CRWD

CrowdStrike sells the Falcon cybersecurity platform — a cloud-native, AI-centered endpoint/security operations platform built around a single lightweight sensor that collects data once and reuses it across endpoint, cloud workload, identity, SIEM/logging, and AI-security workflows.

• FY2026 revenue: $4,812M
• FY2026 gross profit: $3,593M
• FY2026 gross margin: 74.7%
• FY2026 operating loss: -$293M
• FY2026 net loss: -$163M
• FY2026 operating cash flow: $1,612M
• FY2026 CapEx: $302M
• FY2026 implied FCF: ~$1,310M
• Q1 FY2027 revenue: $1.39B
• Q1 FY2027 ARR: $5.51B
• Q1 FY2027 net new ARR: $255.8M
• Q1 FY2027 subscription gross margin: 78% GAAP / 81% non-GAAP

Q1 Bypass: PARTIAL (2) — not upgraded. Guardian/Agentic IdP raise the cost of bypass for AI-agent estates (runtime endpoint + cryptographic agent identity + SIEM-native retention). Substitutes still exist: Microsoft Defender / Copilot security, SentinelOne, PANW, plus model-lab native controls (OpenAI/Anthropic). A new category (AIDR) with a GA SKU is not “no viable substitute.”

Q2 Concentration: PARTIAL (2) — unchanged. Endpoint share still fragmented; AIDR has no disclosed share. 74.6% GAAP GM clears the 65% pricing-power bar, Flex 39% of ARR is wallet-share evidence, but not a ≥30% monopoly.

Q3 Hyperscaler: PARTIAL (2) — unchanged, and this is the live risk. Microsoft will bundle agent security into E5/Copilot. OpenAI is now a partner (Codex runtime on Guardian) which hedges one lab and concentrates another: if OpenAI ships first-party agent security, the partnership is a distribution deal, not a moat. NVIDIA/CoreWeave are infra partners, not demand locks.

Cheat-sheet check: DT Zero Trust / endpoint leaders land ~5–6; 6 is on the published range, not a stretch.

• technical_scarcity: 9/10 (unchanged) — 7T events/day telemetry + single-sensor runtime for AI agents + SafeMind trained on Falcon Complete annotations is still the hardest corpus in the category to copy. Not 10: Microsoft/S1/PANW exist, QuiltWorks will license the models out, and OpenAI can internalize Codex runtime security.
• economic_capture: 8/10 (unchanged) — Flex 39% of ARR + $29B whitespace (4.97×) + identity/SIEM 22% of ARR are real capture. Caps: SafeMind tokens not in FY27, GAAP NI 0.36% and sequentially down, capex stepping to 11–12%.
• time_to_monetize: 8/10 (unchanged) — Guardian is GA as a Flex entitlement now (attach = PO, not a new agent). SafeMind / token packs are FY28. The 6–24 month window is Flex/Guardian attach + FY28 NNARR ≥20% guide, not model-token P&L.

Hypothesis verdict: STRENGTHENED. Fal.Con converts the thesis from “endpoint telemetry + Flex flywheel” into “runtime control plane for AI agents on the already-deployed sensor,” with named lab/silicon partners (OpenAI, NVIDIA) and a pulled-forward $10B/$20B path whose required CAGR (16%) is below the current +25% ARR run-rate. The 08-29 Q2 print already cleared the four earnings falsifiers; this catalyst adds a new module-attach surface. Residual disconfirmers (no 8-K, SafeMind not in FY27, sequential GAAP NI down, 1.8× capex step-up, Microsoft agent-security bundle) keep the toll-road at STRONG PROXY and cap economic_capture at 8.

• monetization model: Subscription/SaaS; Falcon platform modules sold as term subscriptions, plus professional services (10-K FY2025 Item 1 Business; 10-Q Q1 FY2026 Revenue Note, sec.gov , Acc. No. 0001535527-25-000014; sec.gov , Acc. No. 0001535527-25-000039).
• revenue mix: One reportable segment; subscription ~95% of revenue, professional services ~5% (10-K FY2025 segment/revenue note; 10-Q Q1 FY2026 revenue note).
• who pays: CISO/security operations budgets; also CIO/IT, cloud, identity, and compliance teams (10-K FY2025 Item 1 Business).
• margin_value_capture: Subscription gross margin ~80%; total gross margin ~75%; GAAP operating margin low, non-GAAP materially higher (10-K FY2025 MD&A; 10-Q Q1 FY2026 MD&A).

• customer classes: CISOs & Security Operations, Compliance & GRC Officers, Identity & Access Management Buyers, Platform & Developer Teams (10-K FY2025 Item 1 Business).

CrowdStrike operates as a single reportable segment for SEC purposes. Its revenue is disaggregated into two line items: subscription revenue and professional services revenue.

For fiscal year 2024, ended January 31, 2024, the FY2024 Form 10-K reports:

CrowdStrike monetizes through multi-year subscription contracts for its Falcon platform. The FY2024 10-K states that its subscriptions are generally one to three years in length and are generally billed annually in advance. Revenue is recognized ratably over the subscription term. Professional services are typically sold on a time-and-materials or fixed-fee basis.

The FY2024 10-K reports over 29,000 subscription customers as of January 31, 2024. The filing describes customers across industries and organization sizes, including enterprises, mid-market organizations, government entities, and managed security service providers. The company sells through both direct sales and channel partners.

CrowdStrike is a software-as-a-service/subscription cybersecurity business built around its Falcon platform. The company sells cloud-delivered endpoint security, workload security, identity protection, managed threat hunting, exposure management, and SIEM/log management in modular subscriptions. It also sells professional services, including incident response, activation, and training.

The most recent full-year primary source I can specify is CrowdStrike’s Form 10-K for fiscal year ended January 31, 2024, filed with the SEC on March 7, 2024. The revenue split below is reproduced from that filing; any mismatch must be checked against the live EDGAR retrieval.

From the FY2024 10-K, CrowdStrike sells to:

• Large enterprises with complex security infrastructures.
• Mid-market organizations that need enterprise-grade security without building a large SOC.
• Small businesses increasingly via Falcon Go and managed services.
• Government entities — federal, state, local, and education.
• MSSPs / partners that manage Falcon on behalf of end customers.

The primary buyer archetypes are:

• CISO / security leadership — owns security budget, compliance, and breach risk.
• SOC director/manager — owns detection and response workflows.
• Security architect/platform owner — integrates endpoint, cloud, identity, and SIEM.
• IT risk/compliance officer — buys for regulations and audit readiness.
• Incident response / threat hunting teams — buy OverWatch/Complete managed threat hunting.

The filings do not name individual Buyer titles; the archetypes above are inference from product modules and the security procurement model. The source-bound anchor is that the company’s revenue is almost entirely subscription, implying recurring security-operations budget rather than one-time hardware/software.

As of January 31, 2024, CrowdStrike reported approximately 29,000 subscription customers. This is from the FY2024 10-K; exact number is needs primary source validation. The filing further states that no customer accounted for more than 10% of revenue. This means customer concentration risk is low and the installed base is broad, but each individual customer is small relative to revenue.

FY2026 (ended 2026-01-31): revenue $4,812M, gross profit $3,593M (74.7% gross margin), operating loss -$293M, net loss -$163M, operating cash flow $1,612M, CapEx $302M, implied free cash flow ~$1,310M. Q1 FY2027 (ended 2026-04-30): revenue $1.39B, ARR $5.51B, net new ARR $255.8M, subscription gross margin 78% GAAP / 81% non-GAAP.

CRWD owns the endpoint telemetry moat. The 10-K says Falcon’s single sensor ingests data from endpoints, cloud workloads, identities, and third-party sources; that data is then reused across multiple security functions and fed into Threat Graph, which correlates trillions of cybersecurity events. The result is a platform that gets harder to displace as more modules and more telemetry are layered in.

• Falcon’s Threat Graph correlates and analyzes trillions of cybersecurity events, while the platform’s single sensor ingests data once and reuses it across modules (FY2026 10-K).
• Q1 FY2027 revenue was $1.39B and ARR reached $5.51B, up 24% YoY; net new ARR was $255.8M, up 32% YoY (2026-06-03 EX-99.1 earnings release).
• Management raised FY2027 net new ARR growth guidance to a 27.7% midpoint and guided Q2 FY27 revenue to $1.436B-$1.442B; FY27 ARR guidance was $6.532B-$6.556B (2026-06-03 EX-99.1).
• Subscription gross margin held at 78% GAAP / 81% non-GAAP in Q1 FY2027, supporting strong incremental economics (2026-06-03 EX-99.1).
• FY2026 operating cash flow of $1,612M versus GAAP net loss of -$163M shows the business is cash-generative despite stock-based compensation noise (FY2026 10-K / companyfacts).

• Derived switching-cost model: if a 50K-endpoint enterprise pays roughly $2.5M/year for endpoint/security coverage, then a $3M-$5M migration cost equals 120%-200% of annual contract value. That is a high enough friction band that most buyers only switch after a major breach, vendor failure, or broad standardization change.
• Telemetry catch-up gap: even if a challenger managed to process 100M relevant events/day, catching up to a corpus that the company describes as trillions of events in aggregate would still take many quarters to years depending on quality equivalence. The barrier is not just event count; it is labeled context and behavioral history.

• CrowdStrike's official X commentary cited Flex ARR approaching $2B at +99% YoY, with 480 customers having re-flexed and 130+ doing so multiple times, producing an average 51% ARR uplift from the initial Flex deal.
• X-sourced earnings watchposts put Q2 FY2027 earnings on Aug. 27, 2026; that remains the next hard catalyst after the Q1 FY2027 print that took ARR to $5.51B and net new ARR to $256M.
• Analyst/operator synthesis on X continues to frame Microsoft Defender bundling as a persistent but not existential pressure: it is strongest in low-complexity, Microsoft-heavy estates, while CrowdStrike retains the edge in high-intensity threat hunting, multi-cloud visibility, and platform depth.

• Refined switching-cost model: $3.2M-$7.5M per large enterprise, or roughly 120%-300% of one year's Falcon spend for a typical $2.5M/year deployment.
• That places the customer replacement problem in the "parallel-run plus retraining" range where buyers usually need a breach, a forced standardization event, or a major platform failure before switching.

The "moat" is the endpoint telemetry corpus + Flex platform lock-in. What does it cost CRWD each year to sustain and defend it?

• Cost of the moat = R&D + SBC = $1,384.77M + $1,096.68M = $2,481.4M (FY2026).
• That is 51.6% of revenue — i.e., more than half of every revenue dollar is reinvested in either building the platform (R&D) or paying for the engineering/talent that maintains it (SBC).
• As a share of the surplus it defends: $2,481.4M / $3,593.1M gross profit = 69.1% — for every $1.00 of gross profit, CRWD spends ~$0.69 on R&D + SBC to hold the endpoint/telemetry position.
• As a share of the contracted base it protects: $2,481.4M / $5,510M ARR = 45.0%.

Calc 1 — White-space multiple (installed-base expansion capacity).

• Briefing: white space inside the existing customer base $29B in Q2 FY27, up from $21B a year earlier.
• Filed ARR (08-26 EX-99.1 / 08-29 block): $5.84B.
• $29B ÷ $5.84B = 4.97× current ARR of expansion capacity already sitting in the book — and the reservoir grew +38% YoY ($21B → $29B) even as ARR compounded +25%.
• Read: the binding constraint on CRWD’s next decade is not TAM awareness. It is attach-rate of new modules (Guardian / Agentic IdP / token packs) onto an already-deployed sensor. A 4.97× whitespace multiple is the dollar form of “the shovel is already in the mine.”

Calc 2 — Pulled-forward $10B / $20B path vs required CAGR.

• Briefing: $10B ARR inside FY2030 and $20B inside FY2035, each one year earlier; “about 30% of the way to $20B.”
• Filed ARR $5.84B ÷ $20B = 29.2% — the 30% claim restates the Q2 number, it does not add a new one.
• Required CAGR: $5.84B → $10B in ~3.5 years = 16.6%; $5.84B → $20B in ~8.5 years = 15.6%.
• Current ARR growth is +25% YoY. The pulled-forward path is not a heroic re-acceleration versus the run-rate; it is management claiming the +25% does not mean-revert as hard as the Street’s FY28 NNARR models (Rosenblatt: Street 11–12% NNARR growth vs company FY28 NNARR ≥ $1.626B = ≥20% vs FY27 midpoint $1.355B).
• Disconfirming math: holding +16% CAGR for 8.5 years is still a long-duration execution claim. Capex guided to 11–12% of revenue next year (AI infra) vs FY2026 CapEx $302M / $4.812B = 6.3% — a ~1.8× capital-intensity step-up that can cut the FCF-margin path (briefing target 34–38% by FY2029) if GPU spend outruns token/Guardian attach.

Calc 3 — Cost of the moat vs the moat it defends (R&D + SafeMind unit economics).

• Q2 FY27 10-Q XBRL: R&D $444.2M on derived revenue $1.4709B (GrossProfit $1.0969B + COGS $374.0M) = 30.2% of revenue. H1 R&D $852.5M annualized $1.705B = 29.2% of $5.84B ARR.
• Briefing: “R&D investment over $1 billion” + SafeMind trained on 7 trillion security events/day. The $1B line is lower than the XBRL run-rate; use ~$1.7B / yr as the filed cost of defending the telemetry corpus.
• SafeMind unit claim (Bartley Richardson, briefing): detection/remediation cost $10 → $0.03 = 333× / 99%. IR PR: 29% higher detection rate, 6× faster end-to-end remediation, 99% cost savings vs frontier models.
• Capture test: even if CrowdStrike prices a detection at 10× its $0.03 cost ($0.30), that is a 97% discount to the $10 frontier-model bill the customer used to pay — i.e. they can under-price generic models and still print software GM. The catch: token packs are contemplated for FY2028, not in the FY27 guide. Until a filed ARR line exists, this is a cost-structure option, not economic capture.

Calc 4 — Module mix that the agentic stack actually rides.

• Briefing: next-gen identity ARR $585M (target $1.7B by 2034 = 2.9×); Next-Gen SIEM ARR ~$700M, +60% YoY (target $1.8B by 2034 = 2.6×). Combined $1.285B = 22% of $5.84B ARR.
• Flex ARR $2.29B = 39.2% of ending ARR; 935 new Flex opportunities in Q2; non-Flex→Flex ending-ARR uplift 34% → 40%.
• Kurtz: AIDR uptake 79× in 3 months vs EDR’s 10× in 3 quarters at launch. This is a management velocity claim with no denominator in a filing — treat as directional. The durable number is that Guardian is a Flex entitlement on an already-deployed sensor, so attach cost to the customer is a purchase order, not a rip-and-replace.

Calc 5 — GAAP profitability is thinner than the 08-29 block advertised.

• Q2 10-Q XBRL: GAAP GM 74.57% ($1.0969B / $1.4709B); GAAP operating loss −$33.2M (−2.3%); GAAP NI +$5.3M (0.36%).
• Q1 10-Q XBRL GAAP NI +$27.8M. Sequential GAAP NI −$22.5M. The “expensive moat” is directionally healing (two GAAP-positive quarters) but not compounding yet. SBC + AI-infra capex are the residual tax.

$872.3 million ÷ $1,331.5 million = 0.65