Upgrading CrowdStrike to Outperform: The Reacceleration Doesn't Just Confirm — It Accelerates, the Back-Half Guide Jumps to 50%, and AWS Makes Falcon Its Default SIEM

Results vs. Consensus

Q3 FY2026 Scorecard

Year-Over-Year Comparisons

Quarter-Over-Quarter Comparisons

Quality of Beat

Revenue: The 22% headline growth is still being suppressed by the CCP subscription-revenue separation ($13–15M in Q4, ending after the quarter), so reported growth understates underlying demand by a point or two. The FY26 revenue guide was raised $24.1M at the midpoint — a real raise, not a re-base. Critically, US and APAC revenue growth both accelerated versus Q2, broadening the geographic base.

Margins: Operating margin held at 21% despite the seasonal Falcon-conference sales-and-marketing step-up (opex 57% of revenue), and operating income set an all-time record. Subscription gross margin ticked up to 81% from 80%. The deliberate margin trough of FY26 is showing the first signs of bottoming, with the FY27 path to 30%+ FCF margin reaffirmed.

EPS & cash: Non-GAAP EPS of $0.96 returned to year-over-year growth (~+3%) after the Q2 decline, and the GAAP loss narrowed by more than half to $(34)M as outage costs fell to $26.2M (from $35.7M in Q2). Free cash flow of $295.9M (a Q3 record, 24% margin) was struck after absorbing ~$53M of incident/strategic-plan cash costs — meaning the underlying cash engine is already operating well above the reported margin. This is the cleaner profitability quarter the Hold was waiting to see begin.

Platform Performance

The "newer-three" module families (cloud, next-gen identity, next-gen SIEM) all posted record or near-record net-new-ARR quarters and continue to compound well above the corporate rate, while the endpoint base itself accelerated — the broadest-based growth quarter in the post-outage period.

Next-Gen SIEM — The AWS Deal Changes the Distribution Math

Next-gen SIEM posted a record net-new-ARR quarter, but the headline is the AWS partnership announced at re:Invent: AWS named Falcon next-gen SIEM the default SIEM in its Security Hub console, pre-populated with AWS telemetry, available to millions of AWS customers — including those who do not yet run Falcon. Accenture is the launch partner migrating customers off legacy SIEM. The motion is product-led-growth that CrowdStrike intends to convert into Flex subscriptions over time.

"AWS selected Falcon next-gen SIEM as the default SIEM for all their customers… This brings Falcon next-gen SIEM with pre-populated AWS data to millions of AWS customers in a product-led growth motion. Our intent is to convert next-gen SIEM usage into Flex subscriptions." — George Kurtz, CEO

Assessment: This is the most consequential strategic development of the quarter and the kind of thing that justifies an upgrade. SIEM displacement was already CrowdStrike's most credible multi-year story; an AWS-default distribution channel pre-seeds the funnel with millions of accounts at near-zero CAC. It will monetize gradually (PLG-to-Flex is a multi-quarter conversion), but it materially raises the ceiling on the next-gen SIEM TAM and is under-priced in consensus models.

Cloud — Runtime Leadership and a String of Wiz Replacements

Cloud delivered a Q3 record net-new-ARR quarter, with management citing "multiple Wiz replacements" — including a Fortune 500 CPG company's 7-figure displacement — on the strength of runtime protection over posture-only tools (CSPM). The Pangea acquisition (closed in-quarter) extends Falcon into AI-infrastructure security ("protect AI from the source"), and an 8-figure "Neo cloud" token-factory win signals demand from the AI-infrastructure buildout itself.

"As the cloud security market matures, customers are realizing that posture doesn't equate to prevention… this can only be delivered in runtime. CrowdStrike is the cloud runtime security leader." — George Kurtz, CEO

Assessment: The Wiz-replacement evidence directly addresses the most-watched competitive threat in cloud security (Wiz, now inside Google). Winning runtime-led displacements against a posture-led incumbent validates the architecture argument and the consolidation pitch. Pangea is sensible AI-infrastructure optionality. Cloud is now an unambiguous growth leg.

Identity / Falcon Shield — SaaS-App Security Goes Mainstream

The identity business performed exceptionally, with Falcon Shield (SaaS-application security) posting a record net-new-ARR quarter, up nearly 50% sequentially. The pitch — securing human and non-human/agentic identity misuse of data-rich SaaS apps — is resonating, with examples of 7-figure deals landing in under an hour (one customer activated Shield via Flex during a demo) and Shield landing net-new logos without any endpoint deployment.

Assessment: Shield's ability to land standalone (no endpoint prerequisite) is strategically important — it opens a new front-door into accounts and a new TAM. The ~50% sequential growth off a meaningful base is the fastest-improving sub-segment in the portfolio. Identity has graduated from "optionality" (our Q2 framing) toward "confirmed growth leg."

Endpoint — The Base Re-Accelerated

The endpoint business accelerated in the quarter — a notable reversal of the maturation concern that anchored our Q2 caution. Management credits AI-at-the-edge: employees deploying desktop AI apps (Claude Desktop, ChatGPT) and AI browsers create new endpoint attack surface and renewed modernization demand, with ~50% of the market still on legacy AV.

Assessment: An accelerating endpoint base meaningfully de-risks the "law of large numbers caps consolidated growth" bear point from our Q2 note. If AI adoption is a durable endpoint-modernization catalyst, the two-thirds of ARR we worried was gravity-bound has a fresh demand driver. This is a direct upgrade-supporting data point.

Module Adoption

Key Topics & Management Commentary

Overall Management Tone: Confident to the point of celebratory — "acceleration is back" and "one of our very best quarters in company history" set the register. The posture shifted from Q2's "the reacceleration is here" to Q3's "the reacceleration is compounding and we're raising the bar," and management leaned hard into the AI-security narrative as the durable multi-year driver. There was no defensiveness; the CCP lap and the outage are treated as closed chapters, and the only measured note was the customary deferral of segment-level FY27 detail to the Q4 call.

1. Acceleration Compounds — and the Framework Goes Up

"At the midpoint of our net new ARR assumptions, we expect second-half net new ARR growth of at least 50% year over year, well above our previously provided assumptions of at least 40% year over year, driven by our strong Q3 outperformance and record pipeline." — Burt Podbere, CFO

One quarter after guiding the back half to "at least 40%," management raised it to "at least 50%" — and reaffirmed FY27 net-new-ARR growth of at least 20% on the now-higher FY26 base. Net new ARR of $265M (+73% YoY) and an all-time-record pipeline entering Q4 underpin the raise.

Assessment: A guidance raise of this magnitude, one quarter after the initial framework, is the cleanest possible confirmation of the thesis we held back from at Q2. It removes the "is the 40% just an easy comp" debate — raising to 50% with a record pipeline is a demand statement, not a calendar artifact. This is the spine of the upgrade.

2. The AWS Default-SIEM Partnership

Beyond the next-gen SIEM section above, the strategic weight of the AWS deal deserves its own frame: it positions Falcon next-gen SIEM as competitive with the hyperscaler-native and firewall-vendor SIEMs precisely where those incumbents are weakest (cost, speed, agentic operability), and it does so inside the console where AWS customers already live. CrowdStrike was also named AWS's global security partner of the year and global marketplace partner of the year.

"Our next-gen SIEM helps AWS fill a critical market gap, now competing with other hyperscaler SIEMs and doing so with Falcon… we've become a federated, pre-populated, and affordable security data lake." — George Kurtz, CEO

Assessment: The multi-cloud optics (does AWS proximity complicate Azure/GCP relationships?) are a fair question, but management's answer — security is inherently multi-vendor and customers pick the best technology — is credible, and CrowdStrike remains cloud-agnostic at the platform level. The deal is a net structural positive for distribution.

3. Falcon Flex Becomes the Standard, and Reflex Deepens

"Falcon Flex is an unlock, not an ELA… the number of reflex accounts more than doubled quarter over quarter to more than 200, with 10 customers reflexing more than two times their initial Flex subscription… we expect it to become our licensing standard." — George Kurtz, CEO

Flex ending ARR exceeded $1.35B (tripled YoY), reflex accounts doubled sequentially to 200+, and ten customers have now reflexed more than twice. Management expects Flex to become the default licensing model.

Assessment: The reflex data continues to be the strongest forward-looking evidence in the model. Customers exhausting and re-upping their Flex commitments — some multiple times — is a land-and-expand signature that compounds. The one nuance to watch (raised thoughtfully in Q&A) is whether the Flex-driven NRR tailwind eventually normalizes as the early-adopter cohort matures.

4. The CCP Lap and Discounting Normalization

Management characterized the CCP program as having done exactly what it was designed to do — carry customers through the post-outage period while seeding Flex adoption — and now lapping cleanly, with the ARR-to-revenue separation down to $13–15M in Q4 and ending thereafter. On discounting, management framed price realization as normal-course and pointed to the 81% subscription gross margin as evidence pricing power held through the outage period.

"As we lap the CCP, CCP was designed to do exactly what we delivered… we provided a way to accelerate Flex adoption, and we've seen that with our Flex license adoptions throughout the quarter." — George Kurtz, CEO

Assessment: The clean CCP lap resolves the largest open question from our Q2 note — the cohort is renewing and converting to Flex rather than churning, and the 81% subscription gross margin confirms price realization was protected. The finite headwind is now visibly rolling toward its end date.

5. Next-Gen SIEM → Observability Expansion

Management surfaced an additional expansion vector: observability. Recalling that ~50% of the Humio/LogScale business was already observability when acquired, and that the platform is already ingesting non-security IT telemetry, Kurtz framed observability as a natural consolidation opportunity layered on the same data fabric and Onum pipeline.

Assessment: Observability is a large adjacent TAM (the Datadog/Splunk arena) that CrowdStrike can attack with the data layer it already operates. It is early and not yet a line item, but it is real optionality on top of the security platform — and consistent with the "operating system of the SOC, and increasingly of IT" ambition.

6. Ecosystem and GSI Standardization

The partner ecosystem delivered a record quarter of deal value. Marquee signals: Kroll migrating ~500K endpoints to Falcon in a ~8-figure rip-and-replace (with Falcon Complete becoming Kroll's SOC); F5 certifying the Falcon sensor on BIG-IP appliances; and Deloitte, Wipro, and Accenture standardizing next-gen SIEM delivery on Falcon. A Canalys report cited up to $7 of services opportunity per $1 of Falcon product sales.

Assessment: When a competitor's MDR (Kroll's prior point product), a network-appliance vendor (F5), and the largest GSIs all standardize on your platform, it is category-leadership gravity. The $7-of-services-per-$1-of-product ratio is the structural reason the partner channel keeps compounding — partners make more money selling Falcon than alternatives.

7. Endpoint as the AI "Risk Point"

"AI adoption is supercharging renewed interest in the endpoint, as the endpoint is the epicenter of human and nonhuman interaction with AI… the endpoint has quickly become the risk point, the productivity point, and the opportunity point." — George Kurtz, CEO

The reframing of endpoint as the AI risk surface — desktop AI apps and AI browsers creating new monitoring needs — is the demand narrative behind the endpoint re-acceleration, on top of the ~50% of the market still running legacy AV.

Assessment: This is the most important second-order AI argument for CrowdStrike: AI doesn't just create new products to sell (security-for-AI), it re-energizes the core endpoint franchise (AI-as-endpoint-risk). If durable, it extends the runway on two-thirds of ARR.

8. Profitability Inflection and the FY27 Setup

Record operating income, 81% subscription gross margin, a halved GAAP loss, and a Q3-record FCF struck after ~$53M of incident/strategic-plan cash costs collectively mark the beginning of the margin recovery. Management reaffirmed the FY27 framework: net-new-ARR growth of at least 20% on a higher base, FCF margin above 30%, and the end of the CCP revenue separation — which together imply reported revenue growth re-accelerates as ARR-to-revenue re-couples.

Assessment: The FY27 setup is the second pillar of the upgrade. FY26 was the trough; FY27 is when growth, margin, and cash all inflect together. Buying ahead of that visible convergence, with the catalysts now de-risked, is the risk/reward we were unwilling to underwrite at Hold but are willing to underwrite now.

Guidance & Outlook

The framework, not the point estimate, is again the signal. Management raised back-half net-new-ARR growth to at least 50% YoY (from 40%), guided low-to-mid-teen sequential net-new-ARR growth Q3→Q4, and put FY26 ending-ARR growth at 23%. The $13–15M Q4 CCP separation is the last of that headwind. FY27 net-new-ARR growth was reaffirmed at "at least 20%" on the higher base, with FCF margin guided above 30%.

Implied Q4 net new ARR: Low-to-mid-teen sequential growth off $265M implies a Q4 net-new-ARR figure around $300M+ — which would put CrowdStrike near a $1B+ annualized net-new-ARR run-rate and clear the $5B ending-ARR milestone comfortably.

Street at: Consensus was positioned for a beat (high-multiple name); the surprise was the magnitude of the framework raise and the AWS deal, not the headline P&L. The raised FY guide sits above where the Street had modeled.

Guidance style: Conservative-revenue/confident-ARR, as in Q2 — but this quarter the ARR confidence was explicit enough (a +10pt framework raise) that the gap between the two is now a feature, not a worry.

Analyst Q&A Highlights

Whether the Flex-Driven NRR Tailwind Eventually Normalizes

The most analytically interesting exchange probed whether Flex is producing a temporary elevation in net retention — because it started with CrowdStrike's best, most-excited customers — that could normalize lower as the cohort broadens, versus a structural step-up. Management argued the tailwind is durable and continuous, anchored in the model being designed to make buying-more frictionless.

Q: "You've now got several quarters of data on Flex… I'm wondering if there's a dynamic where you see an elevated tailwind to NRR for a period of time because of Flex, and Flex starting with your best and most excited customers and then perhaps normalizes lower. How do you think about the tailwind that Flex is driving in the model and how sustainable that is?"
— Gabriela Borges, Goldman Sachs

A: "Our Flex license, it's continuous. Net ARR will be continuous throughout time… it's designed for customers to easily buy more. So over time… we're excited about the opportunity as we bring more products to market… the benefit is that we're seeing bigger deals and longer deals… the biggest point… is consolidation."
— Burt Podbere, CFO

Assessment: The question is exactly the right skeptical lens on the bull case, and management's answer was more conviction than quantification — the "continuous" framing is a claim, not yet a proof. Our read: there is probably some early-adopter selection in the current reflex cohort, but the >200 reflexes across an expanding base, plus rising module-adoption rates among non-Flex customers, argue the structural component dominates. We treat eventual NRR normalization as a second-derivative watch item, not a thesis risk for FY26–FY27.

The Velocity and Value Capture of SIEM Displacements

An analyst pressed on whether the SIEM market is seeing accelerating displacement velocity, how much value CrowdStrike captures versus incumbents' prior spend, and the timetable of legacy-SIEM renewals it can target. Management drew the analogy to its legacy-AV displacement playbook and emphasized that every Falcon customer is already next-gen-SIEM-enabled.

Q: "It feels like the SIEM market is starting to see more velocity of displacements. Can you talk about what sort of value you're able to capture in those opportunities compared to what customers were maybe spending before? And how do you think about the timetable for legacy SIEM renewals in the coming quarters?"
— Saket Kalia, Barclays

A: "It feels a lot like [legacy AV] in the early days… because we already have the EDR data in the platform, we can offer disruptive pricing… all of our customers are next-gen SIEM enabled… all we need to do is go through the licensing exercise, and Flex is helping to accelerate that… it's a multiyear long-tail journey that feels very similar to the displacement of legacy AV."
— George Kurtz, CEO

Assessment: The legacy-AV analogy is the most useful framing for sizing the SIEM opportunity — CrowdStrike turned AV displacement into a decade-long share-gain engine, and the structural advantage in SIEM (every customer already enabled, EDR data already resident, disruptive pricing) is arguably stronger. The "multiyear long-tail journey" framing also correctly sets expectations: SIEM is a durable compounding driver, not a single-quarter spike.

Discounting Levels as the Outage Recedes

A pointed question asked whether the elevated discounting of the post-outage period (CCP and competitive aggressiveness) would diminish as the outage moves into the rear-view, and how to think about price realization into FY27. Management framed discounting as normal-course and pointed to gross margin as the proof of discipline.

Q: "If I think about this time last year, we had the CCP program, but we also had CrowdStrike being aggressive to cement and extend its position through discounting… as we look toward fiscal '27, can you talk about how you're thinking about normal-course-of-business discounting? Are those levels gonna diminish over time as the outage [recedes]?"
— Patrick Colville, Scotiabank

A: "There's always some level of discounting… we've been very prudent… we've tried to focus on things like CCP, which allow customers to take new technologies in but protect the price point… I'll also point out the 81% gross margin. You have to look at the margin as well. We've been able to protect the margin."
— George Kurtz, CEO

Assessment: The right answer, and the 81% subscription gross margin is the proof point — if discounting had been structurally eroding price realization, it would show up in gross margin, and gross margin actually improved. The "protect the price point" framing of CCP (giving modules/value rather than cutting headline price) is why the franchise emerged from the outage with pricing power intact. This de-risks the bear concern that the recovery was bought with margin.

AWS Proximity and Multi-Cloud Dynamics

A high-level strategic question asked whether the deepening AWS partnership — with the full Falcon suite integrated into AWS — could complicate CrowdStrike's relationships with other hyperscalers or with multi-cloud customers. Management reframed security as inherently multi-vendor and positioned Falcon as cloud-agnostic.

Q: "Does this proximity [to AWS] preclude you or influence you or potentially complicate your relationship with other hyperscalers, and your customers who would presumably have multi-cloud footprints?"
— Fatima Boolani, Citi

A: "There's always an area to cooperate with many different companies… we're gonna work with other players that are out there. They're gonna leverage the best technology in the market, which is CrowdStrike… it doesn't preclude us from doing that, but this reinforces what a great relationship we have with AWS."
— George Kurtz, CEO

Assessment: The multi-cloud concern is legitimate but over-weighted — CrowdStrike's value proposition is precisely that it secures across all clouds and endpoints, and that platform-neutrality is its moat against any single hyperscaler's native security. The AWS deal is a distribution win that doesn't compromise neutrality; Azure/GCP customers still need a cloud-agnostic security layer, which is Falcon.

F5 and the Appliance-TAM Expansion

An analyst flagged the F5 partnership as potentially TAM-expanding, since network-appliance hardware historically could not run endpoint agents, and asked how meaningful and replicable it could be. Management confirmed it opens a new insertion point and a replicable model for other appliance vendors.

Q: "I believe this part of the infrastructure stack historically was never able to support endpoint agents before. So does this expand the endpoint TAM? How meaningful can this be? And are there other areas of the infrastructure stack this is applicable to?"
— Eric Heath, KeyBanc

A: "It does… customers have been asking for a long time to protect these appliances… we do think that this will create a model that will open it up to other appliance vendors… there was a story just last week of a noncustomer… was blown away, and within a week we had him in an EBC and now we're getting into a proof of value… these [appliances] are the tip of the spear for many of these nation-state breaches."
— George Kurtz, CEO

Assessment: A genuinely new insertion point — network appliances are high-value, frequently-targeted, and historically un-agentable. If the F5 model replicates across other appliance vendors, it is incremental endpoint TAM that didn't exist before, with a built-in lead-gen effect (the appliance vendor's install base). Small today, but the right kind of optionality.

Emerging Segments Lapping the CCP and Pangea Seasonality

The opening question asked how the emerging segments are behaving as the company laps last year's initial CCP initiatives, plus any read on organic net-new-ARR seasonality given the Pangea close. Management said the emerging products "performed fantastic" and confirmed Pangea/Onum were de minimis to revenue and ARR.

Q: "Could you offer a little color on how those [emerging] segments are behaving as you lap the initial CCP initiatives of last year? And… any sense of the organic seasonality for net new ARR?"
— Brian Essex, JPMorgan

A: "When we look at the emerging products… they performed fantastic. NextGen SIEM… has been an all-star standout… Identity as well… and cloud… And as we lap the CCP, CCP was designed to do exactly what we delivered." (Podbere: "Pangea… de minimis impact both from a revenue standpoint and net new ARR.")
— George Kurtz, CEO / Burt Podbere, CFO

Assessment: The confirmation that the $265M net-new-ARR figure was organic — with the in-quarter acquisitions de minimis — matters. The acceleration is not acquired growth; it is the platform compounding. That cleanliness is part of what makes the print upgrade-worthy.

What They're NOT Saying

1. Segment-level ARR breakouts. Management deferred the cloud/identity/SIEM ARR disclosure to the Q4/year-end report ("we'll be reporting out on those next quarter"). We have directional records ("record net new ARR quarter") but not the updated dollar levels — the year-end breakout is a small catalyst.
2. The comp-adjusted net-new-ARR growth rate. The +73% YoY laps an outage-depressed base; management did not provide an underlying/normalized growth figure that would isolate organic acceleration from the easy comp. The raised forward framework (to 50%) is the better signal, but a normalized number would have settled the comp debate outright.
3. AWS deal economics. No revenue or ARR contribution, ramp timeline, or revenue-share terms were disclosed for the AWS default-SIEM partnership — consistent with a PLG motion still in its early innings, but it leaves the most important new catalyst unquantified.
4. A specific FY27 revenue or margin guide. Beyond the "at least 20%" net-new-ARR and ">30% FCF margin" framework, formal FY27 guidance was again deferred to the Q4 call — the one disclosure that would let the Street fully price the FY27 inflection.
5. Net revenue retention. Still no clean DBNRR number, despite the Flex-NRR question in Q&A. The Flex tailwind is described qualitatively rather than via a comparable retention metric.

Market Reaction

• Pre-print setup: CRWD entered the December 2 print at a prior close around $516.55 — near all-time-high territory, up from ~$480 at the Q2 print and roughly +50% year-to-date. Valuation was full at ~27–28x forward sales, among the richest in large-cap software; the bar for a positive reaction was a flawless beat-and-raise.
• After-hours / initial reaction: Shares slid ~3% in after-hours to ~$501, then recovered through the December 3 session (opening ~$497, dipping to ~$487, closing back near $515) — roughly flat on a clean beat-and-raise.

The muted, roughly-flat reaction to an excellent print is the single most important market signal in this report, and it cuts both ways. It confirms our standing concern that CRWD is a high-expectation, high-multiple name where excellence is the baseline — the reason we are upgrading to Outperform rather than to a higher-conviction stance, and the reason valuation remains the live risk. But it also means the stock did not re-rate up on the framework raise and the AWS deal — the market is, for now, treating the catalysts as priced. We disagree: the back-half framework moving to 50%, the AWS distribution channel, and the visible FY27 convergence (margin + growth + cash) are not, in our view, fully reflected at a flat post-print price. That gap — between a de-risked, improving multi-year setup and a stock that went nowhere on the news — is the Outperform opportunity. The bar is high; the trajectory is now clearly clearing it.

Street Perspective

Debate: Is the Net-New-ARR Acceleration Structural or a Comp Mirage?

Bull view: Ending ARR re-accelerated to 23% from 20% — something an easy comp alone cannot produce — and management raised the forward framework to 50% with a record pipeline. Flex reflex activity, the AWS channel, and endpoint re-acceleration are durable, organic drivers. This is a genuine inflection with multi-quarter legs.

Bear view: The +73% YoY net-new-ARR optic laps an outage-depressed trough; on a two-year stack the growth is less dramatic. The raised framework still leans partly on the comp, and the muted stock reaction shows the smart money is skeptical the acceleration is as structural as the headline implies.

Our take: The ending-ARR re-acceleration and the framework raise are the two facts the comp-mirage argument can't explain away. We side with the bull on structure while acknowledging the optics are flattered — which is why our model leans on ARR re-acceleration and the raised framework rather than the headline 73%.

Debate: Does ~28x Forward Sales Leave Room After a Flat-Reaction Print?

Bull view: The flat reaction means the catalysts (framework raise, AWS, FY27 setup) are not yet in the price — the stock can re-rate as those de-risk and as FY27 revenue growth re-accelerates with the CCP tail ending. Premium franchises with widening moats sustain premium multiples; the multiple has held through every prior "too expensive" call.

Bear view: At ~28x sales near all-time highs, the multiple already capitalizes years of flawless execution. A flat reaction to a beat-and-raise is a warning that upside is capped; any FY27 guide disappointment or tech-multiple compression leaves asymmetric downside.

Our take: This is the crux, and it is why our upgrade is to Outperform rather than high-conviction. We judge the de-risked trajectory and the un-priced catalysts as enough to beat the market over twelve months, but we are clear-eyed that valuation caps the magnitude and raises the stakes on each subsequent print. We would add on weakness, not chase strength.

Debate: Is the AWS Deal Material or Just a Logo?

Bull view: Default-SIEM placement in front of millions of AWS accounts, pre-populated with their data, in a PLG-to-Flex motion, is a structural distribution unlock at near-zero CAC — the kind of channel that compounds for years and is barely in consensus models.

Bear view: PLG-to-paid conversion is slow and uncertain; "default" placement doesn't guarantee monetization, and the deal economics (revenue share, ramp) are undisclosed. It could be more marketing than money for several quarters.

Our take: Both are right on timing — it will monetize gradually — but the strategic value of seeding the SIEM funnel with millions of pre-populated AWS accounts is high and under-appreciated. We model it as a back-half-FY27-and-beyond contributor, not an FY26 number, and view it as raising the next-gen-SIEM ceiling rather than the near-term run-rate.

Model & Valuation Framework

Valuation framework: At ~$515 and ~28x forward sales, CRWD is not cheap on any near-term metric — and we are not pretending otherwise. The Outperform case is not a valuation-rerating call; it is a thesis-confirmation call. The reacceleration we wanted to see print, printed and then accelerated; the forward framework moved up; the GAAP loss is healing; and a structural new distribution channel (AWS) emerged — all while the stock went nowhere on the day. Over a 12-month horizon, we expect FY27 revenue re-acceleration (as the CCP tail ends and ARR-to-revenue re-couples) plus FCF margin crossing 30% to drive earnings/cash-flow upside that the flat-reaction price has not captured. We see a 12-month path to the high-$500s/low-$600s on the base case, with the downside ($420–450) gated by any FY27-guide disappointment or a broad software de-rate.

What would change our mind (back to Hold): a Q4 net-new-ARR figure that misses the low-to-mid-teen sequential framework; an FY27 guide (at Q4) that disappoints on revenue re-acceleration or FCF margin; evidence the Flex-NRR tailwind is normalizing faster than module-adoption gains can offset; or a multiple that runs further ahead of the fundamentals without a commensurate raise.

Thesis Scorecard: Q2 Framework Revisited

Our Q2 initiation laid out five bull pillars and five bear points. Q3 resolved several decisively.

Overall: Thesis materially strengthened. Three of the five bear points weakened or resolved (EDR maturation, CCP tail, CCP-cohort renewal), a new bull pillar was added (AWS), and the central bull pillar (reacceleration) didn't just confirm — it accelerated and the guide went up. The only fully-active bear is valuation, which is precisely why the rating is Outperform and not higher.

Action: Upgrade to Outperform from Hold. The confirmation we required at Hold arrived and over-delivered. Accumulate; add on any valuation-driven pullback.

Bottom Line: The Confirmation We Were Waiting For — and Then Some

One quarter ago we initiated CrowdStrike at Hold with a constructive bias and a clear, single condition for an upgrade: a Q3 net-new-ARR print that validated the 40%+ back-half framework and made the FY27 re-acceleration setup visible. Q3 did not merely meet that bar — it cleared it and raised it. Net new ARR grew 73% to a Q3 record, ending ARR re-accelerated to 23%, management lifted the back-half framework to at least 50%, the GAAP loss halved, and AWS made Falcon its default SIEM. The reacceleration is no longer a forecast to be confirmed; it is a trend that is compounding and that management is guiding higher into.

Our one reservation is unchanged from Q2 and is honest: at ~28x forward sales near all-time highs, this is not a cheap stock, and the roughly-flat reaction to a beat-and-raise proves the expectations bar is high. But that flat reaction is also the opportunity — the framework raise, the AWS distribution channel, and the visible FY27 convergence of growth, margin, and cash are, in our judgment, not yet in the price. Over twelve months, we expect the FY27 inflection (CCP tail ending, revenue re-coupling to ARR, FCF margin crossing 30%) to drive upside the market is currently treating as already-paid-for.

This is the textbook upgrade setup: every Hold-gating concern from our initiation resolved the right way in a single quarter, a new structural catalyst emerged, and the stock didn't move. We upgrade to Outperform, with valuation as the acknowledged constraint and the FY27 guide at Q4 as the next proof point.