CrowdStrike Holdings, Inc. (CRWD) Q2 2027 Earnings Call Transcript

Hello and welcome to CrowdStrike's Fiscal Second Quarter 2027 Financial Results Conference Call. At this time, all participants are in a listen-only mode. After the speaker's presentation, we will conduct a question-and-answer session. Please be advised that today's conference is being recorded. I would now like to hand the call over to Andy Nowinski, Vice President of Investor Relations and Strategic Finance. Andy, please go ahead.

Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, Chief Executive Officer and Founder of CrowdStrike, and Burt Podbear, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth, including projections, and expected performance, including our outlook for the third quarter and fiscal year 2027, and any assumptions for fiscal periods beyond that, are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events, or otherwise. Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the Company's Annual and Quarterly Reports. Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings release, which may be found on our investor relations website at ir.crowdstrike.com or on our Form 8K filed with the SEC today. With that, I will now turn the call over to George.

Thank you, Andy, and thank you for joining CrowdStrike's Q2 FY27 earnings call. When we last spoke, we were just weeks after what we called the mythos moment, an inflection point in cybersecurity. The world came to understand that cybersecurity is a necessity for AI adoption. New models created a new risk environment with no turning back. Recently, this realization became even clearer with the market's newest adversary, AI agents themselves. We told you this was the future, and this future is now a reality. Our previous guidance foreshadowed this conviction, and CrowdStrike's Q2 was our very best quarter in company history. Inflection has become acceleration. Our Q2 results set a new bar. Here's what we delivered. One, all-time record net new ARR of $333 million, accelerating to 51% year-over-year growth and beating the high end of our guidance by more than 45 million dollars two ending ARR growth accelerated for the fourth consecutive quarter reaching 5.84 billion dollars up more than 25 percent year over year three total revenue growth accelerated for the fifth consecutive quarter, reaching $1.47 billion, up 26% year-over-year. Four, Q2 record free cash flow of $377 million, or 26% of revenue, growing 33% year-over-year. Five, all-time record operating income of $372 million, or 25% of revenue, growing 46% year-over-year. 6. All-time record net new ARR from new logos, while both net and gross dollar-based retention improved over the prior quarter. 7. All-time record FalconFlex quarter with ending ARR from accounts that have adopted the FalconFlex subscription model, surpassing $2.29 billion, accelerating to 101% year-over-year growth. An 8 FY27 net new ARR guidance increase of 630 basis points. We now expect year-over-year growth of 34% at the midpoint, a 1,150 basis point increase from our initial outlook. The quarter was a sea change for CrowdStrike and I see these dynamics continuing. We're in an arms race. AI is driving more cyber attacks. AI is driving more cyber spending. AI is driving a clear divide between the cybersecurity companies that solve problems and those that compound problems. CrowdStrike's quarter demonstrates the market trusting us more than ever to secure their adoption of AI with cybersecurity's single platform of choice. The world's adoption of AI is rapidly expanding the attack surface. More models, more agents, more agentic applications, more data, and with that, more identities, more permissions, more policies, more cyber attacks, and more risk. Agent proliferation is becoming mainstream to augment work and personal life. Agents are powerful forces for productivity and good. Agents are also human and machine risk multipliers with access to data, continuous operational capability, and limited judgment. We're seeing agents go rogue, swarming to attack and moving beyond their guardrails to autonomously harm. Agents are proving capable of data theft, permission alteration, and full-on command and control at scale, leading to organizational compromise. The agent of today is both a friend and foe. The currency of protection is increasingly presence and speed. Do you have the right technology deployed that can see, prevent, and stop agentic attacks? Do you have the right technology that can outpace an entirely new real-time adversary? The AI threat environment is shining a clear light on which products work and which don't. We see failing products as open doors for agentic adversaries. At CrowdStrike, we don't just stop these breaches. We and our partners help the world recover from them. In this threat landscape, CrowdStrike stands out. Our market-leading cybersecurity services are in high demand. The flywheel we've created of best-in-class incident response services, allotted by law firms and insurance brokers, translates into best-in-class product outcomes for new customers. Ever since Mythos, we've seen growth in our business, not measured by meetings or calls, but measured by ARR, and we don't see the threat landscape subsiding. Far from it. Demand for AI grows our TAM, driving the need for CrowdStrike. The AI transformation doesn't just necessitate a technological lift and shift. It's necessitating a fundamentally new go-to-market motion, one based on maximizing time to value, ecosystem impact, and ROI. The Falcon platform removes friction from cybersecurity and the go to market motion we created with Falcon Flex does the same. Flex is the commercial harness to enable customer success in the agentic era. This quarter we kicked Falcon Flex activity into high gear with our flex first go to market strategy. Our top 10 deals by deal value were each flexes and the results speak for themselves. This quarter, we delivered record flex deal volume adding more than 935 flex accounts. That's more than 10 flexes every day of the quarter and more flexes than the last three quarters combined. When Falcon customers convert from standard subscriptions to flex, we see a greater than 40% average ending ARR uplift. We're not just focused on converting existing customers to Flex, we used Flex from the start with New Logo customers. Flex New Logo ARR contributed 34% of Q2 NetNew ARR, a record. We also saw record reflex activity for existing Flex customers, with more than 630 accounts having reflexed at least once, up 6x year over year. On average, a customer's first Reflex happens in eight months from their initial Flex. Lastly, we saw record repeat Reflex customers with average ending ARR uplift of 53% from their initial Flex subscription. Falcon Flex wins include a frontier lab that significantly grew with CrowdStrike in an eight-figure ARR deal, using Flex to maintain cost visibility while significantly growing Falcon Cloud security across its rapidly expanding data center infrastructure. A European automotive manufacturer called upon CrowdStrike to replace a next-gen EDR, a legacy SIM, and a legacy vulnerability management product. Landing with an eight-figure net new Falcon Flex, CrowdStrike delivered superior outcomes and immediate platform consolidation. Our Falcon Flex go-to-market motion unlocks the complete aperture of the Falcon platform. When looking at our Q2 performance, I'm pleased to see strength across so many different product areas. Increasingly, the epicenter of agentic work securing the endpoint is now a top spend priority. CrowdStrike is the leader in endpoint. We're now capitalizing on our ubiquitous endpoint presence to deliver the future of AI security. In Q2, our endpoint business accelerated for the fourth consecutive quarter as customers look to secure their growing AI attack surface. We're seeing dramatic expansion in agentic work on the endpoint, both through fast-growing tools such as Codex and Claude, as well as custom agentic applications. In sampling our customer base, we've seen more than 400% growth in cloud usage and more than 100% growth in custom agent usage on endpoints in recent months. As enterprises look to deploy these new technologies, they're also seeking ways to contain the new risk created, ranging from code exploitation to data leakage to identity compromise. Instead of turning to science projects or point products, the market is trusting CrowdStrike as critical infrastructure to both enable and safeguard their AI future. A large financial services firm worked with two of our GSI partners to replace a next-gen EDR in an eight-figure flex win. Across more than 100 entities and hundreds of thousands of endpoints, CrowdStrike was selected for the best detection coverage, deployment ease, and the lightest impact. Our endpoint success fuels the adoption of AIDR, a product surging past our expectations. AIDR ending ARR nearly tripled versus Q1 as customers embrace our frictionless approach to AI visibility and security. One of the world's largest banks adopted AIDR in an eight-figure FlexWin. Immediate AI deployments necessitated security, visibility, and control. We were selected for AI usage visibility and data exfiltration prevention. Demand, adoption, and growth like this is rarely seen. I can't wait to unveil our newest AI security innovations at next week's Falcon Conference. Moving to our cloud, identity, and next-gen SIM businesses, the market is rapidly embracing these products to protect fast-expanding attack surfaces. We delivered record Q2 net new ARR from the combination of these businesses. Unpacking these results, our next-gen SIM business delivered another banner quarter driven by record Q2 net new ARR. Next-Gen Sim ending ARR surpassed $695 million this quarter as both new and existing customers are standardizing on Falcon as the operating system of the SOC. Our native first-party data advantage coupled with the speed and efficiency of our platform continue to set us apart. Features like AgentWorks enable security teams to build, deploy, and manage custom AI security agents, setting the foundation for the AI SOC. In an eight-figure FalconFlex win, a major American power provider replaced a legacy-acquired SIM, selecting next-gen SIM over a firewall-first product for technical, speed, and economic superiority. Turning to our identity business, Ending ARR grew 34% year-over-year to more than $585 million, driven by strength across our identity product portfolio. Specifically, Falcon Shield had another strong quarter as enterprises looked to secure their third-party agentic applications. Shield ending ARR grew more than 185% year-over-year in Q2. In addition, our privileged account security offering saw stellar adoption, with ending ARR growing more than 35x year-over-year. Rounding out our identity portfolio, we're seeing early success with Signal. Large enterprises are rethinking decades of legacy access controls, no longer effective for the agentic era. Instead, they're embracing Signal's real-time, granular access model for both humans and non-human alike. In one customer alone, Signal brokered more than 30 million unique access decisions without friction. A major global financial firm added NextGen Identity to their Falcon deployment following a board-mandated AI security audit. Hand-in-hand with next-gen identity was an immediate deployment of AIDR, where identity protection enabled AI adoption. Moving on to cloud, where ending ARR exceeded $905 million, growing more than 29% year-over-year. CrowdStrike is the leader in cloud runtime security, which has become an imperative in protecting modern AI workloads. Our customers tell us that point-in-time posture scans are no longer enough to protect against fast-moving threats that now proliferate in seconds. A mega-technology conglomerate opted to use Falcon Cloud Security for our runtime superiority in an eight-figure ARR win. CrowdStrike now secures this organization's AI cloud and labs because of our build pipeline integration and compatibility with internal tools resonating with their DevOps teams. Finally, we're seeing the mythos moment transform the market's need for exposure management, pressuring antiquated vulnerability management products built for a bygone era. The agentic adversary has broken the exploit sound barrier, and you simply cannot patch vulnerabilities fast enough. As the patch window collapsed, our exposure management business accelerated sequentially in Q2. Falcon Exposure Management offers real-time detection and continuous prioritization to successfully contain a new speed and scale of vulnerability risk. A representative exposure management win included a global religious organization that replaced a legacy vulnerability management product as part of their AI transformation initiatives. In this seven-figure flex, the account also immediately deployed AIDR to bring visibility and control to its AI usage, showcasing CrowdStrike's position to protect against AI threats and govern AI adoption. Our partner ecosystem is mobilized around Falcon and its role in securing AI. Project Quilt Works has united more than 25 of our partners, from GSIs to hyperscalers, resellers to ISVs and even distributors and MSPs. To date, our Quilt Work partners are collaborating with us on nearly $400 million of total contract value pipeline. We've seen exceptional engagement from GSI partners, resulting in our GSI business growing nearly 50% year-over-year, largely focused on next-gen SIM transformations and vulnerability management needs. Across our MSSP business, we're seeing significant traction in the SMB space with key partners such as Kroll. Three quarters ago, Kroll took a strategic step to migrate all of its customers off of competing next-gen endpoint technology. A majority of customers already successfully migrated to Falcon across 450,000 endpoints. Tracking ahead of plan, Kroll took a major next step with a multi-year flex subscription growing their spend with CrowdStrike by more than three times. This flex addresses platform consolidation and sim transformation across Kroll's existing Falcon install base and incoming new customers. In another Q2 win, Accenture standardized on CrowdStrike for its new SMB-focused Accenture Edge business launched in June. Lastly, Q2 showcased the power of our one-of-a-kind cloud marketplace go-to-market motion. Across AWS, Google, and Microsoft, each of our hyperscaler marketplace partners, we saw a record Q2 as customers used their hyperscaler of choice for security investments. In Q2 alone, we transacted more than $600 million in deal value through cloud marketplaces, representing more than 30% year-over-year growth. We quickly saw traction with our Microsoft Marketplace presence, opening a new addressable market. Immediate Microsoft Marketplace wins included a new logo Australian healthcare provider started using CrowdStrike for SOC transformation in a seven-figure flex. An American manufacturing firm previously used our services and has now expanded to the Falcon platform through a seven-figure flex on Microsoft Marketplace. In closing, Q2 was an incredible quarter where the mythos moment turned into acceleration. Acceleration in net new ARR, acceleration in ending ARR, acceleration in Falcon Flex, acceleration in our ecosystem, acceleration in innovation. We're seeing endpoint as the epicenter for AI adoption. We're seeing AIDR define a new cybersecurity category. We're seeing NextGenSim as the operating system of cybersecurity, Falcon Identity becoming the security front door for human and non-human users, and Exposure Management as mission critical for prioritizing AI risk. Taken together, the Falcon platform is cybersecurity's infrastructure layer for AI adoption. AI adoption is accelerating from frontier labs and open-weight models alike. and we're still in the early innings of the AI revolution. When I look at our business, here's what this acceleration means. Last quarter, we raised our forward net new ARR growth guidance by 520 basis points. And this quarter, we're raising our FY27 year-over-year net new ARR growth outlook by an additional 630 basis points, even more than last quarter. That's a raise to our net new ARR guidance of more than $100 million since the start of the year. Delivery of a quarter like this and this outlook is fueled by the demand environment in our technology team, ecosystem, and customers. The innovation engine is in overdrive. As I shared last quarter, Dr. Bartley Richardson, previously at NVIDIA, has joined us as our Chief AI Autonomous System Officer as part of our long-planned and mutually agreed-upon CTO leadership transition. I can't wait to share the vision and innovation that we are bringing to the world's adoption of AI at Falcon in Las Vegas next week. The conference sold out in early August, and it's our largest pipeline generation event of the year. We'll have record customer and partner attendance. I also encourage everyone to tune into our investor briefing on Wednesday, September 2nd. Our role in securing enterprises, governments, and economies is vital to AI adoption and mission critical in an AI-first world. I'll now turn the call over to Burt Podbear, CrowdStrike's CFO.

Thank you, George, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers except revenue mentioned during my remarks today are non-GAAP. Additionally, all earnings per share and share amounts presented today and in our accompanying investor materials have been adjusted to reflect our recent four-for-one stock split for all periods presented. We delivered a record second quarter, exceeding expectations across all guided metrics. We achieved an all-time record $333 million of net new ARR well ahead of our guidance and accelerating to 51% growth year-over-year. Ending ARR reached $5.84 billion, up more than 25% over the prior year as growth accelerated for the fourth consecutive quarter. As George discussed, the post-Methos demand environment continued to strengthen in Q2. The customer urgency we began to see in Q1 translated into increased cybersecurity investment, accelerated modernization, and stronger demand for the Falcon platform. Our exceptional Q2 performance was broad-based across customer sizes and geographies. Net new ARR contribution from new logos was an all-time record, and both our dollar-based net and gross retention rates improved sequentially. Platform adoption also continued to deepen, with 51%, 35%, and 26% of subscription customers adopting 6, 7, and 8 or more modules respectively. Falcon Flex continues to be a key driver of our platform consolidation, with this quarter showcasing the power of our Flex First strategy. In Q2, customers converting from standard subscriptions to Flex delivered an average ending ARR uplift of more than 40%. From that new baseline, customers completing their first reflex this quarter generated an additional average ending ARR expansion of 25%. Looking at the cumulative uplift of customers who have reflexed at least twice, In Q2, these customers had average ending ARR 53% higher than their initial flex starting point, increasing for the second consecutive quarter. Taken together, these results underscore exceptional execution and the power of our platform strategy with AI-driven demand accelerating platform consolidation and helping deliver the strongest quarter in CrowdStrike's history. We also exited the quarter with a record Q3 pipeline, further reinforcing our confidence in the demand environment ahead. Moving to the P&L, total revenue exceeded our guidance range and grew 26% over Q2 of last year to reach $1.47 billion, with year-over-year growth accelerating sequentially for the fifth consecutive quarter. Subscription revenue grew 27% over Q2 of last year to reach $1.40 billion, and professional services revenue was an all-time record $71 million, as AI creates incremental demand for our AI readiness and incident response services, further increasing software cross-sell opportunities. The geographic mix of second quarter revenue consisted of approximately 65% from the U.S., and 35% from international geographies. Broad base strength across our major regions drove international year-over-year revenue growth acceleration for the fifth consecutive quarter. Total Q2 non-GAAP gross margin was 79%, up approximately 110 basis points over the prior year. Non-GAAP subscription gross margin was 81%, up approximately 90 basis points over the prior year, driven by continued cloud optimization efforts as we remain focused on achieving our FY29 target model of 82 to 85% non-GAAP subscription gross margin. Second quarter non-GAAP operating income was a record $372 million, exceeding our guidance, and non-GAAP operating margin was 25%, up 350 basis points over the prior year. The outperformance was driven by strong top-line execution continued gross margin expansion and increased operating efficiency our internal investments in automation and ai continue to yield greater operational efficiencies and productivity gains across our business the combination of accelerating revenue growth and substantial year-over-year operating margin expansion demonstrates our strong operating leverage as we invest in the significant opportunities ahead, positioning us to deliver durable, profitable growth. In Q2, we delivered $5 million of GAAP net income attributable to CrowdStrike, marking the third consecutive quarter of positive GAAP earnings. Non-GAAP net income attributable to CrowdStrike was a record $323 million, or 31 cents per diluted share, exceeding our guidance, and up 34% compared to the prior year on a split-adjusted basis. Moving to cash, our cash and cash equivalents grew to $5.01 billion. We generated Q2 record cash flow from operations of $530 million and Q2 record free cash flow of of $377 million or 26% of revenue, exceeding our free cash flow margin expectation of 24.5%. Moving to our outlook and modeling notes. Consistent with our guidance philosophy, our outlook reflects the strength we see in the business while maintaining a prudent approach. Our record second quarter performance, record Q3 pipeline and broad-based demand across customer segments and the Falcon platform give us increased confidence in the strength of the demand environment and our long-term growth opportunity. As a result, we are once again raising our fiscal 2027 net new ARR outlook. At the midpoint, we now expect $1.355 billion of net new ARR for the full year, an increase of approximately $116 million from our initial FY27 outlook. This equates to expected year-over-year net new ARR growth of approximately 34%, compared to 22.5% in our initial FY27 outlook, representing an increase of 1,150 basis points. The magnitude of this increase reflects more than our Q2 outperformance. As AI expands the attack surface and increases the urgency around cybersecurity, we believe it is driving a broader security modernization cycle that creates durable demand across the Falcon platform. Combined with continued platform consolidation and strong Falcon Flex momentum, these demand signals reinforce our confidence in the full-year opportunity ahead. Before I walk through our detailed guidance, let me highlight two additional items to keep First, the acquisition of XM Cyber's technology assets is expected to close in the second half of FY27 and will not bring any ARR or revenue to CrowdStrike, nor are we including any ARR or revenue from this transaction into the FY27 guidance. And second, at the midpoint of our guidance, we expect free cash flow margin of 27.5% in Q3 and continue to expect at least 30% for the full fiscal year on our increased revenue With that, for the third quarter of FY27, we expect annual recurring revenue to be in the range of $6.184 to $6.188 billion, up 26% year-over-year. This translates to net new ARR of $343 to $347 million, up 29 to 31% year-over-year. Total revenue to be in the range of $1.523 to $1.529 billion, up 23% to 24% year-over-year. Non-GAAP income from operations to be in the range of $373 to $376 million, and non-GAAP net income attributed to CrowdStrike to be in the range of $325 to $328 million. Diluted non-GAAP net income per share attributed to the CrowdStrike to be approximately $0.31, assuming a 21% tax rate and approximately $1.048 billion weighted average diluted shares. For the full fiscal year 2027, we expect annual recurring revenue to be in the range of $6.603 to $6.612 billion, up 26% year-over-year. This translates to net new ARR of $1.350 to $1.359 billion, up 34% year-over-year. Total revenue to be in the range of $5.991 to $6.011 billion, up 25% over the prior fiscal Non-GAAP income from operations is expected to be between $1.497 and $1.508 billion, and non-GAAP net income attributable to CrowdStrike to be between $1.303 and $1.312 billion. Assuming a 21% tax rate and approximately $1.044 billion weighted average diluted shares, we expect non-GAAP net income per share attributable to CrowdStrike to be in the range of $1.25 to $1.26. George and I will now take your questions.

Thank you. If you would like to ask a question please click on the raise hand button which can be found on the bar at the bottom of the zoom window you may remove yourself from the queue at any time by lowering your hand when it is your turn you will hear your name called and receive a message on your screen notifying you that you may unmute yourself in the interest of time participants will be limited to one question our first question comes from sakit kalia with barclays please unmute your audio and ask your question okay great can you hear me okay yes go ahead yep okay excellent well hey guys thanks for taking my question here and great to see the acceleration continue um george maybe for

you you know the mythos moment uh you know happened in the spring and and now we've gotten a few months of activity behind us could you maybe talk about what transpired after that and as you look back Zach, what were some of the key drivers of this upside here in Q2?

Thanks, Zach. So as we mentioned in the spring, the mythos moment was building. And as we told you, it was going to be a growth driver and a tailwind for us. And you saw that show up in our results. When we think about AI agents going rogue, when you think about the need for protecting AI and understanding where shadow AI is, it all points to the technologies that we're building and delivering here, like AIDR, which just had a phenomenal quarter, no surprise. Obviously, cloud, identity, next-gen SIM, endpoint was accelerating, and exposure management, which is a big element now, given the fact that companies can't keep up with the patching.

So when you put all of that together, it comes to what we said, the mythos moment was a point of acceleration and we see those tailwinds continuing thanks socket operator next question please your next question will come from brian essex with jp morgan please unmute your audio and ask your question hi good afternoon thanks for taking the question and great to see the uh the nice magnitude of net new arr upside this quarter um maybe maybe george for you just to piggyback on socket's question there um would love to get your view on the durability of strength that you're seeing on the back of the mythos moment, so to speak. I mean, how much of the momentum goes beyond next quarter, perhaps beyond the end of the year? And given what you have in your pipeline, how much visibility do you have into the strength, maybe just into next year and beyond? Thank you.

Sure. I think when you look at the durability, in my opinion, it is absolutely there. It's one of the reasons why we raised FY27 Outlook again. And what we're hearing from customers is they want to deploy more ai but they're being held back because of security compliance privacy data protection type uh issues so every customer that we talk to is concerned about the agentic threats we've seen uh agents go wild we've seen them break out of the frontier labs and this is is a sustainable tailwind if we believe that ai is in its early days and is only going to get better and more powerful combined with the autonomous nature of these attacks it's absolutely something that every company is going to need and as i said um in a prior earnings call i think the ai dr business can be bigger than the edr business just given the pure number of

agents which uh each person will have which is estimated to be about 90. so for me it's uh sustained tailwinds and um you know i think we're only going to see more uh stories around agents gone wild and we're going to be there to to protect our customers yeah i think brian the numbers back it up look you start with the record q3 pipeline so that prompted us you know to raise our full year guidance by an additional 630 basis points that means we moved our fy27 annual growth rate from 27.7 at the end of last quarter to 34 this quarter when when compared to our initial guide for the year, we raised the growth rate 1,150 basis points, or $116 million in just two quarters. That talks to the durability of the things that George talked about.

Thanks, Brian. Operator, next question, please.

Your next question will come from Gabriella Borges with Goldman Sachs. Please unmute your audio and ask your question.

Hey, good afternoon. Thank you. George and Bert, i wanted to ask you a little bit of a product question you gave a little bit of uh you gave the case studies earlier on on customer journeys and some of the flagship ones in the quarter what i want to better understand is if you have a customer let's say it's a large financial organization and they go from having agents being sandboxed and isolated regardless of how effective those sandboxes can be to actually wanting the agents to have real customer data real enterprise data. Walk us through the before and after. How do you advise those clients on what products they need to buy from CrowdStrike? Clearly, identity is a part of it. To be able to say agents isolated to agents in production. Thank you.

Sure. Well, I think to make the agents productive, they're going to have to have access to data. And again, when you look at what we're delivering for customers, it's looking across the entire spectrum of threats, right? You have to have an identity control plane which we have for non-human identities you have to have data protection which we have you have to understand at runtime what the agents are actually doing whether that's in a sandbox or if those agents are running uh essentially on your your computer your laptop um you have to understand the exposures that you have you have to be able to keep track of where those agents are calling out to we can do all of that so um if it's in a sandbox we can run in a sandbox if it's out of a sandbox which many of our customers are you know just kind of consuming ai on their desktops using um the various frontier lab you know harnesses and the like and we cover all of those including if you're creating agents uh in a cloud environment so from my perspective the agents first of all you need to know where ai is being created you need to know where it's being consumed and you have to put the right guardrails around identity data execution and network connectivity, and we're delivering that for our customers.

Thanks, Gabrielle.

Operator next.

Your next question will come from Matt Hedberg with RBC. Please unmute your audio and ask your question.

Hey, guys. Thanks for taking my questions.

I'll offer my congrats as well.

You know, I wanted to piggyback sort of on this train of thought, and George, you talked about in your prepared remarks, but I just, I think we're all sitting back there and we're seeing these agents going rogue uh and and and just how quickly this landscape is changing so i guess you know from your perspective i just wanted to kind of get double click on like how you see the threat landscape today and when we think about how quickly this is changing you know the relationship with the frontier labs is obviously great but talk to us about why you're uniquely positioned even if these frontier labs start to release some of their own security solutions in the future sure well i i think it's important um that when you look at ai and um to make ai protection more

effective you have to have very deep uh data expertise and this has been something that's been basically built into the platform from day one over the last 15 years we have some of the the richest uh threat data uh richest attack data richest uh data around actually how to mitigate these threats in the industry so when you look at the models that we built you know we've trained on those specifically and that gives us a unique perspective um customers of course want choice they want to work with frontier models they want to work with our technology and our platform fantastic um but having the right data having it trained uh in a specific fashion and labeled appropriately i think is unique and and we have data that just isn't available uh outside of um the crowd strike walls that's very important the other piece is and i i mentioned this um some time ago we are net data creators we're constantly creating new data that's coming out of our endpoints we're constantly using that data update our algorithms uh as uh the threat environment changes um and again i think this is very important to our customers they want security companies they can trust they want data sovereignty from a technology perspective and they want to get actual results based upon the information in their own environment and we're delivering that today

thanks matt operator next question your next question will come from fatima mulani with city please unmute your audio and ask your question good afternoon thank you so much for taking my question um i wanted to double back on some of the earlier uh questions around portfolio pervasiveness so specifically just around the the acceleration that you continue to see in falcon flex both from a standard conversion and reflex um george i was hoping if you could help us maybe parse out more granularly where you are seeing the most incremental or outsized traction on a skew or disciplinary basis as organizations move to production-grade AI adoption? And I guess, in other words, it's sort of what parts of the portfolio have proven to be most potent in giving organizations the assurances and confidence they need that they are in a secure situation with their AI adoption?

Sure. I'll take that, Fatima. So first, let's just talk about Flex. So Flex, it was an all-time record Flex quarter with you over your growth accelerating. to 101 percent um year over year surpassing 2.29 billion and a lot of that um is coming from you know some of the different technologies that we've been talking about quarter after quarter when you think about cloud next gen sim next gen identity ending arr was 2.1 billion up 39 year over year and if you go down the list of how we've done in each one of those particular elements they're all they're all really impressed right you think about you know cloud over 905 million in ending ARR, you know, up 29%. You've got next-gen identity, which is a big piece of the AI story. That's up, you know, 33% year-over-year. And then you've got, obviously, next-gen sim, just a home run for us. You know, that's, you know, coming up on, you know, almost 700 million, and that's up 60% year-over-year. You know, so all three of those can be an IPO by themselves. You're seeing adoption through our Flex licensing really showcased itself in those three products. And then George mentioned a whole bunch of other ones. We talked about exposure management having a great quarter. You talked about AIDR having a fantastic quarter. I think the point is that Flex is letting itself to be able to buy multiple of our products at the same time, and that's what's leading to bigger, longer deals for us. And it's better for the customer. At the end of the day, it's the platform sale. That's what matters. Customers are looking to consolidate on it. They want better outcomes at a cheaper cost.

Thanks Fatima. Operator, next question.

Our next question will come from Metta Marshall with Morgan Stanley. Please unmute your audio and ask your question.

Great, thanks. I wanted to maybe follow up on some of that next gen sim strength. If we were having this conversation a year ago, there was a lot of, they can start with, if their customers can start moving their ADR data over and then kind of gradually over time, expand those implementations. I just wanted to get a sense, as you guys are seeing continued really strong growth, is that kind of land happening differently? Like are people taking more of a chance upfront and moving more to you guys initially? And then just, are we seeing kind of more data or logs being put into the SIM to give better signals as they try to kind of detect more advanced attacks?

Yeah, well, when you look at NextGen Sim, the great news is it's every customer is NextGen Sim enabled. Like the data is just in the platform. So it's just a matter of signing up and paying for the license entitlement and you're up and running with the crowd, what we call first-party data, the data that we actually generate. So that has made it incredibly easy and friction-free for many customers. They routinely say it's the easiest SIM to get up and running. It's the quickest return in terms of time to value of what they're putting in and the results are getting out. And then it's very easy to connect other data sources. We've seen the other data sources rapidly expand. If we think about AI, AI agents, SaaS and SaaS cloud agents, if you will, these are all an identity. These are all areas that customers have to instrument because we see these cross-domain attacks that go from internal systems to the cloud or cloud internal systems um and everything in between so we've seen just tremendous results there it's a fantastic product and it's very disruptive from a price price point because of how we charge for the first party data that we create so um you know it is a story of better faster and more value for the money and uh you can see the the results and they speak for themselves. Thanks, Mia. Operator, next question, please.

Our next question will come from Adam Tindall with Raymond James. Please unmute your audio and ask your question.

Okay, thanks. Good afternoon and congrats on a great quarter. George, I wanted to ask on AIDR versus the core EDR platform, kind of a two-parter. I asked because investors are struggling with the definition and a view that there might be more gray area between aidr and your core platform so i guess the first part of the question would be is there kind of a simple way to think about aidr where is this incremental where customers are buying this in addition to edr or is this being used more as a substitute for edr or any other products and the second part would be um you've kind of alluded to some metrics around this that have been helpful but i wonder if you might just take a second to put in context the ramp of aidr versus other products at this stage as we try to think about the potential ultimate size of that platform? Thank you.

Yeah, so on the first point, it is separate and incremental. It's another module and it's priced separately, which is, again, where we're seeing a lot of the growth. So that is, you know, certainly a good fact to make sure that we clear up if there was any confusion about it. But when we think about the beauty of the architecture and the platform, it's still using the same agent. And if you want to enable AIDR, again, that's a license entitlement. It's part of our friction-free deployment. Again, why is FalconFlex so successful? Why have we been successful? Immediate time to value. You don't have to roll out yet another agent. So that's very important. And when we talk about sort of like the ramp of this, it's been incredible over the last you know, a couple of quarters, and we've seen almost the results sort of parallel some of the Frontier Labs growth, you know, as they continue to add more agents and capabilities, you have customers that are deploying more AI, they, they actually want to deploy AI faster, and they need to scale incredibly fast. So when you combine what we're building with, again, it's on the same platform, that's the beauty, but we're able to monetize it separately. we think that's a home run and we're showing the value to customers and they're willing to pay for it because it's very unique in the environment and they don't want to deploy yet another agent, right? They're getting it all with CrowdStrike and that's what they're looking for. All right, thanks, Adam. Operator, next question.

Our next question will come from Roger Boyd with UBS. Please unmute your audio and ask your question.

Great, thanks for the question. For George or maybe for Bert, given the traction you're seeing around AI security And you noted the acceleration in AIDR, overall AI usage across your install base and inflecting. I appreciate your updated views on how you're evolving the pricing model. And namely, are customers asking for token-based pricing in cybersecurity? And if so, how is that incorporated into Flex Contracts? Thanks.

Yeah, so we actually have token-based pricing as part of AIDR. So we already have that today. and what's important from a customer perspective is they do want some certainty on what they're paying. So we provide a certain number of tokens across an environment and we obviously we scale out to how big the customer is. And then if they exceed that token usage, they can buy extra token packs. And again, the beauty is it's all consumable via the Falcon Flex licensing. So it's a model, I think it has served this well where it's not runaway costs for customers, they can define it, they can budget for it, but certainly as they scale up their AI, if they exceed their budget allowance, they certainly can up-level the tokens and it's friction-free to do that with FalconFlex. Okay.

Thanks for the question, operator. Next question, please.

Our next question comes from Rob Owens with Piper Sandler.

Please unmute your audio and ask your question great thank you and good afternoon um george i guess back to the start and thinking about your your history with foundstone a little bit and twice on this call you did mention exposure management so love to understand the evolution of that market where you're seeing displacement because i think you mentioned a a large-scale transaction there and effectively what the older solutions aren't providing at this point i know that you guys adopted a network scanning capability a year ago but with ai i'd assume it's well beyond that at this point so just would love for you to drill down on that opportunity in why crowd strike is winning thanks

sure so when we think about where we are with exposure management um i think it's a rebirth and and certainly we're in full position in that area so what i mean by that is um given the fact that there's an exponential increase in vulnerabilities that are found uh you know frontier ai and patches that can be created via frontier ai uh that's great the problem is you've hit the sound barrier of actually rolling out a patch and what that means is that companies are looking for their ability to prioritize where these exposures are because they're not going to be able to fix everything all at once within the window of what autonomous agents can actually exploit so that that's really the driver uh in an in an area where um you know customers are are looking at and saying hey i've got to think about this differently i can't be doing the same old things that we've been doing i can't keep using the same old legacy exposure management or vulnerability management technology so they want a view of their assets they want a view of where their protection is falcon they want a view of what's exposed right what patches need to be applied but haven't and they want to understand the attack paths and we we are delivering that in an autonomous fashion within the falcon platform and that's a big reason why we're displacing a lot of legacy vendors in the market today okay thanks rob operator next question our next question comes from mike secos with needham please unmute your audio and ask your

question thank you for taking the questions and congratulations on uh another significant lift tier to the NetUAR guide following the strong 2Q execution. George, maybe for you, we've been doing a significant amount of work with CISOs, and the common refrain we're hearing comes back to AI governance, both in terms of security, as well as the pull through on the economic need to control these AI costs. My question really ties to, can you just put a finer point on discussing how customers are turning to crowd in terms of serving as that strategic partner for implementing and enforcing AI governance guardrails, I think that'd be super helpful. Thank you.

Sure. Well, in the product today, we have the ability to set policy and enforce those guardrails, which is incredibly useful, needed, and incredibly difficult. As you might imagine, in some organizations that are dealing with, you know, they make chemicals as an example. Well, that may be something that, you know, is not an approved sort of topic, if you will, in other companies but in some companies that's what they make right so you have to be able to have the right models to understand what's happening in the environment you have to be able to set the policies in a way that actually work and minimize false positives and then you have to give these customers um you know very good results very quickly so they can roll this thing out without a lot of friction and we're doing that today the other piece and you touched on it which is very important is we actually have the ability to count tokens and track cost and this is very important as you expand outside of the the boundaries of just pure security when we think about uh it infrastructure we think about the cio having the ability to help them manage cost is a big part of our selling point as well so you get the guardrails that you're looking for get the protection you need and also you have visibility into where your ai agents are and what people are actually spending on uh these results and it's incredible i mean we've heard you know, EA spending $10,000 just on tokens because of the way they were using the models. And dramatically, once you understand and have visibility around that, you can dramatically cut those costs down. So it's really a one-two punch of protection and cost management. Thanks, Mike. Operator, next question.

Our next question comes from Patrick Colville with Scotiabank. Please unmute your audio and ask your question.

Thank you for having me on. I guess this one for both george and burke please um you talked about the frontier lab eight figure deal um with this customer protecting their rapidly expanding data center infrastructure um i mean any more question any more details you can share on this specific eight figure deal and then to zoom out the aperture a little bit um you know could you just talk to this emerging customer category of helping to protect the frontier labs thank you sure i think you know you you've got the digital natives that are out there ai native companies you've got the frontier labs as you might imagine

you know all the companies that are involved in creating ai um need to protect ai and they're turning to crowd strike because we've got the right technologies across the entire stack and again like if you look at what we've done with nvidia and how we have integrated uh into their platforms um it's a complete ecosystem from the chips all the way up to the applications and ai inference so we think we're in a great position to be able to help these rapidly growing and expanding companies because they're going to need visibility they're going to need protection they're going to need control they're going to need compliance as they continue to scale and um you know we think the the sky's the limit with uh the frontier um model creators and anyone involved

in in the ai ecosystem and you know we're there for them and and uh we think we have a very unique and differentiated technology in those areas all right thanks patrick operator next question our next question comes from joseph gallo with jeffries please unmute your audio and ask your question hey guys thanks for the question there's a lot of excitement in big numbers with the emerging products on the call but i just wanted to focus on endpoint which accelerated for the fourth straight quarter can you just unpack that a little bit more is that new logos is that selling more managed services and premium SKUs and just how much runway is left there just given it's perceived as a more mature market?

Sure. Well, I think when you look at companies' desire to protect AI, again, a lot of the AI is being consumed on the endpoint, right? It might be created in the cloud, but it's being consumed on the endpoint. You can think about your own organizations and perhaps how you even use AI. So that has driven the need for companies like CrowdStrike to be able to actually protect those instances. If we think about the market, about half the market is still using legacy AV, right? So legacy AV and legacy providers are not really going to have the capabilities to identify rogue AI agents, shadow AI, and be able to protect against it's very unique and differentiated, but it fits within the platform that we built from the beginning. So that's one area where, again, if you want to protect these endpoints, you're going to have to have something like Froutstrike, and that includes net new wins from a lot of the legacy providers that are out there, certainly in addition to cross-selling into our customer base.

Thanks, Joe.

Operator, next question, please.

Our next question comes from Todd Weller with Stevens. Please unmute your audio and ask your question.

Yeah, good afternoon. Congrats, and thanks for taking the question. George, question on Quiltworks. Can you talk about how impactful it was in the quarter? And then trying to better understand the monetization angles there. Should we initially think about that as like a partner-led motion where they're leveraging your platform and frontier AI model capabilities to do assessments? And then that drives kind of follow-on platform pull through? Thank you.

Yeah, that's exactly right. When we think about the mythos moment, there's many of our partners and again we're a very partner first organization that want to be able to service their customers they've got great relationships but we need to be able to arm them with frontier caliber capabilities to be able to understand where these vulnerabilities are what threats are out there and what they can do so essentially they're leveraging our our platform in a partner-led motion and finding these vulnerabilities understanding exposure and And then obviously working on remediation with, you know, some of the largest enterprises in the world. And of course, that leads to platform pull through. So I think from our perspective, it's been a home run in Quilt Works. We have many companies that want to still yet get into it. We're working through all of those, and we'll continue to expand the partners as well as its capabilities within the platform for them to leverage.

Thank you. This concludes today's question and answer session. I would now like to turn the call back over to George Kurtz for closing remarks.

Thank you for your time today. We appreciate your continued support and look forward to seeing you at Falcon 2026 and other upcoming events.

Thank you.