CrowdStrike Holdings Inc Earnings - Q4 2025 Analysis & Highlights
CrowdStrike Holdings reported record financial results for fiscal year 2026, driven by strong platform consolidation momentum, Falcon Flex subscription model success, and accelerating demand for AI security solutions, with management emphasizing the company's structural competitive advantages in securing artificial intelligence deployments across enterprise environments.
Key Financial Results
Total revenue reached $1.31 billion in Q4 2026, growing 23% year-over-year.
Subscription revenue grew 23% year-over-year to reach $1.24 billion in Q4.
Record net new ARR of $331 million for Q4, growing 47% year-over-year, well ahead of expectations.
Full-year net new ARR of $1.01 billion, up 25% year-over-year, marking the first year delivering over $1 billion of net new ARR.
Ending ARR reached $5.25 billion, crossing the $5 billion milestone and accelerating to 24% growth year-over-year.
Record free cash flow of $376 million for Q4, representing 29% of revenue.
Full-year free cash flow of $1.24 billion, representing 26% of revenue.
Record operating income of $326 million for Q4, representing 25% of revenue, marking the third consecutive quarter of record operating income.
Full-year operating income of $1.05 billion, exceeding the $1 billion milestone for the first time.
Non-GAAP gross margin was a record 79% in Q4, with subscription gross margin reaching a record 81% of revenue.
Non-GAAP operating margin was 25% in Q4, exceeding guidance.
Non-GAAP net income was a record $289.1 million or $1.12 per diluted share in Q4.
Dollar-based net retention of 115% and gross retention of 97%, demonstrating best-in-class durability and stickiness.
Cash and cash equivalents increased to $5.23 billion.
Business Segment Results
Falcon Flex subscription model generated $1.69 billion in ending ARR, growing more than 120% year-over-year, with more than 1,600 customers adopting the model.
Falcon Flex customers added more than 350 new customers in Q4, representing nearly four new Flex customers each day of the quarter.
Average Flex customer ending ARR exceeded $1 million.
Re-Flex momentum showed more than 380 Flex accounts have re-Flexed, representing more than 23% of the Flex customer base, up from 5% in Q1.
Average ARR lift after re-Flex was 26%, occurring on average within seven months.
Multiple-time re-Flexers totaled nearly 100 customers, representing approximately 6% of total Flex customers and over a quarter of all re-Flex customers, with an average ARR lift of an additional 48%.
Next-Gen Identity, Cloud, and Next-Gen SIEM businesses collectively grew more than 45% year-over-year, reaching more than $1.9 billion in ending ARR.
Next-Gen Identity business ended FY 2026 with more than $520 million of ending ARR, growing more than 34% year-over-year, a double-digit acceleration versus two quarters ago.
Privileged account security solution grew more than 170% sequentially.
Falcon Shield ending ARR grew more than 300% year-over-year, more than 5x since the acquisition of Adaptive Shield.
Cloud business net new ARR growth accelerated for the second consecutive quarter, with ending ARR growing more than 35% year-over-year.
Cloud business ending ARR exceeded $800 million for the first time.
Next-Gen SIEM business grew over 75% year-over-year, delivering ending ARR of more than $585 million.
Endpoint business accelerated for the second consecutive quarter amidst AI proliferation.
AIDR offering grew more than 5x versus the prior quarter despite being available for only a few weeks.
Module adoption showed 50% of subscription customers using six or more modules, 34% using seven or more, and 24% using eight or more modules.
MSSP business grew to more than $1.3 billion in ending ARR, up from a sub-$100 million business just over three years ago.
AWS Marketplace generated nearly $1.5 billion of total contract value, growing nearly 50% year-over-year.
Capital Allocation
Share repurchases of approximately 144,000 shares following fiscal year end, with approximately $950 million remaining under the current share repurchase authorization.
Capital expenditures anticipated to be 7% to 8% of revenue in FY 2027, with investments more weighted to the first half of the year.
Interest income expected to be $160 million to $170 million for FY 2027, based on expected market rates and cash outlay from recent acquisitions.
Industry Trends and Dynamics
AI proliferation is driving elevated demand for the Falcon platform and serving as a key accelerant for the business.
AI is weaponizing adversaries to attack with increased speed, sophistication, and precision, with nation-state activity being observed in real time in the Middle East.
AI revolution is creating two disparate groups of software companies: those who are existentially vulnerable and those who will thrive.
Mission-critical, trusted infrastructure technologies are necessary for global continuity and are net data creators producing novel, fresh, and proprietary data that fuels agentic business outcomes.
Endpoint is rapidly becoming the epicenter of AI usage, driven by growth of technologies ranging from MCP servers to coding tools to localized LLMs.
AI is the fastest growing attack surface on the endpoint, with sensors detecting more than 1,800 distinct AI applications running on enterprise devices, representing nearly 160 million unique application instances across the customer base.
Customers are safely and securely using more than 1,800 distinct AI applications on their endpoints, which would not be possible without CrowdStrike.
Browser has become the front door for how people interact with AI models and LLMs, as well as how threats get into the environment.
Competitive Landscape
CrowdStrike is the fastest and only pure-play cybersecurity software company to achieve the $5 billion ARR milestone.
Falcon is a vertically integrated net data creator and third-party data aggregator, generating real-time data that no one else has from customer environments combined with world-class Threat Intelligence.
Cyber-reinforced learning from human feedback (RLHF) at scale has been performed by CrowdStrike for over a decade, which frontier AI labs cannot replicate.
NDR analysts, threat hunters, and incident responders produce expert-labeled data as a byproduct of operations, with labels coming from stopping real breaches in real time rather than Internet text.
Threat Graph correlates more than 1 trillion security events per day across approximately 2 trillion vertices, analyzing 15-plus petabytes of data at a scale no one can replicate.
Frontier models can augment security, summarize alerts, draft queries, and speed up triage, but stopping breaches requires sensors, real-time telemetry, continuous expert validation, and enforcement through a closed loop system, not a text model.
CrowdStrike's competitive moat is becoming an opportunity ocean through a flywheel and network effect that no one else has in cybersecurity at the company's size and scale.
Falcon is purpose-built for securing AI at every layer, including GPU foundation, hardware and infrastructure OEMs, neo clouds and hyperscalers, token factories, and AI applications and agents.
CrowdStrike secures nearly all of the world's AI leaders, securing both the use of each company's products and the companies themselves.
Efficacy and precision matter more than ever in cybersecurity, where hallucinations cannot occur and first-time final decisions are required, differentiating CrowdStrike from general LLM approaches.
Agentic SOC and AI technologies are transforming security, with Charlotte as the flagship agent and 10 other agents representing specific security skills and roles within security teams.
Charlotte usage soared more than 6x year-over-year with ARR more than tripling.
Charlotte achieved 3x faster mean time to respond in a leading cloud software provider's 30-day use case.
Falcon Flex subscription model has been mimicked across cybersecurity, transforming customer discussions to demand planning based on risk, data, attack surface, and overall platform capabilities.
Runtime protection-first approach in Cloud Security resulted in a 90% reduction in mean time to detect and respond for a major enterprise data platform company.
Next-Gen SIEM performance and cost advantages set CrowdStrike apart from legacy competitors.
Falcon's fully native data pipeline delivered an expected 80% faster query performance compared to legacy SIEM solutions.
Customers are leveraging Falcon to consolidate their security needs and lower their total cost of ownership, resulting in higher retention rates and strong module adoption rates.
Hyperscaler partnerships continue to differentiate CrowdStrike from every other cybersecurity player, with Microsoft Marketplace now open for business allowing customers to use Azure consumption commitment dollars on Falcon.
Managed service offerings like Complete and OverWatch continue to grow extremely well, with CrowdStrike being best-in-class for meantime to detection and meantime to remediation.
Macroeconomic Environment
Elevated threat environment is driving strong professional services revenue growth of 26% year-over-year.
Broad-based demand was achieved across customers of all sizes, from enterprise to down market and MSSPs, with both EMEA and APAC year-over-year revenue growth accelerating compared to Q3.
US, Japan, Europe, the Middle East and Africa all exceeded expectations in geographic performance.
Growth Opportunities and Strategies
AI adoption accelerator positioning allows CrowdStrike to help customers safely and securely use AI applications while providing necessary protection layers for visibility, compliance, and enforcement.
AI use necessitates AI security, with every enterprise deploying AI needing an independent protection layer, making CrowdStrike even more of a necessity as AI adoption grows.
Data moat creates a structural advantage, requiring expert label telemetry from global sensors, NDR analysts, and elite incident responders rather than just a prompt.
Agentic cybersecurity requires in-line prevention as well as real-time remediation, with CrowdStrike having created an AI-native platform since founding.
AI revolution represents a new and generational growth opportunity as accelerating AI adoption necessitates security built for this next era of technology.
Platform consolidation continues to drive customer adoption, with customers consolidating their security needs through Falcon.
Partner go-to-market delivered beyond expectations with growing practices across EY, Accenture, Deloitte, HCL, Wipro, KPMG, and Infosys focused on Next-Gen SIEM migrations.
SGNL.AI acquisition brings Zero Standing Privilege for all identities to the Falcon platform, enabling customers to rapidly reduce their identity attack surface while expanding the number of identities.
Seraphic acquisition turns any browser into a secure enterprise browser without impacting user behavior, meeting human and non-human users where they are with agentic browsers for real-time visibility and protection.
Falcon Onum enables customers to connect data sources quickly and efficiently, resonating with both security and IT teams.
AIDR offering gives customers immediate visibility into employees' usage of AI tools, including specific models being used and detections into potentially malicious or noncompliant usage.
Agent pricing opportunity exists as industry stats indicate each knowledge worker will have 90 AI agents, creating massive opportunity to protect AI agents and AI cloud workloads.
Flex model enables rapid customer adoption of new acquisitions without requiring additional procurement cycles, with acquired capabilities available immediately to customers.
Open platform approach allows customers to create their own agents leveraging CrowdStrike technologies and MCP services.
Financial Guidance and Outlook
Q1 FY 2027 ending ARR expected in the range of $5.502 billion to $5.504 billion, reflecting a year-over-year growth rate of 24%, translating to net new ARR of $249 million to $251 million, reflecting a year-over-year growth rate of 29% to 30%.
Q1 FY 2027 total revenue expected in the range of $1.360 billion to $1.364 billion, reflecting a year-over-year growth rate of 23% to 24%.
Q1 FY 2027 non-GAAP operating income expected in the range of $308 million to $310 million.
Q1 FY 2027 non-GAAP net income expected in the range of $275 million to $277 million.
Q1 FY 2027 diluted non-GAAP net income per share expected to be approximately $1.06 to $1.07, utilizing a 21.0% tax rate and weighted average share count of approximately 259 million shares on a diluted basis.
Full fiscal year 2027 ending ARR expected in the range of $6.466 billion to $6.516 billion, reflecting a year-over-year growth rate of 23% to 24%, translating to net new ARR of $1.213 billion to $1.264 billion, reflecting a year-over-year growth rate of 20% to 25%.
Full fiscal year 2027 total revenue expected in the range of $5.868 billion to $5.928 billion, reflecting a growth rate of 22% to 23% over the prior fiscal year.
Full fiscal year 2027 non-GAAP operating income expected between $1.422 billion and $1.462 billion.
Full fiscal year 2027 non-GAAP net income expected between $1.241 billion and $1.271 billion.
Full fiscal year 2027 non-GAAP net income per share expected in the range of **$4.78
