tapebrief
CRWD · Q2 2026
Preliminary brief— based on press release only. Full analysis including management tone and Q&A will be added when the transcript is available.

CRWD · Q1 2026 Earnings

CrowdStrike

Reported June 3, 2025

30-second summary

Revenue grew 20% YoY to $1.10B and ARR reached $4.44B (+22% YoY) with net new ARR of $193.8M, the first print free of material outage-related drag. Management is leaning hard into Falcon Flex — $3.2B in deal value, 39 customers already "reflexing" within five months — and raised the FY27 operating-margin target to "at least 24%" and FCF margin to ">30%". The catch: a deliberate $10–15M/quarter wedge between ARR and recognized subscription revenue from CCP amortization will mute reported growth even as the underlying business reaccelerates.

Headline numbers

EPS

Q1 FY2026

$0.73

Revenue

Q1 FY2026

$1.10B

+20.0% YoY

Gross margin

Q1 FY2026

78.0%

Free cash flow

Q1 FY2026

$0.28B

Operating margin

Q1 FY2026

18.0%

Key financials

Q1 FY2026
MetricQ1 FY2026YoY
Revenue$1.10B+20.0%
EPS$0.73—
Gross margin78.0%—
Operating margin18.0%—
Free cash flow$0.28B—

Guidance

Prior quarter data unavailable — comparison not possible.

Segment performance

Q1 FY2026
SegmentQ1 FY2026YoY
Subscription Revenue$1.051B+20.0%
Professional Services Revenue$0.053B+7.8%

Platform metrics

Q1 FY2026
SegmentQ1 FY2026
Annual Recurring Revenue (ARR)$4.44 billion
Net New ARR$193.8 million
ARR Growth YoY22%
Dollar-Based Gross Retention Rate97%
Module Adoption (6+ modules)48%
Module Adoption (7+ modules)32%
Module Adoption (8+ modules)22%
Falcon Flex Deal Value$3.2 billion

Management tone

This is Tapebrief's first quarter of coverage, so the multi-quarter arc will build from here — but the within-quarter shift is unmistakable: management is no longer in damage-control mode. The July 19 outage gets one paragraph; the rest of the call is offensive.

Falcon Flex has been re-cast from packaging tactic to demand-planning operating model. Where consolidation pitches historically went module-by-module, management now describes a different motion entirely: "we're not selling module by module, but we're selling outcomes and we're doing demand planning with our customers." The 39 customers who have already "reflexed" — drawn down their Flex commitment and signed an expanded one within five months — are being held up as proof that years of module sales cycles compress into quarters. If this holds, it changes the unit economics narrative on this stock.

AI has shifted from internal efficiency story to TAM-expanding attack-surface narrative. Prior framings centered on Charlotte AI improving SOC analyst productivity. This quarter's framing: "CrowdStrike will be the protector of autonomous AI agents." Management cited a survey statistic of 96% of respondents planning to expand AI agent use in the next 12 months and a target of "1 billion agents in production." Whether or not the number lands, the rhetorical shift is what matters — agents as priced endpoints would meaningfully reset TAM math.

Next-gen SIEM is being positioned as generational displacement, not feature competition. The phrase used was "disrupting the proverbial horse and buggy with the combustion engine" — paired with disclosed triple-digit ending ARR growth in the product. Splunk and QRadar are now named explicitly. This is more confrontational than the typical CRWD SIEM commentary.

CEO confidence is at a stated high. "I'm more certain than I have ever been of CrowdStrike's place as the world's leading cybersecurity platform for the AI era" — language that, paired with the $1B buyback authorization and the raised FY27 margin targets, signals management views the post-outage chapter as closed.

One notable hedge that didn't make the headlines: the DOJ and SEC requests for information regarding revenue recognition, ARR reporting, and the July 19 outage remain open. Management mentioned them in risk-factor framing only. This is the biggest live overhang on an otherwise clean print.

Recurring themes management leaned on this quarter:

Falcon Flex reflexes accelerating platform adoption faster than anticipated (39 customers reflexing within 5 months)AI agents as new attack surface expanding TAM (1 billion agents in production targeted by enterprises)Next-gen SIEM as generational displacement of legacy incumbents (Splunk, QRadar)Platform consolidation at scale across 30 modules with 48% of customers on 6+ modulesMSSP channel acceleration (15% of Q1 deal value, up from mid-single digits 2 years prior)Margin expansion and FCF outperformance ($1B share buyback authorization signaling confidence)

Risks management surfaced:

DOJ and SEC requests for information relating to revenue recognition, ARR reporting, July 19th outageTemporary near-term divergence between ARR and subscription revenue recognition impacting modeling clarityIntegration and execution risks from strategic realignment announced in early MayMacro uncertainty ('world navigates evolving condition') though management downplays directional impactAI agent protection requires unproven new product categories and competitive differentiation

What to watch into next quarter

Net new ARR sequential step from Q1 to Q2. Management guided to "at least double" the prior-year Q1→Q2 sequential growth rate. Anything less than that breaks the reacceleration narrative.

The ARR-to-revenue wedge. Confirm the $10–15M/quarter CCP amortization drag lands inside that range; a larger wedge would compress reported subscription growth below the 19% Q2 guide.

Falcon Flex "reflex" cohort. 39 customers reflexed within 5 months of signing — watch whether this cohort expands meaningfully in Q2 and whether the time-to-reflex compresses further. This is the single best leading indicator of platform stickiness.

Next-gen SIEM disclosure. Management cited triple-digit ending ARR growth without a base number. Watch for a disclosed dollar figure — its absence has been a persistent ask from buyside.

DOJ/SEC inquiry status. Any movement (subpoena, settlement, closure) on the revenue recognition / ARR / July 19 inquiry materially changes the risk profile.

Operating margin trajectory toward the 24% FY27 target. Q2 operating income guide ($227–233M on $1.145–1.152B revenue) implies ~20% — the ramp must accelerate in the back half to hit FY27.

Sources

  1. CrowdStrike Q1 FY2026 press release, June 3, 2025 — https://www.sec.gov/Archives/edgar/data/1535527/000153552725000017/crwd-20250603xex991.htm
  2. CrowdStrike Q1 FY2026 earnings call prepared remarks (transcript excerpts as provided in extraction inputs)

Get the next brief, free.

We publish analyst-grade earnings briefs the same day or morning after every call — headline numbers, segment KPIs, Q&A highlights, and tone analysis. Free during beta.

This is not investment advice.