CrowdStrike (CRWD) Q4 2026 earnings review
Flawless Execution Erases Outage Memory, GAAP Profitability Reached
CrowdStrike delivered a massive Q4, conclusively putting the July 2024 outage in the rearview mirror. Net new ARR surged 47% YoY to a record $331 million, driving total ARR to $5.25 billion. The trend is clearly Accelerating. Most notably, the company achieved its first positive GAAP net income ($38.7 million) alongside record free cash flow. The 'Falcon Flex' pricing model is successfully forcing vendor consolidation, establishing CrowdStrike as mission-critical AI infrastructure and setting the stage for >20% guided growth next year.
🐂 Bull Case
Falcon Flex is driving massive expansions. Customers are readily dropping legacy SIEM and cloud vendors to consolidate onto CrowdStrike, yielding an Accelerating 24% YoY growth on a massive $5 billion base.
The company crossed a critical maturity threshold with $38.7 million in GAAP net income, silencing bears who pointed to high stock-based compensation as an inhibitor to true profitability.
🐻 Bear Case
The bulk of the hyper-growth is coming from emerging products (SIEM, Cloud, Identity) and the structural shift of Falcon Flex. Core endpoint growth is Decelerating as the market matures.
The DOJ and SEC inquiries related to the July 19th incident and revenue recognition, initiated earlier in the fiscal year, remain a background risk factor.
⚖️ Verdict: 🟢🟢
Extremely Bullish. CrowdStrike passed the ultimate stress test. To suffer a massive global outage in Q2 and exit the fiscal year with record net new ARR, positive GAAP income, and accelerating growth is a masterclass in execution.
Key Themes
Falcon Flex is the Ultimate Consolidation Engine
The Falcon Flex licensing model is fundamentally changing CrowdStrike's trajectory. Ending ARR from Flex accounts reached $1.69 billion, an Accelerating growth rate of over 120% YoY. By removing procurement friction and allowing customers to activate new modules instantly, Flex is driving a powerful 'reflex' motion where customers consume contracts early and re-sign for significantly larger amounts.
Next-Gen SIEM & AI Capabilities Defeating Legacy Rivals
CrowdStrike is successfully positioning itself as the AI-native Security Operations Center (SOC). With Charlotte AI automating threat hunting, and the integration of data pipeline acquisitions like Onum, Falcon Next-Gen SIEM is aggressively displacing legacy solutions like Splunk and QRadar. This is an Accelerating vector for massive deal sizes.
Deepening Identity Security Portfolio
Identity is a key battleground. Following the earlier acquisition of Adaptive Shield, CrowdStrike recently acquired SGNL (Continuous Identity) and Seraphic Security (browser runtime security). This expands the Falcon platform's reach beyond endpoints directly into SaaS and non-human identities, presenting a Stable new TAM.
Regulatory and Legal Tail
Despite the financial recovery, CrowdStrike is still operating under the shadow of a DOJ and SEC inquiry (disclosed in Q1) regarding revenue recognition and the July 19th configuration update. While the financial impact appears muted, the distraction and potential legal costs remain a Stable concern.
Module Adoption Rate Plateauing
The percentage of customers utilizing 8 or more modules hit 24% in Q3 and remained Stable at 24% in Q4. While the absolute number of modules per Flex customer is high, the overall base adoption metrics for the highest tiers are showing signs of friction as customers digest massive platform expansions.
Other KPIs
Accelerating significantly from $239.8M in 25Q4. The FCF margin sits at a highly lucrative 29%. For the full year, FCF was $1.24 billion, demonstrating that the structural cash generation engine was unharmed by the summer outage and partner care concessions.
Stable and expanding. It improved from 80% a year ago, proving that CrowdStrike is retaining exceptional pricing power. The Customer Commitment Packages (CCPs) given out post-outage did not permanently impair unit economics.
Reversing toward profitability. Compare this to an operating loss of -$79.3 million a year ago and -$124.6 million in 26Q1. While technically still an operating loss, the gap has closed almost entirely, driving the net income line positive.
Guidance
Stable. The midpoint implies ~23% YoY growth, maintaining the exact same growth rate achieved in FY26. To hit this, CrowdStrike will need to add over $1.2 billion in Net New ARR over the next 12 months.
Stable. Implies approximately 22% YoY revenue growth, directly in line with the 22% total revenue growth printed for FY26. It shows total resilience in the financial model.
Stable. Implies around 23% YoY growth and sequential acceleration from 26Q4's $1.31 billion, shaking off typical Q1 software seasonality.
Decelerating sequentially. Down slightly from the $1.12 achieved in 26Q4, likely reflecting cyclical payroll taxes, annual merit increases, and front-loaded marketing/R&D investments at the start of the fiscal year.
Key Questions
Falcon Flex Saturation Point
With Falcon Flex accounts now representing over 30% of total ARR and growing at >120%, what does the 'reflex' expansion motion look like in years 3 and 4 once a customer has already consolidated the majority of their SIEM and Cloud workloads?
Regulatory Update
Can you provide an update on the status of the DOJ and SEC requests for information disclosed in Q1 regarding revenue recognition and the July 19th incident?
AWS and Hyperscaler Dynamics
You are pushing hard into Next-Gen SIEM natively within AWS. How are you navigating the competitive friction with hyperscalers' own native security/SIEM offerings as you become deeply embedded in their marketplaces?