CrowdStrike Holdings, Inc. Class A Common Stock 2027 Q2 Earnings Call

Andy, please go ahead. Good afternoon, and thank you for your participation today.

With me on the call are George Kurtz, Chief Executive Officer and Founder of CrowdStrike, and Burt Podbere, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth, including projections and expected performance, including our outlook for the third quarter and fiscal year 2027, and any assumptions for fiscal periods beyond that, are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties.

We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events, or otherwise. Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the company's annual and quarterly reports. Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings release, which may be found on our investor relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today. With that, I will now turn the call over to George.

Thank you, Andy, and thank you for joining CrowdStrike's Q2 FY 2027 earnings call. When we last spoke, we were just weeks after what we called the Mythos moment, an inflection point in cybersecurity. The world came to understand that cybersecurity is a necessity for AI adoption. New models created a new risk environment with no turning back. Recently, this realization became even clearer with the market's newest adversary, AI agents themselves. We told you this was the future, and this future is now a reality. Our previous guidance foreshadowed this conviction, and CrowdStrike's Q2 was our very best quarter in company history. Inflection has become acceleration. Our Q2 results set a new bar. Here's what we delivered. One, all-time record net new ARR of $333 million, accelerating to 51% year-over-year growth and beating the high end of our guidance by more than $45 million.

Two, ending ARR growth accelerated for the fourth consecutive quarter, reaching $5.84 billion, up more than 25% year-over-year. Three, total revenue growth accelerated for the fifth consecutive quarter, reaching $1.47 billion, up 26% year-over-year. Four, Q2 record free cash flow of $377 million, or 26% of revenue, growing 33% year-over-year. Five, all-time record operating income of $372 million, or 25% of revenue, growing 46% year-over-year. Six, all-time record net new ARR from new logos, while both net and gross dollar-based retention improved over the prior quarter. Seven, all-time record Falcon Flex quarter with ending ARR from accounts that have adopted the Falcon Flex subscription model surpassing $2.29 billion, accelerating to 101% year-over-year growth. Eight, FY 2027 net new ARR guidance increase of 630 basis points. We now expect year-over-year growth of 34% at the midpoint, a 1,150 basis point increase from our initial outlook.

The quarter was a sea change for CrowdStrike, and I see these dynamics continuing. We are in an arms race. AI is driving more cyber attacks. AI is driving more cyber spending. AI is driving a clear divide between the cybersecurity companies that solve problems and those that compound problems. CrowdStrike's quarter demonstrates the market trusting us more than ever to secure their adoption of AI with cybersecurity's single platform of choice. The world's adoption of AI is rapidly expanding the attack surface. More models, more agents, more agentic applications, more data, and with that, more identities, more permissions, more policies, more cyber attacks, and more risk. Agent proliferation is becoming mainstream to augment work and personal life. Agents are powerful forces for productivity and good. Agents are also human and machine risk multipliers with access to data, continuous operational capability, and limited judgment.

We are seeing agents go rogue, swarming to attack and moving beyond their guardrails to autonomously harm. Agents are proving capable of data theft, permission alteration, and full-on command and control at scale, leading to organizational compromise. The agent of today is both a friend and foe. The currency of protection is increasingly presence and speed. Do you have the right technology deployed that can see, prevent, and stop agentic attacks? Do you have the right technology that can outpace an entirely new real-time adversary? The AI threat environment is shining a clear light on which products work and which don't. We see failing products as open doors for agentic adversaries. At CrowdStrike, we don't just stop these breaches, we and our partners help the world recover from them. In this threat landscape, CrowdStrike stands out. Our market-leading cybersecurity services are in high demand.

The flywheel we have created of best-in-class incident response services, lauded by law firms and insurance brokers, translates into best-in-class product outcomes for new customers. Ever since Mythos, we have seen growth in our business, not measured by meetings or calls, but measured by ARR, and we don't see the threat landscape subsiding. Far from it. Demand for AI grows our TAM, driving the need for CrowdStrike. The AI transformation doesn't just necessitate a technological lift and shift. It is necessitating a fundamentally new go-to-market motion, one based on maximizing time to value, ecosystem impact, and ROI. The Falcon platform removes friction from cybersecurity, and the go-to-market motion we created with Falcon Flex does the same. Flex is the commercial harness to enable customer success in the agentic era. This quarter, we kicked Falcon Flex activity into high gear with our Flex first go-to-market strategy.

Our top 10 deals by deal value were each Flexes, and the results speak for themselves. This quarter, we delivered record Flex deal volume, adding more than 935 Flex accounts. That is more than 10 Flexes every day of the quarter and more Flexes than the last three quarters combined. When Falcon customers convert from standard subscriptions to Flex, we see a greater than 40% average ending ARR uplift. We are not just focused on converting existing customers to Flex. We use Flex from the start with new logo customers. Flex new logo ARR contributed 34% of Q2 net new ARR, a record. We also saw record re-Flex activity for existing Flex customers, with more than 630 accounts having re-Flexed at least once, up 6X year-over-year. On average, a customer's first re-Flex happens in eight months from their initial Flex.

Lastly, we saw record repeat re-Flex customers, with average ending ARR uplift of 53% from their initial Flex subscription. Falcon Flex wins include a frontier lab that significantly grew with CrowdStrike in an eight-figure ARR deal, using Flex to maintain cost visibility while significantly growing Falcon Cloud Security across its rapidly expanding data center infrastructure. A European automotive manufacturer called upon CrowdStrike to replace a next-gen EDR, a legacy SIEM, and a legacy vulnerability management product. Landing with an eight-figure net new Falcon Flex, CrowdStrike delivered superior outcomes and immediate platform consolidation. Our Falcon Flex go-to-market motion unlocks the complete aperture of the Falcon Platform. When looking at our Q2 performance, I am pleased to see strength across so many different product areas. Increasingly, the epicenter of agentic work securing the endpoint is now a top spend priority. CrowdStrike is the leader at endpoint.

We are now capitalizing on our ubiquitous endpoint presence to deliver the future of AI security. In Q2, our endpoint business accelerated for the fourth consecutive quarter as customers look to secure their growing AI attack surface. We are seeing dramatic expansion in agentic work on the endpoint, both through fast-growing tools such as Codex and Claude, as well as custom agentic applications. In sampling our customer base, we have seen more than 400% growth in Claude usage and more than 100% growth in custom agent usage on endpoints in recent months. As enterprises look to deploy these new technologies, they are also seeking ways to contain the new risk created, ranging from code exploitation to data leakage to identity compromise. Instead of turning to science projects or point products, the market is trusting CrowdStrike as critical infrastructure to both enable and safeguard their AI future.

A large financial services firm worked with two of our GSI partners to replace a next-gen EDR in an eight-figure Flex win. Across more than 100 entities and hundreds of thousands of endpoints, CrowdStrike was selected for the best detection coverage, deployment ease, and the lightest impact. Our endpoint success fuels the adoption of AI Detection and Response, a product surging past our expectations. AI Detection and Response ending ARR nearly tripled versus Q1 as customers embrace our frictionless approach to AI visibility and security. One of the world's largest banks adopted AI Detection and Response in an eight-figure Flex win. Immediate AI deployments necessitated security, visibility, and control. We were selected for AI usage visibility and data exfiltration prevention. Demand adoption and growth like this is rarely seen. I cannot wait to unveil our newest AI security innovations at next week's Fal.Con conference.

Moving to our cloud, identity, and next-gen SIEM businesses, the market is rapidly embracing these products to protect fast-expanding attack services. We delivered record Q2 net new ARR from the combination of these businesses. Unpacking these results, our next-gen SIEM business delivered another banner quarter driven by record Q2 net new ARR. Next-gen SIEM ending ARR surpassed $695 million this quarter, as both new and existing customers are standardizing on Falcon as the operating system of the SOC. Our native first-party data advantage, coupled with the speed and efficiency of our platform, continue to set us apart. Features like AgentWorks enable security teams to build, deploy, and manage custom AI security agents, setting the foundation for the AI SOC. In an eight-figure Falcon Flex win, a major American power provider replaced a legacy-acquired SIEM, selecting next-gen SIEM over a firewall-first product for technical speed and economic superiority.