Maintaining CrowdStrike at Outperform: A Blockbuster $5B-ARR Finish, GAAP Profitability Returns, Microsoft Opens Its Marketplace — and the Stock Is 24% Cheaper Than at Our Upgrade

Results vs. Consensus

Q4 FY2026 Scorecard

Year-Over-Year Comparisons

Quarter-Over-Quarter Comparisons

Quality of Beat

Revenue: Reported revenue grew 23% — an acceleration — and, importantly, this is the quarter where the CCP subscription-revenue separation is in its final stage, so the ARR-to-revenue re-coupling is beginning to show. EMEA and APAC growth both accelerated versus Q3, broadening the base geographically. Subscription gross margin set a record at 81% on cloud-cost optimization, confirming pricing power was never compromised by the outage-era discounting.

Margins & profitability: The 25% non-GAAP operating margin (a record) and the return to GAAP profitability ($38.7M) together mark the end of the FY26 margin trough. Full-year operating income of $1.05B (first year over $1B) and FCF of $1.24B (26% margin) demonstrate the "growth-plus-margin" algorithm is fully restored. The combination of 24% ARR growth, 25% operating margins, and 26% FCF margins is, as the CFO put it, "rare air."

Net new ARR & retention: The $330.7M record was organic (acquisitions de minimis), and the durability metrics underneath it are pristine: DBNRR rose to 115%, gross retention held at 97%, and module adoption deepened (50% of customers at 6+ modules). This is the highest-quality net-new-ARR print in the franchise's history, struck against the toughest available comp narrative — and it silenced the easy-comp debate by re-accelerating off an already-recovered base.

Platform Performance

Every major product line either accelerated or set a record, and the endpoint base accelerated for a second consecutive quarter — the broadest-based growth quarter in the company's history. The "newer-three" crossed $1.9B of ending ARR at +45% YoY.

Next-Gen SIEM — +75% and the AWS/Microsoft Distribution Stack

Next-gen SIEM grew over 75% to more than $585M of ending ARR in a record quarter, with Onum now powering fast data onboarding and a Fortune 500 retailer replacing a legacy SIEM plus its attached pipeline point product (~80% faster query performance). The strategic step-change is distribution: on top of the AWS default-SIEM placement, the newly-opened Microsoft marketplace gives Falcon access to Azure consumption-commitment budgets.

Assessment: SIEM remains the most credible multi-year displacement engine, and it now has two hyperscaler distribution channels feeding it. The legacy-AV-displacement analogy management drew last quarter is playing out — a long-tail, multi-year share-gain motion with structurally disruptive pricing. The frontier-lab commoditization fear (addressed in Q&A) is the main bear counter, and we find it over-stated.

Identity — Acceleration, and the SGNL Zero-Standing-Privilege Bet

Next-gen identity ended FY26 above $520M ARR, +34% YoY — a double-digit acceleration versus two quarters ago. PAM grew 170% sequentially and Falcon Shield 300% YoY (5x since the Adaptive Shield acquisition) as SaaS/agentic-identity security goes mainstream. The newly-closed SGNL.ai acquisition adds zero-standing-privilege, real-time authorization — redefining Zero Trust from static to dynamic access for human and non-human identities.

Assessment: Identity has fully graduated to a confirmed growth leg, and the agentic-identity tailwind (each knowledge worker projected to spawn dozens of agents, each an identity to secure) is a structural multi-year driver. SGNL is well-timed optionality on the non-human-identity explosion. With ~80% of breaches now non-malware/identity-based (per management's threat data), this is strategically central, not peripheral.

Cloud — >$800M and Accelerating on Runtime

Cloud crossed $800M of ending ARR (+35% YoY) with net-new-ARR growth accelerating for a second straight quarter, on continued runtime-protection-led displacements (an 8-figure deal cut mean-time-to-detect-and-respond 90%). The AI-infrastructure buildout is itself a cloud-security demand driver, with Pangea extending Falcon into AI-infrastructure protection.

Assessment: An accelerating $800M+ cloud business that keeps winning runtime displacements against posture-only incumbents is a durable, defensible leg. The competitive question (Wiz/Google) persists, but the runtime moat and consolidation pitch are answering it in CrowdStrike's favor deal by deal.

Endpoint — Second Straight Quarter of Acceleration

The core endpoint base accelerated for a second consecutive quarter, validated by a striking new datapoint: Falcon sensors now detect 1,800 distinct AI applications across ~160M unique instances on customer devices. AI-at-the-edge (desktop AI apps, coding tools, local LLMs, AI browsers) is a genuine endpoint-modernization catalyst, with ~50% of the market still on legacy AV.

Assessment: This decisively retires the "EDR maturation caps growth" bear point from our initiation. The two-thirds of ARR we worried was gravity-bound has re-accelerated on a fresh, durable demand driver — and the new AIDR product turns AI-on-the-endpoint into a net-new monetization surface.

Key Topics & Management Commentary

Overall Management Tone: Triumphant but framework-driven. The register was "best year in company history," but management spent most of the prepared remarks on a forward-looking thesis — that the AI revolution bifurcates software into the "existentially vulnerable" and those who "thrive," with CrowdStrike firmly in the latter as a "net data creator" with a structural, non-cyclical data moat. The CCP and outage were spoken of in the past tense and as a validated success. The only guarded note was the customary refusal to over-quantify nascent AI-security ARR, which management framed as "early innings" with conviction rather than hedging.

1. A Milestone Year: First $1B Net New ARR, $5B ARR, GAAP Profit

"FY26 was CrowdStrike's best year yet, capped by a blockbuster Q4… all-time record net new ARR of $331 million for the quarter, which grew 47% year-over-year… ending ARR of $5.25 billion, crossing the $5 billion milestone… the fastest and only pure-play cybersecurity software company to achieve this." — George Kurtz, CEO

Three firsts landed in one quarter: first $1B+ net-new-ARR year ($1.01B), first $1B+ operating-income year ($1.05B), and the return to GAAP profitability. ARR growth accelerated to 24% at $5B+ scale — a rare combination of size and acceleration.

Assessment: This is thesis-defining. Re-accelerating ARR at $5B scale, with margins and cash flow simultaneously inflecting up, is the financial profile that justifies a premium franchise multiple. The milestone year is the proof that the post-outage recovery is not just complete but has handed off to a structurally faster growth-and-profit phase.

2. The CCP Cohort: From Risk to Best-in-Class

"Accounts that took CCP deals have gross and net retention rates higher than the company average, have shown a strong trend of early renewal, and have already expanded more than twice the total $80 million of ARR value we provided." — Burt Podbere, CFO

The single largest open question from our initiation — how the post-outage commitment cohort would behave at renewal — resolved emphatically. These accounts now retain above the company average and have expanded more than 2x the value extended.

Assessment: This converts our biggest reservation into a tailwind. The CCP was not a discount that lowered price realization; it was a customer-acquisition-and-expansion investment that produced the best-retaining cohort in the base, seeded through Flex. It is the clearest validation that management's post-outage playbook was the right one — and it removes a bear pillar entirely.

3. Falcon Flex Becomes the Go-To-Market

"A major enterprise software player that started with using 1 module, threat intelligence, and spending low 6 figures… through Falcon Flex, this customer is now using 25 modules and spending $86 million in total Flex contract value with us. Flex is creating its own flywheel." — George Kurtz, CEO

Flex ending ARR reached $1.69B (+120% YoY) across 1,600+ customers; reflex penetration hit 23% of the base (from 5% in Q1) at a 26% average lift in ~7 months, with ~100 multiple-time reflexers averaging a further +48%. Management now describes Flex as "how we go to market."

Assessment: The reflex data has matured from "promising early signal" (our Q2 framing) into the demonstrated engine of net-new-ARR acceleration. The $86M-from-$100K example is the consolidation thesis in a single account. Flex's emergence as the default model also means competitors' "copycat" attempts face a first-mover with the broadest module set to draw against — a durable structural advantage.

4. Microsoft Opens Its Marketplace — A Second Hyperscaler Channel

"A few weeks ago, Satya Nadella and I spoke to CrowdStrike's go-to-market team together. We are now open for business on the Microsoft marketplace, and customers can use their Microsoft Azure consumption commitment dollars on Falcon. This is a watershed moment." — George Kurtz, CEO

On top of the AWS default-SIEM placement and ~$1.5B of AWS marketplace TCV (+50% YoY), the Microsoft marketplace opening lets customers spend committed Azure dollars on Falcon — notable given Microsoft is also a security competitor.

Assessment: Two hyperscaler marketplace channels — one of them a competitor's — is a powerful distribution moat that lowers friction and taps pre-committed cloud budgets. The Microsoft thaw is strategically significant: it signals that even a security rival concludes its customers want Falcon. This is under-modeled distribution leverage.

5. The "Two Groups of Software Companies" Thesis

"We see the AI revolution creating 2 disparate groups of software companies: Group 1, those who are now existentially vulnerable… Group 2, those who will thrive. These are mission-critical, trusted infrastructure technologies… net data creators producing novel, fresh and proprietary data." — George Kurtz, CEO

Management's central framing positions CrowdStrike as a "net data creator" running cyber-RLHF at scale — expert-labeled telemetry from MDR analysts and incident responders, a Threat Graph correlating 1T+ events/day — a closed-loop system that frontier models can augment but not replace.

Assessment: This is the most important strategic argument against the "AI commoditizes security software" bear case, and it is well-constructed: the data CrowdStrike generates by stopping real breaches in real time does not exist on the internet for an LLM to train on. We find the moat argument credible and the "net data creator" framing the right lens for the multi-year story.

6. The AI-Security Stack and AIDR

Management mapped the new AI attack surface — GPU foundation, hardware/infra OEMs, neoclouds/hyperscalers, token factories, AI apps/agents — and positioned Falcon to secure all five layers (and to secure the AI leaders themselves). The newly-launched AIDR (AI detection & response, built on Pangea) grew 5x quarter-over-quarter within weeks of launch, giving customers visibility and guardrails into employee AI usage.

Assessment: AIDR is the clearest new monetization surface from the AI wave, and management's framing of it as "the next EDR" (a compliance-driven must-have) is ambitious but directionally plausible given the 1,800-AI-apps-detected datapoint. Early innings, but the 5x ramp is a genuine demand signal, not a roadmap promise.

7. Capital Allocation: Buyback Begins

With GAAP profitability achieved and $5.23B of cash, CrowdStrike began returning capital — repurchasing ~144K shares post-fiscal-year-end with ~$950M remaining under authorization — while continuing disciplined tuck-in M&A (SGNL, Seraphic closed in February). FY27 modeling includes a commission-amortization change (4→5 years, +$85–95M to operating income) offset by acquisition integration costs.

Assessment: The buyback initiation is a maturity marker — a company confident enough in its cash generation to return capital while still investing for 20%+ growth. At a de-rated price, opportunistic repurchase is rational capital allocation. The tuck-in cadence (SGNL, Seraphic, Onum, Pangea) continues the proven integrate-don't-bolt-on track record.

8. Margin Inflection and the FY27 Setup

Record 25% operating margin, record 79% gross margin, and 29% Q4 FCF margin confirm the FY26 trough is behind. FY27 guidance frames FCF margin at ~33% in Q1 and 30%+ for the year, with the CCP revenue separation ending and ARR-to-revenue re-coupling — the structural setup we flagged at the upgrade is now in the official numbers.

Assessment: The FY27 guide validates the second pillar of our Outperform thesis: growth, margin, and cash inflecting together as the outage tail ends. With FY27 revenue guided to 22–23% growth and FCF margin 30%+, the model is compounding on all three axes simultaneously.

Guidance & Outlook

The FY27 ARR outlook was raised relative to prior framework, with net-new-ARR growth of 20–25% on a base that is itself 25% larger — an above-prior-commentary setup that an analyst flagged on the call. The Q1 pipeline entered FY27 up 49% year over year, the underpinning for the guide.

Implied trajectory: FY27 revenue of $5.87–5.93B (+22–23%) marks revenue re-accelerating toward ARR growth as the CCP separation ends — the convergence we underwrote at the upgrade. FCF margin stepping to 30%+ (from 26% in FY26) is the margin half of the same inflection.

Street at: The raised ARR outlook and the $4.78–4.90 EPS guide sit above where the Street had modeled; the muted after-hours reaction reflected a surface read that the headline revenue guide looked in-line, under-weighting the ARR raise and the margin inflection.

Guidance style: CrowdStrike's conservative-revenue/confident-ARR pattern persists, but FY27 is the year the two re-converge — making the ARR raise the cleaner read on the real trajectory.

Analyst Q&A Highlights

The Durability of the SIEM Moat Against Frontier Labs

The sharpest skeptical question of the call probed whether the open-ended SOC-modernization share-capture opportunity is at risk of commoditization from what the frontier AI labs may pursue, and asked management to defend the durability of its moat against architectural commoditization. Management leaned on the "net data creator" framing and the closed-loop, compliance-bound nature of breach prevention.

Q: "There are very much percolating fears that the open-ended SOC modernization share capture opportunity… is perceived to maybe be at more risk from what the frontier labs may or may not be pursuing… how should we very critically think about the durability of your moat from any potential commoditization?"
— Fatima Boolani, Citi

A: "We're a net data creator… we have telemetry that we create from our agents… that is unique… We're able to understand the threats in real time with real-time prevention. That's vastly different than what the LLM providers and frontier models do. Now certainly, we leverage the frontier models… but we're doing this in a platform that is driving consolidation… To be a security vendor, you have to have trust. Customers are driven by compliance, and we are the epicenter of creating this data."
— George Kurtz, CEO

Assessment: This is the central bear/bull debate for all of cybersecurity software, and management's answer is the right one: an LLM can summarize alerts and draft queries, but it cannot generate the real-time, expert-labeled breach telemetry that CrowdStrike produces as a byproduct of stopping attacks, nor can it provide the enforcement and compliance trust that buyers require. The moat is the proprietary, continuously-refreshed data and the closed-loop enforcement — not the model. We judge the commoditization fear over-weighted and view it as the source of the multiple compression that has made the stock cheaper, not a fundamental crack.

Agent Pricing and the Seats-to-Agents Mix Shift

A forward-looking question raised the concern that AI could reduce knowledge-worker seats (a headwind to seat-based pricing) while multiplying agents, and asked how Flex positions CrowdStrike for that mix shift and whether consumption could become a larger part of the growth algorithm.

Q: "There's obviously a lot of concerns… about potentially fewer knowledge worker seats in the future due to AI. The flip side to that is way more agents. So… how do you think about agent pricing? And how well does Flex position customers for this potential mix shift? And could consumption become a bigger element to the growth algorithm?"
— Matt Hedberg, RBC

A: "Industry stats is that each knowledge worker will have 90 AI agents. So even if the mix moves around, we have a massive opportunity to protect AI agents… from what I've seen in different technology shifts, we tend to create more opportunity as technology advances, not less… [Flex] makes it so much easier to help customers very quickly… that's really the model that we're leading with."
— George Kurtz, CEO

Assessment: The seat-compression concern is real for some software categories, but CrowdStrike's exposure is inverted: it secures endpoints, workloads, and now identities/agents, and the agent explosion (90 per knowledge worker, per the cited industry stat) expands the protect-surface far faster than seats could shrink it. Flex, being consumption-flexible rather than seat-locked, is the right model for a world where the unit of protection shifts from humans to agents. This reframes a perceived AI risk as an AI tailwind.

When Securing-AI Becomes Material ARR, and Hyperscaler Share

The opening question asked when securing-AI converts to meaningful ARR (an FY27 story?) and how much of the new AI-security market accrues to pure-play vendors versus the hyperscalers' native security. Management cited AIDR's 5x ramp and drew on the cloud-security precedent.

Q: "When [does] securing AI materialize to ARR meaningfully for you? Is that a fiscal '27 story? And… how much of the new market opportunity goes to pure-play cyber vendors? In cloud, people certainly use the hyperscalers for some of their security needs."
— Joe Gallo, Jefferies

A: "We're still in the early innings, but we continue to ramp in protecting AI and it's happening today in terms of ARR growth… [AIDR] was up 5x quarter-over-quarter… when I started the company in 2011, we pioneered cloud-delivered security… I heard a lot about the hyperscalers actually providing all the security services. Well, that didn't happen… we transact billions through these platforms, and they're a great partner."
— George Kurtz, CEO

Assessment: The cloud-security precedent is the strongest rebuttal to the "hyperscalers will eat security" fear — it was made a decade ago and proved wrong, with CrowdStrike instead transacting billions through hyperscaler marketplaces. Securing-AI is early-innings ARR today (AIDR's 5x ramp is real but off a tiny base); the bigger near-term contribution is the AI tailwind lifting cloud, SIEM, and endpoint. We model securing-AI as a meaningful FY27-and-beyond contributor, not an FY27 number.

FY27 ARR Guide Building Blocks

An analyst noted the FY27 ARR guide implies ~22.5% net-new growth — above prior commentary and off a higher base — and asked for the building blocks, especially the renewal-and-expansion opportunity given how much more CrowdStrike can sell to customers who last transacted years ago.

Q: "Impressive ARR guidance out of the gate for next year, implying 22.5% net new growth, which is above your prior commentary and now off of even a higher base… Can you talk about the building blocks that get you there, and especially the renewal opportunity?"
— Brad Zelnick, Deutsche Bank

A: "It starts with the strong momentum… broad-based demand from all sizes of businesses… that rolled over into Q1 [record pipeline +49% YoY]… we're still benefiting from the consolidation tailwinds… cloud, Next-Gen Identity and Next-Gen SIEM collectively… $1.9 billion… up 45%… endpoint accelerated for the second straight quarter… you combine all those things… [for] the confidence to come out with the guide."
— Burt Podbere, CFO

Assessment: The building blocks are credible and diversified — record pipeline (+49%), newer-three at +45%, endpoint re-acceleration, and Flex/reflex expansion — not reliant on any single driver. Guiding net-new-ARR growth above prior commentary on a 25%-larger base is the opposite of the sandbagging some bears assume; it is management putting conviction behind the durability of the acceleration.

Identity Acceleration: CCP Renewal vs. Net-New

A question sought to disentangle how much of the identity resurgence is CCP/Flex renewal versus genuinely net-new emerging-identity demand, given identity was a popular CCP attach.

Q: "Identity was one of the segments that was part of the CCP incentive plans… How much of the resurgence in growth there on the identity side is renewal of CCP or Flex deals versus net new emerging identity product?"
— Brian Essex, JPMorgan

A: "It's one of the modules everyone wanted, and certainly it was a fan favorite in the days of CCP… once a customer engages with the module, there's an extremely high percentage that they're going to continue to renew… but… compromised identity is really one of the #1 drivers of breaches… we're getting the benefit from the platform consolidation piece, and we're also getting the benefit from having a very mature stack now."
— George Kurtz, CEO

Assessment: Honest framing — it's both. Identity benefited from CCP renewals converting (the high module-renewal rate at work) AND from genuine net-new demand driven by identity being the #1 breach vector. The combination is healthier than either alone: the CCP cohort renews and the threat landscape pulls new demand. With Falcon Shield +300% and PAM +170% sequential, the net-new component is clearly material, not just renewal.

Cloud Competitive Environment and Growth Longevity

An analyst asked how management sees the cloud-security competitive environment and the longevity of cloud growth, given it is the largest of the newer-three.

Q: "The cloud security business… has continued to add a consistent amount of net new ARR dollars… How do you see the competitive environment in cloud security right now? And how do you think about the longevity of the growth in that market?"
— Saket Kalia, Barclays

A: "We focused on… runtime protection… the technology that really is focused on stopping breaches… customers have realized just having the ability to understand exposures doesn't mean you're going to stop the breach… we're giving the customers what they want… the right outcome at a much lower cost than the competitors."
— George Kurtz, CEO

Assessment: The runtime-vs-posture distinction is CrowdStrike's durable competitive wedge in cloud, and the consistent net-new-ARR contribution (now an accelerating $800M+ business) shows it is winning. Longevity is supported by the AI-infrastructure buildout creating new cloud workloads to secure faster than the market matures. We see cloud sustaining 30%+ growth for multiple years.

What They're NOT Saying

1. A standalone securing-AI/AIDR ARR figure. AIDR's "5x QoQ" growth is impressive but unanchored — management gave no absolute dollar base, so the securing-AI opportunity remains a narrative rather than a quantified line. The "next EDR" framing is ambition, not yet ARR.
2. Organic vs. acquired ARR detail for FY27. The guide discloses only $5–8M of acquired net new ARR in Q1 from SGNL/Seraphic and "minimal" thereafter; the absence of a fuller organic/inorganic bridge for FY27 leaves the underlying organic growth rate to be inferred.
3. The Delta and other outage litigation. With the financial outage tail closed (GAAP profit restored), management did not address the status of outage-related litigation, which remains an unquantified legal tail risk.
4. Microsoft marketplace economics. The "watershed" Microsoft marketplace opening was announced without revenue-contribution sizing, ramp timeline, or take-rate — consistent with a new channel, but it leaves a potentially large catalyst unquantified.
5. The net effect of the commission-amortization change on "clean" margins. The 4→5-year commission-amortization change adds $85–95M to FY27 non-GAAP operating income; management disclosed it transparently and offset it with acquisition costs, but it does flatter the FY27 margin optics and warrants adjustment when comparing underlying operating leverage.

Market Reaction

• Pre-print setup: CRWD entered the March 3 print at a close of ~$393.19 — down ~16% year-to-date (from a ~$468.76 start) and ~24% below the ~$515 level at our Q3 upgrade, trading just under its 20-day moving average (~$398.48). The decline was a broad early-2026 software/tech multiple compression, not company-specific — fundamentals improved while the multiple contracted, taking forward EV/sales from ~28x at Q3 to roughly 16–17x.
• After-hours reaction: Muted and modestly lower — down ~0.5% immediately post-call and drifting toward ~−2% as the headline forward revenue guide screened "largely in-line" on a surface read, despite the record ARR, the return to GAAP profit, and the raised FY27 ARR outlook.

The muted after-hours response to a genuinely blockbuster print is the most important — and most favorable — signal for our rating. Consider what the market shrugged at: an all-time-record net-new-ARR quarter, the $5B-ARR milestone, the return to GAAP profitability, a 115% net-retention rate, a second hyperscaler marketplace, and a raised FY27 outlook — delivered into a stock already down 16% on the year. The reflexive "revenue guide looks in-line" read under-weights the ARR raise and the margin/FCF inflection, which are the truer signals. We read the disconnect plainly: the business inflected up across every axis while the price inflected down on a sector-wide de-rate. That is the textbook setup for an Outperform rating to do its job — a great business available at a materially better price than three months ago, with the market's attention elsewhere.

Street Perspective

Debate: Does AI Commoditize Security Software, or Entrench CrowdStrike?

Bull view: CrowdStrike is a "net data creator" running cyber-RLHF at scale — expert-labeled breach telemetry that no LLM can train on — with a closed-loop enforcement model and compliance trust that frontier labs can't replicate. AI is a tailwind: it expands the attack surface (agents, AI apps), drives AIDR/cloud/SIEM demand, and entrenches the data moat. The de-rating on commoditization fears is a misread.

Bear view: Frontier models could collapse the SOC-modernization opportunity by making detection/triage cheap and generic, compressing the value of the SIEM/SOC layer. The whole security-software complex de-rated in early 2026 on exactly this fear, and CrowdStrike's premium leaves it most exposed if the bear is right.

Our take: Strongly bull. The moat is the proprietary, continuously-refreshed breach data and the enforcement/compliance layer — not the model, which CrowdStrike itself leverages. The commoditization fear is what made the stock cheaper, not what will impair the business; we view the de-rate as the opportunity.

Debate: Is the De-Rated Multiple Now Attractive, or a Value Trap?

Bull view: At ~$393, ~16–17x forward sales (from ~28x at Q3) with ARR re-accelerating to 24%, GAAP profitability restored, FCF margin guided to 30%+, and a raised FY27 outlook, the risk/reward is the best it has been in our coverage. Better business, lower multiple. A buyback adds a floor.

Bear view: "Cheaper" is relative — the stock still trades at a premium on near-term P/E, and if the software de-rate continues or AI-commoditization fears deepen, multiple compression can overwhelm fundamental growth regardless of how good the print is.

Our take: Bull, with eyes open. The de-rate has done much of the valuation-risk work that constrained our Q3 upgrade; we are now paying a meaningfully lower multiple for a demonstrably better business. Macro/multiple risk is real and is why this is Outperform, not a table-pounding call — but the entry point is materially improved.

Debate: Can Net New ARR Sustain 20%+ Growth at $5B Scale?

Bull view: FY27 net-new-ARR guided to 20–25% on a 25%-larger base, with a record +49% pipeline, two hyperscaler channels, Flex/reflex compounding, identity and SIEM accelerating, and securing-AI as fresh TAM. The drivers are diversified and durable.

Bear view: The law of large numbers eventually bites — sustaining 20%+ net-new-ARR growth at $5B+ ARR is historically rare, and any single driver disappointing (SIEM, cloud, Flex) could break the guide.

Our take: Bull for FY27, watchful beyond. The diversification of drivers and the raised guide give us confidence in the near term; the multi-year question (can it hold 20% toward $10B ARR) is the right thing to monitor, but nothing in this print suggests the deceleration is imminent — the opposite, ARR re-accelerated.

Model & Valuation Framework

Valuation framework: The de-rate has transformed the setup we underwrote at the Q3 upgrade. Then, the Outperform call required looking past a full ~28x sales multiple to the FY27 inflection. Now, at ~$393 and ~16–17x forward sales, the multiple has compressed ~40% while ARR re-accelerated, GAAP turned positive, retention hit 115%, and FY27 was guided up. On FY27 EPS of $4.78–4.90 the stock trades at ~80x earnings — still optically rich on P/E — but on the metrics that actually drive a hyper-growth SaaS franchise (EV/ARR, EV/FCF on a 30%+-margin business growing ARR 24%), the entry is the most attractive in our coverage. We see a 12-month path back toward the high-$400s/$500s as the software de-rate stabilizes and the FY27 inflection prints, with downside ($330–360) gated by a continued broad multiple compression rather than any company-specific impairment.

What would change our mind (to Hold): a genuine deceleration in net-new-ARR below the guided framework; concrete evidence that frontier-model commoditization is compressing SIEM/SOC economics (pricing pressure, win-rate erosion); a re-acceleration of the broad software de-rate that overwhelms fundamentals; or a re-rating back toward 28x+ without a commensurate fundamental step-up.

Thesis Scorecard: The Arc Through Q4 FY2026

Tracking the bull/bear framework across our three quarters of coverage. Q4 resolved the last major open items.

Overall: The thesis is the strongest it has been. Five of six original bull pillars are confirmed/strengthening (with a sixth, the hyperscaler channel, now doubled), and four of the original bear points are resolved or de-risked — including the two biggest (valuation, via the de-rate; and the CCP cohort, which became a tailwind). The one genuinely active bear is the new, sector-wide AI-commoditization fear, which we judge over-weighted and which is itself the source of the improved entry price.

Action: Maintain Outperform — conviction raised. The business inflected up on every axis while the stock de-rated ~24%. Add on the weakness.

Bottom Line: Better Business, Cheaper Price

This is the rare quarter where almost everything that could go right, did. CrowdStrike posted an all-time-record net-new-ARR quarter (+47% YoY), crossed $5B in ARR with growth still accelerating, returned to GAAP profitability, printed 115% net retention, opened a second hyperscaler marketplace, raised its FY27 outlook, and began returning capital. The two largest reservations from our initiation — whether the CCP cohort would renew, and whether EDR maturation would cap growth — both resolved decisively in the bull's favor: the CCP accounts now retain above the company average, and the endpoint base accelerated for a second straight quarter.

And it is cheaper. When we upgraded to Outperform at Q3, valuation was the lone active risk at ~28x forward sales near $515. Since then a broad early-2026 software de-rate has taken the stock to ~$393 — down ~24% — even as the fundamentals strengthened on every axis. The multiple has compressed roughly 40% while ARR re-accelerated and profitability inflected. That is the opposite of a thesis breaking; it is the market handing a better entry into a better business, with its attention diverted by a sector-wide AI-commoditization fear we judge over-weighted — a fear that CrowdStrike's own "net data creator" moat is built to withstand.

The muted after-hours reaction to a blockbuster print is the tell. The market read a surface-level "in-line revenue guide" and looked past the ARR raise, the GAAP-profit inflection, and the second marketplace channel. We do not. We maintain Outperform with raised conviction and would be adding here, with the FY27 revenue re-acceleration (CCP tail ending) and the 30%+ FCF-margin step-up as the catalysts that close the gap between an improving business and a de-rated price.