CrowdStrike closed FY2026 as its best year on record — $5.25B in ending ARR, $4.81B in revenue, $1.24B in free cash flow, and first-ever GAAP profitability in a quarter — completing a stunning recovery from the July 2024 global IT outage. Today, at ~$411, the stock sits 27% below its $566.90 all-time high while trading above its short-term moving averages, placing it at a technical inflection point. The question for investors: is the premium valuation justified by a platform becoming mission-critical AI security infrastructure — or is the AI disruption narrative a genuine existential threat?
NASDAQ: CRWD · Apr 16, 2026
$411.16
▲ Recovery from $342.72 low (+19.9%)
52-wk range: $342.72 – $566.90 | Mkt cap: ~$104B
Day range: $402.05 – $411.98 | Next earnings: Jun 9, 2026
After-Hours
~$416
▲ +$5 est. (+1.2%)
Below 200d MA of ~$460
key metrics at a glance — fy2026
FY2026 Revenue
$4.81B
+22% YoY
Ending ARR
$5.25B
+24% YoY · First $5B milestone
Net New ARR (FY26)
$1.01B
First year exceeding $1B
Free Cash Flow
$1.24B
26% FCF margin · Record
Gross Retention
97%
Post-outage resilience
Analyst Target
$489.86
+19% upside · 41 Buy, 0 Sell
Q4 FY2026 earnings — results vs. estimates
Q4 Revenue$1.31B (+23% YoY)
vs. consensusBeat $1.30B est. (above guidance)
Subscription revenue$1.24B (+23% YoY)
Non-GAAP EPS$1.12 (beat $1.10 est.)
Q4 Non-GAAP op. income$325.8M · 25% margin (+45% YoY)
Sub. gross margin79% (up from 77%)
Q4 Net new ARR$331M (+47% YoY) · Record
Q4 Operating cash flow$497.9M (+44% YoY)
Q4 Free cash flow$376.4M · 29% margin (+57%)
Falcon Flex ARR$1.69B (+120% YoY)
Dollar-based net retention115%
Cash & equivalents$5.23B
GAAP profitability milestone: CrowdStrike achieved positive GAAP net income for the first time in a quarter during Q4 FY2026 — a watershed moment signalling that the platform has reached the scale where recurring subscription revenue meaningfully exceeds the cost structure. The non-GAAP EPS beat of $1.12 vs. the consensus estimate of $0.74 is extraordinary — a 51% beat — primarily because older consensus estimates carried pre-recovery caution from the July 2024 outage. The business accelerated well beyond those expectations.
full year fy2026 & fy2027 guidance
FY2026 Revenue
$4.81B
+22% YoY
FY2026 FCF
$1.24B
26% margin · Record
FY27 Rev. guidance
$5.87–5.93B
+22% projected
FY27 Non-GAAP EPS
$4.78–4.90
+28–31% growth
ending ARR trajectory — fy2022 to fy2027E
FY ends January 31 each year · FY2027E based on management guidance midpoint · FCF margin right axis
the defining event — july 19, 2024
The world's largest IT outage — and CrowdStrike's greatest test
A faulty Falcon sensor content update crashed 8.5 million Windows systems globally — disrupting airlines, hospitals, banks, emergency services, and governments. Fortune 500 direct losses exceeded $5 billion. CrowdStrike's stock plunged 45% over 18 days, bottoming at $217.89.
Root cause: A configuration update to "Channel File 291" caused an out-of-bounds memory read at the kernel level. CrowdStrike lacked staged rollout mechanisms to catch the error before global deployment. A fix was deployed within 6 hours, but manual remediation meant outages lingered for days.
The recovery: Gross retention held at 97% — virtually no enterprise customers left. CrowdStrike deployed "Customer Commitment Packages" (rebates + extended terms + expanded module access) that actually deepened relationships. Kurtz's public transparency tour preserved credibility with institutional investors.
Structural changes: New staged deployment protocols, kernel-level update validation, and a new quality assurance leadership team. Falcon Flex (introduced post-outage) lets customers purchase module credits on-demand — a retention and sales tool born from the crisis. FY2025 stock gained +38%, and FY2026 crossed $5B ARR. The comeback is complete.
business model — the falcon platform architecture
The Single-Agent, Cloud-Native SaaS Platform — 28+ Modules, One Sensor
Platform economics: One lightweight agent deployed on any endpoint or workload sends telemetry to the "Threat Graph" cloud — processing trillions of security events per week. Each additional module added has near-zero marginal cost of delivery. This creates a powerful land-and-expand model: customers start with endpoint protection and progressively add cloud, identity, SIEM, and threat intelligence modules.
Module adoption (Jan 31, 2026): 50% of customers with $100K+ ARR use 6+ modules, 34% use 7+, 24% use 8+. Each module adds ARR without deploying additional agents — pure revenue expansion at existing customers. This is why DBNR of 115% means Shopify's existing customers are spending 15% more year-over-year on the same platform.
Falcon Flex: Post-outage innovation — customers buy a credit pool and deploy any module on demand. ARR from Flex accounts reached $1.69B (+120% YoY). This removes friction in the enterprise sales cycle and makes consolidation onto Falcon economically attractive vs. managing 60–80 point security tools.
Charlotte AI (agentic SOC): Evolved from a chatbot into an autonomous agent handling alert triage, incident response, and threat hunting. Selected for OpenAI's Trusted Access for Cyber (TAC) program. CRWD targets $20B in ending ARR by FY2036 — from $5.25B today — driven by AI expanding the TAM across every security layer from GPU to agent to prompt.
product segments — revenue branches
Endpoint / XDR
The original core — Falcon Prevent (AV), Falcon Insight (EDR), Falcon OverWatch (MDR). Still the largest revenue segment. Subscription gross margin ~80%. 97% retention. Competitors: SentinelOne, Microsoft Defender.
Cloud & Identity Security
Falcon Cloud Security (CSPM/CWPP), Falcon Identity Protection (Zero Trust). Combined ARR surpassed $1.3B in FY2025. Fastest-growing segment. Competitors: Palo Alto Prisma, Zscaler, Wiz.
Next-Gen SIEM & Data
Falcon Next-Gen SIEM (now ingests Microsoft Defender EDR data), LogScale (data lake). Crossed $1B ARR. Now positioning CRWD as the analytics layer even over competitor telemetry. Competitors: Splunk/Cisco, Microsoft Sentinel, Elastic.
supply chain & infrastructure dependencies
Cloud infrastructure — AWS, GCP, Azure (multi-cloud): The Threat Graph processes trillions of events per week across cloud infrastructure. Unlike GoDaddy (single-cloud), CrowdStrike's multi-cloud architecture reduces vendor concentration risk. However, cloud compute costs are a key variable in gross margin management as data volumes scale with AI workloads.
Microsoft Windows kernel dependency: The July 2024 outage was a direct consequence of Falcon operating at the Windows kernel level — where a faulty update can crash the entire OS. Microsoft is reducing third-party kernel access in Windows 12 via its "VBS Enclave" initiative. CrowdStrike is adapting its architecture, but this represents a structural supply chain risk for endpoint protection delivery.
AI compute — OpenAI TAC + internal models: Charlotte AI and Next-Gen SIEM analysis rely on large language model inference. Selection for OpenAI's Trusted Access for Cyber program gives CrowdStrike preferred access to frontier models for defensive cybersecurity. AI inference cost is a rising opex line managed via its own Charlotte AI fine-tuned models reducing external API dependency.
SGNL + Seraphic acquisitions (2025): CrowdStrike acquired SGNL (identity governance) and Seraphic (browser security) — extending Falcon's identity and application security reach. These integrations add software supply chain complexity but expand module inventory for land-and-expand.
Legal tail risk — Delta Air Lines lawsuit: Delta sued for gross negligence; a Georgia judge allowed claims to proceed (May 2025). CrowdStrike contends liability is limited to "single-digit millions" by contract. A large judgment would be a headline risk but is unlikely to materially impair operations given $5.23B cash position.
competitor quantitative scorecard
Branches of competition & how to read the scorecard
Competitive branches: CrowdStrike competes across four distinct domains simultaneously — (1) Endpoint/XDR vs. SentinelOne and Microsoft Defender; (2) Cloud Security vs. Palo Alto Networks' Prisma and Zscaler; (3) Identity Security vs. CyberArk (now PANW) and Okta; (4) Next-Gen SIEM vs. Splunk/Cisco and Microsoft Sentinel. Palo Alto Networks is the broadest strategic rival — both companies are racing to become the unified security operating system for enterprises.
EBITDA: Non-GAAP adjusted EBITDA used for all companies to remove SBC distortion. PANW's large revenue base ($9.2B) gives it the highest absolute EBITDA. CRWD leads on FCF margin (26%) due to its pure-play SaaS model with no hardware. SentinelOne is newly profitable — a structural improvement but still a fraction of scale.
Altman Z-Score: Modified model for tech/SaaS firms. High market cap relative to liabilities inflates scores for large-cap names. The score here is most useful as a relative comparison of financial robustness — not as an absolute bankruptcy predictor. All four companies are solvent; the gap reflects balance sheet quality and earning power.
Piotroski F / CCC / EVA: CCC is strongly negative for all four because SaaS businesses collect annual subscription fees upfront before delivering the service — a structural advantage. EVA measures whether NOPAT exceeds the cost of capital deployed. Positive EVA = genuine wealth creation. SentinelOne's negative EVA reflects a company still burning capital in excess of returns, improving rapidly. PANW's large EVA reflects its scale and GAAP profitability.
| Company · Branch |
Rev. (FY25/26) |
Adj. EBITDA |
EBITDA Margin |
Altman Z |
Piotroski F |
CCC (days) |
EVA (est.) |
CrowdStrike (CRWD) ★
Endpoint · Cloud · Identity · SIEM |
$4.81B |
~$1.24B |
~26% |
~9.1 |
8 / 9 |
-75 days |
+$530M |
Palo Alto Ntwks (PANW)
Network · Cloud · Endpoint · SASE |
$9.2B |
~$2.76B |
~30%* |
~10.4 |
8 / 9 |
-55 days |
+$1.1B |
Zscaler (ZS)
Zero Trust · Network · Cloud Proxy |
~$2.65B |
~$580M |
~22% |
~6.8 |
6 / 9 |
-60 days |
+$120M |
SentinelOne (S)
Endpoint / XDR · Cloud |
~$1.0B |
~$30M |
~3% |
~3.4 |
4 / 9 |
-35 days |
-$85M |
* PANW non-GAAP op. margin ~30% on FY25 $9.2B revenue; FY26E guided at $10.5B with 29.5–30% margin. CRWD EBITDA uses FCF as proxy (26% margin), approximating adj. EBITDA closely for pure-play SaaS. EVA: WACC CRWD 9%, PANW 8%, ZS 10%, S 11%. CCC reflects SaaS deferred revenue model — negative = collects before delivering. SentinelOne FY2026 ends Jan 31, 2026; first non-GAAP profitability achieved. All figures approximate from public filings.
piotroski f-score — signal breakdown
| Signal (0 or 1 each) |
CRWD |
PANW |
ZS |
S |
Signal meaning |
| Profitability |
| Positive ROA | 1 | 1 | 0 | 0 | Net income / total assets > 0 |
| Positive operating cash flow | 1 | 1 | 1 | 1 | Operating cash flow positive |
| Increasing ROA | 1 | 1 | 1 | 1 | ROA improving vs. prior year |
| Quality of earnings (OCF > NI) | 1 | 1 | 1 | 1 | Cash earnings exceed reported profit |
| Leverage & Liquidity |
| Declining leverage ratio | 1 | 1 | 1 | 0 | LT debt / avg assets falling |
| Improving current ratio | 1 | 1 | 1 | 0 | Current assets / current liabilities ↑ |
| No share dilution | 1 | 1 | 0 | 0 | Shares outstanding not increased YoY |
| Operating Efficiency |
| Improving gross margin | 1 | 1 | 1 | 1 | Gross margin improving YoY |
| Improving asset turnover | 1 | 1 | 0 | 0 | Revenue / total assets rising |
| Total Score |
8 / 9 |
8 / 9 |
6 / 9 |
4 / 9 |
Max 9 · >7 = strong health |
adj. ebitda & eva — visual comparison
Adj. EBITDA ($B)
CRWD FCF-based · PANW non-GAAP op. income
EVA — value creation vs. cost of capital
NOPAT minus capital charge (WACC × inv. capital)
technical chart analysis — april 16, 2026
Current price$411.16
52-wk high (ATH)$566.90 (Nov 2025)
52-wk low$342.72
From ATH-27.5%
From 52-wk low+19.9% recovery
YTD (from ~$468)-12.2% approx.
20-day MA~$401 (price above ✓)
50-day MA~$405 (price above ✓)
200-day MA~$460 (price below ✗)
RSI (14-day)~42–53 · Neutral-Recovering
MACDTentative buy forming
Beta1.12 (near-market)
price level map — support & resistance
ATH$566.90All-time high · Nov 2025
R2$460200-day MA · major resistance
R1$428Near-term resistance band
NOW$411Between 50d MA & R1
S1$40120-day MA · near-term support
S2$342.7252-wk low · major support
Technical read: CRWD is in recovery mode after forming a base at $342.72 and rebounding nearly 20%. The stock is constructively positioned above both the 20-day ($401) and 50-day ($405) MAs — short and medium-term momentum are positive. The critical next test is the $428 resistance level, beyond which the 200-day MA at $460 becomes the decisive hurdle. A confirmed close above $460 on volume would signal trend reversal and open a path toward the $490 analyst consensus target. Until then, the stock is technically neutral-to-improving — not a confirmed breakout, but no longer in freefall.
act-by-act — crwd's price narrative
ACT 01 · 2019–JUL 2024
The Falcon Rises
From $34 IPO to $398 peak. Cloud-native security for the remote-work era. Revenue growing 35%+ YoY. Reputation as "Special Forces" of endpoint protection, winning Sony and DNC investigation mandates.
ACT 02 · JUL–AUG 2024
The Outage Crisis
Faulty update crashes 8.5M Windows systems. Stock collapses 45% to $218. Fortune 500 losses exceed $5B. Existential questions about the platform's reliability and role as concentrated global infrastructure.
ACT 03 · SEP 2024–MAR 2026
The Comeback
97% retention. Falcon Flex drives ARR. Charlotte AI emerges. $5B ARR crossed. FY26 best year ever. Stock recovers to $566. Kurtz's performance package tied to $10B ARR aligns with shareholders.
ACT 04 · TODAY
The AI Question
Down 27% from ATH at $411. AI disruption fears (Anthropic Claude Code narrative). Recovering above 20d/50d MA but below 200d. June 9 earnings next catalyst. $20B ARR by FY2036 — the long-game thesis.
investment case — bull vs. bear
Bull case
Mission-critical infrastructure: Cyberattacks do not pause for recessions. With 97% gross retention, once deployed, enterprises almost never rip out CrowdStrike — the switching cost of replacing a security platform is measured in years of integration work and human capital. MarketsandMarkets projects cybersecurity to reach $351.9B by 2030 (+9.1% CAGR).
AI tailwind: Selected for OpenAI TAC program. Charlotte AI handles 97% of alerts autonomously. Every AI workload enterprises deploy requires security — CrowdStrike is embedded as the security layer from "GPU to agent to prompt." $20B ARR target by FY2036 assumes AI drives a new TAM expansion cycle.
Falcon Flex + module expansion: $1.69B Flex ARR growing 120% YoY. Platform consolidation trend — enterprises reducing from 60–80 tools to a unified platform — is a multi-year structural tailwind. 41 Buy ratings, 0 Sell. Avg target $489.86.
Valuation reset from ATH: At $411 vs. $566 ATH and $489 avg target, the risk/reward is more balanced than at peak. $5.23B cash, $1.24B FCF, 97% retention — this is a high-quality compounding business at a 27% discount to its 52-wk high.
Bear case
AI disruption of the SOC: Anthropic's Claude Code narrative (April 2026) raised the question: if AI can autonomously detect and respond to threats at near-zero marginal cost, does the $411 stock price reflect a platform about to be commoditised? CrowdStrike's answer is Charlotte AI — but incumbent AI security tools could erode pricing power.
Microsoft bundling: Defender is functionally free for enterprises in E5 Microsoft 365 licenses. As Microsoft improves Defender's detection efficacy, the "good enough for free" argument becomes stronger for cost-conscious enterprises. CrowdStrike's $22B+ FY2026 average contract value faces this headwind directly.
Outage recurrence risk: A second major outage would be unforgiving. CrowdStrike has implemented new QA protocols, but kernel-level software inherently carries this risk. Delta litigation is an ongoing headline risk.
Valuation remains premium: Even at $411, CRWD trades at ~85× forward earnings and ~17× EV/forward revenue. Strong execution is already priced in. Any revenue deceleration below the guided 22% FY27 growth will reprice the stock downward sharply.
verdict summary
CrowdStrike is, without question, one of the highest-quality cybersecurity platforms in existence — a Piotroski 8/9, $5.25B ARR business with 97% gross retention, 80% subscription gross margins, $1.24B FCF, and a $20B ARR long-term vision backed by the AI security tailwind. The July 2024 outage, once an existential crisis, is now chapter two in a remarkable comeback story that proved the platform's stickiness under maximum stress.
The competitive scorecard shows CRWD leading pure-play peers (SentinelOne, Zscaler) on virtually every quantitative metric, trailing only Palo Alto Networks on absolute scale while matching it on financial quality signals. Palo Alto remains the closest strategic competitor and deserves its own analysis — both companies are racing to become the enterprise's unified security operating system.
The bear case — Microsoft bundling and AI commoditisation — is real but not yet decisive. CrowdStrike's strategic move to ingest Microsoft Defender data into its Next-Gen SIEM is a masterclass in competitive repositioning: rather than fighting Microsoft, it becomes the analytics brain above Microsoft's telemetry.
Current positioning: At $411, CRWD sits 27% below its ATH with the short- and medium-term MA above price but the 200-day MA ($460) still serving as resistance. The June 9, 2026 Q1 FY2027 earnings call — the first test of the $5.87–5.93B FY27 revenue guidance — is the next major inflection point. For a long-term investor (3–5 years), accumulating between $400–$420 offers a favourable risk/reward against a $489 consensus target and a business with a structurally growing TAM.
For informational purposes only. Not financial advice. Prices as of April 16, 2026. Competitor metrics estimated from public SEC filings; EVA, Altman Z, and Piotroski calculations are approximations for comparative purposes. Past performance does not guarantee future results. Consult a qualified financial advisor.
PERSONAL RESEARCH · 2026 · CRWD