CrowdStrike ARR Hits $5.84B as Falcon Flex Licensing Doubles

A record quarter built on how software is sold

CrowdStrike's latest results are mostly a story about pricing and packaging, more than about threat detection. In the second quarter of fiscal 2027, which ended July 31, 2026, the company's annual recurring revenue (ARR) grew 25% from a year earlier to $5.84 billion. It added $332.8 million of net new ARR in the quarter.16 That net new figure was 51% higher than a year earlier, and the company says it beat the top of its own guidance by more than $45 million.11 Total revenue rose 26% to $1.47 billion, and subscription revenue rose 27% to $1.40 billion.4

Investors liked it. Shares climbed more than 10% in after-hours trading on August 26, the day of the report.13 One later analysis described a gain of nearly 20% after earnings.4 Revenue beat the LSEG consensus of $1.44 billion. Adjusted earnings came in at 31 cents a share, two cents above estimates.13

The more important figure for software buyers is a different one. ARR from accounts on Falcon Flex, CrowdStrike's flexible licensing model, passed $2.29 billion, up 101% year over year.16 That is close to 40% of the company's total ARR. In other words, the way customers license CrowdStrike's software is now a major source of its growth.

What Falcon Flex changes for customers

Under the traditional model, a customer buys a fixed set of security modules. Flex instead lets customers draw from a pool of CrowdStrike products and move spending between them as their needs change.6 Coverage describes it as a modular, consumption-based model that lets companies pick specific parts of the Falcon product line rather than buy one large bundle. One analysis argues this lowers the customer's upfront financial commitment while giving CrowdStrike more room to grow revenue over time.1

CrowdStrike says that second point is what sets Flex apart. On an earlier earnings call, CEO George Kurtz called Flex "an unlock, not an ELA," meaning not an enterprise license agreement. Management contrasted the two directly: with an ELA, the vendor collects most of the deal's value up front, while Flex customers keep increasing what they spend.7 CFO Burt Podbere described Flex as a way to make buying easier and deployment faster while lowering customers' total cost of ownership. He added that it brings CrowdStrike bigger and longer deals.7

The second-quarter numbers show how this works. CrowdStrike added 935 Flex accounts in the quarter, which works out to more than ten a day. Customers who moved from standard subscriptions to Flex ended up with ARR about 40% higher on average.11 When a Flex customer finishes its first "re-Flex," or renewal, ARR rises by another 25% on average from the new baseline.11 Last quarter, CrowdStrike reported more than 1,900 Flex accounts and 480 re-Flexed customers, also with a 26% average uplift.3

The cost question

CrowdStrike says Flex lowers total cost of ownership, but its own figures show converting customers paying about 40% more in ARR. Both claims can hold, though they depend on different assumptions.

The company's argument is that customers spend more with CrowdStrike but drop other vendors, so their total security budget goes further. Management has pointed to deals where Flex customers replaced competing products. In one eight-figure healthcare expansion, a customer removed two SIEM systems (tools that collect and analyze security logs), Microsoft's Defender for Endpoint, and a standalone cloud security product.7 If that pattern is common, a bigger CrowdStrike bill can still mean lower total spending, because licenses from other vendors go away.

The cautious view is that Flex makes adding modules so easy that spending grows more through convenience than through deliberate choices. Module adoption supports that reading. Among subscription customers, 51% now use six or more modules, 35% use seven or more, and 26% use eight or more.11 One analysis lists the steps of the Flex cycle and notes that each added module raises switching costs.3 Customers get one vendor and simpler buying. CrowdStrike gets customers who are harder to lose.

In our view, both effects are real, and the second matters more for CrowdStrike's long-term economics. Dropping other vendors is a one-time saving. Deeper dependence on Falcon lasts. Buyers should go into Flex negotiations knowing that the model is designed to increase their spending over time, as management has openly said.7

Why demand jumped: the "Mythos moment"

CrowdStrike explains this quarter's sharp acceleration with what Kurtz called the "Mythos moment." He said it marked broad acceptance that companies adopting AI need to secure it.16 In other coverage, the quarter followed disclosures from Meta, Anthropic and OpenAI that advanced AI models had shown they could exploit vulnerabilities or break into systems in security testing.13 On the call, Podbere said customer urgency first appeared in the first quarter and turned into faster modernization projects and higher security spending in the second.11

The company's newest AI products are growing quickly from a small base. ARR for AI detection and response (AIDR) nearly tripled from the first quarter, including an eight-figure Flex deal with one of the world's largest banks.11 Investors cannot easily weigh these products on their own, because CrowdStrike does not disclose their absolute ARR.3 For now, the clearest sign of their value is how they push customers into larger Flex commitments.

Growth also reached well beyond endpoint protection, CrowdStrike's original business. Next-gen SIEM ARR passed $695 million, and identity ARR grew 34% to more than $585 million.11 Morningstar calculates that cloud, identity and security operations together grew 39% and now make up 37% of total ARR.18

Where the coverage agrees and where it splits

The operating results are not in dispute. Every outlet reports the same headline figures: $5.84 billion in ARR, $1.47 billion in revenue, and free cash flow of about $377 million, a 26% margin.415 Most also note that management raised its full-year net new ARR growth forecast by 630 basis points, to 34% at the midpoint.16 Podbere told investors that cloud optimization helped push subscription gross margin to 81% on an adjusted basis.2

The disagreement is over valuation, and it is large. One analysis puts CrowdStrike's market value at about $264 billion, or roughly 45 times ARR, based on the October 23 close.12 Morningstar estimates enterprise value at about 35 times expected fiscal 2027 sales. By comparison, the median for its wider cybersecurity coverage is about 10 times sales. Morningstar's conclusion is that the stock is priced for perfection.18 Another estimate puts the shares near 190 times forward earnings and about 41 times forward revenue, while Salesforce trades at under 5 times forward revenue.15

Profit under standard accounting rules (GAAP) is also small. GAAP net income attributable to CrowdStrike was only $5.3 million in the quarter.12 The company posted a GAAP operating loss of $33.2 million while reporting $371.6 million of adjusted operating income.4 Over the twelve months ending July 31, the GAAP operating loss was about 2.5% of revenue, compared with an 18.5% operating margin for the S&P 500.10

The stock has also run far ahead. It rose about 154% in the six months after the "Mythos moment" began.17 It closed at $266 on October 28, above the $247 average analyst price target. That same week, reports said Kurtz had sold about $35 million of stock.15 Bulls have their own catalysts. At the company's Fal.Con conference, Podbere moved the $10 billion ARR target up to fiscal 2030 and the $20 billion target up to fiscal 2035.17 Separately, the closing of a Justice Department probe removed a regulatory concern.20

The next test

CrowdStrike's own guidance shows growth slowing. For the third quarter it expects $343 million to $347 million of net new ARR. That is more in dollars than the second quarter, but only 29% to 31% growth from a year earlier, compared with 51% last quarter.10 Full-year guidance calls for ending ARR of $6.603 billion to $6.612 billion and revenue of $5.991 billion to $6.011 billion.16

CrowdStrike reports third-quarter results after the market closes on December 1. Analysts expect 31 cents a share on revenue of $1.51 billion.12 Many expect slower growth, given the lower guidance. Our view is that two Flex figures matter more than the headline numbers: whether new-account additions stay close to the second quarter's pace, and whether the conversion and re-Flex uplifts hold up. If customers keep accepting 40% higher bills on conversion, CrowdStrike's pricing power holds. If buyers start pushing back on what consolidation actually saves them, a valuation that already assumes years of strong growth would be exposed.