CRWD · Q4 2026 Earnings

Bullish

CrowdStrike

Reported March 3, 2026

30-second summary

Revenue grew 23.3% YoY to $1.305B and Q4 net new ARR landed at a record $330.7M, +47% YoY — combined with Q3 contribution, H2 net new ARR cleared the raised ≥50% YoY commitment. Management opened FY27 with an ARR guide of $6.466–$6.516B (+23% YoY) and a Falcon Flex ARR figure of $1.69B (+120% YoY vs the $1.35B disclosed last quarter), framing AI as both the threat driving demand and the structural moat against frontier-model commoditization. The print extends a four-quarter arc from outage recovery to platform reacceleration to — now — a generational AI-infrastructure positioning underwritten by hard numbers.

Headline numbers

EPS

Q4 FY2026

$1.12

+1.8% vs est.

Revenue

Q4 FY2026

$1.30B

+23.3% YoY

+0.4% vs est.

Gross margin

Q4 FY2026

75.8%

Free cash flow

Q4 FY2026

$0.38B

Operating margin

Q4 FY2026

-0.5%

Key financials

Q4 FY2026

Metric	Q4 FY2026	YoY	Q3 FY2026	QoQ
Revenue	$1.30B	+23.3%	$1.23B	+5.8%
EPS	$1.12	—	$0.96	+16.7%
Gross margin	75.8%	—	75.0%	+80bps
Operating margin	-0.5%	—	-5.6%	+510bps
Free cash flow	$0.38B	—	$0.30B	+27.0%

Guidance

Guidance is issued for both next quarter and the full year. Both may appear below.

Actuals vs prior guidance

Metric	Period	Prior guide	Actual	Δ	Result
Revenue	Q4 FY2026	$1,290.0 - $1,300.0 million	$1,305.0 million	+$5.0M above guide	Beat
Non-GAAP EPS	Q4 FY2026	$1.09 - $1.11	$1.12	+$0.01 above guide	Beat
Revenue	FY2026	$4,796.6 - $4,806.6 million	$4,812.0 million	+$5.4M above guide	Beat
Non-GAAP EPS	FY2026	$3.70 - $3.72	$3.73	+$0.01 above guide	Beat

New guidance

Metric	Period	Guide	YoY
Revenue	Q1 FY2027	$1,360.0 - $1,364.0 million	+23.6% to +23.9% YoY
Non-GAAP EPS	Q1 FY2027	$1.06 - $1.07	—
Recurring Revenue (ARR)	Q1 FY2027	$5,501.8 - $5,503.8 million	—
Non-GAAP Income from Operations	Q1 FY2027	$308.0 - $310.4 million	—
Non-GAAP EPS	FY2027	$4.78 - $4.90	—
Recurring Revenue (ARR)	FY2027	$6,465.8 - $6,516.4 million	—
Net New ARR	FY2027	$1,213 - $1,264 million	—

Changes to prior guidance

Metric	Period	Prior guide	New guide	Δ	Result
Revenue	FY2027	—	$5,867.6 - $5,927.6 million	—	Raised

Segment performance

Q4 FY2026

Segment	Q4 FY2026	YoY
Subscription Revenue	$1.242B	+23.2%
Professional Services Revenue	$0.063B	+25.7%
Falcon Flex Accounts ARR	$1.69B	+120.0%

Platform metrics

Q4 FY2026

Segment	Q4 FY2026
Annual Recurring Revenue (ARR)	$5.25 billion
Net New ARR (Q4)	$331 million
Net New ARR (Full Year)	$1.01 billion
ARR Growth Rate (YoY)	24%
Module Adoption (6+ modules)	50%
Module Adoption (7+ modules)	34%
Module Adoption (8+ modules)	24%

Profitability

Q4 FY2026

Segment	Q4 FY2026
Non-GAAP Operating Margin	24.9%

Management tone

Narrative arc: Outage recovery → Flex as operating model → Reacceleration delivered → AI infrastructure positioning with multi-year hard commitments.

Three quarters ago AI was framed as a TAM-expansion narrative ("CrowdStrike will be the protector of autonomous AI agents") — speculative, future-tense, agent-count-driven. Two quarters ago it became "AI-lifecycle infrastructure" across model-to-endpoint. Last quarter Charlotte AI and 11 named agents moved the story into evidentiary territory. This quarter management completes the arc, framing CrowdStrike as durable infrastructure for the AI economy itself: "CrowdStrike is durable, mission-critical infrastructure for both securing AI and accelerating global AI adoption." The shift signals management now views AI not as a tailwind to bolt onto the existing growth story but as the operating context that defines the next decade of demand — and they are willing to underwrite a $20B FY36 ending ARR target on that thesis.

Three quarters ago next-gen SIEM was "the horse-and-buggy displacement" rhetoric. Two quarters ago it was "the engine of the modern SOC" with ONIM as the data pipeline. Last quarter it was active competitive displacement at disruptive pricing. This quarter management goes further still, arguing that the moat against frontier-model commoditization is architectural, not feature-based: "In cybersecurity, you simply cannot have a hallucination. You can't prompt twice. It's first time final. It's the difference between thwarting an adversary or experiencing a breach." The shift matters because it pre-empts the most credible bear case (that OpenAI/Anthropic can replicate detection workflows) — management is staking the durability claim on RLHF-trained specialized models plus proprietary data, not on product features.

Hyperscaler positioning has inverted across four quarters from competitive threat to strategic distribution. Last quarter AWS was "default SIM for all their customers" — already a meaningful elevation. This quarter management discloses ~$1.5B of FY26 AWS marketplace TCV and announces Microsoft Marketplace availability as "a watershed moment" with Satya Nadella personally addressing the CrowdStrike go-to-market team. The shift signals that the two largest cloud distribution channels are now operating as co-sellers rather than competitors, which materially de-risks the FY27 pipeline composition.

Falcon Flex has hardened from "operating model" (Q3) to commercial architecture (now). The Q3 disclosure was $1.35B Flex ARR with ~10 customers reflexed 2x+. This quarter: $1.69B Flex ARR (+25% QoQ), 380+ accounts reflexed at least once at an average +26% ARR lift within ~7 months, and ~100 reflexed multiple times with an additional +48% average ARR lift from their initial Flex subscription. "Flex is now how we go to market... Flex is creating its own flywheel. Demand drives use, use drives more demand." The reflex cohort velocity disclosed this quarter — the time-to-second-reflex and the multi-reflex uplift — is the strongest single data point validating the platform consolidation thesis since Flex was introduced.

The acquisition cadence is itself a tone signal. Three closed/announced acquisitions (Signal, Seraphic, Pangea) feeding identity, browser, and AI-application security layers — management explicitly assumes "minimal organic contribution" from these in FY27 guidance, meaning the +23% ARR guide is underwritten by the core platform alone. This is the most aggressive M&A pace in the company's history and the first time guidance has been built without leaning on acquired revenue.

Recurring themes management leaned on this quarter:

AI as both threat vector and business accelerator requiring dedicated security layerProprietary data and RLHF-trained models as structural moat against LLM commoditizationPlatform consolidation through Flex and multi-module adoption creating network effectsAgentic security (Charlotte + 10 other agents) as next-generation SOC paradigmIdentity security (Signal AI acquisition) as critical control point for both human and non-human identitiesBrowser security and endpoint acceleration driven by AI application proliferation

Risks management surfaced:

Frontier AI model providers potentially commoditizing security analytics and threat detectionAbility to maintain pricing power as identity workloads shift from knowledge workers to AI agentsExecution risk on native integration of Signal, Seraphic, Pangea acquisitions at scaleCompetition intensifying in cloud security from hyperscaler-native offerings and legacy SIEM vendorsRapid pace of AI adoption creating compliance and detection challenges faster than platform can scale

Answers to last quarter's watch list

H2 net new ARR vs the raised ≥50% YoY bar. Q4 net new ARR of $330.7M grew 47% YoY by itself, and combined with Q3 cleared the H2 ≥50% bar. The full-year net new ARR of $1.01B (+25% YoY) also surpasses the $1B psychological threshold for the first time.

Resolved positively

FY27 ≥20% net new ARR commitment — early Q4 commentary on the path. Not just confirmed but extended: FY27 net new ARR guide of $1.213–1.264B implies +20% to +25% growth off the $1.01B FY26 base, with the high end pushing toward the upper end of the commitment. Management explicitly characterised the FY27 ARR outlook as raised from prior framing, citing "record Q1 pipeline" and AI adoption. The longest-dated hard commitment on the table has been validated and tightened.

Resolved positively

NextGen SIEM disclosed ARR. Management disclosed next-gen SIEM ending ARR of more than $585M, growing over 75% YoY — restoring the standalone disclosure that had been absent in recent quarters. SIEM is also referenced alongside cloud and next-gen identity collectively exceeding $1.9B ending ARR at +45% YoY growth.

Resolved positively

Falcon Flex ARR growth from the $1.35B base. Flex ARR reached $1.69B, +25% QoQ and +120% YoY — compounding 5x faster than total ARR. Reflex cohort metrics deepened: 380+ accounts reflexed at an average +26% ARR lift within ~7 months, ~100 reflexed multiple times with an additional +48% average ARR lift from initial Flex subscription. The Flex compounding thesis is validated as durable.

Resolved positively

Non-GAAP operating margin progression toward ≥24% FY27 target. Q4 non-GAAP operating margin reached 24.9% — hitting the FY27 target a full year early. The FY27 operating income guide of $1.422–1.462B on $5.868–5.928B revenue implies ~24.2% to 24.7% — confirming the company will sustain at-or-above the target into FY27 even with Signal/Seraphic/Pangea integration costs absorbed.

Resolved positively

DOJ/SEC inquiry status. No update was disclosed in the press release. The largest live overhang remains undisclosed.

Continue monitoring

What to watch into next quarter

Q1 FY27 net new ARR vs the $249–251M guide. Management explicitly guided Q1 net new ARR to $249–251M (+29–30% YoY). This is the H1 seasonality test — with the disclosed 41/59 H1/H2 split, Q1 needs to land in this range to keep FY27 on the +20–25% net new ARR trajectory.

Falcon Flex ARR growth from the $1.69B base. With +120% YoY growth disclosed this quarter, watch whether the sequential step in Q1 holds at >$200M (vs $340M QoQ this quarter). A slowdown in Flex compounding velocity would be the earliest signal that the consolidation flywheel is saturating.

Signal/Seraphic/Pangea integration milestones. Management assumed "minimal organic contribution" from these acquisitions in FY27 beyond the disclosed $5–8M of acquired net new ARR in Q1 — watch for any quantified contribution disclosure that would represent guidance upside, or any integration friction that would compress the operating margin glide path.

Non-GAAP operating margin sustainment at/above 24%. Q4 hit 24.9%; Q1 guide implies ~22.6% at the midpoint (acquisition mix + seasonality). Watch whether the H2 reacceleration delivers margin back above 25%, which would force a rerating of the FY27 ≥24% framing as a floor rather than a ceiling.

NextGen SIEM growth durability off the $585M base. With standalone SIEM disclosure restored at +75% YoY, watch whether Q1 sustains that growth rate against tougher comps — the next-gen SOC displacement thesis hinges on it.

AWS and Microsoft marketplace traction. $1.5B FY26 AWS TCV (+~50% YoY) is now the baseline. Microsoft Marketplace is newly open — watch for any FY27 marketplace TCV disclosure that would validate the hyperscaler-distribution thesis at scale.

DOJ/SEC inquiry status. Still the largest undisclosed overhang. Any movement materially changes the risk profile.

Sources

CrowdStrike Q4 FY2026 press release, March 3, 2026 — https://www.sec.gov/Archives/edgar/data/1535527/000153552726000007/crwd-20260303xex991.htm
CrowdStrike Q4 FY2026 earnings call prepared remarks (excerpts as provided in extraction inputs)

Get the next brief, free.

We publish analyst-grade earnings briefs the same day or morning after every call — headline numbers, segment KPIs, Q&A highlights, and tone analysis. Free during beta.

This is not investment advice.