CrowdStrike (CRWD) Q2 2026 earnings review
Net New ARR Reaccelerates Ahead of Schedule, Strong Guidance Signals Return to Growth
CrowdStrike delivered a strong Q2, beating expectations and signaling a key inflection point. Net New ARR (NNARR) grew year-over-year for the first time since the July 2024 outage, reaching $221 million and marking a reacceleration a quarter earlier than management had guided. This performance was driven by strong demand for the AI-native Falcon platform, particularly in Cloud and Next-Gen SIEM. The company raised its full-year guidance for both revenue and profitability, and now forecasts NNARR in the second half of the year to grow at least 40% YoY, a significant acceleration. The strategic acquisition of Onum, a data pipeline firm, is set to further enhance its fast-growing SIEM business.
🐂 Bull Case
The key leading indicator, Net New ARR, returned to positive YoY growth ($221M vs $218M). Management's guidance for at least 40% YoY NNARR growth in the second half of the year signals strong conviction in a sustained recovery and new business momentum.
Emerging products are now at significant scale and growing rapidly. Next-Gen SIEM ARR grew 95% YoY to over $430M, and Cloud Security ARR grew 35% YoY to over $700M, demonstrating successful platform diversification and consolidation.
The acquisition of data pipeline company Onum is a smart tactical move to supercharge the Next-Gen SIEM business by making it faster and cheaper for customers to ingest third-party data, further strengthening its competitive advantage against legacy SIEMs.
🐻 Bear Case
While still solid, the Next-Gen Identity business grew ARR 21% YoY, significantly slower than Cloud (+35%) and SIEM (+95%). Management noted this was a popular offering in post-outage customer packages, which may be temporarily suppressing the reported growth rate.
The company reported a significant GAAP net loss of $77.7 million, a reversal from a $47.0 million profit a year ago. This was driven by $74 million in one-off charges related to the July 2024 outage and a strategic realignment plan.
Non-GAAP operating margin, while strong at 22%, contracted from 25% in the prior-year quarter. This reflects ongoing investments and costs associated with post-incident recovery and strategic initiatives.
⚖️ Verdict: 🟢
Bullish. The confirmed reacceleration in the key Net New ARR metric, coupled with a very strong outlook for the second half, is the most important takeaway. It suggests the business has successfully navigated the post-incident headwinds and is returning to a high-growth trajectory. The strength of the platform businesses, particularly SIEM and Cloud, provides durable growth drivers that outweigh the temporary pressure on GAAP profitability and margins.
Key Themes
The Growth Engine Re-Ignites: Net New ARR Accelerates
The headline of the quarter is the return to year-over-year growth in Net New ARR, which reached $221 million versus $218 million in the prior year. This marks a crucial inflection point, ending the period of decline following the July 2024 incident. Management expressed high confidence this trend will strengthen, guiding for at least 40% YoY growth in Net New ARR for the second half of FY26.
Platform Pillars Demonstrate Hyper-Growth at Scale
CrowdStrike's diversification beyond endpoint security is paying off significantly. The key growth platforms are now multi-hundred-million-dollar businesses. Next-Gen SIEM ARR grew 95% YoY to over $430 million, and Cloud Security ARR grew 35% YoY to over $700 million. Combined with Identity, these solutions now represent over $1.56 billion in ARR, growing more than 40% YoY and driving the platform consolidation narrative.
FalconFlex Model Fuels Consolidation
The FalconFlex licensing model is proving to be a powerful sales driver. The company surpassed 1,000 Flex customers in Q2 and noted that over 100 have already 'reflexed'—returning to purchase more credits ahead of schedule. On average, these 'reflexes' increase the customer's ARR by nearly 50%, demonstrating the model's success in accelerating platform adoption and increasing customer spend.
Identity Protection Growth Moderates
A key area to monitor is the relative growth of the Identity Protection business. At 21% YoY ARR growth ($435M ARR), it lags significantly behind the hyper-growth seen in SIEM and Cloud. Per management on prior calls, this module was a significant component of the post-incident Customer Commitment Packages. This suggests underlying demand may be stronger than the metric indicates, but the business will need to demonstrate reacceleration as those packages expire.
Onum Acquisition to Supercharge Next-Gen SIEM
CrowdStrike announced its intent to acquire Onum, a real-time data pipeline management company. The strategic rationale is to make its Next-Gen SIEM offering even more disruptive by simplifying and accelerating the ingestion of third-party data. Onum's technology claims to reduce data storage costs by 50% and enable 'in-pipeline' detection, which could further differentiate CrowdStrike from legacy SIEM vendors by improving performance and lowering total cost of ownership for customers.
Macro Backdrop: The AI Arms Race
CEO George Kurtz framed the current market as an 'AI arms race' where adversaries are using AI to scale attacks and enterprises are adopting AI, creating new security challenges. This macro trend is a primary driver of demand for CrowdStrike's platform, which aims to secure AI development and deployment from the cloud to the endpoint and protect against AI-powered threats.
Other KPIs
Stable. The company continues to demonstrate strong cash generation, with a free cash flow margin of 24% in the quarter. Management reaffirmed their outlook to exit FY26 with a 27% margin in Q4, expanding to over 30% for the full fiscal year 2027, highlighting a commitment to balancing high growth with increasing profitability.
Reversing. The return to a significant GAAP loss from a profit a year ago was driven by specific, disclosed charges. These included $35.7 million for costs related to the July 2024 outage and $38.4 million for strategic plan-related charges. Excluding these items, the company would have been much closer to GAAP breakeven.
Stable. Platform adoption remains high and steady, with 48% of customers on 6 or more modules, 33% on 7 or more, and 23% on 8 or more. This illustrates the platform's stickiness and the success of the company's strategy to land and expand with more capabilities.
Guidance
Stable. The midpoint of $1.213 billion implies a 20.6% YoY growth rate. This is consistent with the 21% growth reported in Q2, indicating a stabilization of top-line growth after a period of deceleration.
Stable. The midpoint of the raised full-year guidance implies approximately 20.8% YoY growth. While the revenue growth outlook is stable, the underlying business momentum is much stronger, as reflected in the NNARR guidance.
Accelerating. The company significantly raised its full-year outlook for non-GAAP operating income and EPS. This reflects strong operational execution and confidence in delivering improved leverage throughout the remainder of the fiscal year.
Accelerating. This is the most critical piece of guidance. After growing just 1.4% YoY in Q2, this implies a dramatic acceleration in new business bookings in Q3 and Q4. It reflects management's confidence that the impacts of the July 2024 outage are receding and demand drivers are strengthening.