CrowdStrike Holdings, Inc. (CRWD) Q2 2027 Earnings Report, Transcript and Summary

Hello, and welcome to CrowdStrike's Fiscal Second Quarter 2027 Financial Results Conference Call. [Operator Instructions] Please be advised that today's conference is being recorded. I would now like to hand the call over to Andy Nowinski, Vice President of Investor Relations and Strategic Finance. Andy, please go ahead.

Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, Chief Executive Officer and Founder of CrowdStrike; and Burt Podbere, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth, including projections and expected performance, including our outlook for the third quarter and fiscal year 2027 and any assumptions for fiscal periods beyond that are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise. Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the company's annual and quarterly reports. Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today. With that, I will now turn the call over to George.

Thank you, Andy, and thank you for joining CrowdStrike's Q2 FY '27 Earnings Call. When we last spoke, we were just weeks after what we called the Mythos moment, an inflection point in cybersecurity. The world came to understand that cybersecurity is a necessity for AI adoption. New models created a new risk environment with no turning back. Recently, this realization became even clearer with the market's newest adversary, AI agents themselves. We told you this was the future, and this future is now a reality. Our previous guidance foreshadowed this conviction, and CrowdStrike's Q2 was our very best quarter in company history. Inflection has become acceleration. Our Q2 results set a new bar. Here's what we delivered. One, all-time record net new ARR of $333 million, accelerating to 51% year-over-year growth and beating the high end of our guidance by more than $45 million. Two, ending ARR growth accelerated for the fourth consecutive quarter, reaching $5.84 billion, up more than 25% year-over-year. Three, total revenue growth accelerated for the fifth consecutive quarter, reaching $1.47 billion, up 26% year-over-year. Four, Q2 record free cash flow of $377 million or 26% of revenue, growing 33% year-over-year. Five, all-time record operating income of $372 million or 25% of revenue, growing 46% year-over-year. Six, all-time record net new ARR from new logos, while both net and gross dollar-based retention improved over the prior quarter. Seven, all-time record Falcon Flex quarter with ending ARR from accounts that have adopted the Falcon Flex subscription model surpassing $2.29 billion, accelerating to 101% year-over-year growth. And eight, FY '27 net new ARR guidance increase of 630 basis points. We now expect year-over-year growth of 34% at the midpoint, a 1,150 basis point increase from our initial outlook. The quarter was a sea change for CrowdStrike, and I see these dynamics continuing. We're in an arms race. AI is driving more cyber-attacks. AI is driving more cyber spending. AI is driving a clear divide between the cybersecurity companies that solve problems and those that compound problems. CrowdStrike's quarter demonstrates the market trusting us more than ever to secure their adoption of AI with cybersecurity's single platform of choice. The world's adoption of AI is rapidly expanding the attack surface, more models, more agents, more agentic applications, more data and with that, more identities, more permissions, more policies, more cyberattacks and more risk. Agent proliferation is becoming mainstream to augment work and personal life. Agents are powerful forces for productivity and good. Agents are also human and machine risk multipliers with access to data, continuous operational capability and limited judgment. We're seeing agents go rogue, swarming to attack and moving beyond their guardrails to autonomously harm. Agents are proving capable of data theft, permission alteration and full-on command and control at scale, leading to organizational compromise. The agent of today is both a friend and foe. The currency of protection is increasingly presence and speed. Do you have the right technology deployed that can see, prevent and stop agentic attacks? Do you have the right technology that can outpace an entirely new real-time adversary? The AI threat environment is shining a clear light on which products work and which don't. We see failing products as open doors for agentic adversaries. At CrowdStrike, we don't just stop these breaches. We and our partners help the world recover from them. In this threat landscape, CrowdStrike stands out. Our market-leading cybersecurity services are in high demand. The flywheel we've created of best-in-class incident response services, lauded by law firms and insurance brokers, translates into best-in-class product outcomes for new customers. Ever since Mythos, we've seen growth in our business, not measured by meetings or calls, but measured by ARR. And we don't see the threat landscape subsiding, far from it. Demand for AI grows our TAM, driving the need for CrowdStrike. The AI transformation doesn't just necessitate a technological lift and shift. It's necessitating a fundamentally new go-to-market motion, one based on maximizing time to value, ecosystem impact and ROI. The Falcon platform removes friction from cybersecurity and the go-to-market motion we created with Falcon Flex does the same. Flex is the commercial harness to enable customer success in the agentic era. This quarter, we kicked Falcon Flex activity into high gear with our Flex-first go-to-market strategy. Our top 10 deals by deal value were each Flexes and the results speak for themselves. This quarter, we delivered record Flex deal volume, adding more than 935 Flex accounts. That's more than 10 Flexes every day of the quarter and more Flexes than the last 3 quarters combined. When Falcon customers convert from standard subscriptions to Flex, we see a greater than 40% average ending ARR uplift. We're not just focused on converting existing customers to Flex. We use Flex from the start with new logo customers. Flex new logo ARR contributed 34% of Q2 net new ARR, a record. We also saw record Re-Flex activity for existing Flex customers, with more than 630 accounts having Re-Flex at least once, up 6x year-over-year. On average, a customer's first Re-Flex happens in 8 months from their initial Flex. Lastly, we saw record repeat Re-Flex customers with average ending ARR uplift of 53% from their initial Flex subscription. Falcon Flex wins include a frontier lab that significantly grew with CrowdStrike in an 8-figure ARR deal using Flex to maintain cost visibility while significantly growing Falcon Cloud security across its rapidly expanding data center infrastructure. A European automotive manufacturer called upon CrowdStrike to replace a next-gen EDR, a legacy SIEM and a legacy vulnerability management product. Landing with an 8-figure net new Falcon Flex, CrowdStrike delivered superior outcomes and immediate platform consolidation. Our Falcon Flex go-to-market motion unlocks the complete aperture of the Falcon platform. When looking at our Q2 performance, I'm pleased to see strength across so many different product areas. Increasingly, the epicenter of agentic work, securing the endpoint, is now a top spend priority. CrowdStrike is the leader in endpoint. We're now capitalizing on our ubiquitous endpoint presence to deliver the future of AI security. In Q2, our endpoint business accelerated for the fourth consecutive quarter as customers look to secure their growing AI attack surface. We're seeing dramatic expansion in agentic work on the endpoint, both through fast-growing tools such as Codex and Claude as well as custom agentic applications. In sampling our customer base, we've seen more than 400% growth in Claude usage and more than 100% growth in custom agent usage on endpoints in recent months. As enterprises look to deploy these new technologies, they're also seeking ways to contain the new risk created, ranging from code exploitation to data leakage to identity compromise. Instead of turning to science projects or point products, the market is trusting CrowdStrike as critical infrastructure to both enable and safeguard their AI future. A large financial services firm worked with two of our GSI partners to replace a next-gen EDR in an 8-figure Flex win. Across more than 100 entities and hundreds of thousands of endpoints, CrowdStrike was selected for the best detection coverage, deployment ease and the lightest impact. Our endpoint success fuels the adoption of AIDR, a product surging past our expectations. AIDR ending ARR nearly tripled versus Q1 as customers embrace our frictionless approach to AI visibility and security. One of the world's largest banks adopted AIDR in an 8-figure Flex win. Immediate AI deployments necessitated security, visibility and control. We were selected for AI usage visibility and data exfiltration prevention. Demand, adoption and growth like this is rarely seen. I can't wait to unveil our newest AI security innovations at next week's Falcon Conference. Moving to our cloud, identity and next-gen SIEM businesses. The market is rapidly embracing these products to protect fast-expanding attack surfaces. We delivered record Q2 net new ARR from the combination of these businesses. Unpacking these results, our next-gen SIEM business delivered another banner quarter driven by record Q2 net new ARR. Next-gen SIEM ending ARR surpassed $695 million this quarter as both new and existing customers are standardizing on Falcon as the operating system of the SOC. Our native first-party data advantage, coupled with the speed and efficiency of our platform, continue to set us apart. Features like AgentWorks enable security teams to build, deploy and manage custom AI security agents, setting the foundation for the AI SOC. In an 8-figure Falcon Flex win, a major American power provider replaced a legacy acquired SIEM, selecting next-gen SIEM over a firewall-first product for technical, speed and economic superiority. Turning to our identity business. Ending ARR grew 34% year-over-year to more than $585 million, driven by strength across our identity product portfolio. Specifically, Falcon Shield had another strong quarter as enterprises look to secure their third-party agentic applications. Shield ending ARR grew more than 185% year-over-year in Q2. In addition, our privileged account security offering saw stellar adoption with ending ARR growing more than 35x year-over-year. Rounding out our identity portfolio, we're seeing early success with Signal. Large enterprises are rethinking decades of legacy access controls, no longer effective for the agentic era. Instead, they're embracing Signal's real-time granular access model for both humans and non-human alike. In one customer alone, Signal brokered more than 30 million unique access decisions without friction. A major global financial firm added next-gen identity to their Falcon deployment following a Board-mandated AI security audit. Hand-in-hand with next-gen identity was an immediate deployment of AIDR, where identity protection enabled AI adoption. Moving on to cloud, where ending ARR exceeded $905 million, growing more than 29% year-over-year. CrowdStrike is the leader in cloud runtime security, which has become an imperative in protecting modern AI workloads. Our customers tell us that point-in-time posture scans are no longer enough to protect against fast-moving threats that now proliferate in seconds. A mega technology conglomerate opted to use Falcon Cloud Security for our runtime superiority in an 8-figure ARR win. CrowdStrike now secures this organization's AI cloud and labs because of our build pipeline integration and compatibility with internal tools, resonating with their DevOps teams. Finally, we're seeing the Mythos moment transform the market's need for exposure management, pressuring antiquated vulnerability management products built for a bygone era. The agentic adversary has broken the exploit sound barrier, and you simply cannot patch vulnerabilities fast enough. As the patch window collapsed, our exposure management business accelerated sequentially in Q2. Falcon Exposure Management offers real-time detection and continuous prioritization to successfully contain a new speed and scale of vulnerability risk. A representative exposure management win included a global religious organization that replaced a legacy vulnerability management product as part of their AI transformation initiatives. In this 7-figure Flex, the account also immediately deployed AIDR to bring visibility and control to its AI usage, showcasing CrowdStrike's position to protect against AI threats and govern AI adoption. Our partner ecosystem is mobilized around Falcon and its role in securing AI. Project QuiltWorks has united more than 25 of our partners from GSIs to hyperscalers, resellers to ISVs, and even distributors and MSPs. To date, our QuiltWorks partners are collaborating with us on nearly $400 million of total contract value pipeline. We've seen exceptional engagement from GSI partners, resulting in our GSI business growing nearly 50% year-over-year, largely focused on next-gen SIEM transformations and vulnerability management needs. Across our MSSP business, we're seeing significant traction in the SMB space with key partners such as Kroll. Three quarters ago, Kroll took a strategic step to migrate all of its customers off a competing next-gen endpoint technology. A majority of customers already successfully migrated to Falcon across 450,000 endpoints. Tracking ahead of plan, Kroll took a major next step with a multiyear Flex subscription, growing their spend with CrowdStrike by more than 3x. This Flex addresses platform consolidation and SIEM transformation across Kroll's existing Falcon installed base and incoming new customers. In another Q2 win, Accenture standardized on CrowdStrike for its new SMB-focused Accenture Edge business launched in June. Lastly, Q2 showcased the power of our one-of-a-kind cloud marketplace go-to-market motion across AWS, Google and Microsoft. Each of our hyperscaler marketplace partners, we saw a record Q2 as customers use their hyperscaler of choice for security investments. In Q2 alone, we transacted more than $600 million in deal value through cloud marketplaces, representing more than 30% year-over-year growth. We quickly saw traction with our Microsoft marketplace presence, opening a new addressable market. Immediate Microsoft Marketplace wins included a new logo Australian health care provider started using CrowdStrike for SOC transformation in a 7-figure Flex. An American manufacturing firm previously used our services and has now expanded to the Falcon platform through a 7-figure Flex on Microsoft Marketplace. In closing, Q2 was an incredible quarter where the Mythos moment turned into acceleration, acceleration in net new ARR, acceleration in ending ARR, acceleration in Falcon Flex, acceleration in our ecosystem, acceleration in innovation. We're seeing endpoint as the epicenter for AI adoption. We're seeing AIDR define a new cybersecurity category. We're seeing next-gen SIEM as the operating system of cybersecurity, Falcon Identity becoming the security front door for human and non-human users, and exposure management as mission-critical for prioritizing AI risk. Taken together, the Falcon platform is cybersecurity's infrastructure layer for AI adoption. AI adoption is accelerating from frontier labs and open-weight models alike, and we're still in the early innings of the AI revolution. When I look at our business, here's what this acceleration means. Last quarter, we raised our forward net new ARR growth guidance by 520 basis points, and this quarter, we're raising our FY '27 year-over-year net new ARR growth outlook by an additional 630 basis points, even more than last quarter. That's a raise to our net new ARR guidance of more than $100 million since the start of the year. Delivery of a quarter like this and this outlook is fueled by the demand environment in our technology team ecosystem and customers. The innovation engine is in overdrive. As I shared last quarter, Dr. Bartley Richardson, previously at NVIDIA, has joined us as our Chief AI Autonomous Systems Officer as part of our long-planned and mutually agreed upon CTO leadership transition. I can't wait to share the vision and innovation that we are bringing to the world's adoption of AI at Falcon in Las Vegas next week. The conference sold out in early August, and it's our largest pipeline generation event of the year. We'll have record customer and partner attendance. I also encourage everyone to tune into our investor briefing on Wednesday, September 2. Our role in securing enterprises, governments and economies is vital to AI adoption and mission-critical in an AI-first world. I'll now turn the call over to Burt Podbere, CrowdStrike's CFO.

Thank you, George, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers except revenue mentioned during my remarks today are non-GAAP. Additionally, all earnings per share and share amounts presented today and in our accompanying investor materials have been adjusted to reflect our recent 4-for-1 stock split for all periods presented. We delivered a record second quarter, exceeding expectations across all guided metrics. We achieved an all-time record $333 million of net new ARR, well ahead of our guidance and accelerating to 51% growth year-over-year. Ending ARR reached $5.84 billion, up more than 25% over the prior year as growth accelerated for the fourth consecutive quarter. As George discussed, the post-Mythos demand environment continued to strengthen in Q2. The customer urgency we began to see in Q1 translated into increased cybersecurity investment, accelerated modernization and stronger demand for the Falcon platform. Our exceptional Q2 performance was broad-based across customer sizes and geographies. Net new ARR contribution from new logos was an all-time record, and both our dollar-based net and gross retention rates improved sequentially. Platform adoption also continued to deepen with 51%, 35% and 26% of subscription customers adopting six, seven and eight or more modules, respectively. Falcon Flex continues to be a key driver of our platform consolidation, with this quarter showcasing the power of our Flex-first strategy. In Q2, customers converting from standard subscriptions to Flex delivered an average ending ARR uplift of more than 40%. From that new baseline, customers completing their first Re-Flex this quarter generated an additional average ending ARR expansion of 25%. Looking at the cumulative uplift of customers who have Re-Flexed at least twice, in Q2, these customers had average ending ARR 53% higher than their initial Flex starting point, increasing for the second consecutive quarter. Taken together, these results underscore exceptional execution and the power of our platform strategy with AI-driven demand accelerating platform consolidation and helping deliver the strongest quarter in CrowdStrike's history. We also exited the quarter with a record Q3 pipeline, further reinforcing our confidence in the demand environment ahead. Moving to the P&L. Total revenue exceeded our guidance range and grew 26% over Q2 of last year to reach $1.47 billion, with year-over-year growth accelerating sequentially for the fifth consecutive quarter. Subscription revenue grew 27% over Q2 of last year to reach $1.40 billion, and professional services revenue was an all-time record $71 million as AI creates incremental demand for our AI readiness and incident response services, further increasing software cross-sell opportunities. The geographic mix of second quarter revenue consisted of approximately 65% from the U.S. and 35% from international geographies. Broad-based strength across our major regions drove international year-over-year revenue growth acceleration for the fifth consecutive quarter. Total Q2 non-GAAP gross margin was 79%, up approximately 110 basis points over the prior year. Non-GAAP subscription gross margin was 81%, up approximately 90 basis points over the prior year, driven by continued cloud optimization efforts as we remain focused on achieving our FY '29 target model of 82% to 85% non-GAAP subscription gross margin. Second quarter non-GAAP operating income was a record $372 million, exceeding our guidance, and non-GAAP operating margin was 25%, up 350 basis points over the prior year. The outperformance was driven by strong top line execution, continued gross margin expansion and increased operating efficiency. Our internal investments in automation and AI continue to yield greater operational efficiencies and productivity gains across our business. The combination of accelerating revenue growth and substantial year-over-year operating margin expansion demonstrates our strong operating leverage as we invest in the significant opportunities ahead, positioning us to deliver durable, profitable growth. In Q2, we delivered $5 million of GAAP net income attributable to CrowdStrike, marking the third consecutive quarter of positive GAAP earnings. Non-GAAP net income attributable to CrowdStrike was a record $323 million or $0.31 per diluted share, exceeding our guidance and up 34% compared to the prior year on a split-adjusted basis. Moving to cash. Our cash and cash equivalents grew to $5.01 billion. We generated Q2 record cash flow from operations of $530 million and Q2 record free cash flow of $377 million or 26% of revenue, exceeding our free cash flow margin expectation of 24.5%. Moving to our outlook and modeling notes. Consistent with our guidance philosophy, our outlook reflects the strength we see in the business while maintaining a prudent approach. Our record second quarter performance, record Q3 pipeline and broad-based demand across customer segments and the Falcon platform give us increased confidence in the strength of the demand environment and our long-term growth opportunity. As a result, we are once again raising our fiscal 2027 net new ARR outlook. At the midpoint, we now expect $1.355 billion of net new ARR for the full year, an increase of approximately $116 million from our initial FY '27 outlook. This equates to expected year-over-year net new ARR growth of approximately 34% compared to 22.5% in our initial FY '27 outlook, representing an increase of 1,150 basis points. The magnitude of this increase reflects more than our Q2 outperformance. As AI expands the attack surface and increases the urgency around cybersecurity, we believe it is driving a broader security modernization cycle that creates durable demand across the Falcon platform. Combined with continued platform consolidation and strong Falcon Flex momentum, these demand signals reinforce our confidence in the full year opportunity ahead. Before I walk through our detailed guidance, let me highlight two additional items to keep in mind. First, the acquisition of XM Cyber's technology assets is expected to close in the second half of FY '27 and will not bring any ARR or revenue to CrowdStrike, nor are we including any ARR or revenue from this transaction into the FY '27 guidance. And second, at the midpoint of our guidance, we expect free cash flow margin of 27.5% in Q3 and continue to expect at least 30% for the full fiscal year on our increased revenue guidance. With that, for the third quarter of FY '27, we expect annual recurring revenue to be in the range of $6.184 billion to $6.188 billion, up 26% year-over-year. This translates to net new ARR of $343 million to $347 million, up 29% to 31% year-over-year. Total revenue to be in the range of $1.523 billion to $1.529 billion, up 23% to 24% year-over-year. Non-GAAP income from operations to be in the range of $373 million to $376 million and non-GAAP net income attributable to CrowdStrike to be in the range of $325 million to $328 million. Diluted non-GAAP net income per share attributable to CrowdStrike to be approximately $0.31, assuming a 21% tax rate and approximately 1.048 billion weighted average diluted shares. For the full fiscal year 2027, we expect annual recurring revenue to be in the range of $6.603 billion to $6.612 billion, up 26% year-over-year. This translates to net new ARR of $1.350 billion to $1.359 billion, up 34% year-over-year. Total revenue to be in the range of $5.99 billion to $6.011 billion, up 25% over the prior fiscal year. Non-GAAP income from operations is expected to be between $1.497 billion and $1.508 billion and non-GAAP net income attributable to CrowdStrike to be between $1.303 billion and $1.312 billion. Assuming a 21% tax rate and approximately 1.044 billion weighted average diluted shares, we expect non-GAAP net income per share attributable to CrowdStrike to be in the range of $1.25 to $1.26. George and I will now take your questions.

[Operator Instructions] Our first question comes from Saket Kalia with Barclays.

Okay. Great. Can you hear me okay?

Yes. Go ahead.

Excellent. Great to see the acceleration continue. George, maybe for you, the Mythos moment happened in the spring. And now we've gotten a few months of activity behind us. Could you maybe talk about what transpired after that? And as you look back, what were some of the key drivers of this upside here in Q2?

Thanks, Saket. So as we mentioned in the spring, the Mythos moment was building. And as we told you, it was going to be a growth driver and a tailwind for us. And you saw that show up in our results. When we think about AI agents going rogue, when you think about the need for protecting AI and understanding where shadow AI is, it all points to the technologies that we're building and delivering here like AIDR, which was -- just had a phenomenal quarter, no surprise. Obviously, cloud, identity, next-gen SIEM, endpoint was accelerating, and exposure management, which is a big element now given the fact that companies can't keep up with the patching. So when you put all of that together, it comes to what we said, the Mythos moment was a point of acceleration, and we see those tailwinds continuing.

Your next question will come from Brian Essex with JPMorgan.

Great to see the nice magnitude of net new ARR upside this quarter. Maybe, George, for you, just to piggyback on Saket's question there. Would love to get your view on the durability of strength that you're seeing on the back of the Mythos moment, so to speak. I mean how much of the momentum goes beyond next quarter, perhaps beyond the end of the year? And given what you have in your pipeline, how much visibility do you have into the strength maybe just into next year and beyond?

Sure. I think when you look at the durability, it's -- in my opinion, it is absolutely there. It's one of the reasons why we raised FY '27 outlook again. And what we're hearing from customers is they want to deploy more AI, but they're being held back because of security, compliance, privacy, data protection type issues. So every customer that we talk to is concerned about the agentic threats. We've seen agents go wild. We've seen them break out of the frontier labs. And this is a sustainable tailwind. If we believe that AI is in its early days and is only going to get better and more powerful, combined with the autonomous nature of these attacks, it's absolutely something that every company is going to need. And as I said in the prior earnings call, I think the AIDR business can be bigger than the EDR business, just given the pure number of agents, which each person will have, which is estimated to be about 90. So for me, it's sustained tailwinds. And I think we're only going to see more stories around agents gone wild, and we're going to be there to protect our customers.

And I think, Brian, the numbers back it up. Look, you start with the record Q3 pipeline. So that prompted us to raise our full year guidance by an additional 630 basis points. That means we moved our FY '27 ARR growth rate from 27.7% at the end of last quarter to 34% this quarter. When compared to our initial guide for the year, we raised the growth rate 1,150 basis points or $116 million in just 2 quarters. That talks to the durability of the things that George talked about.

Your next question will come from Gabriela Borges with Goldman Sachs.

George and Burt, I wanted to ask you a little bit of a product question. You gave a little bit of -- you gave the case studies earlier on customer journeys and some of the flagship wins in the quarter. What I want to better understand is if you have a customer, let's say, it's a large financial organization, and they go from having agents being sandboxed and isolated regardless of how effective those sandboxes can be to actually wanting the agents to have real customer data, real enterprise data -- walk us through the before and after. How do you advise those clients on what products they need to buy from CrowdStrike? Clearly, identity is a part of it, to be able to say agents isolated to agents in production.

Sure. Well, I think to make the agents productive, they're going to have to have access to data. And again, when you look at what we're delivering for customers, it's looking across the entire spectrum of threats, right? You have to have an identity control plane, which we have for non-human identities. You have to have data protection, which we have. You have to understand at runtime what the agents are actually doing, whether that's in a sandbox or if those agents are running essentially on your computer or your laptop. You have to understand the exposures that you have. You have to be able to keep track of where those agents are calling out to. We can do all of that. So if it's in a sandbox, we can run in a sandbox. If it's out of the sandbox, which many of our customers are just kind of consuming AI on their desktops using the various frontier lab harnesses and the like, and we cover all of those, including if you're creating agents in a cloud environment. So from my perspective, the agents -- first of all, you need to know where AI is being created. You need to know where it's being consumed, and you have to put the right guardrails around identity, data execution and network connectivity, and we're delivering that for our customers.

Your next question will come from Matt Hedberg with RBC.

I'll offer my congrats as well. I wanted to piggyback sort of on this train of thought. And George, you talked about it in your prepared remarks, but I just -- I think we're all sitting back there and we're seeing these agents going rogue and just how quickly this landscape is changing. So I guess from your perspective, I just wanted to kind of get double-click on like how you see the threat landscape today? And when we think about how quickly this is changing, the relationship with the frontier labs is obviously great. But talk to us about why you're uniquely positioned even if these frontier labs start to release some of their own security solutions in the future.

Sure. Well, I think it's important that when you look at AI and to make AI protection more effective, you have to have very deep data expertise. And this has been something that's been basically built into the platform from day 1. Over the last 15 years, we have some of the richest threat data, richest attack data, richest data around actually how to mitigate the threats in the industry. So when you look at the models that we've built, we've trained on those specifically, and that gives us a unique perspective. Customers, of course, want choice. They want to work with frontier models. They want to work with our technology and our platform, fantastic. But having the right data, having it trained in a specific fashion and labeled appropriately, I think, is unique. And we have data that just isn't available outside of the CrowdStrike walls. That's very important. The other piece is, and I mentioned this some time ago, we are net data creators. We're constantly creating new data that's coming out of our endpoints. We're constantly using that data to update our algorithms as the threat environment changes. And again, I think this is very important to our customers. They want security companies they can trust. They want data sovereignty from a technology perspective, and they want to get actual results based upon the information in their own environment, and we're delivering that today.

Your next question will come from Fatima Boolani with Citi.

I wanted to double back on some of the earlier questions around portfolio pervasiveness. So specifically just around the acceleration that you continue to see in Falcon Flex, both from a standard conversion and Re-Flex. George, I was hoping if you could help us maybe parse out more granularly where you are seeing the most incremental or outsized traction on a SKU or disciplinary basis as organizations move to production-grade AI adoption. And I guess, in other words, what parts of the portfolio have proven to be most potent in giving organizations the assurances and confidence they need that they are in a secure situation with their AI adoption.

Sure. I'll take that, Fatima. So first, let's just talk about Flex. So Flex, it was an all-time record Flex quarter with year-over-year growth accelerating to 101% year-over-year, surpassing $2.29 billion. And a lot of that is coming from some of the different technologies that we've been talking about quarter after quarter. When you think about cloud, next-gen SIEM, next-gen identity, ending ARR was $2.1 billion, up 39% year-over-year. And if you go down the list of how we've done in each one of those particular elements, they're all really impressive, right? You think about cloud, over $905 million in ending ARR, up 29%. You've got next-gen identity, which is a big piece of the AI story. That's up 33% year-over-year. And then you've got obviously next-gen SIEM, just a home run for us. That's coming up on almost $700 million, and that's up 60% year-over-year. So all three of those can be an IPO by themselves. So you're seeing kind of adoption through our Flex licensing really showcase itself in those three products. And then George mentioned a whole bunch of other ones. We talked about exposure management having a great quarter. You talked about AIDR having a fantastic quarter. So I think the point is that Flex is lending itself to be able to buy multiple of our products at the same time, and that's what's leading to bigger, longer deals for us. And it's better for the customer. At the end of the day, it's the platform sale. That's what matters. Customers looking to consolidate on. They want more better outcomes at a cheaper cost.

Our next question will come from Meta Marshall with Morgan Stanley.

I wanted to maybe follow up on some of that next-gen SIEM strength. If we were having this conversation a year ago, there was a lot of -- they can start with -- the customers can start moving their EDR data over and then kind of gradually over time, expand those implementations. I just wanted to get a sense, as you guys are seeing continued really strong growth, is that kind of land happening differently? Like are people taking more of a chance upfront and moving more to you guys initially? And then just are we seeing kind of more data or logs being put into the SIEM to give better signals as they try to kind of detect more advanced attacks?

Yes. Well, when you look at next-gen SIEM, the great news is it's -- every customer is next-gen SIEM enabled, like the data is just in the platform. So it's just a matter of signing up and paying for the license entitlement and you're up and running with the CrowdStrike, what we call first-party data, the data that we actually generate. So that has made it incredibly easy and friction-free for many customers. They routinely say it's the easiest SIEM to get up and running. It's the quickest return in terms of time to value of what they're putting in and the results they're getting out. And then it's very easy to connect other data sources. We've seen the other data sources rapidly expand. If we think about AI, AI agents, SaaS and SaaS cloud agents, if you will, these are all -- and identity, these are all areas that customers have to instrument because we see these cross-domain attacks that go from internal systems to the cloud or cloud internal systems and everything in between. So we've seen just tremendous results there. It's a fantastic product. And it's very disruptive from a price point because of how we charge for the first-party data that we create. So it is a story of better, faster and more value for the money. And you can see the results, they speak for themselves.

Our next question will come from Adam Tindle with Raymond James.

Congrats on a great quarter. George, I wanted to ask on AIDR versus the core EDR platform, kind of a two-parter. I ask because investors are struggling with the definition and a view that there might be more gray area between AIDR and your core platform. So I guess the first part of the question would be, is there kind of a simple way to think about AIDR, where is this incremental where customers are buying this in addition to EDR? Or is this being used more as a substitute for EDR or any other products? And the second part would be, you've kind of alluded to some metrics around this that have been helpful. But I wonder if you might just take a second to put in context the ramp of AIDR versus other products at this stage as we try to think about the potential ultimate size of that platform?

So on the first point, it is separate and incremental. It's another module and it's priced separately, which is, again, where we're seeing a lot of the growth. So that is certainly a good fact to make sure that we clear up if there was any confusion about it. When we think about the beauty of the architecture and the platform, it's still using the same agent. And if you want to enable AIDR, again, that's a license entitlement. It's part of our friction-free deployment. Again, why is Falcon Flex so successful? Why have we been successful? Immediate time to value, and you don't have to roll out yet another agent. So that's very important. And when we talk about sort of like the ramp of this, it's been incredible over the last couple of quarters. And we've seen almost the results sort of parallel some of the frontier labs growth. As they continue to add more agents and capabilities, you have customers that are deploying more AI. They actually want to deploy AI faster, and they need to scale incredibly fast. So when you combine what we're building with -- again, it's on the same platform, that's the beauty, but we're able to monetize it separately. We think that's a home run. And we're showing the value to customers and they're willing to pay for it because it's very unique in the environment, and they don't want to deploy yet another agent, right? They're getting it all with CrowdStrike, and that's what they're looking for.

Our next question will come from Roger Boyd with UBS.

For George or maybe for Burt, given the traction you're seeing around AI security and you noted the acceleration in AIDR, overall AI usage across your installed base and inflecting, I would appreciate your updated views on how you're evolving the pricing model. And namely, are customers asking for token-based pricing in cybersecurity? And if so, how is that incorporated into Flex contracts?

Yes. So we actually have token-based pricing as part of AIDR. So we already have that today. And what's important from a customer perspective is they do want some certainty on what they're paying. So we provide a certain number of tokens across an environment, and we -- obviously, we scale that to how big the customer is. And then if they exceed that token usage, they can buy extra token packs. And again, the beauty is it's all consumable via the Falcon Flex licensing. So it's a model, I think it has served us well where it's not runaway cost for customers. They can define it, they can budget for it. But certainly, as they scale up their AI, if they exceed their budget allowance, they certainly can up-level the tokens, and it's friction-free to do that with Falcon Flex.

Our next question comes from Rob Owens with Piper Sandler.

George, I guess back to the start and thinking about your history with Foundstone a little bit. And twice on this call, you did mention exposure management. So love to understand the evolution of that market, where you're seeing displacement because I think you mentioned a large-scale transaction there. And effectively, what the older solutions aren't providing at this point? I know that you guys adopted a network scanning capability a year ago. But with AI, I'd assume it's well beyond that at this point. So just would love for you to drill down on that opportunity and why CrowdStrike is winning.

Sure. So when we think about where we are with exposure management, I think it's a rebirth and certainly, we're in full position in that area. So what I mean by that is given the fact that there's an exponential increase in vulnerabilities that are found via frontier AI and patches that can be created via frontier AI, that's great. The problem is you've hit the sound barrier of actually rolling out a patch. And what that means is that companies are looking for their ability to prioritize where these exposures are because they're not going to be able to fix everything all at once within the window of what autonomous agents can actually exploit. So that's really the driver in an area where customers are looking at and saying, "Hey, I've got to think about this differently. I can't be doing the same old things that we've been doing. I can't keep using the same old legacy exposure management or vulnerability management technology." So they want a view of their assets. They want a view of where their protection is, Falcon. They want a view of what's exposed, right, what patches need to be applied but haven't. And they want to understand the attack path. And we are delivering that in an autonomous fashion within the Falcon platform. And that's a big reason why we're displacing a lot of the legacy vendors in the market today.

Our next question comes from Mike Cikos with Needham.

Congratulations on another significant lift here to the net new ARR guide following strong 2Q execution. George, maybe for you. We've been doing a significant amount of work with CISOs and the common refrain we're hearing comes back to AI governance, both in terms of security as well as the pull-through on the economic need to control these AI costs. My question really ties to, can you just put a finer point on discussing how customers are turning to Crowd in terms of serving as that strategic partner for implementing and enforcing AI governance guardrails? I think that would be super helpful.

Sure. Well, on the product today, we have the ability to set policy and enforce those guardrails, which is incredibly useful, needed and incredibly difficult. As you might imagine, in some organizations that are dealing with -- they make chemicals, as an example. Well, that may be something that is not an approved sort of topic, if you will, in other companies, but in some companies, that's what they make, right? So you have to be able to have the right models to understand what's happening in the environment. You have to be able to set the policies in a way that actually work and minimize false positives, and then you have to give these customers very good results very quickly so they can roll this thing out without a lot of friction. And we're doing that today. The other piece, and you touched on it, which is very important, is we actually have the ability to count tokens and track cost. And this is very important as you expand outside of the boundaries of just pure security. When we think about IT infrastructure and we think about the CIO, having the ability to help them manage cost is a big part of our selling point as well. So you get the guardrails that you're looking for, you get the protection you need and also you have visibility into where your AI agents are and what people are actually spending on these results. And it's incredible. I mean we've heard EAs spending $10,000 just on tokens because of the way they were using the models. And dramatically, once you understand and have visibility around that, you can dramatically cut those costs down. So it's really a one-two punch of protection and cost management.

Our next question comes from Patrick Colville with Scotiabank.

I guess this one for both George and Burt, please. You talked about the frontier lab, 8-figure deal with this customer protecting their rapidly expanding data center infrastructure. I mean any more question -- any more details you can share on this specific 8-figure deal? And then to zoom out the aperture a little bit, could you just talk to this emerging customer category of helping to protect the frontier labs?

Sure. I think you've got the digital natives that are out there, AI native companies. You've got the frontier labs. As you might imagine, all of the companies that are involved in creating AI need to protect AI. And they're turning to CrowdStrike because we've got the right technologies across the entire stack. And again, like if you look at what we've done with NVIDIA and how we have integrated into their platforms, it's a complete ecosystem from the chips all the way up to the applications and AI inference. So we think we're in a great position to be able to help these rapidly growing and expanding companies because they're going to need visibility, they're going to need protection. They're going to need control. They're going to need compliance as they continue to scale. And we think the sky is the limit with the frontier model creators and anyone involved in the AI ecosystem, and we're there for them. And we think we have a very unique and differentiated technology in those areas.

Our next question comes from Joseph Gallo with Jefferies.

There's a lot of excitement and big numbers with the emerging products on the call, but I just wanted to focus on endpoint, which accelerated for the fourth straight quarter. Can you just unpack that a little bit more? Is that new logos? Is that selling more managed services and premium SKUs? And just how much runway is left there, just given it's perceived as a more mature market?

Sure. Well, I think when you look at companies' desire to protect AI, again, a lot of the AI is being consumed on the endpoint, right? It might be created in the cloud, but it's being consumed on the endpoint. You can think about your own organizations and perhaps how you even use AI. So that has driven the need for companies like CrowdStrike to be able to actually protect those instances. If we think about the market, about half the market is still using legacy AV, right? So legacy AV and legacy providers are not really going to have the capabilities to identify rogue AI agents, shadow AI and be able to protect against it. It's very unique and differentiated, but it fits within the platform that we've built from the beginning. So that's one area where, again, if you want to protect these endpoints, you're going to have to have something like CrowdStrike, and that includes net new wins from a lot of the legacy providers that are out there, certainly in addition to cross-selling into our customer base.

Our next question comes from Todd Weller with Stephens.

Congrats. George, a question on QuiltWorks. Can you talk about how impactful it was in the quarter? And then trying to better understand the monetization angles there. Should we initially think about that as like a partner-led motion where they're leveraging your platform and frontier AI model capabilities to do assessments, and then that drives kind of follow-on platform pull-through?

Yes, that's exactly right. When we think about the Mythos moment, there's many of our partners. And again, we are a very partner-first organization that want to be able to service their customers. They've got great relationships. But we need to be able to arm them with frontier caliber capabilities to be able to understand where these vulnerabilities are, what threats are out there and what they can do. So essentially, they're leveraging our platform in a partner-led motion and finding these vulnerabilities, understanding exposure and then obviously working on remediation with some of the largest enterprises in the world. And of course, that leads to platform pull-through. So I think from our perspective, it's been a home run in QuiltWorks. We have many companies that want to still yet to get into it. We're working through all of those, and we'll continue to expand the partners as well as its capabilities within the platform for them to leverage.

This concludes today's question-and-answer session. I would now like to turn the call back over to George Kurtz for closing remarks.

Thank you for your time today. We appreciate your continued support and look forward to seeing you at Falcon 2026 and other upcoming events. Thank you.