeks later by Armadin, Cognizant, HCL Tech, Infosys, KPMG, NTT Data, TCS and Wipro, plus insurers Coalition, Liberty Mutual, Lockton, Resilience and Marsh underwriting frontier-model risk. One EY engagement with a Fortune 100 account uncovered more than 45 million vulnerabilities using Falcon Exposure Management and frontier models, also pulling in next-gen SIEM. Continuous exposure management and Falcon for IT adoption nearly doubled YoY.