Aug 26, 2026 earnings call — AI security acceleration and Falcon Flex adoption
Record net new ARR of $333 million; FY27 net new ARR outlook raised to $1.35 billion at midpoint.
Revenue $1.5B (est $1.4B) · EPS $0.31 (est $0.29) · Next-quarter revenue outlook $6.2B–$6.2B
Key quotes
"When Falcon customers convert from standard subscriptions to flex, we see a greater than 40% average ending ARR uplift."
"AIDR ending ARR nearly tripled versus Q1 as customers embrace our frictionless approach to AI visibility and security."
"At the midpoint, we now expect $1.35 billion of net new ARR for the full year, an increase of approximately $116 million from our initial FY 2027 outlook."
Analyst Q&A 13
what drove Q2 upside
Q (Saket Kalia · Barclays): Analyst asked what happened after the "Mythos" moment and which factors drove the upside in Q2.
A: Management said the Mythos moment became a growth driver and is producing tailwinds. They pointed to products like AIDR, cloud, identity, next gen SIEM, endpoint acceleration, and exposure management as key drivers.
"When we think about AI agents going rogue, when you think about the need for protecting AI and understanding where shadow AI is." — George R. Kurtz (CEO)
durability of momentum
Q (Brian Essex · JPMorgan): Analyst asked how durable the Mythos-driven strength is beyond next quarter and what visibility they have into next year.
A: Management said they believe the strength is durable and raised FY 2027 outlook again. They cited ongoing customer need to deploy more AI while handling security, compliance, and data protection issues as a sustained tailwind.
"If we believe that AI is in its early days and is only going to get better and more powerful, combined with the autonomous nature of these attacks, it is absolutely something that every company is gonna need." — George R. Kurtz (CEO)
protecting agents on real data
Q (Gabriela Borges · Goldman Sachs): Analyst asked how CrowdStrike advises a large financial customer moving agents from sandbox to production on real enterprise data and what products they need.
A: Management said making agents productive requires access to data plus controls across identity, data protection, runtime visibility, exposures, and network calls. They said CrowdStrike can cover sandboxed and production agents, including cloud-created agents, and deliver guardrails across identity, data, execution, and connectivity.
"You need to know where AI is being created. You need to know where it is being consumed, and you have to put the right guardrails around identity data execution, and network connectivity, and we are delivering that for our customers." — George R. Kurtz (CEO)
why CrowdStrike is unique vs Frontier Labs
Q (Matt Hedberg · RBC): Analyst asked why CrowdStrike is uniquely positioned as the threat landscape changes and even if Frontier Labs release security solutions.
A: Management said deep, proprietary threat and attack data trained into their models gives them a unique position. They emphasized being net data creators that continuously update algorithms and deliver data sovereignty and trusted security results for customers.
"We are net data creators. We are constantly creating new data that is coming out of our endpoints." — George R. Kurtz (CEO)
which products drive Flex growth
Q (Fatima Boolani · Citi): Analyst asked which parts of the portfolio drive the most traction as organizations move to production-grade AI adoption.
A: Management said FalconFlex had a record quarter and highlighted cloud, next gen identity, and next gen SIEM as major growth contributors. They also cited exposure management and AIDR as strong performers and said Flex enables customers to buy multiple products easily.
"So first, let's just talk about Flex. Flex, was an all time record Flex quarter with year over year growth accelerating to 101% year over year, surpassing $2.29 billion." — Burt W. Podbere (CFO)
how SIEM adoption is happening
Q (Meta Marshall · Morgan Stanley): Analyst asked whether customers are moving more data into NextGen SIEM upfront and if more logs are being ingested to detect advanced attacks.
A: Management said every customer is NextGen SIEM enabled because the data is already in the platform, making activation friction-free. They said it is easy to connect other data sources and that the product gives quick time to value while being disruptive on price for first party data.
"When you look at NextGen SIEM, the great news is every customer is NextGen SIEM enabled." — George R. Kurtz (CEO)
is AIDR separate from EDR
Q (Adam Tindle · Raymond James): Analyst asked whether AIDR is incremental or a substitute for core EDR and how its ramp compares to other products.
A: Management said AIDR is separate and incremental, sold as a separately priced module that uses the same agent and license entitlement. They said the ramp has been incredible over recent quarters and customers appreciate monetization without deploying another agent.
"On the first point, it is separate and incremental." — George R. Kurtz (CEO)
token pricing for AI use
Q (Roger Boyd · UBS): Analyst asked whether customers ask for token-based pricing for AI and how that fits into Flex contracts.
A: Management said token-based pricing is already part of AIDR. They explained customers get a certain number of tokens, can buy extra token packs if they exceed usage, and tokens are consumable via FalconFlex so customers can budget and scale friction-free.
"So we actually have token based pricing as part of AIDR." — George R. Kurtz (CEO)
exposure management market
Q (Robbie Owens · Piper Sandler): Analyst asked how the exposure management market is evolving, where CrowdStrike is displacing legacy solutions, and what older solutions lack.
A: Management said exposure management is experiencing a rebirth due to exponential increases in vulnerabilities and limited patching capacity. They said customers need prioritized views of assets, protection, unpatched items, and attack paths, and CrowdStrike delivers autonomous exposure management within the Falcon platform, displacing legacy vendors.
"They want a view of their assets. They want a view of where their protection is. Falcon. They want a view of what is exposed, what patches need to be applied but have not, and they wanna understand the attack paths." — George R. Kurtz (CEO)
AI governance and cost control
Q (Michael Turrin · Needham): Analyst asked how customers use CrowdStrike to implement and enforce AI governance guardrails and manage AI costs.
A: Management said their product can set and enforce policies and minimize false positives while delivering quick, low-friction results. They also said they can count tokens and track costs, helping CIOs manage AI spend alongside security, citing an example of an EA spending $10 thousand on tokens before visibility reduced costs.
"In the product today, we have the ability to, set policy and enforce those guardrails." — George R. Kurtz (CEO)
protecting Frontier Labs and large AI customers
Q (Patrick Colville · Scotiabank): Analyst asked for details on the referenced 8-figure deal protecting a Frontier Lab and about the customer category of protecting model creators.
A: Management said AI-native companies and Frontier Labs need protection across the stack for visibility, protection, control, and compliance as they scale. They noted integrations like with NVIDIA and said CrowdStrike is well positioned to help these companies across chips to inference and expects broad demand.
"All of the companies that are involved in creating AI. Need to protect AI. And they are turning to CrowdStrike because we have got the right technologies across the entire stack." — George R. Kurtz (CEO)
endpoint acceleration drivers
Q (Joseph Gallo · Jefferies): Analyst asked what drove the fourth straight quarter of endpoint acceleration: new logos, managed services, premium SKUs, or cross-sell, and how much runway remains.
A: Management said much AI is consumed on endpoints, increasing the need to protect them, and about half the market still uses legacy AV. They said legacy providers lack capabilities against rogue AI agents, leading to net new wins and cross-selling within their platform.
"If we think about the market about half the market is still using legacy AV." — George R. Kurtz (CEO)
Quiltworks impact and monetization
Q (Todd Weller · Stephens): Analyst asked how impactful Quiltworks was in the quarter and whether it is mainly a partner-led motion that drives platform pull-through.
A: Management said Quiltworks is partner-led: partners use CrowdStrike's platform and frontier-caliber capabilities to find vulnerabilities and exposures, then work on remediation which drives platform pull-through. They called it a home run and said they will expand partners and capabilities within the platform.
"They are leveraging our platform in a partner-led motion And finding these vulnerabilities, understanding exposure, and then obviously working on remediation with, you know, some of the largest enterprises in the world." — George R. Kurtz (CEO)