CrowdStrike reported its best quarter in company history, significantly beating expectations across the board. The company is attributing this surge to the 'Mythos moment,' positioning AI security as a new necessity, with a record net new ARR of $333 million and major guidance raises. Management conveyed exceptional confidence, describing the demand environment as a durable multi-year tailwind fueled by AI agent proliferation and a fundamental shift in the cybersecurity landscape. Q2 FY27 was a record quarter: net new ARR of $333M (+51% YoY), ending ARR of $5.84B (+25% YoY), total revenue of $1.47B (+26% YoY), and record operating income of $372M.
CrowdStrike reported its best quarter in company history, significantly beating expectations across the board. The company is attributing this surge to the 'Mythos moment,' positioning AI security as a new necessity, with a record net new ARR of $333 million and major guidance raises. Management conveyed exceptional confidence, describing the demand environment as a durable multi-year tailwind fueled by AI agent proliferation and a fundamental shift in the cybersecurity landscape. Q2 FY27 was a record quarter: net new ARR of $333M (+51% YoY), ending ARR of $5.84B (+25% YoY), total revenue of $1.47B (+26% YoY), and record operating income of $372M.
Management reported an all-time record net new ARR of $333 million, up 51% year-over-year, and beat guidance by over $45 million. They noted record Q3 pipeline and raised full-year net new ARR guidance by 1,150 basis points, citing durable demand driven by AI-driven security…
Guidance · revenue to $1.526B
Management emphasized that AI adoption is expanding the attack surface and driving demand for its AI security products, particularly AIDR, which nearly tripled in the quarter. They highlighted the rise of agentic AI as a key threat vector, positioning CrowdStrike as the…
Falcon Flex is a major driver, surpassing $2.29B in ending ARR (+101% YoY). The company detailed a '40% ARR uplift' on Flex conversion and further expansion on 'Reflexes'.
Management emphasized that AI adoption is expanding the attack surface and driving demand for its AI security products, particularly AIDR, which nearly tripled in the quarter. They highlighted the rise of agentic AI as a key threat vector, positioning CrowdStrike as the security platform of choice for AI adoption, with token-based pricing for AIDR and strong early traction.
Management reported an all-time record net new ARR of $333 million, up 51% year-over-year, and beat guidance by over $45 million. They noted record Q3 pipeline and raised full-year net new ARR guidance by 1,150 basis points, citing durable demand driven by AI-driven security modernization.
Management's tone is highly confident and optimistic, emphasizing record results, accelerated growth, and a strong demand environment, repeatedly using phrases like 'inflection has become acceleration' and 'all-time record.'
“In Q2, customers converting from standard subscriptions to Flex delivered an average ending ARR uplift of more than 40%. From that new baseline, customers completing their first Reflex this quarter generated an additional average ending AR…”
“AIDR ending ARR nearly tripled versus Q1 as customers embrace our frictionless approach to AI visibility and security.”
“The agentic adversary has broken the exploit sound barrier, and you simply cannot patch vulnerabilities fast enough. As the patch window collapsed, our exposure management business accelerated sequentially in Q2.”
| Metric | Period | Range | Midpoint | Status |
|---|---|---|---|---|
| Free cash flow | FY2027 | 30% | 30% | MAINTAINED |
| Free cash flow | FY2027 Q3 | 27.5% | 27.5% | GUIDED |
| Revenue | FY2027 Q3 | $1.523B–$1.529B | $1.526B | RAISED |
| Revenue | FY2027 | $5.991B–$6.011B | $6.001B | RAISED |
| Issued | Metric | Target | Guide | Actual | Outcome |
|---|---|---|---|---|---|
| FY2027 Q1 | EPS | FY2027 Q2 | $1.16–$1.17 | $0.31 | Missed |
| FY2027 Q1 | Revenue | FY2027 Q2 | $1.436B–$1.442B | $1.47B | Met / beat |
| FY2026 Q4 | EPS | FY2027 Q1 | $1.06–$1.07 | $0.28 | Missed |
| FY2026 Q4 | Revenue | FY2027 Q1 | $1.36B–$1.364B | $1.3856B | Met / beat |
Rapid adoption of Anthropic's Claude on endpoints is directly expanding CrowdStrike's addressable market and driving demand for its AI security and visibility products, positioning CrowdStrike as a key enabler of Anthropic's enterprise growth.
“In sampling our customer base, we've seen more than 400% growth in Claude usage and more than 100% growth in custom agent usage on endpoints in recent months.”
… is the leader in endpoint. We're now capitalizing on our ubiquitous endpoint presence to deliver the future of AI security. In Q2, our endpoint business accelerated for the fourth consecutive quarter as customers looked to secure their growing AI attack surface. We're seeing dramatic expansion in agentic work on the endpoint, both through fast-growing tools such as Codex and Claude, as well as custom agentic applications. In sampling our customer base, we've seen more than 400% growth in Claude usage and more than 100% growth in custom agent usage on endpoints in recent months. As enterprises look to deploy these new technologies, they're also seeking ways to contain the new risk created, ranging from code exploitation to data leakage to identity compromise. Instead of turning to science projects or point products, the market is trusting CrowdStrike as critical infrastructure to both enable and safeguard their AI future. A large financial services firm worked with two of our GSI partners to replace a next-gen EDR in an eight-figure flex win. Across more than 100 entities and hundreds of thousands of endpoints, CrowdStrike was selected for the best detection coverage, …
Accenture is deepening its security partnership with CrowdStrike, leveraging the Falcon platform for its new SMB-focused offering, which should drive significant services revenue and expand CrowdStrike's footprint in the SMB segment.
“In another Q2 win, Accenture standardized on CrowdStrike for its new SMB-focused Accenture Edge business launched in June.”
… all of its customers off a competing next-gen endpoint technology. A majority of customers already successfully migrated to Falcon across 450,000 endpoints. Tracking ahead of plan, Kroll took a major next step with a multi-year flex subscription growing their spend with CrowdStrike by more than three times. This flex addresses platform consolidation and SIEM transformation across Kroll's existing Falcon install base and incoming new customers. In another Q2 win, Accenture standardized on CrowdStrike for its new SMB-focused Accenture Edge business launched in June. Lastly, Q2 showcased the power of our one-of-a-kind cloud marketplace go-to-market motion. Across AWS, Google, and Microsoft, each of our hyperscaler marketplace partners, we saw a record Q2 as customers used their hyperscaler of choice for security investments. In Q2 alone, we transacted more than $600 million in deal value through cloud marketplaces, representing more than 30% year-over-year growth. We quickly saw traction with our Microsoft Marketplace presence, opening a new addressable market. Immediate Microsoft Marketplace wins included. A new logo Australian healthcare provider started using CrowdStrike for …
Kroll's substantial expansion (3x spend) with CrowdStrike and its successful migration of 450,000 endpoints validates CrowdStrike's platform value and points to sustained, high-margin recurring revenue growth from this MSSP partner, while also signaling displacement of competing endpoint vendors.
“Three quarters ago, Kroll took a strategic step to migrate all of its customers off a competing next-gen endpoint technology. A majority of customers already successfully migrated to Falcon across 450,000 endpoints. Tracking ahead of plan,”
… are collaborating with us on nearly $400 million of total contract value pipeline. We've seen exceptional engagement from GSI partners, resulting in our GSI business growing nearly 50% year over year, largely focused on next-gen SIEM transformations and vulnerability management needs. Across our MSSP business, we're seeing significant traction in the SMB space with key partners such as Kroll. Three quarters ago, Kroll took a strategic step to migrate all of its customers off a competing next-gen endpoint technology. A majority of customers already successfully migrated to Falcon across 450,000 endpoints. Tracking ahead of plan, Kroll took a major next step with a multi-year flex subscription growing their spend with CrowdStrike by more than three times. This flex addresses platform consolidation and SIEM transformation across Kroll's existing Falcon install base and incoming new customers. In another Q2 win, Accenture standardized on CrowdStrike for its new SMB-focused Accenture Edge business launched in June. Lastly, Q2 showcased the power of our one-of-a-kind cloud marketplace go-to-market motion. Across AWS, Google, and Microsoft, each of our hyperscaler marketplace …
The deep integration with NVIDIA's platform positions CrowdStrike as a critical security layer as AI workloads scale, creating a mutually reinforcing relationship that solidifies CrowdStrike's role in AI infrastructure.
“We've done with NVIDIA and how we have integrated into their platforms, it's a complete ecosystem from the chips all the way up to the applications and AI inference.”
Sure. I think you've got the digital natives that are out there, AI native companies. You've got the frontier labs, as you might imagine. All of the companies that are involved in creating AI need to protect AI. and they're turning to CrowdStrike because we've got the right technologies across the entire stack. And again, if you look at what we've done with NVIDIA and how we have integrated into their platforms, it's a complete ecosystem from the chips all the way up to the applications and AI inference. We think we're in a great position to be able to help these rapidly growing and expanding companies because they're going to need visibility. They're going to need protection. They're going to need control. They're going to need compliance as they continue to scale. And we think the sky's the limit with the frontier model creators and anyone involved in the AI ecosystem. And we're there for them. And we think we have a very unique and differentiated technology in those areas.
The Microsoft Marketplace is emerging as a significant new sales channel for CrowdStrike, enabling faster customer acquisition and deeper collaboration with a key cloud partner, though it also highlights the complex, co-opetitive relationship in the security space.
The growth of cloud marketplace deal flow drives customer acquisition and consumption for CrowdStrike while also deepening its alignment with major cloud provider ecosystems like AWS.
… spend with CrowdStrike by more than three times. This flex addresses platform consolidation and SIEM transformation across Kroll's existing Falcon install base and incoming new customers. In another Q2 win, Accenture standardized on CrowdStrike for its new SMB-focused Accenture Edge business launched in June. Lastly, Q2 showcased the power of our one-of-a-kind cloud marketplace go-to-market motion. Across AWS, Google, and Microsoft, each of our hyperscaler marketplace partners, we saw a record Q2 as customers used their hyperscaler of choice for security investments. In Q2 alone, we transacted more than $600 million in deal value through cloud marketplaces, representing more than 30% year-over-year growth. We quickly saw traction with our Microsoft Marketplace presence, opening a new addressable market. Immediate Microsoft Marketplace wins included. A new logo Australian healthcare provider started using CrowdStrike for SOC transformation in a seven-figure flex. An American manufacturing firm previously used our services and has now expanded to the Falcon platform through a seven-figure flex on Microsoft Marketplace. In closing, Q2 was an incredible quarter where the mythos …
The 'Mythos moment' is forcing vendors to evolve, with a specific notable trend being the 'collapse of the patch window' due to autonomous agent-driven attacks. This is creating urgency around exposure management and replacing traditional VM/EDR paradigm. — For the cyber sector, this is a competitive signal: companies that rely on legacy AV/VM or even next-gen EDR without proactive 'exposure management' are losing to CrowdStrike's platform approach, impacting CRWD and its competitors (e.g., PANW, FTNT).
… for our runtime superiority in an eight-figure ARR win. CrowdStrike now secures this organization's AI cloud and labs because of our build pipeline integration and compatibility with internal tools resonating with their DevOps teams. Finally, we're seeing the mythos moment transform the market's need for exposure management, pressuring antiquated vulnerability management products built for a bygone era. The agentic adversary has broken the exploit sound barrier, and you simply cannot patch vulnerabilities fast enough. As the patch window collapsed, our exposure management business accelerated sequentially in Q2. Falcon Exposure Management offers real-time detection and continuous prioritization to successfully contain a new speed and scale of vulnerability risk. A representative exposure management win included a global religious organization that replaced a legacy vulnerability management product as part of their AI transformation initiatives. In this seven-figure flex, the account also immediately deployed AIDR to bring visibility and control to its AI usage, showcasing CrowdStrike's position to protect against AI threats and govern AI adoption. Our partner ecosystem is …