CrowdStrike Holdings Inc Aktie

Hello, and welcome to CrowdStrike's Fiscal First Quarter 2027 Financial Results Conference Call. [Operator Instructions] Please be advised that today's conference is being recorded.

I would now like to hand the call over to Andy Nowinski, Vice President of Investor Relations and Strategic Finance. Andy, please go ahead.

Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, Chief Executive Officer and Founder of CrowdStrike; and Burt Podbere, Chief Financial Officer.

Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives growth, including projections and expected performance, including our outlook for the second quarter and fiscal year 2027 and any assumptions for fiscal periods beyond that are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise.

Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the company's annual and quarterly reports.

Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today.

With that, I will now turn the call over to George.

Thank you, Andy, and thank you for joining CrowdStrike's Q1 FY '27 Earnings Call. We started our fiscal year in an environment where cybersecurity has dramatically risen in organizational visibility and funding priority. CrowdStrike is now being understood as critical AI infrastructure. Frontier AI Lab started a new chapter in the AI revolution. New model releases starting in April, connected AI innovation with cybersecurity necessity. CrowdStrike was the only cybersecurity company selected by both Anthropic and OpenAI from the very start to secure these new models, their adoption and the new risk they create.

Today, AI adoption is not a nice to have, it's an existential imperative across every geography and vertical. The more AI an organization adopts the more cybersecurity it requires. In this new agentic era, we're now guiding net new ARR acceleration for the full year. Q1 highlights included: one, record Q1 net new ARR of $256 million up 32% year-over-year and exceeding the high end of our guidance; two, ending ARR of $5.51 billion, accelerating over our record Q4 and more than 24% growth; three, total revenue of $1.39 billion, up 26% year-over-year, beating guidance and accelerating for the fourth consecutive quarter; four, all-time record free cash flow of $468 million or 34% of revenue, exceeding our expectations, our free cash flow Rule of 40 was 59 increasing for the fourth consecutive quarter.

Five, record Q1 operating income of $326 million or 24% of revenue, up 62% year-over-year, exceeding guidance; and six, we added over 300 Falcon Flex accounts in the quarter with accounts that have adopted this subscription model reaching more than $1.9 billion in ending ARR growing 99% year-over-year. These data points illustrate momentum, traction and achievement. It's on the backs of our strong Q1 results and the unprecedented market dynamics I see that we are raising our growth expectations for the full year net new ARR by more than 500 basis points.

For the full year, we now expect net new ARR growth to accelerate over FY '26. What I see is AI driving structural demand for cybersecurity that compounds not decelerate. The AI enterprise unfolding in real time and CrowdStrike is a necessity to secure it. AI's technology progression has unfolded in waves. Wave 1 of AI adoption was about making information rapidly accessible and foreshadowing the power of reasoning using existing data points to connect new dots. Wave 2 of AI adoption started with the agent, transforming what was once a basic web experience into a rich connected and human-like digital worker. Agents became a major unlock moment for the enterprise, opening the door to productivity gains and augmentation of human workers. The concept of the Agentic workforce was born and for the first time, enterprises could start pointing to economic value creation and newfound outputs from the AI revolution.

This brings us to Q1 right in the middle of Wave 2, the wave of agent creation. In April of Q1, more happened in a matter of weeks in cybersecurity than in the whole year prior, the Mythos inflection moment. In collaboration with Anthropic from the start, we saw a new model emerge that had relevance for the cybersecurity market, relevance for defenders in identifying vulnerabilities much faster than before, including the chaining of multiple vulnerabilities to create lethal cyber attacks. Project Glasswing brought together CrowdStrike and a focused group of consequential companies to ensure market readiness for Anthropics new model.

Shortly thereafter, OpenAI announced GPT 5.5 cyber later known as Daybreak, where we were selected as a founding member of their trusted access for cyber program. CrowdStrike is the only cybersecurity company to secure both Anthoropic and OpenAI's introduction programs from the very start. What the Mythos moment proved is that the world, starting from the Frontier AI labs themselves realize that AI needs a cybersecurity ecosystem. This was a Mythos inflection point. The discussion evolved from is AI going to disrupt cybersecurity to organizations and even the Frontier AI labs relying on Falcon as their AI-powered Defender for the post Mythos era. Even more consequential is how adversaries can use these new and future models to democratize destruction.

Now any human or agent can be a [indiscernible] or worse wage serious cyberattacks that threatened enterprise survival, nation-state continuity and critical infrastructure operations. AI has now directly entered the world of cybersecurity across 2 dimensions. One, you need cybersecurity to secure AI itself, deploying AI across the enterprise is simply too risky without cybersecurity from the start. Cybersecurity is now foundational AI infrastructure; and two, an explosion in greenfield attack surfaces each of which needs cybersecurity. The AI revolution has led to a boom in one, hardware, GPUs, MPUs, GPUs and training chips; two, data centers and hyperscalers, training and housing AI models; three, neo-cloud, a whole new class of cloud focusing on inference; four, token factories, we're seeing unprecedented eye-watering demand for Anthropic and OpenAI; and five, agentic applications a whole new class of identic tools such as Cursor, Sierra, [ 11 Labs, Exa, Lagora ] and more.

The inflection point is that every player in this value chain is experiencing hypergrowth in every one of these technologies need cybersecurity. The Mythos moment crystallize the reality for the market and for the first time in my career, the market's view of cybersecurities role has shifted from being viewed primarily through the lens of risk management, compliance and protection to being recognized as a strategic accelerator and a critical enabler of AI adoption.

Here's how we're seeing this shift manifest across our ecosystem, customers and business. As soon as Project Glasswing and Mythos were announced, a deluge of customer prospect and partner inquiries followed. Post Mythos threat landscape readiness reached a fever pitch with the primary question being, is my organization protected. The immediate focus turned to uncovering and remediating vulnerability susceptible to being weaponized by new models. Answering this question across tens of thousands of organizations created an opportunity to showcase the power of our platform and ecosystem. Within days of Anthropic's Project Glasswing and open AI [ TAC ], we announced Project [ Quito ] to unite and mobilize the industry around Mythos readiness. Footworks is a phased process of vulnerability discovery, prioritization, remediation and then executive communication, [indiscernible] protected conversations at executive and Board levels quickly became opportunities to leapfrog legacy point-in-time vulnerability discovery. The answer became real-time, continuous discovery and remediation.

This conversation plays right into the strength of Falcon's continuous exposure management solution and Falcon for IT, both of which saw adoption nearly double year-over-year in the quarter. We saw immediate interest from our ecosystem to join our coalition. After the announcement of Project [ Quite Works ] Accenture, EY, IBM, Kroll and OpenAI joined us to use the latest OpenAI and Anthropic models for [ Quote Works ] engagements. And a few weeks later, we expanded the coalition to include [ Armin, Cognizant , HCL check ], Infosys, KPMG, NTT Data, Tata Consultancy Services and WiPro and more recently, insurers such as Coalition, Liberty Mutual Insurance, [ Lockton Resilience ] and [ Marsh ] joined the coalition to start underwriting Frontier AI model risk to the enterprises they serve.

[ Quote Works ] engagements include EY engaged with a Fortune 100 account and uncovered more than 45 million vulnerabilities, leveraging Falcon Exposure Management and Frontier models, and the engagement is also accelerating Next-Gen SIEM adoption within this account. Kroll, who recently replaced their incumbent next-gen endpoint vendor with CrowdStrike brought us into a clothing manufacturer, which is becoming a new logo account on the back of a [ Quote Works ] assessment. [ QuoteWorks ] is how we're preparing the market for cybersecurity's Y2K moment with CrowdStrike as the key security control for AI deployment. Footworks and the AI accelerated demand environment are delivering growth across the business.

In Q1, we delivered innovation and saw a pronounced demand across the following platform modules. First, endpoint, our endpoint business again accelerated for the third consecutive quarter, the endpoint has become the epicenter of where AI happens and our best-in-class efficacy sets us apart. The rapid adoption of AI tools like [ Quad Cowork ] and codecs have dramatically expanded the endpoint attack surface. Our endpoint leadership continues to widen with Gartner naming as a leader for the seventh consecutive year and storing us the very highest both axis of the Magic Quadrant, ahead of all other participants for the fourth year in a row.

Today, we're seeing 2 new phenomena on the endpoint. First, AI's rapid evolution has created renewed enterprise focus on endpoint security investment. Second, nonhuman identities and agents require their own underlying host, creating greenfield demand for sensors, we're already seeing companies deploying agentic workloads inside virtual machines, each requiring its own sensor. Illustrating this was an 8-figure new logo land in a major U.S. government agency. We replaced a legacy AV and operating system EDR and a legacy vulnerability management point product across more than 200,000 hosts, and that unlocks what's next.

We pioneered EDR. We have the endpoint real estate, and that gives us the structural advantage to own what we're bringing to the market, AIDR, AI detection and response. AIDR is quickly becoming a new growth pillar in our business with ending ARR growing more than 250% sequentially and Q2 pipeline already exceeding $50 million. We went from 0 to this in under 2 quarters. In my career, I've never seen adoption happen this fast. As I look forward, I see AIDR as a larger opportunity than EDR. Here's why.

First, our structural advantage. We built EDR because the endpoint is where attacks execute, and you need a sensor there to see them. The same is true for AI. Agents run on the end point. They make tool calls, access files in both APIs and move data at the process level to detect and respond to AI threats in real time, you need a runtime sensor where AI executes. That's Falcon. While competitors may provide AI visibility, only CrowdStrike can detect, block and respond where AI actually runs, the pattern that made EDRs repeats.

Second, the AIDR market opportunity is structurally larger. EDR secured one attack surface, the host. AIDR secures 7 data, models, prompts, agents, identities, infrastructure and the interaction layer where they converge. Worldwide spending on AI is forecasted to total over $2.5 trillion and only a low single-digit percent of organizations have an advanced AI security strategy. The gap between AI adoption and AI protection is the widest asymmetry in security since the cloud transition, and it's moving faster. We're already converting the demand and automotive financial services leader added AIDR to more than 30,000 hosts for shadow AI visibility and protection in a 7-figure win, greenfield opportunity, seamless upsell, same sensor.

Moving to Next-Gen SIEM, Cloud and Identity. We saw a record Q1 net new ARR from the combination of these businesses. Combined, these businesses have now exceeded $2 billion in ending ARR. Our Next-Gen SIEM business exceeded $600 million in ending ARR and has transformed CrowdStrike into the operating system of the AI SOC. Charlotte AI, where ending ARR accelerated sequentially over Q4 is now the reasoning engine across Falcon. Triaging alerts, correlating cross-domain telemetry and automating investigation at machine speed. This quarter, we expanded that vision with [indiscernible] Works, our ecosystem of purpose-built AI agents built on the Falcon platform. Partners, including Accenture, AWS, Anthropic, Deloitte, NVIDIA, OpenAI and Salesforce are building specialized security agents that operate natively on Falcon data. The result of security operations center that runs at AI speed, orchestrated by Charlotte extended by the ecosystem and grounded in the richest telemetry in the industry.

A key Next-Gen SIEM win was an 8-figure new logo land in a major fuel retailer. CrowdStrike was selected to replace a legacy SIM, a next-gen EDR and stitch together software from a network security hardware vendor. The performance and price superiority of Next-Gen SIEM, combined with Charlotte AI's autonomous triage eliminates swivel chair alert management successfully starting this customer's AI SOC journey. Cloud had another strong quarter as enterprises continue securing their AI infrastructure. concern around elevated risk from new frontier models has pushed customers to harden their cloud environment. An 8-figure win in a high-performance AI chip company allowed this customer to secure the rapidly expanding Kubernetes managed data center and cloud environments in the wake of the AI boom.

Next-Gen Identity net new ARR growth accelerated versus Q4. In the AI era, every agent needs an identity, every identity needs governance and every enterprise is realizing they can't tell a human from machine in their environment. Falcon Shield had another stellar quarter with ending ARR growing nearly 4x year-over-year as organizations secure their SaaS agentic attack surface. Our recently acquired Signal Solution and our fast-growing privileged access offering are boasting strong early demand as enterprises lock down what agents can do and access. A major American health care company selected Falcon Next-Gen Identity and Signal in a 7-figure expansion to solve a problem that simply didn't exist 2 years ago, governing what AI agents can and cannot do across the enterprise.

Signal delivers granular, policy-based authorization over agentic workloads in real time. This is the identity opportunity in the AI era. Falcon Flex is how we go to market. with accounts that have adopted the subscription model rapidly approaching $2 billion in ending ARR. The most exciting part is the re-flex dynamic customers renewing and expanding their investment beyond their first Flex contract with highlights including the number of re-Flex customers reached 480, representing nearly 25% of all Flex customers. The average re-Flex uplift was 26% with the average re-Flex happening in 7 months, well ahead of their subscription renewal date and the most compelling over 130 customers have re-Flex multiple times with the average ARR uplift over their original Flex coming in at 51%.

Customers are coming back multiple times and they're continuously spending more, consolidating on CrowdStrike. This is the power of the platform in action. To secure AI organizations need the Falcon platform to deliver the platform you need the right go-to-market model. Flex is the commercial harness to drive secure AI adoption.

In closing, I'm proud of the start of our year. Q1 was another beat and as the quarter progressed, we saw the Mythos inflection point. The world of cybersecurity and Frontier AI collided. The result is that Frontier AI needs the very best defender and that's CrowdStrike. The inflection is now the need for cybersecurity to defend AI is nonnegotiable. CrowdStrike is not only in the right place at the right time, we're the right technology to stop the breach. Think of CrowdStrike as the picks and shovels for the world's largest technology gold rush of all time.

CrowdStrike is in the prime position to be the world's AI security layer with nearly 100,000 businesses, including hundreds of the Fortune 500 already trusting us to secure their organizations. Our ecosystem of thousands of partners are looking to us the answers on how to secure AI at global scale. This is even bigger than customers and partners. The market's very best AI talent seeks out CrowdStrike to join our mission. I'm excited to announce [ Dr. Bartley Richardson ] joins my leadership team as Chief AI and Autonomous System Officer. He joins CrowdStrike from a long-time strategic partner, NVIDIA, where he led agentic AI and cybersecurity AI. [ Bartley ] deepens our NVIDIA collaboration and furthers our verticalization of AI into cybersecurity. The best AI talent in the world is choosing to build at CrowdStrike.

In this inflection moment, I see CrowdStrike's opportunity larger than ever before. The technology is here, the talent is here and the market opportunity is here. We're raising our full year net new ARR guidance by more than $50 million. We now expect full year net new ARR growth to accelerate over last year. At $5.5 billion in ending ARR, we are accelerating. We see this as the AI tailwind in action.

Given the strength of this quarter and our confidence in what's ahead, I'm announcing CrowdStrike's first dock split as a public company. We'll be doing a 4-for-1 stock split making CrowdStrike more accessible for investors to join our mission. Cybersecurity isn't a nice to have in the world of AI. It's a need to have. And CrowdStrike is the innovator of choice, the partner of choice and the protector of choice for this new accelerated AI world. Thank you for your trust.

I'll now turn the call over to Burt Podbere, our CFO.

Thank you, George, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers except revenue mentioned during my remarks today are non-GAAP.

We delivered strong first quarter results to begin the new fiscal year, exceeding expectations across all guided metrics. We achieved record Q1 net new ARR of $255.8 million, up 32% year-over-year driving ending ARR to $5.51 billion, accelerating growth to more than 24% year-over-year. As George outlined, the Mythos moment marked an inflection point for the industry, confirming that cybersecurity is not just foundational to AI adoption, it is critical AI infrastructure.

Our Q1 results and FY '27 outlook reflect the very beginnings of this technology wave with broad-based momentum fueled by customers consolidating their security needs, lowering their total cost of ownership and accelerating AI adoption with CrowdStrike as their security foundation. This strength is reflected in our continued strong retention rates, increased module adoption, third consecutive quarter of ending ARR growth acceleration for the endpoint business and Q2 record pipeline. Additionally, we closed the acquisitions of Signal and [ Surafic ] in the first quarter, contributing a combined $7.8 million of acquired net new ARR, which was within our stated expectations of $5 million to $8 million.

Moving to the P&L. Total revenue exceeded our guidance range and grew 26% over Q1 of last year to reach $1.39 billion, with year-over-year growth accelerating sequentially for the fourth consecutive quarter. Subscription revenue grew 26% over Q1 of last year to reach $1.32 billion, and professional services revenue remained strong at $64.8 million up 23% year-over-year, driven by the elevated threat environment. The geographic mix of first quarter revenue consisted of approximately 66% from the U.S. and 34% from international geographies with EMEA and overall international year-over-year revenue growth accelerating compared to Q4.

Total non-GAAP gross margin was our Q1 record 79% and non-GAAP subscription gross margin was a Q1 record 81% of revenue, up 90 basis points over the prior year driven by continued cloud optimization. First quarter non-GAAP operating income was a Q1 record $325.7 million, and non-GAAP operating margin was 24% up 530 basis points over the prior year and exceeding our guidance. The outperformance was driven by our strong top line performance gross margin improvement and increased operating efficiency, underscoring our commitment to durable profitable growth.

In Q1, we once again delivered positive GAAP net income attributable to CrowdStrike of $27.8 million. Non-GAAP net income attributable to CrowdStrike was a Q1 record $283.4 million or $1.10 on a diluted per share basis, exceeding our guidance.

Moving to cash. Our cash and cash equivalents were $4.55 billion. We generated record cash flow from operations of $590.9 million and record free cash flow of $468.5 million or 34% of revenue. In Q1, we repurchased $176 million of shares outstanding at an average price of $365.63. We now have approximately $1.3 billion remaining under our share repurchase authorization. We will remain opportunistic in returning capital to shareholders as we remain focused on capturing the significant growth opportunities ahead of us.

Finally, as George mentioned, we are announcing a [ 4:1 ] forward stock split to make ownership of CrowdStrike stock more accessible to investors. Stockholders of record after the close of market on June 25, 2026 we'll receive an additional 3 shares of common stock for every 1 share held after the close of market on July 1, 2026, with trading on a split-adjusted basis expected to commence at market open on July 2, 2026.

Moving to our outlook and modeling notes. Our record Q2 pipeline and strong momentum across competitive displacements Falcon Flex adoption and platform consolidation give us conviction in the durability of CrowdStrike's growth trajectory, profitability expansion and cash flow generation. As George outlined, AI adoption has become an existential imperative, and it requires cybersecurity. CrowdStrike provides critical infrastructure that enterprises need to adopt AI safely and at scale. Our broad business momentum and the accelerating AI tailwind we see are reflected in our raised FY '27 outlook.

We now expect FY '27 net new ARR growth to accelerate over FY '26 with year-over-year growth of 27.7% at the midpoint, a 520 basis point increase in year-over-year growth from our prior guidance translating to an increase of $52 million to $1.291 billion of net new ARR. Given our Q1 net new ARR outperformance and increased outlook for the full fiscal year, we now expect FY '27 net new ARR seasonality to be approximately 42% in the first half and 58% in the second half.

Moving to cash. At the midpoint of our guidance, we expect free cash flow margin of 24.5% in Q2, our seasonally lowest free cash flow quarter and continue to expect at least 30% for the full fiscal year on our increased revenue guidance. As a result of our outperformance in Q1, we now expect the seasonal mix of free cash flow dollars between the first and second half to be 46% in the first half and 54% in the second half.

For the second quarter of FY '27, we expect annual recurring revenue to be in the range of $5.793 billion to $5.795 billion, reflecting a year-over-year growth rate of 24% translating to net new ARR of $284 million to $286 million, reflecting a year-over-year growth rate of 28% to 29%. We expect total revenue to be in the range of $1.436 billion to $1.442 billion, reflecting a year-over-year growth rate of 23%. We expect non-GAAP income from operations to be in the range of $346 million to $349 million and non-GAAP net income attributable to CrowdStrike to be in the range of $301 million to $303 million. We expect diluted non-GAAP net income per share attributable to CrowdStrike to be approximately $1.16 to $1.17 utilizing a 21% tax rate and weighted average share count of approximately 258 million shares on a diluted basis.

Adjusted for the stock split, we expect diluted non-GAAP net income per share attributable to CrowdStrike to be approximately $0.29, utilizing a weighted average share count of approximately 1.034 billion shares on a diluted basis.

For the full fiscal year 2027, we expect annual recurring revenue to be in the range of $6.532 billion to $6.556 billion, reflecting a year-over-year growth rate of 24% to 25% and translating to net new ARR of $1.279 billion to $1.303 billion reflecting a year-over-year growth rate of 27% to 29%. We expect total revenue to be in the range of $5.915 billion to $5.959 billion reflecting growth rate of 23% to 24% over the prior fiscal year. Non-GAAP income from operations is expected to be between $1.452 billion and $1.480 billion. We expect non-GAAP net income attributable to CrowdStrike to be between $1.263 billion and $1.285 billion. Utilizing a 21% tax rate and approximately 259 million weighted average shares on a diluted basis we expect non-GAAP net income per share attributable to CrowdStrike to be in the range of $4.88 to $4.96. Adjusted for the stock split, we expect diluted non-GAAP net income per share attributable to CrowdStrike to be approximately $1.22 to $1.24 utilizing a weighted average share count of approximately 1.036 billion shares on a diluted basis.

George and I will now take your questions.

[Operator Instructions] Our first question comes from Meta Marshall with Morgan Stanley.

Great. George and Burt, you noted a lot of tailwinds for the business as customers invest in AI. Can you just unpack which of those are the biggest near-term drivers that prompted you to meaningfully raise the net new ARR guidance for both Q2 and the full fiscal year?

Sure. Thanks, Meta. The first we drive demand for us in terms of the tailwinds of the AI tailwinds that George talked about in his prepared remarks. But then you look into other things that really give us confidence in terms of raising the guide. One is basically the strong module adoption rates that we have, the strong gross and net retention rates that we have. And of course, our strong Q2 record Q2 pipeline. And then you can throw in the Mythos moment, which created an inflection point around ARR for our business. So you combine all those things that gave us confidence for both the Q2 guide as well as the full year guide.

Our next question will come from Saket Kalia with Barclays.

Okay. Great. Great to see the raised net new ARR for the year. George, maybe for you related to that point, can you just give us a little bit of color on when you started to see that inflection in demand related to what I think we called the ethos moment. I'm curious how it's sort of unfolded here from a timing perspective?

Yes. Thanks, Saket. It actually started RSA just at the end of March, which is slightly before Mythos. And every meeting that we had with customers was all about protecting AI and providing visibility into things like shadow AI. We talked about the inflection point in endpoint and the acceleration. And obviously, there's a lot of customers that want to deploy more but they're actually being held back because they don't have the right visibility, security controls around everything from identity to data protection to MCP type services. So every meeting was literally the same meeting all over on help us protect these AI workloads that are running on the endpoints. And all the developers are running it, marketing is running it, accounting is running it. We heard just crazy stories about AI run amok.

And the biggest thing for me when I ask what outcome the customer is looking for. It wasn't a technology outcome per se, it was we need to solve the security issue because we want to deploy AI faster. We want to go faster in our business, and our CEO is demanding the adoption of AI. We can't do it securely. So that was a kind of a lifeful moment, obviously, or an inflection point in RSA. And then you combine that with Mythos in April. And I mean the -- literally, the thousands of interactions that we've had with customers on Mythos and briefings and our project [ Footworks ] has been incredible. So you kind of put all that together, and you've got a real inflection point in the market.

Your next question will come from Brian Essex with JPMorgan.

Thanks, everyone. Likewise, great to see the pretty impressive net new ARR increase in recent guide. George, would love to pick your brain a little bit. We've been hearing that security has been gaining budgets outside of traditional IT and security budgets, maybe around RSA. And then after Mythos release, was released. It seems as though we have a bit of panic spending, which we're seeing a lot in the consulting industry, and it sounds like everyone is seeing it in their pipeline.

But would love your sense of where the money is -- where do you think the money is coming from? How much of the current AI tailwind might be incremental security spend? And how much is maybe a reallocation of existing budgets towards vendors perceived as more AI native and where is the money coming from within, what I would imagine are relatively set budgets for the year?

Yes. I think you have to look at just a crazy inflection point in the adoption of frontier type models, right? And we've all seen the revenue curves with the big players that are out there. So we're tending to follow the slope of that adoption curve. And the token spend has been just jaw dropping. And when you have that level of adoption, you're going to have incremental funding around security. I think if we look at this realistically 2 years ago, there wasn't these big token budgets, right? All of a sudden there is and people are finding money and it's incremental, and they need to adopt more of it. We have plenty of companies that are tracking token usage not only from the spend standpoint of what are they spending, but they want to know who's spending it, are they spending it enough? Are they going fast enough.

So we've seen it being incremental. And at the end of the day, getting back to something I've said time and time again. If you want to create AI, you need GPUs, if you want to use AI, you need security, and that's what we're finding.

Your next question will come from Gabriela Borges with Goldman Sachs.

George and Burt, I want to ask you a little bit about the modules in your business where you price based on consumption. I think there might be a little bit of that in your Next-Gen SIEM business maybe in the cloud business as well. What I want to ask you is, are you seeing a change in or a step function change in the amount of ingestion, data injection, cloud workloads, that sort of dynamic either because of agentic activity or because perhaps the amount of agentic threats that customers have to deal with has gone up in the SOC. And I'm wondering because of the structural advantages you have on the cost and performance side in Next-Gen SIEM, can that now create an additional motion for you to have success in the Next-Gen SIEM product.

Well, when we think about the agentic world, it's all about data, and that's been a foundational element of CrowdStrike since my starting of the company. If you have the right amount of data, you can sell most security use cases. And in today's world, it's all about creating data, using that data for training, instrumenting the agentic SOC. And that's why we've seen incredible adoption in our Next-Gen SIEM. We've seen workloads increase in the cloud. We've seen companies where in the past, they may not have put as much data into their SIEM just because of a legacy provider and sort of the cost model.

And given the disruptive nature of our SIM pricing, it's all part of our platform, and we're really charging for third-party ingest, it's been a real win for customers. So we're seeing more and more adoption broader and we're able to cover use cases that weren't covered in the past just given sort of the economics of how we go market with it. So I think there'll be more tailwinds. And again, there are a lot of customers now that are using that data with our own AI agents that we provide on the platform, and they're getting incredible outcomes. So the data gravity and the data moat that we talk about is obviously here. It's been here, and it's only getting bigger given the nature of AI.

Your next question will come from Matthew Hedberg with RBC.

George, you mentioned your Script Cloud Security had another strong quarter. I guess I'm curious with the rise in AI demand, how is cloud security impacted by AI? And what are you seeing in terms of either competitive displacements or win rates in the segment?

Well, yes, it's a good question. And when you think about cloud security for a long time, it was about posture management. In the AI world, it's really about runtime protection and control because you're seeing out these AI workloads being hosted in the cloud, right? And these containers that have agents that are long-running agents, right? And they're being spun up with a certain level of control, and they need the run time enforcement that we bring to it, which is a real strategic advantage for us. So that has certainly played into our favor.

And then you combine that with the ability to understand sort of SaaS posture for cloud providers and some of the attack vectors around those SaaS providers. It's been just a very I would say, a bright spot for us given the full nature of the cloud stack that we've been building over many years.

Your next question comes from Rob Owens with Piper Sandler.

Great. Andy, thanks for the question, George and Burt. George, another seminal cyber event here in our careers, but definitely probably lending to a greater step function than we've seen historically in terms of the opportunity. And so given the events of the last couple of months, how are you thinking about your business in general and where you might lean in to take advantage of it? Obviously, you've been building out the product set. But given the greater sense of urgency? Are there things you're contemplating from packaging, pricing, further M&A to really go after this opportunity is seemingly is exploding from a demand perspective.

Well, I guess, I mean, I'll start with the Flex model itself, and it's something that we put in for a few years now, and we're all seeing the benefits of the Flex model in terms of taking advantage of helping customers in these Mythos moments. There are many technologies that are rapidly evolving in an enterprise, and they all need protection. A lot of them obviously is sent around AI.

I think we've done a good job from an acquisition perspective. I think we've been very strategic in getting companies that fit within our portfolio. Again, we spent a lot of time on the integration, which is something customers recognize and reward us for and will continue to be acquisitive. We're always looking at companies. Again, we tend to buy tech and great teams and spend a lot of time on the integration. But I think there's just a lot of areas in AI that are rapidly emerging and we continue to monitor that market, and we'll continue to build it organically as we have.

And inorganically as we round out the entire portfolio, specifically in that area. You've got data protection. We continue to invest in those areas. You've got Falcon for IT. We've seen just incredible progress in replacing some of the larger incumbents in that market. So where we need to, we'll augment that with acquisitions, and we continue to be a company that drives innovation organically as well.

Your next question will come from Josh Tilton with Wolfe.

George, maybe for you, I thought it was very interesting in the prepared remarks. You mentioned how things were just moving so fast in the month of April. I'm just trying to understand, was there any delayed spending or decision-making that maybe changed the net new ARR seasonality relative to what you guys were initially thinking 90 days ago. And I'm just asking because I'm trying to reconcile the incredibly impressive raise and understandably so kind of to the beat that you saw in the quarter.

Well, I'll start and I'll turn it over to Burt. But as I mentioned earlier, you kind of look at March and RSA is a real inflection point. And you have to look at sort of the adoption of things like [ quad co ] just exploded. I mean I think everyone knows the numbers there, right? So seeing this massive adoption very quickly of AI agents, and that really kind of took place, I think, in earnest towards the end of March. And then the Mythos moment was in April and then obviously, just incredible demand from that standpoint that we saw. And obviously, you're seeing it in the forward guidance and the rate.

So Burt, do you want to add to that?

Yes. So for sure, I mean, all the things that George said, it all came down to just our record Q2 pipeline. That gave us the confidence as we looked out into the full year. It gave us confidence in terms of how we saw the business, the momentum in the business. And as I look at Q1, and I remark on Q1, I look at the 32% year-over-year growth rate for net new ARR. That's an impressive number.

Then you go to the cash, our record cash -- free cash flow and you look at our rule of 59, which is impressive at our scale. So you look at all those things combined, and that gives me confidence in terms of the raise that we looked at for the year.

Your next question will come from Joe Gallo with Jefferies.

I've got a 2 part on agentic identity. This is clearly a huge need that all CSOs know they have. But at the same time, companies aren't really deploying security there. What is causing that? And what's the catalyst that can revert that? And then just two, can you talk a little bit more about your product positioning in identity outside of ITDR, especially now with Signal in the fold and just the right to win that agentic identity market.

Yes. I mean we've been in the identity market in some segments since 2020. And we've built a great business there, one of the largest pure-play security identity businesses around. And what are we seeing? Well, obviously, with what we've built, the organic evolution of the products and now combined with Signal we've got an incredible opportunity in front of us. Just Signal alone, we've got customers who are using it for nonhuman identities and they're getting incredible results. And I met with a customer at RSA, became a 2-time customer. This particular gentleman left one company that was a Signal customer. And the first thing he did was to get Signal as next company, which we called out in the prepared remarks.

And I asked him, I said, "What do you like? What works? Why you hear so quickly for your second time around?" He said, "It would take him 2 weeks to get an identity up and running and now it takes them like 2 minutes." And the amount of just efficiencies that he was able to provide is incredible. And what we're seeing right now, and we're working with customers right now on this is using a Signal as the identity control plane combined with our AIDR. So we see a fantastic opportunity. And remember, we're not saddled with legacy technology and sort of patchwork of things that we have to deal with, with respect to sort of vaulting, right? Customers want a new, they want a fresh approach of 0 standing privileges and we have it, and it works in the agentic world. So we feel really good about this acquisition and our Identity business.

Your next question will come from Roger Boyd with UBS.

Great [indiscernible] for the question. George, I wanted to come back to AI detection response and a pretty impressive pipeline and color you provided on that product. From a higher perspective, relative to that $2.5 trillion forecast AI market, how are you thinking about the TAM for AIDR? And then a few months ago, it felt like this is a pretty early market. I guess can you talk about with these early deals what you're seeing from a competitive perspective? What's giving you the right to win here?

Yes. So Roger, I think when you look at this market now and the TAM, I think, is going to be very large. I called out in my prepared remarks, I think it's going to be larger than EDR. And the reason why I think that is from an EDR perspective, we're protecting machines and workloads and such. In the agentic world, on average, and this an industry stat, there will be 90 agents per employee. So when you look at all of those agents that need protection, this is what gives me confidence that it is going to be a bigger market than EDR. And why do we have a right to win? Well, we've pretty much created the EDR category. We're the #1 pure-play player in that category. And customers already have what they need. They already have the agent. They already have visibility into what's happening. And we've created some incredible advancements that gives like unparalleled visibility to what's happening at the agentic layer. And we're working with some of the biggest companies on the planet now.

In preview mode on some of this technology in addition to what we already have in the market. So as a leader in EDR, it is a natural evolution where customers have said, we need this to protect our agents, and we are there to meet them in the market. So for me, it's one of the most exciting times since when I started the company because it really is just an incredible moment to be in security. And given all of the fast-moving tailwinds of AI, I think we're perfectly positioned.

Your next question will come from Eric Heath with KeyBanc.

Can you hear me okay?

Yes.

George, as the security industry starts to embrace and leverage these frontier models to deliver products and services as you've done, do the pricing models need to move to more of a token-based pricing model? Just how do you see this evolving?

Well, it is an evolving market. And the great news is that Falcon Flex license already contemplates that. Remember, Flex is a commitment model, but it has the ability to use tokens, use credits, things of that nature. So I think we're in a great spot because we've done the hard work of getting these Falcon Flex licenses in place. We've got customers who already committed massive dollars to it.

And then as it evolves, we can easily add token consumption into the model. And that's certainly something that we may do in the future. But obviously, it's moving pretty quick and we want to make sure that we get it right. We want to make sure we meet customers where they want to be met where they've got a level of flexibility but also a level of certainty around the spend. And I think as a company, we've done a good job to help provide that to our customers, which is why you've seen the adoption around Flex.

Our next question will come from Fatima Boolani with Citi. Well, we'll go to our next caller, and we can check back in with Fatima. So our next question will come from John DiFucci with Guggenheim Securities.

Thank you. George, a question for you. You said the gap between AI adoption and AI protection is the widest asymmetry in security since the cloud transition. You also talked about an inflection in the market, which implies some incremental business, and that's your results look good, and that's reflected. But it seems like that's more about interest and intent and it sounds like we're still really early in this journey for enterprises.

So my question is, like, where are we in the actual adoption of AI in the enterprise. Our enterprise is still trying to figure out how to harness its power and stepping in lightly or are they actually really starting to deploy it broadly. And I guess, more importantly, as it pertains to CrowdStrike because I don't think they are necessarily going to be aligned where are enterprises in their journey of adoption of security for AI?

Well, yes, John, let's start from the top. It's still the early innings, as you might imagine, in AI adoption, but you have to look across an enterprise where they've gone deep very quickly, obviously, around developers first, and then they're moving into other areas. So depending on the industry, depending on the company. But certainly, in the developer world, just since January and the evolution of some of the models and the harnesses that they've created to actually get worked on, you've just seen incredible adoption very quickly. And that, like many other technology sort of inflection points, the adoption front runs the security piece of it. And that's why so many CSOs and CIOs CEOs are calling us saying, we need something to keep up with the adoption of security. We wanted of AI. We want to go faster, and we need something like CrowdStrike and AIDR. So we're still in the early innings.

The other thing I will point out, even when you look at our pipelines and the things that Burt talked about is the AI adoption isn't all enterprise-wide yet. And it's almost like the early days of EDR, where someone would adopt it in a division or geography or something. We're still in those early innings, and we're seeing incredible pipeline. So once it goes really mainstream and entire companies adopted across all of their employees and workloads, again, I think you're going to see just another incremental increase in opportunities there.

Your next question comes from Gregg Moskowitz with Mizuho.

George, as you know, the U.S. government just announced an executive order to upgrade systems for advanced AI, can you talk about the role that you expect CrowdStrike to play here? And then maybe for Burt, how, if at all, is this being reflected in your guidance?

Yes. So I mean, first, let me commend the administration for calling out the need for AI security. And I think the White House struck an appropriate balance here. And we're certainly excited and we'll continue to engage. We've been very active in D.C. We work very closely with various groups, administration, et cetera. And I think this is a good thing.

When you look at AI and how important it is for the future of the federal business and the security of the country, is something that you really have to get right. And I think the executive order will create a tailwind ultimately for businesses like CrowdStrike because these federal governments are going to need to expedite prioritize cyber defenses in a more modern way. And you have to keep in mind that when we think about this, cybersecurity is national security. And it's incredibly important, we're at the epicenter there, we will continue to engage, and we're happy to be part of those efforts as they unfold.

Your next question comes from [ Michael Turrin ] with Wells Fargo Securities.

I appreciate you taking the question. I want to go back to just the shape of what you're seeing and how it shows up in the model. The 1Q ARR was strong, but a bit closer to the guide, especially relative to how the full year numbers went up. So I know, George, you've mentioned the post Mythos moment multiple times. Maybe speak to the sequence of what you're expecting for rest of the year in terms of pipeline progression and Burt, maybe you can just also touch on how we should think about the visibility you have into the ARR guide for the rest of the year versus what would drive further upside?

Yes. So I'll start and turn it over to Burt. But when you look at AIDR, I mean, it's 250% quarter-over-quarter up with a $50 million-plus pipeline and that's only growing by the day. I mean the EB -- our executive briefing centers are full with companies that want to be talking about Mythos, how to protect AI. Every conversation, every rep, every -- you name it. And we've done a tremendous amount of executive and Board briefings because Mythos this is from the back room to the boardroom. I can tell you, CEO after CEO, who called their CISOs on the weekend saying, is this thing really a problem? What does it mean for us? How do we protect theirselves? What does it mean going forward? And it really is a Y2K moment for security. So that's -- we look at the upcoming year in the guidance and it reflects that sort of momentum that we've seen in the pipeline.

Yes, I think that's exactly right. So for us, again, we're getting that confidence from all the fundamentals in the business. We're getting the confidence from all the conversations we're having with our customers, what George talked about with the Mythos moment and there's not a conversation that isn't happening from our largest customers down to our smaller customers about how are we going to protect our AI.

Look, I think the world is looking to us to be an accelerant for AI deployment because CISOs all over the world are the ones that have to kind of be the roadblock in terms of deploying all of the AI, but they can't do it unless they know that they are the proper guardrails in place, and that's where they look to CrowdStrike. So based on all of that, I got confidence in the full year guide as well as the Q2 guide.

Thank you. This concludes today's question-and-answer session. I would now like to turn the call back over to George Kurtz for closing remarks.

I want to thank everyone for their time today. We certainly appreciate your continued support and look forward to seeing you at our upcoming events. Thanks so much and see you soon.

All right. Welcome, everybody. We're going to have a great act to follow here with CrowdStrike, but I'll read the disclosures first. If any research disclosures that you're interested in, please see morganstanley.com/researchclosures, or reach out to your sales representative. Delighted to have CrowdStrike here, Burt Podbere, CFO.

Maybe to kick off. We just had Sam on stage. How do you think about everything that Sam said, and how it relates to kind of all the security we're going to need to protect against that?

Meta, you said it right, they're going to need security. And we're here to help. Look, we have a partnership with OpenAI and others. And we're really excited about what we can do together. And we don't comment on who our customers are. But certainly, we have a lot of interactions with Sam and the team. So we're excited to see what the future holds.

All right. Perfect. All right. We're going to put on as good of a show. All right.

I'm here to help.

Exactly. So you reported very strong fiscal Q4 earnings on Tuesday this week. There were a lot of highlights. We saw EDR reaccelerate, continued strong growth across multiple growth pillars, strong traction with Flex. What were some of the most encouraging signs for you versus kind of expectations you had coming into the quarter?

Yes. So first, let me start off by saying that last year was one of the greatest years in our company history. Super proud of the team, super proud of being part of that team and really proud to have the customers that we have to make us who we are. And then if you dig down a little deeper, it really all starts with net new ARR. In Q4, $330.7 million, that's our biggest net new ARR number in company history. And for those who aren't familiar exactly with what net new ARR means for us, it's the one metric that's forward-looking that we give out. And it really talks to the health of the business. That's our metric. That's what we focus on. That's what the company rallies around. But there are other things that are important, too. And we had a couple of other records that standout for me and for many, non-GAAP operating income or our profitability. That was a record, right? So we did $326 million. Again, we're known for a company that does not grow at all costs, we grow profitably. And then our free cash flow. As a CFO, that's a number that I look at all the time. So for a record $376 million of free cash flow, really proud of the team, really proud of how we all rallied together and everybody in the management team is focused on those 3 metrics for sure.

Got it. I mean you were confident enough to raise your fiscal '27 ARR guidance from the 20% set at the Analyst Day. What were some of the drivers there? And a question we've gotten from investors is just, would you have raised it without some of the acquisitions?

Yes. So it would have been the same without those acquisitions. It would have been the same number. We disclosed what the acquired ARR was, and it was very small, $5 million to $8 million. And so -- for SGNL and Seraphic. And so we were really confident in being able to give out that guide for net new ARR for fiscal '27. I think it goes to, and it speaks to the momentum of the business. It starts there, right, with the records across the board from all different sizes of companies. We have broad-based demand. So it started there and then you saw that I talked about Q1 pipeline. So we had a record Q1 pipeline, 49% year-over-year. So those are 2 things that give us confidence as we look into the future, but it goes beyond that.

Look at the numbers that we provided with respect to our emerging products, Next-Gen SIEM, Next-Gen identity, cloud, over $1.9 billion, growing at 45%. I mean, those are some of the signs to me that says, "Hey, our customers are really, really looking at things other than what we were known for, the Next-Gen AV." So it says that, "hey, we're going beyond what we've -- and doing well on products that were essentially the older products that we had brought out." So that gives me a lot of confidence in terms of being able to put out a guide like that. And some of you may not realize, but that's the first time we've ever guided a specific guidance to net new ARR. And I think that goes and talks to the fact that we really are trying to be more transparent with our results and how we think about the business.

So between the momentum in the business, the product performance and also our Flex, right? Flex licensing, if you think about it, it's not a new product. It's not a new TAM. But you know what, it really matters, right? To be able to offer a customer with the ability to acquire our technology easily, seamlessly, flexibly, that really matters. It takes out the friction in the sales process, which is huge. And when we came up with the Flex licensing, the success is also driven -- you can see with everybody else, you are coming with -- all these other companies coming up with their versions of Flex because it's working. So really proud to see all those numbers. And then you look at within Flex, and you see we have a person or a company who will engage with us and they'll do a first Flex license. And what we've been tracking is, well, how long will it take before a customer comes back to the [ well ] and say, "Hey, we want to re-Flex." And we've given some data on that, and the data is strong, right? And I think we gave out a stat -- now that I think, we give out a stat on companies that are re-Flexing multiple times, almost 100 customers have re-Flexed multiple times within that same original contract period.

And so all those signs gives me a lot of confidence to be able to give a guide the way I did.

Okay. Perfect. We'll dive more into Flex in a second. But maybe to just kind of talk about some of the bigger thematics that have been going on within cyber right now, you and George addressed this on the earnings call, but just can you talk about how you have seen this AI disruption of cyber kind of come through discussions, and how you guys think about where that misjudges kind of the market?

Yes, it's a great question. And for us, when we think about it, there are really 2 different types of companies. One type of company would be the ones that have an exponential vulnerability to AI, and the other one is companies that are going to thrive. And those are the companies that have data moats. Those are the companies that can use AI to accelerate. We've been thriving with AI. You saw our results for last quarter. You don't have to go further than that. But why? Well, we're a net data creator. We create data.

So we collect data. We curate data. We're the folks that use that data as a backbone of our business, and certainly, we can use AI to accelerate what we do. When you think about AI, AI is created with GPUs. CrowdStrike secures that AI. And the big picture for us is that, "Hey, AI is great for a lot of things." You heard Sam up here. There's a lot of things that AI can do. Their AI is really good for reasoning, right? You can do incredible reports really quickly, gathering all this information, and it's fantastic for that. But when you're thinking about cyber, you need to be completely accurate and you need speed. And if you don't have both, you don't get a second chance, right?

And so, for us, it's more than just the technology. It's the support systems, it's the testing, it's the trust, right? You've got to trust your cyber professionals. And for us, we've been in the business a long time, we've been able to curate an incredible team to be able to work with our customers, build that trust. Tough to build trust with AI when sometimes you're -- you get a lot of -- in security, for security purposes when you're thinking about false positives. False positives, the name that you're probably all familiar with is hallucinations. You can't ask AI to -- something and you get 3 different answers, right? It's just -- that's not what it was built for, right?

So we have been able to benefit from other changes in the environment, like the hyperscalers. Remember when they all came out and they were talking about security within the hyperscalers. Well, look at our cloud business, right? It actually was a huge opportunity for us. Our cloud business, $800 million, growing 35%. Those are fantastic numbers. And it was generated from something that was going to change the world, and it has. And at first, we're running against the same things that we're seeing with AI, right? AI is going to dismantle a lot of SaaS companies. They said that with the hyperscalers. And it was an accelerant for our business. So we draw the parallels between the 2 so we give people an understanding of how we think about it.

Got it. Just the other question that we've been getting is just the, well, when does it become material that we can see it? I know you guys had a number of strong stats within the quarter in terms of what you were seeing as far as AI security. But when do you guys think about it being a material catalyst for the business?

Yes. Today, it is from the standpoint of the following. So number one, we use AI and agentic AI even in our product set today. So for example, we've -- in our exposure management. So if you are running Windows, pick one, 10, and you want to know if that version has the latest patch, you can use Charlotte, which is one of our AI tools, it's an orchestrator, to identify how many of the machines have the latest patch and it'll tell you. And then if you want to go beyond and say, "Hey, Charlotte, can you patch this?" So Charlotte, along with some of our other technologies, for example, Falcon for IT and others, can patch it for you. So you can see that it's already built into the product set.

And then you have specific things that we look at in terms of how is the adoption going for some of our AI tools? Charlotte, so last quarter, we gave out the fact that Charlotte has 6x the utilization year-over-year. It's also 3x the ARR year-over-year. So we're seeing signs that -- even on specific products that things are moving in the right direction as well as AI VR, which is our AI detection and response product. We just had it in the market for just a few weeks, and we saw a 5x quarter-over-quarter growth rate.

So we're already seeing the momentum ourselves with our AI tools. And I think a lot of people don't even -- don't realize that CrowdStrike was built on AI. In my day, it was called machine learning, right? And then we were doing agentic AI years ago. So we were on the front edge of doing all this work with AI, and it's really helped our business.

Got it. Okay. I want to go back to just another tailwind for the industry, which is just kind of this platformization versus best-of-breed. Just how do you think that, that -- like if you think about companies consolidating down to a right number of vendors, how do you -- how is that discussion going on with customers in terms of what you can bring to them in that conversation?

Yes, I love this question, right? So since the dawn of time, what do customers want? They want the best outcome at the cheapest price. That hasn't changed. And so what our platform has been able to enable is just that, right? So we feel we're the only pure-play cybersecurity company with the singular platform, right? We have 1 sensor, we have 1 console, and we have 1 platform, right? We don't have any integration tools. We do it all for you, and that's our customer promise. So we would go to our customers and say, "Hey, look, we have this opportunity to not only give you the best outcomes, but help you consolidate on us for a variety of things." And that matters, right?

So if you have disparate different technologies and they all have to work together, guess where the adversaries go, right there. They're going to look for those weak links. They're going to look for those stitching that you're putting together. They're going to go right to that stitching and go attack. But if there is no stitching, my arm is attached to my body, there's nowhere to attack, right? So we feel that that's the right approach. And clearly, it's been successful. So the consolidation tailwinds for us, I think, are going to continue for quite some time. And I think they're going to win. I mean, if you've got a crystal ball, maybe I think there's going to be maybe 3 or 4 full security platforms that exist, of which endpoint would be the center.

So that's how I think about it. And customers seem to be gravitating to it. And then you throw on the ability to purchase our technology easily with the Flex. And it's just -- it goes hand in glove. And so we're getting the -- we're seeing the momentum when we talk about our platform being the platform of choice. It's because of all these things that I've just described that make it work.

So you mentioned Flex being a reason why you have kind of more confidence in the business. It grew ARR 120% year-over-year. Can you just talk about like when customers are coming back to re-Flex? Just what is it -- where is it that they just start experimenting with more products? Is it that they're getting tons of usage? Just what is kind of bringing them back? And then how do you think about the -- why not just kind of convert everybody to a Flex model?

Yes. Great stuff. So a big accelerant to the re-Flexing is Next-Gen SIEM, right? They've used it. They want more of it. It's the backbone for companies in terms of their data. And we're -- we brought something to the market, which has just been so well accepted, so well received because it works, it's fast, it's less expensive than some of our competitors. All those things matter. So that's a big part of it. And then it's about how we flight our products. We have 33 different products that somebody could buy. And so basically, what Flex is able to do is it's like, "Hey, look, you have the whole book ready for you. You just pull it down, however you want, when you want." And so when you've got -- it's like anything else, when you bought a suite of things. It doesn't have to be technology, you bought a suite of different things, and you paid for it. You want to make sure you're getting the maximum value out of what you paid for. So you're going to try this and you're going to try that and you are like, that really helps, and that really helps. And then you get the viral effect of 3 things being able to do the work of 5.

And so for us, we've made it -- we flighted it in such a way that it allows customers to, in the apps, try other things. So why are we seeing such great results from our re-Flexes is because they are doing that, exactly that. They're trying different things, they're recognizing that, "Oh, I didn't realize you had that." This is today one of the biggest fights I have -- it's not fights, one of the things. I'm on a crusade with all our customers to educate all of our customers about some of the things that we have. So we have 33 different modules. So granted, that's a lot of modules. And oftentimes, when I'm meeting with customers, I get the look, "Oh, you actually have that?" And I'm like, yes, we've had it for 2 years, right? Because they were only focused over here.

And so what I try to do and what the sales team is trying to do is to educate our customers with respect to all the different features and functionality that we have. And that's also aided in the ability to see the re-Flexing.

In terms of Flex and where it's going, look, we've told the Street, we've told our own sales team that Flex is the future. So starting this fiscal year, fiscal '27, if it's not a Flex deal, you need to actually get an exception from management. There has to be a specific reason why you don't have a Flex deal. And so we're building that into -- we built it into our processes so that it's got to be something like myself or George or our President, Mike Sentonas, that's going to have to give authorizations, or a few others that have to give authorizations.

And so if you're a sales rep, you're going to go, okay, I don't want to go through that, right? That's not something I want to do. So I'm going to go after Flex. Oh, and by the way, my colleagues are making a bunch of dough, right, I am selling Flex, and by the way, my customers love it. So it's a win-win-win. And that is a recipe that's really hard to create.

Yes. Okay. Perfect. I mean maybe just going to the core for a second -- or not the core, but just the center of endpoint. You've talked about endpoint security as seeing reacceleration in past couple of quarters driven by AI demand. Can you just talk about kind of some of the underlying trends, and where you're kind of seeing this reacceleration take place?

AI is a big fundamental shift, right? And it's using AI at the edge. One of the things that I've seen in this year is we've had customers that are still -- big customers that are still on legacy AV. I'm out of my mind, right? You're a Global 2000 whatever, and you're using that? Are you kidding me, right? And so it's just a matter of time this time bomb is going to go off, you're going to get hit. And so the amazing stat is that from monitoring the endpoint, there's still 50% out there that's with legacy AV. And we're scratching our heads going, how could that be, on the one hand, on the other hand, let's attack. Okay, we're going to go after those, and we've been super successful with that. And now with AI, the -- obviously, the attack surface has completely changed, right? There are so many new attack surface areas using AI to be able to attack that the old legacy technologies just can't keep up, right? The speed of which attacks are coming in is in multiples from what it was because of AI.

So you got to think about the adversaries. They're going to leverage every single piece of technology to be better, stronger, faster than any company can prevent. So you need to stay ahead of that. So if you're on a legacy technology, it's only a matter of time before you're going to get hit for sure. And so that's why we've invested so heavily in AI. And that's why our product set is laced with AI everywhere. And for us, we see that as a future and not an accelerant.

Got it. I mean, just how have you seen competitive dynamics shift over the last year? Competitors are not standing still. Everybody has a platform. Everybody has a Flex now. Just what is -- how is that changing the competitive landscape?

Yes. We announced this partnership with Microsoft, right, to be on the Microsoft Marketplace. And this is amazing to me. Being at the company now in my 11th year, I never thought I'd see the day when Sachin will be up and talking to my sales team, right, about how to use the marketplace. So today, we have zero going through Microsoft. We have 1.5 billion going through AWS, right? Now we've done a lot of work with AWS to flight it, to make sure it's used appropriately. And with Microsoft, they have this Microsoft Azure Consumption Commitment, right, that you can use for CrowdStrike. I never really thought I'd see the day that, that would happen. But here we are. So it's better together and ultimately, who wins? The customer, right?

So between Sachin and George, they've been able to work through the competitive aspect of it in certain areas to carve out what's best for the customer.

How do you think that, that Microsoft relationship kind of ramps?

Yes. I mean we got 1.5 billion going through AWS. So I think the Microsoft folks who are running the Microsoft Marketplace, they're going to want to see that as well. But not only Microsoft, like you think about all these GSIs, right? They're looking at that number and going, "Wait, we have an opportunity to go do something like that?" So anyway, it's a lot of tailwinds with respect to the partnerships. So I talked about Sam, who was up here earlier and others. And we feel that, that dynamic is really changing the competitive landscape about who's going with who, who's associating with who. And they're just becoming -- for us, they're becoming less and less competitors that we're seeing, right? So now, obviously we talked about Microsoft. By far, they're our biggest competitor, right, if not close. But then you have others who are kind of in our space. You have Palo doing some things and some others, but that's pretty much it. There's not much else out there.

Okay. Perfect. I mean, Next-Gen SIEM has been a home run for you guys. It grew 75% year-over-year, over $500 million in ARR scale. Just how are you seeing being able to improve that product, being able to differentiate that product and kind of give this kind of SecOp solution that customers looking for?

Yes, it's been a home run, and I was involved in the transaction way back when, when we bought this company, Humio, and saw the potential that rested in that. And we built our Next-Gen SIEM based on that technology. And I think when you look at the technology and you're scouring the world, we got great folks who understand technology. We saw something a little different there. We saw a company that can really do what it does at scale. The speed was incredibly fast, and just the way it was designed, the architecture was very different than anything that was in the market. And we said, okay, well, if we can get to a faster response for asking queries, and if we can do it at a cheaper level, this is a home run for our customers. And we were able to do that.

And a big piece of the architecture is that it was index free, right? So the timing was incredibly fast versus some of the legacy SIEM vendors. And so for us, we've been able to showcase why it's faster, cheaper and you can log everything. Like if you're using one of the legacy technologies, it's expensive to log everything, really expensive. So customers were not. And so there were a whole bunch of logs falling on the floor. And so at first, when we were out there going to go, okay, well, the 20% that's falling on the floor, we'll take that, we'll log it for you, and it worked.

And then it's like, okay, well, we're doing the 20%, let's go for the rest. And when you think about SIEM, and you think about where the data and security data comes from, 80% of our SIEM, the security comes from us, comes from Falcon, and then first party. And then you've got 20% from a third party. So we've made it really attractive on pricing for the first party, like sometimes it's free. And then you pay for third party. And so that competitive advantage has really helped in terms of the cost structure.

Got it. I mean you had the Onum acquisition, just how do you see this kind of conversions of SIEM, observability, security analytics? We've seen Palo do acquisitions as well that kind of around this convergence.

It's really funny. Their acquisition of Chronosphere, the Humio technology that I talked about, that was the backbone for Chronosphere back then, right? So we have what it takes to do a lot more in observability because of the technology we have. And we're just being really thoughtful about how and when and all that kind of stuff that we -- before we bring it to market. And it's also going to stand up to the customer promise, which is we're only ever going to have 1 sensor, right? And so that all takes work to flight it and make it enterprise grade. And so for us, we have that ability to do it. And so we're excited about what we can do in that

space.

And for us, I think the Onum acquisition was really, really significant in that, if you're not familiar with what Onum is, it's basically a highway, and it delivers data from Depot A to Depot B. And for us, we saw a technology that not only did that, but also did a detection on route. So by the time it got to the SIEM, you'd have already filtered out so much data and understanding to make your SIEM, again, more cost-effective. So Onum is an accelerant to our Next-Gen SIEM. And that's why we went after it. And now not only do we have the data, but now we control the routes of where the data is going. So it's been a really, really powerful combination, adding Onum to our Next-Gen SIEM, and you're seeing the results.

Right. I mean cloud security, another strong area for you guys, $800 million ARR in the last quarter, growing 35% year-over-year. I think you mentioned that earlier. Just we've had the acquisition of Wiz by Google, or pending acquisition. Just how do we see kind of opportunities for competitive displacements in the market?

Yes. So when you think of cloud security, I'll break it down in the simplistic form. One is, you've got run time, which is Crowd Workload Protection, which we have. You need a sensor for that. And then you have cloud, then you have a nonagent, right, where you can do things like reporting, compliance. This is where companies like Wiz and others have kind of made their forte. Our belief and our strategy is you need both. You need the run time and you need the compliance side, and we have both, and we're investing in both. And over the years, we've invested in ASPM and DSPM, and we've got a lot of technology around cloud. That's why you're seeing the $800 million. It's because we have all these different cloud technologies that work as one.

Again, it's our brand promise, right? And customers are getting a tremendous amount of value from what we're able to provide from visibility in the cloud, to detection in the cloud, response in the cloud, run time, real-time, these things actually matter. In security, nanoseconds matter. And if you're not built for it, you're not going to stop it. So we feel pretty good about our strategy. We feel pretty good about how we're able to do work with both the sensor and the nonsensor, and we're going to continue to invest in that area.

Got it. Just rounding out all the different categories you guys have. On the identity side, again, over $500 million of ARR, growing 30% plus year-over-year. Just where does that fit in? We're going to have other identity people up here later on in the day, just how are you thinking about building out that kind of fuller identity platform? And does it expand beyond identity to kind of a more fulsome platform?

Yes. I love what we've done with identity. I was there when we purchased our first identity product, Preempt. And that was a home run for us, not only from the technology, but from the people. We still have the founders in our company all these years later. That was the foundation, right? And then we said, hey, there are 3 parts to identity. There's the identity creation, that's Microsoft. We're not going to do that. Then you have the identity brokering, right? That's the Oktas and Pings and that's not in our focus area. And then you have security in the identity. That's us. So Preempt was our first. And then we started adding other different pieces. We've got a PAM offering, just in time credentialing, right, which is the modern PAM. We're not -- we didn't build this thing on vaulting, which is actually fairly easy to do. So -- but you can see where we're going with that.

We also acquired Falcon Shield. We call it Shield now. And that's identity for the applications, the machines and the non-machines. So what we've done with our identity protection is enterprise grade and a big piece of our technology. And when you think about it, right? When you think about our earlier discussion on AI and where AI is going, when Anthropic announced their AI tool, it was talking about vulnerabilities. And even if you took out all the vulnerabilities in the world, took them all out, and it wasn't an issue, companies are still going to get breached. There are many, many other ways that adversaries are going to get in. Identity is another one, right?

So if you have a strong identity platform, you've now taken off another, or reduced the risk in another area of attack. And so you need identity in security, you absolutely do. It's a fundamental pillar. And we're going to continue to invest in our identity products to make sure that we're on the front lines of this thing, right? And for us, obviously, there's the vulnerability, sure, but that's a small piece of what you have to protect to stop a breach.

I mean maybe a question on the AI security portfolio that kind of wraps into you guys wanted to have this 1 platform, no stitches as you were kind of describing earlier. That's led to a lot of kind of smaller acquisitions. Just how do you see kind of the AI security piece of the portfolio growing? And just how do you see kind of the acquisition strategy of CrowdStrike evolving?

Yes. Number one, I think you're all seeing that the velocity of our acquisitions has increased, and I love that. I think that we've got a war chest of cash, and I think the highest and best use of that cash isn't sitting in the bank getting whatever 3%, 4%, it's definitely applying it to investment in R&D and certainly on inorganic activity. We've been really successful in buying great tech and great people, right? And then putting our distribution on top of that and you see the inflection. We've been really, really successful at that. So to deviate from that would take something exceptional, right? And we're doing so well, why would we go and buy something that's completely transformational when we're already transforming everything in what we're doing. So it would have to be kind of like I look at it as a deal of the century. But I rely on our CEO, George Kurtz; and our President, Mike Sentonas, to kind of bring thoughtful enhancements to our platform.

So I have the money for it, and I can go raise a bunch even through your bank to help me do whatever we need to do. But right now, I love our success in buying great tech and great people.

And then maybe just -- we've mentioned a whole suite of products, you have Flex. Just how -- any -- you've made some investments kind of in channel to kind of better sell all of these products. Just how are you finding the most effective way to sell these products through the channel or just channel optimization that you made it to do?

Yes. We've got a great leader in our channel, our Chief Business Officer, Daniel Bernard. And he's just transformed how we think about the channel. We're a channel-first company, so part of it is incenting the channel in the right way. We had a CCP program in place, and the CCP program was basically incentives for our customers, and it really, really worked. But we did it for partners, too. And we saw the success. And so we're going to continue with that -- with some of those programs and making sure that the channel, when they're seeing a customer, the first product out of their bag is CrowdStrike. That's our mission, right? Unless they're exclusive, and there is no other cyber product, which we always want. But for those that are some of the larger ones that are not exclusive, it's about how do we make sure that CrowdStrike is the first out of the bag.

Right. Okay. So we spent 95% of our time talking about kind of ways to enhance the top line. Just -- we'll end with the CFO question of just what does this all mean to the bottom line?

Yes. So we've got that long-term target that we -- out there, and it's my kind of North Star. So what are we doing to make sure that we are able to hit those targets? Well, we are well on our way. It starts with gross margin, right? So we had a record gross margin quarter in Q4, 81% on subscription non-GAAP, and that's hard. Moving the needle on gross margin is really hard. What have been able to do? We've been able to optimize some of the public clouds that we leverage as well as our own, right? We've migrated certain things over that made sense. And then our scale. When you're able to consume as much as we do, you're going to get a better deal when you're talking to some of the hyperscalers. You're going to get a better deal.

We look at ways within some of the hyperscalers, what's the most economical way to do it? For example, in Amazon, they have something called West 1 and West 2. West 2 is in different geo, a little less expensive. So okay, let's put more of our customers over to West. So it's little things like that, that add up. Look, I'm looking for 0.1% at a time, 0.2%, 0.3% would be fantastic in a quarter. That's where I'm going. But if I continue to do that, I'm going to get to where I need to be. I'm not far from my long-term model, by the way. So I only need a few of those to get me there.

Okay. All right. Perfect. Well, Burt, congratulations on a fantastic quarter and a fantastic story.

Thank you so much, Meta. Thanks, everyone.

Hello, and welcome to CrowdStrike's Fiscal Fourth Quarter 2026 Financial Results Conference Call. [Operator Instructions] Please be advised that today's conference is being recorded. I would now like to hand the call over to Andy Nowinski, Vice President of Investor Relations and Strategic Finance. Andy, please go ahead. Thank you.

Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, Chief Executive Officer and Founder of CrowdStrike; and Burt Podbere, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth, including projections and expected performance, including our outlook for the first quarter and fiscal year 2027, and any assumptions for fiscal periods beyond that are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995.

These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise. Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the company's annual and quarterly reports.

Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today.

With that, I will now turn the call over to George.

Thank you, Andy, and thank you all for joining CrowdStrike's Q4 FY '26 Earnings Call. I couldn't be more pleased with our results. AI is driving elevated demand for the Falcon platform and is a key accelerant for our business. At the same time, AI is weaponizing adversaries to attack with increased speed, sophistication and precision.

We're seeing this play out in real time in the Middle East as emboldened adversaries fuel nation state activity. FY '26 was CrowdStrike's best year yet capped by a blockbuster Q4 where we set new records across the business. Summarizing our results. One, all-time record net new ARR of $331 million for the quarter, which grew 47% year-over-year, coming in well ahead of our expectations.

For the year, we delivered $1.01 billion in net new ARR, up 25% year-over-year, our first year delivering over $1 billion of net new ARR. Two, ending ARR of $5.25 billion, crossing the $5 billion milestone, which accelerated to 24% growth year-over-year. CrowdStrike is the fastest and only pure-play cybersecurity software company to achieve this milestone. Three, record free cash flow of $376 million for the quarter or 29% of revenue. And for the year, we delivered record free cash flow of $1.24 billion or 26% of revenue. Four, all-time record operating income of $326 million for the quarter or 25% of revenue. This is the third consecutive quarter of record operating income.

For the year, we delivered $1.05 billion of operating income, exceeding the $1 billion operating income milestone for the first time. Five, record net new ARR from cloud, next-gen identity and next-gen SIEM collectively, ending ARR for these solutions collectively grew more than 45% year-over-year. Amidst today's AI backdrop, our endpoint business accelerated for the second consecutive quarter. Six, dollar-based net retention of 115% and gross retention of 97% showcasing best-in-class durability and stickiness, which leads to my final point. Seven, we delivered $1.69 billion in ending ARR from accounts that have adopted the Falcon Flex subscription model, growing more than 120% year-over-year, turbocharging our land and expand motion.

Our Q4 and FY 2026 execution showcases CrowdStrike's leadership in every theater, every segment and every route to market. In our third consecutive quarter of net new ARR acceleration, the voice of the market is clear. CrowdStrike is durable, mission-critical infrastructure for both securing AI and accelerating global AI adoption. We find ourselves in one of the most defining times in the history of modern technology. AI has gone from DreamWorks to reality, now increasingly in production across the enterprise.

From CrowdStrike's founding, we've been building AI innovation for cybersecurity, yet the pace of AI innovation is broadly misunderstood. Novel discoveries are often interpreted as the [indiscernible] of existing categories. The market is questioning enterprise software's role in an agentic world. It's in moments like these where opportunity is created. In the same way that we anticipated the cloud revolution, we pioneered and built for the agentic revolution.

Here's what I see unfolding in the market. We see the AI revolution creating 2 disparate groups of software companies. Group 1, those who are now existentially vulnerable. These are historically nice to have technologies that are productivity features and point products geared to legacy pricing models. Group 2, those who will thrive. These are mission-critical trusted infrastructure technologies necessary for global continuity with deep IP.

These technologies are net data creators producing novel, fresh and proprietary data that doesn't exist elsewhere. -- data that is fuel for the agentic business outcomes. In these companies, proprietary data is just one part of the advantage. The other is trusted enterprise architectural superiority, which drives stickiness, adoption and scale. Here's why CrowdStrike is winning and how AI is driving even more competitive success for us. One, our competitive moat is becoming an opportunity ocean.

Falcon is a vertically integrated net data creator and third-party data aggregator. We generate real-time data that no one else has from customer environments and our world-class threat intelligence. What Frontier AI labs cannot do, we've been doing for over a decade. Cyber reinforced learning from human feedback or RLHF at scale. Our MDR analyst, threat hunters and incident responders produce expert label data as a byproduct of operations. These labels don't come from Internet text. They come from stopping real breaches in real time.

Threat Graph correlates more than 1 trillion security events per day across approximately 2 trillion vertices, analyzing 15-plus petabytes of data, structured, queriable, security signals at scale no one can replicate. Frontier models can augment security, summarize alerts, draft queries, speed up triage. That's extremely valuable, but stopping breaches require sensors, real-time telemetry, continuous expert validation and enforcement, a closed-loop system, not a text model.

As our technology evolves, our data improves, as our data improves, our platform evolves. As our experts validate outcomes, our AI agents get better. This is a flywheel and network effect that no one else has in cybersecurity at our size and scale, and it's how we stand behind our brand promise of stopping breaches. This dynamic is not cyclical, it is structural. Two, we win because Falcon is purpose-built for securing AI at every layer.

The layers of the new AI stack are the attack surface of the future and Falcon can secure all of them. AI must be secured at every level, including: one, GPU foundation, partnering with NVIDIA, AMD, Intel and others to secure AI at the source; two, hardware and infrastructure OEMs, securing AI factories such as Dell, HPE and Super Micro; and novel AI operating systems such as vast data; three, Neo clouds and hyperscalers, securing where AI happens in the cloud across AWS, OCI, GCP, Azure and inference disruptors such as CoreWeave, Nebius and Crusoe. Four, token factories, securing the use of frontier model creators like anthropic, OpenAI and Google Gemini; and 5 AI applications in agents securing AI native software and the agentic workforce.

Not only do we secure the use of each of these companies' products, but we also secure nearly all of the companies themselves. We secure the world's AI future by securing the world's AI leaders. And three, we win because efficacy and precision matter more than ever. In cybersecurity, you simply cannot have a hallucination. You can't prompt twice. It's first time final. It's the difference between thwarting an adversary or experiencing a breach. Cybersecurity is a unique paradigm. Success for us and our customer is, did we stop a breach? We win because cybersecurity needs to be faster and more deterministic than ever before, and we uniquely deliver superior outcomes.

Our agentic SOC and AI technologies are transforming security. CrowdStrike's AI innovation is setting new adoption standards on the journey to delivering security AGI. Charlotte is our flagship agent, and now we have 10 other agents representing specific security skills and roles within security teams. Between Charlotte and our other agents we can already see the mobilization of securities agenetic workforce working hand-in-hand with human security professionals.

Coming back to Charlotte, our agentic [indiscernible] built from multiple models allowing us to optimize from the latest and greatest LLMs. We couple industry innovation with our own AI expertise, training and models from security's richest data source, Falcon adversary threat and security analyst training data. We saw Charlotte usage soar more than 6x year-over-year as ARR more than tripled. A thematic win was in a leading cloud software provider in an 8-figure re-Flex transaction. The re-Flex expanded the adoption of next-gen SIEM and Charlotte. Their 30-day use of Charlotte tells a compelling story, achieving a 3x faster mean time to respond, using the power of our domain-specific AI, Charlotte accelerates streamlines and democratizes security outcomes. Technology innovation is just one part of our success.

Our results are also driven by our go-to-market innovation, creating the revolutionary Falcon Flex subscription model, which we now see mimic across cybersecurity. The model transformed our discussions with customers to demand planning based on risk, data, attack surface and overall platform capabilities. Let me share our Q4 Falcon Flex performance within the now $1.69 billion ending ARR cohort of Flex account value, growing greater than 120% year-over-year.

We now have more than 1,600 customers who have adopted Falcon Flex and added more than 350 Flex customers in Q4. That amounts to nearly 4 new Falcon Flex customers each day of the quarter. The average Flex customers ending ARR is greater than $1 million. The proof of Falcon adoption success is in the re-Flex. Customers are using what they buy and expanding their Flex commitments. More than 380 Flex accounts have already re-Flexed representing more than 23% of the Flex customer base, up from 5% in Q1. The average ARR lift after a re-Flex is 26%, happening on average within 7 months.

And the platform adoption grows even further from there. We're now tracking the number of customers who are repeat re-Flexers. Nearly 100 customers have re-Flex multiple times. The multiple time re-Flex cohort now represents approximately 6% of of total Flex customers and over 1/4 of all re-Flex customers. Our multiple time re-Flexers on average, have an ARR lift of an additional 48% from their initial Flex subscription.

In summary, Falcon Flex unlocks never seen before adoption for customers. Flex is now how we go to market. A key win includes a major enterprise software player that started with using one module, threat intelligence and spending low 6 figures. Through Falcon Flex, this customer is now using 25 modules and spending $86 million in total Flex contract value with us.

Flex is creating its own flywheel. Demand drives use, use drives more demand. Flex is the stage on which our platform solutions shine. Collectively, our next-gen identity, cloud and next-gen SIEM businesses grew more than 45% year-over-year reaching more than $1.9 billion in ending ARR. Our NextGen Identity business ended FY '26 with more than $520 million of ending ARR growing more than 34% year-on-year, a double-digit acceleration versus 2 quarters ago.

Key drivers include our privileged account security solution which grew more than 170% sequentially. Falcon Shield and the ARR grew more than 300% year-over-year, more than 5x since our acquisition of Adaptive Shield as customers protect the rapidly growing agentic SaaS attack surface. Our ability to secure both human and agentic identities wherever they exist is rapidly turning CrowdStrike into our customers' identity secure control plane, a key identity win, an iconic department store selecting CrowdStrike over an SMB point product in a 7-figure deal driven by the ease of use of our IT DR and PAM solutions in a Flex consolidation.

While our next-gen Identity business had an excellent quarter, we're most excited for what's ahead. We recently closed the acquisition of SGNL AI. This is SGNL, bringing the power of zero standing privilege for all identities to the Falcon platform. With SGNL AI, CrowdStrike is delivering high fidelity, content-driven, real-time authorization to the market, enabling our customers to rapidly reduce their identity attack surface even as they rapidly expand the number of identities within their organization.

We're moving access from static point in time to real time and redefining Zero Trust. Access should be always on granular and dynamic. But we're not shopping there. Our recent acquisition of Seraphic turns any browser into a secure enterprise browser without impacting user behavior. The browser has become the front door for AI applications and Seraphic meets human and nonhuman users where they are and where they're going, agentic browsers for real-time visibility and protection.

Turning to our cloud business, where net new ARR growth accelerated for the second consecutive quarter and ending ARR grew more than 35% year-over-year. For the first time, our cloud business exceeded $800 million in ending ARR as our customers look to us to secure the infrastructure powering their AI future. Our unique ability to operate in run time at scale continues to set us apart from the rest of the market. A key win in our cloud business was with a major enterprise data platform company who deployed Falcon Cloud Security in an 8-figure total deal value Flex.

After extensive testing, this account ripped out their existing provider for our runtime protection first approach, realizing the integrated benefits of CSPM, CIEM, CDR, and Overwatch threat hunting, which resulted in a 90% reduction in mean time to detect and respond for their cloud environment.

Turning to our next-gen SIEM business, where we delivered a record quarter. Our Next-Gen SIEM business grew over 75% year-over-year, delivering ending ARR of more than $585 million. Next-Gen SIEM has proven itself a scaled market disruptor where our performance and cost advantages set us apart from legacy competitors. At the same time, our launch of agentic security workflows is powering the cybersecurity operating system of the future.

With Falcon Onum, we're enabling our customers to connect data sources quickly and efficiently, resonating with both security and IT teams. A key win in the quarter was with a Fortune 500 retailer highlighting our strength and momentum in the next-gen SIEM space. In the 7-figure deal, we replaced a legacy SIEM and its attached point product data pipeline. Falcon's fully native data pipeline and an expected 80% faster query performance was a game changer in helping this customer build out their agentic SoC.

Rounding out our product portfolio, I want to touch on our endpoint and other AI-specific businesses. Amidst the backdrop of accelerating AI proliferation, our endpoint business accelerated for the second consecutive quarter. The endpoint is rapidly becoming the epicenter of AI usage driven by the growth of technologies ranging from MCP servers to [ coding ] tools to localized LLMs. AI is the fastest-growing attack surface on the endpoint. As of Q4, our sensors detected more than 1,800 distinct AI applications running on enterprise devices, representing nearly 160 million unique application instances across our customer base.

And with the acquisition of Seraphic, we now give our customers even more control over their knowledge workers usage of AI tools. Lastly, I want to touch on our recently launched AIDR offering. In just a short time, AIDR has become 1 of our most in-demand products, growing more than 5x versus last quarter despite having only been available for a few weeks. AI adoption is moving faster than can be controlled and our AIDR offering gives customers immediate visibility into their employees' usage of AI tools, including the specific models being used as well as detections into potentially malicious or noncompliant usage, bringing model scanning, visibility, guardrails and detections to AI usage positions CrowdStrike as a catalyst for enterprise AI adoption.

Concluding the discussion on our platform solutions. Seeing is believing. Please reference our investor deck, which now includes a link to product demo videos, showcasing AI innovation across the Falcon platform. Our partner go-to-market delivered beyond expectations this past year. We saw growing practices across EY, Accenture, Deloitte, HCL, Wipro, KPMG and Infosys taking shape focused on next-gen SIEM migrations.

Our MSSP business also continues to grow at a rapid pace. In just over 3 years, we've gone from a sub-$100 million MSSP business to more than $1.3 billion spanning market-leading partners like Kroll, Pax8, and NInjaOne. Finally, our hyperscaler leadership continues to differentiate Crowdstrike from every other cybersecurity player. This past year alone, we did nearly $1.5 billion of total contract value on the AWS marketplace, growing nearly 50% year-over-year.

Then a few weeks ago, Satya Nadella and I spoke to CrowdStrike's go-to-market team together. We are now open for business on the Microsoft marketplace and customers can use their Microsoft Azure consumption commitment dollars on Falcon. This is a watershed moment reflecting a clear evolution of how our companies see each other and how Microsoft and CrowdStrike are working together to make the world a safer place.

In summary, we didn't just have a great partner year, we built an ecosystem to win the next decade. Closing my remarks today, I'm proud of the team and our partners for executing a terrific FY '26. Here are my key takeaways as I look at the business today and into the future. First, CrowdStrike is an AI adoption accelerator. Our customers are safely and securely using more than 1,800 distinct AI applications on their endpoints, which would not be possible without CrowdStrike.

Second, AI necessitates AI security. Every enterprise deploying AI needs an independent protection layer for visibility, compliance and enforcement. As AI adoption grows, CrowdStrike becomes even more of a necessity to these organizations. And third, our data moat creates a structural advantage delivering cybersecurity at scale requires more than a prompt. It requires expert label telemetry from our global sensors, MDR analysts and elite incident responders. It is a structural advantage no LLM provider can replicate. In addition. Agentic cybersecurity requires in-line prevention as well as real-time remediation.

Since the founding of CrowdStrike, we created an AI-native platform. Enterprises have trusted us to help them safely navigate market transitions like digital transformation and cloud migration. The AI revolution is now upon us, and just like prior market transitions, adoption of AI will be secured by CrowdStrike. Thank you for your trust.

I'll now turn the call over to Burt Podbere, CrowdStrike CFO.

Thank you, George, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue mentioned during my remarks today are non-GAAP. We delivered exceptional fourth quarter results and a record finish to the year, exceeding expectations across all guided metrics driven by continued Flex and re-Flex momentum and strong organic growth across the platform.

FY '26 was a milestone year for CrowdStrike. For the full fiscal year, ending ARR growth accelerated to 24% and net new ARR accelerated to 25% year-over-year. We delivered this record top line performance while exceeding our profitability and free cash flow targets. Operating income reached a record $1.05 billion or 22% of revenue, and we delivered record free cash flow of $1.24 billion or 26% of revenue. The combination of growth, scale, profitability and cash flow put CrowdStrike in rare air.

The strength of our platform and the significant market opportunity ahead further reinforce our conviction in the path to achieving our future growth milestones of $10 billion and $20 billion of ending ARR as well as our target profitability model. Our full year momentum was punctuated by an exceptional fourth quarter. We achieved record net new ARR of $330.7 million, up 47% year-over-year and well ahead of our stated expectations driving ending ARR to $5.25 billion.

Our fourth quarter results showcased the success of our Flex led go-to-market strategy. Momentum was broad-based across customers of all sizes from enterprise to downmarket and MSSPs, achieving another record quarter in our corporate business. Customers continue to leverage Falcon to consolidate their security needs and lower their total cost of ownership resulting in higher retention rates over the prior quarter and strong module adoption rates.

As of Q4, 50% of subscription customers are now using 6-or-more modules. 34% are using 7 or more and 24% are using 8-or-more modules. Our gross retention rate remained high at 97%, and our dollar-based net retention rate increased to 115% in the quarter. At our more than $5 billion ending ARR scale, these retention rates highlight the durability of our customer relationships and our ability to both retain and expand our customer base.

Our strong business momentum and Q1 record pipeline entering FY '27, which grew 49% year-over-year, gives us conviction in our ability to deliver profitable growth throughout FY '27 and beyond. As we lapse the 1-year mark from the end of our highly successful CCP program, we have seen that accounts that took CCP deals have gross and net retention rates higher than the company average, have shown a strong trend of early renewal and have already expanded more than twice the total $80 million of ARR value we provided.

Moving to the P&L. Total revenue exceeded our guidance range and grew 23% over Q4 of last year to reach $1.31 billion. Subscription revenue grew 23% over Q4 of last year to reach $1.24 billion, and professional services revenue remained strong at $63.1 million, up 26% year-over-year, driven by the elevated threat environment. The geographic mix of fourth quarter revenue consisted of approximately 66% from the U.S. and 34% from international geographies with both EMEA and APAC year-over-year revenue growth accelerating compared to Q3.

We saw broad strength across all our major geographic markets with the U.S., Japan, Europe, the Middle East and Africa, all exceeding expectations. Total Q4 non-GAAP gross margin was a record 79% and Q4 non-GAAP subscription gross margin was a record 81% of revenue, primarily as a result of continued cloud optimization. Fourth quarter non-GAAP operating income was a record $325.8 million, and non-GAAP operating margin was 25%, exceeding our guidance.

The outperformance was driven by our strong top line performance, gross margin improvement and sales execution, underscoring our commitment to durable profitable growth as we continue to balance strong net new ARR growth and operational excellence. In Q4, we delivered positive GAAP net income attributable to CrowdStrike of $38.7 million. Non-GAAP net income attributable to CrowdStrike was a record $289.1 million or $1.12 on a diluted per share basis, exceeding our guidance.

Moving to cash. Our cash and cash equivalents increased to $5.23 billion. We generated record cash flow from operations of $497.9 million and record free cash flow of $376.4 million or 29% of revenue. Our FY '27 outlook reflects our confidence in the durability of CrowdStrike's growth trajectory, profitability expansion and cash flow generation. The fundamental tailwinds, platform consolidation, AI proliferation and Flex adoption are continuing to gain momentum.

As George mentioned earlier, we see the AI revolution creating 2 disparate groups of software companies, one, those who are now extensionally vulnerable and two, those who will thrive. CrowdStrike is thriving amid the AI revolution as we not only leverage AI within our entire platform, but our platform helps organizations adopt AI safely and securely.

The AI revolution represents a new and generational growth opportunity for CrowdStrike as accelerating AI adoption necessities security built for this next era of technology. As AI adoption accelerates, combined with our record Q1 pipeline and continued platform consolidation momentum, we have strong conviction to once again raise our FY '27 ARR outlook. The outlook we are providing today includes the acquisitions of SGNL and Seraphic, both of which closed in February and are expected to contribute a combined $5 million to $8 million of acquired net new ARR in Q1.

We are assuming minimal organic contribution from these acquisitions in the remaining quarters of FY '27 as we remain committed to natively integrating their capabilities into the Falcon platform before fully scaling go-to-market, consistent with our proven M&A strategy and brand promise. We expect FY '27 net new ARR seasonality to remain unchanged relative to FY '26 with approximately 41% in the first half and 59% in the second half.

Beginning in Q1, we are changing the sales commission amortization expense period from 4 to 5 years to reflect our longer customer relationship periods. We expect this change to benefit non-GAAP operating income by $85 million to $95 million in FY '27, partially offset by additional operating expenses resulting from the integration of our recent acquisition of SGNL, Seraphic, Onum and Pangea of $74 million to $80 million.

For a detailed breakout of the acquisition impacts to our guidance, please refer to the guidance slides of our Q4 FY '26 earnings presentation available at ir.crowdstrike.com following our prepared remarks today. Additionally, we remain confident in our previously provided assumptions for FY '27 partner rebates to represent approximately 0.8% of total revenue.

Moving to interest income. Based on expected market rates and cash outlay from our recent acquisitions, we are assuming interest income of $160 million to $170 million for FY '27.

Moving to cash. At the midpoint of our guidance, we expect free cash flow margin to be approximately 33% in Q1 and at least 30% for the full fiscal year. In FY '27, we expect the seasonal mix of free cash flow dollars between the first and second half of the fiscal year to be 43% in the first half and 57% in the second half, with Q2 remaining our seasonally lowest quarter.

We anticipate capital expenditures as a percentage of revenue to be 7% to 8% in FY '27 with these investments more weighted to the first half of the year. Finally, as of March 2, we repurchased approximately 144,000 shares following our fiscal year-end and had approximately $950 million remaining under our current share repurchase authorization. We will remain opportunistic in returning capital to shareholders as we remain focused on capturing the significant growth opportunities ahead of us.

For the first quarter of FY '27, we expect annual recurring revenue to be in the range of $5.502 billion to $5.504 billion, inclusive of the estimated acquired ARR and reflecting a year-over-year growth rate of 24%, translating to net new ARR of $249 million to $251 million, reflecting a year-over-year growth rate of 29% to 30%. We expect total revenue to be in the range of $1.360 billion to $1.364 billion, reflecting a year-over-year growth rate of 23% to 24%. We expect non-GAAP income from operations to be in the range of $308 million to $310 million, and non-GAAP net income attributable to CrowdStrike to be in the range of $275 million to $277 million.

We expect diluted non-GAAP net income per share attributable to CrowdStrike to be approximately $1.06 to $1.07, utilizing a 21.0% tax rate and weighted average share count of approximately 259 million shares on a diluted basis. For the full fiscal year 2027, we expect annual recurring revenue to be in the range of $6.466 billion to $6.516 billion, reflecting a year-over-year growth rate of 23% to 24% and and translating to net new ARR of $1.213 billion to $1.264 billion, reflecting a year-over-year growth rate of 20% to 25%.

We expect total revenue to be in the range of $5.868 billion to $5.928 billion, reflecting a growth rate of 22% to 23% over the prior fiscal year. Non-GAAP income from operations is expected to be between 1.422 billion and $1.462 billion. We expect fiscal 2027 non-GAAP net income attributable to CrowdStrike to be between $1.241 billion and $1.271 billion, utilizing a 21.0% tax rate and approximately 260 million weighted average shares on a diluted basis. We expect non-GAAP net income per share attributable to CrowdStrike to be in the range of $4.78 to $4.90. George and I will now take your questions.

[Operator Instructions] Our first question comes from Joe Gallo at Jefferies.

Really nice results and guide. George, securing AI is a huge market opportunity. Would love your thoughts on, one, when securing AI materializes to ARR meaningfully for you? Is that a fiscal '27 story? And then two, how much of the new market opportunity goes to pure-play cyber vendors. In cloud, people certainly use the hyperscalers for some of their security needs. So just curious how much of that new AI market goes to pure-play cyber vendors like yourselves?

Yes. Thanks, Joe. Obviously, we're still in the early innings, but we continue to ramp in protecting AI and it's happening today in terms of ARR growth. And we're obviously blown away of what we've seen with Pangea and AIDR. It was up 5x quarter over quarter from when we acquired the company. So we're really excited about that.

The other piece to keep in mind is that not only is it going to drive AIDR growth, but we're going to see growth in protecting attack services like cloud. We're going to see growth in next-gen SIEM. We're going to see growth in other areas that all touch AI. So from that standpoint, I said early innings, but lots of opportunity for us. And I think with regards to hyperscalers, I'm glad you asked the question because when I started the company in 2011, we pioneered, Bob delivered security.

And over the years, as cloud was maturing, I heard a lot about the hyperscalers actually providing all the security services. Well, that didn't happen. In fact, as you've seen with our results and our partnership with AWS, as an example, we transact billions through these platforms, and they're a great partner, and there's a lot more exposure in the cloud. So we see the same thing happening what I call AI hyperscalers, being able to actually partner with these hyperscalers leveraging AI and their LLMs and also being able to leverage the technology to provide better outcomes within the platform of record for our customers, which [indiscernible]. .

Our next question comes from Rob Owens at Piper Sandler.

George, you talked about the 10 other agents that you guys have besides Charlotte and some of the traction that's Crowdstrike seeing with security agents. But can you provide color on some of the recent acquisitions. When we look at agentic security more broadly, where are customers in their journey? And do you see identity as maybe one of the main hurdles for them getting agenetic deployments at scale.

Yes, Rob, identity is one of the biggest threat vectors right now that we see, in fact, one of our latest threat reports, 80% of the breaches are non-malware base, right? So a lot of it is around identity. And between the identity stack that we've built over the years, again, we got into identity in 2020. We've built that out. It's a big business. And now really with the addition of SGNL AI. This is, in my mind, game-changing technology to have 0 standing privileges to be able to protect nonhuman identities and human identities in a much more modern stack than anything else that's out there in the market.

It's a perfect fit to CrowdStrike in our platform. You combine that then with something like Seraphic in browser security. So now you're able to protect the front door of really where these attacks happen, plus where AI takes place and you add the identity layer to that. And again, we're providing something that we think is going to be very unique in the industry. And of course, Pangea, which is our AIDR product, when you look at EDR, in today's market, EDR is a must, its compliance mandate, and we believe that EDR will be a similar opportunity --, AIDR will be a similar opportunity to EDR in the coming years, driven by compliance and the need to accelerate protecting AI.

Our next question comes from Fatima Boolani at Citi.

George, I wanted to direct this to you, I had a question about the next-generation SIEM opportunity. There are very much percolating fears that the open-ended stock modernization share capture opportunity that had thus far been pretty open ended has -- is perceived to maybe be at more risk from what the Frontier Labs may or may not be pursuing.

So maybe in the context of the opportunity ocean commentary in your prepared remarks. Can you help us with a deeper explanation and understanding of what your current nature of relationship, partnership and integration is with the Frontier Labs and the frontier Models? And how should we very critically think about the durability of your moat from any potential commoditization from an architectural or technical or frankly, any other relevant contextual standpoint?

Yes, Great question. So when you look at what we've built, and I talked about this in the prepared remarks, we're a net data creator, right? We have telemetry that we create from our agents and from other parts of our platform that is unique. We put it into various data stores, including next-gen SIEM and our Threat Graph. And we're able to understand the threats in real time with real-time prevention. That's vastly different than what the LLM providers in Frontier models do. .

Now certainly, we leverage the Frontier models. We have our own small language models. We have our own curated data. So I think we get the best of both worlds, but we're doing this in a platform that is driving consolidation that we've got millions and millions of workflows on already and becomes very, very sticky. So from the standpoint of our next-gen SIEM, you've got to look at the next-gen SOC opportunity and what we're doing with Charlotte and the agents that we've created where we're driving meaningful change in the soc or overall driving down costs and getting better outcomes, and we're doing it in a compliant way.

To be a security vendor, you have to have trust, customers are driven by compliance, and we are the epicenter of creating this data. So what we also are open to is having an open model. We have customers that create their own agents that leverage our technologies that leverage our MCP services. And this is part of having an open platform, which is why our customers loved [indiscernible]

Our next question comes from Saket Kalia at Barclays.

Great finish to the year. George, maybe for you. The cloud security business, I think, is the biggest piece of kind of that 3 platform product group, if you will. And it's continued to add a consistent amount of net new ARR dollars over the last few years, which has been great to see. Maybe the question is how do you see the competitive environment in cloud security right now? And how do you think about the longevity of the growth in that market as you look out into the future?

Well, when we look at the cloud market, I couldn't be prouder of our execution and the products that we brought to market. One of the areas that we focused on, as you know, for a long time, is run time protection, and that's the technology that really is focused on stopping breaches. And I think customers have realized just by having the ability to understand sort of exposures doesn't mean you're going to stop the breach.

So with our CSPM technology with -- a lot of the other technologies that we have acquired like Falcon Shield, it has become an extremely potent offering for our customers. And again, why is it resonating? One, the technology works. Two, it all works together, and we're able to drive down cost, complexity and get a better outcome, which is stopping the breach. It's not just about reporting on some exposures. It's about understanding the overall control plane in the cloud and being able to protect it and we're giving the customers what they want, and that's the right outcome at a much lower cost than the competitors that are out there. So I think that's why in a nutshell you're seeing the results in our cloud business.

Our next question comes from Brian Essex at JPMorgan.

Congrats on some nice results. And Burt, congrats on the return to GAAP profitability. Really good to see. Maybe a quick question for you, George, on identity. Great to see the acceleration there. Could you unpack that business a little bit and help us understand, I mean, obviously, identity was 1 of the segments that was part of the CCP incentive plans that you guys were pursuing. How much of the resurgence in growth there on the identity side is I guess, renewal of CCP or Flex deals versus net new kind of emerging identity product. It would be great to get a feel underneath the covers there.

Well, it's one of the modules everyone wanted. And certainly, it was a fan favorite in days of CCP. So we're seeing success from that. And as I've mentioned many times, once a customer engages with the module is an extremely high percentage that they're going to continue to renew that.

So we continue to see that. But I think overall, you have to look at the threat landscape and the fact that identity is really one of -- the compromised identity, it's really one of the #1 drivers of breaches and customers are being are focused on being able to protect those identities, both in the cloud and on-premise, if you will, and there's a massive compliance need for something like. So we're getting the benefit from the platform consolidation piece, and we're also getting the benefit from having a very mature stack now.

Not only can we prevent these sort of reaches what ITD are, but you include now Falcon Shield protecting SaaS identities. -- and then you kind of look at what we've done with our PAM offering, it's been very, very well received by our customers. So I think that's why you're seeing our opportunity to continue to grow there. And as I said earlier, we couldn't be more excited about the SGNL AI acquisition that we just completed. .

Our next question comes from Brad Zelnick at Deutsche Bank.

Congrats on a really strong finish to the year, an impressive ARR guidance out of the gate for next year, implying 22.5% net new growth, which is above your prior commentary and now off of even a higher base. After such a strong fiscal '26, this obviously stands out in a very good way. Can you talk about the building block to get you there? And especially how to think about the renewal opportunity that you have visibility to and the expansion opportunity given just how much you can address today versus when many of those customers might have last transacted?

Brad, thanks for your comments, and I'll give you an insight into how we thought about the guide. I mean first and foremost, it starts with the strong momentum that we're seeing in -- we saw in Q4 a broad-based demand from all sizes of businesses from all business sizes, whether it's enterprise all the way down to MSPs.

And then that rolled over into Q1 when we talked about the record Q1 pipeline, which grew 49% year-over-year. Then as George mentioned, CrowdStrike is thriving in this AI revolution. We are not only leveraging AI within the entire platform, but our platform also helps organizations use AI security, and that's the key.

And then one think we're still benefiting from the consolidation tailwinds. Customers continue to seek the best outcomes at the lower TCO, which we're helped to provide. And the consolidation really comes from the strength of our platform. you look at cloud, NextGen identity and next-gen SIEM collectively, we posted our record net new ARR, resulting in $1.9 billion in ending IRR, up 45% year-over-year.

Looking Endpoint that accelerated for the second straight quarter on the heels of AI-driven demand. The menu peg onto that the success that we saw in Flex. We added over 350 Flex customers in Q4. The average Flex customer ending ARR that was over $1 million, those guys have adopted nearly 10 modules well over our company average and then re-Flex. We have greater than 380 re-Flex customers. The average time for our re-Flex is 7 months, 100 customers re-Flex multiple times with the average ARR lift post reflex for this cohort was 48%. These are really, really great numbers for us. And so you combine all those things and other things gave us the confidence to be able to come out with the guide that we came out with for that new ARR for next year. . .

Our next question comes from Matt Hedberg at RBC.

Congrats from me as well. George, I wanted to ask about pricing. Obviously, Flex and Re-Flex is doing extremely well, but there's obviously a lot of concerns that I think we're all seeing out there about potentially fewer knowledge workers sees in the future. due to AI. The flip side to that is way more Asian. So I guess a 2-part question. First, how do you think about agent pricing? And second, how well does Flex position customers for this potential mix shift in could consumption become a bigger element to the growth algorithm?

Well, when we look at the overall threat landscape and how we go to market, obviously, we protect endpoints and cloud workloads. You have to look at those in totality, but now we have the opportunity to protect AI agents and industry stats is that each knowledge worker will have 90 AI agents. So even if the mix moves around, we have a massive opportunity to protect AI agents.

We have a massive opportunity to protect all of these AI cloud workloads. And from what I've seen in different technology shifts, we tend to create more opportunity as technology advances, not less opportunity. So that's the way we would view that piece of it.

In terms of Flex, look, it's been a smashing success there's a reason why some so many other companies sort of copied or model we try to copy it. Customers like it. You can see the success in the numbers. And it just makes it so much easier to help customers very quickly. You look at the acquisition we did -- they were available immediately to customers as soon as the deal closed and/or we went to a GA, but we didn't have to go through another procurement cycle. So -- that's really the model that we're leading with going to market this year, and we couldn't be more excited about it, and I think the Flex results speak for themselves.

Our next question comes from Roger Boyd at UBS.

Okay. Great. George, I want to go back to your comments on why you're best positioned to benefit from AI SoC. And I appreciate your comments around your approach of tech plus human expertise and the [ flywheel ] that creates giving you an advantage in terms of operationalizing this technology. I think it's also made the lowest friction way for some enterprises to benefit from some of this emerging tech. .

And I guess with that in mind, what sort of growth are you seeing with some of the managed service offerings like completing Overwatch relative to the acceleration you're seeing in the overall endpoint business right now?

Yes. Those businesses continue to grow extremely well. And when you look at why it's because we're getting the right outcome that customers need. One of the things that we track is mean time to detection, meantime to remediation. We are absolutely best-in-class for customers.

It's very difficult for them to replicate what we do. Why? Because it's a network effect, right? It's the full view that we see in over 176 countries where we actually have our software operating.. So When you're at the tip of the spear in seeing the activity through our technology, the tip of the spear and responding to some of the biggest breaches in the world combined with our threat intelligence, you've got the right understanding and the right DNA to create the right technology and outcome for customers.

So that's what we continue to see. Obviously, they're leveraging our technology and we're providing the automation, but there are many, many customers who don't have the skills or expertise to get the outcomes that we provide, which is stopping the breach, identifying these sort of threats, remediating much faster than they ever could and ultimately giving them the best outcome for a cost that it's very hard to replicate. And that's why it's been a fantastic success for us.

Our next question comes from Gabriela Borges at Goldman Sachs.

George, I really appreciated your description on what LLMs are not not and as a [indiscernible] to the RHLF commentary. I want to ask you the opposite question. What do you think the role is of Anthropic in cybersecurity use cases, whether it's on the [ cutting ] side or the pen testing side or even the data allocation side, what role do you think they should have?

I mean I guess I'll talk just in general terms for LLM providers. And there's certainly a lot of things you can help sort through lots of data very quickly. And it's something that the security industry and most secure players are leveraging. In our particular case, we certainly leverage technology like that, but we've built our own bespoke models depending on the module and trained in a certain way, with the vertical expertise to get the right outcome.

Here's what you have to remember is that what customers want is real-time prevention, you have to be in line, you have to be able to get the data in milliseconds and you have to make a decision. That's not the case within LLM. There's many ratings it can do, and it's certainly a fantastic technology, but it's not stopping any breaches in real time.

And that's one of the areas, I think, again, where we shine. So from my perspective, we continue to work with them. We continue to partner with them and amazing technologies. And I think it really is going to be the better together approach as the industry goes forward. Customers want to leverage their own models. We leverage [ neumotron ] with NVIDIA. It's an unbelievable time to be in tech and you're going to have agents talk to agents and our agents talking to customer agents that are inside their network. But at the end of the day, as the platform system of record for security, this is where you want to be. It is a very sticky place. We create the data, we curate the data. And again, we want to be open and work with any of the models that are out there. and we want to meet our customers where they have AI and leverage their technologies as well as ours. .

Our next question comes from Todd Weller at Stephens..

Yes. Appreciate the question. George, this is the second quarter of endpoint acceleration. Can you talk about what's driving that, how you think about the durability of the growth acceleration? And then related to this, there's been a lot of action in the market recently around browser security. Do you see that as a new category or as an extension of endpoint?

Well, when you think about endpoint acceleration, it's a simple answer, AI. We've talked about it, and we're showing it in the results. And I mean one of the biggest things you look at, [indiscernible] comes out, our customers immediately are looking at all of our technologies to be able to identify it, put controls around it and make sure that they can leverage these technologies in an efficient and compliant way.

So that's where AI meets the -- rubber meets the road is at the endpoint, and that's how people consume it. So that's where we're seeing it. And then you combine that with browser security. That's really the front door now for how people are interacting with AI models and LLMs and the various technologies that are out there as well as how threats get into the environment.

So you combine that with our agent and the ability to have protection across any browser, not just as an organization to switch their browser. We can protect any browser that's out there. We tie it into our identity stack. And I can tell you the feedback from our customers as soon as we made the announcement, they were looking at how fast can we get this technology because they know on our platform, it's going to be additive for them. and we're excited about the category and the great company, Seraphic that we acquired.

Our next question comes from Dan Ives at Wedbush.

Yes. It's a great, great quarter, as always. I -- George, I was going to say what -- when it comes to Anthropic and Claude and obviously all the worries out there and you hear in the Q&A. To some extent, can't this also be a huge benefit to you as it just further spreads the word and customers realize essentially what they don't have and you do have, especially with the Microsoft partnership at the same time?

Yes, as I said in my prepared remarks, AI is a tailwind for us. And I mean I take a simple approach is will we have more AI in the next year or 2 or 5 years? And for me, the answer is absolutely yes. And if that AI is being deployed with AI agents, you're going to need protection, you're going to need something like AIDR. You're going to need identity security. You're going to need browser security. You're going to need compliance around this. And that's the way we look at it.

And again, we leverage the technologies that are out there. Why wouldn't we? And we have our own unique IP and our own model. So we get the best of both worlds. And there's many things that customers are looking for in these workflows and sort of data curation and knowledge in the security industry that you can't just get from a general LLM model. So I've talked about this before, and it's a great opportunity to work together, and that's really what we're focused on.

This concludes today's question-and-answer session.

All right. So thanks, everyone, for their time today. We appreciate your continued support and look forward to seeing you at our upcoming events. Thanks so much.

All right. We will get things going here. Thank you all for being here on day 3 of the UBS Tech and AI Conference. I have the pleasure of starting the day off with George Kurtz, Co-Founder and CEO of CrowdStrike.

George, fresh off earnings. Appreciate you being here on short notice. But yes, thanks for being here.

Great to be here.

Yes. Cool. I think I want to talk a lot about the high-level strategy here. But given we're just off earnings last night and before we get into the bigger picture, maybe just review some of the highlights from last night.

I felt like a very strong quarter on all regards. But in your words, what's about?

Well, I think if you look at the quarter, it was broad based performance. Obviously, our ARR stands out year-over-year, 7% growth. We had a lower comp, of course. But when you look across our product lines, including next-gen SIM, including cloud, including identity, these all accelerated.

So if you look at that, you look at our free cash flow, it was a record. You look at our gross margin for subscription 81%. We're getting big deals done Falcon Flex. We've doubled the reflexes. When you put it all together, what I would say is we delivered an incredible quarter, broad-based success across all the product lines and geographies. And I think it really shows the power of the single platform that we've built and the fact that companies are embracing what we're doing, particularly technologies like next-gen SIM and I'm sure we'll talk more about that.

Awesome. Maybe 2 quick questions in the quarter. This is, I think, the best quarter of net new ARR since, I think, calendar 4Q '23 I know you got this question last night -- or I know I got this question, I'm sure you did too. You acquired 2 companies in the quarter.

Can you talk a little bit about the contribution there? I think there was maybe some misinterpretation.

There was a lot of misinterpretation. We said de minimis, but de minimis means de minimis. It means $2.8 million of contribution. And there's some crazy numbers being thrown out there. So just to be crystal clear, was $2.8 million of net new contribution.

Yes. Very clear.

For the acquisitions, right.

And then the other question I got was just around the bottom line operating margin, EBIT. In many regards, this is a record quarter for non-GAAP operating income, EPS despite the fact that you closed 2 acquisitions, you had a record Falcon conference in September. Can you just talk about the operational execution? I know Burt is here somewhere. I'm sure we're pretty pleased with the quarter as well.

Yes, we are very pleased with the quarter. And I think when you look at sort of bottom line, what do you have in the quarter, where you have Falcon, which is our biggest selling event in the entire year, which drives the record pipeline, which we called out. And we did 2 acquisitions with de minimis revenue, right?

So we still have to absorb all the expenses of the folks that we brought over. And we still had a fantastic bottom line results. So I know when we look at this and we look at overall the performance, obviously, things that Burt and I focus on ARR, we focus on cash, free cash flow. And these are the things that help drive the business, and these were records for us.

Yes. Cool. Maybe zooming out, I want to talk about platforms. And last night, you talked about CrowdStrike as the operating system for security operating system for the stock. I think that idea demands a true single platform. So I'd love to get kind of your expanded thoughts on why that's so important, especially as we enter an AI attack landscape.

Yes. It's again, what's the ethos of cross right? It is the single agent single platform, and it's how I built the company. And I've learned from what not to do. I was at a prior company before, we did 21 acquisitions and it all looks good on the PowerPoint, but we can never get them integrated.

So you have to look at those lessons learned in the past and go, okay, I'm not going to repeat that. I see it being repeated in other parts of our industry, but we're not going to repeat that. That's why we've been so thoughtful about M&A.

And I know that's another topic we'll cover. But in a single platform, it really focuses on the data and the data architecture. And for me, data, in my opinion, can solve most security challenges that are out there. And I think most people would believe that data can solve that, whether that is a endpoint use case, whether that's a risk use case, whether that's an identity use case. If you have the data, you can not only identify things, but you can also prevent these breaches.

And it really does then set up all of the AI training that allows the operating system to work at scale. You mentioned that yourself. The SoC is transforming. It isn't just kind of alert and triage and alert in triage. It needs to have much more autonomy built into the stock.

And one of the things that I talked about at Falcon is CrowdStrike really being the first 2 security AGI. We've got a lot of efforts internally working on this. Now the industry has to get to AGI. But along with that, our goal is to map out and bring the industry to a level 5 autonomy. And if we think about the simple analogy of autonomous driving, you have an autonomous safer well, you have an autonomous SOC agent, right?

You have a Level 5 model in cars. And we mapped out a Level 5 model in security. So when you have that level of autonomous interactions, a, you've got to get it right; and b, it's just a different way to instrument and operate the stock, and we're really pioneering that.

Yes. Cool. I wanted to talk about Falcon Flex that you mentioned. And I think, in my view, it highlights what customers think of your platform. I talk to some of those customers who appreciate the flexibility it gives them to try out new solutions while still making a broader commitment to CrowdStrike. I think you now have $135 billion of ARR going through Flex contracts, growing very rapidly. What's going right there and where can that go from here?

Flex is something that we put together in combination with our customers. And it was really a demand from our customers saying, look, we want to do more with CrowdStrike. You've got -- I mean, I started with 1 module. We went public with 10. We've got 30-plus modules today and growing. And customers basically want the ability to leverage the entire platform.

So they came to us and said, how can you make it easier? How can you maybe take a page out of the hyperscale or playbook and give us a commitment model? It's not a consumption model, it's a commitment model. So customers commit, the more they commit, the better the dealers, they get a rate card for it. And then the entire product platform is opened up to them and friction-free procurement, right, you just have to go through it once. They can add a new product, and then it basically just burns down their commitment.

This has been, as I said on the call, often imitated, never duplicated. Ours, I think, is still differentiated from the others that are out there. that couldn't even kind of renamed their flex model. They just gave it something flex, which is, I guess, invitations the sincere for flattery. But in any case, it works, customers like it. And the key is they're consuming more of it faster than sort of the contract term, right? So if you had a 3-year contract term and you can -- as an example, consume it in 18 months, you're up for a reflex or even sooner.

So these are the dynamics that we're working with. And each customer is going to be a little bit different. But from a selling motion, it moves from, hey, here's another module. Here's another module to let us look at the outcome that you want. Let us look at how you want to consolidate and get rid of these 5 other products that don't work well and are costly and then move it all into Flex. And that's why we keep getting bigger and bigger Flex deals, yes.

I think it's really interesting, and that reflex activity remains super strong. You have 200 reflex customers that have shown up. And I know people have kind of equated this to an ELA. Like that doesn't sound like ELA buying motion...

It's not an ELA. The term ELA is banned from our company. This is not an ELA. It is a commitment model, again, very similar to what you would see in a hyperscaler. And we kind of view ourselves as a hyperscaler of security, having the model, having the platform, you have to have both together.

You asked me about the platform earlier. A big piece of having the platform is actually having the model, the licensing model that can help customers consolidate and be part of the platform journey. And you have to have both pieces. And we put both together and really, we're hitting on all cylinders with both areas.

Yes. Okay. I want to talk a bit about next-gen SIM, which continues to grow, I think, pretty close to 100%. It's almost $0.5 billion in scale. You called out a couple of key wins on the call last night. It feels like the legacy replacement cycle there is maybe accelerating a little bit? Is that a fair thing to say?

It does. It feels a lot like the legacy replacement of AV. So when I came out with next-gen AV. We were, again, semantic [ Mcfe ] all the big guys and nobody thought we had a chance. And we've seen how all that played out. It feels a lot like that in that customers are frustrated.

They're certainly frustrated with the cost. They're frustrated with the performance they're frustrated with the complexity. And they're looking for a new model this sort of alert and this triage is just getting old. There's too much data. It's happening too quick and humans just can't keep up with it.

So when you look at our next-gen SIM, the beauty of it, is -- and before we even got into the business, our customers were saying, like we're taking all of your EDR data, and we're putting it and paying to put it in another SIM and it's costing us a lot of money. Like 80-plus percent of the data that was going into a SIM was from CrowdStrike. So they said, why don't you just take the 20% that you don't actually create and take it into your platform? And that's what we've been able to do.

So what is maybe underappreciated is they don't have to pay for the 80% they generate. There's a retention fee and those sort of things, but the transfer they don't have to pay for. So this is a huge cost savings to them. This is why we can be very disruptive in the pricing because we already have the data. So it makes it a lot easier when you go do a rip and replace.

The one I talked about was a large bank in Europe. Not only did we replace their SIM, but we also added on them to it. And this pipelining technology is very exciting. So I think the combination of what we built having it integrated and EDR data is really the highest resolution data that's out there, combined with things like Charlotte AI, making a winning combination.

Beyond that brownfield replacement cycle, there's also a greenfield opportunity to sell in the customers who maybe never bought a formal SIM before. And I think that you're kind of reinventing that coming from a very strong EDR standpoint. How do you think about that opportunity, both directly and indirectly working with some of your managed security service provider partners?

Well, certainly, the big folks out there, big companies have SIMs. And I think what we've been able to do, and we've shown this over time as we've been able to take something that's very complex.

And we've been able to take that model and bring it down all the way to the SMB. So we did that with endpoint, [ NextAV ], those sort of things. So we have the ability to do that with SIM. When you think about the companies, and there's so many smaller companies that are out there, it could be million dollar company, it could be even a billion dollar company.

There's still a lot of risk that they have and having visibility into their security posture is important and even combining that with the managed service provider motion. So we think we can tap into the SIM market at a lower stratification than it's done before because for the most part, if you were setting up an enterprise SIM, it's a ton of complexity, you need lots of people.

And because of the way that the product works in the platform, it's very easy, it's natively built in. This is the other piece. Every customer we have has next-gen SIM. Now what do I mean by that? I want to be very specific. They have access to next-gen SIM, and we give them 10 gigabytes of next-gen SIM for free, okay? So then it's on us to be able to upsell them. So even the smaller customers, we have plenty of small customers that are using the 10 gigabytes, and we have the ability to grow that.

Very cool. Last question on SIM. Earlier this week at Reinvent, AWS announced that Falcon [ Flex ] SIM is going to be the default in for their customers and security hub. Can you talk about how important that is? And when you look at competition in the end market, some of the other hyperscalers are in some ways, your competition. I know has been a big partner for you. But what does this mean this next step?

Well, we're really excited about this announcement came at Reinvent. And if you look at 2 of the I guess 4 hyperscalers now sort of have their own, right? And this is a great, great addition to AWS so their customers can actually consume AWS data into a SIM that is now part of their stack. So you can go into your console, you can assume data flow it in and then pay as you go. And that is going to dramatically open up new customers for us.

It is pay as you go, so part of our selling motion will be to move them over to [ Apu ] subscription. And it's a win for AWS because it gives them native capability within the platform, which they didn't necessarily have before. So obviously, we just got going on it. We just announced it at Reinvent, which was this weakest obviously, a big runway ahead of us. But in terms of the opportunity, we're already hearing from people who are using it and liking the technology.

The other piece that I want to mention is what we did with F5. It's a very similar motion. So F5 worked with us, they said, hey, we want to put CrowdStrike on our F5 appliances, which one, if you look at the appliance landscape, these are one of the most attacked sort of surfaces, but nobody runs anything on them. So working in collaboration with F5, we were able to certify our sensor to run an F5, which was a great collaboration.

And now we have new customers coming to us saying, hey, we weren't a crowds customer. We use your technology with F5. It's way better than anything we have. We had no idea, and we want to get to an EBC, and we're doing that already, and we just announced it a couple of weeks ago. So if you look at what we did with and then you kind of look at AWS, we're going to hit a whole bunch of customers that we've never hit before in a whole bunch of different regions where we want to continue to build out our momentum.

Cool. I want to talk a little bit about the Onum acquisition. You talked about it being a game changer for the next-gen SIM product, and I think broadly your exposure to the observability market. Can you -- what does that do for you in terms of emerging trends in that space around federated distributed data structures? And what led you to the one acquisition in the first place.

Well, interesting, the Onum acquisition, I was talking to a customer and I was traveling and they said, hey, you got to meet this company. It's really cool. And I knew a little bit about them, and I was in town and basically set up a meeting 1 hour, met some folks and I'm like, okay, this really is good stuff. And if you look at the background of the founders, again, we buy teams in tech, right? You have to have the right team, you have to have the right cultural fit. They came out of [ ivo ].

So they knew they knew the whole SIM space. And they knew some of the problems associated with moving data, getting it in and duplicate data and costs and those sort of things. So they really built a next-gen pipeline and technology that can -- it's much more efficient in how it operates. It's not just designed to sort of reduce data and save cost. Yes, it can do that. But there's so much logic that's built into the pipeline. Now what that means is that as data is created and sense of were, they can actually apply logic to it in the pipeline.

So it has to move from point A to point B. And that logic can be security logic, so you can do detection in the pipeline even before it hits our SIM makes it really efficient or it can be IT sort of logic, like where you're looking for performance? Are you looking for sort of anomalies in sort of IT infrastructure data, if you will.

So that's why, to your point, of observability, we do have capabilities within Onum and then you combine that with LogScale, which, by the way, LogScale started at [ Jumia ], which is what we bought, 50% of the customers were observability customers. So we actually have the tech for observability, and we have more and more customers using it with their own sort of custom workflows.

It's more work we need to do around the workflows and some of the data that we take in, but it's all doable. So from that standpoint, if you only control the data fabric, I think it's a huge competitive advantage versus some of the other competitors that are out there, yes.

I wanted to go high level here and talk about AI in a few different ways. But maybe to start, last month, we saw state actors leverage an LLM to help propagate a tax on I think, 30 different enterprises. And I think we've always been talking about as an industry like this potential risk. But now that we're seeing it, like what is that doing to your customer conversations? Like are you hearing more concern? Is that elevating budgets what's the general level of panic over what we saw with them?

There's a lot of concern about it. And I sort of try to distill problems into time and money. I mean that's just make it easy. And there is a time element to this AI attack vector. And there's also a money element that it's much cheaper for adversaries to do it. But what it has done is it has massively compressed the window that a defender has to be able to protect themselves.

It used to be months and it was weeks, days, hours now and sometimes seconds. We've actually -- and we called this out 1 of our threat reports seen an attack or pivot from 1 system to another in 51 seconds, right? So incredibly quick. So AI is driving a lot of the tooling around this. And in this particular case, they were using a public model, and they were basically just driving new attacks and creating sort of what I'll call AI-type malware, that isn't really malware. It's more prompts, right?

So it can hit a system, and then it can basically say, what system on my hand, Well, what's interesting, what files are here, look at the files. Like there's no malware. It's just prompting and then it's creating scripts that will actually do that for the adversary on their behalf. So it's unique every time it hits a new system, it's unique, which again becomes a problem in the world, and that's why you need AI to fight AI.

Makes sense. The second AI theme question is how enterprises are thinking about securing AI, whether it's in first-party applications or API calls or through SaaS. And I've heard a lot of customers of your site interest in Falcon Shield, you talked about, I think, 50% sequential growth last night. You acquired Pangea to add functionality there. How are you helping customers grapple with challenges around securing applications?

Yes. So there's -- let me step back a little bit and when we talk about the AI applications, there's the AI creation, and we help secure that and then there's the applications, the use of AI, AI agents, et cetera. And I think where we see a huge opportunity, and I'll get to the -- some of the acquisitions is in the ability to secure these AI agents.

I talked about this in September at our event. There's a stat on average a enterprise sort of person will control about 90 different agents in the future. So all those agents are going to need to be protected. Very similar to the way we protect endpoints, right? They have access to data. they have access to compute. They have access to other agents. They have access to workflow.

So if you think about our opportunity, that we have in front of us. Everybody has a laptop or a device here, like we've built a huge business in protecting these technologies, cloud, et cetera. But we have a massive opportunity to protect all these AI agents. And now they're going to be at a different price point. If you have 90 of them, you're one person, it's going to be at a different price point, but it opens up a much broader opportunity for us.

So when you look at what we did with Pangea, Pangea not only provides technology around sort of prompt injection, guard railing, identity, those sort of things. But it actually has a whole building block layer. So if you're building AI applications, you can actually use the Pangea building blocks. And it's not something because we really are releasing it in Q4 because we're integrating it. We haven't talked a lot about it, but it's really exciting, so it could be part of the whole sort of building of AI applications where you can build the security into it. That's why we're excited about that acquisition.

And then Shield is amazing because you have a lot of SaaS applications with identity, certainly a lot of them driven by AI, shadow AI and Falcon Shield is immediate time to value. It's one of those technologies that when you run it, there's always a hot moment, and it's a very quick sales cycle. And we're getting a lot of net new business where customers just try it out, and they're like, wow, okay, once they're in the platform, then we have the ability to cross-sell them.

And the last point on AI is the use of AI to improve security operations and the idea of the genic so where we're headed. I've been pretty encouraged by some of the feedback I've heard about Charlotte.

I think -- the one example that stands out is a customer told me that they're regular seeing 3-hour investigations being done in a minute, and that trust level is increasing. At some point, like this is going to become a bigger deal. Do you feel like we're getting there is 2026, the year where we're going to see more adoption of some of the agenetic AI technology in the stock?

I think so. There's a cycle of AI adoption. I think everyone here would probably remember their first ChatGPT sort of [ mom and said ], wow, okay, that's really interesting, right? Then you started to use it and then there was people bringing the first power users we're bringing it into the enterprise.

And then the enterprise security folks and IT folks like, wait a minute, we got to control this thing, right, and then they kind of went through their motions and -- now we're in the deployment of AI agent. So we're in the early phase.

So as more and more organizations get comfortable with AI, they're going to drive more AI across their entire architecture, including security. There isn't too many companies that go into it that tell me, hey, I've got unlimited budget and unlimited people. Conversely, it's like, hey, budgets are tight and people are tight. We don't want to add more people. So how do we leverage AI? So Charlotte is a perfect force multiplier.

And the beauty of Charlotte is that we've taken a lot of what we do as 1 of the largest MDR providers, and we've built that into Charlotte. So think about the training data. We've got over 10 years of MDR data that we've annotated. And sometimes it's better to be lucky than good. You didn't know like Jenny was coming 10 years ago. But the training data was laid out in the way that made it really easy for us to do that. So that creates a moat in what I call the [ Reddit ] of security data, where we have all that, we're able to train Charlotte. So Charlotte has now become really a workflow orchestration layer.

And it's gone well beyond our competitors sort of chat bots, and that's why you're seeing customers go, wow, okay, this is really evolving. And like every week or 2, there's new capabilities, and it gets better and better and better. And again, we're driving towards that autonomous SOC. That is our vision. That's down the road, but you're going to see more and more adoption, obviously, of Charlotte, we get more training. And then people get more comfortable with allowing it to do more things autonomously.

So I would say a year ago, this felt like an AI agent for the SOC felt like a road map item that everybody had to have. It seems to me like it's showing up more in wins. You continue to highlight Charlotte and Flex deals. How do you think about like driving adoption there versus like customers coming in to try and pull it and try to monetize it. And is it conceivable at some point that like cloud security and same identity, we could potentially have a Charlotte segment disclosure?

Yes, that's a Burt question, but it's possible. on the disclosure side. When we think about the adoption of it, though, and what we're seeing is customers, they want something more than a chatbot. And I think to your point, 1 of your earlier questions, we've been able to build it within the platform. Like we just didn't slap together a chatbot and go here it is.

So we wired it into each of the modules, and we actually built our own smaller LOMs, if small ends. And basically, because it's built into the platform, it allows us to actually do work on behalf of the customer in our workflow. And that's vastly different than others, but the platform really sets up Charlotte and again, gets back to how things are built. Not all things are built equally. And it will continue to grow and at some point, maybe there will be disclosure around that. So we'll take that up with Burt.

8 Very good. Maybe 2 last questions or 3. Just on the M&A strategy and coming maybe full circle on the idea of a platform. You've always had a very disciplined approach to M&A. At Falcon, you did note that you're not ruling out larger scale acquisitions. Can you just talk about kind of the framework and the high bar you set for whenever you're looking at going external for R&D?

Sure. When we think about M&A and what we've done, and I think what we've been incredibly successful with is tech and teams, right? And I always say teams first really because if you don't have the right team, tech doesn't matter.

So techies matter. And we started there, and I think we have a great track record of these acquisitions. If you go down the list from Preempt to Humio, I mean these are all stars for us, Falcon Shield, et cetera. So that has worked well.

We're not ruling out doing something big, but it has to have a high bar. And my general philosophy, on an M&A deal is I say no to everything until I run out of nose. And then when I run out of those, it's a default, yes, that's how we get a deal done. That's how all of our deals got done.

So is there a larger acquisition that could potentially hit the yes, for sure. But again, we're not chasing ARR. If it comes with it, great. We want the best tech and the best team for the best outcome of our customers, and we don't want to dilute the value of the platform of what we built.

And we're going to see many others out there struggle we're trying to put piece parts together. And that's -- again, I got a lot of scars on my back from prior companies. I don't want to be in that situation. So I won't rule it out, but it's going to have to have a high bar.

At Falcon, you laid out a target for fiscal '27 for 20% net new AR growth. And last night, you reiterated that on a higher fiscal '26 base. Could you just parse out your confidence in that number and maybe more of a Burt question, but I'm for sure the answer is everything we've talked about thus far. But -- what's your confidence in that? I know you talked about record pipeline in 4Q, but...

Yes. Well, I think it does start with a record pipeline. You have to have some visibility looking out, right? You have to -- you look at where we are today, the acquisitions, what we've done, the integrations we've done, Falcon coming out of it, Falcon Europe as well. and customers just coming around. There's a lot of customers -- new customers that are coming that might have been with another vendor through a life cycle.

They might have had a 3- or 5-year deal that are now coming up, going, okay, like they're dissolution, the dissolution with the outcome and the cost. And they're talking to their peers, and we're solving really hard problems. And if you talk to them, and I encourage you, and I know you do, but if you talk to most customers, we're the #1 security control they have.

Number one, right? And what do they do? They talk to their friends in the industry and go, what are you doing different? Like CrowdStrike. So that continues to build. And I think when you look at our road map, you look at the pipeline, you look at the market opportunity, particularly with AI in the areas that we're leading in that gives us confidence. And at our scale, there's not many 20% growers. I mean we're in rare, right?

So from my perspective, I think it's all coming together and you've got this tectonic shift in technology with AI that's going to help really drive that into the future years, awesome.

I think that's a great place to end things. But this has been a great conversation. George, thank you for being here. And thank you all for listening in.

Fantastic. Thank you so much.

Hello, and welcome to CrowdStrike's Fiscal Third Quarter 2026 Financial Results Conference Call. [Operator Instructions] Please be advised that today's conference is being recorded.

I would now like to hand the call over to Andy Nowinski, Vice President of Investor Relations and Strategic Finance. Andy, please go ahead.

Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, Chief Executive Officer and Founder of CrowdStrike; and Burt Podbere, Chief Financial Officer.

Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth, including projections and expected performance, including our outlook for the fourth quarter and fiscal year 2026 and any assumptions for fiscal periods beyond that are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995.

These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise. Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the company's quarterly and annual reports.

Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today.

With that, I will now turn the call over to George.

Thank you, Andy, and a warm welcome to the CrowdStrike team. Andy is no stranger to many on this call, and I'm glad to have him with us to lead Investor Relations.

I'm excited to share CrowdStrike's fantastic Q3. It was a record quarter as the business continued accelerating. On the back of record attendance at Falcon Global and Falcon Europe, the momentum we're seeing with customers, prospects and partners drives my conviction in our near-term and long-term growth.

Last quarter, Q2, we delivered our forecasted reacceleration a quarter early. This quarter, we furthered the trend with relentless execution. Across the entire CrowdStrike team, I'm extremely proud of our Q3 with highlights including: one, record Q3 net new ARR of $265 million, which grew 73% year-over-year, beating our expectations by more than 10%; two, ending ARR of $4.92 billion, which accelerated to 23% growth year-over-year; three, record Q3 free cash flow of $296 million or 24% of revenue; four, all-time record operating income of $265 million or 21% of revenue, this is the second consecutive quarter of record operating income; five, broad-based ending ARR acceleration across cloud, Next-Gen Identity and Next-Gen SIEM collectively as well as acceleration in our endpoint business; and six, more than $1.35 billion in ending ARR from accounts that have adopted the Falcon Flex subscription model, growing more than 200% year-over-year.

Underpinning these financial highlights is the CISO, CIO and Board feedback I regularly hear. CrowdStrike is mission-critical in today's agentic society. No matter how the market swings, geopolitical tensions evolve or what technologies are in vogue, our digital society mandates cybersecurity as a necessity. And now more than ever, synonymous with that, CrowdStrike is a necessity.

Our growth is driven by pervasive, durable and thematic market forces. Organizations of all sizes are in the midst of AI transformations, investing in the future of workforce productivity in the name of speed, scale and cost benefits. In the midst of this societal shift, what I've shared over the past few years and quarters is unfolding before our very eyes.

One, AI is rapidly expanding the attack surface. Businesses are onboarding a whole new type of workforce today, the agentic workforce, humans using agents to do more and agents working by themselves, each with access to data, applications, compute and sometimes even other agents.

While the benefits of this newfound workforce are exciting and increasingly vital for market competitiveness, the rapidly expanding risk profile of this realm cannot be ignored. Every single agent expands the attack surface, necessitating protection. CrowdStrike is both the armor and intelligence layer that keeps each agentic identity secure. The intelligence layer, providing visibility and context to organizations from agentic threats and risks, and the armor protecting agents from attacks, influence, exfiltration and data manipulation.

In addition, CrowdStrike is also present as the foundational protector of the underlying technologies powering the AI revolution, providing security by design for the world's cloud and token factories.

Two, the democratization of destruction wasn't just a bold prediction, it's already today's reality. Businesses every day are having jarring, lightbulb moments witnessing AI-powered adversarial trade craft firsthand. Just a few weeks ago, a major AI company shared that China state-sponsored adversaries were using their LLM to create and operationalized active cyber intrusion agents. This is just one of the many AI-enabled attacks we've seen. The AI cyber battleground is no longer theoretical, it's now real. Now just as anyone can use AI to vibe code and become a software engineer, anyone can now also vibe hack, becoming a sophisticated adversary with AI.

Three, cybersecurity in the agentic era demands a single platform. The criticality in being able to operate with agility, efficacy and speed to stop breaches is having the data, the controls and the actions in a single platform, not multiple platforms because when you have multiple platforms, by definition, you don't have a platform. Tab switching and contact switching cost time, data stitching doesn't scale. These are the seams and cracks where adversaries thrive.

The leaky lifeboat of PowerPoint platforms and point product fragments simply cannot offer the protection, scalability and cost benefits or the ease of use of a single platform solution. CrowdStrike wins as the market's broadest and only single platform solution.

Taking my 3 points together: One, we've built the right architecture, a single console, single data backend, single sensor, agentic hyperscale platform that is frictionless and one of a kind in cybersecurity; two, it's the right time with the rapid growth of AI agents raising the threat risk profile and driving a holistic technology shift; and three, we're in the right position. CrowdStrike's technology, innovation engine and ecosystem position us as the operating system of cybersecurity for the agentic era.

Market demand is high because the need is real. We have the right architecture, we have the right products and we're in the right market position to continue taking share. Successful AI adoption requires cybersecurity transformation, necessitating a new operating system to create a structure around the next chapter of enterprise security programs.

Falcon Next-Gen SIEM is the foundation of our platform, turning CrowdStrike into our customers' operating system for cybersecurity. Next-Gen SIEM has become a scale disruptor in a market that has historically been slow to evolve as customers embrace the speed and efficiency advantages versus legacy competitors. And with the acquisition of Onum, we're making it even easier to build on CrowdStrike with a hyper scalable telemetry detection pipeline that brings CrowdStrike even closer to all our customers' critical data.

Falcon Next-Gen SIEM had a record net new ARR quarter, a clear outcome of the deliberate strategic choices we've made over the past several years. We know that the value of the technology is only as good as the platform on which it's delivered. So we invested heavily in integrating Next-Gen SIEM to create a unified single platform.

This isn't just a single console. It's a truly integrated and unified data backend that brings together all of CrowdStrike in one place, delivering not just economies of scale, but far superior outcomes. And with Charlotte as the agentic SOC orchestrator, now FedRAMP High approved, we're delivering the AI SOC of the future today.

Furthering our position as the operating system of cybersecurity, we recently announced our expanded partnership with AWS. Through this announcement, all of AWS's millions of customers will have access to Falcon Next-Gen SIEM natively within their AWS security console, enabling them to immediately access, interact with and analyze AWS telemetry directly in Next-Gen SIEM. Going a step further, we've also enabled federated search so that AWS customers can query their data from a single console.

We're incredibly excited about what the future holds and thank AWS for both our amazing partnership and for their validation of Falcon Next-Gen SIEM as the best choice for their customers. A large European bank renewed their more than 500,000 workload EDR deployment, adding Next-Gen SIEM, Onum and Charlotte in a large 8-figure expansion deal. With our acquisition of Onum, this financial institution was able to eliminate their existing streaming pipeline point product as well as migrate off Splunk.

Competing against hyperscalers and firewall vendor SIEMs, Falcon Next-Gen SIEM won the hearts and minds of the security and IT team as the easiest solution, fastest to see value and best agentic SOC transformation platform.

Our identity business continues to perform exceptionally well. While the demand for our ITDR offering has increased, it's the launch of both our PAM and Falcon Shield offerings that has our customers increasingly excited. Falcon Shield had a record net new ARR quarter, growing nearly 50% sequentially as market demand for SaaS application security has become a mainstream necessity, securing SaaS app misuse from human and nonhuman identities has never been more important or challenging.

Nefarious agentic behavior is targeting data-rich SaaS applications that have quickly become a feeding ground for breaches. From on-prem apps to cloud apps, we stopped these breaches. A Fortune 500 logistics company used Falcon Shield to uncover exfiltrated CRM data in less than 30 minutes from deployment, resulting in a 7-figure deal. A leading customer experience platform saw a Shield demo and activated the module via Flex within an hour.

And lastly, a Global 500 personal care leader conducted a Shield assessment uncovering 25 unknown shadow instances of their CRM. This customer quickly transacted a 7-figure expansion, bringing their SaaS environment under control. As these examples illustrate, today's elevated third-party SaaS risk environment demands visibility and protection. Falcon Shield delivers near immediate time to value and is a product that we can land new logo accounts with even without endpoint deployments.

Turning to the cloud, where we delivered Q3 record net new ARR. While CrowdStrike continues to benefit from M&A-related market disruptions, it is our customers embrace of best-in-class runtime protection that continues to push us forward. As the cloud security market matures, customers are realizing that posture doesn't equate to prevention. Security teams now understand that they need active defense within their cloud environments, and this can only be delivered in runtime. CrowdStrike is the cloud runtime security leader as validated by the most recent Frost & Sullivan CWP report.

And with our recent acquisition of Pangea, we're now positioned to protect the entirety of our customers' AI infrastructure. At our recent Analyst Day at our Falcon conference, we discussed how protecting AI is akin to protecting a building. Security teams don't want a nonintegrated, fragmented series of solutions to protect their critical AI infrastructure because they know that this complexity creates gaps that are increasingly exploitable by AI-enabled adversaries.

CrowdStrike Falcon Cloud Security offers customers a unified, integrated end-to-end solution that enables secure adoption of transformative technology without slowing the end user down. A Fortune 500 consumer packaged goods company grew their Falcon deployment with Falcon Cloud Security in a 7-figure expansion deal. This customer took the opportunity to displace Wiz, bringing their cloud security program to Falcon for the benefit of our consolidated CSPM, ASPM, CIEM and CDR approach. The outcome delivered is single platform management, better visibility and the ability to stop cloud breaches versus simply alerting on them. This was just one of multiple Wiz replacements.

In addition, Falcon Cloud Security was selected to protect a leading neo cloud in an 8-figure transaction. This token factory decided it was time to secure AI from the source so that enterprises of all sizes would trust and build with confidence on them. Cybersecurity became a differentiator and business enabler, not a cost.

And finally, I wanted to touch on our endpoint business. Our endpoint business accelerated in the quarter on the heels of AI-driven demand. In the world of AI, so much is being pushed to the edge. Employees are now deploying new applications such as cloud desktop and ChatGPT directly onto their machines, driving both rapidly improved productivity and also significant new risks. This is further exacerbated by the rapid adoption of new AI browsers such as Comet and Atlas, which bring new opportunities and concurrently new vulnerabilities and threats.

AI adoption is supercharging renewed interest in the endpoint as the endpoint is the epicenter of human and nonhuman interaction with AI. In this new agentic world, the endpoint has quickly become the risk point, the productivity point and the opportunity point.

A large government agency took the opportunity to modernize, replacing more than 75,000 endpoints of legacy AV with Falcon as well as deploying us in their AWS environment for cloud protection in what was a strong federal quarter for CrowdStrike.

In addition, EY brought us into a Fortune 500 health care account, where in just a few months, we were able to modernize the endpoint, cloud and SIEM environments, an 8-figure end-to-end Flex expansion deal where we displaced 2 SIEMs, Defender for endpoint and a point cloud security product.

Frequently imitated but never duplicated, Falcon Flex makes it easier than ever for our customers to experience the full power of the Falcon platform without procurement friction. The Flex model cultivates more platform utilization, accelerating module adoption. Falcon Flex is an unlock, not an ELA.

Flex customer ending account ARR more than tripled year-over-year. But what has us even more excited is the momentum we're seeing in reflex activity. The number of reflex accounts more than doubled quarter-over-quarter to more than 200 with 10 customers reflexing more than 2x their initial Flex subscription. This demonstrates that Flex customers can and do increase their ARR and TCV spend with CrowdStrike, which is contrary to the ELA model, where all the economic value is realized once upfront.

When we launched Flex, we believe that it would allow customers to more quickly benefit from the full value of our platform, and that's exactly what's happening. As customers and partners alike continue to embrace Flex as the best way to adopt Falcon, we expect it to become our licensing standard.

Our community or crowd powers our technology, and that's who we build for. Our ecosystem partners continue leading us to new heights, affirming CrowdStrike's market and category leadership.

Our Alliance team delivered a record quarter in terms of deal value closed with partners. CrowdStrike's market position comes to light in mission-critical times. F5 asked us to partner with them to further secure their BIG-IP hardware and virtual appliances. We rapidly deployed our sensor on BIG-IP, which they certified and F5 took the opportunity to purchase Falcon and OverWatch licensing for their installed base in a large Flex transaction.

We are pleased to be taking our industry-leading protection capabilities to new insertion points, designed to enhance network perimeter protection. Today, hundreds of F5 customers are now securing their F5 appliances with CrowdStrike, many of whom weren't CrowdStrike customers prior.

Partners take us into new account environments, implementing Falcon as part of their broader agentic enterprise architecture vision. Experiencing the success of Next-Gen SIEM in the market, EY took a bold step to standardize their SIEM practice on Falcon in a large 7-figure transaction. EY is migrating accounts for which they own and operate multiple legacy SIEM technologies, consolidating on CrowdStrike.

Additionally, EY is a leading global partner of ours for Next-Gen SIEM implementations, taking numerous Fortune 500 accounts through the journey from legacy SIEM to Next-Gen SIEM migration. Deloitte announced Next-Gen SIEM in their MXDR practice, replacing their legacy SIEM provider. And Wipro, too, has standardized security delivery and incident response on Falcon.

The GSI community is quickly seizing the SIEM and SOC transformation opportunity that only our single platform provides. The ecosystem embrace of partner-led services on Falcon is correlated to the opportunity we represent. A recent Canalys report showed that our ecosystem creates up to $7 in services opportunities for every dollar of Falcon product sales, illustrating the large ecosystem opportunity surrounding the Falcon platform.

I want to return to yesterday's announcement that we made with AWS. AWS selected Falcon Next-Gen SIEM as the default SIEM for all their customers offered in their Security Hub console. This brings Falcon Next-Gen SIEM with prepopulated AWS data to millions of AWS customers in a product-led growth motion. Our intent is to convert Next-Gen SIEM usage into Flex subscriptions as more accounts experience the power, speed and actionability of their AWS data, CrowdStrike data and other third-party data in Next-Gen SIEM.

Our Next-Gen SIEM helps AWS fill a critical market gap, now competing with other hyperscaler SIEMs and doing so with Falcon. Our Next-Gen SIEM delivers value for AWS customers, even those who don't yet use Falcon because we've become a federated prepopulated and affordable security data lake for observability, triage and threat hunting. And Charlotte is there to help operate the whole system on a customer's behalf.

In addition, Accenture is our launch partner with AWS, helping AWS customers leave their legacy SIEM for Falcon Next-Gen SIEM on AWS. Our partnership with AWS continues from strength to strength with CrowdStrike announced as AWS's Global Security Partner of the Year and AWS's Global Marketplace Partner of the Year yesterday at re:Invent. We're excited about the opportunity to engage AWS accounts, onboarding them to Falcon and serving as their operating system for cybersecurity.

Lastly, I want to share a noteworthy MSSP partnership, which we've announced today with Kroll, a leading mid-market professional services firm. Kroll's cybersecurity division performs thousands of incident response engagements yearly for mid-market firms around the world, largely from their cyber insurance panel inclusion. Kroll had been using a point product EDR in their incident response and managed detection and response business.

Now Kroll exclusively uses Falcon. And in an almost 8-figure rip and replace transaction, Kroll is migrating nearly 0.5 million endpoints to Falcon, which were previously running on a point product SMB EDR and up-leveling their own MDR service with Falcon Complete for service providers with our Falcon Complete team becoming the SOC for Kroll.

This partnership announcement illustrates the value that only CrowdStrike can deliver, the best technology platform with numerous expansion opportunities to help customers and partners alike consolidate, the services opportunities partners need to see value, whether that be an incident response, proactive assessments, managed detection and response or SOC transformation and our scaled and agentic MDR teams to up-level partners so they can focus on selling and client services while we focus on stopping breaches as the world SOC.

We've improved Kroll's technology stack, displaced an inferior point product, improved their margins with Falcon Complete and they migrated their entire practice to us. This transaction highlights the power of Falcon to be a business creator for our ecosystem. We're not selling products. We're delivering outcomes, introducing the world to a whole new way of performing cybersecurity and risk management.

In closing, this was one of our very best quarters in company history. Acceleration is back. We're winning and we're living the company's mission of stopping breaches. AI represents our largest opportunity and demand driver yet. We're using AI to revolutionize cybersecurity. And even larger, we're securing the world's use of AI, so businesses of all sizes can adopt more AI faster, securely and with confidence.

The takeaway is this, AI adoption necessitates the right cybersecurity. It necessitates CrowdStrike. Jensen Huang summed up our market position best saying, "I can't imagine a better defender than CrowdStrike," on the stage at NVIDIA GTC in Washington, D.C. The transformative work we're doing with NVIDIA is representative of how we're securing AI at its very source, all the way down to its human and nonhuman users and its outcomes. I see this as a generational opportunity for the company.

AI is but one of many tailwinds continuing to propel CrowdStrike to new heights. One thing is certain, whenever our customers engage in technology change and transformation, cybersecurity has been a constant necessity, and that constant is CrowdStrike.

With that, we have a big Q4 opportunity in front of us, a robust demand environment and no shortage of breaches to stop. Cybersecurity doesn't slow down for the holidays and neither do we. Stay safe, happy holidays, and I'll pass the call over to Burt Podbere, CrowdStrike's CFO.

Thank you, George, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue mentioned during my remarks today are non-GAAP. Additionally, the results we are reporting today include the acquisitions of Onum and Pangea, which closed during the quarter and were de minimis to revenue and ARR.

We delivered an exceptional third quarter driven by organic growth, exceeding expectations across all guided metrics. We achieved record Q3 net new ARR of $265 million, exceeding our expectations by double-digit millions and more than 10 percentage points.

Net new ARR growth accelerated to 73% year-over-year and ending ARR reached $4.92 billion, accelerating to 23% growth over last year.

As George highlighted, our performance reflects the success of our single platform strategy as organizations prioritize cybersecurity in the agentic era and customers consolidate on Falcon as the operating system of the SOC.

We delivered acceleration across the platform with cloud, Next-Gen SIEM and Next-Gen Identity, all delivering strong results. Momentum was broad-based across customers of all sizes from enterprise to down market and MSSPs, achieving record results in our corporate business and strong performance in the public sector, particularly in U.S. federal and higher education.

Falcon Flex continues to be a powerful driver of platform consolidation with over $1.35 billion in ending ARR from accounts that have adopted the Flex subscription model. Falcon Flex is quickly becoming the standard licensing model as it makes it easier for customers to adopt more of the Falcon platform faster.

Customers continue to leverage Falcon to consolidate their security needs and lower their total cost of ownership, resulting in higher retention rates over the prior quarter and increased module adoption rates.

As of Q3, 49% of subscription customers are now using 6-or-more modules, 34% are using 7-or-more and 24% are using 8-or-more modules. With our business momentum increasing and our all-time record high pipeline entering Q4, we have strong conviction in our ability to deliver profitable growth as we finish FY '26 and look into FY '27 and beyond.

Moving to the P&L. Total revenue exceeded our guidance range and grew 22% over Q3 of last year to reach $1.23 billion. Subscription revenue grew 21% over Q3 of last year to reach $1.17 billion and professional services revenue was $65.5 million.

The geographic mix of third quarter revenue consisted of approximately 67% from the U.S. and 33% from international geographies with both U.S. and APAC year-over-year revenue growth accelerating compared to Q2.

Total non-GAAP gross margin was 78% and non-GAAP subscription gross margin increased to 81% of revenue. Total non-GAAP operating expenses in the third quarter were $703.2 million or 57% of revenue.

In Q3, we saw a typical step-up in sales and marketing expenses from our annual Falcon conference we hosted in September, which was our biggest selling event of the year and set multiple records with over 8,000 attendees joining us.

Non-GAAP operating income was a record $264.6 million, and operating margin was 21%, exceeding our guidance. The outperformance was driven by our strong top line performance, gross margin improvement and sales execution, underscoring our commitment to profitable growth as we balance accelerating net new ARR growth with operational excellence.

GAAP net loss attributable to CrowdStrike was $34.0 million, which included $26.2 million of costs associated with the July 19 incident and related matters and $5.6 million of acquisition-related expenses. Non-GAAP net income attributable to CrowdStrike was a record $245.4 million or $0.96 on a diluted per share basis, exceeding our guidance.

Moving to cash. Our cash and cash equivalents were $4.80 billion. We generated record cash flow from operations of $397.5 million and record Q3 free cash flow of $295.9 million or 24% of revenue. Payments for incident-related and strategic plan costs impacted Q3 free cash flow by approximately $53 million.

Moving to our outlook and modeling notes. The AI-driven demand environment, combined with our record pipeline and the continued momentum in customer platform consolidation on Falcon gives us strong conviction as we finish Q4 and look toward FY '27.

While we do not guide to ending ARR or net new ARR, our revenue guidance includes the following assumptions: Low to mid-teens sequential net new ARR growth Q3 to Q4, bringing ending ARR growth for FY '26 to 23% year-over-year. At the midpoint of our net new ARR assumptions, we expect second half net new ARR growth of at least 50% year-over-year, well above our previously provided assumptions of at least 40% year-over-year, driven by our strong Q3 outperformance and record pipeline. Additionally, we continue to expect FY '27 year-over-year net new ARR growth of at least 20% from our now increased FY '26 net new ARR assumptions.

As we discussed during our September investor briefing, as a result of our successful CCP and related partner programs, our ARR to subscription revenue assumptions include a separation of $13 million to $15 million in Q4. Consistent with what we noted at Falcon, this gets you to the midpoint of our FY '26 revenue guidance, which we have raised by $24.1 million at the midpoint to reflect our strong Q3 outperformance and a record pipeline. We ask that you please be mindful of these dynamics when updating your models.

Moving to cash. We expect Q4 free cash flow margin to be 27% and include cash payments of approximately $33 million in connection with incident-related costs. This brings our full year FY '26 free cash flow margin expectation to 25%.

Finally, we remain confident in our previously provided assumptions for FY '27 partner rebates, non-GAAP operating margin and free cash flow margin, which are detailed in the modeling assumption slide of our Q3 FY '26 earnings presentation available at ir.crowdstrike.com following our prepared remarks today.

Moving to our outlook. For the fourth quarter of FY '26, we expect total revenue to be in the range of $1.290 billion to $1.300 billion, reflecting a year-over-year growth rate of 22% to 23%. We expect non-GAAP income from operations to be in the range of $315 million to $319 million and non-GAAP net income attributable to CrowdStrike to be in the range of $282 million to $287 million.

We expect diluted non-GAAP net income per share attributable to CrowdStrike to be approximately $1.09 to $1.11, utilizing a 21% tax rate and weighted average share count of approximately 258 million shares on a diluted basis.

For the full fiscal year of 2026, we currently expect total revenue to be in the range of $4.797 billion to $4.807 billion, reflecting a growth rate of 21% to 22% over the prior fiscal year. Non-GAAP income from operations is expected to be between $1.036 billion and $1.040 billion. We expect fiscal 2026 non-GAAP net income attributable to CrowdStrike to be between $950 million and $954 million. Utilizing a 21% tax rate and approximately 256 million weighted average shares on a diluted basis, we expect non-GAAP net income per share attributable to CrowdStrike to be in the range of $3.70 to $3.72.

George and I will now take your questions.

[Operator Instructions] Our first question will come from Brian Essex with JPMorgan.

Nice results. And Andy, congratulations on the new role. Maybe for George, great to hear the acceleration in the endpoint segment of the business. And I know you guys aren't giving any update until year-end on the emerging segments of the business. But could you offer a little bit of color of how those segments are behaving as you kind of lap the initial CCP initiatives of last year?

And then maybe for George -- I mean, maybe for Burt, I know you're not offering any kind of impact from Pangea and Onum on ARR, but any sense of the seasonality, organic seasonality for net new ARR?

Yes. Brian, thanks. Yes, when we look at, obviously, the emerging products, which was the heart of your question, they performed fantastic. If you look at Next-Gen SIEM, it's been an all-star standout for us. We've seen just incredible results from a customer perspective and what they're able to do and driving down the cost and get better outcomes.

Identity as well, that's key to the -- securing AI in an enterprise. And then obviously, cloud, we talked about some of the big wins throughout the quarter. So when we look at those segments, and as you mentioned, we'll be reporting out on those next quarter, we're very, very pleased on the results and customers are embracing the technology and the consolidation the single platform delivers. So from that standpoint, I think we're very happy.

And then as we lap the CCP, CCP was designed to do exactly what we delivered, right? We helped customers through a situation. And also, we provided a way to accelerate Flex adoption, and we've seen that with our Flex license adoption throughout the quarter, which we called out. And then obviously, we had a fantastic endpoint quarter, which continues to help drive all the other modules. So overall, I couldn't be happier with the quarter that we just put up.

Yes. And on your question with respect to Pangea, I think that I called out that we have got a de minimis impact from both a revenue standpoint and net new ARR. And we're excited that those are going to roll into the platform in Q4. So that's how we think about it.

Your next question will come from Saket Kalia with Barclays.

Great quarter, and congrats, Andy. George, maybe for you. I just want to pick up on your comment earlier on SIEM. It feels like the SIEM market is starting to see more velocity of displacements. Can you just maybe talk about what sort of value you're able to capture in those opportunities compared to what customers were maybe spending before? And then maybe relatedly, how do you kind of think about the timetable for legacy SIEM renewals in the coming quarters, years, which, of course, I imagine you'd be targeting?

Yes. So I'll try to wrap this up into one answer here. But Saket, let me just kind of lay this out, if you look at the journey that we've been on and how we've been able to replace legacy AV, it feels a lot like that market in the early days when we think about replacing legacy SIEM, customers are looking for better outcomes. They're looking for faster results, and they're looking for lower cost. And because we already have the EDR data in the platform, we can offer disruptive pricing versus our competitors. The most -- the stickiest data that's out there is the EDR data, we already have it.

And really, what it becomes is a journey to activate Next-Gen SIEM for our customers. So when we think about the opportunity to work with customers and how we get in and the opportunity going forward, keep in mind, all of our customers are Next-Gen SIM enabled, all of our customers are Next-Gen SIM enabled. It's a huge difference between us and everyone else in the marketplace. And all we need to do is go through the licensing exercise, and Flex is helping to accelerate that. So we can offer competitive disruptive pricing and then overall grow our total wallet share with the customer over time. So it's a multiyear long-tail journey that feels very similar to the displacement of legacy AV.

Your next question will come from Matt Hedberg with RBC.

Congrats from me as well on the quarter and Andy to you as well. George, building on your Next-Gen SIEM success and Onum and a little bit related to Saket's question, do you see a further push into observability? Obviously, there's been some movement with some of your cyber competitors to go deeper into observability. Just curious on kind of how you view that market? And is that a consolidation opportunity for you as well?

Well, we do view it as a consolidation opportunity. And I'll remind everyone on the call that when we acquired Humio, which became LogScale, 50% of their business was actually in observability. So we have all of the technology. And in fact, because the platform is collecting so much data and so much telemetry, we have customers today that are using it for observability use cases. You combine that with our agent technology, which does deep inspection within its platform. And we have data that goes well beyond security data that is already being consumed by customers.

And then you combine that with Onum pipelining technology, the data fabric, which again has the ability to take IT data. And we have a fantastic opportunity in front of us to consolidate in those areas, which, again, this is nothing new to us, we've actually been doing this. And this has been part of our selling motion as well as what customers are embracing. So it's already there, and there's certainly more that we can do and certainly more we will do.

Your next question will come from Gabriela Borges with Goldman Sachs.

Question for Burt. So CrowdStrike has years and years of data on customer cohorts and how your customer cohorts typically expand with you over time. You've now got several quarters of data on Flex and how the Flex customers expand with you over time. There's a piece of this which is structural, which is you're making it easier for customers to consolidate with you. But I'm wondering if there's also a dynamic where you see an elevated tailwind to NRR for a period of time because of Flex and Flex starting with your best and most excited customers and then perhaps normalizes lower. So my question for you is how do you think about that dynamic? How do you think about the tailwind that Flex is driving in the model and how sustainable that is?

Thanks, Gabriela. So the way I think about this is our Flex licensing, it's continuous. Net ARR will be continuous throughout time. And the beauty of this whole program is that it's designed for customers to easily buy more. So over time, we're excited about the opportunity as we bring more products to market and offer more availability to our customers easily. And I think that's the biggest piece that everybody on the call should just remember is that, that's exactly what Flex was designed to do, make it easier for customers to buy, make it very easier for us to be able to deploy and be able to give value and lower TCO. That's how we think about it.

And the benefit is that we're seeing bigger deals and longer deals. And that's all good for us, and it's great for the customers. And I think the most important thing is and not get lost in things I've just said is consolidation. We started this company talking about consolidation, the ability for customers to do more with us, spend more with us and lower their total TCO but spending more with us. So I think that's the biggest point that I want to drive home.

Your next question will come from Dan Ives with Wedbush.

And also congrats on the Mercedes deal, George. Can you just talk about AI? Like as you're starting to see more and more deployments, talk about how that's changing the conversations with customers, even over the last 3, 6, 9 months relative to where CrowdStrike sits. Can you maybe just give some insight into how those have changed from your perspective?

Yes. Great. Thanks, Dan. Thanks, as always. Yes, when we think about the conversation of AI, what customers have realized is that CrowdStrike is probably the only company in security that's moved beyond chatbots. And what I mean by that is Charlotte AI and its related agents are deeply embedded into the platform. At our last Falcon in Europe, we talked about 11 AI agents and AgentWorks, which allows our customers to actually create their own security agents, which we think is going to be a massive opportunity for us.

So it's moved from chatbots to actual doing work, and this is something that we continually hear differentiates us from our competitors. Our competitors are still stuck on chatbots where we've done the orchestration within the platform. We've created models around each of our modules, and we're delivering results. Things that would take 4 days of work, we're delivering in minutes for customers.

And at the various events that I was at both in Las Vegas for Falcon and in Europe for our Falcon in Europe, our customers talk about just the evolution of Charlotte, the maturation of it and how it's become a key part of their success in their SOC. And it gets back to what I said earlier, CrowdStrike has become the operating system for the SOC and Charlotte is a big piece of it.

Your next question will come from Joseph Gallo with Jefferies.

Congrats, Andy, on the new role. It was awesome to see you guys maintain the fiscal '27 net new ARR growth of 20% on higher numbers. You mentioned several key components of the business accelerated in 3Q. Is there 1 or 2 products that you think have an outsized growth impact for upside next year?

And then as a part of that, security for AI feels necessary but very early. Is that accounted for in your preliminary fiscal '27 guidance? Or is that more longer term?

Yes, sure. So I think when we look at next year, again, seeing the momentum that we talked about with Next-Gen SIEM, again, it's an all-star product. It delivers a lot of value, which is key in this market when you're talking about consolidation. And it's enabling customers to do things that they haven't been able to do.

And I think one of the areas that maybe is really not appreciated is that many organizations of all sizes are making a decision in the past to not collect certain data because of the cost. With CrowdStrike, we can actually open the aperture, and we can provide value to collect all that data. So in general, we're expanding the wallet share, but we're giving them more value because we're collecting data they've never seen, and we're giving them outcomes that weren't available to them previously.

So I would look at that as an all-star. I would look at cloud. We look at the displacements that we talked about in the call. We looked about -- we talked about the runtime protection, which is key. Customers want that protection. And then we look at Falcon Shield, which is, again, cloud and identity, but it is a key technology to help protect the SaaS applications. So these are all fantastic opportunities for us in the coming year, and we'll continue to double down on them.

Your next question will come from Fatima Boolani with Citi.

Here I go. George, I wanted to direct this to you. You gave us a lot of information about your strengthening partnership with AWS. And your proximity to AWS for customer and a very, very strategic partner has only cemented further. So I wanted to ask you a very high-level strategic question. This proximity that preclude you or influence you or potentially maybe even complicate your relationship with other hyperscalers and your customers who would typically presumably have multi-cloud infrastructure footprints. I would love for you to sort of dive into some of those dynamics a little bit, again, just by virtue of the strengthening partnership with AWS and the availability of the full Falcon suite in a very deep integrated way inside AWS.

Yes. So first, we couldn't be more excited about this partnership. And really, I mean, I think this is something that's going to be incredible for AWS customers as well as customers at CrowdStrike and the fact that now natively, you can actually flow data from AWS into Next-Gen SIEM. It's right in your console, and it's going to be a tremendous enabler for new customer acquisition. And it's a needed technology for AWS customers. So overall, a fantastic relationship, and we're excited to be deeply integrated.

And when we think about the current environment, as you know, there's always an area to cooperate with many different companies that are out there. Just look at the AI space and how many people work with different companies that are out there. I think if you look at that and you apply it to security, of course, we're going to work with other players that are out there. They're going to leverage the best technology in the market, which is CrowdStrike. And we're there to support all of our customers and potential partners. So it doesn't preclude us from doing that. But again, I think this reinforces what a great relationship we have with AWS, how we've been able to partner with them, not only in the technology side, but also in the marketplace. And you've seen the evidence of that by the awards that I called out. So overall, extremely excited about what the future brings.

Your next question will come from Meta Marshall with Morgan Stanley.

Great. You noted core EDR acceleration in the quarter and you kind of noted AI as a catalyst for that. But just is that kind of more endpoints getting protected or as they become more intelligent or just existing customers looking to modernize as part of general AI adoption?

Sure. When you think about endpoints and the adoption of AI, a lot of it takes place at the endpoint. Think about all of the various technologies that are out there where people are running these as a user on their endpoints. And we've seen some big announcements from consulting firms and others that are leveraging AI in their business because they have to and they have to drive efficiencies.

So what that means is that, that creates opportunities and exposure for companies. So they're going to need to monitor what sort of queries go in. They're going to need to monitor what data comes out. They're going to need to monitor what other services are connected into those AI desktop technologies, and that becomes another threat vector. So this becomes a catalyst. Again, I think this is underappreciated as a new risk vector that we hadn't had over the last number of years. Now with the adoption of this, this isn't AI creation, it's AI adoption. And that, I believe, is going to be a massive market opportunity for us. So that's where we see that. And overall, as I always say, 50% of the market is still legacy AV, and there's still a long runway in the endpoint business to be able to take that legacy market share.

Your next question will come from Patrick Colville with Scotiabank.

All right. I guess this one is for George. I want to ask about discounting levels because if I think about this time last year, we had the CCP program, but we also had CrowdStrike very correctly being aggressive to cement and extend its position through discounting. That was the right strategy, and these results prove that. But as I think about the quarter we've just had, fiscal 3Q and as we look towards fiscal '27, I guess, can you just talk about how you're thinking about just discounting and normal course of business discounting? Are those levels going to diminish over time as we have the Falcon outage further and further in the rearview mirror and your position is looking very strong?

Sure. Well, I think when you look at this market and you look at, say, enterprise sales, I mean, there's always some level of discounting. That's not unique to us. It's not unique to security, and it's not unique to software companies. It just happens as a normal course of business. And I think we've been very prudent in how we operate in those areas. And we've tried to focus on things like CCP, which again, allow customers to take new technologies in, but protect the price point and allow us to basically capture them in a flex opportunity.

So we're going to use the tools available to us to be competitive. We continue to take share. We continue to drive new customer business. And we don't see anything out of normal course of business, but we've got various tools in our toolbox, and we tend to use those judiciously and again, where it makes sense for us and for the customer, and that just drives the growth that you've seen. And I'll also point out the 81% gross margin, like you have to look at the margin as well. And we've been able to be successful, and we've been able to protect the margin.

Your next question will come from Eric Heath with KeyBanc.

Nice set of results. George, I wanted to ask about the partnership with F5. I thought that was pretty interesting. But correct me if I'm wrong, but I believe this part of the infrastructure stack historically was never able to support endpoint agents before. So does this expand the endpoint TAM? How meaningful can this be? And are there other areas of the infrastructure stack you think this is applicable to?

Yes. This is a great and insightful question. I'm really glad that you asked it because it does. And what we've seen over the years is that customers have been asking for a long time to protect these appliances. And in many cases, the appliances has not been available to us, the underlying operating system, if you will, to be able to protect, but there's been a huge demand there.

So we worked with F5 in great partnership and very quickly to be able to certify our agent to run on their platform. And we do think that this will create a model, working model that will open it up to other appliance vendors to be able to have it protected. And I can tell you just some anecdotal stories. There was a story just last week of a noncustomer never used CrowdStrike, had the opportunity to actually use our technology because of F5 and was blown away. And within a week, we had them in an EBC, and now we're getting into a proof of value.

So this play works, and we're going to expand our market and be very forward leaning in being able to protect other appliances that are out there, which you probably have seen are the tip of the spear for many of these nation state breaches.

Your next question will come from Roger Boyd with UBS.

Well, congrats, Andy, on the new role. I wanted to double-click on the Kroll partnership. I know MSP has been a growing part of the channel for CrowdStrike for the past couple of quarters. Can you walk us through that longer-term opportunity as you expand with Kroll and other -- beyond kind of the initial endpoint landing spot?

Sure. Yes. We are excited about this opportunity. We took out another EDR vendor that was in there. We're providing a much better solution for them and their customers. And they're in a segment that allows us to bring our technology to. There's a lot of incident response engagements they're doing. They're part of the insurance panels. And it opens up a market opportunity with one customer and just accelerates our ability to penetrate that.

So these are the type of models that we like to create. We've been very successful in the MSSP market. This is just another proof point of us working with customers like Kroll and the reach that they have and the trust that they have. So the idea is to create more Kroll opportunities and certainly grow the opportunity that we have with Kroll, which I feel very confident we will.

Your next question will come from Tal Liani with BofA.

I'm trying -- you're a $5 billion revenue company and you only provide one number, revenue or ARR. There's no breakdown. So I'm trying to understand a little bit of the kind of any segmentation of your revenues. And the question I have is, can you discuss verticals like contribution of SMB and trends in SMB, kind of new market opportunities that were not in your core before and how you're addressing them? And also new customers versus upsell to existing customers. Are you disclosing NRR and GRR? I know you stopped doing it a few quarters ago.

Actually, let me take the last part of your question first. So basically, we are going to be giving out dollar-based net retention and gross retention rates at the end of the year. So that's what we've talked about, and we will do that, Tal at the end of Q4. So -- and we do it every Q4. So I think you'll be -- you'll get that information.

Now with respect to breaking out how we think about our business, whether it's enterprise or SMB or MSSP, the great news about our business is that we sell all of it. We're successful with all of it. We're successful with small deals. We're successful with large enterprise deals. And for us, we have that great technology that it's the same. It's the same technology for if you're a 5-person shop or you're the largest company in the world. And the beauty of how we're able to deliver our technology is that it's up and running in seconds.

So when you think about segmentation, you think about who we sell to, it really is everybody. Our ability and our success is agnostic. We are really driving new wins and displacing competitors on a daily basis, right? And for us, to continue to invest in the business and for us to be able to continue to make sure that we're able to deliver in a very timely manner, these are the successful things that we look at to be able to sell to all of our customers, whether big or small. So we're excited about that. And we're also rare in the entire security community to be able to do that successfully.

Your next question will come from Mike Cikos with Needham.

This is Jeff Hopson on for Mike. With the increased amount of M&A activity in security we've seen this year, including CrowdStrike recently, how are you guys approaching the buy versus build when it comes to a technology like AI that's developing pretty quickly?

Well, when we look at the market, certainly, there's a lot of activity out there, and it probably isn't a week that goes by that we don't talk to some bankers that are talking about other companies. The great news is we've got a tremendous balance sheet. We're in a fantastic position to be able to build or buy or partner. And I think we've been very thoughtful about our acquisitions. And a big part of our strategy has been the integration.

When you look at Pangea, we're really starting to sell that in Q4 because we wanted to take the time and effort to integrate it. It's not just kind of stitch together. The single platform, which I talked about, is very important to our customers. So we're going to continue to be thoughtful. We're going to continue to buy what we perceive as best-of-breed in the market, not legacy technologies. We're going to integrate them, which is part of our customer brand promise. And we're going to continue to grow them within our sales motion and the channel that we built. So we'll be opportunistic, but we'll also be very strategic in what we buy.

Your last question will come from Adam Borg with Stifel.

Awesome. And Andy, congrats on the role. Maybe just on the identity business. It's great to hear stronger quarter there qualitatively. I know we've talked in the past about PAM being almost like a 1.0 product. Love to hear more about how you're thinking about that product, in particular, and the maturity in coming quarters.

Yes. So identity, as we mentioned, super important in an AI era, something that we got into many years ago, and we continue to evolve that. And we've seen some really nice wins specific to our PAM technology. We have to look at what customers are telling us and basically skate to the puck of where they're going, which is they're looking for more modern identity solutions. They're looking for solutions that can do just in time and some of the kind of legacy vaulting they'd like to move away from. So those are areas of focus for us.

We'll continue to build out our identity stack. It's been very successful for us. But certainly, there's more to do. There's more to build out and there's more opportunity in front of us. The good news is there's demand from customers, as you've seen lots of market movement. And as customers think about what they're going to do next, they want to make sure they set themselves up for really in the next era of agentic identity, and CrowdStrike will be there for them.

This concludes today's question-and-answer session. I would now like to turn the call back to George Kurtz for closing remarks.

Thanks, everyone, today for your time. We appreciate your continued support. We'll actually be presenting at the UBS conference tomorrow and a live webcast and replay of the presentation will be available on our IR website, and we look forward to seeing many of you at the conference. So thanks so much. Stay safe, and we'll talk soon.

All right. Fantastic. We will go ahead and kick it off day 2 of the Goldman Sachs Communacopia + Technology Conference. Thanks so much, everyone, for joining us at the CrowdStrike session. Delighted to welcome George Kurtz back on stage with me, Founder and CEO of CrowdStrike. Thank you for joining us.

Great to be here.

So George, I know how much you pride yourself on being more than just a vendor to your customers. What I mean by that is we spend a lot of time having more strategic conversations about where security strategy is going. So maybe to start, share with us some of those conversations on AI strategy in particular. With your largest, your most technology sophisticated enterprise customers, how are they working with you and how are they thinking about what their security strategy looks like in an age of AI adoption?

Yes. I think when you look at customers and larger enterprise, everyone is in their early days of their journey of AI. And it started in 2022 with, hey, this ChatGPT thing is pretty cool. It can give us some really cool results until you get something wrong and you have to correct it and it's like, "Oh, yes, you were right. Yes, I'm sorry about that, I was wrong." And as you get through that journey, then it's like, okay, well, where can we operationalize AI and what does it mean for a business?

And I think keeping my CEO hat on, it's really about can it make you money or save you money and people are in that journey. And where can they use it, what areas, do they start in legal, do they start in sales, do they look in -- they're in financial services and sort of trading and those sort of things? And how do you do that in a secure way? And it started from -- we've got everybody using ChatGPT and it's totally uncontrolled, and data is going everywhere to we're going to shut it all down and then we're going to open things back up. We have to put guardrails around it. We have to manage the data. We have to manage the identity.

So that's been a couple of year journey, and we've been helping them with providing the guardrails, understanding the models, protecting the intellectual property, but you really have to enable AI to allow people to get all the benefits from it. And we're such in the early innings. That's what we're seeing right now. And I don't think there's a company that I've talked to where I talk to the people in the business and they go, "We want to use more AI, but we can't." And it's like, "Well, why can't you? Well, corporate doesn't let us." So great opportunity for us.

And to what extent is this building on the existing security foundational elements that already exist versus maybe catalyzing an incremental step function in modernization or next-generation product and architecture?

Well, I think if you look at most companies, I don't know how many companies in here think like their data is really good. I haven't found one. If you think like your data is really good, show hands, it's probably be like 0. Because everyone is like, oh, we have this data, it's in Salesforce, it's kind of a mess. And does that sound familiar?

Absolutely.

Right? And so I think there is this process now of like, okay, well, we've got to get our data architecture in line, we've got to make sure that we can put it in a Snowflake or Databricks or what have you, and we've got to train it and those sort of things. And it's just kind of a force function into like let's start cleansing the data, let's start labeling the data, and how do we move data around the organization and begin to provide some level of governance around it, which some have. But that needs to be in place so that you can actually get the training done on these models and then implement it in a secure fashion. And then it ties into identity, which I know we're going to talk more about.

But it all starts to come together, and it's like just the next industrial revolution that we're going to see around AI and all of the things that you're going to need to actually get the full benefit of it. They're all going to need security, all of it. And if you believe in AI and you believe there's going to be more AI in 5 years than there is today, then you're going to believe in the security story that security has to be part of AI in order to enable it.

Yes. And it's interesting because not all pieces of the security budget are created equal. What I mean by that is an analyst will break down, okay, here's network endpoint identity SIEM. The question for you is, how do you think about where in the stack the value is going to accrue? And you made a really interesting comment on the earnings report saying that AI is not a network problem. So maybe elaborate on that a little bit and how you think about the framework for what's defensible versus what's less important.

I think you have to look at where AI originates from and how people use it. So certainly, the data is a big piece of it. I talked about what CrowdStrike does in terms of like our training for some of our AI models, like we've become the Reddit of AI security data because we have all these annotated security events over the last 10 years. And you have to look at in each company, where the data is coming from, how it's labeled, how you have this kind of human feedback loop that you're still going to need. And then you have to look at who's using it.

Like at the end of the day, you have some autonomous actions that take place, but it's for the benefit of humans. And humans are going to be guiding all these AI agents, right? So that's why when I talked about it on the earnings call, it was like you got to -- it's at the endpoint, it's at the workload, it's at the data level. It isn't like some network device that's magically going to make AI secure. Like you have to look at how people use it and where it originates from and a lot of it starts around data and humans.

Yes. And let's stay here with data. We hear this argument that, well, the offense has the data, too. Meaning you've got defenders using AI in the security architectures, you've also got the bad guys using AI to attack. And my question for you is, can it actually be inverted this time around where the defenders can use AI to apply it to the data such that the defenses get stronger at a faster pace than the attackers who is trying to hold in it. I'm curious how you think about that.

Well, the way we look at it at the highest level is you have AI for security, which is the way we started CrowdStrike and was machine learning at the time, but it was using that to secure systems. And then you have securing AI to two different things. So when we think about the ability to actually secure companies, it really comes down to a time element, like the window of exposure and how fast things can be exploited have moved from weeks to days to now minutes and sometimes seconds. On one of our threat reports, we talked about exploitation of 52 seconds. So you're going to need AI to be part of that solution.

But I just kind of give you an idea of the threat landscape, maybe tell you one story. It was a week or 2 ago, our researchers found some malware. And it was really interesting because what it did is it would drop on a system and then it would gather a bit of information of what that system was. And then it would go out to a GPT and it would start querying it for like, hey, write a script that allows me to get all the data off the system or write a script that allows me to move from one place to another or it went through a whole bunch of recursive sort of questions into a public GPT.

So think about each time it dropped on a system, it gave a unique response back to what was on that system. So it actually learned what the function of the system was. Was it a database? Was it an e-mail server? Was it a desktop? And then based upon learning that, it would actually provide different actions for how it was going to exploit it and what data it was going to harvest from it. That's kind of what we're dealing with, right? And the speed of that's happening -- at which that's happening is like unparalleled.

Yes, absolutely. Well, the threat intelligence part of your business leads really nicely into discussion around security operations center. Your AI SIEM business was up more than 95% in 2Q, ARR north of $430 million. And one of my favorite phrases that you used, it's like upgrading from a typewriter to a computer with moving from legacy solutions to fast solutions. So what do you see as the biggest impediment today in your customer base from getting people to make that upgrade cycle from typewriter to computer?

Well, there's always a level of inertia in what people are familiar with. And when you've got newer technologies, you have to really focus on what the outcome is. And sometimes you may talk to a customer like, well, we do it this way, and it's like, okay, but what is your outcome? You don't really need to do those five steps when we can just go right to the step that you want and the outcome that you desire. And that's really what we focus on.

But I don't know, I'm a simple guy, I like to just break it down into better, faster, cheaper. Like we can offer a solution that gives you better outcomes faster and we can reduce your cost. I mean we're taking costs from some of the big legacy SIEM vendors, and we're cutting it to 1/3 on what people were paying. So there's a reason why people are moving to CrowdStrike. And what's important to keep in mind, too, is every Falcon platform customer has Next-Gen SIEM built in. It's in the platform. The only thing we need to do is license it, and we actually give them 10 gigabytes free so anybody can use it.

The second critical piece, which sometimes I think it's often overlooked is we actually don't charge for first-party data, okay? What that means is first-party data is CrowdStrike data, the data that we generate from our agents that people were taking from their legacy SIEM and paying to move it -- sorry, taking from us and paying to move it into a legacy SIEM, you don't have to do that anymore. You actually don't pay for that. So that's vastly different than their old models and very disruptive. So where we charge them is for ingest on the data that we don't have.

Now when you combine that with Onum, that's the acquisition we did last week or a last week or 2 ago, that's like the railroads, right? We control the pipeline of where data originates and where it's going to go. And we can do in pipeline detection with AI at the source of the data and the events where it originates. And again, this is for third-party data. So it's very disruptive on the speed and the cost. So we can go into a customer and basically say we can dramatically reduce your cost and give you a much better outcome.

And maybe to crystallize this point on Onum and the data pipeline piece of this. When you approach customers in the pipeline today or when your sales team does and they say to you, well, we get this on 2/3, but this is not a priority for us. It's going to take us X number of months to migrate. What is X in the number of months and what is it post Onum?

Well, it depends on each customer. And let me just tell you through the sales cycle, typically how it occurs, which is we're at the point now of customers going, okay, we know your stuff works, we know it works at scale, you have plenty of reference customers, we tried it, we like it. So we want to move from our legacy SIEM to you, which means we're not going to renew something. So we got to move it all over to you. And typically, the way that would work is you would run two systems in parallel, and then you would cut over.

So what Onum allows us to do is not only can it do in-pipeline detection and really cool kind of features, but you can fork the data. So literally, you can have one event and send it to multiple places, it doesn't matter. So you can keep your legacy SIEM running and then deprecate that over time. And then by the time the renewal comes up, you're up and running on CrowdStrike. And by the way, Charlotte can help actually even in the migration process. That is going to dramatically accelerate the adoption of Next-Gen SIEM. That's one.

And two, and we just sort of talked about the security use cases when we announced it. But guess what, it's an IT product. So any data in your environment in IT can be consumed by Onum. And that then moves -- continues to move us into different buying centers, into the DevOps buying center, into the IT buying center, right? You become much more strategic when you're consolidating all these costs. So it is a very strategic acquisition that we did. I think a year or 2 when we're back here, we're talking about, you can be like that was a really good acquisition because it goes well beyond security into IT.

Yes. And I'm curious because the problems in the SOC have been compounding for 10-plus years now. Do you think there is an incremental stress function happening because of AI such that the scalability of log ingestion is increasingly at a breaking point because the complexity of being able to do AI logs is changing? A couple of different concepts in there. So maybe correct my technical knowledge.

Yes. I think people, just in general, are overwhelmed with the amount of data they have and sort of the noise that they have to deal with. One of the things that we developed is something called Signal, which is to separate the signal from the noise because you have so much data, and that's kind of an AI element that gets rid of all the noise. But in general, SOCs are overwhelmed. They're using legacy technologies. They're using legacy workflows like SOAR, I think, is going to be dead, right? And we can talk about sort of agentic SOAR and what that looks like. But these are all transforming the SOC.

We work with lots of companies, lots of the companies in the room here, banks, et cetera. And it's not like you guys are piling on the headcount. I'm sure the conversation is how do you do more with less, right? That's everywhere, not just in IT. So when we think about the SOC, it has to transform and it has to become agentic. You've got to use AI for what it's really good at. It can deal with lots of data very quickly. It can understand patterns very quickly, and it can take actions even if it's a guided action, which is going to dramatically reduce the cycle time to getting things done and separate the noise from the signal.

Yes, absolutely. So it leads nicely into a question around agentic in the SOC. And we know that security people are some of the most risk-averse people in the IT organization. And yet you're seeing a success with Charlotte. And one of the comments you made to me a couple of weeks ago was you've actually put enough guardrails on Charlotte to make it act deterministically with a set of framework. Tell us a little more about that. How do you put the right guardrails on the agents to get to a place of productivity?

Yes, that's a good question. So when we built Charlotte, it was built as an agentic technology from day 1, actually before people were calling these things Agentic AI agents. And the whole idea was we wanted to go beyond just kind of a chatbot, right? So you can think about Charlotte as an orchestration layer with multiple models underneath it. And we had to provide to your question, guardrails, we had to build all this. So that when you ask Charlotte a question, I'm sure when you use ChatGPT or Claude or what have you, you ask a question three times, you get three different answers. And you're like, well, I just ask the question, why can't I get the same answer? And in security, it's not a great thing if you got like three different answers to one security question. So we actually had to build the guardrails around that to give a deterministic outcome.

And those are the kind of things that are maturing in -- think technologies beyond Charlotte, where when you implement AI, you want to make sure you get the right answer one time. But we've built all of that in and then we built all the workflows in. So again, Charlotte has become more of an orchestrator of agentic workflows, which is really where we're seeing a lot of activity. And we've got over 30 million different unique workflows that customers are using per week across the platform, which is saving a lot of time and effort. But you couldn't get the right results. And to your point around security, like people don't want to take action if you're getting like random results. So we had to do a lot of work around that.

Well, maybe let me ask you the flip side of that question, which is if you think about copilots versus truly autonomous agents, Copilots tend to be more deterministic. So with the guardrails, what levels show it up from being more than just a copilot?

I'm going to save that for Falcon because I'm going to talk about that. So it is a good question. But I think if you look at where a lot of the industry is at, they're in the -- I still have to keep my hand on the steering wheel, right? And you want to get to a point where the car can drive itself. And in any big organization, again, you're going to have like a lot of resistance from a risk perspective where you don't want these random -- these agents doing random things. And that's why having the right data to train it on, getting the right outcomes, having the guardrails and then it's going to be an evolution over time where you're going to have that sort of autonomous piece.

Yes. And the amazing thing about some of these concepts that you're talking about, whether it's in the SOC or in the CrowdStrike stack more broadly, is some of the connectivity you have with the agent into observability. And when we discussed in the past, I think you framed it as, look, there are five categories of observability. We can do two of those five categories. So maybe bring us up to speed, how are you thinking about your technical road map in observability? And where do you see CrowdStrike's right to compete?

Yes. We keep getting asked more and more for different data elements. Like if you look at Falcon for IT, which has allowed us to cross over into the IT world of gathering information. So you have this sort of digital employee experience and these sort of things, like we can gather a lot of that information. And these are big categories that are out there that go beyond security. And why do we have a right to win there? Well, we have -- I'd like to say we're in the real estate business, right? We have beachfront real estate, which is our agents, whether they're running on a laptop or whether they're running in a cloud, whether it's an ephemeral workload. And they can pull telemetry beyond just security. What's the health of the system? What is it doing? What's the user doing, all the identity data associated with it.

So these become very interesting to companies. And we have something -- it doesn't get a lot of airplay and it should, but it's called Falcon Foundry, which is the ability to actually create your own module on our platform. And I think that's really the hallmark of a true platform is you can create your own stuff on it. So you can actually combine and mix and match IT and security data in your own application and you can solve unique challenges.

So we have customers doing this and solving things like we didn't even think about. And that's part of the ability to go out beyond just security. So our ability to go into IT, we're already there in certain aspects, but I think there's a huge runway ahead of us into solving more problems beyond just security. But within our own lane, you don't want to go too far afield, but there are a lot of things that we can do that tie in nicely that expand our TAM.

Yes. Just from a lane concept, so clearly, there are industry leaders in IT asset management, observability, et cetera. So do you envision a world where 5 years from now or 10 years from now, how do you think about where CrowdStrike fits relative to those incumbents?

Well, I think there's a huge market and lots of bleed over and observability wants to go on security, security wants to go on observability, those sort of things. I think at the end of the day, it's going to be a lot around the workflow and how do you get the data. And then how do you operationalize that and how does that impact sort of TCO and price.

And a lot of times, if you can supply 80% of what somebody wants at a very good price point, they're like, hey, that does what I need. Like that's good enough, and that does what I want in some of these other maybe ancillary areas, right? And then if you're really specialized and you have companies that have spent a decade doing it, that might be their niche. But it doesn't mean that it sort of limits your opportunity because I think having the real estate as a strategic beachhead allows you to do many things, and there's still a lot of TAM that you can capture.

What are some of the most interesting or maybe one or two most interesting examples of what customers are building on Foundry? And to what extent does that shape your own product road map?

Yes. I mean we have customers that are building applications like, again, you can pull data in from anywhere and build it into the workflow. So they're looking at specific identity use cases and then they're tying into things like Workday, what's the employee doing? Are they on a tip into badge readers? Well, did somebody badge in? Are they really the employee, they want to get to this piece? So they're pulling from lots of different systems to solve sort of an identity use case. Is it really you? Compliance. They're pulling data from a lot of different areas, and then they're building compliance workflows around specific compliance needs that they have for their own industry, and they can load all that up in there.

They're looking at using Foundry for a digital employee experience. So is your computer slow? Why is it slow? Is it about to fail? Is the hard drive? Like all these things that cost a lot of money, they're actually using CrowdStrike to solve that. We didn't really plan on it. We just have all this data and then they solve different use cases, and we're like, that's a pretty good idea.

Yes, really cool. Okay. Let's talk a little bit about the identity use case in particular. So you've been investing in identity since 2020. How do you think about where it makes sense for CrowdStrike to compete across the identity SIEM lanes? And where do you sort of draw the line between being able to invest in specific identity solutions?

Well, we've been in identity since 2020. We saw it as a major threat vector and things that were really causing companies to be breached. So first thing that we did is we got into ITDR. We helped really pioneer a lot of that. So identity threat detection and response. We've got a tremendous amount of telemetry out of those systems. And the key thing here is we already run on the high ground, which is domain controllers, right? This is the most sacred of systems in an environment is to run on a domain controller. So we had customers over the years say, okay, you give us all this rich telemetry. You're already running on our domain controllers. We're using legacy like PAM technologies. So why don't you come out with something that can help us and again, save time, money and move to more modern architecture?

So with our PAM module, it's more conditional access and just-in-time access than kind of just credential vaulting. And we think that's a more modern way to deal with identity. Now you have governance. I mean, there's a lot of pieces to identity. We do a few of them. More we're adding, more we're coming out with, et cetera. But it's a big market. And again, the good news is we were there very early and we identified it. ITDR, I don't know, we're probably the biggest player in that whole market. And then we keep adding like the PAM module, we just launched a quarter ago. Why? Because customers said, we want it. We launched it, and we already have customers on it moving from legacy technology. So I think we have more than our fair share of opportunity to win in that market. And it's a huge pool of dollars and a great growth opportunity for us.

And just to be clear here, you mentioned you don't have a vaulting product today. Do you envision a scenario where customers can use you as their PAM solution without needing a "legacy PAM" solution as well? Or is it more complicated?

Well, I think customers want more just in time. I mean the vaulting is -- I mean, it's a glorified password manager. Most of that was created in 1999 to store Windows credentials. What people want is real-time access, conditional access. And not to say you don't need to store like certain passwords, but that will become more commoditized.

Yes. It's interesting because we've talked about so many different adjacencies that sit around in the CrowdStrike platform. It leads me to a question on R&D and how you think about prioritizing R&D. Scale is important in security. You have competitors that will say, "Hey, we're out investing you 2:1 or 4:1." But we also know that not all R&D dollars are created equal. So how do you think about incrementally investing R&D? And how do you counter those claims on competitors saying, will we invest more?

I mean they can say whatever they want. A lot of this is where do you actually allocate in some accounting allocation like your R&D. So I think the proof is in the pudding of like what do customers say, where is the innovation, how fast you are innovating? Are you one platform? Are you three or four platforms? I mean this is -- the proof is in the cake that you're baking, right? It's not in saying that you spend a lot on the ingredients. I mean there's a lot of ingredients that people spend money on and the product is c***.

So for me, that's what it's all about. It's about driving innovation, and it's about the fact that we have a brand promise of the single-agent architecture with one platform. Last I check customers want one. You look at ServiceNow, one. You look at some of these Workday, one. One in CrowdStrike. And that costs actually a lot of money to do and to do it right. So that's the way I would look at it. And I don't get hung up. We spend a lot of money on R&D. We drive a lot of innovation there. Innovation is our lifeblood, and we're focused on solving the customer problems. And it's very complicated and it's a very convoluted process that we have to go through, not really. We just listen to the customer, we build what they want.

Yes. Well said. Let me ask you about Falcon Flex because by all the metrics that you've disclosed, it's been a home run in making it easier for customers to buy across the platform. Talk to us a little bit about how durable the momentum you're seeing with Falcon Flex. I'm sure we'll get more updates of Falcon. But to the extent you're willing to give us a little color now, how do we think about the durability of growth driven by Falcon and some of the ARR uplift that you're seeing?

On falcon Flex?

Falcon Flex, yes.

Well, I think Falcon Flex, we pioneered this licensing model. As you've seen everyone now has a Core Flex model, one that we've got the idea from, again, driving innovation not only in the technology, but in the licensing world. And we listen to customers. They basically said, we want to buy more from CrowdStrike, make it easy. You got 30 modules. Like you guys can't keep track of them. We can't keep track of them. So make them all available to us, make it easy for us to buy. The only people that like going through procurement are the procurement people. So let's go through it one time, we get a rate card and we want to add more, we do that. And it's been a total home run.

Out of the 1,000-plus Flex customers that we talked about, we got 10% of them reflexing. And of sort of that pool, we've seen 75% utilization of the Flex license. So we're seeing customers actually use more of their Flex sooner than they anticipated and we anticipated. And someone might come back and say, "Well, geez, is that a problem? Are they going to get a big bill? No. Because what we're doing is we're working with them on the demand plan to actually remove and consolidate the other products they have, so they can buy more of CrowdStrike.

The 75% utilization, maybe just benchmark that for us. How do you contextualize that?

Well, if there's a pool of dollars, they've used 75% of it faster than sort of you would on a monthly basis. If it's -- they're using more of it faster.

Yes. I got you. Okay. And then talk to us a little bit about what the reflex in the renewals motion is going to look like over the next 12 months. You have an elevated amount of Flex deals because of the customer commitment program in the last 12 months. So what should we be looking for in the renewal cycle? Do you think you'll see similar uplift? You've already talked about customers tracking ahead of their demand plans. Maybe just paint a picture of...

So just to reinforce, the Flex is the licensing model, right? It's a commitment, not a consumption. You commit, it's not a consumption. So it's very easy to track. It doesn't have variability to revenue and those sort of things. The CCP was just a way that we were able to work with customers and give them a pool of dollars that they can spend. But the byproduct of that sort of benefit of that is we had to move everybody to Flex. So if you want a CCP, it was a customer commitment package you had to have Flex. So we vastly accelerated the move to Flex rather than just waiting for the natural renewal cycle.

So we have a lot of customers that are just on Flex and consuming it. And then CCP is the customer packages that burn off Q3, Q4. Some of it runs multiyear type of thing, but you're going to see those kind of run out. And then obviously, the whole idea is 95% of the time, someone is going to renew that module if they got something for free.

Yes, absolutely. So I know Burt and the team have spent time dissecting the delta between ARR and subscription revenue. Maybe I'll ask you a higher-level question. When do you think that begins to normalize? And how does that shape the way you're thinking about the 2027 growth algorithm, understanding that it's too early for us?

Yes. I mean the key metric for us is ARR. So if you look at the $221 million that we delivered last quarter, it was a record for us, reacceleration. Burt talked about the 40% reacceleration in the back half of the year, right, 40% growth in ARR. That's the key metric. There's a bit of a divergence now because we really have an accounting artifact between revenue and ARR, and that is the partner rebates. So the reality is when we gave away some free products, we had to pay the partners on stuff that was free. That is actually a contra item. You would think it's a sales expense, it's not. It means you have revenue minus the contract gives you new revenue -- it gives you your net revenue. That's where you see the divergence. So when the partner rebates are -- when they're abated over Q3 and Q4, then ARR and revenue converge back together.

So it's interesting because you've seen so much success on the back of some of the "free programs" in terms of adoption. How do you think about does it make sense for that to perpetuate for longer? Or have you all as a management team drawn a line in the sand and said, look, this is the period of time in which we're running this particular program?

Well, that was for a specific incident we had to deal with. That's in the rearview mirror. But we have the ability with Falcon Flex to be able to be very creative and work deals. Hey, you have a legacy technology that you want to run out, we can be creative and put money in a pool. Like if you want to move from your old SIEM to our SIEM, we can help you with that. So there's a lot of levers that we can pull and we do. And this is a normal part of running a software and technology business. This is what happens, like you figure out where you are, what deal you're trying to get through and who you want to replace and you just kind of creatively come up with like how do you make it a win for the customer and how do you make it a win for them. And with Flex, you only pay for what you use when you use it. And it makes it really easy to ramp out of an old technology and ramp into ours without a whole bunch of extra cost. So those are the levers that we pull, and that's software 101.

Yes, absolutely. So I wanted to ask a question about unit economics because CrowdStrike has had consistently benchmarked best of class relative to security relative to all software. I'm curious when you look internally throughout your operating structure, are there particular levers that you're excited to pull because of AI applications internally? Maybe there's a little bit of discussion here as well on you're touching so many different points within the IT stack now that the CAC actually goes down relative to addressing some of these new categories. So maybe just holistically, how do you think about the durability of where your margins can go?

Well, we look at AI everywhere internally. Maybe just in general, like where can we be more efficient, things like legal, things like sales, marketing, et cetera, those are kind of ones you would expect, and we've gotten tremendous efficiencies out of it. But one of the big areas that we're investing in, which actually drives Charlotte to be even better and better is our Falcon Complete MDR service, right, our managed detection response. We have one of the largest MDR businesses in the world. And by the way, we have to drive automation in it, right?

And I think there's -- sometimes there's confusion of like, well, you have an analyst, how many customers can they handle? There isn't this weird like -- or I would say, legacy mindset of like you have one customer to -- seven customers to one analyst. We don't even think about it that way. The platform does the work, it drives the automation. So we continue to get more and more leverage in that business. And the output in terms of the technology we built actually goes into Charlotte. So what we use internally then gets commercialized and goes into Charlotte, and that becomes the basis for solving customer problems.

Yes. And maybe just on this point with the customer exposure that you have as well. What I mean by that is earlier in the conversation, you touched on having more personas using CrowdStrike in DevOps, in IT observability, Falcon IT, et cetera. So how do you think about the way your breadth is expanding with end customers? And does it actually end up changing your LTV to CAC because the incremental cost of those personas coming on to the platform is actually quite low?

I think it can. I think it can change the CAC over time. You just have to keep in mind that there are some specialized centers, right? If you're selling the DevOps, the same person who's selling traditional sort of endpoint protection and related technologies may not be the same person that can talk cloud and DevOps and those sort of things. So there's still a little incremental spend as you specialize. But I think overall, we've been very efficient in our CAC. We've got in-app trials. We've got the ability to turn things on very quickly and license them and make it friction-free. So all that accrues value to us and our shareholders. And then as we bring on these new technologies and we have new buying centers, we have the ability, again, to go out and be very efficient from a CAC perspective. Just keep in mind, though, there's some specialization that's needed in those areas.

Yes. All right, fair. Maybe we can leave the audience with a tease for Falcon. What are the milestones that people should be watching for next week?

Well, it's going to be, obviously, as you might expect, a big talk around AI, some of the things that we've already developed, what we're doing in those areas, and I think how we're really disrupting the industry. And I think one of the things that I would leave you with is, if you think about what we did in the sort of take cloud and Next-Gen SIEM and all those things out of the equation. If you think about what we did when we started the company is we had agents that ran on a computer that protected users with an identity and their data and where they went.

And if you think about the explosion of AI agents, you may have a 10,000-person company that has 1 million AI agents. They're all going to need security. They all have identities. They all have access to data. They all have access to workflows. And by the way, you're going to have to do introspection of what they did because you're going to need it from a compliance standpoint. There's no way Goldman Sachs is going to release a whole bunch of AI agents without security and without compliance, and that goes for every other company out here. So that's the big opportunity, and you'll hear more about that at Falcon.

Fantastic. Well, George, thank you. Please join me in thanking George Kurtz for the time.

All right. Thank you.

Hello, and welcome to CrowdStrike's Fiscal Second Quarter 2026 Financial Results Conference Call. [Operator Instructions] Please be advised that today's conference is being recorded. I would now like to hand the call over to Maria Riley, Vice President of Investor Relations. Maria, please go ahead.

Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, Chief Executive Officer and Founder of CrowdStrike; and Burt Podbere, Chief Financial Officer.

Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth, including projections and expected performance, including our outlook for the third quarter and fiscal year 2026 and any assumptions for fiscal periods beyond that are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995.

These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise.

Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the company's quarterly and annual reports.

Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today. With that, I will now turn the call over to George.

Thank you, Maria, and thank you, all, for joining our Q2 FY '26 earnings call. Reflecting on our second quarter, the key theme was reacceleration. We've talked about reacceleration coming in the back half of this fiscal year. It's here now. I'm proud of CrowdStrike's ability to deliver reacceleration, our return to year-over-year net new ARR growth a quarter early. Our reacceleration is driven largely by AI-necessitated demand for the Falcon platform and stellar execution across the business.

Q2 was a robust quarter where we exceeded all guided metrics. Highlights included: one, record Q2 net new ARR of $221 million, double-digit millions ahead of our expectations, showcasing accelerating net new ARR; two, ending ARR of $4.66 billion, growing more than 20% year-over-year; three, record Q2 free cash flow of $284 million or 24% of revenue; four, record operating income of $255 million or 22% of revenue; five, total revenue growth of 21% year-over-year, reaching $1.17 billion and exceeding the high end of our guidance; six, cloud, Next-Gen Identity, and Next-Gen SIEM platform solutions are now more than $1.56 billion in ending ARR, growing more than 40% year-over-year; and seven, we surpassed the 1,000 Falcon Flex customer milestone with the average Flex customer representing more than $1 million of ending ARR.

Building on last quarter's re-Flex momentum, now more than 100 customers have already re-Flexed. We're very pleased with adoption rates. Seeing so many customers re-Flex validates the Flex model and illustrates customers' accelerating consolidation with CrowdStrike. Quarters like this one highlight our momentum and progress on the path to $10 billion in ending ARR. Setting new records, achieving net new ARR reacceleration sooner than anticipated and rising competitive win rates highlight CrowdStrike leading the way in cybersecurity.

Our innovative solutions are winning at scale like Exposure Management, which surpassed $300 million in ending ARR and was named a leader in the 2025 IDC Worldwide Exposure Management Marketscape. CrowdStrike's market leadership was further reflected in Gartner's latest Magic Quadrant for Endpoint Protection Platforms where we were placed in the Leaderbox for the sixth consecutive year. Our position was furthest right for completeness of vision and highest for ability to execute out of all vendors for the third year in a row.

In cybersecurity as well as the broader technology market, AI's impact is palpable. As organizations of all sizes embrace AI transformation, I hear several thematic concerns from executives and Boards. One, where is shadow AI emerging in my business? Two, how do I control what data enters AI systems? Three, how do I control what AI systems can do in my enterprise? Which ultimately leads to the focal question of four, how do I secure AI agents? AI has made the role of CISOs and COOs more complicated than ever.

Answering these 4 questions is far too difficult, expensive, nuanced, conditional and incomplete. At the same time, adversaries are now using AI, democratizing destruction at mass scale. Our threat intelligence research uncovered Famous Chollima, a North Korean nexus group, using GenAI to infiltrate more than 320 enterprises by automating fabricated resumes and conducting deepfake interviews. The threat is real.

CrowdStrike's role in the agentic era is staying ahead of AI-armed threat actors to secure AI at every layer. Beginning with the AI model itself to the workloads and hosts on which they run to the actual human and agentic identities, to the end-user devices accessing these systems and applications. In this time of societal and technological revolution, we secure where AI happens. Enterprises are quickly realizing AI security is not a network problem. AI doesn't happen in transit. Model creation and AI development happens in the cloud and in the data center.

AI adoption happens at the endpoint on the computing device itself. And AI access happens by users with human and increasingly, nonhuman machine identities. CrowdStrike secures each of these attack surfaces. We deliver AI for security, where we revolutionize security operations with our own SOC agent, Charlotte. We also deliver security for AI helping the world securely adopt the power of agentic outcomes. This combination, grounded in our data foundation, is a competitive moat. You can't just stitch or acquire a unified AI native platform.

AI security's primary enforcement mechanism is not and will not be the firewall. AI security must be on the devices, workloads, data and identities anywhere, everywhere and always on. AI security and now enterprise security in the agentic era is fundamentally a data, speed and enforcement problem, one that CrowdStrike solves today and is uniquely positioned to solve tomorrow.

Driving adoption of the Falcon platform as the operating system of cybersecurity is our Next-Gen SIEM. Every day, customers are discovering the power of our native hyperscalable data foundation to solve their most complex security and IT problems. Falcon Next-Gen SIEM had a stellar Q2 with year-over-year growth of more than 95% and ending ARR of more than $430 million. Next-GEN SIEM is becoming synonymous with AI SOC transformation, akin to upgrading from a typewriter to a computer, unlocking new capabilities, cost efficiencies and agentic speed.

A leading Global 2000 communications platform chose Next-Gen SIEM in a highly competitive 7-figure legacy SIEM replacement. Synthesizing EDR and third-party data proved easier, faster and more effective than going with a network-first SIEM product. And we're not stopping. Today, we're incredibly excited to announce our intent to acquire Onum, a leading data pipeline platform. Built on a proprietary stateless in-memory architecture, we believe Onum is the perfect complement to Next-Gen SIEM. It offers unparalleled speed, scale and efficiency in onboarding to Next-Gen SIEM while giving customers control of their data.

Onum will bring Falcon's AI-powered detections closer to third-party data sources in pipeline, starting analysis before data even enters the Falcon platform. Here's why Onum stood out to us. One, speed. Onum delivers 5x more events per second than its nearest competitor and processes data in real-time versus legacy batch and store methods. Two cost. Onum's smart filtering reduces data storage costs by 50%. Three, superior outcomes. Onum's real-time pipeline detection starts before data enters the Falcon platform, delivering up to 70% faster incident response with 40% less ingestion overhead. If our Next-Gen SIEM is the engine that powers the modern SOC, then data is the fuel that makes the engine run. Onum is both the pipeline and the filter, streaming high-quality filter fuel quickly into the engine to drive robust, efficient and superior performance.

With Onum, CrowdStrike will align with each stage of the AI life cycle, ingestion and detection of data, filtration and optimization of data as well as actioning and enforcement to produce high-fidelity autonomous outcomes across security and nonsecurity use cases. Before, migrating data into Next-Gen SIEM was a long pole in a displacement tent, often requiring third-party tools. Our acquisition of Onum is a direct response to a growing course of frustration with the incomplete data and punitive costs from today's third-party tools.

We're forging a new path. Onum and Next-Gen SIEM will enable CrowdStrike customers to focus on earlier in pipeline detection, blazing fast data streaming and high-fidelity data filtration, optimizing the agentic Next-Gen SIEM experience. Most importantly, the acquisition of Onum will give our customers control of their security, observability and IT data, uniquely positioning CrowdStrike as our customers' data foundation.

With our performant data platform as its foundation, CrowdStrike is rapidly expanding our pace of AI innovation. Charlotte is our agentic SOC analyst, automating actions and now end-to-end autonomous workflows across the SOC. Charlotte had a record quarter, growing more than 85% over Q1. We're embedding Charlotte across the entirety of the Falcon platform, empowering customers to achieve their agentic security goals out of the box with immediate ROI.

Charlotte is constantly learning and improving as we train it on our market-leading threat intelligence, battleground incident response and scaled Falcon Complete MDR analyst behavior. As one of cybersecurity's largest MDRs, our Falcon Complete SOC data is akin to the encyclopedia threat telemetry, resulting in a powerful cybersecurity AI feedback loop. Our unique cyber data advantage, coupled with our data science expertise, create a reinforcement learning flywheel, continuously adapting and improving autonomous detection and response.

The outcome is Charlotte turning our data moat into a fortified and dynamic AI wall. Our customers are facing AI disruption, which is driving our Next-Gen Identity business. As agentic identities proliferate, customers require an identity security solution to safely leverage agentic AI, preventing exploitation, misuse and breaches. We recently announced the launch of Next-Gen Identity Protection, which extends our best-in-class identity protection to nonhuman identities or NHI, SaaS applications and most importantly, AI agents. Including Falcon Shield, our Next-Gen Identity Protection business exceeded $435 million of ending ARR in Q2, growing more than 21% year-over-year.

Based on customer demand and seeing another opportunity to innovate, we launched our own PAM offering in Q1. Elevated uncertainty around the future of legacy PAM tools is driving heightened interest in our Next-Gen PAM solution. Driven by the excitement for Next-Gen Identity Protection and Next-Gen Privilege Access, these new solutions significantly expand our identity opportunity.

A leading global consulting firm decided to replace their legacy PAM after years of frustration with cost, limited efficacy and point product woes. Our ability to deliver privileged account password rotation, privileged user identification and risk assessment, privileged escalation detection, user risk profile insights and flexible MFA controls for different departments helped this customer consolidate with confidence. With nothing new to deploy, this customer seamlessly met all device trust, escalating privilege and cyber insurance requirements.

Moving to our Cloud business, the rapid adoption of AI has placed a spotlight on the importance of securing cloud infrastructure at run time. While out-of-band posture tools can lend an overall view of security health, they are incapable of stopping breaches. CrowdStrike is a leader in cloud runtime protection with the largest and most sophisticated enterprises trusting us to protect their most critical production environments.

With the need to secure AI as a backdrop, we delivered impressive net new ARR in Cloud this past quarter. Total Cloud ending ARR exceeded $700 million, growing more than 35% year-over-year. A Fortune 500 energy supplier selected Falcon Cloud Security in a 7-figure win. The ease of adoption for our single-platform approach and having ASPM already natively integrated drove this win. Our ASPM reduced months of manual work into minutes. Through this upsell, Falcon Cloud Security consolidated more than 10-point products across CNAP, CSPM, ASPM, CDR and container security.

Contributing to our platform growth is our revolutionary Falcon Flex model, helping customers accelerate and maximize Falcon platform adoption. In Q2, we crossed 1,000 Falcon Flex customers, adding more than 220 new Flex customers. Not only are we and our partners successfully landing new Flex deals, we also continue to see increases in: one, platform adoption. Utilization of Flex contracts is more than 75% across the Flex customer base; two, re-Flexes. We more than doubled the number of re-Flexed accounts to nearly 10% of all Flex customers. In just an average of 5 months from their initial Flex subscriptions, this cohort of Flex customers found themselves wanting more modules and more consolidation.

Re-Flexes on average are yielding a nearly 50% uplift in Flex customer ending ARR, illustrating the strength of the Falcon platform and the power of our game-changing licensing model. Re-Flex activity gives us conviction in our net new ARR acceleration, highlighting the difference between a onetime ELA and the recurring Flex model.

A lighthouse example of the re-Flex motion was with a Fortune 500 software firm which completed an 8-figure re-Flex. 18 months prior to their initial Flex subscription expiration, this customer decided to take their next strategic step with CrowdStrike, enabling them to modernize their SOC by replacing a legacy SIEM and a hyperscaler SIEM. They also adopted Charlotte to identify threat hunting and SOC operations. What was recently a very successful Flex has become an even more impressive re-Flex.

Consolidation isn't just a phenomenon with our customers. We also see it with our ecosystem partners. Diverse partner types are continuing to standardize on Falcon as their cybersecurity platform of choice. Take Red Canary, an MDR focused on the mid-market to small enterprise recently acquired by Zscaler, one of our strategic technology partners. Red Canary decided to consolidate and migrate their legacy point product EDR installed base of more than 100,000 endpoints across hundreds of customers onto Falcon.

Through a multimillion-dollar Q2 transaction, Red Canary is migrating these customers to CrowdStrike, where they will enjoy Red Canary's MDR services delivered on the Falcon platform. Red Canary is just one of the many MSSPs who build their business on CrowdStrike. Further into the SMB market, Amazon Business Prime selected CrowdStrike Falcon Go for millions of businesses around the world. Business Prime members now receive Falcon Go as part of their subscription, opening a significant sub-100 user TAM. This partnership highlights our ability to strategically monetize new markets and migrate underserved segments from legacy ineffective technologies.

And lastly, industry stalwarts like NVIDIA continue to choose CrowdStrike as their cybersecurity partner of choice. With our recently announced integration of Falcon Cloud Security, with NVIDIA universal LLM NIM microservices and NeMo Safety, NVIDIA customers now benefit from full AI life cycle protection for over 100,000 LLMs through Falcon. Partners sourced over 60% of Q2 new business, highlighting our ecosystem's competitive advantage and leadership across all customer segments.

I started my remarks talking about acceleration. AI is accelerating every aspect of our society and revolutionizing the way we work, but it's also accelerating the adversary. I know all too well that there is no peace time in cybersecurity. The adversary never rests. The world is soon to embark on the largest arms race ever, the arms race over AI superiority. The world's AI infrastructure necessitates protection from development to deployment, from cloud to endpoint, and from human to agent.

CrowdStrike isn't just a passenger in this revolution, we're driving it. We're becoming the foundation of our customers' AI future, delivering the security platform that makes AI transformation possible. Looking forward, AI-driven market demand and customer-driven consolidation, brought together by our revolutionary Flex licensing model, drive my belief in sustained growth. In light of the demand environment and our platform superiority, our guidance now assumes back half net new ARR will grow at least 40% versus last year. With that, I'll turn the call over to Burt Podbere, CrowdStrike's CFO.

Thank you, George, and good afternoon, everyone. We delivered a strong second quarter, exceeding expectations across all guided metrics. We achieved record Q2 net new ARR of $221 million and net new ARR reacceleration a quarter ahead of our expectations, growing ending ARR to $4.66 billion, up 20% over last year. Market demand for our AI native Falcon platform and Falcon Flex subscription model drove strength across the business. The number of deals with total deal value over $10 million doubled year-over-year, and we reached a new milestone of 800 customers with ending ARR exceeding $1 million.

As George highlighted, customers are increasingly consolidating their security operations onto the Falcon platform as they modernize their security stack for the AI era. This momentum is reflected in our module adoption metrics with 48%, 33% and 23% of subscription customers adopting 6, 7, and 8 or more modules, respectively. Most notably, among our customers with over $100,000 in ending ARR, we reached a new milestone with 60% adopting 8 or more modules, demonstrating the power of our platform consolidation strategy.

Looking into the back half of the year, the combination of strong Falcon Flex momentum, record Q3 pipeline and increasing demand for our AI-powered innovations reinforces our conviction in driving year-over-year growth acceleration in both net new ARR and ending ARR. Moreover, we have a clear line of sight to well exceed the $5 billion ending ARR milestone by fiscal year-end, achieving the ambitious goal we set in 2022 as we execute on our path to $10 billion in ending ARR by FY '31.

Moving to the P&L. Total revenue exceeded our guidance range and grew 21% over Q2 of last year to reach $1.17 billion. Subscription revenue grew 20% over Q2 of last year to reach $1.10 billion, and professional services revenue was a record $66.0 million. The geographic mix of second quarter revenue consisted of approximately 67% from the U.S. and 33% from international geographies, with both U.S. and EMEA year-over-year growth accelerating compared to Q1.

Total non-GAAP gross margin was 78% and non-GAAP subscription gross margin remained best-in-class at 80% of revenue. Total non-GAAP operating expenses in the second quarter were $652.5 million or 56% of revenue. In the second quarter, non-GAAP operating income was a record $255.0 million and operating margin was 22%, exceeding our guidance. Strong top line performance and efficiency gains from our strategic plan drove the outperformance in profitability, highlighting our commitment to profitable growth as we accelerate net new ARR growth and execute on the path to achieving our target operating model.

GAAP net loss attributable to CrowdStrike was $77.7 million and included $35.7 million of expenses for outage and related matters and $38.4 million of strategic plan-related charges. Non-GAAP net income attributable to CrowdStrike was a record $237.4 million or $0.93 on a diluted per share basis, exceeding our guidance. In Q2, our long-term projected non-GAAP tax rate decreased to 21% from 22.5%, reflecting recent changes in tax legislation and resulting in a $0.03 benefit on a diluted per share basis.

Moving to cash. Our cash and cash equivalents grew to a record $4.97 billion. We generated record Q2 cash flow from operations of $332.8 million and record Q2 free cash flow of $283.6 million or 24% of revenue. Expenses for outage-related and strategic plan costs impacted Q2 free cash flow by approximately $29 million.

Moving to our outlook and modeling notes. Our leadership is showcased by our record Q2 performance, strong Falcon Flex adoption and expansion, continued strong retention rates and broad success across our AI-powered Falcon platform. This momentum further bolsters our conviction in continued net new ARR acceleration for the back half of FY '26.

While we do not guide to ending ARR or net new ARR, our revenue guidance includes the following assumptions: high single-digit sequential net new ARR growth Q2 to Q3 and at least 40% year-over-year net new ARR growth for the back half of the fiscal year, bringing ending ARR growth for FY '26 to more than 22%. Our revenue guidance also assumes a wider-than-typical range for professional services, given the strong Q2 performance. Additionally, as we discussed last quarter, as a result of our successful CCP and related partner programs, our ARR to subscription revenue assumptions includes a separation of $10 million to $15 million per quarter through Q4. When this impact begins to subside, we ask that you please reflect this when updating your models.

Moving to cash. Payments related to strategic plan costs are expected to be de minimis in Q3, and we expect to make Q3 cash payments of approximately $51 million in connection with outage-related costs. As previously discussed, we expect to exit this fiscal year with a free cash flow margin of 27% in Q4, expanding to more than 30% for the full year FY '27.

Moving to our outlook. For the third quarter of FY '26, we expect total revenue to be in the range of $1,208.0 million to $1,218.0 million, reflecting a year-over-year growth rate of 20% to 21%. We expect non-GAAP income from operations to be in the range of $256.0 million to $262.0 million and non-GAAP net income attributable to CrowdStrike to be in the range of $238.1 million to $242.8 million. We expect diluted non-GAAP net income per share attributable to CrowdStrike to be approximately $0.93 to $0.95, utilizing a 21% tax rate and weighted average share count of approximately 257 million shares on a diluted basis.

For the full fiscal year 2026, we currently expect total revenue to be in the range of $4,749.5 million to $4,805.5 million, reflecting a growth rate of 20% to 22% over the prior fiscal year. Non-GAAP income from operations is expected to be between $1,000.1 million and $1,040.1 million. We expect fiscal 2026 non-GAAP net income attributable to CrowdStrike to be between $922.4 million and $954.0 million. Utilizing a 21% tax rate and approximately 256 million weighted average shares on a diluted basis, we expect non-GAAP net income per share attributable to CrowdStrike to be in the range of $3.60 to $3.72.

Finally, Fal.Con 2025 begins on Monday, September 15. With over 100 sponsors and over 8,000 attendees, Fal.Con is going to be our largest customer event yet. We will hold an investor briefing during the conference on Wednesday, September 17. The briefing will be webcast live on our Investor Relations website, and we look forward to seeing many of you there. George and I will now take your questions.

[Operator Instructions] Our first question comes from Andy Nowinski with Wells Fargo.

I'm really impressed with the many new products you launched this quarter, particularly on the identity side. But I do have a question around the revenue guidance that you gave for both Q3 and the full year. I'm wondering if the partner rebate program you talked about last quarter remains in effect for the remainder of the year or if it goes beyond that. And if so, is that $10 million to $15 million per quarter that you just mentioned, I mean, is that -- I guess, is that factored in into your revenue guidance? Or is there more to it than just the partner rebate program?

Thanks, Andy. It's Burt. Hey, first, let me start off by saying that ARR is the best leading indicator of our business. We've used it since we went public. George and I talk about it all the time. First and foremost, we're very pleased with net new ARR performance in the quarter as well as our record Q3 pipeline.

Second, our guidance now assumes back half net new ARR will grow at least 40% versus last year with high single-digit sequential net new ARR growth in Q2 to Q3 and ending ARR growth for FY '26 to be more than 22%. Finally, we did give a wider range than typical for pro services and for partner rebates. Last year after the outage, we made an investment in our partners through these programs. And that has paid off and has helped us sustain our high retention rates and accelerating the new ARR. As previously stated, we expect the impact of CCP and special partner programs to subside starting in Q4 of FY '26. We would do this all again, Andy, 100% of the time. Making those investments really paid off for us.

Your next question will come from Matt Hedberg with RBC.

George, it was really interesting to hear you talk about identity. It seems like you're having a lot of success there with Shield and even some legacy displacement as well as your PAM acquisition now. Given the announced Palo Alto-CyberArk deal, can you talk a little bit more holistically about how you're thinking about targeting the identity market versus some of the pure plays and just kind of how you see this market evolving over time?

Well, yes, thanks for that. When you look at identity, this is something that we were well ahead of the curve in identifying in 2020, which is why we did the Preempt acquisition. We took the time. We've integrated it. It's a key part of our platform and our fabric today. Our customers love it. And they want more. They've been asking us for years to come out with a PAM solution, which we did in Q1. They're looking for alternatives, and they're looking for a next-gen technology that isn't just legacy stitched together.

So from the standpoint of identity, we've identified it very early as a key element to solving the security breach problems that are out there. With the announcement we made this quarter in terms of our Next-Gen Identity, which includes Shield, the uptake has been fantastic. We look at the breaches that are happening today. A huge part of that is in the enterprise SaaS market, right? And our product, Shield, combined with our other identity solutions, are key in helping prevent these.

So I think we're in a perfect spot and we're in a position where customers are demanding alternatives to legacy solutions. And we're going to continue to evolve. But the good news is we've been in the market since 2020. We've recognized identity is critical very early on.

Your next question will come from Saket Kalia with Barclays.

Nice quarter.

Thank you.

George, maybe for you. Thanks a lot for that comment on just the second half net new ARR growth of 40%. That's great to hear and I think very useful. Maybe the question is, what are you seeing from the customers who bought those customer care packages? That, of course, offered those customers great value in the wake of the outage. How do you maybe think about that net retention in the second half? And just as importantly, how helpful can Falcon Flex be in that process? Does that make sense?

Yes, it's a great question. And I have to go to the historical numbers on our renewal rates for modules. So 95-plus percent of the time, a customer will renew a module once they adopt it. So I got to start with that. Obviously, CCP was a new element for us, right? But when you look at the value that we provide in these modules and once customers see it, integrated into the platform and into their workflows, 95%-plus they're going to renew it. So we feel confident that we'll see these CCP packages roll into renewals.

And we've spent the last number of months working with customers and making sure that we've got the right level of success there. So I feel good about that. And obviously, that will take place in Q3 and Q4. And overall, when you've got the right platform solving real problems that are out there, that's a good thing for us and it's a good thing for customers. Flex, of course, is a big part of that. Remember, our CCP program, a lot of it was delivered through Flex. So we were able to seed the market much more rapidly in the Flex licensing mechanism than we would have. So we leveraged the CCP program to actually seed Flex and now we have the ability to re-Flex them on those CCP packages as they burn off.

Your next question will come from Brian Essex with JPMorgan.

George, I had a question for you on Onum. It looks like this is pushing in the direction of real-time analysis on streaming data. And I'd love to get your sense of how this -- how you envision this competing against legacy solutions, and also how you think it will either complement or potentially cannibalize what you're seeing on LogScale. I know from a practical standpoint, how do customer -- how do you anticipate customers utilizing this platform relative to what they're already using on a Next-Gen SIEM basis?

Well, first, let me say how excited I am about this acquisition. This is something, I think, really going to supercharge our Next-Gen SIEM business, which includes LogScale and something customers have been asking for. They're looking for a modern pipeline technology that will be able to get data, whether it's security data or IT data from 1 place to another. But the amazing thing about the technology is the in-pipeline detection. So we can begin doing detections at the point really of forwarding for third-party data, which is critical and it gives us tremendous flexibility.

And it's a great value prop for customers, right? Less data to move around and quick results, if you will. I think what's important, and I want to reiterate is our pricing in Next-Gen SIEM is very disruptive. Why is that? Well, we actually don't charge customers for data that CrowdStrike generates. This is why we're seeing so many displacements. If you think about legacy SIEMs, people have to take data out of our platform and put it somewhere else and pay for it. They actually don't have to do that with CrowdStrike. They only pay for the ingest of the third-party data.

Now we have other ways to monetize retention and those sort of things. But between Onum and between the way we actually price and the way we can run it because the technology is very scalable, we again think this is a tremendous value for customers and will be disruptive to the market.

Your next question will come from Gabriela Borges with Goldman Sachs.

George, I actually wanted to revisit some of the dynamics of competition on EDR in particular. One of the things we see in technology is invariably, CrowdStrike has been really good at innovating with some of the leading-edge modules that you've introduced over the years. Maybe just remind us, how do you feel about EDR? Are you seeing within the Flex contracts equal interest in EDR? Or are customers maybe -- is it all else equal with modules between EDR and the U.S. stuff? And to what extent are you still landing customers in EDR?

Well, I mean, 2 things are important. One is to realize that the modern SOC is built on EDR and it's built on SIEM, and in our case, Next-Gen SIEM. So without that EDR data, it becomes very difficult to manage and execute on Next-Gen SIEM and all the AI elements on top of it. We're the leader, as many third-party organizations have pointed to, in that space. We've pioneered it. And we continue to innovate, which is really important.

And the thing to remember is when you look at EDR, it's a way to get telemetry into the platform. But then you have all of the other AI elements across the platform. It also then allows the collect once, reuse many philosophy that we have so we can light up all the other modules. And I think a key element is, and customers are seeing this, there is a huge difference in the service layer that we put on top of EDR, things like Overwatch or Complete. Competitor's not even close in this area.

So what we're focused on is stopping the breach, and it's a combination of our technology and the service overlay, which is highly automated. But between those, people are really seeing the distinction. And then when you wrap it with Next-Gen SIEM and Charlotte AI on top of it, it's really a winning combination. So we're the leader in it. We continue to invest and we continue to innovate, and that's a core part of our DNA.

Your next question will come from Joe Gallo with Jefferies.

It was awesome to see the $700 million in Cloud ARR growing 35%. Can you just talk through an update on that competitive environment? Has that stabilized? And where are customers in the journey to vendor consolidation for cloud security?

Sure. It's still in the early days. When you look at Cloud Security, it really 2 paths to go down, right? CSPM, which is really more of a kind of a vulnerability exposure policy, doesn't really do any enforcement. And that was an easy button for a lot of customers. And certainly, vendors had success in that area. I think what people have realized as the market matures a bit is you really need cloud workload protection, which is something that CrowdStrike helped to pioneer and we have leading technology in that area.

So when you combine that with ASPM, right, or DSPM or SaaS security posture management and all of the other technologies, we have a very fulsome offering underpinned by cloud workload protection. So given the disruption in the market, we've seen tremendous interest and conversions with customers. So still very early innings but we are very excited about being one of the largest cloud security providers in the market by revenue. And we continue to invest and innovate there. And I think it's a perfect time, given the market dynamics, to take advantage of it.

Your next question will come from Mike Cikos with Needham.

Leila, maybe we can go to the next question and come back to Mike.

Sure. We'll go to Tal Liani with Bank of America.

Yes. Can you hear me?

Yes. Hi, Tal.

So if you wouldn't tell me that ARR is going to grow 40% a year -- 40% year-over-year in the second half, I would have told you that growth is clearly decelerating because your growing -- ARR is growing on a constant basis, 5%, around 5% a quarter on a sequential basis. And that translates into deceleration on a year-over-year basis. You started with about 32% last year, and every quarter, it slows down to about [ 20.5% ]. But now you're giving this guidance of 40% growth in the second half. And the question is, what drives it and how sustainable is it? So when you think kind of beyond just the year-over-year impact of the CCP and what happened last year, how sustainable is this acceleration of growth?

Yes, I'll start, and then George could kick in. So there are a lot of factors that give us confidence in the back half. We talk about how we're a consolidator, that continues. AI, that's a big piece of who we are. And I think that when you combine those 2 with the strength of the platform, these are the things that give customers confidence in going with us.

Certainly, as we've moved through our journey, the biggest piece that I see out there for us in terms of how we're going to continue to reaccelerate growth is this opportunity for customers to lean in more with us with Flex. Flex has been extremely well received. Customers are able to easily implement it. It's very easy in terms of to procure. And at the end of the day, it allows customers to be able to use Flex as they need it. And we've already given out a lot of stats with respect to how fast they're burning through their Flex licenses, which has been fantastic for them and fantastic for us. With that, I'll turn it over to George.

Yes. I think Burt covered sort of the financial mechanics around that. I guess what I would comment on is what I hear in the field. I spend day and night with customers, and it's all about how we're solving problems that can't be solved by other companies, how we are the #1 security product for stopping breaches in some of the largest enterprises around the world, and how customers want to go in more with us and consolidate around CrowdStrike.

So I kind of look at the feedback that I get and I look at the threat environment. We have one of the largest incident response practices in the world. And we're in helping noncustomers cleanup breaches from other technologies that they thought they were getting a good deal on. As I've said in the past, a good deal on a leaky lifeboat isn't really a good deal. So when you look at the end goal of saving time, money, and consolidation with the right outcome of stopping breaches, that's what our customers are buying and that's what I'm hearing. So that's why I get confident in the back half.

Our next question, we'll return to Mike Cikos with Needham.

This is Jeff Hopson on for Mike. Can you guys hear me okay?

Yes.

Perfect. Congrats on the impressive Charlotte AI growth. I'm just looking for any insights to specific features that may have pushed customers to adopt. Or I guess on the flip side, any hurdles that are keeping some organizations on the sidelines as some are still hesitant to adopt AI overall?

Well, if you look at Charlotte and its maturation, as with many technologies, these technologies mature very quickly. We've invested a lot into Charlotte. And the fact is we spent a lot of time early on, on the architecture so it's not a chatbot, right? It is something as an orchestration layer that is wired into all of our modules. It's wired into our workflows, and it was really designed for agentic security and security use cases. So customers are solving problems.

What do I mean by that? Tasks that would take 4 days to actually investigate and understand and kind of piece things together now taking an hour. The ability to have Charlotte, right, reports automatically for you. The ability for Charlotte to triage and act autonomously as a Tier 1 analyst, this is what gets customers excited and this is really what's powering the next-gen SOC. So customers are seeing every release more and more features and more and more capabilities. And just like any GenAI product keeps getting more mature and better and better.

Your next question will come from Jonathan Ruykhaver with Cantor Fitzgerald.

So my question is, when I look at the cloud-native attack surface, to me, it seems like it starts in code with misconfigurations. You have open-source vulnerabilities, insecure secrets. All those issues originate in the development stage. And we've seen move less. They capture issues, obviously in run time but it's often too late. So let me hear your strategy, George, or your view on where move to when you look at [indiscernible] Will we see further move beyond just container, et cetera?

Like anything else in security, if you could move left and capture these issues before they're put in production, it's going to be a good thing. We spent time in that area and have technologies. Our ASPM technology covers a lot of that. Our container scanning to understand vulnerabilities and open source before things are published, understanding what golden images are and providing some guardrails around that. So we've invested in those areas. We continue to invest in those areas.

I think a big part of it is going to be the AI story of understanding how all these interdependencies work in the build environments, in code and obviously, in sort of these interactions with MCP-type services. So this is something that we continue to invest in this area. And I think the AI elements we've already built are going to be extremely helpful to solve these challenges in the future.

Your next question will come from Shaul Eyal with TD Cowen.

George or Burt, a question which is not being asked frequently on your conference calls in recent quarters. $5 billion on your balance sheet. You guys focus predominantly on those tuck-in acquisitions. We just heard another 1 announced this evening. Those have been expanding the platform really nicely. Indeed, we see the great results of those historical investments. It would appear as if nothing transformational is on the horizon, and indeed, there's no need for that right now. What's the current thinking of that utilization? Pretty much steady as she goes, more tuck-ins? How are you guys thinking about it for the second half and obviously for calendar '26 and beyond?

Well, as you pointed out, we have an incredible balance sheet. Myself and Mike Sentonas and the team has spent a lot of time looking at the market, looking at the different segments that are out there and really thinking about strategically where we need to go. We certainly have a history of buying acquisitions and taking the time to integrate them. I mean, this is a hallmark of what we do and a proven track record of not just stitching things together.

So we're very thoughtful about these acquisitions. We have a certain sweet spot, which you've seen. Doesn't mean that we can't go outside of that. But we've got to find the right team, the right technology, the right company that makes sense for CrowdStrike. So our #1 goal is to be thoughtful, make sure that it's a fantastic user experience for our customer. And we're not just trying to buy ARR for the sake of ARR. It's got to make sense and it's got to be something that we can execute on and feel really good about.

Our next question will come from Ittai Kidron with Oppenheimer.

Congrats again on a good quarter. I wanted to go back to Gabriela's question on your core EDR business. If you take a look at your ARR and you exclude your [ Fab 3 ], your SIEM, Identity and Cloud Security and you look at the ARR growth of your core business, it seems like it significantly decelerated. It was growing 18%-plus a year ago. It's growing 11% now. How should we think about your core business growth going forward? Do you expect stability there? Are there any potential accelerators in that business? Or just given the size, we should expect that business to continue to decelerate going forward?

Yes. I don't look at it as core, I look at it as a platform. And the platform piece actually sets up all the other modules. So when you look at the 3 that you just articulated, whether it's Identity, Cloud, Next-Gen SIEM, it's all predicated on getting the telemetry into the cloud, which starts with EDR. So we feel really good about that. And I think when you look across the entire platform, you need to look at it as a platform, not separate kind of things out.

But from my perspective, we continue to innovate there and we continue to win. We continue to drive new business and I think people, again, looking for the best technologies with the right outcome, stopping the breach, choose CrowdStrike. And that's what we've seen time and time again.

Your next question will come from Roger Boyd with UBS.

Can you hear me okay?

Yes.

George, I wonder if you could compare and contrast your businesses in SIEM and Identity. Both are roughly similar scale but the growth rates are pretty different. How much of that difference would you attribute to the M&A disruption you've seen in the SIEM market? And given what's happening in the identity market as well as your expanded portfolio there, what's the level of conviction in reaccelerating that identity business from here?

Sure. Well, identity is a key area for us as I talked about. Obviously, we've got the Next-Gen offering that we announced. And I guess the positive news is that Identity was a very popular choice for CCP packages, so you'll see a little bit of impact from that. So I think when you look at identity, it is something that is going to be -- continue to be adopted by customers. There's still a lot of white space out there.

And I think when you look at the SIEM market itself, we're in the perfect spot. Customers are coming to us. They've come to us for years saying, we want something different. We were locked into a vendor. We're being charged too much. Give us something that's better, faster, cheaper that's integrated into your platform. And as I mentioned earlier, it's pretty disruptive. Customers are not paying to take data out of our platform and putting it somewhere else. They actually get it and they're only paying for data they put in.

So I feel really good about both of those businesses. And again, when you put them together and you look at how we're solving problems, Identity, Next-Gen SIEM, Cloud, I mean, these are all critical elements to the future of the company. And I think we've got really good performance around it.

Your next question will come from Jonathan Ho with William Blair.

Let me congratulate you on a strong quarter as well. When we look at cybersecurity to protect agentic AI, you have many of the pieces to help customers solve the AI challenge, yet spending in AI remains fairly fragmented. What are customers buying today? And specific to agentic AI, what categories are you most excited about right now?

Well, certainly, customers are in the early journey of how they leverage AI. And it's moving from, hey, this is really a cool technology to how do we implement it and implement it securely and do it in a way that actually accrues value back to the business. If we believe in AI, and we think there's going to be more AI in the future, in the next year, 3 or 5 years, then security is a necessity. You're not going to have more AI without security.

And what that looks like is everything from helping organizations create secure models to deploying those models, to creating guardrails, to creating visibility into these AI agents and protecting them. If you look at what CrowdStrike does, we're the leader in agent security and protecting computers and workloads, right, which is essentially protecting users, identities, data, workflows. An AI agent is just a superhuman. So we're in the perfect situation to be able to capture protecting all of these super AI agents in the future, and that's a big part of our strategy. So we're working on what's here today and we're also working on the future of protecting these agents.

Your next question will come from Adam Borg with Stifel.

Maybe just on Exposure Management, it was great to hear crossing the $300 million threshold. Love to hear the traction you're seeing. And is this really living alongside what you'll call the traditional VMware exposure vendors or is this displacing them? Any thoughts here would be really helpful.

Yes. It's an exciting business for me. I mean, it's one, in a prior life, I started a company called Foundstone in vulnerability management space. So to see where it's evolved and now into exposure management is exciting. We've got so many assets in terms of agent vulnerability management. And one of the things that may have passed some by is that we, a few quarters ago, added network vulnerability management and we can do that right from our agents across the network. So that's been very well received.

And we've got attack surface management and a host of sort of risk management technologies bundled in there. So I think we're really hitting the sweet spot in the market. And again, it goes to customers want to consolidate. And we've got some great big wins out of it. So -- and I guess the final piece is it's been recognized as a leader in the inaugural IDC Marketscape. So all good things and certainly a needed technology, it may sometimes feel a little sleepy but it's a really rapidly growing business for CrowdStrike.

Your last question will come from Adam Tindle with Raymond James.

Save the best for last. I wanted to continue on the acceleration theme. The net new ARR guidance implies another record of net new ARR for Q3. So I guess the first one for Burt. If you could just talk around assumptions for public sector, given that's Fed fiscal year-end. And then separately, you previously talked about net new ARR accelerating again in fiscal '27. I wonder if that still holds.

For George, real quick since I'm last here. Bigger picture, if I look at your back half guide for net new ARR, you're going to be run rating over $1 billion on that metric. It's a huge milestone, and I just wonder how you're thinking bigger picture about structural changes or things that you need to do to manage an organization of that size.

It's Burt. I'll take the first part. As we stated many times, fed today is not a big piece of our business. But there's a great opportunity for us. The Fed has come out and said they want to run like in the private sector. They want to consolidate, they want to reduce cost. They want to become more efficient. That plays right into our sweet spot. So we feel that there's a Fed opportunity out there for us. But those deals, they take time and we're patient and we want to land the right deals at the right time, but we're excited about that opportunity.

For us, at the end of the day, we've got great certifications with the federal government and we'll take advantage of it. In terms of FY '27, we'll give more comments about FY '27 at the end of our Q4. But we're excited about just the 40% acceleration in net new ARR in the back half. That, to us, should signal to you that we have a lot of confidence in the business, and we've got a lot of things that I talked about earlier that give us that confidence in the business. George, if you have anything else?

Yes. I guess I would add that there's always ways to optimize. I think when you look at go-to-market and you look at how we've evolved from selling modules into selling Flex and platform and activation, we've got to organize for success to make sure that we continue to work with our customers around this consolidation journey and activating more Flex. And I think we've done a good job of that.

But there's different ways to help optimize that. And then we have to take those learnings and apply it to our partner and channel communities. So we're always looking at, again, how do we optimize and how do you take the platform vision that we have and the execution that we see in the field from a selling perspective and make it as impactful as we can. So I think that will be something we continue to look at.

And that concludes the question-and-answer session for today. I'll hand it back to George for closing remarks.

All right. Thanks, Maria. So thank you all for joining us today. We look forward to seeing you soon at Fal.Con 2025. Thank you.

Hello, and welcome to CrowdStrike's Fiscal First Quarter 2026 Financial Results Conference Call. [Operator Instructions]. Please be advised that today's conference is being recorded. I would now like to hand the call over to Maria Riley, Vice President of Investor Relations, Maria. Please go ahead.

Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, Chief Executive Officer and Founder of CrowdStrike; and Burt Podbere, Chief Financial Officer.

Before we get started, I would like to note that certain statements made during this conference call that are not historical facts including those regarding our future plans, objectives, growth, including projections and expected performance, including our outlook for the second quarter and fiscal year 2026 and -- and any assumptions for fiscal periods beyond that are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995.

And -- these forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise.

Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the company's quarterly and annual reports.

Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A -- A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings press release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today.

With that, I will now turn the call over to George.

Thank you, Maria, and thank you all for joining our Q1 FY 2026 earnings call. Our fiscal year started from a position of strength.

While the market navigates evolving condition, CrowdStrike is capitalizing on accelerated demand through continuous innovation, increasing win rates and platform consolidation at scale. We consolidate point products without compromise and most importantly, CrowdStrike stops the breach.

In Q1, where we met or exceeded our key metrics, highlights include: one, Q1 net new ARR of $194 million, double-digit millions ahead of our expectations; two, Q1 ending ARR surpassing $4.4 billion, maintaining our leadership as the only pure-play cybersecurity software company of this size; three, subscription gross margin of 80%, demonstrating our AI platform efficiency; four, sustained 97% gross retention as customers remain firmly committed to Falcon; five, free cash flow of $279 million or 25% of revenue, demonstrating double-digit quarter-on-quarter growth; and six added $774 million of total Falcon Flex account value bringing the total deal value of accounts that have adopted Falcon Flex to $3.2 billion, growing 31% sequentially and more than 6x year-over-year.

Seeing our customers an ecosystem embrace Falcon Flex at this speed and scale gives me confidence, confidence in improving sequential net new ARR growth next quarter and accelerating back half net new ARR. Falcon Flex is significantly evolving our go-to-market and customer experience. The subscription model sparks Falcon platform adoption, delivers point product consolidation and fuels partner success.

I'd like to share where we are with Falcon Flex as well as a thematic customer win showcasing the power of the model. In less than 2 years since starting Falcon Flex, we've closed more than $3.2 billion of total account deal value across more than 820 accounts that have adopted the subscription model.

Here are the trends we're seeing. One, customers spend more, the average Flex customer deal size is greater than $1 million in ending ARR; two, customers commit to longer durations, the average Flex subscription length is 31 months; and three, Flex customers adopt Falcon faster, more than 75% of Flex contracts are already deployed.

The outcome of these points taken together as a phenomenon we're already seeing reflexes, 39 Flex customers have already deployed their initial contract demand plan and have returned to us for a reflex. These customers' initial Flex contracts were 35 months, nearly 3 years on average, and within just 5 months, they came back to CrowdStrike wanting more of the Falcon platform to achieve their cybersecurity consolidation goals.

The model we pioneered is a game changer. Flex accelerates what would have taken years of module sales cycles into rapid platform transformations unlocking adoption and spend while creating even more platform stickiness.

Now let's witness Flex in action at a Fortune 100 technology firm. We began our relationship with this account pre Falcon Flex when they selected CrowdStrike to displace and consolidate a point product EDR and legacy AV. Our initial EDR contract was for $12 million over a 3-year term. When we launched Falcon Flex, this customer took the opportunity to accelerate their cybersecurity modernization, executing a 5-year $100 million-plus contract. This is the power of Flex, evolving Falcon from what was a singular outcome sale into a multidimensional platform experience more than 8x the size of the initial deal.

This transformational Flex contract was for securing cloud workloads, expanding in other business units, Next-Gen SIEM to replace 2 legacy SIEMs and broad-based adoption of Falcon Complete to standardize detection and response. Within just 9 months of the initial Flex contract, this customer had already utilized 95% and of their initial subscription and still had more point products to consolidate and cybersecurity outcomes to deliver.

As a result, in Q1, this customer reflected to realize the following new outcomes: Expansion of Falcon endpoint protection across multiple additional business units, replacing and consolidating cloud protection with Falcon Cloud Security, which has since become the standard across a vast and growing cloud estate. Identity protection became an imperative across sensitive assets.

Next-Gen SIEM quickly became the central enterprise data store replacing multiple legacy SIEMs and expanding beyond security use cases into IT. Data protection is replacing legacy DLP from endpoint to cloud, Falcon for IT is replacing a legacy endpoint management tool and Charlotte AI will deliver agentic analyst capabilities and automation, accelerating security outcomes at scale.

This customer more than doubled their initial Flex subscription in their Q1 9-figure reflex over an unchanged subscription duration. Through Flex, this customer now spends nearly 20x their initial EDR purchase. Replacing more than 8 technologies and deploying more than 10 Falcon modules, this customer still has much more to achieve with the Falcon platform across millions of workloads, petabytes of data and hundreds of thousands of identities.

With Flex dramatically accelerating Falcon platform adoption, customers are already seeing our Agentic AI transforming their security outcomes. We're on the cusp of the fifth industrial revolution with artificial general intelligence on the horizon.

What excites me the most is the necessity Agentic AI is creating for CrowdStrike's AI-native security, growing our total addressable market each and every day. Here's why and how. In a recent market survey, 96% of respondents plan to expand their use of AI agents in the next 12 months with 2/3 already building agents and some targeting to reach over 1 billion in production agents. At their core, every AI agent represents a unique superhuman identity, necessitating visibility, control and protection for every single agent.

These autonomous AI agents increasingly have access to multiple internal and external data stores, applications and machines, automating business processes and workflows at scale. Simply put, AI agents dramatically increased the size, severity and speed of the enterprise attack surface. Size, more agents everywhere. Severity, everything is connected faster than it can be contained. Speed, autonomous agents move at machine speed.

This is the new attack surface, and it's an adversaries paradise. Just as enterprises need best-in-class protection for devices, data workloads and human identities, every AI agent has the same needs too. As an AI-first company, CrowdStrike is uniquely positioned to secure the identity, the workload, the infrastructure, the data and underlying AI models themselves.

We have the platform, we have the expertise, we have a track record. CrowdStrike will be the protector of autonomous AI agents. While we see a massive opportunity to protect AI agents, our use of Agentic AI is already transforming the SOC. Charlotte AI is our genic security analyst, completing tasks and making decisions to supercharge human stock personnel.

With the launch of Charlotte AI's expanded detection triage customers now have access to an agentic SOC analyst delivering autonomous expert-level triage, reasoning and response at machine speed, flattening the hiring curve, saving time and delivering even better security outcomes.

The power of Charlotte AI came to life in an 8-figure Falcon Flex expansion for a global health care provider. Charlotte AI was the tip of the spear in this customer's AI-native SOC transformation with Next-Gen SIEM, where we displaced a legacy SIEM. Charlotte AI and Next-Gen SIEM started a new chapter of cybersecurity for this customer.

Charlotte AI enables this customer's Level 1 threat analyst team delivering on the promise of Agentic security today. We deliver an AI-first automated approach, eliminating clicks, panes of glass and manual operations for a predictive, fast and cost-efficient SOC.

Next, I'll share updates on the momentum we're experiencing in our cloud, identity, exposure management and Next-Gen SIEM platform products.

First, turning to our cloud business. Cloud had a very strong start to the year with Q1 net new and total ARR growth accelerating year-over-year over the prior quarter. Our native unified offering combines cloud workload protection, posture management, application security and SaaS security on a single back end and with both agent and ageless form factors.

In Q1, we built on this approach with the launch of cloud data protection, all on our unified sensor, the very same sensor that also delivers our world-class workload protection which is what the market now wants and needs. Our innovation and commercial success was recognized in the 2025 Frost Radar, cloud and application runtime security report where we scored highest out of all vendors on the innovation index.

Further driving our success is recent M&A in the space, increasing our relevance and competitiveness as a hyperscaler agnostic, independent solution. We also announced the general availability of both our AI model scanning and AI security dashboard technologies at RSA.

With the rapid growth of AI tools across the enterprise, CrowdStrike is ensuring that enterprises can safely adopt AI while managing potential risk such as model vulnerabilities, data leakage, unsanctioned use an identity-based privilege. A prime example of a customer adopting Falcon Cloud Security was a 7-figure technology customer doubling their spend with us.

This customer had CrowdStrike on the endpoint and was using a competitor's point product, CSPM for cloud protection. The incident response call came into CrowdStrike when the competitor's CSPM didn't stop the breach. Our rapid platform expansion, including Falcon Cloud Security quickly illustrated the difference between just alerting on a breach and actually stopping one. This customer was able to consolidate on Falcon, save money and most importantly, see the benefits of Falcon Cloud securities protection.

Moving on to our Exposure Management business, which includes vulnerability management and attack surface management. CrowdStrike is rapidly evolving from an incumbent complement to a scaled disruptor. Historically, our biggest displacement gap was the lack of network scanning, something near and dear to me as someone who pioneered the vulnerability management space.

With the launch of AI-powered network vulnerability assessment, CrowdStrike now delivers unified exposure management for both managed and unmanaged devices. With this innovation, CrowdStrike customers no longer need to rely on legacy third-party VM point products. Our winning offering in this space is yielding exciting share gains.

A large financial services customer purchased Falcon Exposure Management across 120,000 devices through their Flex subscription. Utilizing Charlotte AI and Falcon Exposure Management together allows for AI to finally automate vulnerability detection.

Now with network vulnerability scanning, this customer is moving away from their long-standing legacy VM vendor and their existing attack surface management vendor as well.

Moving on to our Next-Gen SIEM business, where we're disrupting the proverbial horse and buggy with the combustion engine. Our Next-Gen SIEM delivered triple-digit ending ARR growth while displacing antiquated, expensive and poor performing point products. With LogScale as a foundational component of the Falcon platform, we're creating even deeper tie-ins across the rest of the CrowdStrike and third-party ecosystem.

This quarter, we announced Falcon Adversary Overwatch for Next-Gen SIEM, which brings together our world-class threat hunting and our hyperperformance cost-efficient data platform. This makes the AI-powered SOC turnkey hunting across native and third-party data with real-time intelligence and automation to deliver full visibility, high fidelity alerts and accelerated response.

This is exactly why a leading payments company displace the legacy SIEM in a large 7-figure win. Next-Gen SIEM was our entry point to the account where they were frustrated with ballooning costs, latency and complexity, substantially faster query times accelerated and customizable dashboarding and significant cost savings resulted in this new logo win.

Within our Identity business, we continued rapid expansion in both coverage and functionality. In April, we announced the general availability of Falcon Privileged Access. Before CrowdStrike's identity customers relied on third-party integrations for enforcement. Today, CrowdStrike customers experience just-in-time access and permissions for critical applications and services all within our single AI native platform.

The need is real, a foreign government expanded their 7-figure existing Falcon platform subscription with identity protection, gaining insights into stale accounts, exposed credentials, shared passwords and agent free unmanageable devices went beyond the incumbents limited approach Falcon was the clear winner of providing immediate time to value in securing identities.

Our ecosystem partners continue accelerating CrowdStrike's growth with 60% of our Q1 annual deal value sourced by partners. Several highlights include: first, GuidePoint joins our $1 billion partner ranks as our fifth partner to achieve this noteworthy milestone joining AWS, Optiv, CDW and SHI and further cementing CrowdStrike as cybersecurity's benchmark for partner success.

Second, our MSSP business continues growing at a rapid pace, now representing more than 15% of our Q1 deal value. We won our largest Latin American deal of all time through our MSSP channel last quarter. And third, NVIDIA's recently announced Enterprise AI factory, their reference AI architecture integrates Falcon as the cybersecurity standard for securing NVIDIA's hardware and software.

A marquee partnership with Microsoft, which we announced yesterday, highlights our bold ecosystem leadership. Since last summer, we've worked to find common ground where together, we can make the world a safer, more resilient place. I was pleased to have Satya joined me at Fal.Con last fall. And yesterday, we announced a joint threat actor strategic collaboration where we map each other's adversaries naming conventions.

Through this Rosetta Stone collaboration, we unite defenders in knowing the adversary, both in our nomenclature and Microsoft, so they can better defend. Together, we take the guesswork out of adversary attribution for the benefit of our joint customers and the entire market. In closing, I'm very pleased with where we are and even more excited about where we're going.

Q2 will be a quarter of improving sequential net new ARR growth followed by back half net new ARR acceleration. Here's why the platform wins across 30 Falcon modules. We have the products and innovation engine that stops breaches. In addition, we're seeing momentum build across the entire business.

I began today's comments talking about uncertainties facing the world. What's certain is that the world increasingly needs cybersecurity and increasingly needs CrowdStrike. CrowdStrike is best positioned to protect the workloads, identities, data and infrastructure for the AI age and the superhuman AI agents themselves.

Our Falcon Flex subscription model is accelerating platform adoption at a faster pace than we've ever seen before, and our execution is delivering speed and efficiency across the business.

It's all of these elements together that gives me confidence and excitement in our future, and that's why the company has authorized up to $1 billion in share repurchases. We -- I'm more certain than I have ever been of CrowdStrike's place as the world's leading cybersecurity platform for the AI era with the unequivocal mission of stopping breaches. Thank you to our team, partners and customers who tell me that they cannot live without CrowdStrike.

And I'll now turn the call over to Burt Podbere, CrowdStrike's CFO.

Thank you, George, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers except revenue mentioned during my remarks today are non-GAAP.

CrowdStrike delivered a strong first quarter to kick off the new fiscal year. Our robust Q1 performance, focused execution and growing Falcon Flex momentum, including reflexes further reinforce our conviction in improved sequential net new ARR growth in Q2 as well as net new ARR reacceleration and margin expansion in the second half of FY '26.

And -- Additionally, the share repurchase authorization of up to $1 billion that we announced today reflects our confidence in CrowdStrike's long-term strategy, including M&A, growth prospects and robust cash flow generation capabilities as we scale on the path to $10 billion in ending ARR.

We will continue to prioritize investing in our growth and innovation while retaining the flexibility to opportunistically repurchase shares to maximize returns and deliver increased value to our shareholders.

In Q1, we achieved net new ARR of $194 million, growing ending ARR to $4.44 billion, up 22% over last year. Highlights in the quarter included significant big deal activity driven by Falcon Flex Momentum and Reflexes, record MSSP channel results, strength in multiple geographies, including the U.S., Europe, Canada, Japan and Latin America, deep platform adoption with subscription customers with 6, 7 and 8 or more modules, representing 48%, 32% and 22%, respectively, strong and increasing competitive win rates and sustained 97% gross retention and consistently strong net retention in line with our expectations, demonstrating our success in both customer retention and expansion.

Moving to the P&L. Total revenue was within our guidance range and grew 20% over Q1 of last year to reach $1.10 billion, subscription revenue grew 20% over Q1 of last year to reach $1.05 billion and professional service revenue was a record $52.7 million. The geographic mix of first quarter revenue consisted of approximately 67% from the U.S. and 33% from international geographies.

Total gross margin was 78% and subscription gross margin was best-in-class at 80% of revenue. Total non-GAAP operating expenses in the first quarter were $656.0 million or 59% of revenue. In the first quarter, non-GAAP operating income was $201.1 million and operating margin was 18%, exceeding our guidance.

We achieved strong non-GAAP operating income performance alongside strategic upfront investments in internal automation, go-to-market and AI innovation. We expect these investments to fuel our growth in the back half of FY '26 and beyond as we progress towards our long-term targets.

GAAP net loss attributable to CrowdStrike was $110.2 million and included $39.7 million of expenses for outage and related matters. Non-GAAP net income attributable to CrowdStrike was $184.7 million or $0.73 on a diluted per share basis, exceeding our guidance.

Cash and cash equivalents grew to a record $4.61 billion. Cash flow from operations was a record $384.1 million and free cash flow was $279.4 million or 25% of revenue. Expenses for outage and related matters impacted Q1 free cash flow by approximately $61 million.

Moving to our outlook and modeling notes. We believe cybersecurity remains mission-critical in today's AI-accelerated threat environment. We continue to see strong demand for the Falcon platform, growing momentum with Falcon Flex, including reflexes and a robust and growing pipeline building for the second half of FY '26.

We -- while we do not guide to net new ARR, our Q2 assumptions include the sequential net new ARR growth rate to be at least double over what we saw from Q1 to Q2 in the prior fiscal year. I'd like to take a minute to discuss the near-term relationship between ARR and subscription revenue in FY '26.

And -- as we previously discussed, our successful CCP program that concluded in Q4 of FY '25 provided customers the onetime ability to choose more product, more time or both, which results in an impact to subscription revenue. In addition, a limited special partner program related to CCP success also has an amortization impact on subscription revenue.

As a result of these CCP-related programs, we expect to see a temporary near-term separation between ARR and subscription revenue recognition, which was reflected in our revenue guidance. This amounted to approximately $11 million in Q1. We expect the impact to be in the range of $10 million to $15 million in each remaining quarter of this fiscal year, subsiding in Q4.

We -- moving to the strategic realignment plan we announced in early May, we continuously look for optimizations and efficiencies across the business. We identified opportunities to reallocate and focus investment in one platform growth areas of Cloud, Identity, Exposure Management, AI and Next-Gen SIEM as well as platform resilience; two, AI to accelerate our internal execution and efficiency; and three, go-to-market and customer success as we scale.

The timing of executing the realignment in early May was focused on minimizing in-quarter business disruption while maximizing in-quarter financial benefit. We expect the full benefit of the realignment to add at least 1% to next year's non-GAAP operating margin from our previously discussed target, increasing our target in FY '27 to at least 24%. And -- Additionally, we now anticipate an FY '27 improved free cash flow margin of more than 30%.

Moving to cash. We expect to incur Q2 cash charges of approximately $26 million in connection with the aforementioned strategic plan. Additionally, we expect Q2 free cash flow to be impacted by approximately $29 million for outage and related expenses. As I just mentioned, we now anticipate an FY '27 free cash flow margin of more than 30%.

Moving to our outlook. For the second quarter of FY '26, we expect total revenue to be in the range of 1,144.7 million to $1,151.6 million, reflecting a year-over-year growth rate of 19%. And -- we expect non-GAAP income from operations to be in the range of $226.9 million to $233.1 million, and non-GAAP net income attributable to CrowdStrike to be in the range of $209.1 million to $213.8 million.

We expect diluted non-GAAP net income per share attributable to CrowdStrike to be approximately $0.82 to $0.84, and -- utilizing a 22.5% tax rate and weighted average share count of approximately 255 million shares on a diluted basis.

For the full fiscal year 2026, we currently expect total revenue to be in the range of $4,743.5 million to $4,805.5 million, reflecting a growth rate of 20% to 22% over the prior fiscal year. Non-GAAP income from operations is expected to be between $970.8 million to $1,010.8 million. We expect fiscal 2026 non-GAAP net income attributable to CrowdStrike to be between $878.7 million and $909.7 million.

Utilizing a 22.5% tax rate and approximately 256 million weighted average shares on a diluted basis, we expect non-GAAP net income per share attributable to CrowdStrike to be in the range of $3.44 to $3.56.

Please refer to our earnings presentation with additional modeling notes that we just posted on the website. George and I will now take your questions.

[Operator Instructions]. Our first question comes from Saket Kalia with Barclays.

Okay. Great. Solid start to the year here, guys. Sure thing. George, maybe for you. I'd love to dig a little bit more into Falcon Flex. You had a couple of interesting customer examples in your prepared remarks.

Maybe the question is, as you look broadly at that growing Falcon Flex install base, what products do you feel like are benefiting most in terms of usage as customers adopt Falcon Flex? And maybe relatedly, how is the sales motion changing as Falcon Flex gets more broadly adopted?

Sure. Well, I think that the net of it is Falcon Flex has been a real home run for us, Saket. And as I said in my prepared remarks, a real game changer for adoption, customers are asking for it, they're talking to each other, they're hearing more about it. Our partners are now able to talk about it and so through it, and a big part of this has been around Next-Gen SIEM, Cloud and Identity.

I think if you look at Next-Gen SIEM with some of our larger GSIs, Falcon Flex is the perfect complement to running out existing legacy licenses and then being able to bring up Next-Gen SIEM. So I think for sure, Next-Gen SIEM is one of the areas that's benefiting.

And when you look across the metrics, $3.2 billion total account value for Falcon Flex customers, 820 customers, 31 months on average. It's been just unbelievable and more successful than we thought. And one of the things that I pointed out here in the earnings script is the reflex. We're seeing more and more reflexes faster than we thought -- and the key to Flex is it does change our selling motion, where we're not selling module-by-module, but we're selling outcomes and we're doing demand planning with our customers and ultimately, they're using more of our licenses faster, which ultimately results in net new increase in ARR.

Our next question comes from Tal Liani with Bank of America.

I would like to go back to something you said about the divergence between revenue growth and ARR growth. I understand why CCP is pressuring revenue growth just near term. But why is it causing a divergence? Why don't -- why isn't it impacting the same way ARR? And just a follow-up on this is why you said that you expect ARR growth to accelerate in the second half? Why is it what drives it? .

Thanks, Tal. So one, in terms of the divergence, we talked about it in the modeling notes where we went through our overall CCP programs, and then we highlighted specifically our CCP program had with respect to a limited partner program. And we talked about how the amortization impacts revenue.

So when you look at the 2 of them and you say, "Hey, how does this work with respect to our revenue?" When you look at when partners have a program with us, we then are able to recognize the amortization within revenue. So this would be part of ASC 606. And so this is how we account for it, and that's why you see the divergence in terms of how we think about reacceleration in the back half.

So reacceleration in the back half is due to many things. One, we think about -- we think about not only our what we expect from our products that we have -- really, we have momentum with respect to what George talked about Next-Gen SIEM, Identity, Cloud. So we feel great about where we have the momentum with respect to the products. We feel like we have momentum with respect to Flex.

We talked about Flex, we talked about the numbers that we had with respect to Flex, $774 million with respect to account value in the quarter. This is over double what we did year-over-year. So we're really excited about how we think about Flex.

And then when we talk about reacceleration in ARR, we're also talking about how we think about the momentum just in our overall platform. We are the consolidator, we're the one that people are looking to not only get the best outcome, but to save money. So when you wrap that all together, we have confidence with respect to our conviction in back half reacceleration.

Our next question comes from Gabriela Borges with Goldman Sachs. .

George and Burt, some of these reflex deals are really interesting. Talk to us a little bit about the budget conversation that happens. If I was budgeting for 35 months, and I burned through my usage in 5 months, where does the incremental budget come from? And how does the ROI conversation change? Clearly, customers are getting value out of the they using the product? Just curious how that math works out.

Yes. Great question. So a lot of what we're doing with customers is going through the demand plan and our business value assessment, and that's really where we can talk about how we can replace other point products.

So typically, the conversation will look at customer road map, they'll look at certainly our road map and the products we have in the 30 modules and then we'll begin to plan the phased rollout of our products to replace what they have. And in general, what we're focused on is how can we save them money by replacing those point products and ultimately getting a better outcome.

So Flex is going to give them the best discounted rates. The more they commit, the bigger the discounts and then also, it takes all the friction out of procurement. So they can roll us out and within 5 months, as we talked about, they can consume that Flex license. But we're now on a path to adding more modules faster. And once they see the value of it and they are using all of the products or the products that they're licensed for within the Flex suite, it just incentives to use more and more of those.

So that's the way we see it. It's instead of module by module sale, it's more of a demand planning exercise with real tangible ROI and financial benefits, which has been a huge success for us and our partners.

Our next question comes from Brian Essex with JPMorgan.

George, I was wondering if you could talk about the sales go-to-market effort and how that's changed. Obviously, you're coming off a pretty meaningful period of disruption in the second half of the year and you had to adjust compensation structures and focus to focus on CCP and penetration of Flex. How have things changed in 1Q? Have plans materially changed the way that you're compensating quota-bearing reps in the channel? And how less response been from the sales force?

Well, I think the response has been great from a sales force perspective and customer perspective. The customers have put it in the rearview mirror, we've moved forward with our customers and partners and the focus really has been on innovation that we're delivering on how we can consolidate the point products they have, the power of the Falcon platform, Charlotte AI.

We're back to business in areas that we've always focused on, which is really exciting for us. And the big takeaway is customers want to do more and more with us. And we're seeing that with the adoption rates, and we're seeing that with the burn down of the Falcon Flex licensing much faster than we originally anticipated.

So there's still more work to do in terms of educating partners and -- and our own sales force in this go-to-market motion around demand planning, but that's an exercise that always be ongoing, but we're seeing tremendous success, both internally and with our partners.

Our next question comes from Andy Nowinski with Wells Fargo.

I wanted to follow up on Falcon Flex and the -- really the impact it has on both revenue and ARR, because it seems like it has a very different impact. So I guess when a customer burns through their contracted credits faster than they expected and they reflex, does that overage flow into your subscription revenue? Or do they have to reflex to a new contract right away? And where do we see that showing up? I mean does that show up in your net new ARR when they reflex or is that RPO? Just any help you can give us on how we -- how we can measure the success of that reflex and where we see it showing up .

Andy, great question. So were it shows up is basically on the reflex. So when a customer burns through all of their flex then they're going to come back to us and say, look, we want to reflex with you. We enjoy what you have. You want to do more what you have, and that's where you're going to start seeing the net new ARR come into play.

Our next question comes from Keith Weiss with Morgan Stanley.

And congratulations on a solid start to the fiscal year. George, I wanted to touch on something you said in your prepared remarks about the generative AI demand on the horizon and definitely agree with you in terms of the expansive sort of demand potential there is behind generative AI.

But there's also a lot of different types of demand that you could see. You were talking a lot about surface area, but you also have it in your products. There's also the threat environment. Can you give us a little bit of visibility on what's hitting today? What's actually driving demand today for you guys? Is it what you guys are doing in your SIEM product? And what's up more on the horizon? What should we be looking forward to going forward in terms of what could be future demand drivers?

Sure. Well, when we think about AI, when I started CrowdStrike, it was AI-first company. Years ago, it was machine learning now AI, but at the end of the day, what we're able to do is to deliver the right outcomes to customers.

We'll take Charlotte AI as an example. We're just seen tremendous growth in the product itself. and the adoption within the customer base and what we're able to really solve for them in saving hours and hours of work coming up with the right results which really helps to automate Level 1 triage and really free up those resources internally. So that's, again, how we use AI to drive workflow automation as well as get better security outcomes.

When we think about the protection piece, we have model -- scanning model protection today. We're doing that for customers. But really, what I highlighted in the call is something I'm really excited about and that is, if you think about CrowdStrike and you think about what we do and how we've evolved, we protect workloads, computers, users, identities, right? Those are today's speed.

When we think about generative AI and really what I'd call autonomous agents, they have the same needs, but they're super human. They have access to data, they have identities, they have access to systems outside of their own environment, they have workflows, they take action. So it's building those guardrails and then instrumenting the visibility and protection across the entire AI workflow and every agent and there could be billions of agents are going to need protection, and that's where we see a fantastic future opportunity, and we're going to be at the tip of the spear of being able to protect those in the future.

Our next question comes from Matt Hedberg with RBC.

Congrats on the results, not an easy environment for sure. George, I wanted to ask about U.S. Fed. I guess, how has it been trending sort of what's baked into the guide? And if there's any comment that you could make on -- there's a Bloomberg article earlier in May, that would certainly be helpful.

So I'll take the second part of your question, any comments with respect to Bloomberg. So for us, the company and the -- and how Bloomberg reported what they reported. The company received a request for information from the DOJ and the SEC relating to revenue recognition and reporting of ARR for certain transaction -- for certain transactions, the July 19 outage and related matters. .

Our next question comes from Joe Gallo with Jefferies. .

Bert, can you provide some guardrails on how to think about free cash flow margin this year? I think previously you talked through an exit rate. And then maybe just talk a little bit more about what underpins your confidence in 30% plus margin next year.

Yes, sure. So yes, we did talk about the 27% exit rate on Q4 for free cash flow margin. We're excited about that. And then the 30%, we get most of our conviction from what we've already been talking about, we get it from Flex. We had it from larger, longer, bigger deals, and we get a lot of momentum with respect to how customers burn through Flex. We gave you those examples faster than we anticipated. And all that's going to turn into dollars for us. And that's where we get excited about next year's free cash flow numbers that we provided. .

Our next question comes from Mike Cikos with Needham

I just wanted to get a quick update on what you're seeing more from a macro standpoint as far as April and May. We received some differing data points depending on which of the fiscal quarter end cyber companies you're speaking to? .

And just wanted to sanity check if you guys are seeing any movement at the margin when we think about how things are playing out in the month of April versus the linearity in the quarter and then how things have trended with May in the rearview mirror at this point.

Yes. I think we did a great job on execution. And with the right platform and solving the problems that we're solving, we powered through it. Like you look at the results with net new ARR, it was fantastic. Again, customers want to buy more and more from us. Next-Gen SIEM has been a total home run.

So I can only focus on what we can control. And I think the team did a fantastic job in -- in an environment that had a lot of noise to power through it and deliver the results that we delivered.

Our next question comes from Shaul Eyal with TD Cowen

George, my question is on Next-Gen SIEM. Success is absolutely unquestionable. I listened to your tone looking at the presentation, it's unequivocal. If we think about 1 or 2 legacy same incumbents that you are most frequently displacing, who would those be? .

I would say it's across the board, but certainly a big player out there is Splunk and QRadar. So -- and others are out there, but you have to look at the legacy comments and customers are looking for better, faster and better value. So that's what we're delivering, and it's all in an integrated package.

And a big part of our success has been it's already built in. All of our customers actually have Next-Gen SIEM, and they get pigabytes of it basically built in. So it makes it easy for them to try it out. And then when they see the results of it, they don't have to move data out of our platform. It's already there. and then we're converting them internally and as well as working with our GSI partners.

So I think this is one of the most exciting areas that we have. And for us, it feels a lot like the legacy AV market when I started the company. And I think we've got a tremendous amount of runway in front of us. And I just hear time and time again from customers, we cannot believe how fast it is, how well it works and the value we're getting from it. So I think overall, we'll continue to see great success with it.

Our next question comes from Roger Boyd with UBS.

Great. George, I wanted to hit on MSSP. I think you said 15% of bookings coming from that channel this quarter. If I look at kind of 2 years ago, it was maybe kind of in the mid-single digits. So a much more significant piece today. Can you just expanding the momentum there, what's going well, your competitive positioning with those partners and where you see the channel going, particularly as you look to engage partner first on a managed SIEM and managed SOC basis?

Yes. Well, we've spent a lot of time and effort over the last couple of years of working with those channel partners working with the managed service providers adding the capabilities that they need to be able to deploy and manage CrowdStrike very easily.

There's always been a demand for us in the SMB and through managed service providers. And we had to meet that demand in a way that makes sense for the managed service providers. We've made those changes. It's very easy to use and deploy within those environments.

And the big thing is customers have been and continue to ask for it and we're winning against our competitors. I mean we are now in a market that we weren't necessarily in and we're having an impact in the competitive environment. And that, for me, is, I think, a bright spot and really highlights the partner-first mentality we have.

Our next question comes from Peter Levine with Evercore ISI.

Maybe for you, George, at RSA, I think you announced a privileged access management product for identity. You have identity Falcon Flex Identity. So maybe if you could just share with us like what are -- what's your vision within getting deeper into the Identity management space.

Well, when you look at what we have with our identity protection, we are there with our agent. We're built in. We've run on very critical domain controllers and customers for years have asked us, can you do more in that space. They love our identity product.

And now we have the ability to help them with privilege access. And we continue to add more and more capabilities. It's a big TAM. It's an area that we've got expertise. We've got the real estate of having these agents and customers are looking for the consolidation play and they're also looking to save money. Some of the other solutions are very expensive, and by consolidating on CrowdStrike in that area, it's a win for them and it's a win for us. So we'll continue to add more and more capabilities and it does unlock a new TAM for us. today in the future.

Our last question comes from Keith Bachman with BMO.

Hopefully, you can hear me okay. Bert, I wanted to direct this to you, if I could. On the CCP, I'm just trying to get a little bit of help how to think about it in the second half of the year. So last year, in the October and January quarter, you identified $80 million of CCP. And so presumably, as you anniversary that, how does that layer into the back half of the year opportunities in terms of ARR. Would we just add it to kind of normal back half of the year growth? Or any comments on exactly how that layer takes into the second half of the year?

And if you don't mind, could you just repeat what you said about the July quarter in terms of sequential growth in terms of net new ARR?

Yes. So Keith, thanks for the question. So first, let me just start with saying that, as I said earlier, about Flex. When the Flex licenses start burning out, that's the opportunity for customers to buy more and all the new purchases that they make that all goes into net new ARR. And the momentum we're seeing gets us for that confidence level with respect to back half acceleration that we keep talking about and have more and more conviction to.

When we think about the $80 million, so the $80 million was with respect to deal value that we gave out, and we talked about that number. And then when you heard the -- my prepared remarks today, I'm talking about impact from CCP on revenue specifically. And then I go into specifically about the partner programs that we have. And we talked about basically for Q2 and beyond around $10 million to $15 million per quarter.

The other thing I want to mention is that when we think about our module and module retention rates, we're over -- we're around approximately 95% with respect to module retention rate, that gives us that confidence with respect to for customers who are going to come back to Flex and re-up with Flex, which is a big piece of how we're thinking about the back half of this year.

Not only by the way, do we think about net new ARR, but I talked about, Keith, margin expansion in the back half of next year. I don't want to do -- i don't want you to lose sight of that as well.

Operator?

[ This concludes today's question and answer session ]. I would now like to turn the call back over to George Kurtz for closing remarks.

I want to thank everyone for joining us today, and we look forward to seeing you on our next earnings call. Stay well.