CrowdStrike Holdings (NASDAQ:CRWD) Q2 2027 Earnings Call

0:00 Hello, and welcome to CrowdStrike's Fiscal Second Quarter twenty twenty seven Financial Results Conference Call. At this time, all participants are in a listen only mode. After the speakers' presentation, we will conduct a question and answer session. Please be advised that today's conference is being recorded. I would now like to hand the call over to Andy Nowinski, Vice President of Investor Relations and Strategic Finance. Andy, please go ahead.

0:24 Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, Chief Executive Officer and Founder of CrowdStrike and Bert Podbere, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth, including projections and expected performance, including our outlook for the third quarter and fiscal year twenty twenty seven and any assumptions for fiscal periods beyond that are forward looking statements within the meaning of the Private Securities Litigation Reform Act of 1995.

1:00 These forward looking statements represent our outlook only as of the date of this call. While we believe any forward looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward looking statements, whether as a result of new information, future events or otherwise. Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the company's annual and quarterly reports. Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed in this call will be non GAAP. The discussion of why we use non GAAP financial measures and a reconciliation schedule showing GAAP versus non GAAP results is currently available in our earnings release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form eight ks filed with the SEC today.

2:04 With that, I will now turn the call over to George. Thank you, Andy, and thank you for joining CrowdStrike's q two f y twenty seven earnings call. When we last spoke, we were just weeks after what we called the mythos moment, an inflection point in cybersecurity. The world came to understand that cybersecurity is a necessity for AI adoption. New models created a new risk environment with no turning back. Recently, this realization became even clearer with the market's newest adversary, AI agents themselves. We told you this was the future, and this future is now a reality. Our previous guidance foreshadowed this conviction, and CrowdStrike's Q2 was our very best quarter in company history.

2:52 Inflection has become acceleration. Our Q2 results set a new bar. Here's what we delivered. One, all time record net new ARR of three thirty three million dollars accelerating to 51% year over year growth and beating the high end of our guidance by more than $45,000,000. Two, ending ARR growth accelerated for the fourth consecutive quarter, reaching $5,840,000,000 up more than 25 year over year. Three, total revenue growth accelerated for the fifth consecutive quarter, reaching $1,470,000,000 up 26% year over year.

3:39 Four, q two record free cash flow of $377,000,000 or 26% of revenue, growing 33% year over year. Five, all time record operating income of $372,000,000 or 25% of revenue, growing 46% year over year. Six, all time record net new ARR from new logos, while both net and gross dollar based retention improved over the prior quarter. Seven, all time record FalconFlex quarter with ending ARR from accounts that have adopted the FalconFlex subscription model surpassing $2,290,000,000 accelerating to 101% year over year growth.

4:30 And eight, FY '27 net new ARR guidance increase of six thirty basis points. We now expect year over year growth of 34% at the midpoint, a 1,150 basis point increase from our initial outlook. The quarter was a sea change for CrowdStrike, and I see these dynamics continuing. We're in an arms race. AI is driving more cyber attacks. AI is driving more cyber spending. AI is driving a clear divide between the cybersecurity companies that solve problems and those that compound problems. CrowdStrike's quarter demonstrates the market trusting us more than ever to secure their adoption of AI with cybersecurity's single platform of choice.

5:21 The world's adoption of AI is rapidly expanding the attack surface. More models, more agents, more agentic applications, more data, and with that, more identities, more permissions, more policies, more cyber attacks, and more risk. Agent proliferation is becoming mainstream to augment work and personal life. Agents are powerful forces for productivity and good. Agents are also human and machine risk multipliers with access to data, continuous operational capability, and limited judgment. We're seeing agents go rogue, swarming to attack and moving beyond their guardrails to autonomously harm. Agents are proving capable of data theft, permission alteration, and full on command and control at scale, leading to organizational compromise.

6:16 The agent of today is both a friend and foe. The currency of protection is increasingly presence and speed.

6:25 Do you have the right technology deployed that can see, prevent, and stop agentic attacks? Do you have the right technology that can outpace an entirely new real time adversary? The AI threat environment is shining a clear light on which products work and which don't. We see failing products as open doors for agentic adversaries. At CrowdStrike, we don't just stop these breaches, we and our partners help the world recover from them. In this threat landscape, CrowdStrike stands out. Our market leading cybersecurity services are in high demand. The flywheel we've created of best in class incident response services, lauded by law firms and insurance brokers, translates into best in class product outcomes for new customers.

7:14 Ever since Mythos, we've seen growth in our business, not measured by meetings or calls, but measured by ARR. And we don't see the threat landscape subsiding. Far from it. Demand for AI grows our TAM driving the need for CrowdStrike. The AI transformation doesn't just necessitate a technological lift and shift. It's necessitating a fundamentally new go to market motion, one based on maximizing time to value, ecosystem impact, and ROI. The Falcon platform removes friction from cybersecurity, and the go to market motion we created with Falcon Flex does the same. Flex is the commercial harness to enable customer success in the agentic era.

8:02 This quarter, we kicked Falcon Flex activity into high gear with our Flex First go to market strategy. Our top 10 deals by deal value were each flexes and the results speak for themselves. This quarter, we delivered record flex deal volume, adding more than 935 flex accounts. That's more than 10 flexes every day of the quarter and more flexes than the last three quarters combined. When Falcon customers convert from standard subscriptions to Flex, we see a greater than 40% average ending ARR uplift. We're not just focused on converting existing customers to Flex, we use Flex from the start with new logo customers. Flex new logo ARR contributed 34% of Q2 net new ARR, a record.

8:55 We also saw a record reflex activity for existing Flex customers with more than six thirty accounts having reflexed at least once, up 6x year over year. On average, a customer's first reflex happens in eight months from their initial Flex. Lastly, we saw record repeat Reflex customers with average ending ARR uplift of 53% from their initial Flex subscription. Falcon Flex wins include a Frontier Lab that significantly grew with CrowdStrike in an 8 figure ARR deal, using Flex to maintain cost visibility while significantly growing Falcon cloud security across its

9:40 rapidly expanding data center infrastructure. A European automotive manufacturer called upon CrowdStrike to replace a next gen EDR, a legacy SIM, and a legacy vulnerability management product. Landing with an 8 figure net new Falcon Flex, CrowdStrike delivered superior outcomes and immediate platform consolidation.

10:02 Our Falcon Flex go to market motion unlocks the complete aperture of the Falcon platform. When looking at our Q2 performance, I'm pleased to see strength across so many different product areas. Increasingly, the epicenter of AgenTic work, securing the endpoint is now a top spend priority. CrowdStrike is the leader in endpoint. We're now capitalizing on our ubiquitous endpoint presence to deliver the future of AI security. In Q2, our Endpoint business accelerated for the fourth consecutive quarter as customers look to secure their growing AI attack surface. We're seeing dramatic expansion in agentic work on the endpoint, both through fast growing tools such as Codex and Claude, as well as custom agentic applications.

10:50 In sampling our customer base, we've seen more than 400% growth in Claude usage and more than 100% growth in custom agent usage on endpoints in recent months. As enterprises look to deploy these new technologies, they're also seeking ways to contain the new risk created ranging from code exploitation to data leakage to identity compromise.

11:15 Instead of turning to science projects or point products, the market is trusting CrowdStrike as critical infrastructure to both enable and safeguard their AI future. A large financial services firm worked with two of our GSI partners to replace a next gen EDR in an 8 figure flex win.

11:36 Across more than 100 entities and hundreds of thousands of endpoints, CrowdStrike was selected for the best detection coverage, deployment ease, and the lightest impact. Our endpoint success fuels the adoption of AIDR, a product surging past our expectations. AIDR ending ARR nearly tripled versus q one as customers embrace our frictionless approach to AI visibility and security. One of the world's largest banks adopted AIDR in an 8 figure flex win. Immediate AI deployments necessitated security, visibility, and control.

12:16 We were selected for AI usage visibility and data exfiltration prevention. Demand, adoption, and growth like this is rarely seen. I can't wait to unveil our newest AI security innovations at next week's Falcon conference. Moving to our cloud, identity and next gen SIEM businesses, the market is rapidly embracing these products to protect fast expanding attack surfaces. We delivered record Q2 net new ARR from the combination of these businesses.

12:48 Unpacking these results, our Next Gen SIM business delivered another banner quarter driven by record Q2 net new ARR. Next Gen SIM ending ARR surpassed $695,000,000 this quarter as both new and existing customers are standardizing on Falcon as the operating system of the SOC. Our native first party data advantage coupled with the speed and efficiency of our platform continue to set us apart. Features like AgentWorks enable security teams to build, deploy, and manage custom AI security agents, setting the foundation for the AI SOC. In an eight figure FalconFlex win, a major American power provider replaced a legacy acquired SIEM, selecting next gen SIEM over a firewall first product for technical, speed, and economic superiority.

13:46 Turning to our identity business. Ending ARR grew 34% year over year to more than 5 and $85,000,000 driven by strength across our identity product portfolio. Specifically, Falcon Shield had another strong quarter as enterprises look to secure their third party agentic applications. Shield ending ARR grew more than 185% year over year in Q2.

14:14 In addition, our privileged account security offering saw a stellar adoption with ending ARR growing more than 35 x year over year. Rounding out our identity portfolio, we're seeing early success with Signal. Large enterprises are rethinking decades of legacy access controls no longer effective for the agentic era. Instead, they're embracing Signal's real time granular access model for both humans and nonhuman alike. In one customer alone, Signal brokered more than 30,000,000 unique access decisions without friction. A major global financial firm added NextGen Identity to their Falcon deployment following a board mandated AI security audit.

15:02 Hand in hand with NextGen Identity was an immediate deployment of AIDR where identity protection enabled AI adoption.

15:12 Moving on to cloud, where ending ARR exceeded $905,000,000, growing more than 29% year over year. CrowdStrike is the leader in cloud runtime security, which has become an imperative in protecting modern AI workloads. Our customers tell us that point in time posture scans are no longer enough to protect against fast moving threats that now proliferate in seconds.

15:37 A mega technology conglomerate opted to use Falcon cloud security for our runtime superiority in an 8 figure ARR win. CrowdStrike now secures this organization's AI cloud and labs because of our build pipeline integration and compatibility with internal tools resonating with their DevOps teams.

16:00 Finally, we're seeing the Methos moment transform the market's need for exposure management, pressuring antiquated vulnerability management products built for a bygone era. The agentic adversary has broken the exploit sound barrier, and you simply cannot patch vulnerabilities fast enough. As the patch window collapsed, our exposure management business accelerated sequentially in q two. Falcon Exposure Management offers real time detection and continuous prioritization to successfully contain a new speed and scale of vulnerability risk. A representative exposure management win included a global religious organization that replaced a legacy vulnerability management product as part of their AI transformation initiatives.

16:49 In this 7 figure flex, the account also immediately deployed AIDR to bring visibility and control to its AI usage, showcasing CrowdStrike's position to protect against AI threats and govern

17:03 AI adoption. Our partner ecosystem is mobilized around Falcon and its role in securing AI. Project QuoteWerks has united more than 25 of our partners from GSIs to hyperscalers, resellers, to ISVs, and even distributors and MSPs. To date, our QuiltWork partners are collaborating with us on nearly $400,000,000 of total contract value pipeline.

17:30 We've seen exceptional engagement from GSI partners, resulting in our GSI business growing nearly 50% year over year, largely focused on next gen SIEM transformations and vulnerability management needs. Across our MSSP business, we're seeing significant traction in the SMB space with key partners such as CRWL. Three quarters ago, CRWL took a strategic step to migrate all of its customers off a competing next gen endpoint technology. A majority of customers already successfully migrated to Falcon across 450,000 endpoints. Tracking ahead of plan, Kroll took a major next step with a multi year flex subscription growing their spend with CrowdStrike by more than three times. This flex addresses platform consolidation and SIM transformation across CRWL's existing Falcon install base and incoming new customers.

18:25 In another q two win, Accenture standardized on CrowdStrike for its new SMB focused Accenture Edge business launched in June. Lastly, q two showcased the power of our one of a kind cloud marketplace go to market motion across AWS, Google, Microsoft. Each of our hyperscaler marketplace partners, we saw a record Q2 as customers use their hyperscaler of choice for security investments.

18:53 In Q2 alone, we transacted more than 600,000,000 in deal value through cloud marketplaces, representing more than 30% year over year growth. We quickly saw traction with our Microsoft marketplace presence, opening a new addressable market. Immediate Microsoft Marketplace wins included a new logo Australian healthcare provider started using CrowdStrike for SOC transformation in a 7 figure flex. An American manufacturing firm previously used our services and has now expanded to the Falcon platform through a seven figure flex on Microsoft Marketplace. In closing, q two was an incredible quarter where the mythos moment turned into acceleration.

19:41 Acceleration in net new ARR, acceleration in ending ARR, acceleration in Falcon Flex, acceleration in our ecosystem, acceleration in innovation.

19:52 We're seeing endpoint as the epicenter for AI adoption. We're seeing AIDR define a new cybersecurity category. We're seeing next gen SIEM as the operating system of cybersecurity, Falcon Identity becoming the security front door for human and nonhuman users, and exposure management as mission critical for prioritizing AI risk. Taken together, the Falcon platform is cybersecurity's infrastructure layer for AI adoption.

20:25 AI adoption is accelerating from frontier labs and open weight models alike, and we're still in the early innings of the AI revolution. When I look at our business, here's what this acceleration means. Last quarter, we raised our forward net new ARR growth guidance by 520 basis points. And this quarter, we're raising our FY '27 year over year net new ARR growth outlook by an additional 630 basis points, even more than last quarter. That's a raise to our net new ARR guidance of more than $100,000,000 since the start of the year. Delivery of a quarter like this and this outlook is fueled by the demand environment in our technology team ecosystem and customers.

21:14 The innovation engine is in overdrive.

21:17 As I shared last quarter, Doctor. Bartley Richardson, previously at NVIDIA, has joined us as our Chief AI Autonomous System Officer as part of our long planned and mutually agreed upon CTO leadership transition.

21:33 I can't wait to share the vision and innovation that we are bringing to the world's adoption of AI Falcon in Las Vegas next week. The conference sold out in early August, and it's our largest pipeline generation event of the year. We'll have record customer and partner attendance. I also encourage everyone to tune into our investor briefing on Wednesday, September 2. Our role in securing enterprises, governments, and economies is vital to AI adoption and mission critical in an AI first world. I'll now turn the call over to Bert Podbearer, CrowdStrike's CFO.

22:15 Thank you, George, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers except revenue mentioned during my remarks today are non GAAP. Additionally, all earnings per share and share amounts presented today and in our accompanying investor materials have been adjusted to reflect our recent four for-one stock split for all periods presented.

22:38 We delivered a record second quarter, exceeding expectations across all guided metrics. We achieved an all time record $333,000,000 of net new ARR, well ahead of our guidance and accelerating to 51% growth year over year. Ending ARR reached $5,840,000,000 up more than 25 over the prior year as growth accelerated for the fourth consecutive quarter. As George discussed, the post Methos demand environment continued to strengthen in Q2. The customer urgency we began to see in Q1 translated into increased cybersecurity investment, accelerated modernization and stronger demand for the Falcon platform. Our exceptional Q2 performance was broad based across customer sizes and geographies.

23:29 Net new ARR contribution from new logos was an all time record, and both our dollar based net and gross retention rates improved sequentially. Platform adoption also continued to deepen with 51%, 3526% of subscription customers adopting six, seven and eight or more modules, respectively. Falcon Flex continues to be a key driver of our platform consolidation, with this quarter showcasing the power of our FlexFirst strategy.

24:01 In Q2, customers converting from standard subscriptions to Flex delivered an average ending ARR uplift of more than 40%. From that new baseline, customers completing their first reflex this quarter generated an additional average ending ARR expansion of 25%. Looking at the cumulative uplift of customers who have reflexed at least twice, in Q2, these customers had average ending ARR 53 higher than their initial flex starting point, increasing for the second consecutive quarter. Taken together, these results underscore exceptional execution and the power of our platform strategy with AI driven demand accelerating platform consolidation and helping deliver the strongest quarter in CrowdStrike's history.

24:52 We also exited the quarter with a record Q3 pipeline, further reinforcing our confidence in the demand environment ahead. Moving to the P and L. Total revenue exceeded our guidance range and grew 26% over Q2 of last year to reach $1,470,000,000 with year over year growth accelerating sequentially for the fifth consecutive quarter.

25:17 Subscription revenue grew 27% over Q2 of last year to reach $1,400,000,000 and professional services revenue was an all time record $71,000,000 as AI creates incremental demand for our AI readiness and incident response services, further increasing software cross sell opportunities. The geographic mix of second quarter revenue consisted of approximately 65% from The U. S. And 35% from international geographies. Broad based strength across our major regions drove international year over year revenue growth acceleration for the fifth consecutive quarter. Total Q2 non GAAP gross margin was 79%, up approximately 110 basis points over the prior year.

26:07 Non GAAP subscription gross margin was 81%, up approximately 90 basis points over the prior year, driven by continued cloud optimization efforts as we remain focused on achieving our FY 'twenty nine target model of 82% to 85% non GAAP subscription gross margin.

26:26 Second quarter non GAAP operating income was a record $372,000,000 exceeding our guidance, and non GAAP operating margin was 25%, up three fifty basis points over the prior year. The outperformance was driven by strong top line execution, continued gross margin expansion and increased operating efficiency. Our internal investments in automation and AI continue to yield greater operational efficiencies and productivity gains across our business. The combination of accelerating revenue growth and substantial year over year operating margin expansion demonstrates our strong operating leverage as we invest in the significant opportunities ahead, positioning us to deliver durable, profitable growth.

27:14 In Q2, we delivered $5,000,000 of GAAP net income attributable to CrowdStrike, marking the third consecutive quarter of positive GAAP earnings. Non GAAP net income attributable to CrowdStrike was a record $323,000,000 or $0.31 per diluted share, exceeding our guidance and up 34% compared to the prior year on a split adjusted basis. Moving to cash. Our cash and cash equivalents grew to $5,010,000,000 We generated Q2 record cash flow from operations of $530,000,000 and Q2 record free cash flow of $377,000,000 or 26% of revenue, exceeding our free cash flow margin expectation of 24.5.

28:04 Moving to our outlook and modeling notes. Consistent with our guidance philosophy, our outlook reflects the strength we see in the business while maintaining a prudent approach. Our record second quarter performance, record Q3 pipeline and broad based demand across customer segments and the Falcon platform give us increased confidence in the strength of the demand environment and our long term growth opportunity. As a result, we are once again raising our fiscal twenty twenty seven net new ARR outlook. At the midpoint, we now expect $1,355,000,000 of net new ARR for the full year, an increase of approximately $116,000,000 from our initial FY 'twenty seven outlook. This equates to expected year over year net new ARR growth of approximately 34% compared to 22.5% in our initial FY 'twenty seven outlook, representing an increase of eleven fifty basis points.

29:03 The magnitude of this increase reflects more than our Q2 outperformance. As AI expands the attack surface and increases the urgency around cybersecurity, we believe it is driving a broader security modernization cycle that creates durable demand across the Falcon platform. Combined with continued platform consolidation and strong Falcon Flex momentum, these demand signals reinforce our confidence in the full year opportunity ahead. Before I walk through our detailed guidance, let me highlight two additional items to keep in mind. First, the acquisition of XM Cyber's technology assets is expected to close in the second half of FY 'twenty seven and will not bring any ARR or revenue to CrowdStrike, nor are we including any ARR or revenue from this transaction into the FY 'twenty seven guidance.

29:56 And second, at the midpoint of our guidance, we expect free cash flow margin of 27.5 in Q3 and continue to expect at least 30% for the full fiscal year on our increased revenue guidance. With that, for the third quarter of FY 'twenty seven, we expect annual recurring revenue to be in the range of 6,184,000,000 to $6,188,000,000 up 26% year over year. This translates to net new ARR of $343,000,000 to $347,000,000 up 29% to 31% year over year. Total revenue to be in the range of 1,523,000,000 to $1,529,000,000 up 23% to 24% year over year non GAAP income from operations to be in the range of $373,000,000 to $376,000,000 and non GAAP net income attributable to CrowdStrike to be in the range of $325,000,000 to $328,000,000 diluted non GAAP net income per share attributable to CrowdStrike to be approximately $0.31 assuming a 21% tax rate and approximately 1,048,000,000 weighted average diluted shares.

31:12 For the full fiscal year 2027, we expect annual recurring revenue to be in the range of $6,603,000,000 to $6,612,000,000 up 26% year over year. This translates to net new ARR of $1,350,000,000 to $1,359,000,000 up 34% year over year. Total revenue to be in the range of $5,991,000,000 to $6,011,000,000 up 25% over the prior fiscal year. Non GAAP income from operations is expected to be between 1,497,000,000 and $1,508,000,000 and non GAAP net income attributable to CrowdStrike to be between 1,303,000,000 and $1,312,000,000 Assuming a 21% tax rate and approximately 1,044,000,000 weighted average diluted shares, we expect non GAAP net income per share attributable to CrowdStrike to be in the range of $1.25 to $1.26 George and I will now take your questions.

32:19 Thank you. If you would like to ask a question, please click on the raise hand button, which can be found on the bar at the bottom of the Zoom window. You may remove yourself from the queue at any time by lowering your hand. When it is your turn, you will hear your name called and receive a message on your screen notifying you that you may unmute yourself. In the interest of time, participants will be limited to one question. Our first question comes from Saket Kalia with Barclays. Please unmute your audio and ask your question. Okay, great. Can you hear me okay? Yes, go ahead. Yep. Okay, excellent. Well, hey guys, thanks for taking my question here and great to see the acceleration continue. George, maybe for you, the Mythos moment happened in the spring, and now we've gotten a few months of activity behind us.

33:12 Could you maybe talk about what transpired after that? And as you look back, what were some of the key drivers of this upside here in Q2? Thanks, Zach. So as we mentioned in the spring, the Methos moment was building, and as we told you, it was going to be a growth driver and a tailwind for us, and you saw that show up in our results. When we think about AI agents going rogue, when you think about the need for protecting AI and understanding where shadow AI is, it all points to the technologies that we're building and delivering here, like AIDR, which was just had a phenomenal quarter. No surprise. Obviously, cloud identity, next gen SIM, endpoint was accelerating, and exposure management, which is a big element now given the fact that companies can't keep up with the patching. So when you put all of that together, it comes to what we said the methos moment was a point of acceleration, and we see those tailwinds continuing.

34:17 Thanks, Saket. Operator, next question, please. Your next question will come from Brian Essex with JPMorgan. Please unmute your audio and ask your question. Hi. Good afternoon. Thanks for taking the question, and great to see the nice magnitude of net new ARR upside this quarter. Maybe, George, for you, to piggyback on Sake's question there. We'd love to get your view on the durability of strength that you're seeing on the back of the Mythos moment, so to speak. I mean, how much of the momentum goes beyond next quarter, perhaps beyond the end of the year? And given what you have in your pipeline, how much visibility do you have into the strength, maybe just into next year and beyond? Thank you. Sure, I think when you look at the durability, in my opinion, it is absolutely there. It's one of the reasons why we raised FY '27 outlook again, and what we're hearing from customers is they want to deploy more AI, but they're being held back because of security compliance privacy data protection type issues.

35:23 So every customer that we talk to is concerned about the agentic threats. We've seen agents go wild, we've seen them break out of the frontier labs, and this is a sustainable tailwind. If we believe that AI is in its early days and is only going to get better and more powerful, combined with the autonomous nature of these attacks, it's absolutely something that every company is going to need. And as I said in a prior earnings call, I think the AIDR business can be bigger than the EDR business, just given the pure number of agents which each person will have, which is estimated to be about 90. So for me, it's sustained tailwinds, and you know, I think we're only going to see more stories around agents gone wild, and we're going to be there to protect our customers.

36:13 Yeah, and I think Brian, the numbers back it up. Look, you start with the record Q3 pipeline, so that prompted us, you know, to raise our full year guidance by an additional six thirty basis points. That means we moved our FY '27 net new ARR growth rate from 27.7 at the end of last quarter to 34% this quarter. When compared to our initial guide for the year, we raised the growth rate eleven fifty basis points, or 116,000,000 in just two quarters. That talks to the durability of the things that George talked. Thanks, Brian. Operator, next question, please. Your next question will come from Gabriela Borges with Goldman Sachs. Please unmute your audio and ask your question. Hey, good afternoon. Thank you. George and Bert, I wanted to ask you a little bit of a product question.

37:03 You gave a little bit of, you gave the case studies earlier on customer journeys and some of the flagship wins in the quarter. What I want to better understand is, if you have a customer, let's say it's a large financial organization, and they go from having agents being sandboxed and isolated, regardless of how effective those sandboxes can be, to actually wanting the agents to have real customer data, real enterprise data, walk us through the before and after. How do you advise those clients on what products they need to buy from CrowdStrike? Clearly identity is a part of it, to be able to say agents isolated to agents in production. Thank you. Sure. Well, I I think to make the agents productive, they're gonna have to have access to data, and again when you look at what we're delivering for customers, it's looking across the entire spectrum of threats, right? You have to have an identity control plane, which we have for non human identities. You have to have data protection, which we have. You have to understand at runtime what the agents are actually doing, whether that's in a sandbox or if those agents are running essentially on your computer or your laptop.

38:12 You have to understand the exposures that you have. You have to be able to keep track of where those agents are calling out to. We can do all of that, so if it's in a sandbox, we can run-in a sandbox. If it's out of a sandbox, which many of our customers are, you know, just kind of consuming AI on their desktops using the various Frontier Lab harnesses and the like, and we cover all of those, including if you're creating agents in a cloud environment. So from my perspective, the agents, first of all, you need to know where AI is being created, need to know where it's being consumed, and you have to put the right guardrails around identity, data, execution, and network connectivity, and we're delivering that for our customers. -Thanks, Gabriela. Operator, next. Your next question will come from Matt Hedberg with RBC. Please unmute your audio and ask your question.

39:05 Hey, guys. Thanks for taking my questions. I'll offer my congrats as well. You know, I wanted to piggyback sort of on this train of thought. And George, you talked about it in your prepared remarks, but I just I think we're all sitting back there, we're seeing these agents going rogue, and just how quickly this landscape is changing. So I guess, from your perspective, I just wanted to kind of get double click on how you see the threat landscape today. And when we think about how quickly this is changing, the relationship with the Frontier Labs is obviously great, but talk to us about why you're uniquely positioned, even if these Frontier Labs start to release some of their own security solutions in the future. Sure, well I think it's important that when you look at AI and to make AI protection more effective, you have to have very deep data expertise, and this has been something that's been basically built into the platform from day one.

40:07 Over the last fifteen years, we have some of the richest threat data, richest attack data, richest data around actually how to mitigate these threats in the industry. So when you look at the models that we've built, know, we've trained on those specifically, and that gives us a unique perspective. Customers of course want choice, they want to work with frontier models, they want to work with our technology and our platform, fantastic, but having the right data, having it trained in a specific fashion and labeled appropriately, I think, is unique, and we have data that just isn't available outside of the CrowdStrike walls. That's very important. The other piece is, and I mentioned this some time ago, we are net data creators.

40:53 We're constantly creating new data that's coming out of our endpoints. We're constantly using that data to update our algorithms as the threat environment changes. And again, I think this is very important to our customers. They want security companies they can trust, they want data sovereignty from a technology perspective, and they want to get actual results based upon the information in their own environment, and we're delivering that today. Thanks, Matt. Operator, next question. Your next question will come from Fatima Boolani with Citi. Please unmute your audio and ask your question. Good afternoon. Thank you so much for taking my question. I wanted to double back on some of the earlier questions around portfolio pervasiveness.

41:41 So specifically just around the acceleration that you continue to see in FalconFlex, both from a standard conversion and reflex. George, I was hoping if you could help us maybe parse out more granularly where you are seeing the most incremental or outsized traction on a skew or disciplinary basis as organizations move to production grade AI adoption. And I guess in other words, it's sort what parts of the portfolio have proven to be most potent in giving organizations the assurances and confidence they need that they are in a secure situation with their AI adoption? Sure, I'll take that Fatima. So first let's just talk about Flex. So Flex, it was an all time record Flex quarter with year over year growth accelerating to 101% year over year, surpassing 2,290,000,000.

42:36 And a lot of that is coming from, you know, some of the different technologies that we've been talking about quarter after quarter. When you think about cloud, next gen SIEM, next gen identity, ending ARR was $2,100,000,000 up 39% year over year, and if you go down the list of how we've done in each one of those particular elements, they're really impressive, right? You think about, you know, cloud, over $9.00 $5,000,000 in ending ARR, you know, up 29%. You've got next gen identity, which is a big piece of the AI story. That's up 33% year over year. And then you've got obviously next gen SIM, just a home run for us. That's coming up on almost 700,000,000, and that's up 60% year over year. So all three of those can be an IPO by themselves.

43:26 So you're seeing adoption through our flex licensing really showcase itself in those three products. And then George mentioned a whole bunch of other You know, we talked about exposure management having a great quarter, you talked about AI and Doctor having a fantastic quarter. So I think the point is that Flex is letting itself to be able to buy multiple of our products at the same time, and that's what's leading to bigger, longer deals for us. And it's better for the customer. At the end of the day, it's the platform sale. That's what matters. Customers looking to consolidate on us, they want better outcomes at a cheaper cost. Thanks, Fatima. Operator, next question. Our next question will come from Meta Marshall with Morgan Stanley. Please unmute your audio and ask your question. Great, thanks. I wanted to maybe follow-up on some of that next gen SIEM strength. If we were having this conversation a year ago, there was a lot of can start with or customers can start moving their EDR data over and then kind of gradually over time expand those implementations.

44:30 I just wanted to get a sense, as you guys are seeing continued really strong growth, is that kind of land happening differently? Like are people taking more of a chance upfront and moving more to you guys initially? And then just are we seeing kind of more data or logs being put into the SIEM to give better signals as they try to kind of detect more advanced attacks? Thanks. Yeah, well, you look at next gen SIEM, the great news is every customer is next gen SIEM enabled. Like the data is just in the platform, so it's just a matter of signing up and paying for the license entitlement, and you're up and running with the CrowdStrike, what we call first party data, the data that we actually generate. So that has made it incredibly easy and friction free for many customers. They routinely say it's the easiest SIM to get up and running, it's the quickest return in terms of time to value of what they're putting in and the results they're getting out, and then it's very easy to connect other data sources.

45:34 We've seen the other data sources rapidly expand. If we think about AI, AI agents, SaaS, and SaaS, you know, cloud agents, you will, these are all, and identity, these are all areas that customers have to instrument, because we see these cross domain attacks that go from internal systems to the cloud, or cloud to internal systems, and everything in between. So we've seen just tremendous results there, it's a fantastic product, and it's very disruptive from a price point because how we charge for the first party data that we create, so you know it is a story of better, faster, and more value for the money, and you can see the results, they speak for themselves. Thanks, Mia. Operator, next question, please. Our next question will come from Adam Tindle with Raymond James. Please unmute your audio and ask your question.

46:27 Okay, thanks. Good afternoon and congrats on a great quarter. George, I wanted to ask on AIDR versus the core EDR platform, kind of a two parter. Ask because investors are struggling with the definition and a view that there might be more gray area between AIDR and your core platform. So I guess the first part of the question would be, is there kind of a simple way to think about AIDR? Where is this incremental where customers are buying this in addition to EDR or is this being used more as a substitute for EDR or any other products? The second part would be, you've kind of alluded to some metrics around this that have been helpful, but I wonder if you might just take a second to put in context the ramp of AIDR versus other products at this stage as we try to think about the potential ultimate size of that platform. Thank you.

47:17 Yeah, so on the first point, it is separate and incremental. It's another module and it's priced separately, which is again where we're seeing a lot of the growth. So that is, you know, certainly a good fact to make sure that we clear up if there was any confusion about it. When we think about the beauty of the architecture and the platform, it's still using the same agent, and if you want to enable AIDR, again, that's a license entitlement, it's part of our friction free deployment. Again, why is Falcon Flex so successful? Why have we been successful? Media time to value, you don't have to roll out yet another agent, So that's very important, and when we talk about sort of like the ramp of this, it's been incredible over the last, you know, couple of quarters, and we've seen almost the results sort of parallel some of the Frontier Labs' growth, You know, as they continue to add more agents and capabilities, you have customers that are deploying more AI.

48:19 They actually want to deploy AI faster, and they need to scale incredibly fast. So when you combine what we're building with, again, it's on the same platform, that's the beauty, but we're able to monetize it separately, we think that's a home run, and we're showing the value to customers and they're willing to pay for it because it's very unique in the environment, and they don't want to deploy yet another agent, right, they're getting it all with CrowdStrike, and that's what they're looking for. Alright, thanks Adam. Operator, next question. Our next question will come from Roger Boyd with UBS. Please unmute your audio and ask your question. Great. Thanks for the question. For George or or maybe for Bert, given the traction you're seeing around AI security and you noted the acceleration in in AIDR, overall AI usage across your installed base and inflecting, I'd love appreciate your updated views on how you're evolving the pricing model. And and namely, customers asking for token based pricing in cybersecurity?

49:17 And if so, how how is that incorporated in in the flex contracts? Thanks. Yeah, so we actually have token based pricing as part of AIDR, so we already have that today, and what's important from a customer perspective is they do want some certainty on what they're paying, so we provide a certain number of tokens across an environment, and we obviously we scale that to how big the customer is, and then if they exceed that token usage, they can buy extra token packs. And again, the beauty is it's all consumable via the Falcon Flex licensing. So it's a model I think has served us well where it's not runaway cost for customers. They can define it. They can budget for it, but certainly as they scale up their AI, if they exceed their their budget allowance, they certainly can, you know, up level the tokens and it's friction free to do that with Falcon Flex.

50:18 Okay, thanks for the question, operator. Next next question, please. Our next question comes from Rob Owens with Piper Sandler. Please unmute your audio and ask your question. Great. Thank you and good afternoon. George, I guess back to the start and thinking about your history with found a little bit. And twice on this call, you did mention exposure management. So love to understand the evolution of that market, where you're seeing displacement because I think you mentioned a large scale transaction there. And effectively, the older solutions aren't providing at this point. I know that you guys adopted a network scanning capability a year ago, but with AI, I'd assume it's well beyond that at this point. So just would love for you to drill down on that opportunity in why CrowdStrike is winning. Thanks.

51:09 Sure, so when we think about where we are with exposure management, I think it's a rebirth, and certainly we're in pole position in that area. So what I mean by that is given the fact that there's an exponential increase in vulnerabilities that are found via, you know, Frontier AI and patches that can be created via Frontier AI, that's great. The problem is you've hit the sound barrier of actually rolling out a patch, and what that means is that companies are looking for their ability to prioritize where these exposures are because they're not going to be able to fix everything all at once within the window of what autonomous agents can actually exploit. That's really the driver in an area where customers are looking at and saying, hey, I've got to think about this differently.

51:59 I can't be doing the same old things that we've been doing. I can't keep using the same old legacy exposure management or vulnerability management technology. So they want a view of their assets. They want a view of where their protection is, Falcon. They want a view of what's exposed, right? What patches need to be applied but haven't, and they want to understand the attack paths, and we are delivering that in an autonomous fashion within the Falcon platform, and that's a big reason why we're displacing a lot of legacy vendors in the market today. Okay, thanks Rob. Operator, next question. Our next question comes from Mike Sikos with Needham. Please unmute your audio and ask your question. You for taking the questions, and congratulations on, another significant lift here to the net new ARR guide following the strong two q execution.

52:49 George, maybe for you. We've been doing a significant amount of work with CSOs, and the common refrain we're hearing comes back to AI governance, both in terms of security as well as the pull through on the the economic need to control these AI costs. My question really ties to can you just put a finer point on discussing how customers are turning to CRWD in terms of serving as that strategic partner for implementing and enforcing AI governance guardrails? I think that'd be super helpful. Thank you. Sure, well in the product today we have the ability to set policy and enforce those guardrails, which is incredibly useful, needed, and incredibly difficult. As you might imagine in some organizations that are dealing with, you know, they make chemicals as an example. Well, that may be something that, you know, is not an approved sort of topic, if you will, in other companies, but in some companies that's what they make, right? So you have to be able to have the right models to understand what's happening in the environment. You have to be able to set the policies in a way that actually work and minimize false positives, and then you have to give these customers very good results very quickly so they can roll this thing out without a lot of friction, and we're doing that today. The other piece, and you touched on it, which is very important, is we actually have the ability to count tokens and track costs, and this is very important as you expand outside of the boundaries of just pure security. When we think about IT infrastructure, we think about the CIO.

54:21 Having the ability to help them manage costs is a big part of our selling point as well. So you get the guardrails that you're looking for, get the protection you need, and also you have visibility into where your AI agents are and what people are actually spending on these results. And it's incredible. I mean, we've heard, you know, EA spending $10,000 just on tokens because of the way they were using the models. And dramatically, once you understand and have visibility around that, you can dramatically cut those costs down. So it's really a one two punch of protection and cost management. Thanks Mike. Operator, next question. Our next question comes from Patrick Colville with Scotiabank. Please unmute your audio and ask your question. Thank you for having me on. I guess this one for both George and Bert, please.

55:12 When you talked about the Frontier Lab eight figure deal, with this customer protecting their rapidly expanding data center infrastructure, I mean, any more question any more details you can share on this specific 8 figure deal? And then to zoom out the aperture a little bit, know, could you just talk to this emerging customer category of helping to protect the Frontier Labs? Thank you. Sure, I think you know you've got the digital natives that are out there, AI native companies, you've got the Frontier Labs, as you might imagine, you know all of the companies that are involved in creating AI need to protect AI, and they're turning to CrowdStrike because we've got the right technologies across the entire stack.

56:06 And again, if you look at what we've done with NVIDIA and how we have integrated into their platforms, It's a complete ecosystem from the chips all the way up to the applications and AI inference. So we think we're in a great position to be able to help these rapidly growing and expanding companies because they're going to need visibility, they're going to need protection, they're going to need control, they're going to need compliance as they continue to scale. You know, we think the sky's the limit with the frontier model creators and anyone involved in the AI ecosystem, and you know, we're there for them, and we think we have a very unique and differentiated technology in those areas. All right, thanks Patrick. Operator, next question. Our next question comes from Joseph Gallo with Jefferies. Please unmute your audio and ask your question.

56:57 Hey, guys. Thanks for the question. There's a lot of excitement in big numbers with the emerging products on the call, but I just wanted to focus on endpoint, which accelerated for the fourth straight quarter. Can you just unpack that a little bit more? Is that new logos? Is that selling more managed services and premium SKUs? And just how much runway is left there, just given it's perceived as a more mature market? Sure, well I think when you look at companies' desire to protect AI, again a lot of the AI is being consumed on the endpoint, right? It might be created in the cloud, but it's being consumed on the endpoint. You can think about your own organizations and perhaps how you even use AI. So that has driven the need for companies like CrowdStrike to be able to actually protect those instances. If we think about the market, about half the market is still using legacy AV, right, so legacy AV and legacy providers are not really going to have the capabilities to identify rogue AI agents, shadow AI, and be able to protect against it. Very unique and differentiated, but it fits within the platform that we built from the beginning, so that's one area where, again, if you want to protect these endpoints, you're going to have to have something like CrowdStrike, and that includes net new wins from a lot of the legacy providers that are out there, certainly in addition to cross selling into our customer base.

58:23 Thanks, Joe. Operator, next question please. Our next question comes from Todd Weller with Stephens. Please unmute your audio and ask your question. Yeah, good afternoon. Congrats, and thanks for taking the question. George, question on Quiltworks. Can you talk about how impactful it was in the quarter? And then trying to better understand the monetization angles there. Should we initially think about that as like a partner led motion where they're leveraging your platform and frontier AI model capabilities to do assessments, and then that drives kind of follow on platform pull through? Thank you. Yeah, that's exactly right. When we think about the Methos moment, there's many of our partners, and again, we're a very partner first organization, that want to be able to service their customers.

59:11 They've got great relationships, but we need to be able to arm them with Frontier caliber capabilities to be able to understand where these vulnerabilities are, what threats are out there, what they could do. So essentially they're leveraging our platform in a partner led motion and finding these vulnerabilities, understanding exposure, and then obviously working on remediation with, you know, some of the largest enterprises in the world. And of course that leads to platform pull through. So I think from our perspective, it's been a home run-in QuoteWerks. We have many companies that want to still yet get into it. We're working through all of those, and we'll continue to expand the partners as well as its capabilities within the platform for them to leverage.

1:00:01 -Thank you. This concludes today's question and answer session. I would now like to turn the call back over to George Kurtz for closing remarks. Thank you for your time today. We appreciate your continued support and look forward to seeing you at Falcon twenty twenty six and other upcoming events. Thank you.