CrowdStrike is still posting elite growth, with record ARR, strong free cash flow, and raised guidance. But the stock’s premium valuation leaves less room for error, making it a quality Hold rather than an obvious buy.
CrowdStrike(CRWD) remains one of the strongest growth franchises in cybersecurity, but the stock already prices in a large share of that strength. The core bullish case is easy to see in the numbers. Q1 FY2027 revenue rose 26% YoY to $1.3856B, non-GAAP EPS reached $1.10, ending ARR hit $5.51B, net new ARR was a record $256M, and free cash flow reached a record $468.5M. The company also raised full-year FY2027 guidance to $5.9147B-$5.9587B in revenue, $4.88-$4.96 in non-GAAP EPS, and $6.5317B-$6.5555B in ARR. That is not a business losing momentum.
The harder part is the stock. CrowdStrike carries a forward P/E of 158.7x, an EV/revenue multiple of 38.0x, and a PEG ratio of 6.31. Analyst consensus target data at $179.69 sits below the recent market price implied by the company’s own split-adjusted buyback price and recent insider sale prices. That leaves a familiar setup: a great company, a powerful platform, and a valuation that demands near-flawless execution. For a balanced, moderate-risk investor with a medium-term horizon, CrowdStrike looks more like a high-quality name to buy on pullbacks than a stock to chase aggressively at any price.
CrowdStrike(CRWD) is a cloud-native cybersecurity company headquartered in Austin, Texas. Founded in 2011 and public since 2019, it sells software through a SaaS subscription model centered on the Falcon platform. The company serves customers in the U.S. and internationally, with Q1 FY2027 revenue split 66% U.S. and 34% international. It had 11,157 employees and operates in software infrastructure, with products spanning endpoint protection, cloud workload security, identity protection, SIEM, threat intelligence, data protection, SaaS security posture management, workflow automation, and AI security.
The business model is built around recurring subscriptions. In FY2026, subscription revenue was $4.56B, or 94.9% of total revenue, while professional services contributed $247.3M, or 5.1%. That mix matters. Subscription-heavy software businesses tend to produce better visibility, stronger gross margins, and more durable free cash flow than services-heavy models. CrowdStrike’s annual gross margin of 74.7% in FY2026 and Q1 FY2027 non-GAAP subscription gross margin of 81% show that the model still scales well.
Management is led by co-founder and CEO George Kurtz, with Burt Podbere as CFO. The company’s current narrative is increasingly tied to AI-era security. On the Q1 FY2027 call, Kurtz said CrowdStrike is now being understood as “critical AI infrastructure,” a phrase that captures how management wants investors to view the company: not just as endpoint security, but as a control layer across endpoints, identities, cloud workloads, data, and AI agents.
CrowdStrike reports two revenue buckets: subscription and professional services. Subscription is the real engine. FY2026 subscription revenue reached $4.5647B, up from $3.7615B in FY2025. Professional services rose to $247.3M from $192.1M. The revenue mix has stayed remarkably consistent, with subscriptions at 93.9% of revenue in FY2024, 95.1% in FY2025, and 94.9% in FY2026. That consistency reinforces the view that CrowdStrike is a platform software company first, not a consulting shop wearing a software label.
Within subscriptions, management gives more useful operating detail through ARR and product adoption rather than formal segments. Q1 FY2027 ending ARR reached $5.51B, up more than 24% YoY, and net new ARR was $256M, up 32% YoY. Management said cloud, next-gen identity, and next-gen SIEM delivered record combined Q1 net new ARR, and those businesses together now exceed $2B in ending ARR. Next-gen SIEM alone exceeded $600M in ending ARR.
Falcon Flex has become a major commercial layer on top of the product stack. CrowdStrike had more than 1,900 Flex customers in Q1 FY2027, 480 Re-Flex customers, and more than $1.9B in ending ARR from Flex accounts, up more than 99% YoY. Management said the average Re-Flex uplift was 26%, with more than 130 customers re-flexing multiple times and generating an average ARR uplift of 51% over the original Flex contract. In plain English, once customers enter the platform, they tend to buy more of it, faster.
Professional services remains a smaller but useful support function. Q1 FY2027 professional services revenue was $64.8M, up 23% YoY, helped by what management called an elevated threat environment. This business is not the valuation driver, but it can support adoption by helping customers deploy, assess, and expand use of the platform.
Get AI research on any stock
Instant reports, daily intelligence, and an AI analyst in your pocket.
Falcon is CrowdStrike’s flagship platform and the center of the investment case. The architecture uses a single lightweight sensor and a cloud-delivered data layer, which lets customers add modules without rebuilding their security stack. As of FY2026, CrowdStrike said it offered 33 cloud modules. That matters because module sprawl is usually a cost problem for customers and a revenue opportunity for platform vendors. CrowdStrike has turned that into a land-and-expand machine.
Customer adoption data supports that view. In Q1 FY2027, 51% of subscription customers used 6+ modules, 35% used 7+ modules, and 25% used 8+ modules. Those are not vanity metrics. They show that Falcon is not being bought as a single-purpose endpoint tool. It is being used as a broader operating layer for security operations, identity, cloud, and data protection.
Endpoint remains the anchor. Management said the endpoint business accelerated for the third consecutive quarter, and Gartner named CrowdStrike a leader in endpoint protection for the seventh consecutive year, placing it highest on both axes for the fourth year in a row. That installed endpoint base gives CrowdStrike what Kurtz called “endpoint real estate,” which is a useful phrase because it captures the strategic value of already being present where attacks execute.
The newer product to watch is AIDR, or AI Detection and Response. Management said AIDR ending ARR grew more than 250% sequentially and that Q2 pipeline already exceeded $50M. It also cited a 7-figure win where an automotive financial services leader added AIDR to more than 30,000 hosts. That is early-stage data, but it is real traction, not a slide-deck fantasy.
Charlotte AI and AgentWorks add another layer to the product story. Management said Charlotte AI ending ARR accelerated sequentially over Q4 and described it as the reasoning engine across Falcon. AgentWorks extends that with an ecosystem that includes Accenture, AWS, Anthropic, Deloitte, NVIDIA, OpenAI, and Salesforce. The strategic point is simple: Falcon is evolving from a detection platform into a workflow and automation platform. That broadens both switching costs and monetization paths.
CrowdStrike’s moat rests on architecture, telemetry, cross-sell, and brand validation. The single-agent, cloud-native design reduces deployment friction and supports module expansion. The Falcon platform aggregates data across endpoints, cloud workloads, identities, and third-party sources, creating a telemetry advantage that improves detection and response. In security, more data is not automatically better, but more relevant data tied to one control plane often is.
The company is also using the AI cycle to reposition itself higher in the stack. Management said CrowdStrike was the only cybersecurity company selected by both Anthropic and OpenAI from the start to secure new model introductions. It tied that to Project Glasswing, OpenAI’s trusted access program, and Project QuiltWorks, a coalition effort that expanded to include Accenture, IBM, Kroll, Cognizant, HCL Tech, Infosys, KPMG, NTT DATA, Tata Consultancy Services, Wipro, and several insurers including Liberty Mutual and Marsh.
That ecosystem angle matters because security buying often follows trust and integration, not just feature checklists. Management cited a Fortune 100 QuiltWorks engagement that uncovered more than 45 million vulnerabilities and accelerated next-gen SIEM adoption. It also cited a Kroll-led assessment that helped convert a clothing manufacturer into a new-logo account. Those are concrete examples of ecosystem-led pipeline creation.
Third-party validation adds weight. CrowdStrike cited 100% detection and 100% protection with no false positives in the 2025 MITRE ATT&CK Enterprise Evaluations, a 273% ROI figure from a Forrester TEI study, and Gartner leadership in endpoint protection. None of those items alone makes the stock cheap, but they do help explain why the company keeps winning platform consolidation deals.
CrowdStrike is a software company, so its operational backbone is cloud infrastructure, engineering talent, partner channels, and customer support rather than a traditional physical supply chain. The most important operational signals are gross margin, cloud efficiency, geographic execution, and the ability to convert growth into cash. On those measures, the recent data is strong.
Q1 FY2027 non-GAAP gross margin reached a record 79%, and subscription gross margin reached a record 81%, up 90 basis points YoY. CFO Burt Podbere said the improvement was driven by continued cloud optimization. That is a useful detail because it shows CrowdStrike is not just growing by spending harder. It is also getting more efficient in how it delivers the service.
International execution also looks healthy. Q1 FY2027 revenue mix was 66% U.S. and 34% international, with EMEA and overall international growth accelerating compared with Q4. For a security platform, international scale matters because threat environments are global while enterprise budgets are often regionally diversified.
Capital allocation has become more active. In Q1, CrowdStrike repurchased $176M of shares at an average price of $365.63 pre-split and still had about $1.3B remaining under its authorization. The company also announced a 4-for-1 stock split, with record date June 25, 2026 and split-adjusted trading beginning July 2, 2026. The split changes optics, not value, but the buyback is more meaningful because it signals management is willing to return capital while still funding growth.
CrowdStrike operates in one of the better parts of enterprise software: cybersecurity with a strong cloud and AI overlay. Gartner said enterprise spending on cybersecurity software and network security will grow 14% in 2025 to $118.5B, with demand driven by GenAI security, cloud adoption, and SASE. CrowdStrike’s own TAM framing is even larger, with a CY26 TAM of $140B expanding to $300B by CY30 across endpoint security, security and IT ops, managed services, observability, cloud security, identity protection, threat intelligence, data protection, and cybersecurity generative AI.
That TAM expansion is not just a marketing exercise. It lines up with the company’s recent traction in cloud, SIEM, identity, and AI security. Management said combined cloud, next-gen identity, and next-gen SIEM now exceed $2B in ending ARR, while AIDR is scaling rapidly from a small base. This is how a successful software platform extends its runway: it uses one installed base to attack adjacent budgets.
The broader software backdrop also helps. Gartner said the enterprise application software market will reach roughly $690B-$722B by 2029, with AI integration and platform consolidation reshaping vendor standings. CrowdStrike fits both trends. It is leaning into AI-native security while also selling consolidation. That combination is powerful because CFOs like fewer vendors and CISOs like better visibility. It is one of the rare cases where the budget owner and the operator can both nod at the same slide.
Like what you're reading?
Get full access to AI-powered research reports, market analysis, and portfolio tools.
CrowdStrike serves a broad enterprise and upper-midmarket customer base. Management said nearly 100,000 businesses trust the platform, including hundreds of the Fortune 500. The customer profile spans government, healthcare, manufacturing, retail, financial services, and AI-native companies. Recent examples from management commentary included an 8-figure new-logo win at a major U.S. government agency covering more than 200,000 hosts, an 8-figure next-gen SIEM win at a major fuel retailer, and a 7-figure identity expansion at a major American healthcare company.
The common thread is complexity. CrowdStrike tends to win where customers need to replace multiple point products, secure large endpoint fleets, or build a more unified security operations stack. That profile supports larger deal sizes and better module expansion. It also helps explain why Falcon Flex is working. Customers with broad, messy environments are often more willing to commit to platform spending if it reduces tool sprawl and procurement friction.
Retention data also points to a sticky customer base. CrowdStrike previously disclosed 97% gross retention, and management highlighted strong gross and net retention rates again in Q1 FY2027. Module adoption reinforces that stickiness. Once a customer uses 6, 7, or 8 modules on one platform, switching becomes less like changing a vendor and more like rewiring a building while the lights are still on.
CrowdStrike competes against large platform vendors and specialists. The closest strategic rivals are Microsoft, Palo Alto Networks(PANW), and SentinelOne(S). Microsoft is the most obvious structural threat because it can bundle security into broader enterprise agreements. Palo Alto is a direct platform competitor across cloud security and security operations. SentinelOne remains a direct endpoint and XDR rival. Other relevant names include Fortinet(FTNT), Cisco(CSCO) and Splunk in SIEM, Elastic(ESTC), Wiz in cloud security, and legacy endpoint vendors such as Symantec, Trellix, and Carbon Black.
CrowdStrike’s advantage is not that it has no competition. It is that it has a coherent platform story with measurable cross-sell. The single-agent architecture, rising module adoption, and Flex model all support that. Management also claims performance and price superiority in next-gen SIEM and cited a major fuel retailer replacing a legacy SIEM, a next-gen EDR, and software from a network security hardware vendor. That is the kind of displacement story investors want to see because it shows CrowdStrike can take share from both old and new rivals.
The main competitive risk is bundling pressure. Microsoft can trade margin for distribution in ways most standalone vendors cannot. CrowdStrike’s own filings warn that competitors can offer integrated products or overlap Falcon features. That means the company must keep proving that best-of-breed outcomes and platform efficiency justify a premium price. So far, the ARR and module data say it is doing that. The valuation says the market expects it to keep doing that for a long time.
Cybersecurity demand is shaped by macro conditions, but not in the same way as most software categories. Budgets can tighten, yet breach risk does not take a quarter off. In CrowdStrike’s case, the macro backdrop has two favorable elements. First, Gartner expects cybersecurity software and network security spending to grow 14% in 2025. Second, AI adoption is creating new attack surfaces across endpoints, identities, cloud environments, and agentic workflows. Management tied its raised FY2027 ARR outlook directly to that shift.
Geopolitics also supports demand. CrowdStrike’s products are used to defend enterprises, governments, and critical infrastructure against increasingly sophisticated attacks. Management explicitly linked AI-enabled threats to enterprise survival, nation-state continuity, and critical infrastructure operations. That language is dramatic, but the spending pattern behind it is practical: when the threat surface expands, security budgets tend to migrate toward vendors that can consolidate controls and respond in real time.
The main macro risk is not lack of demand. It is valuation compression if rates stay higher or growth stocks fall out of favor. A company trading at 38.0x EV/revenue and 158.7x forward earnings does not need bad business results to produce weak stock returns. It just needs investors to decide that future growth deserves a smaller multiple.
CrowdStrike ended Q1 FY2027 with $4.31B in cash and investments against $740.3M of debt, leaving a net cash position that supports flexibility.
Unlock the full analysis
Premium members get the complete breakdown — pick rationale, financial metrics, and recent earnings detail.
Get Full Access →Revenue rose 26% year over year to $1.3856B in Q1 FY2027, while non-GAAP subscription gross margin held at 81% and free cash flow hit a record $468.5M.
Unlock the full analysis
Premium members get the complete breakdown — pick rationale, financial metrics, and recent earnings detail.
Get Full Access →Management raised FY2027 revenue guidance to $5.9147B-$5.9587B and non-GAAP EPS to $4.88-$4.96, signaling continued double-digit growth and margin expansion.
Unlock the full analysis
Premium members get the complete breakdown — pick rationale, financial metrics, and recent earnings detail.
Get Full Access →At 158.7x forward earnings and 38.0x EV/revenue, CrowdStrike trades at a premium that already assumes near-perfect execution.
Unlock the full analysis
Premium members get the complete breakdown — pick rationale, financial metrics, and recent earnings detail.
Get Full Access →The report’s fair value sits at $185, below the recent market price and under the $179.69 analyst consensus target only slightly, reinforcing a Hold stance.
Unlock the full analysis
Premium members get the complete breakdown — pick rationale, financial metrics, and recent earnings detail.
Get Full Access →CrowdStrike(CRWD) has built one of the most compelling platforms in cybersecurity. The company is growing revenue at 26%, compounding ARR above $5.5B, producing record free cash flow, and widening its reach into cloud, identity, SIEM, and AI security. The balance sheet is strong, customer expansion is healthy, and management has credible evidence that AI adoption is creating fresh demand rather than just fresh buzzwords.
The investment debate is not about whether CrowdStrike is a high-quality business. It is. The debate is whether the stock offers enough return from here to justify the risk. For a balanced investor with a medium-term horizon, the answer is not a clean yes at elevated prices. CrowdStrike deserves a place on the watchlist and, for existing holders, a place in the portfolio. It just does not deserve blind enthusiasm. Great businesses still need disciplined entry points.
Get AI-powered research reports, daily market intelligence, and a personal analyst in your pocket.
Get Full Access →Not ready to subscribe? ·
Cancel anytime
CrowdStrike Holdings, Inc. (CRWD) rises after UBS raised its price target and cited AI-driven growth in cybersecurity demand. The stock also has support from recent earnings beats and a string of bullish analyst calls, though its premium valuation and lighter relative volume suggest caution for new buyers.
CrowdStrike’s 5.7% drop looks far more like a multiple tantrum than evidence the business is slipping. The platform keeps widening across SIEM, browser, cloud, identity, and AI security, while growth and market leadership signals remain intact.
CrowdStrike Holdings, Inc. (CRWD) crashes in after-hours trading, but the move is tied to a 4-for-1 stock split rather than a business breakdown. The cybersecurity leader remains fundamentally strong, with recent earnings beats, bullish analyst targets, and a premium valuation still driving investor debate.