CrowdStrike Holdings, Inc.

Hello, and welcome to CrowdStrike's fiscal first quarter 2027 financial results conference call. At this time, all participants are in a listen-only mode. After the speaker's presentation, we will conduct a question and answer session. Please be advised that today's conference is being recorded. I would now like to hand the call over to Andy Nowinski, Vice President of Investor Relations and Strategic Finance. Andy, please go ahead.

Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, Chief Executive Officer and Founder of CrowdStrike, and Bert Podbear, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth, including projections, and expected performance, including our outlook for the second quarter and fiscal year 2027, and any assumptions for fiscal periods beyond that are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events, or otherwise. Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the Company's Annual and Quarterly Reports. Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings release, which may be found on our investor relations website at ir.crowdstrike.com or on our form 8K filed with the SEC today. With that, I will now turn the call over to George.

Thank you, Andy, and thank you for joining CrowdStrike's Q1 FY27 earnings call. We started our fiscal year in an environment where cybersecurity has dramatically risen in organizational visibility and funding priority. CrowdTrack is now being understood as critical AI infrastructure. Frontier AI Lab started a new chapter in the AI revolution. New model releases starting in April connected AI innovation with cybersecurity necessity. CrowdStrike was the only cybersecurity company selected by both Anthropic and OpenAI from the very start to secure these new models, their adoption, and the new risks they create. Today, AI adoption is not a nice to have, it's an existential imperative across every geography and vertical. The more AI an organization adopts, the more cybersecurity it requires. In this new agentic era, We're now guiding net new ARR acceleration for the full year. Q1 highlights included. One, record Q1 net new ARR of 256 million, up 32% year over year and exceeding the high end of our guidance. Two, ending ARR of 5.51 billion, accelerating over our record Q4 and more than 24% growth. Three, total revenue of $1.39 billion, up 26% year over year, beating guidance and accelerating for the fourth consecutive quarter. Four, all-time record free cash flow of $468 million, or 34% of revenue, exceeding our expectations. Our free cash flow rule of 40 was 59, increasing for the fourth consecutive quarter. Five, record QN operating income of $326 million, or 24% of revenue, up 62% year-over-year, exceeding guidance. And six, we added over 300 Falcon Flex accounts in the quarter, with accounts that have adopted this subscription model reaching more than $1.9 billion and ending ARR, growing 99% year-over-year. these data points illustrate momentum traction and achievement it's on the backs of our strong q1 results and the unprecedented market dynamics i see that we are raising our growth expectations for the full year net new arr by more than 500 basis points for the full year we now expect net new arr growth to accelerate over fy26 What I see is AI driving structural demand for cybersecurity that compounds, not decelerates. The AI enterprise is unfolding in real time and CrowdStrike is a necessity to secure it. AI's technology progression has unfolded in waves. Wave one of AI adoption was about making information rapidly accessible and foreshadowing the power of reasoning using existing data points to connect new dots. Wave two of AI adoption started with the agent, transforming what was once a basic web experience into a rich, connected, and human-like digital worker. Agents became a major unlock moment for the enterprise, opening the door to productivity gains and augmentation of human workers. The concept of the agentic workforce was born, and for the first time, enterprises could start pointing to economic value creation and newfound outputs from the AI revolution. This brings us to Q1, right in the middle of Wave 2, the wave of agent creation. In April of Q1, more happened in a matter of weeks in cybersecurity than in the whole year prior, the mythos inflection moment. In collaboration with Anthropic from the start, we saw a new model emerge that had relevance for the cybersecurity market, relevance for defenders in identifying vulnerabilities much faster than before, including the chaining of multiple vulnerabilities to create lethal cyber attacks. Project Glasswing brought together CrowdStrike and a focus group of consequential companies to ensure market readiness for Anthropic's new model. Shortly thereafter, OpenAI announced GPT 5.5 Cyber, later known as Daybreak, where we were selected as a founding member of their trusted access for cyber program. CrowdStrike is the only cybersecurity company to secure both Anthropic and OpenAI's introduction programs from the very start. What the mythos moment proved is that the world, starting from the frontier AI labs themselves, realized that AI needs a cybersecurity ecosystem. This was the mythos inflection point. The discussion evolved from, is AI going to disrupt cybersecurity, to organizations and even the frontier AI labs relying on Falcon as their AI-powered defender for the post-mythos era. Even more consequential is how adversaries can use these new and future models to democratize destruction. Now any human or agent can be a vibe hacker or worse wage serious cyber attacks that threaten enterprise survival, nation state continuity and critical infrastructure operations. AI has now directly entered the world of cybersecurity across two dimensions. One, you need cybersecurity to secure AI itself. Deploying AI across the enterprise is simply too risky without cybersecurity from the start. Cybersecurity is now foundational AI infrastructure. And two, an explosion in greenfield attack surfaces, each of which needs cybersecurity. The AI revolution has led to a boom in, one, hardware, GPUs, MPUs, TPUs, and tranium chips. Two, data centers and hyperscalers, training and housing AI models. Three, neoclouds, a whole new class of cloud focusing on inference. Four, token factories. We're seeing unprecedented, eye-watering demand for anthropic and open AI. And five, agentic applications. A whole new class of agentic tools, such as Cursor, Sierra, 11 Labs, Exa, Lagora, and more. The inflection point is that every player in this value chain is experiencing hypergrowth, and every one of these technologies needs cybersecurity. The mythos moment crystallized the reality for the market. And for the first time in my career, the market's view of cybersecurity's role has shifted from being viewed primarily through the lens of risk management, compliance, and protection to being recognized as a strategic accelerator and a critical enabler of AI adoption. Here's how we're seeing this shift manifest across our ecosystem, customers, and business. As soon as Project Glasswing and Mythos were announced, a deluge of customer, prospect, and partner inquiries followed. Post-Methos threat landscape readiness reached a fever pitch with the primary question being, is my organization protected? The immediate focus turned to uncovering and remediating vulnerabilities susceptible to being weaponized by new models. Answering this question across tens of thousands of organizations created an opportunity to showcase the power of our platform and ecosystem. Within days of Anthropix Project Glasswing and OpenAI's TAC, we announced Project Quiltworks to unite and mobilize the industry around mythos readiness. Quiltworks is a phased process of vulnerability discovery, prioritization, remediation, and then executive communication. RE-protected conversations at executive and board levels quickly became opportunities to leapfrog legacy point-in-time vulnerability discovery. The answer became real-time, continuous discovery and remediation. This conversation plays right into the strength of Falcon's continuous exposure management solution and Falcon for IT, both of which saw adoption nearly double year over year in the quarter. We saw immediate interest from our ecosystem to join our coalition. After the announcement of Project QuiltWorks, Accenture, EY, IBM, Kroll, and OpenAI joined us to use the latest OpenAI and anthropic models for QuiltWorks engagements. And a few weeks later, we expanded the coalition to include Armaden, Cognizant, HCL Tech, Infosys, KPMG, NTT Data, Tata Consultancy Services, and Wipro. And more recently, insurers such as Coalition, Liberty Mutual Insurance, Lockton Resilience, and Marsh joined the coalition to start underwriting frontier AI model risk to the enterprises they serve. Quiltworks engagements include EY engaged with a Fortune 100 account and uncovered more than 45 million vulnerabilities leveraging Falcon exposure management and frontier models. And the engagement is also accelerating next-gen SIM adoption within this account. Kroll, who recently replaced their incumbent next-gen endpoint vendor with CrowdStrike, brought us into a clothing manufacturer, which is becoming a new logo account on the back of a Quiltworks assessment. PutWorks is how we're preparing the market for cybersecurity's Y2K moment with CrowdStrike as the key security control for AI deployment. PutWorks and the AI accelerated demand environment are delivering growth across the business. In Q1, we delivered innovation and saw pronounced demand across the following platform modules. First, endpoint. Our endpoint business again accelerated for the third consecutive quarter. The endpoint has become the epicenter of where AI happens, and our best-in-class efficacy sets us apart. The rapid adoption of AI tools like ClaudeCode and Codex have dramatically expanded the endpoint attack surface. Our endpoint leadership continues to widen with Gartner naming us a leader for the seventh consecutive year and scoring us the very highest on both axes of the magic quadrant ahead of all other participants for the fourth year in a row. Today, we're seeing two new phenomena on the endpoint. First, AI's rapid evolution has created renewed enterprise focus on endpoint security investment. Second, non-human identities and agents require their own underlying hosts, creating greenfield demand for sensors. We're already seeing companies deploying agentic workloads inside virtual machines, each requiring its own sensor. Illustrating this was an eight-figure new logo land in a major U.S. government agency. We replaced a legacy AV, an operating system EDR, and a legacy vulnerability management point product across more than 200,000 hosts. And that unlocks what's next. We pioneered EDR. We have the endpoint real estate. And that gives us the structural advantage to own what we're bringing to the market, AIDR, AI detection and response. AIDR is quickly becoming a new growth pillar in our business, with ending ARR growing more than 250% sequentially and Q2 pipeline already exceeding $50 million. We went from zero to this in under two quarters. In my career, I've never seen adoption happen this fast. As I look forward, I see AIDR as a larger opportunity than EDR. Here's why. First, our structural advantage. We built EDR because the endpoint is where attacks execute and you need a sensor there to see them. The same is true for AI. Agents run on the endpoint. They make tool calls, access files, invoke APIs, and move data at the process level. To detect and respond to AI threats in real time, you need a runtime sensor where AI executes. That's Falcon. While competitors may provide AI visibility, only CrowdTrack can detect, block, and respond where AI actually runs. The pattern that made EDRRs repeats. Second, the AIDR market opportunity is structurally larger. EDR secured one attack surface, the host. AIDR secures seven. Data, models, prompts, agents, identities, infrastructure, and the interaction layer where they converge. Worldwide spending on AI is forecasted to total over $2.5 trillion, and only a low single-digit percent of organizations have an advanced AI security strategy. The gap between AI adoption and AI protection is the widest asymmetry in security since the cloud transition, and it's moving faster. We're already converting the demand. An automotive financial services leader added AIDR to more than 30,000 hosts for shadow AI visibility and protection in a seven-figure win. Greenfield opportunity, seamless upsell, same sensor. Moving to next-gen SIM, cloud, and identity. We saw a record Q1 net new ARR from the combination of these businesses. Combined, these businesses have now exceeded $2 billion in ending ARR. Our next-gen SIEM business exceeded $600 million in ending ARR and has transformed CrowdStrike into the operating system of the AI SOC. Charlotte AI, where ending ARR accelerated sequentially over Q4, is now the reasoning engine across Falcon, triaging alerts, correlating cross-domain telemetry, and automating investigation at machine speed. This quarter, we expanded that vision with AgentWorks, our ecosystem of purpose-built AI agents built on the Falcon platform. Partners including Accenture, AWS, Anthropic, Deloitte, NVIDIA, OpenAI, and Salesforce are building specialized security agents that operate natively on Falcon data. The result, a security operations center that runs at AI speed, orchestrated by Charlotte, extended by the ecosystem, and grounded in the richest telemetry in the industry. A key next-gen SIM win was an eight-figure new logo land in a major fuel retailer. CrowdStrike was selected to replace a legacy SIM, a next-gen EDR, and stitch together software from a network security hardware vendor. The performance and price superiority of next-gen SIM, combined with Charlotte AI's autonomous triage, eliminates swivel chair alert management, successfully starting this customer's AI SOC journey. Cloud had another strong quarter as enterprises continue securing their AI infrastructure. Concern around elevated risk from new frontier models has pushed customers to harden their cloud environments. An eight-figure win in a high-performance AI chip company allowed this customer to secure the rapidly expanding Kubernetes managed data center and cloud environments in the wake of the AI boom. Next-Gen Identity net new ARR growth accelerated versus Q4. In the AI era, every agent needs an identity, every identity needs governance, and every enterprise is realizing they can't tell a human from a machine in their environment. Falcon Shield had another stellar quarter with ending ARR growing nearly 4x year over year as organizations secure their SAS agentic attack surface. Our recently acquired Signal solution and our fast-growing privileged access offering are boasting strong early demand as enterprises lock down what agents can do and access. A major American healthcare company selected Falcon Nextion Identity and Signal in a seven-figure expansion to solve a problem that simply didn't exist two years ago, governing what AI agents can and cannot do across the enterprise. Signal delivers granular policy-based authorization over agentic workloads in real time. This is the identity opportunity in the AI era. Falcon Flex is how we go to market with accounts that have adopted the subscription model rapidly approaching 2 billion and ending ARR. The most exciting part is the Reflex dynamic. Customers renewing and expanding their investment beyond their first Flex contract with highlights including the number of Reflex customers reached 480, representing nearly 25% of all Flex customers. The average Reflex uplift was 26% with the average Reflex happening in seven months, well ahead of their subscription renewal date. And the most compelling, over 130 customers have Reflex multiple times with the average ARR uplift over their original Flex coming in at 51%. Customers are coming back multiple times, and they're continuously spending more, consolidating on CrowdStrike. This is the power of the platform in action. To secure AI, organizations need the Falcon platform. To deliver the platform, you need the right go-to-market model. Flex is the commercial harness to drive secure AI adoption. In closing, I'm proud of the start of our year. Q1 was another beat, and as the quarter progressed, we saw the meet those inflection point. The worlds of cybersecurity and frontier AI collided. The result is that frontier AI needs the very best defender, and that's CrowdStrike. The inflection is now. The need for cybersecurity to defend AI is non-negotiable. CrowdStrike is not only in the right place at the right time, or the right technology to stop the breach. Think of CrowdStrike as the picks and shovels for the world's largest technology gold rush of all time. CrowdStrike is in the prime position to be the world's AI security layer with nearly 100,000 businesses, including hundreds of the Fortune 500, already trusting us to secure their organizations. Our ecosystem of thousands of partners are looking to us for the answers on how to secure AI at global scale. This is even bigger than customers and partners. The market's very best AI talent seeks out CrowdStrike to join our mission. I'm excited to announce Dr. Bartley Richardson joins my leadership team as Chief AI and Autonomous System Officer. He joins CrowdStrike from longtime strategic partner, NVIDIA, where he led agentic AI and cybersecurity AI. Bartley deepens our NVIDIA collaboration and furthers our verticalization of AI into cybersecurity. The best AI talent in the world is choosing to build at CrowdStrike. In this inflection moment, I see CrowdStrike's opportunity larger than ever before. The technology is here, the talent is here, and the market opportunity is here. We're raising our full-year net new ARR guidance by more than $50 million. We now expect full-year net new ARR growth to accelerate over last year. At $5.5 billion in ending ARR, we are accelerating. We see this as the AI tailwind in action. Given the strength of this quarter and our confidence in what's ahead, I'm announcing CrowdStrike's first stock split as a public company. We'll be doing a four for one stock split, making CrowdStrike more accessible for investors to join our mission. Cybersecurity isn't a nice to have in the world of AI. It's a need to have. And CrowdStrike is the innovator of choice, the partner of choice, and the protector of choice for this new accelerated AI world. Thank you for your trust. I'll now turn the call over to Bert Podbear, our CFO.