tkalAI Capital Flows
Earnings deep dive · Tier K Cyber

CrowdStrike Q2 FY27 — Net New ARR Growth Guided Down 20 Points. The Stock Went Up 20%.

The quarter is not in dispute and I am not going to pretend otherwise. Revenue $1.47 billion, up 26%. Record net new ARR of $332.8 million, up 51%. Ending ARR $5.84 billion, up 25%. Non-GAAP operating income $371.6 million at a 25% margin, up 350 basis points; free cash flow $377.4 million at a 26% margin; a third consecutive quarter of positive GAAP net income. The stock closed $227.95 against $189.18, up 20.5%. Here is the claim I will defend: the record and the raise are two different things, and only one of them is evidence. Net new ARR grew 51% in the quarter just reported and is guided to grow 29 to 31% in the quarter that follows — roughly twenty points of deceleration in a single step derived, inside the release the tape read as acceleration. The full-year midpoint is where the raise actually went. Take the FY27 ending-ARR guidance midpoint of $6,607.45 million, subtract the Q3 midpoint of $6,186.4 million, and the fourth quarter has to produce roughly $421 million of net new ARR derived — about 27% above the record CrowdStrike just set, and about 22% above its own Q3 guide. Management never said that number out loud. Thirteen analysts asked one question each, and none of them asked for it. The engine that produced the record is a licensing conversion: 935 new Falcon Flex accounts in one quarter, more than the prior three combined, carrying a 40% uplift at conversion and another 25% at the first re-Flex. That is a ladder. The rungs are finite. Not investment advice.
Published · Post-print analysis (Q2 FY27, quarter ended ; reported after the close ; earnings call same evening) · NASDAQ: CRWD · All per-share figures split-adjusted for the four-for-one effected · Committed analyst read — not advice · For analysts covering cybersecurity, platform software, and AI security

The quarter, stated plainly

Total revenue was $1,470,897 thousand against $1,168,952 thousand, up 26%, the fifth consecutive quarter of revenue acceleration. Subscription revenue was $1,400,291 thousand against $1,102,945 thousand, up 27%. Professional services was an all-time record $70,606 thousand. Annual recurring revenue reached $5.84 billion, up more than 25%, of which $332.8 million was net new ARR added in the quarter, up 51% and beating the high end of guidance by more than $45 million.

Profitability moved the right way and moved a lot. GAAP loss from operations narrowed to $33.2 million from $105.5 million. Non-GAAP income from operations was $371.6 million against $255.0 million, a 25% margin, up 350 basis points. GAAP net income attributable to CrowdStrike was $5.3 million, or $0.01 diluted, against a loss of $70.2 million and $(0.07). Non-GAAP net income attributable was $322.9 million against $237.4 million, or $0.31 diluted against $0.23. Non-GAAP subscription gross margin was 81% against 80%, up approximately 90 basis points, against an FY29 target model of 82 to 85%. Total non-GAAP gross margin was 79%, up approximately 110 basis points. Net cash from operations was $530,268 thousand against $332,832 thousand; free cash flow was $377,407 thousand against $283,616 thousand, a 26% margin against 24%. Cash and cash equivalents were $5,013,847 thousand against long-term debt of $746,216 thousand.

The platform disclosures are the ones that carried the narrative. Module adoption for subscription customers was 51%, 35% and 26% at six or more, seven or more and eight or more modules. Ending ARR from accounts that have adopted Falcon Flex surpassed $2.29 billion, accelerating to 101% growth. Next-gen SIEM ending ARR surpassed $695 million, up 60%; identity ending ARR was more than $585 million, up 34%, with Falcon Shield up more than 185%; cloud ending ARR was over $905 million, up 29%. Those three together were $2.1 billion of ending ARR, up 39%. Cloud marketplaces transacted $600 million of deal value, up more than 30%. Kroll migrated 450,000 endpoints off a competing next-gen endpoint product and grew its spend more than 3x.

That is a very good quarter. It is not the argument.

Two numbers that do not sit together

The release and the call were built around one word, and the word was acceleration — ending ARR accelerating a fourth consecutive quarter, revenue a fifth, net new ARR growth going to 51%, Kurtz saying “Inflection has become acceleration.” The tape agreed emphatically. CRWD closed $227.95 against $189.18, a gain of $38.77 or 20.5% derived, on a name that had already gained nearly 60% year to date and more than 80% over twelve months coming in.

Now put the guidance next to it. Third-quarter ending ARR is guided to $6,184.4 to $6,188.4 million, which management itself translated to net new ARR of $343 to $347 million, up 29 to 31%. Revenue growth is guided from 26% in Q2 down to 23 to 24% in Q3, with 25% for the full year. So the metric that just grew 51% is guided to grow about 30% one quarter later, and the metric that just grew 26% is guided to slow.

Both of those numbers were read aloud on the same call, by the same CFO, twenty minutes apart. One was called a record. The other was called guidance. Nobody put them side by side.

The fourth quarter nobody named

Here is the arithmetic that decides this print, and every input is a number CrowdStrike published. Full-year FY27 ending ARR is guided to $6,603.0 to $6,611.9 million, a midpoint of $6,607.45 million. Third-quarter ending ARR is guided to a midpoint of $6,186.4 million. The difference is what the fourth quarter has to deliver: approximately $421.05 million of net new ARR derived.

Against the Q3 guided midpoint of about $345 million, that is a sequential step-up of roughly 22% derived. Against the $332.8 million record CrowdStrike just celebrated, it is roughly 27% higher derived. The entire raise is back-end weighted into a quarter that has not started, guided by a company that just told you the intervening quarter decelerates by twenty points.

None of that is hidden. It is two subtractions on two guidance midpoints printed in the same table. It was not stated by management on the call, and it was not asked about by any of the thirteen analysts who were permitted a question. This is the house edge in its plainest form — the gap between the narrative and what the data supports — and here the gap is not in the data quality. It is in which arithmetic got done out loud.

Paid subscribers

The rest of this dive is for paid subscribers.

The headline numbers and the implied fourth quarter are above. The eight sections below carry the Flex conversion mechanism, the decomposition of the raise, the bull case argued at full strength, the balance sheet underneath the growth, the peer tape, the trade, and the dated test that settles it.

  • The ladder: what a Flex conversion actually monetizes, and how many rungs are left
  • The raise outran the beat by about $71 million — and the CFO said so
  • Nobody asked: thirteen analysts, one question each, no follow-ups
  • The bull case at full strength, and it is not weak
  • What the growth cost: SBC +44%, capex 4.1×, deferred revenue +1.87%
  • The peer tape, and 39× revenue against a consensus target below spot
  • The trade, and the constraint on it
  • What would prove me wrong — and the bottom line
Subscribe to unlock →

Already a subscriber? Sign in.

Sources