CrowdStrike Holdings, Inc. CRWD

Key data

The business

CrowdStrike sells Falcon, a security platform delivered from the cloud through one lightweight sensor that sits on every laptop, server and cloud workload a company runs. That single agent replaces a rack of separate tools, and the customer keeps adding jobs to it: stopping malware, watching identities, guarding cloud accounts, and now hoovering up security logs in place of the old SIEM systems. You buy one module, then attach more, which is why deferred revenue sits at $4.8B, invoiced up front before the work is recognized. Buyers are enterprises and governments, and no single customer is 10% of revenue, so the base is broad rather than propped on a few whales. The moat is the pain of removal: once that sensor is threaded through every device and its detections trained on your traffic, ripping it out to save money is the kind of project no security chief volunteers for. The thing they hold is one agent where a stack of vendors used to live.

The numbers

The story in the quarters is a loss-maker becoming a profit-maker while it grows. Gross profit compounds steadily, and net income crossed zero two quarters ago.

Gross profit rose 27% year over year in the July quarter, with revenue up in the low twenties, so the recovery from the outage is real and the growth rate has held near where it was. But read the profit honestly: the GAAP operating line was still a $33.2M loss in Q2 FY27 and a $30.6M loss in Q1. The reason net income is positive at all is interest on a $5.0B cash pile plus a tax benefit, not selling software at an operating profit.

The cash tells a cleaner story than the income statement. Operating cash flow compounded near 30% a year and free cash flow with it.

FY26 free cash flow of $1.31B is a 27% margin, genuinely good. The catch sits one line below: stock compensation ran about 23% of revenue on a trailing basis, roughly $1.2B, so a large part of that cash margin is paid for by handing employees shares the reported cash flow never charges. What the market prices at 40 times sales is a widening monopoly. What the filings show is a company whose GAAP operating economics are still slightly negative, rescued into profit by the interest on its own balance sheet. The print that settles which one is true is the operating margin excluding that interest income.

Management

Founder George Kurtz still runs it, and the July 2024 outage he presided over did not cost him the chair. Insiders sold and none bought: 100 sales worth $18.7M over the last year against zero purchases. The watch on that selling held rather than reversed, Kurtz trimmed another $0.9M on August 28 and director Sameer Gandhi $2.4M on September 1, and none of the Form 4s this run disclose a 10b5-1 arrangement, so plan status is not disclosed. Pay is the real dilution: the $175.6M buyback done near $91 a share, the first the company ever ran, is a rounding error against the stock it prints for staff, so the share count keeps drifting up. The one thing management does reliably is clear its own guidance, beating the consensus number in each of the last four quarters.

How it fails or surprises you

Expansion stalls at renewal. The whole case rests on customers adding modules and paying more each year. Deferred revenue of $4.8B is booked, but a slip in net new annual recurring revenue below the low twenties, hidden for a quarter behind that backlog, would crack a 40 times sales multiple fast. The first print to watch is net new ARR next quarter, not the headline revenue.

The profit is really interest income. The fact this memo's bullish read explains least is the GAAP operating loss underneath a positive bottom line. Strip the interest on $5.0B of cash and both recent quarters lose money at the operating line. If rates fall or the cash gets spent on a deal, the "profitability" the multiple leans on thins out or disappears.

Platform consolidation re-accelerates it (right tail). If Falcon Flex pulls budget from the displaced SIEM, identity and cloud point vendors faster than modeled, net new ARR reaccelerates toward the high twenties rather than decelerating. The Street models a slow fade, so it is not paid for today. The tell is net new ARR turning up alongside rising modules per customer.

Closing thoughts

At 40 times sales when peers trade near 5, the monopoly is already in the price. What settles the bet is whether ARR growth stays near 20% quarter after quarter, which you learn every ninety days from the company's disclosed net new ARR figure. What takes longer to settle is whether GAAP operating margins ever turn durably positive, stripped of the interest income that papers over them today, and that story plays out over years, not quarters. The downside materializes faster than the upside: a single stumble in ARR growth reprices a 40-times-sales multiple by half inside a year, as the stock's 85-to-234 range over the last twelve months shows, while the upside is a steady compound that takes patience to collect. What you lose if renewals slow is most of the premium you are paying; what you win if consolidation accelerates is a higher multiple on a larger base, years from now.

The bet is still that big companies keep paying CrowdStrike every year to guard their laptops, servers and cloud from hackers, and keep buying more of its tools. What breaks it is expansion slowing at renewal, and the pair that tells you first is net new ARR against the 40 times sales you are paying for it. If net new ARR decelerates for two straight quarters while the multiple holds, the thesis is wrong regardless of how good the cash flow looks.