CrowdStrike Fiscal Q2 2027 Earnings: Net New ARR Accelerates as AI Security Demand Lifts Guidance

CrowdStrike delivered an unusually strong fiscal second quarter, with record $333M net new ARR, 26% revenue growth, expanding margins, and a second increase to its full-year outlook. The most consequential development was not the quarterly revenue beat alone, but the acceleration in recurring-revenue additions and management’s assertion that AI-related security demand is broadening adoption across endpoint, identity, SIEM, cloud, and exposure-management products.

The investment case is increasingly centered on whether CrowdStrike can convert AI-security urgency into sustained platform expansion rather than a short-lived spending cycle. Q2 results and the raised FY2027 net new ARR forecast support that thesis, although much of the AI opportunity remains framed through management commentary rather than disclosed product-level revenue.

As Reported on the Call

The Bigger Story

CrowdStrike’s quarter indicates that its recovery in net new ARR growth is continuing rather than fading after the initial demand uplift management described last quarter as the “Mythos moment.” Net new ARR rose 51% year over year to $333M, exceeding the high end of management’s guidance by more than $45M, while ending ARR growth accelerated for a fourth straight quarter.

Management attributes the demand environment to enterprises moving more AI applications and agents into production while facing greater concerns around identity, data protection, compliance, and AI-related attack surfaces. That framing needs to be viewed as management’s assessment, but the underlying commercial data were stronger: new-logo ARR was a record, net and gross dollar-based retention improved sequentially, and the company exited the quarter with a record Q3 pipeline.

Falcon Flex was central to the growth story. The consumption-oriented subscription model reached more than $2.29B in ending ARR, up 101% year over year. CrowdStrike added more than 935 Flex accounts in Q2, exceeding the total additions of the prior three quarters combined. The company also said its 10 largest deals by value were all Flex transactions.

The key economic advantage of Flex is that it appears to support broader platform adoption. Management said customers converting from standard subscriptions to Flex generated an average ending ARR uplift of more than 40%. Customers completing a first “re-Flex” expansion generated an additional average uplift of 25%, while customers that had re-Flexed at least twice had ending ARR 53% above their initial Flex level.

Revenue and Operating Performance

Revenue reached $1.47B, up 26% year over year, with subscription revenue of $1.4B growing 27%. Professional services revenue was a record $71M, which management linked partly to demand for AI-readiness and incident-response work. The services contribution may also create cross-sell opportunities for software products, although CrowdStrike did not quantify that conversion.

International revenue growth accelerated for a fifth straight quarter. Revenue mix was approximately 65% U.S. and 35% international, indicating that the growth acceleration was not confined to the domestic business.

The platform strategy remains the primary operating driver. CrowdStrike reported that 51% of subscription customers used seven or more modules, while 35% used eight or more and 26% used nine or more. Those adoption rates matter because the company’s largest growth opportunities increasingly sit beyond its core endpoint-security product.

Management reported record net new ARR from the combined cloud, identity, and next-generation SIEM businesses. Next-gen SIEM exceeded $695M in ending ARR, while identity ARR surpassed $585M and grew 34% year over year. The company said its newer AI detection and response, or AIDR, offering nearly tripled ending ARR from Q1, though it did not disclose the product’s absolute ARR base.

AIDR appears to be additive rather than a replacement for endpoint security. Management said it is a separately priced module that customers can activate using the existing Falcon agent, which reduces deployment friction. The product includes token-based pricing, with customers receiving an initial allotment and buying additional token packs if usage exceeds contracted levels.

Cloud ARR was reported at $105M, up more than 29% year over year. However, during the Q&A, the CFO referred to cloud ARR as “over $905 million,” a figure inconsistent with the $105M disclosed in prepared remarks. Investors should rely on the explicitly stated $105M figure until CrowdStrike clarifies the discrepancy.

Profitability and Margins

CrowdStrike paired faster growth with meaningful operating leverage. Non-GAAP operating income increased 46% year over year to $372M, and the non-GAAP operating margin expanded 350 basis points to 25%.

Non-GAAP gross margin rose 110 basis points to 79%, while subscription gross margin increased 90 basis points to 81%. Management attributed the improvement to cloud optimization and reiterated its FY2029 target of 82% to 85% non-GAAP subscription gross margin.

The company generated $5M of GAAP net income, marking its third consecutive quarter of GAAP profitability. That result remains materially below non-GAAP net income of $323M, or $0.31 per diluted share, underscoring the continuing significance of stock-based compensation and other excluded items in the company’s adjusted profitability presentation.

Free cash flow was particularly strong at $377M, equal to 26% of revenue and up 33% year over year. Management cited stronger operating performance and efficiency gains from internal automation and AI initiatives.

Demand, Customers and Pricing

The demand narrative was broad-based across customer sizes, geographies, and product categories. Management said new-logo net new ARR reached an all-time high, while retention metrics improved from Q1. The company also disclosed that its Q3 pipeline was at a record level.

AI-security demand is creating both a product opportunity and a platform-consolidation opportunity. Management said customers are adopting CrowdStrike to govern AI use, monitor AI agents, protect identities and data, secure runtime environments, and prioritize vulnerabilities that could be exploited before patches can be deployed.

Next-gen SIEM remains one of the clearest examples of the platform advantage. Management said every CrowdStrike customer is technically enabled for the product because CrowdStrike’s first-party endpoint data already resides in the platform; customers only need to activate the relevant license. The company said customers are also adding more third-party data sources as AI, cloud, identity, and SaaS environments become more interconnected.

Partner activity also expanded. CrowdStrike said its Project Quiltworks ecosystem includes more than 25 partners and is associated with nearly $400M of total contract value pipeline. Its global systems integrator business grew nearly 50% year over year, with activity focused on SIEM modernization and vulnerability-management needs. Cloud marketplace transaction value reached $600M in Q2, up more than 30% year over year.

What is CrowdStrike’s guidance and outlook?

Management raised its FY2027 outlook again, reflecting both Q2 outperformance and confidence in the pipeline.

For Q3, CrowdStrike expects:

• ·ARR of $6.184B to $6.188B, up 26% year over year.
• ·Net new ARR of $343M to $347M, up 29% to 31%.
• ·Revenue of $1.523B to $1.529B, up 23% to 24%.
• ·Non-GAAP operating income of $373M to $376M.
• ·Non-GAAP EPS of about $0.31.

For FY2027, management now expects:

• ·ARR of $6.603B to $6.612B, up 26%.
• ·Net new ARR of $1.350B to $1.359B, up 34%.
• ·Revenue of $5.991B to $6.011B, up 25%.
• ·Non-GAAP operating income of $1.497B to $1.508B.
• ·Non-GAAP EPS of $1.25 to $1.26.

The midpoint of the full-year net new ARR outlook increased by approximately $116M from CrowdStrike’s initial FY2027 guide. Management expects free cash flow margin of 27.5% in Q3 and at least 30% for the full year, despite the higher revenue outlook.

CrowdStrike also expects its acquisition of XM Cyber’s technology assets to close in the second half of FY2027. Management explicitly said the transaction is not expected to contribute ARR or revenue in FY2027 and is excluded from current guidance.

Balance Sheet, Cash Flow and Capital

CrowdStrike ended the quarter with $5.01B in cash and cash equivalents. Operating cash flow was $530M and free cash flow was $377M, providing substantial internally generated liquidity.

Based on the disclosed cash generation and cash balance, near-term external financing does not appear to be a central issue in management’s current narrative.

What Investors Should Watch

1. Net New ARR Growth Beyond Q3

The FY2027 net new ARR outlook now implies 34% growth at the midpoint. Investors should monitor whether Q3 net new ARR reaches the guided $343M to $347M range and whether the record pipeline converts at expected rates.

2. Falcon Flex Expansion and Re-Flex Activity

Flex has become a major vehicle for platform consolidation and customer expansion. Continued additions, conversion uplift from standard contracts, and repeat re-Flex activity will indicate whether the model is producing durable multi-product growth rather than simply changing contract structure.

3. AIDR Monetization

Management said AIDR ending ARR nearly tripled sequentially and that the module is separately priced. The next proof point is whether CrowdStrike begins disclosing more detail on its ARR scale, adoption rates, token consumption, and contribution to net new ARR.

4. Margin Durability

Non-GAAP operating margin reached 25% while revenue growth accelerated. Sustained gross-margin gains from cloud optimization and continued operating leverage would reinforce the case that CrowdStrike can fund product expansion without sacrificing profitability.

5. Product-Level Execution in SIEM, Identity and Cloud

Next-gen SIEM and identity have reached meaningful ARR scale, while cloud remains smaller based on the prepared remarks. Investors should watch for consistent product disclosures, including clarification of the cloud ARR discrepancy, and evidence that these products continue to contribute materially to incremental ARR.

AlgovestIQ Takeaway

CrowdStrike’s Q2 was stronger than a typical beat-and-raise quarter because the acceleration appeared across several key indicators: net new ARR, ending ARR, revenue growth, free cash flow, operating margin, new-logo activity, retention, and Flex adoption. The company also raised full-year net new ARR guidance sharply, suggesting management sees its pipeline strength as extending beyond one quarter.

The biggest improvement in the investment story is the apparent broadening of the platform’s growth engine. CrowdStrike is no longer presenting endpoint protection as the sole driver. SIEM, identity, AI detection and response, exposure management, partner-led deployments, and Flex-based expansion are all being positioned as contributors to a larger platform opportunity.

Still, the AI-security narrative requires further evidence. Management’s descriptions of agentic threats, AI-governance demand, and AIDR’s potential are strategically plausible, but disclosed product-level financial data remain limited. AIDR nearly tripling from Q1 is notable, yet investors do not know the product’s absolute ARR base or how much of Q2’s $333M net new ARR it represented.

The central investment question is whether CrowdStrike can sustain elevated net new ARR growth while maintaining the margin expansion demonstrated this quarter. Continued Flex expansion, durable new-logo growth, and measurable contribution from newer products would strengthen that case. A slowdown in pipeline conversion, weaker retention, or evidence that AI-security demand is concentrated in a narrow set of early adopters would weaken it.