Part 1: CrowdStrike Net New ARR Up 51%, Priced at 46x Sales
CrowdStrike's growth has re-accelerated, and the evidence is in the metric the company itself tells investors to watch: net new ARR rose 51% year over year last quarter. The share price, though, got there first. At roughly 46 times this year's revenue guidance, the stock already assumes several more years of fast growth, so the quality of that growth matters more than the headline.
This is Part 1 of Cybersecurity Stocks, Five Ways, a five-part series that reads three US security names and two Korean ones through their filings. The trigger was close to home for this blog: in the first days of October, a string of breaches hit Korean banks, and at least one was reportedly aided by AI tools.
KEY TAKEAWAYS
1. In Q2 FY27 (May to July 2026), CrowdStrike added a record $333 million of net new ARR, up 51% from a year earlier. Ending ARR reached $5.84 billion, up 25%.
2. The growth is coming from existing customers buying more. The share of subscription customers using eight or more modules rose from 21% to 26% in six quarters, and Falcon Flex accounts now carry over $2.29 billion of ARR, up 101%.
3. Market value is about 46 times FY27 revenue guidance. Holding the price flat, 25% annual growth would take five years to bring that to 15 times (illustrative calculation).
What the quarter showed
According to CrowdStrike's Aug 26, 2026 results release (filed as an 8-K exhibit), revenue was $1.47 billion, up 26%. Non-GAAP operating income was $371.6 million, a 25% margin, and free cash flow was $377.4 million, about 26% of revenue. Management raised its FY27 net new ARR growth outlook to 34% at the midpoint, up 630 basis points.
Some context on the stock. CrowdStrike split its shares four-for-one in early July, per its 10-Q. The stock closed at $272.67 on Oct 5, 2026, for a market value of about $276.5 billion (third-party market data).
One sensor, many modules
The business model is simple to state. Per the company's 10-K, customers install a single lightweight sensor on laptops, servers and cloud workloads. Behavioral data from every customer flows into a cloud system called Threat Graph, where detection models run. CrowdStrike argues this creates a network effect: more customers, more data, better detection.
The commercial point is that the sensor is already there. A customer that starts with endpoint detection and response (EDR) can add identity protection, cloud security, log management (SIEM) or AI security without another deployment. CrowdStrike's IR materials list 33 cloud modules.
Falcon Flex accelerates this. Customers commit a dollar amount up front and allocate it across modules as they go. The Q2 release says ARR from Flex accounts exceeded $2.29 billion, up 101%. That points to expansion inside the installed base, not only new logos, as the main engine.
Expansion in numbers
Module adoption is where expansion shows up first. Between Q4 FY25 and Q2 FY27, customers using six or more modules went from 48% to 51%, seven or more from 32% to 35%, and eight or more from 21% to 26%. The biggest gain sits at the top tier: heavy users are getting heavier. One footnote matters: from FY27 the rates exclude Falcon Go, a bundle for organizations with 100 endpoints or fewer.
Retention tells the same story. CrowdStrike reported dollar-based net retention of 115% for FY26 (year ended Jan 31, 2026). Put simply, last year's customer cohort spends 15% more a year later. That gives the company a double-digit growth floor before it signs a single new customer.
The 51% figure also benefits from an easy comparison. Net new ARR was $221 million a year earlier, when results were still weighed down by the customer commitment packages CrowdStrike offered after its July 19, 2024 outage. In Q2 FY27, outage-related items swung to a net recovery of $14.5 million.
Profitability still depends on the accounting lens. The 25% non-GAAP margin sits next to a GAAP operating loss of $33.2 million. Most of the gap is stock-based compensation, which is a real cost to shareholders through dilution.
AI agents become something to secure
CrowdStrike's 2026 product news is mostly about AI. Falcon AI Detection and Response (AIDR) became generally available in December 2025, aimed at prompt injection and jailbreak attempts against AI systems. On June 15, 2026, the company announced Continuous Identity for AI Agents, which authorizes each agent action in real time. Every AI agent working inside a company is another identity to manage.
AI is coming to the defender's side too. On Mar 25, 2026, CrowdStrike launched the Charlotte AI AgentWorks ecosystem, a no-code tool for building security agents, with Anthropic, NVIDIA and OpenAI among the launch partners.
The Korean bank breaches show why speed matters. Bloomberg reported on Oct 2 that AI tools may have been used in an attack on Shinhan Bank that exposed data on about 25,000 customers, and KB Kookmin and Hana disclosed smaller intrusions. When attackers automate, the time a human needs to triage an alert becomes the bottleneck. Platforms that link detection to automated response gain value. The catch: CrowdStrike does not break out AI security revenue, so its contribution cannot yet be measured.
One step further: what 46x sales implies (illustrative)
Divide the roughly $276.5 billion market value by the $6.0 billion midpoint of FY27 revenue guidance ($5.99 billion to $6.01 billion) and you get about 46 times sales, by my math. If the share price stays flat and revenue grows 25% a year, the multiple takes 5.0 years to reach 15 times and 6.8 years to reach 10 times.
The point is not that the stock is expensive. It is that today's price already discounts more than five years of high growth. At 20% growth, reaching 15 times takes 6.1 years; at 30%, 4.3 years. That sensitivity is why net new ARR growth is the number I would watch above all others.
Illustrative calculation. Not actual company figures.
What I actually watch
| Checkpoint | Why it matters |
|---|---|
| Q3 FY27 results (early Dec) | Guide: ending ARR $6.18bn |
| Net new ARR growth | Drives the valuation math |
| Falcon Flex ARR growth | New spend or reallocation? |
| AI security disclosure | No revenue split yet |
| GAAP operating profit | Stock comp and dilution |
Value chain read-through
| Segment | Signal | Metric to track |
|---|---|---|
| Endpoint platforms | Net new ARR +51% | Quarterly net new ARR |
| Cloud infrastructure | Threat data volume | Hyperscaler partnerships |
| AI security | AIDR, agent identity | AI module adoption |
Risks to this view
• Valuation: at about 46 times sales, even a modest slowdown in growth could compress the multiple sharply.
• Outage aftermath: the latest 10-Q says the July 19 incident has had, and is expected to continue to have, an adverse effect on the business.
• Bundling: operating system and cloud vendors that package security with their platforms could erode a standalone vendor's pricing power.
• Accounting gap: the company is still loss-making on a GAAP basis, and stock-based compensation dilutes shareholders.
• The 46x multiple and the years-to-compress figures are an illustrative calculation, not actual company figures.
Bottom line: CrowdStrike's expansion engine is visible in the filings, from module adoption to Flex ARR. The open question is whether growth stays fast enough, for long enough, to grow into the price. Next in the series: Palo Alto Networks, and how much of its ARR growth comes from acquisitions.
Sources: CrowdStrike Q2 FY27 results release and 8-K exhibit 99.1 (Aug 26, 2026); CrowdStrike Q2 FY27 10-Q (shares, stock split, risk factors); FY26 10-K (Mar 2026); quarterly results releases, Q3 FY25 to Q1 FY27; CrowdStrike press releases on Falcon AIDR (Dec 2025), Charlotte AI AgentWorks (Mar 25, 2026) and Continuous Identity for AI Agents (Jun 15, 2026); Bloomberg via Insurance Journal (Oct 2, 2026); share price and market value from third-party market data (Oct 5, 2026).
Comments
Post a Comment