CRWD — Stock Analysis (March 2026)

The leading indicators are screaming. Revenue isn't listening yet — but it will.

CrowdStrike just posted its best quarter since the July 2024 outage. Net new ARR of $331M (+47% YoY) is a record — not just post-outage, but in the company's history. Full-year net new ARR crossed $1B for the first time. Falcon Flex at $1.69B ending ARR (+120% YoY) is transforming the commercial model from product sale to platform consumption. Revenue growth re-accelerated to 23.3% YoY, up from the 19.8% trough four quarters ago, and FY27 guidance of 22-23% is sandbagged given a record Q1 pipeline that's +49% YoY.

But I'm not pounding the table. At 18.3x run-rate P/S for a 23% revenue grower, the stock prices in most of the recovery. The DOJ/SEC investigation into the Carahsoft/IRS deal is a live binary risk that touches ARR reporting methodology. SBC at 24% of revenue is going the wrong direction. And management quietly changed commission amortization from 4 to 5 years, adding $85-95M to non-GAAP op income — cosmetic.

Verdict: Hold/Accumulate on weakness. The leading indicator divergence is undeniable. Revenue re-acceleration to 25%+ is 2-3 quarters away. But at current prices, the risk/reward is balanced, not asymmetric.

The Numbers

Revenue — QoQ Grid (Years Across, Quarters Down)

Three consecutive quarters (Q2-Q4 FY26) where same-quarter QoQ exceeded the prior year. That's the recovery pattern. But note: FY26 Q3/Q4 QoQ (5.6%, 5.8%) is still below FY24 levels (7.4%, 7.5%). We've recovered past FY25's outage-depressed levels but not yet back to the pre-outage trajectory. This is the gap the market is watching.

Revenue — Sequential Adds ($M)

FY26 produced record sequential revenue adds in every quarter from Q2 onward. The incremental revenue story is accelerating even while the YoY percentage growth hasn't yet caught up. At $5.2B run-rate, each $65M sequential add is "only" 5% QoQ — but in dollar terms the engine is bigger than it's ever been.

Revenue — YoY Growth

Four consecutive quarters of YoY growth acceleration. The trajectory is clear. But we haven't yet crossed back through 25% — the threshold where the multiple gets comfortable.

Full P&L Summary (Last 8 Quarters)

Leading Indicators — Where the Alpha Lives

Net New ARR Trajectory (The Decisive Metric)

$330.7M in a single quarter. 1.01Bforthefullyear—firsttime>1B. This is the number that matters. Net new ARR is the leading indicator that converts to recognised subscription revenue over the next 4-8 quarters. At this run rate, revenue re-acceleration to 25%+ YoY is inevitable — it's arithmetic, not speculation.

Leading Indicator Divergence

This is one of the strongest leading indicator divergence profiles I've built. Net new ARR growing at 2x the revenue growth rate, with a record pipeline behind it. The prior learning on ARR/Revenue divergence (from AXON) applies directly: when this gap closes, revenue accelerates. The question is when, not if.

ARR and Falcon Flex

ARR at $5.25B growing 24% YoY — accelerated from 20% in Q2 FY26. Falcon Flex is the story within the story: 1.69BendingARR(+1201M average. The Reflex cycle (380+ accounts, 26% average ARR lift, 7-month average cycle, 100 multi-Reflex customers at 48% average lift) is creating a self-reinforcing expansion flywheel.

This is a commercial model innovation as much as a product one. Flex changes the conversation from "buy this module" to "how much security capacity do you need?" It's the AWS consumption model applied to cybersecurity. The fact that 32% of ARR is already on Flex, up from essentially zero two years ago, is remarkable.

Module Adoption

Half of subscription customers now use 6+ modules. Progress is incremental but consistent. The 8+ cohort at 24% represents the deepest platform commitments — these are customers that will never churn.

Retention

97% gross retention at $5.25B ARR scale is elite. Only a handful of software companies maintain this above $5B. NRR at 115% is adequate but not spectacular — it means the expansion engine works but isn't turbo-charging existing accounts the way a 130%+ NRR would. The Reflex mechanism should push NRR higher over FY27.

Balance Sheet & Cash Flow

Fortress balance sheet. $4.5B net cash. Total deferred revenue at $4.75B growing 27% YoY — faster than revenue (+23.3%). This is additional confirmation of the leading indicator story: revenue that's already contracted but not yet recognised is growing faster than the recognised line.

FCF conversion: FY26 FCF of $1.24B on $4.81B revenue = 25.8% FCF margin. Not expanding — FY25 was likely similar (~27%). The investment in Falcon platform, Charlotte AI, and acquisitions is absorbing the leverage. But 1.24Bofcashgenerationona 91B EV is a 1.4% FCF yield, which is thin.

Management Assessment

George Kurtz — Founder-CEO. Built CRWD from zero to $5.25B ARR. Handled the July 2024 outage with transparency and turned the customer remediation (CCP) into the Falcon Flex upsell mechanism. The outage that could have been existential became a commercial catalyst. That's elite leadership.

Tone on Q4 call: Confident, specific, and visionary. The AI security narrative is genuine — 1,800+ AI applications detected on endpoints, AIDR already the most in-demand product launch, and the Microsoft Azure consumption partnership announced same day as earnings. Kurtz is playing offense.

Concerns:

1. DOJ/SEC investigation. Bloomberg reported (Feb 2025) that DOJ and SEC are investigating a $32M IRS deal booked Q3 FY23 via Carahsoft where the IRS never purchased. "Other government transactions" being examined — scope expansion is the tail risk. Kurtz said on CNBC (June 2025): "We stand by the accounting." Defiant but unresolved. This touches ARR reporting methodology, not just a single deal. Low probability of material restatement, but the overhang is real.
2. Commission amortization change: 4-year to 5-year starting Q1 FY27. Adds $85-95M to non-GAAP op income. Partially offset by $74-80M acquisition integration expenses. I don't love accounting changes that flatter non-GAAP. Flag it.
3. SBC trajectory: FY26 SBC was $1.136B (23.6% of revenue), up from ~21.9% in FY25. Going the wrong direction. The GAAP/non-GAAP spread is $1.12B — GAAP net loss of $162.5M vs non-GAAP net income of $956.6M. That's an enormous gap driven almost entirely by SBC.

Competitive Position

Market share: 22.5% of dedicated endpoint protection (6sense). 1.6x the next vendor (SentinelOne at 10.7%). Microsoft Defender at 12.8% in the broader category via M365 bundling.

Gartner: EPP Customers' Choice for the 6th consecutive year. 4.7/5 from 800 reviews. 97% willingness to recommend. Only vendor to achieve this in every iteration since inception.

MITRE ATT&CK 2025: 100% detection AND 100% protection. Perfect score.

The SentinelOne AI question: Oppenheimer Feb 2026 channel checks rated SentinelOne's Purple AI as superior to Charlotte AI for autonomous SOC use cases. This is the most meaningful competitive signal. CRWD leads on platform breadth and data scale; S1 is closing the AI-specific gap. I wrote about this dynamic back in late 2022 — S1 was taking share from CRWD then too. The difference is CRWD's data moat (trillions of events/day from 6,340+ customers) and platform depth (28 modules vs S1's narrower stack). Platform wins long-term. AI point solutions don't. But monitor this.

Product momentum:

• Cloud/Identity/SIEM combined: $1.9B ending ARR (+45% YoY) — this is the growth engine
• NextGen SIEM: $585M+ ARR (+75% YoY) — the market disruptor
• Cloud: >$800M ARR (+35% YoY), 2nd consecutive Q acceleration
• Identity: $520M+ ARR (+34% YoY), PAS +170% QoQ
• AIDR: launched recently, already +5x QoQ — nascent but high-demand

Valuation

Context: At 18.3x run-rate P/S, CRWD trades at a premium to every large-cap cybersecurity peer (PANW ~13x, NET ~17x, S1 ~15x). The premium is justified only if revenue re-accelerates to 25-30%+ in FY27. The market is pricing recovery as expected but not guaranteed.

What's priced in: At this multiple, the market expects ~25% revenue growth with continued margin expansion. FY27 guidance of 22-23% is below what the multiple demands. Either: (a) management beats guide materially (as net new ARR trajectory suggests), validating the multiple, or (b) the stock drifts lower toward 14-15x where 22% growth is fairly priced.

My read: The stock is down 33% from highs. At ~$378, the recovery is partially priced. The margin of safety comes from the net new ARR divergence suggesting revenue acceleration to 25%+ — if that materialises in Q2-Q3 FY27, the stock re-rates to $450-500. If it doesn't, fair value is closer to $320-340 (14-15x run-rate P/S).

Note on Q4 seasonality: Q4 (Jan quarter) is CRWD's seasonally strongest for net new ARR and FCF (federal budget flush + calendar year-end enterprise renewals). Run-rate metrics using Q4 flatter the picture slightly. But the sequential revenue add trend (records in Q2, Q3, AND Q4) validates that the recovery is genuine, not just seasonal.

FY27 Guidance Analysis

The guidance is conservative. Management guides for 22-23% revenue growth while sitting on: (a) net new ARR that grew 47% in Q4, (b) a record Q1 pipeline +49% YoY, (c) Falcon Flex expanding at 120%+ YoY. This is the classic CrowdStrike sandbagging pattern. They did $1.01B net new ARR in FY26 against no explicit guide; now they're guiding $1.21-1.26B for FY27 when momentum is clearly higher.

Seasonality note: Management confirmed FY27 NNA seasonality unchanged at 41% H1 / 59% H2. Q1 FY27 guided at $249-251M net new ARR (+29-30% YoY). If they beat by the same magnitude as recent quarters, FY27 net new ARR could exceed $1.3B.

My implied revenue estimate: Given the net new ARR momentum and deferred revenue growth, I expect FY27 actual revenue to land at ~$6.0-6.1B (24-25% growth), beating the 22-23% guide by 1.5-2pp. This is where the alpha lies.

Alpha Checklist

• Temporary headwind masking acceleration? Yes — the July 2024 outage depressed net new ARR for 4-5 quarters. The headwind is now fully behind.
• 2+ leading indicators diverging for 2+ quarters? Yes — net new ARR (+47%), pipeline (+49%), Falcon Flex (+120%), deferred revenue (+27%) all growing faster than revenue (+23.3%).
• High-growth sub-segment gaining share? Yes — Cloud/Identity/SIEM at $1.9B ARR (+45% YoY) is 36% of total ARR and growing 2x the overall rate. SIEM alone at +75% YoY.
• Can I calculate implied revenue exceeding guidance? Yes — $6.0-6.1B vs guide of $5.87-5.93B.
• Management tone confident and specific? Yes — Kurtz was visionary on AI security, specific on metrics, and the Azure partnership announcement was a power move.

5/5 boxes checked. In my framework, this should be a high-conviction position. The only reason it isn't is valuation — at 18x P/S, the risk/reward for a NEW position is not asymmetric enough. For an existing position, this is a strong hold.

Key Risks

1. DOJ/SEC investigation scope expansion. If ARR reporting methodology issues are found beyond the $32M Carahsoft deal, the entire ARR-based valuation framework is compromised. Restatement and federal debarment are tail scenarios. This is the single biggest binary risk.
2. Revenue re-acceleration fails to materialise. If FY27 comes in at 22% (not 25%+), the 18x P/S compresses to 14-15x — a 20%+ drawdown.
3. SBC and GAAP profitability gap widens. SBC at 24% of revenue trending up. Institutional buyers increasingly penalise large SBC gaps. GAAP net loss of $163M in FY26 vs non-GAAP income of $957M is a $1.12B spread. At some point this matters.
4. SentinelOne AI competition. Purple AI rated superior in autonomous SOC channel checks. If S1 sustains this and converts mid-market wins into enterprise, CRWD's growth vectors face headwinds.
5. Falcon Flex opacity. Management-defined metric, not independently auditable. At 32% of total ARR, the commercial structure creates concentration risk if renegotiated.

Key Catalysts

1. Q1 FY27 earnings (~June 2026). First data point against FY27 guide. If net new ARR exceeds $260M and revenue beats $1.37B, the re-acceleration narrative crystallises.
2. DOJ/SEC resolution. Clean bill removes governance discount. No timeline known.
3. Revenue growth crossing 25% YoY. This is the psychological/institutional threshold. Most likely Q2-Q3 FY27 based on net new ARR trajectory.
4. Falcon Flex crossing $2B ARR. Validates commercial model transformation. Likely Q2-Q3 FY27.
5. Charlotte AI monetisation disclosure. Standalone ARR or usage metrics create a new narrative and expand the multiple.

Where Atlas and I Diverge

Atlas gave CRWD a 3/5 conviction, Hold existing, Add on FY27 guidance confirmation at 25%+. Atlas's analysis was based on Q3 FY26 data (pre-Q4 earnings).

Where I agree: The leading indicator divergence thesis is the core of the bull case. The DOJ/SEC risk is the primary headwind. Valuation is rich.

Where I add nuance:

1. Q4 FY26 data resolves Atlas's primary question. Atlas said FY27 guidance was the "decisive pricing event." We now have it: 22-23% revenue growth guide with 1.21 − 1.26BnetnewARR.It^′sconservative, notunderwhelming.Thestocktradedto 378 (down from ~$380-400 post-earnings range), suggesting the market wanted slightly better.
2. Net new ARR at $331M (+47%) exceeded Atlas's $265M Q3 expectation trajectory. The inflection is stronger than Atlas projected 4 weeks ago.
3. I weight the SBC issue more heavily. 24% SBC/Revenue is a structural headwind for the GAAP profitability story. Atlas mentioned it but didn't flag the trend direction.
4. I weight the commission amortization change. A 4-to-5 year change adding $85-95M to non-GAAP is not trivial. It makes FY27 non-GAAP margins look better than they organically are.

My conviction: 3.5/5. Half a point above Atlas because Q4 data resolved the biggest uncertainty (net new ARR trajectory). But the valuation keeps me from going to 4/5.

Position Recommendation

Hold existing. Accumulate below $340 (15x run-rate P/S). The thesis is intact and strengthening. Leading indicators are the strongest they've been in two years. Revenue re-acceleration to 25%+ is 2-3 quarters away. But at $378 (18.3x run-rate P/S), the stock needs to demonstrate that re-acceleration, not just signal it, for the multiple to expand.

If the DOJ/SEC investigation resolves cleanly AND Q1 FY27 beats materially → add aggressively. Those two catalysts de-risk the two biggest headwinds simultaneously.

I haven't owned CRWD since late 2022 when I shifted to S1 for the acceleration story. The company today is fundamentally different — larger, more profitable, and executing a platform consolidation strategy that few in cybersecurity can match. This is a company I want to own again, but I need the price to come to me or the revenue line to catch up to the leading indicators.

-wsm

(No position in CRWD. Monitoring for entry below $340 or on revenue re-acceleration confirmation.)