CrowdStrike Stock Q2 Earnings Analysis: Why CRWD Jumped

CrowdStrike did not add roughly $20 billion in market value after hours simply because quarterly revenue beat Wall Street’s forecast by $31 million. The bigger reason was that its most useful forward-looking growth metric, net new annual recurring revenue, exceeded management’s target by nearly $48 million. 

This was not just an earnings beat. It was a market-wide rethink of how long CrowdStrike’s growth can continue.

Let’s break down CrowdStrike’s Q2 FY2027 results, why CRWD stock jumped, how AI security and Falcon Flex are driving growth, and the one big ARR target that still needs to be delivered.

CrowdStrike Q2 FY2027 Earnings Results: Revenue, EPS and ARR

CrowdStrike’s fiscal second quarter ended on July 31, 2026. The company beat Wall Street’s revenue and adjusted earnings expectations, while also exceeding its own guidance across major operating metrics.

Revenue exceeded the FactSet consensus reported by Investor’s Business Daily by approximately $31 million, while adjusted EPS beat expectations by $0.02, or about 7%.

However, the standout result was net new ARR of $332.8 million. It beat the midpoint of management’s guidance by $47.8 million, or almost 17%. According to the official CrowdStrike earnings release, net new ARR grew 51%, compared with 26% revenue growth.

That difference matters. Revenue shows what CrowdStrike recognised during the quarter. ARR measures the annualised value of active subscription contracts, while net new ARR measures how much recurring business was added during the quarter.

Think of revenue as the money already passing through the billing counter. Net new ARR shows how many new recurring orders have entered the system. For a subscription company, it can provide an earlier signal of future growth.

Why Is CrowdStrike Stock Rising After Earnings?

CrowdStrike stock closed 2.05% higher at $189.18 on August 26. It then rose another 10.49% in after-hours trading to approximately $209.

The after-hours rise exceeded the approximately 8.2% move that the options market had priced before the report, according to EarningsWatcher. The actual reaction was about 28% larger than the implied move.

Five factors appear to have driven the rally.

1. Net New ARR Delivered a Major Surprise

A small revenue or EPS beat may not have been enough after CRWD’s strong run in 2026. Instead, net new ARR came in almost $48 million above management’s midpoint and grew 51%.

This suggests that the quarter’s growth was not produced mainly through expense cuts or accounting adjustments. CrowdStrike added more recurring business than expected.

2. Growth Continued to Accelerate

Revenue growth accelerated for a fifth consecutive quarter, while ending ARR growth accelerated for a fourth consecutive quarter.

This is unusual for a business already generating nearly $6 billion in ARR. Growth normally becomes harder as a company gets larger because every percentage point requires more absolute revenue.

3. Growth Was Broad-Based

CrowdStrike reported record net new ARR from new customers. Both gross retention and net retention also improved sequentially.

That combination is important. It means the result was supported by three sources:

• New customers joining the platform
• Existing customers staying with CrowdStrike
• Existing customers spending more

This was not simply one large customer or one product carrying the quarter.

4. AI Interest Began Converting Into Paid Business

CrowdStrike’s AI Detection and Response, or AIDR, ending ARR nearly tripled from the previous quarter. The product is sold as a separate, additional module instead of being included free with endpoint security.

This is the commercial evidence investors wanted. AI security is beginning to move beyond conference presentations and sales pipelines into recurring contracts.

5. Management Raised Guidance Again

CrowdStrike raised its FY2027 net new ARR growth outlook from 27.7% to 34% at the midpoint. This was the second major increase in two quarters.

CEO George Kurtz called Q2 the “best quarter in CrowdStrike’s history” and said during the earnings call that “AI is driving more cyber attacks. AI is driving more cyber spending.”

The numbers provided more support for that statement than they did last quarter.

CrowdStrike FY2027 Guidance: What Changed?

CrowdStrike raised its full-year outlook across revenue, ARR, adjusted operating income and earnings.

The company now expects FY2027 revenue growth of approximately 25% and net new ARR growth of 34%.

For Q3 FY2027, management provided the following guidance:

The $1.526 billion revenue midpoint was above the $1.515 billion FactSet consensus cited by Investor’s Business Daily.

CrowdStrike also maintained its full-year free cash flow margin target of at least 30%. Applied to the new revenue midpoint, that implies at least $1.80 billion of FY2027 free cash flow.

Did CrowdStrike Pass the $750 Million ARR Test?

In our earnings preview, we calculated that CrowdStrike’s previous guidance required roughly $750 million of combined net new ARR in Q3 and Q4.

Q2 came in $47.8 million above management’s target. At first glance, that should have reduced the second-half burden. However, CrowdStrike also raised its full-year target by approximately $64 million.

The company cleared the Q2 checkpoint, but it also moved the finish line further ahead.

The implied Q4 requirement is approximately 27% above the $330.7 million CrowdStrike added in Q4 FY2026.

This remains a demanding target. However, it looks more achievable than it did before Q2 because CrowdStrike exited the quarter with a record Q3 pipeline, record new-customer ARR and improving retention.

The interpretation is also different now. The high second-half target no longer looks like management pushing weakness into Q4. It looks more like management increasing the target after seeing stronger demand.

Still, Q3 net new ARR needs to land near or above the $343 million to $347 million range. A meaningful Q3 shortfall would put too much pressure on the final quarter.

Falcon Flex Is Becoming CrowdStrike’s Growth Engine

Falcon Flex allows customers to make one spending commitment and use it across different CrowdStrike modules.

Think of it as adding money to one cybersecurity wallet. Instead of separately negotiating endpoint, cloud, identity and SIEM contracts, customers can deploy their Flex balance wherever security needs appear.

The model reduces buying friction for customers and makes cross-selling easier for CrowdStrike.

More than 935 Flex accounts were added during Q2, exceeding the number added during the previous three quarters combined. CrowdStrike’s ten largest deals were all Flex contracts.

New-customer Flex deals generated 34% of total net new ARR. Based on the reported $332.8 million, that equals approximately $113 million of net new ARR from customers adopting Flex from the start.

This matters because Flex growth is not coming only from moving existing CrowdStrike customers onto a new contract format.

There is still a risk worth watching. A large upfront Flex commitment could pull future customer spending into the current period. The best test is whether customers use their commitments and then return to expand them.

The early evidence is positive. More than 630 customers had re-Flexed at least once, up sixfold year on year. Management said the first re-Flex happened after an average of eight months, while repeat re-Flex customers had expanded ARR by 53% from their original commitment.

Is AI Security Becoming Real Revenue for CrowdStrike?

CrowdStrike argues that AI creates two security problems at the same time.

First, attackers can use AI to find vulnerabilities and launch attacks faster. Second, companies are deploying their own AI agents, which may access sensitive data, alter permissions or act outside expected rules.

CrowdStrike’s AIDR product is designed to monitor how AI tools and agents are being used, prevent data leakage and apply security controls.

The crucial earnings-call disclosure was that AIDR is a separate module with separate pricing. It uses CrowdStrike’s existing lightweight software agent, so customers do not need another security tool installed on every device.

A simple analogy is a security camera that is already installed. AIDR is like activating a new type of detection software on that same camera instead of installing an entirely new camera system.

CrowdStrike also uses token-based pricing for parts of AIDR. Customers receive an included level of usage and can purchase additional token packs if their activity grows. This gives CrowdStrike a way to benefit when customer AI usage expands.

AIDR ending ARR nearly tripled sequentially, and management highlighted an eight-figure Flex contract with a major bank that included AIDR. However, CrowdStrike did not disclose the product’s absolute ARR.

That is the missing number. Tripling from a small base can create an impressive percentage without yet making a major financial contribution. Future reports should disclose AIDR ARR, customer count or net new ARR contribution if management wants investors to value it as a separate growth engine.

CrowdStrike Is Becoming More Than an Endpoint Security Company

One of the quarter’s strongest signals received less attention than the AI commentary. CrowdStrike’s cloud, identity and Next-Gen SIEM businesses have reached meaningful scale.

These businesses now represent at least 36% of CrowdStrike’s total ARR.

Based on the rounded figures disclosed by management, cloud, identity and SIEM added roughly $590 million of ARR over the past year. CrowdStrike’s total ARR increased by approximately $1.17 billion during the same period.

This suggests that the three newer businesses may have generated roughly half of CrowdStrike’s total ARR growth.

That is an important change in the investment story. CrowdStrike is no longer relying only on selling more endpoint protection. Its newer products are growing faster and becoming large enough to influence company-wide results.

It also explains why Falcon Flex matters. The wider the platform becomes, the more valuable a flexible cross-product contract becomes.

How Strong Was CrowdStrike’s Profit and Cash Flow?

CrowdStrike produced strong adjusted operating leverage and cash flow, but the difference between GAAP and adjusted profit remains significant.

Adjusted operating margin expanded by around 3.5 percentage points to 25%. Subscription gross margin also improved to 81% on a non-GAAP basis.

Cash flow was genuinely strong. Operating cash flow rose 59% to $530.3 million, even though spending on property, equipment and capitalised internal software more than tripled to approximately $150.9 million. Free cash flow still grew 33%.

However, stock-based compensation and related payroll taxes increased 44% to $399 million, faster than revenue. It equalled approximately 27% of quarterly revenue and exceeded free cash flow.

Stock compensation is non-cash in the current period, but it is not free for shareholders. It is similar to paying part of an employee’s salary with small pieces of the company. Cash remains inside the business, but existing ownership is divided across more shares. CrowdStrike’s diluted share count increased by about 1.9% year on year.

The GAAP comparison also benefited from an easier base. Q2 FY2026 included $35.7 million of costs related to the July 2024 incident and $38.4 million of restructuring charges. The latest quarter instead included a $14.5 million net recovery connected to the incident, according to the company’s financial reconciliation.

Therefore, CrowdStrike’s underlying profitability improved, but the swing from a $70 million GAAP loss to a $5 million profit looks cleaner than the underlying economics actually were.

Is CRWD Stock’s Valuation Still a Risk?

The business delivered an excellent quarter. The valuation remains demanding.

At an after-hours price of approximately $209 and roughly 1.02 billion shares outstanding, CrowdStrike’s implied market value was around $213 billion. After subtracting its net cash position, the enterprise value was approximately $209 billion.

That equals roughly:

• 35 times the new FY2027 revenue midpoint
• 116 times the minimum implied FY2027 free cash flow
• More than 30 times estimated free cash flow five years ahead under several strong growth assumptions

This is not a price forecast. It is an expectations test.

Even if CrowdStrike grows revenue by 25% annually for another five years and reaches a 35% free cash flow margin, the current enterprise value would still equal roughly 33 times that future cash flow.

The valuation assumes CrowdStrike remains an elite growth company for years, not quarters.

This brings us back to the $20 billion after-hours increase. CrowdStrike raised its FY2027 revenue guidance midpoint by only about $64 million, but its market value increased by roughly $20 billion.

The market effectively added more than $300 of value for every $1 added to the current-year revenue outlook. Investors were clearly not paying only for the extra $64 million. They were increasing the probability assigned to several more years of strong growth.

That is why we view this as a duration beat. The report convinced investors that CrowdStrike’s growth may last longer than previously assumed.

What Should CrowdStrike Investors Watch Next?

The quarter strengthened CrowdStrike’s business case materially. The company delivered the type of beat that matters most for a high-growth subscription business: net new ARR accelerated, new-customer contribution reached a record, retention improved, guidance increased and margins expanded.

The main concern is no longer whether CrowdStrike can recover from the July 2024 incident. The harder question is whether the business can keep meeting expectations now embedded in one of the software sector’s most demanding valuations.

CrowdStrike Q2 Earnings Analysis: Final Takeaway

CrowdStrike’s Q2 result was better than the headline revenue and EPS beat suggests. Net new ARR exceeded guidance by almost $48 million, Falcon Flex became a larger part of the business, newer security products generated a meaningful share of growth, and AIDR began converting AI concerns into paid contracts.

Our view is that this was a high-quality quarter. The growth was broad, forward-looking indicators improved, and management raised its target by more than the Q2 outperformance.

However, a high-quality business does not automatically create a low-risk stock. At approximately 35 times guided revenue after the earnings rally, CRWD still needs years of strong growth, expanding margins and careful control of stock compensation to justify its valuation.

The quarter made the growth target more believable. It did not make the valuation forgiving.