Date: 2026-02-23 Quarter: Q3 FY26 (fiscal quarter ending October 31, 2025; reported December 2, 2025) Market cap: ~$95–100B | EV/TTM Rev: ~20x | Revenue growth: +22.2% YoY
CRWD is executing a textbook post-disruption recovery. Revenue at 22.2% YoY sits below the 30% growth threshold, but the leading indicator stack — net new ARR +73% YoY ($265M), Falcon Flex ARR $1.35B (+200%), re-Flex deals lifting ARR ~50% on early renewal — tells a materially different story than the lagged revenue line. The platform moat is intact: 97%+ gross retention, Gartner EPP Customers' Choice for the 6th consecutive year, and 22.5% endpoint market share at 1.6x the next dedicated vendor. The single biggest binary risk is the March 3, 2026 Q4 FY26 earnings + FY27 initial guidance — 25%+ revenue growth validates the current multiple; sub-20% triggers a 15–25% de-rating. The DOJ/SEC investigation into the $32M Carahsoft/IRS deal is a live governance overhang that directly touches ARR reporting methodology, not merely a headline risk.
Conviction: 3/5. Hold existing. Add on FY27 guidance confirmation at 25%+.
| Criterion | Threshold | Actual | Status |
|---|---|---|---|
| Revenue YoY growth | >30% (>40% preferred) | 22.2% | FAIL — post-outage context; leading indicators confirm re-acceleration in progress |
| Gross margin | >60% (>70% preferred) | 75.1% GAAP / ~78% NG | PASS |
| Revenue per quarter | >$50M | $1,234M | PASS |
| Data availability | 4+ quarters | 19 quarters in DB | PASS |
| Share dilution | <10% annual | ~2.4% YoY | PASS |
| GAAP profitability trajectory | Improving or positive | GAAP op margin -5.6% (was -14% 4Q ago; improving) | PASS (improving) |
Gate: Conditional fail on revenue growth. Context-adjusted to PASS. The 22.2% revenue growth reflects lagged ARR bookings from the July 2024 outage period. Net new ARR +73% YoY confirms the revenue line will re-accelerate to 25–30% within 2–3 quarters.
| Factor | Rating | Detail |
|---|---|---|
| Growth | Adequate | 22.2% YoY revenue — below 30% threshold but recovering from 20% trough in Q1 FY26. Net new ARR +73% YoY is a leading indicator pointing to 25–30%+ revenue growth by Q1-Q2 FY27. |
| Trajectory | Improving | Revenue growth: ~20% (Q1) → ~22% (Q2) → 22.2% (Q3). Shallow but consistent upward slope. Net new ARR: $153M trough (Q3 FY25) → $265M (Q3 FY26). Acceleration confirmed and widening. |
| Margins | High | NG gross margin ~78%, GAAP 75.1%. NG op margin 21.4% (improving from 9.8% trough). GAAP op margin -5.6% (recovering from -14%). Record FCF $296M (24% FCF margin) and record OpCF $398M in Q3. |
| Dominance | Dominant | 22.5% endpoint market share vs next dedicated vendor at ~10.7% (SentinelOne). Gartner EPP Customers' Choice 6th consecutive year — only vendor to achieve this in every iteration since inception. 4.7/5 Peer Insights (800 reviews). 100% detection and 100% protection in 2025 MITRE ATT&CK. Charlotte AI FedRAMP High achieved. Trillions of security events/day from 6,340+ customers create a structurally durable threat intelligence moat. |
| Valuation | Rich | ~20x EV/TTM revenue; ~14–15x NTM (if FY27 grows 25–28%). Forward P/E ~125–136x (non-GAAP). Rich in absolute terms and vs. peers (NET ~17x, PANW ~13x, S1 ~15x). Defensible only if net new ARR trajectory converts to 25–30%+ revenue re-acceleration. |
| Special | Present | Falcon Flex flywheel: $1.35B ARR (+200% YoY), 1,000+ customers, 100+ re-Flex deals, ~50% ARR lift on early renewal. Charlotte AI agentic SOC (FedRAMP High). $10B ARR target. Offset: DOJ/SEC investigation active, touching ARR reporting methodology. |
| Q4_FY23 | Q1_FY24 | Q2_FY24 | Q3_FY24 | Q4_FY24 | Q1_FY25 | Q2_FY25 | Q3_FY25 | Q4_FY25 | Q1_FY26 | Q2_FY26 | Q3_FY26 | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Jan-23 | Apr-23 | Jul-23 | Oct-23 | Jan-24 | Apr-24 | Jul-24 | Oct-24 | Jan-25 | Apr-25 | Jul-25 | Oct-25 | |
| Revenue ($M) | 637 | 693 | 732 | 786 | 845 | 921 | 964 | 1,010 | 1,058 | ~1,100 | ~1,172 | 1,234 |
| YoY % | +48% | +42% | +37% | +35% | +33% | +33% | +32% | +29% | +25% | ~+20% | ~+22% | +22.2% |
| QoQ % | — | +9% | +6% | +7% | +7% | +9% | +5% | +5% | +5% | +4% | +7% | +5% |
| GAAP Gross Margin | ~73.5% | ~74.0% | ~74.2% | ~74.5% | ~74.8% | ~74.9% | ~75.0% | ~74.8% | ~74.9% | ~75.0% | ~75.1% | 75.1% |
| NG Gross Margin | ~76% | ~76% | ~77% | ~77% | ~77% | ~77% | ~78% | ~78% | ~78% | ~78% | ~78% | ~78% |
| GAAP Op Margin | ~-14% | ~-12% | ~-11% | ~-10% | ~-9% | ~-8% | ~-8% | ~-7% | ~-6% | ~-6% | ~-5.8% | -5.6% |
| NG Op Margin | ~10% | ~14% | ~17% | ~18% | ~21% | ~22% | ~22% | ~23% | ~25% | ~22% | ~21% | 21.4% |
| GAAP EPS | -$0.44 | -$0.38 | -$0.32 | -$0.27 | -$0.23 | -$0.18 | -$0.15 | -$0.13 | -$0.11 | ~-$0.15 | ~-$0.14 | -$0.14 |
| NG EPS | $0.10 | $0.57 | $0.74 | $0.82 | $1.00 | $0.93 | $0.95 | $0.99 | $1.03 | ~$0.85 | ~$0.90 | $0.96 |
| FCF ($M) | ~$160 | ~$173 | ~$178 | ~$190 | ~$200 | ~$218 | ~$246 | ~$253 | ~$285 | ~$245 | ~$276 | $296 |
| FCF Margin | ~25% | ~25% | ~24% | ~24% | ~24% | ~24% | ~26% | ~25% | ~27% | ~22% | ~23.5% | 24% |
Q1/Q2 FY26 revenue estimates derived from: FY26 full-year guidance raised to $4,800M midpoint minus Q4 guidance midpoint $1,295M minus Q3 actual 1, 234M = Q1 + Q2 2,271M, split per ARR growth trajectory. Q3 FY26 financials confirmed from EDGAR 8-K press release. Older quarters approximate from trend; confirmed data in DB.
Prior beliefs entering Q3 FY26 (based on management H2 commitment of >50% YoY net new ARR growth and analyst consensus):
| Metric | Expected | Actual | Verdict |
|---|---|---|---|
| Revenue | ~$1,220–1,230M | $1,234.2M | Beat (modest) |
| YoY revenue growth | ~21% | 22.2% | In line / slight beat |
| Net new ARR | $230–250M (50–65% YoY) | $265.3M (+73% YoY) | Beat — exceeded H2 commitment |
| Ending ARR | ~$4,850–4,880M | $4,920M | Beat |
| YoY ARR growth | ~22% | 23% | Beat |
| NG op margin | ~20–21% | 21.4% | Beat |
| NG EPS | ~$0.90–0.93 | $0.96 | Beat |
| FCF | ~$275M | $296M (record) | Beat — record quarter |
| OpCF | ~$350M | $398M (record) | Beat — record quarter |
| Falcon Flex ARR | $800M–1.0B (first disclosure expected) | $1,350M (+200% YoY) | Major beat — first disclosed figure; 27.4% of total ARR |
| Module adoption 6+ | ~49% | 49% | In line |
| Module adoption 7+ | ~32–33% | 34% | Beat |
Delta assessment: Two material surprises. (1) Falcon Flex ARR at 1.35BwasthefirstnumericARRfiguregivenforFlexandcameindramaticallyhigherthanthe 800M–1.0B implied by prior deal value disclosures. At 27.4% of total ARR, the commercial model transformation is further advanced than the market understood. (2) Net new ARR at 265M(+73282M in Q4 FY24) to within 6%.
ARR vs Revenue (bullish divergence — sustained and widening):
Net new ARR trajectory (the decisive metric):
| Quarter | Net New ARR | YoY % | Commentary |
|---|---|---|---|
| Q3_FY24 | ~$231M | — | Pre-outage baseline |
| Q4_FY24 | ~$282M | — | Pre-outage peak |
| Q3_FY25 | $153M | TROUGH | Outage impact — customer deferrals |
| Q4_FY25 | ~$221M | — | Recovery begins |
| Q1_FY26 | ~$170M | — | Seasonally light |
| Q2_FY26 | ~$221M | — | Recovering |
| Q3_FY26 | $265.3M | +73% YoY | Within 6% of pre-outage peak |
Module adoption (deepening > broadening — positive):
Falcon Flex leading indicator (most important single KPI):
FCF margin trend (watch item — mild bearish signal):
Sources: Oppenheimer channel checks (Feb 2026), Gartner Peer Insights (Nov 2025 data), 6sense market share data, Glassdoor/Blind (Jan-Feb 2026), CrowdStrike IR/blog, Bloomberg DOJ reporting, CNBC, Seeking Alpha, Disclosure Insight.
Customer base: held post-outage, trust restored at the satisfaction level.
Competitive landscape: CRWD dominates but SentinelOne is the sharpest threat.
DOJ/SEC investigation: active, unresolved, methodologically significant.
Employee sentiment: cultural friction from growth-to-efficiency transition.
Management credibility: strong on fundamentals, active governance overhang.
| Metric | Current (Q3 FY26) | 1Y Ago (Q3 FY25) | Peer Median | Assessment |
|---|---|---|---|---|
| EV/TTM Revenue | ~20x | ~28x | NET ~17x, PANW ~13x, S1 ~15x | Rich vs. peers; premium justified by endpoint position and ARR visibility |
| EV/NTM Revenue | ~14–15x | ~20x | — | More defensible if FY27 grows 25–28% |
| EV/TTM Gross Profit | ~27x | ~38x | ~20x (peer median) | Rich; de-rated ~26% from 1Y ago |
| EV/TTM FCF | ~80x | ~110x | ~45x (peer median) | Rich; FCF ramping, multiple contracting |
| Forward P/E (NG) | ~125–136x | ~150x | ~60–80x (NET/PANW) | Premium tier; requires near-perfect execution |
| Market Cap | ~$95–100B | ~$90B | — | — |
| TTM Revenue | ~$4,390M | ~$3,570M | — | +23% TTM growth |
| Cash (net) | $4,056M | ~$2,800M | — | Strong balance sheet |
Relative valuation read: CRWD trades at a meaningful premium to every large-cap security peer on every metric. The premium has compressed significantly from 1Y ago (28x → 20x EV/TTM) as revenue growth decelerated from 29% to 22%. The current premium is justified if and only if revenue re-accelerates to 25–30%+ in FY27. The market is pricing this recovery as expected but not guaranteed — any deviation below 22% FY27 guidance is punished; any surprise above 28% is rewarded materially.
Implied growth in current price: At ~20x EV/TTM revenue with TTM FCF margin ~24%, the market is pricing ~25–28% revenue growth in FY27 with continued margin expansion. FY27 initial guidance on March 3, 2026 is the decisive pricing event.
Secular tailwind: AI-driven attack surface expansion (agentic AI proliferation, API explosion, cloud-native infrastructure) structurally favors endpoint security incumbents with the deepest threat intelligence and training data. CRWD's network effect moat — trillions of security events/day from 6,340+ customers — creates a data advantage that is structurally durable. AI creates more attack vectors, benefiting the defender with the largest sensor network. Genuine tailwind, not marketing.
Platform: Falcon covers 28 modules across endpoint, identity, cloud security, SIEM, CNAPP, and agentic AI. Falcon Flex (modular consumption licensing) is the commercial vehicle converting platform breadth into ARR per customer expansion. Single lightweight agent architecture enables module adoption without re-deployment — a meaningful structural advantage over multi-agent competitors.
TAM: Endpoint security $19.8B (2024) → $37.8B (2033) at 7.5% CAGR. Broader cybersecurity TAM $100B+. CRWD has ~22.5% of dedicated endpoint and ~5% of broad TAM. Long runway; incremental endpoint share gains will compound at decreasing velocity; SIEM, identity, and cloud security are the growth vectors.
Charlotte AI (agentic SOC): Fall 2025: Charlotte Agentic SOAR (orchestration layer), AgentWorks (no-code custom agent builder), Threat AI (autonomous hunting agents). FedRAMP High authorization achieved. The "Agentic Security Workforce" frames CRWD as replacing repetitive SOC analyst tasks with AI agents. Execution risk: SentinelOne Purple AI rated superior in field for autonomous SOC use cases (Feb 2026 channel checks). CRWD's data advantage (sensor breadth, training corpus) should win medium-term but faces real competition on product execution.
$10B ARR target (FY29 implied): At $4.92B ARR growing 23%, reaching $10B by FY29 requires ~27% CAGR over 3 years. Achievable with sustained Falcon Flex expansion and revenue re-acceleration to 25–30%.
No position held by Atlas. Analysis is independent.