CrowdStrike's Q3 2026: Contradictions Emerge on Cloud Strategy, Flex Licensing, and AI's Role in Market Share

Date of Call: December 02, 2025

Financials Results

• Revenue: $1.23B, up 22% YOY (Q3 FY'26)
• EPS: $0.96 per diluted share (non-GAAP), record, exceeding guidance; GAAP net loss $34.0M (includes incident-related and acquisition costs)
• Gross Margin: Total non-GAAP gross margin 78%; non-GAAP subscription gross margin 81% of revenue (increased to 81%)
• Operating Margin: Non-GAAP operating margin 21%, non-GAAP operating income $264.6M (record)

Guidance:

• Q4 FY'26 revenue expected $1.290B–$1.300B (22%–23% YOY)
• Q4 non‑GAAP income from operations $315M–$319M; non‑GAAP net income $282M–$287M
• Q4 diluted non‑GAAP EPS $1.09–$1.11 (21% tax rate, ~258M diluted shares)
• FY'26 revenue $4.797B–$4.807B (21%–22% YOY); FY'26 non‑GAAP income from ops $1.036B–$1.040B; FY'26 non‑GAAP EPS $3.70–$3.72
• Assumptions: low‑to‑mid‑teens sequential net new ARR growth Q3→Q4; 2H net new ARR growth ≥50% YOY; FY'27 net new ARR growth ≥20% vs. raised FY'26 base
• Cash: Q4 FCF margin ~27%; FY'26 FCF margin ~25%; include ~$33M Q4 incident cash payments

Business Commentary:

• Record Financial Performance:
• CrowdStrike reported a record Q3 net new ARR of $265 million, which grew 73% year-over-year, exceeding expectations by more than 10%.
• The growth was driven by increased adoption of the Falcon Flex subscription model and strong demand for its single platform solution.

• Endpoint Business Acceleration:
• CrowdStrike’s endpoint business accelerated, with a large government agency replacing more than 75,000 legacy endpoints with CrowdStrike.

• This growth is attributed to the adoption of AI-driven applications on endpoints, creating new risk vectors that require enhanced security measures.

• Success in the Enterprise Market:

• Ending ARR reached $4.92 billion, accelerating to 23% growth year-over-year, with more than $1.35 billion from accounts adopting the Falcon Flex model.

• This success is due to the company’s strategy of providing a unified single platform solution for cybersecurity, driving consolidation and lower total cost of ownership.

• Partnership and Product Integration:

• CrowdStrike announced a strategic partnership with AWS, integrating its Falcon Next-Gen SIEM into AWS’s Security Hub console.
• This partnership enhances CrowdStrike's market reach and position as the preferred SIEM solution for AWS customers, driven by the need for integrated security data lakes.

Sentiment Analysis:

Overall Tone: Positive

• Management repeatedly described a "fantastic" and "record" quarter: record net new ARR $265M (up 73% YOY), ending ARR $4.92B (accelerating to 23% YOY), record Q3 free cash flow $296M (24% of revenue), and record non‑GAAP operating income $264.6M (21% margin). Commentary emphasized broad‑based acceleration across Next‑Gen SIEM, Cloud, Identity and endpoint and a strong pipeline.

Q&A:

• Question from Brian Essex (JPMorgan Chase & Co): Color on how emerging segments (post‑CCP) are behaving and any sense of seasonality/organic seasonality for net new ARR?
  Response: Emerging segments—Next‑Gen SIEM, Identity and Cloud—performed very strongly and helped drive Flex adoption; Pangea/Onum had de minimis ARR/revenue impact this quarter and will roll into platform in Q4.

• Question from Saket Kalia (Barclays): What value do you capture when displacing legacy SIEMs and what is the timetable for legacy SIEM renewals?
  Response: Next‑Gen SIEM displaces legacy SIEM by leveraging existing EDR telemetry to deliver better outcomes and disruptive pricing; adoption is a multiyear activation/upsell journey accelerated by Flex.

• Question from Matthew Hedberg (RBC Capital Markets): Do you see further push into observability and is that a consolidation opportunity?
  Response: Yes—CrowdStrike already has observability tech (LogScale/Humio) and Onum's pipeline fabric; customers use the platform for observability today and we see clear consolidation opportunities.

• Question from Gabriela Borges (Goldman Sachs): Is Flex producing an elevated but temporary tailwind to NRR because early adopters are your best customers or is it durable?
  Response: Flex is designed to be a durable, continuous tailwind—making it easier to buy more, driving bigger and longer deals and sustained consolidation-driven expansion.

• Question from Daniel Ives (Wedbush): How has AI changed customer conversations recently and how does CrowdStrike sit relative to competitors?
  Response: Customers are moving beyond chatbots to embedded automation—Charlotte and AgentWorks are deployed as actionable agents in the platform, accelerating SOC productivity and platform adoption.

• Question from Joseph Gallo (Jefferies): Which products could drive outsized growth next year and is AI security already in FY'27 guidance?
  Response: Next‑Gen SIEM, Cloud/runtime protection and Falcon Shield are primary upside drivers; AI security is a multi‑year opportunity we’re doubling down on but not isolated as a separate line item in FY'27 guidance.

• Question from Fatima Boolani (Citigroup): Does the deeper AWS partnership preclude or complicate relationships with other hyperscalers or multi‑cloud customers?
  Response: No—AWS partnership is additive and designed to enable customer acquisition; CrowdStrike will continue to work across partners and support multi‑cloud customers.

• Question from Meta Marshall (Morgan Stanley): Is endpoint acceleration due to more endpoints being protected, smarter endpoints, or modernization tied to AI adoption?
  Response: Endpoint acceleration is driven by AI adoption at the endpoint creating new exposure and modernization demand—large runway remains to replace legacy AV.

• Question from Patrick Edwin Colville (Scotiabank): How are you thinking about discounting levels going forward post‑CCP—will they diminish?
  Response: Some discounting is normal; we use tools like CCP and Flex judiciously to preserve price and margins—no abnormal discounting expected and gross margins remain protected.

• Question from Eric Heath (KeyBanc): Does the F5 partnership expand endpoint TAM by enabling agents on appliances and is this applicable to other infrastructure?
  Response: Yes—certifying the agent on F5 appliances opens a new appliance protection market and is expected to be a template for other appliance vendors, expanding TAM.

• Question from Roger Boyd (UBS): Walk through the long‑term MSSP/MSP opportunity highlighted by the Kroll deal beyond endpoint landing spots.
  Response: Kroll is a scalable MSSP channel: the rip‑and‑replace migration (nearly 0.5M endpoints) illustrates how partner-led models accelerate penetration and create repeatable ecosystem opportunities.

• Question from Tal Liani (BofA Securities): Can you discuss segmentation (SMB trends) and will you disclose NRR/GRR?
  Response: CrowdStrike sells across all segments successfully; dollar‑based net and gross retention rates will be provided at the end of Q4 (annual disclosure).

• Question from John Jeffrey Hopson (Needham): How are you approaching buy vs build for fast‑evolving AI capabilities?
  Response: We’ll be opportunistic and strategic—buy best‑of‑breed, integrate thoughtfully (example: Pangea), and leverage a strong balance sheet to support buy/build/partner choices.

• Question from Adam Borg (Stifel): Update on PAM and identity product maturity and roadmap?
  Response: Identity/PAM is maturing with customer demand for modern, just‑in‑time capabilities; we’ve seen PAM wins and will continue building out the identity stack.

Contradiction Point 1

Cloud Strategy and Market Focus

It highlights a shift in focus regarding the company's cloud strategy and market positioning, which impacts its competitive stance and product development priorities.

How does a stronger partnership with AWS affect your relationships with other hyperscalers and multi-cloud customers? - Fatima Boolani (Citigroup Inc.)

2026Q3: AWS is the first path, and we'll then follow that with Google Cloud and Azure, and then other hyperscalers, so I think that's the best way for us to go to market. - George Kurtz(CEO)

What is your strategy for cloud-native attack surface, and how are CNAPPs positioned in the shift-left approach? - Jonathan Ruykhaver (Cantor Fitzgerald & Co.)

2026Q2: We focus on shift left opportunities, using ASPM and container scanning to identify vulnerabilities. Our AI capabilities are crucial for understanding interdependencies and solving these challenges effectively. - George Kurtz(CEO)

Contradiction Point 2

Customer Retention and Flex Licensing Model

It involves differing perspectives on customer retention and the impact of the Flex licensing model, which are crucial for understanding the company's growth trajectory and customer satisfaction.

How sustainable is the tailwind Flex is driving in the model? - Gabriela Borges (Goldman Sachs Group)

2026Q3: Flex licensing drives continuous net new ARR, making it easier for customers to buy more. This leads to bigger, longer deals and consolidated spending, driving customer retention and module adoption. - Burt Podbere(CFO)

How do you view customer retention given the 40% YoY net new ARR growth in the second half? - Saket Kalia (Barclays Bank PLC)

2026Q2: We're confident in customer retention, with a high renewal rate of modules once adopted. CCP packages will roll into renewals in Q3 and Q4. Flex has been instrumental in seeding the market and enabling re-Flex, leveraging the CCP program to facilitate adoption. - George Kurtz(CEO)

Contradiction Point 3

Impact of CCP on Revenue and ARR Growth

It highlights differing explanations about the impact of the CCP program on revenue and ARR growth, which could affect investor expectations and financial strategy.

Can you clarify how these segments are performing as you lap last year's initial CCP initiatives? Can you provide insight into the organic seasonality of net new ARR? - Brian Essex(JPMorgan Chase & Co)

2026Q3: Net new ARR and revenue growth acceleration expected in Q4. - Burt Podbere(CFO)

Why is CCP pressuring short-term revenue growth and causing a divergence between revenue growth and ARR growth? Why do you expect ARR growth to accelerate in the second half? - Tal Liani(BofA Securities)

2026Q1: ARR growth reacceleration driven by product momentum in Next-Gen SIEM, identity, and cloud, along with increased adoption and re-Flexes through Falcon Flex. - Burt W. Podbere(CFO)

Contradiction Point 4

Role of Flex Licensing in Revenue and ARR Growth

It involves differing explanations about the role of Flex licensing in driving revenue and ARR growth, which could impact strategic decisions around licensing and pricing.

How sustainable is Flex's role as a growth driver in the model? - Gabriela Borges(Goldman Sachs Group)

2026Q3: Flex licensing drives continuous net new ARR, making it easier for customers to buy more. - Burt Podbere(CFO)

What products are benefiting most from Falcon Flex adoption? How is the sales motion changing as Falcon Flex becomes more widely adopted? - Saket Kalia(Barclays)

2026Q1: Falcon Flex has been a real home run for adoption. Customers ask for it and partners can talk about it. - George R. Kurtz(CEO)

Contradiction Point 5

AI and Endpoint Market Share

It discusses the role of AI in endpoint market share expansion and the impact on EDR acceleration.

What's driving the acceleration in EDR and how it relates to AI? - Meta Marshall (Morgan Stanley)

2026Q3: AI adoption creates new risk vectors at endpoints. CrowdStrike is positioned to monitor and mitigate these risks, with a long runway for further endpoint market share expansion. - George Kurtz(CEO)

What is the current endpoint market share growth and its stickiness? What were the West Coast deal win rates during the quarter, and how have they trended? - James Cordwell (Barclays)

2025Q4: We are seeing a greater percentage of our endpoint market share driven by Falcon Enterprise's ability to not only meet, but exceed, the security requirements of the world's largest enterprises. - George Kurtz(CEO)