CrowdStrike Says AI Agents Are Now the Adversary, and Enterprises Are Paying Up to Fight Back
Fiscal Q2 2027 earnings call, August 26, 2026
CrowdStrike delivered what CEO George Kurtz called the best quarter in company history, and the numbers back up the rhetoric. Net new annual recurring revenue hit an all-time record of $333 million, accelerating to 51% year-over-year growth and beating the high end of guidance by more than $45 million. Ending ARR reached $5.84 billion, up over 25%, marking the fourth straight quarter of accelerating growth. Total revenue of $1.47 billion grew 26%, the fifth consecutive quarter of acceleration. The company raised its fiscal 2027 net new ARR growth outlook by 630 basis points to roughly 34% at the midpoint, a cumulative 1,150 basis-point increase versus its initial guidance from earlier in the year, equivalent to over $100 million of added ARR guidance since January.
The Mythos Narrative Gets Its Proof Point
Investors have heard CrowdStrike talk about the "Mythos moment" since the spring, its term for the inflection point where cybersecurity became a prerequisite for AI adoption. This quarter is where management says the thesis converted into hard numbers. Kurtz described the current environment bluntly: "We're seeing agents go rogue, swarming to attack and moving beyond their guardrails to autonomously harm. Agents are proving capable of data theft, permission alteration and full-on command and control at scale, leading to organizational compromise." He added that "the agent of today is both a friend and foe," a framing the company is using to justify a new wave of security spending independent of traditional endpoint budgets.
Management was explicit that this isn't a one-quarter phenomenon. Kurtz argued the AIDR (AI detection and response) product could eventually surpass the core EDR business in size, citing an estimate that each employee will eventually operate roughly 90 AI agents. CFO Burt Podbere reinforced the durability argument with pipeline data, noting the company exited the quarter with a record Q3 pipeline that directly informed the aggressive guidance raise.
AIDR Tripled Sequentially and Comes With Its Own Pricing Model
The standout new disclosure was the trajectory of AIDR, CrowdStrike's AI detection and response product, which nearly tripled its ending ARR versus Q1. In response to analyst questions about whether AIDR cannibalizes core EDR revenue, Kurtz clarified it is sold as a separate, incrementally priced module running on the same agent, which he framed as the source of its momentum: "It is separate and incremental. It's another module and it's priced separately, which is, again, where we're seeing a lot of the growth." Notably, CrowdStrike disclosed that AIDR already uses token-based pricing, with customers receiving a baseline token allotment scaled to their environment and the ability to purchase additional token packs if they exceed it, all consumable through the Falcon Flex licensing structure. This is a meaningful data point for investors trying to model how usage-based pricing might penetrate the cybersecurity software model more broadly.
Falcon Flex Is Now the Default Motion, Not an Option
Falcon Flex, the company's consumption-based licensing model, crossed $2.29 billion in ending ARR, accelerating to 101% year-over-year growth. More telling for the sales motion shift: all of the company's top 10 deals by value this quarter were structured as Flex agreements, and new customers are being brought on with Flex-first contracts rather than migrated later. Flex new logo ARR represented 34% of net new ARR in the quarter, a record. Customers converting from standard subscriptions to Flex saw an average ending ARR uplift greater than 40%, and existing Flex customers who expanded again, so-called "Re-Flex" activity, grew 6-fold year-over-year, with repeat expansions averaging a 53% ARR uplift versus their original contract. Podbere noted this Flex-driven bundling is now the primary vehicle pulling multiple product lines into single, larger, longer-duration deals.
Next-Gen SIEM, Identity and Exposure Management Are Quietly Becoming Billion-Dollar Franchises
Beyond the AI-native products, CrowdStrike's legacy adjacent businesses are compounding at rates that stand out even in a strong security spending environment. Next-gen SIEM ending ARR surpassed $695 million, growing 60% year-over-year, with management describing it as fast becoming "the operating system of the SOC" due to its native first-party data advantage over competitors that require separate data ingestion. Identity ending ARR grew 34% to more than $585 million, with Falcon Shield, aimed at securing third-party agentic applications, up over 185% year-over-year, and the privileged account security product growing more than 35-fold, albeit off a small base. Cloud security ending ARR exceeded $905 million, up 29%, driven by demand for runtime protection of AI workloads rather than static posture scans. Exposure management, the vulnerability prioritization business tracing back to Kurtz's Foundstone roots, accelerated sequentially as Kurtz argued that AI-driven exploit speed has broken what he called "the exploit sound barrier," making legacy patch-and-scan vulnerability tools obsolete.
Endpoint, Still the Foundation, Is Reaccelerating Rather Than Maturing
Skeptics have long treated CrowdStrike's core endpoint detection business as a mature, low-growth base supporting newer product lines. Management pushed back on that framing this quarter, noting endpoint revenue accelerated for a fourth consecutive quarter. Kurtz pointed to still-large legacy displacement opportunity, noting roughly half the market remains on legacy antivirus products incapable of detecting rogue AI agents or shadow AI activity on the endpoint. The company disclosed specific usage metrics to back the AI angle: sampling its customer base showed more than 400% growth in Claude usage and over 100% growth in custom agentic application usage on monitored endpoints in recent months, underscoring why endpoint remains the entry point for the broader AI security suite rather than a legacy afterthought.
Partner Ecosystem Momentum and the XM Cyber Deal
CrowdStrike's Project QuiltWorks partner initiative, which spans over 25 partners including global systems integrators, hyperscalers, resellers and MSPs, is now associated with nearly $400 million of total contract value pipeline. GSI-driven revenue grew almost 50% year-over-year, concentrated in SIEM transformation and vulnerability management deals. Marketplace transactions through AWS, Google and Microsoft hit $600 million in deal value in the quarter, up more than 30% year-over-year, with Microsoft marketplace specifically called out as a newly opened addressable channel. On the corporate development side, management confirmed the XM Cyber technology asset acquisition is expected to close in the second half of fiscal 2027, but explicitly excluded any ARR or revenue contribution from the deal in current guidance, a conservative disclosure investors should note when assessing the quality of the raised outlook.
Margins and Cash Flow Are Expanding Alongside Growth, Not at Its Expense
The acceleration story didn't come at the cost of profitability. Non-GAAP operating income hit a record $372 million, or 25% of revenue, up 46% year-over-year, with operating margin expanding 350 basis points. Free cash flow reached a record $377 million, or 26% of revenue, ahead of the company's own 24.5% margin expectation, and management guided to at least 30% free cash flow margin for the full fiscal year. Subscription gross margin rose to 81%, moving toward the company's fiscal 2029 target range of 82% to 85%. GAAP net income was positive for a third straight quarter, a modest but notable proof point as CrowdStrike works to demonstrate durable GAAP profitability rather than relying solely on non-GAAP adjustments.
For fiscal 2027, CrowdStrike now guides to ARR of $6.603 billion to $6.612 billion, net new ARR of $1.350 billion to $1.359 billion, and total revenue of $5.99 billion to $6.011 billion, up 25% year-over-year at the midpoint. Non-GAAP earnings per share is guided to $1.25 to $1.26 for the year on a split-adjusted basis, following the company's recent 4-for-1 stock split. Management pointed to next week's Falcon Conference, which sold out in early August, as the venue where further AI security product announcements are expected, alongside an investor briefing scheduled for September 2.