CrowdStrike net new ARR jumps 51% to $333m as Falcon Flex passes $2.29bn

CrowdStrike Holdings, Inc. (NASDAQ: CRWD) has reported record net new annual recurring revenue of US$332.8 million for fiscal Q2 2027, up 51% year over year, pushing ending ARR to US$5.84 billion as enterprise demand for its Falcon platform accelerates alongside the adoption of artificial intelligence. Revenue increased 26% to US$1.47 billion, while subscription revenue rose 27% to US$1.40 billion and the company returned to a small GAAP profit of US$5.3 million after reporting a US$70.2 million attributable loss in the corresponding quarter last year. CrowdStrike responded by raising its full-year net new ARR growth outlook by 630 basis points to approximately 34% at the midpoint, a material revision only halfway through the fiscal year.

Cash generation provides another important layer to the result because CrowdStrike is producing stronger recurring growth without sacrificing its historically high cash-conversion profile. Operating cash flow increased 59% to a record US$530.3 million, while free cash flow rose 33% to US$377.4 million and represented approximately 26% of quarterly revenue. Cash and cash equivalents reached US$5.01 billion, giving the cybersecurity company considerable financial capacity as it simultaneously invests in AI security, integrates acquisitions and expands partnerships across major cloud platforms.

The stronger performance also indicates that CrowdStrike has moved further beyond the commercial disruption associated with its July 2024 content-configuration incident, although legal, customer and recovery-related risks from that event remain part of the company’s disclosures. The more relevant forward-looking question is now whether CrowdStrike can translate escalating enterprise concern around AI agents, identities and cloud infrastructure into sustained ARR growth above 20% while preserving margins. Management’s revised guidance suggests it believes the current pipeline is strong enough to support precisely that combination.

Why is $333m of net new ARR more important than CrowdStrike’s 26% revenue growth?

Revenue measures what CrowdStrike recognized during the quarter, while ARR measures the annualized subscription value of customer contracts in force at the reporting date. Net new ARR therefore provides an earlier indication of future subscription momentum because it captures the incremental recurring business added during the quarter before all of that contract value necessarily appears as recognized revenue. CrowdStrike’s US$332.8 million of Q2 net new ARR increased 51% year over year, substantially faster than the 25% increase in total ending ARR.

That divergence implies that incremental bookings momentum strengthened rather than merely maintaining the existing growth rate. Ending ARR reached US$5.84 billion, up from roughly US$4.67 billion a year earlier, meaning CrowdStrike added approximately US$1.17 billion to its recurring revenue base over twelve months. The US$333 million added during Q2 alone represents almost 29% of that approximate annual increase, showing how strongly the latest quarter contributed to the current growth trajectory.

Management now expects fiscal-year ending ARR between approximately US$6.603 billion and US$6.612 billion. Using the midpoint of about US$6.607 billion, CrowdStrike would need to add roughly US$767 million of net ARR from its July quarter-end level over the remaining six months, although churn, renewals and other ARR movements mean that simple difference is not identical to the company’s reported net-new-ARR methodology. The guidance nevertheless shows that management expects the business to continue adding recurring revenue at a substantial absolute rate after the record Q2.

How important has Falcon Flex become to CrowdStrike’s commercial model?

Accounts that have adopted Falcon Flex now represent more than US$2.29 billion of ending ARR, up 101% year over year. Compared with CrowdStrike’s total US$5.84 billion ARR, Flex-adopting accounts now account for a recurring-revenue base equivalent to roughly 39% of company-wide ending ARR, although the figure should not be interpreted as ARR generated solely by Flex because it covers accounts that have adopted the programme.

Falcon Flex allows customers to make broader platform commitments while retaining flexibility over which modules they activate and consume, reducing some of the friction associated with purchasing each security product separately. That matters strategically because CrowdStrike is trying to consolidate multiple security categories onto one architecture rather than compete product by product against dozens of specialist vendors. The faster Flex expands, the more opportunities CrowdStrike has to introduce customers to cloud security, identity protection, next-generation SIEM, exposure management and AI-related security capabilities over time.

Broader module adoption supports the same strategy. At July 31, 51% of subscription customers had adopted six or more CrowdStrike cloud modules, while 35% used seven or more and 26% used eight or more. Those figures suggest expansion within the installed base remains an important contributor to growth rather than new-logo acquisition being solely responsible for the US$333 million net new ARR record.

Is CrowdStrike finally achieving meaningful GAAP profitability?

CrowdStrike reported US$5.3 million of GAAP net income attributable to the company compared with a US$70.2 million loss a year earlier, while GAAP operating loss narrowed to US$33.2 million from US$105.5 million. The move into positive GAAP net income is directionally important, but the small absolute profit compared with US$1.47 billion of revenue demonstrates that the statutory earnings model remains much less profitable than the company’s non-GAAP presentation.

Non-GAAP operating income reached US$371.6 million, representing a margin of approximately 25%, compared with US$255 million a year earlier. Non-GAAP net income increased to US$322.9 million from US$237.4 million, while diluted non-GAAP EPS rose to US$0.31 from US$0.23 after adjusting for the company’s four-for-one stock split. The large gap between GAAP and non-GAAP profit reflects items including stock-based compensation, acquired intangible amortization, acquisition costs and adjustments related to the July 2024 incident.

Investors therefore need to watch both earnings frameworks rather than relying exclusively on one. Non-GAAP results provide insight into management’s view of recurring operating economics, while GAAP results capture the actual accounting cost of employee equity compensation, acquisitions and other expenses that can still affect shareholder value. The strongest evidence of underlying financial quality may consequently be cash flow, where CrowdStrike generated US$377.4 million of quarterly free cash flow without relying on accounting adjustments to create the cash itself.

How much stronger is CrowdStrike’s cash generation than a year ago?

Operating cash flow increased from US$332.8 million to US$530.3 million, an improvement of approximately US$197.5 million or 59%. Free cash flow rose from US$283.6 million to US$377.4 million, increasing roughly US$93.8 million or 33%, while free cash flow margin expanded to 26% from 24%.

The slower growth in free cash flow relative to operating cash flow reflects increased investment. CrowdStrike spent more heavily on property, equipment, capitalized software and other infrastructure required to support a larger platform, but still retained more than one quarter of revenue as free cash flow under its definition. That provides considerable capacity for acquisitions, product investment and international expansion without forcing the company to depend on external capital.

Cash and equivalents of US$5.01 billion also give CrowdStrike flexibility as cybersecurity consolidation accelerates. The company has agreed to acquire technology assets from XM Cyber, continues to expand its AWS relationship and is investing heavily in AI security, areas where strategic acquisitions can supplement internal development. The balance sheet therefore supports the company’s attempt to broaden Falcon faster than organic engineering alone might permit.

Why is AI becoming both an opportunity and a new competitive test for CrowdStrike?

CrowdStrike argues that enterprise AI adoption creates an additional security surface because organizations must protect AI agents, models, data pipelines, machine identities and the infrastructure on which those systems operate. During Q2, the company introduced Continuous Identity for AI Agents, expanded AI Detection and Response across multiple AI gateway partners and announced additional AI, cloud and next-generation SIEM integrations with AWS. These launches position Falcon as a control layer for AI adoption rather than leaving CrowdStrike dependent solely on traditional endpoint protection.

The opportunity is attractive because customers deploying AI may need new security products without replacing their existing endpoint and cloud systems. CrowdStrike can therefore potentially sell incremental modules into an already large installed base, especially among Flex customers that have pre-committed to broader platform consumption. That commercial mechanism helps explain why management connects AI adoption directly with higher net new ARR rather than treating AI security as a distant product category.

Competition will be intense because Microsoft, Palo Alto Networks, SentinelOne and other security providers are pursuing many of the same AI-related budgets. Large cloud platforms are also embedding more native security into their infrastructure, forcing CrowdStrike to prove that an independent multi-cloud platform offers enough technical and operational advantages to justify additional spending. Record Q2 ARR provides encouraging evidence, but the competitive outcome will be determined over several years rather than a single earnings cycle.

What does CrowdStrike’s higher FY27 guidance require from the second half?

Full-year revenue guidance now stands at US$5.991 billion-US$6.011 billion, implying approximately US$6.001 billion at the midpoint. Q3 revenue is expected between US$1.523 billion and US$1.529 billion, which would represent another sequential increase from Q2’s US$1.47 billion. Ending ARR guidance of approximately US$6.603 billion-US$6.612 billion requires recurring revenue to keep expanding meaningfully through the January year-end.

Management has raised its net new ARR growth outlook by 630 basis points to 34% at the midpoint, a notable change because guidance revisions of that scale usually require more than a modest improvement in a single quarter. CrowdStrike specifically cited a record Q3 pipeline alongside stronger retention and new-logo activity, suggesting the revised outlook is supported by sales visibility already developing rather than purely by optimism around the broader cybersecurity market.

The main execution risk is that accelerated platform growth creates pressure elsewhere. CrowdStrike must integrate acquisitions, sustain infrastructure investment, protect gross margins and continue improving GAAP economics while expanding into additional product categories. Subscription gross margin improved to 78% on a GAAP basis and 81% on a non-GAAP basis in Q2, giving the company a strong starting point, but increased competition or aggressive product bundling could pressure those levels over time.

What is the strongest signal from CrowdStrike’s Q2 result?

The quarter matters because several indicators improved simultaneously rather than one headline metric carrying the entire story. Revenue rose 26%, net new ARR accelerated 51%, Falcon Flex-account ARR more than doubled, free cash flow reached a record US$377 million and the company raised its annual recurring-revenue growth expectations. That combination suggests the company is gaining commercial momentum while continuing to produce substantial cash rather than buying growth through deteriorating economics.

The transition to GAAP profitability remains incomplete because the US$5.3 million quarterly result is small beside the much larger non-GAAP profit, while stock compensation and acquisition-related expenses continue to create a considerable adjustment gap. Investors therefore still have legitimate reasons to examine the quality of earnings rather than treating the headline profit swing as the central development.

The more consequential tension sits between growth and platform concentration. Falcon Flex and higher module adoption are making CrowdStrike more deeply embedded inside customer security architectures, which can improve retention and lifetime value, but they also increase expectations that one platform can continue outperforming specialists across an expanding number of cyber categories. Q2 suggests customers are currently accepting that proposition at a faster rate, and the raised guidance makes the second half a test of whether that acceleration can persist.