CrowdStrike Holdings Inc Earnings - Q2 2027 Analysis & Highlights
CrowdStrike Holdings Inc. delivered record Q2 FY2027 results driven by accelerating demand for AI security solutions, with the company raising full-year guidance significantly and demonstrating strong platform consolidation momentum through its Falcon Flex subscription model.
Key Financial Results
Total revenue reached $1.47 billion, up 26% year-over-year, with growth accelerating for the fifth consecutive quarter.
Net new ARR (Annual Recurring Revenue) hit an all-time record of $333 million, accelerating to 51% year-over-year growth and beating guidance by more than $45 million.
Ending ARR reached $5.84 billion, up more than 25% year-over-year, with growth accelerating for the fourth consecutive quarter.
Subscription revenue grew 27% year-over-year to $1.40 billion.
Non-GAAP gross margin was 79%, up approximately 110 basis points year-over-year.
Non-GAAP subscription gross margin was 81%, up approximately 90 basis points year-over-year.
Non-GAAP operating income was a record $372 million, or 25% of revenue, growing 46% year-over-year.
Non-GAAP net income was a record $323 million or $0.31 per diluted share, up 34% compared to the prior year.
Free cash flow was a record $377 million or 26% of revenue, growing 33% year-over-year.
Cash and cash equivalents grew to $5.01 billion.
Professional services revenue was an all-time record $71 million.
Business Segment Results
Falcon Flex ending ARR surpassed $2.29 billion, accelerating to 101% year-over-year growth, with record Flex deal volume adding more than 935 Flex accounts.
Endpoint business accelerated for the fourth consecutive quarter as customers look to secure their growing AI attack surface.
AIDR (AI Detection and Response) ending ARR nearly tripled versus Q1 as customers embrace the frictionless approach to AI visibility and security.
Next-gen SIEM ending ARR surpassed $695 million, up significantly year-over-year, with record Q2 net new ARR.
Identity business ending ARR grew 34% year-over-year to more than $585 million.
Falcon Shield ending ARR grew more than 185% year-over-year in Q2.
Privileged account security offering saw ending ARR growing more than 35x year-over-year.
Cloud ending ARR exceeded $905 million, growing more than 29% year-over-year.
Exposure management business accelerated sequentially in Q2.
Customers converting from standard subscriptions to Flex delivered an average ending ARR uplift of more than 40%, with customers completing their first re-Flex generating an additional average ending ARR expansion of 25%.
Customers who have re-Flexed at least twice had average ending ARR 53% higher than their initial Flex starting point.
Net new ARR contribution from new logos was an all-time record, with both dollar-based net and gross retention rates improving sequentially.
Flex new logo ARR contributed 34% of Q2 net new ARR, a record.
51%, 35% and 26% of subscription customers adopting six, seven and eight or more modules respectively.
Capital Allocation
Cash flow from operations was $530 million in Q2.
The company exited the quarter with a record Q3 pipeline.
Acquisition of XM Cyber's technology assets is expected to close in the second half of FY '27 and will not bring any ARR or revenue to CrowdStrike, nor are they including any ARR or revenue from this transaction into the FY '27 guidance.
Industry Trends and Dynamics
AI is driving more cyber attacks and more cyber spending, with AI driving a clear divide between cybersecurity companies that solve problems and those that compound problems.
Agent proliferation is becoming mainstream to augment work and personal life, with agents proving capable of data theft, permission alteration and full-on command and control at scale leading to organizational compromise.
The world's adoption of AI is rapidly expanding the attack surface with more models, more agents, more agentic applications, more data and with that more identities, more permissions, more policies, more cyber attacks and more risk.
The agentic adversary has broken the exploit sound barrier and companies simply cannot patch vulnerabilities fast enough.
Customers are concerned about agentic threats and want to deploy more AI but are being held back because of security compliance, privacy, and data protection issues.
More than 400% growth in Claude usage and more than 100% growth in custom agent usage on endpoints in recent months.
Agents are proving capable of going rogue, swarming to attack and moving beyond their guardrails to autonomously harm.
The market is rapidly embracing cloud, identity and next-gen SIEM products to protect fast expanding attack surfaces.
Point in time posture scans are no longer enough to protect against fast-moving threats that now proliferate in seconds.
Legacy AV and legacy providers are not going to have the capabilities to identify rogue AI agents, shadow AI and protect against it.
Competitive Landscape
CrowdStrike stands out with market-leading cybersecurity services in high demand, with a flywheel created of best-in-class incident response services allotted by law firms and insurance brokers that translates into best-in-class product outcomes for new customers.
CrowdStrike is the leader in Endpoint and is now capitalizing on its ubiquitous endpoint presence to deliver the future of AI security.
CrowdStrike is the leader in cloud runtime security which has become an imperative in protecting modern AI workloads.
Failing products are open doors for agentic adversaries, with CrowdStrike and its partners helping the world recover from breaches.
The market is trusting CrowdStrike more than ever to secure their adoption of AI with cybersecurity's single platform of choice.
CrowdStrike is displacing a lot of legacy vendors in the exposure management market.
CrowdStrike has deep data expertise with some of the richest threat data, richest attack data, and richest data around how to mitigate threats in the industry, trained on specific models.
CrowdStrike is a net data creator, constantly creating new data from endpoints and using that data to update algorithms as the threat environment changes.
Customers want security companies they can trust, want data sovereignty from a technology perspective and want to get actual results based upon information in their own environment.
Macroeconomic Environment
The post-Mythos demand environment continued to strengthen in Q2, with customer urgency translating into increased cybersecurity investment, accelerated modernization and stronger demand for the Falcon platform.
Exceptional Q2 performance was broad based across customer sizes and geographies.
Broad-based strength across major regions drove international year-over-year revenue growth acceleration for the fifth consecutive quarter.
The geographic mix of second-quarter revenue consisted of approximately 65% from the US and 35% from international geographies.
Growth Opportunities and Strategies
The Falcon platform removes friction from cybersecurity and the go-to-market motion created with Falcon Flex does the same.
Flex is the commercial harness to enable customer success in the agentic era.
The company kicked Falcon Flex activity into high gear with its Flex First go-to-market strategy, with the top 10 deals by deal value each being Flexes.
The company is not just focused on converting existing customers to Flex but uses Flex from the start with new logo customers.
Record Reflex activity for existing Flex customers with more than 630 accounts having re-Flexed at least once, up 6x year-over-year.
On average, a customer's first re-Flex happens in eight months from their initial Flex.
The Falcon Flex go-to-market motion unlocks the complete aperture of the Falcon platform.
Securing the endpoint is now a top spend priority, with CrowdStrike capitalizing on its ubiquitous endpoint presence to deliver the future of AI security.
AIDR is a product surging past expectations, with customers embracing the frictionless approach to AI visibility and security.
Features like AgentWorks enable security teams to build, deploy and manage custom AI security agents, setting the foundation for the AI SOC.
Falcon Shield is securing third-party agentic applications with strong adoption.
Signal is enabling large enterprises to rethink decades of legacy access controls no longer effective for the agentic era, embracing Signal's real-time granular access model for both humans and non-human alike.
Project QuiltWorks has united more than 25 partners from GSIs to hyperscalers, resellers to ISVs and even distributors and MSPs, with QuiltWork partners collaborating on nearly $400 million of total contract value pipeline.
GSI business growing nearly 50% year-over-year, largely focused on Next-Gen SIEM transformations and vulnerability management needs.
Significant traction in the SMB space across the MSSP business with key partners such as Kroll.
Kroll took a strategic step to migrate all of its customers off a competing Next-Gen endpoint technology, with a majority of customers already successfully migrated to Falcon across 450,000 endpoints.
Kroll took a major next step with a multi-year Flex subscription, growing its spend with CrowdStrike by more than 3 times.
Accenture standardized on CrowdStrike for its new SMB-focused Accenture Edge business launched in June.
Record Q2 across AWS, Google and Microsoft cloud marketplace partners, with customers using their hyperscaler of choice for security investments.
More than $600 million in deal value transacted through cloud marketplaces in Q2 alone, representing more than 30% year-over-year growth.
Microsoft Marketplace presence opened a new addressable market.
The Falcon platform is cybersecurity's infrastructure layer for AI adoption.
Endpoint is the epicenter for AI adoption, with AIDR defining a new cybersecurity category, Next-Gen SIEM as the operating system of cybersecurity, Falcon Identity becoming the security front door for human and non-human users and exposure management as mission-critical for prioritizing AI risk.
Dr. Bartley Richardson, previously at NVIDIA, has joined as Chief AI Autonomous System Officer as part of the long-planned and mutually agreed-upon CTO leadership transition.
The innovation engine is in overdrive.
Customers are looking for ways to contain new risk created by AI, ranging from code exploitation to data leakage to identity compromise, with the market trusting CrowdStrike as critical infrastructure to both enable and safeguard their AI future.
Companies are looking for their ability to prioritize exposures because they're not going to be able to fix everything all at once within the window of what autonomous agents can actually exploit.
Customers want to understand attack paths and CrowdStrike is delivering that in an autonomous fashion within the Falcon platform.
CrowdStrike has the ability to set policy and enforce guardrails for AI governance, with the ability to count tokens and track cost.
The company has token-based pricing as part of AIDR, providing customers with certainty on what they're paying.
Financial Guidance and Outlook
For Q3 FY '27, the company expects annual recurring revenue in the range of $6.184 billion to $6.188 billion, up 26% year-over-year.
Q3 net new ARR expected to be $343 million to $347 million, up 29% to 31% year-over-year.
Q3 total revenue expected to be in the range of $1.523 billion to $1.529 billion, up 23% to 24% year-over-year.
Q3 non-GAAP income from operations expected to be in the range of $373 million to $376 million.
Q3 non-GAAP net income attributable to CrowdStrike expected to be in the range of $325 million to $328 million.
Q3 diluted non-GAAP net income per share expected to be approximately $0.31 assuming a 21% tax rate and approximately 1.048 billion weighted average diluted shares.
For full fiscal year 2027, the company expects annual recurring revenue in the range of $6.603 billion to $6.612 billion, up 26% year-over-year.
Full year net new ARR expected to be $1.350 billion to $1.359 billion, up 34% year-over-year.
Full year total revenue expected to be in the range of $5.991 billion to $6.011 billion, up 25% over the prior fiscal year.
Full year non-GAAP income from operations expected to be between $1.497 billion and $1.508 billion.
Full year non-GAAP net income attributable to CrowdStrike expected to be between $1.303 billion and $1.312 billion.
Full year non-GAAP net income per share expected to be in the range of $1.25 to $1.26, assuming a 21% tax rate and approximately 1.044 billion weighted average diluted shares.
The company raised its FY '27 net new ARR outlook by an additional 630 basis points, with net new ARR growth now expected at 34% at the midpoint, a 1,150 basis point increase from initial outlook.
At the midpoint, the company now expects $1.355 billion of net new ARR for the full year, an increase of approximately $116 million from initial FY '27 outlook.
The magnitude of the guidance increase reflects more than Q2 outperformance, with AI expanding the attack surface and increasing urgency around cybersecurity, driving a broader security modernization cycle that creates durable demand across the Falcon platform.
Combined with continued platform consolidation and strong Falcon Flex momentum, these demand signals reinforce confidence in the full-year opportunity ahead.
At the midpoint of guidance, the company expects free cash flow margin of 27.5% in Q3 and continues to expect at least 30% for the full fiscal year on increased revenue guidance.
**The company remains focused on achieving its FY '29 target model of 82% to 85% non-GAAP subscription
