CrowdStrike Holdings, Inc.

Hello and welcome to CrowdStrike's fiscal second quarter 2027 financial results conference call. At this time, all participants are in a listen-only mode. After the speaker's presentation, we will conduct a question and answer session. Please be advised that today's conference is being recorded. I would now like to hand the call over to Andy Nowinski, Vice President of Investor Relations and Strategic Finance. Andy, please go ahead.

Thank you for your participation today. With me on the call are George Kurtz, Chief Executive Officer and founder of CrowdStrike, and Burt Podbere, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth, including projections, and expected performance, including our outlook for the third quarter and fiscal year 2027 and any assumptions for fiscal periods beyond that, are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events, or otherwise. Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the company's annual and quarterly reports. Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. The discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings release, which may be found on our investor relations website at ir.crowdstrike.com or on our form 8K filed with the SEC today. With that, I will now turn the call over to George.

Thank you, Andy, and thank you for joining CrowdStrike's Q2 FY27 earnings call. When we last spoke, we were just weeks after what we called the mythos moment, an inflection point in cybersecurity. The world came to understand that cybersecurity is a necessity for AI adoption. New models created a new risk environment with no turning back. Recently, this realization became even clearer with the market's newest adversary, AI agents themselves. We told you this was the future, and this future is now a reality. Our previous guidance foreshadowed this conviction, and CrowdStrike's Q2 was our very best quarter in company history. Inflection has become acceleration. Our Q2 results set a new bar. Here's what we delivered. 1. All-time record net new ARR of $333 million accelerating to 51% year-over-year growth and beating the high end of our guidance by more than $45 million. 2. Ending ARR growth accelerated for the fourth consecutive quarter reaching $5.84 billion up more than 25% year-over-year. Total revenue growth accelerated for the fifth consecutive quarter, reaching $1.47 billion, up 26% year-over-year. Q2 record free cash flow of $377 million, or 26% of revenue, growing 33% year-over-year. 5. All-time record operating income of $372 million or 25% of revenue, growing 46% year-over-year. 6. All-time record net new ARR from new logos while both net and gross dollar base retention improved over the prior quarter. 7. All-time record Falcon Flex quarter with ending ARR from accounts that have adopted the Falcon Flex subscription model surpassing $2.29 billion accelerating to 101% year-over-year growth. and 8 FY27 net new ARR guidance increase of 630 basis points. We now expect year-over-year growth of 34% at the midpoint, a 1,150 basis point increase from our initial outlook. The quarter was a sea change for CrowdStrike, and I see these dynamics continuing. We're in an arms race. AI is driving more cyber attacks. AI is driving a clear divide between the cybersecurity companies that solve problems and those that compound problems. CrowdStrike's quarter demonstrates the market trusting us more than ever to secure their adoption of AI with cybersecurity's single platform of choice. The world's adoption of AI is rapidly expanding the attack surface. More models, more agents, more agentic applications, more data, and with that more identities, more permissions, more policies, more cyber attacks, and more risk. Agent proliferation is becoming mainstream to augment work and personal life. Agents are powerful forces for productivity and good. Agents are also human and machine risk multipliers with access to data, continuous operational capability, and limited judgment. We're seeing agents go rogue, swarming to attack and moving beyond their guardrails to autonomously harm. Agents are proving capable of data theft, permission alteration, and full-on command and control at scale, leading to organizational compromise. The agent of today is both a friend and foe. The currency of protection is increasingly presence and speed. Do you have the right technology deployed that can see, prevent, and stop agentic attacks? Do you have the right technology that can outpace an entirely new real-time adversary? The AI threat environment is shining a clear light on which products work and which don't. We see failing products as open doors for agentic adversaries. At CrowdStrike, we don't just stop these breaches. We and our partners help the world recover from them. In this threat landscape, CrowdStrike stands out. Our market-leading cybersecurity services are in high demand. The flywheel we've created of best-in-class incident response services allotted by law firms and insurance brokers translates into best-in-class product outcomes for new customers. Ever since Mythos, we've seen growth in our business, not measured by meetings or calls, but measured by ARR. And we don't see the threat landscape subsiding. Far from it. Demand for AI grows, RTAM driving the need for CrowdStrike. The AI transformation doesn't just necessitate a technological lift and shift. It's necessitating a fundamentally new go-to-market motion, one based on maximizing time-to-value, ecosystem impact, and ROI. The Falcon platform removes friction from cybersecurity, and the go-to-market motion we created with Falcon Flex does the same. Flex is the commercial harness to enable customer success in the agentic era. This quarter, we kicked Falcon Flex activity into high gear with our Flex First go-to-market strategy. Our top 10 deals by deal value were each Flexes, and the results speak for themselves. This quarter, we delivered record Flex deal volume, adding more than 935 Flex accounts. That's more than 10 Flexes every day of the quarter and more Flexes than the last three quarters combined. When Falcon customers convert from standard subscriptions to Flex, we see a greater than 40% average ending ARR uplift. We're not just focused on converting existing customers to Flex. We use Flex from the start with new logo customers. Flex New Logo ARR contributed 34% of Q2 net new ARR a record. We also saw record reflex activity for existing Flex customers with more than 630 accounts having reflexed at least once up 6x year over year. On average, a customer's first reflex happens in eight months from their initial flex. Lastly, we saw record repeat Reflex customers with average ending ARR uplift of 53% from their initial Flex subscription. Falcon Flex wins include a frontier lab that significantly grew with CrowdStrike in an eight-figure ARR deal, using Flex to maintain cost visibility while significantly growing Falcon Cloud security across its rapidly expanding data center infrastructure. A European automotive manufacturer called upon CrowdStrike to replace a next-gen EDR, a legacy SIM, and a legacy vulnerability management product. Landing with an eight-figure net-new Falcon Flex, CrowdStrike delivered superior outcomes and immediate platform consolidation. Our Falcon Flex go-to-market motion unlocks the complete aperture of the Falcon platform. When looking at our Q2 performance, I'm pleased to see strength across so many different product areas. Increasingly, the epicenter of agentic work securing the endpoint is now a top spend priority. CrowdStrike is the leader in endpoint. We're now capitalizing on our ubiquitous endpoint presence to deliver the future of AI security. In Q2, our endpoint business accelerated for the fourth consecutive quarter as customers looked to secure their growing AI attack surface. We're seeing dramatic expansion in agentic work on the endpoint, both through fast-growing tools such as Codex and Claude, as well as custom agentic applications. In sampling our customer base, we've seen more than 400% growth in Claude usage and more than 100% growth in custom agent usage on endpoints in recent months. As enterprises look to deploy these new technologies, they're also seeking ways to contain the new risk created, ranging from code exploitation to data leakage to identity compromise. Instead of turning to science projects or point products, the market is trusting CrowdStrike as critical infrastructure to both enable and safeguard their AI future. A large financial services firm worked with two of our GSI partners to replace a next-gen EDR in an eight-figure flex win. Across more than 100 entities and hundreds of thousands of endpoints, CrowdStrike was selected for the best detection coverage, deployment ease, and the lightest impact. Our endpoint success fuels the adoption of AIDR, a product surging past our expectations. AIDR ending ARR nearly tripled versus Q1 as customers embrace our frictionless approach to AI visibility and security. One of the world's largest banks adopted AIDR in an eight-figure flex win. Immediate AI deployments necessitated security, visibility, and control. We were selected for AI usage visibility and data exfiltration prevention. Demand, adoption, and growth like this is rarely seen. I can't wait to unveil our newest AI security innovations at next week's Falcon conference. Moving to our cloud, identity, and next-gen SIEM businesses, the market is rapidly embracing these products to protect fast-expanding attack services. We delivered record Q2 net new ARR from the combination of these businesses. Unpacking these results, our next-gen SIEM business delivered another banner quarter driven by record Q2 net new ARR. NextGenSim ending ARR surpassed $695 million this quarter as both new and existing customers are standardizing on Falcon as the operating system of the SOC. Our native first-party data advantage coupled with the speed and efficiency of our platform continue to set us apart. Features like Agentworks enable security teams to build, deploy, and manage custom AI security agents, setting the foundation for the AI SOC. In an eight-figure Falcon Flex win, a major American power provider replaced a legacy-acquired sim, selecting next-gen sim over a firewall-first product for technical, speed, and economic superiority. Turning to our identity business, ending ARR grew 34% year-over-year to more than $585 million, driven by strength across our identity product portfolio. Specifically, Falcon Shield had another strong quarter as enterprises looked to secure their third-party agentic applications. Shield ending ARR grew more than 185% year-over-year in Q2. In addition, our privileged account security offering saw stellar adoption with ending ARR growing more than 35x year over year. Rounding out our identity portfolio, we're seeing early success with Signal. Large enterprises are rethinking decades of legacy access controls no longer effective for the agentic era. Instead, they're embracing Signal's real-time, granular access model for both humans and non-human alike. In one customer alone, Signal brokered more than 30 million unique access decisions without friction. A major global financial firm added NextGen Identity to their Falcon deployment following a board-mandated AI security audit. Hand-in-hand with NextGen Identity was an immediate deployment of AIDR where identity protection enabled AI adoption. Moving on to cloud, where ending ARR exceeded $905 million, growing more than 29% year over year. CrowdStrike is the leader in cloud runtime security, which has become an imperative in protecting modern AI workloads. Our customers tell us that point-in-time posture scans are no longer enough to protect against fast-moving threats that now proliferate in seconds. A mega technology conglomerate opted to use Falcon Cloud security for our runtime superiority in an eight-figure ARR win. CrowdStrike now secures this organization's AI cloud and labs because of our build pipeline integration and compatibility with internal tools resonating with their DevOps teams. Finally, we're seeing the mythos moment transform the market's need for exposure management, pressuring antiquated vulnerability management products built for a bygone era. The agentic adversary has broken the exploit sound barrier, and you simply cannot patch vulnerabilities fast enough. As the patch window collapsed, our exposure management business accelerated sequentially in Q2. Falcon Exposure Management offers real-time detection and continuous prioritization to successfully contain a new speed and scale of vulnerability risk. A representative exposure management win included a global religious organization that replaced a legacy vulnerability management product as part of their AI transformation initiatives. In this seven-figure flex, the account also immediately deployed AIDR to bring visibility and control to its AI usage, showcasing CrowdStrike's position to protect against AI threats and govern AI adoption. Our partner ecosystem is mobilized around Falcon and its role in securing AI. Project Quiltworks has united more than 25 of our partners from GSIs to hyperscalers, resellers to ISVs and even distributors and MSPs. To date, our Quiltworks partners are collaborating with us on nearly $400 million of total contract value pipeline. We've seen exceptional engagement from GSI partners, resulting in our GSI business growing nearly 50% year over year, largely focused on next-gen SIEM transformations and vulnerability management needs. Across our MSSP business, we're seeing significant traction in the SMB space with key partners such as Kroll. Three quarters ago, Kroll took a strategic step to migrate all of its customers off a competing next-gen endpoint technology. A majority of customers already successfully migrated to Falcon across 450,000 endpoints. Tracking ahead of plan, Kroll took a major next step with a multi-year flex subscription growing their spend with CrowdStrike by more than three times. This flex addresses platform consolidation and SIEM transformation across Kroll's existing Falcon install base and incoming new customers. In another Q2 win, Accenture standardized on CrowdStrike for its new SMB-focused Accenture Edge business launched in June. Lastly, Q2 showcased the power of our one-of-a-kind cloud marketplace go-to-market motion. Across AWS, Google, and Microsoft, each of our hyperscaler marketplace partners, we saw a record Q2 as customers used their hyperscaler of choice for security investments. In Q2 alone, we transacted more than $600 million in deal value through cloud marketplaces, representing more than 30% year-over-year growth. We quickly saw traction with our Microsoft Marketplace presence, opening a new addressable market. Immediate Microsoft Marketplace wins included. A new logo Australian healthcare provider started using CrowdStrike for SOC transformation in a seven-figure flex. An American manufacturing firm previously used our services and has now expanded to the Falcon platform through a seven-figure flex on Microsoft Marketplace. In closing, Q2 was an incredible quarter where the mythos moment turned into acceleration. Acceleration in net new ARR, acceleration in ending ARR, acceleration in Falcon Flex, acceleration in our ecosystem, acceleration in innovation. We're seeing Endpoint as the epicenter for AI adoption. We're seeing AIDR define a new cybersecurity category. We're seeing next-gen SIM as the operating system of cybersecurity, Falcon Identity becoming the security front door for human and non-human users, and exposure management as mission critical for prioritizing AI risk. Taken together, the Falcon platform is cybersecurity's infrastructure layer for AI adoption. AI adoption is accelerating from frontier labs and open-weight models alike, and we're still in the early innings of the AI revolution. When I look at our business, here's what this acceleration means. Last quarter, we raised our forward net new ARR growth guidance by 520 basis points. And this quarter, we're raising our FY27 year-over-year net new ARR growth outlook by an additional 630 basis points, even more than last quarter. That's a raise to our net new ARR guidance of more than $100 million since the start of the year. Delivery of a quarter like this and this outlook is fueled by the demand environment in our technology team, ecosystem, and customers. The innovation engine is in overdrive. As I shared last quarter, Dr. Bartley Richardson, previously at NVIDIA, has joined us as our Chief AI Autonomous System Officer as part of our long-planned and mutually agreed-upon CTO leadership transition. I also encourage everyone to tune into our investor briefing on Wednesday, September 2nd. Our role in securing enterprises, governments, and economies is vital to AI adoption and mission critical in an AI-first world. I'll now turn the call over to Burt Podbere, CrowdStrike's CFO.