CrowdStrike Holdings
Analytical review · Report for the quarter ended July 31, 2026 (Q2 of fiscal 2027)
Bakshi Finance — Family Office | Research Depth: Comprehensive
What this review is based on. CrowdStrike's quarterly report on Form 10-Q for the quarter ended July 31, 2026, filed on August 27, 2026; the results release for that quarter (August 26, 2026); the quarterly report and release for the prior quarter; the annual report on Form 10-K for the fiscal year ended January 31, 2026; and Form 8-K filings on the expanded share repurchase, the annual meeting and the stock split. Market data: price on October 8, 2026, and the Bank of Israel representative dollar rate for the same day. The company's fiscal year ends on January 31. All per-share data are adjusted for the 4-for-1 stock split effected on July 1, 2026.
Company Profile
CrowdStrike Holdings sells a cloud-delivered cybersecurity platform called Falcon. A single small software component (a sensor) is installed on the customer's computers, servers and cloud environments, and streams data to a central system that detects and blocks attacks. Around that sensor the company has built separate modules: endpoint protection, cloud security, identity protection, log and security-event management (SIEM), threat intelligence, a managed detection service and, over the past year, browser security and protection for AI systems.
Subscription fees make up 95% of revenue, usually under one- to three-year contracts billed in advance. The rest is incident response and security consulting. The company is headquartered in Austin, Texas, and had 11,706 employees on July 31, 2026. Founder George Kurtz serves as Chief Executive Officer.
In July 2024 the company pushed a content update to its sensor that crashed large numbers of Windows computers worldwide (in the filings: the "July 19 Incident"). The incident and the legal proceedings that followed are still part of the filings and are covered in sections 6 and 7.
Financial Performance
The metric the company places at the centre is ARR — annual recurring revenue: the annualised value of all active subscription contracts on the measurement date. The quarterly increment (net new ARR) is the difference between two quarters. Revenue under accounting rules (GAAP) is recognised over the subscription term, so it reflects contracts signed in earlier quarters.
The acceleration in the quarter
In the May–July 2026 quarter revenue rose 26% to $1,471 million. ARR rose 25% to $5,841 million, compared with 20% growth a year earlier. Net new ARR in the quarter was $333 million, up 51% on the same quarter last year and the highest quarterly increment the company has reported. In the previous quarter (February–April) net new ARR was $256 million, up 32%.
According to company management, ARR at fiscal year-end (January 31, 2027) will be $6,603–6,612 million and full-year revenue $5,991–6,011 million. This is the third increase in the annual guidance since March 2026 (then: ARR of $6,466–6,516 million). In the first two quarters of the year, actual results exceeded the top of the guidance range for revenue, ARR and adjusted operating income.
Profit, cash flow and stock compensation
Under accounting rules the company is still loss-making at the operating level: an operating loss of $33 million in the quarter, against $105 million a year earlier. Net income ($5.3 million) is positive because of $44 million of interest income on cash. On the company's adjusted presentation (non-GAAP, excluding stock-based compensation, amortisation and one-off items) the quarter ended with operating income of $372 million, 25.3% of revenue, against 21.8% a year earlier.
Two figures from the filing complete the picture. First, stock-based compensation (SBC) of $377 million in the quarter — 25.6% of revenue — and $1,244 million over the last 12 months. It does not leave the company's cash, but it increases the share count. Second, a change in accounting estimate: from February 2026 the company spreads sales commissions on new customers over five years instead of four. According to the filing, the change reduced sales and marketing expense by $25.5 million in the quarter and by $53.4 million in the first half of the year. Without it, the adjusted operating margin in the quarter would have been about 23.5%.
Free cash flow in the quarter was $377 million (26% of revenue), and $1,518 million over the last 12 months. Investment in property and software rose to $151 million in the quarter, 10% of revenue, against $48 million in the same quarter a year earlier — mainly data-center equipment.
| $ millions, quarter ended | 4/25 | 7/25 | 10/25 | 1/26 | 4/26 | 7/26 |
|---|---|---|---|---|---|---|
| Revenue | 1,103 | 1,169 | 1,234 | 1,305 | 1,386 | 1,471 |
| GAAP operating income (loss) | −119 | −105 | −62 | −7 | −31 | −33 |
| Non-GAAP operating income | 201 | 255 | 265 | 326 | 326 | 372 |
| Free cash flow | 279 | 284 | 296 | 376 | 468 | 377 |
| Ending ARR | 4,436 | 4,657 | 4,922 | 5,253 | 5,509 | 5,841 |
| Net new ARR | 194 | 221 | 265 | 331 | 256 | 333 |
The 10/25 quarter and some ARR figures were derived from the published annual and half-year figures. The 7/25 quarter is shown after an immaterial correction the company made to the timing of stock-compensation expense.
Balance Sheet & Capital
On July 31, 2026 the company held $5,014 million in cash and cash equivalents. Its only debt is $750 million of 3% senior notes due February 2029. On the liability side, the largest item is deferred revenue of $4,842 million — subscription fees paid in advance for service not yet delivered. Remaining performance obligations (RPO) under contracts totalled $10.7 billion, of which about 46% is to be recognised as revenue in the next 12 months according to the filing.
Acquisitions: in the first half of the year the company completed two acquisitions: SGNL (identity, $628 million in cash) and Seraphic (browser security, $328 million). In September 2025 it acquired Onum ($253 million) and Pangea ($212 million). Goodwill rose from $1,363 million to $2,251 million. In July 2026 it signed an agreement to acquire the technology assets of XM Cyber for $145 million in cash and shares, plus additional shares to be set at closing. According to the company, the acquisitions are not material to the financial statements, and it does not disclose how much ARR they added.
Purchase commitments: on July 31, 2026 non-cancellable commitments to buy services and products (data centers, cloud, technology and more) stood at $4.14 billion. According to the filing, after the balance-sheet date the company committed to a further $2.9 billion through fiscal 2034.
Buybacks and dilution: the repurchase authorisation was raised to $1.5 billion in April 2026. In the February–April quarter the company bought back 1.92 million shares (split-adjusted) for $176 million; in the May–July quarter there were no repurchases. Remaining authorisation: $1.3 billion. The share count rose from about 1,014.5 million (February 2026, split-adjusted) to 1,023.9 million (August 2026), an increase of about 0.9% in six months. The company pays no dividend.
Segments
CrowdStrike reports a single operating segment. The breakdowns available in the filings are by revenue type (subscription versus services) and by geography, alongside adoption metrics the company publishes.
| Revenue by region, $ millions | May–Jul 2025 | May–Jul 2026 | Change | Share of revenue |
|---|---|---|---|---|
| United States | 785 | 954 | +22% | 65% |
| Europe, Middle East and Africa | 188 | 264 | +40% | 18% |
| Asia Pacific | 118 | 158 | +34% | 11% |
| Other | 78 | 95 | +21% | 6% |
Subscription versus services: subscription revenue rose 27% to $1,400 million, at a 78% gross margin (81% adjusted). Professional services revenue rose 7% to $71 million, at a 10% gross margin.
Adoption metrics: according to the company, 51% of subscription customers use six or more modules, 35% seven or more and 26% eight or more. ARR in accounts that adopted the Falcon Flex licensing model (an upfront commitment from which the customer draws modules over time) reached $2.29 billion, double the prior year. This figure covers all ARR in those accounts, not only what was sold under Flex. Dollar-based net retention (NRR) was 115% at the end of January 2026 (112% a year earlier); for the current quarter the company wrote that it "improved sequentially", without publishing a number.
Competitive Position
The differentiation the company presents is one sensor and one platform: a customer that has installed the sensor can switch on further modules without another installation, and all data from all customers feed the same detection system. The more data flows in, the better the ability to detect new attacks — this is the company's network-effect argument. The Flex model is designed to make it easier for customers to add modules without a new procurement cycle for each one.
What the filings show: two years after the July 19 Incident, net retention rose from 112% to 115%, and the share of customers with eight or more modules rose to 26%. At the same time, the company notes in the filing that the compensation packages offered to customers after the incident included discounts, extra modules and subscription extensions, and that these increase contraction and reduce the value of upsells. The company also describes a market with many competitors, including large cloud providers and other security vendors. This review does not include market-share data from a primary source.
How to Think About This Company
At CrowdStrike there are three layers of "profit", and reading only one of them gives a partial picture. Under accounting rules the company is loss-making at the operating level. On its adjusted presentation it earns 25% of revenue. And free cash flow stands at 28% of revenue. The gap between the layers is explained mainly by one item — stock-based compensation of about a quarter of revenue — and by customers paying in advance.
ARR is the central metric, and it is the company's own metric. ARR is not a line item in the audited financial statements; the company defines and calculates it. According to the filing, the U.S. Department of Justice and the Securities and Exchange Commission have requested information from the company on revenue recognition and ARR reporting for transactions with certain customers, as well as on the July 19 Incident. The company states that it is cooperating. A request for information is not a finding, but it is relevant to anyone relying on this metric.
The acceleration comes from sources that are hard to separate. Net new ARR rose 51% in the quarter. Over 12 months the company completed four acquisitions totalling about $1.4 billion in cash. The company describes the acquisitions as not material and does not disclose how much ARR they added. None of them closed within the May–July quarter itself; two closed in February 2026. It is therefore hard to determine from the filing alone how much of the acceleration across the year is organic.
Part of the margin improvement is an estimate change. The adjusted operating margin rose 3.5 percentage points in the quarter. About 1.7 points of that come from sales commissions now being spread over five years instead of four. The company explains the change by longer customer relationships. The change does not affect cash — commissions are paid at the same time — so free cash flow is not affected by it.
Stock compensation is growing faster than revenue. In the quarter stock compensation rose 35%, against 26% revenue growth. Over the last three fiscal years, the gap between free cash flow and stock compensation fell from about $290 million (year ended January 2024) to about $139 million (January 2026), and stood at about $274 million over the last 12 months. Unrecognised stock compensation stands at about $2.9 billion.
Infrastructure is getting heavier. Investment in property and software rose from about 4% of revenue to 10% in the quarter, and purchase commitments — including the $2.9 billion added after the quarter — reach about $7 billion. The filing does not describe the nature of the new commitments. If they relate to larger-scale data processing (for example for AI products), their effect would show up in the subscription gross margin, currently 78%.
The July 19 Incident: most proceedings closed, one material one open. The airline-passenger class action was dismissed, and the dismissal was affirmed on appeal in May 2026. The derivative suits against officers were dismissed in Texas and Delaware. Delta Air Lines' suit is in discovery, and the company cannot estimate the range of possible loss. In the latest quarter the company recorded a net insurance recovery of $14.5 million.
The multiple is part of the picture. At a market value of about $272 billion, the shares trade at about 46 times ARR and about 176 times trailing 12-month free cash flow (on enterprise value, after netting cash). Looking at the past six months, the price rose about 2.7 times while ARR rose about 11%. In other words, most of the price change in that period was a change in the multiple rather than in the size of the business. According to company management, the long-term goal is ARR of $20 billion in fiscal 2036.
What management presents as the engine. According to management, enterprise adoption of AI systems widens what needs protecting — autonomous agents, non-human identities, browsers and interactions with models — and the company is building modules for each of these layers, partly through the acquisitions. The filings currently show the rise in net new ARR and in module adoption, but do not break revenue down by product.
The framework is meant to organise the questions. It does not decide and does not take part in the decision — the decision belongs to the reader.
This framework is intended to structure analysis, not to produce an investment conclusion.
Risks & Monitoring
Risks that emerge from the filings
- Proceedings and information requests: the Delta suit is in discovery; the DOJ and SEC have requested information on revenue recognition, ARR reporting and the July 19 Incident. The company does not estimate a range of loss.
- Software reliability: the company states it cannot guarantee that the improvements made after the July 19 Incident will be effective, and that another failure could harm its reputation and customers.
- Stock compensation and dilution: about 23% of revenue over the last 12 months; the share count rises despite buybacks.
- Purchase commitments: about $7 billion of non-cancellable commitments, above the cash balance.
- Integrating acquisitions: four acquisitions in 12 months and a fifth pending.
- Falcon Flex: according to the filing, customers who do not use their full commitment may renew at a lower value.
- Competition: a market with large cloud providers and competing security platforms, some of which, according to the company, sought to exploit the July 19 Incident.
Items to monitor in the next quarterly report (August–October 2026)
| # | Item | Latest reading |
|---|---|---|
| 1 | Net new ARR against the guidance range | Quarter-end ARR according to company management: $6,184–6,188 million |
| 2 | Stock compensation as a share of revenue | 25.6% in the May–July quarter |
| 3 | Free cash flow versus stock compensation | $377 million versus $377 million in the quarter |
| 4 | Adjusted margin excluding the commission estimate change | About 23.5% |
| 5 | Capital investment and subscription gross margin | 10% of revenue · 78% |
| 6 | Net retention (NRR) | 115% in January 2026; latest quarter "improved", no number |
| 7 | Developments in the Delta suit and the information requests | Discovery · cooperation |
| 8 | Closing of XM Cyber and share repurchases | No repurchases in the quarter; $1.3 billion remaining |
Scenario Framework
The scenarios below are descriptive, not predictive. They contain no prices, no probabilities and no ranking of outcomes. Their only purpose is to set out the conditions that would need to hold for each state to materialise, so that they can be checked against future filings.
Scenarios are descriptive, not predictive.
- If net new ARR keeps growing at a similar pace in the second half, when seasonality is stronger according to the company
- If the company discloses the acquisitions' contribution to ARR, and organic growth remains high
- If stock compensation grows more slowly than revenue, and the gap between free cash flow and stock compensation widens
- If the subscription gross margin holds as infrastructure investment grows
- If ARR keeps growing at 20%–25% and net new ARR moves around the guidance range
- If stock compensation stays around a quarter of revenue
- If adjusted margins rise mainly through the estimate change and leverage on fixed costs
- If the legal proceedings continue without resolution and without a material provision
- If net new ARR falls back to last year's levels after the record quarter
- If Flex customers renew at lower values and retention declines
- If infrastructure commitments weigh on the gross margin
- If the authorities' information requests lead to a change in how the company reports ARR or recognises revenue
Analytical Lens
The following six questions are identical in every company review we publish. They are deliberately open and do not lead to a single conclusion. Their role is to let the reader examine the company on the same six dimensions as any other company.
Key Observations
1. In the May–July 2026 quarter CrowdStrike reported revenue of $1,471 million (+26%) and ARR of $5,841 million (+25%). Net new ARR in the quarter was $333 million, up 51%. According to company management, year-end ARR will be $6,603–6,612 million.
2. The quarter ended with a GAAP operating loss of $33 million, adjusted operating income of $372 million, and free cash flow of $377 million. Stock-based compensation in the quarter was $377 million, 25.6% of revenue.
3. A change in the estimated period over which sales commissions are spread (from four to five years) reduced expenses in the quarter by $25.5 million. Four acquisitions over the last 12 months totalled about $1.4 billion in cash; the company does not publish their contribution to ARR.
4. The company holds $5.0 billion of cash against $0.75 billion of debt, and purchase commitments of $4.1 billion, plus $2.9 billion added after the quarter. The U.S. Department of Justice and the SEC have requested information from it on revenue recognition and ARR reporting for certain transactions.
Bakshi Finance operates as a Family Office for qualified clients only. Mr. Yaron Bakshi held a licensed investment adviser qualification in Israel during 2008–2023. As of the publication date of this document, the firm does not hold an investment advice, investment marketing or portfolio management licence.
This document is intended for research and professional study purposes only. Nothing herein constitutes a recommendation to buy, sell, hold or carry out any transaction in securities. Nothing herein substitutes for advice that takes into account the data and needs of each person. Every decision is the sole responsibility of the investor.
Past performance is not indicative of future results. Data were drawn from official sources: the quarterly report on Form 10-Q for the quarter ended July 31, 2026 (August 27, 2026), the company's results releases of March 3, June 3 and August 26, 2026, the quarterly report for the quarter ended April 30, 2026, the annual report on Form 10-K for the fiscal year ended January 31, 2026 (March 5, 2026), and the company's 2026 filings with the U.S. Securities and Exchange Commission. Filings published after this date are not included.
Review for qualified clients — Family Office
The full analytical review of CrowdStrike (CRWD) for the quarter ended July 2026 is available to Bakshi Finance premium clients.
The review includes a 10-section analysis, "How to Think About This Company" paragraphs, a structured scenario framework, and a six-dimension Analytical Lens.
Bakshi Finance · Family Office · All rights reserved 2026