CrowdStrike Q2 FY27: net new ARR re-accelerates to 51%
CrowdStrike signed up $332.8 million of brand-new annual subscription value in three months, the most it has ever added in a quarter. It also lost money running the business. Both are true. Only one of them moved the stock.
The number that did the work
Net new ARR is the metric CrowdStrike is judged on. ARR is annual recurring revenue, the annualised value of subscriptions under contract; net new ARR is how much of it the company added in the quarter after churn. For the three months to July 31 it came in at $332.8 million, up 50.5% year over year, against consensus of roughly $284 million and a tougher buy-side bar that Jefferies had put at about $310 million going in.
The re-acceleration is the point. The prior quarter grew 32%. This one grew 51%, and CEO George Kurtz told the earnings call it beat the top of the company's own guidance by more than $45 million.
The rest of the print was solid rather than spectacular. Total revenue of $1,470.9 million grew 25.8%, subscription revenue of $1,400.3 million grew 27.0%, and total deferred revenue reached $4,842.2 million, up 26.3%. Sales and marketing fell to 34.7% of revenue from 38.2% a year ago while R&D rose 29.7%, which is the shape you want: spending shifted from selling to building.
The raise was bigger than the beat
Ending ARR reached $5.84 billion, up 25%, the fourth consecutive quarter of accelerating ARR growth off a trough of 20% in Q2 FY26, when commitment packages handed out after the July 19 incident were still dragging.
Then management did the thing that actually re-rated the shares. It lifted full-year FY27 net new ARR growth guidance by 630 basis points, to roughly 34% at the midpoint, or about $1.355 billion. Cumulatively that is a 1,150 basis point raise from the 22.5% CrowdStrike guided to at the start of the year, worth about $116 million.
CFO Burt Podbere was explicit that this was not simply passing through one good quarter: "The magnitude of this increase reflects more than our Q2 outperformance... we believe it is driving a broader security modernization cycle."
Falcon Flex is the engine
Falcon Flex lets a customer commit one budget across CrowdStrike's modules and draw against it, instead of negotiating each product separately. Ending ARR from Flex accounts passed $2.29 billion, up 101%.
The mechanics disclosed on the call explain the acceleration better than any slogan. More than 935 Flex accounts were added, which CEO George Kurtz framed as "more than 10 Flexes every day of the quarter and more Flexes than the last three quarters combined." All ten of the largest deals by value were Flex. Converting a standard subscription to Flex lifts ending ARR by more than 40% on average; the first re-flex, which arrives about eight months later, adds roughly another 25%; accounts that have re-flexed twice carry 53% more ARR than at their initial Flex. More than 630 accounts have now re-flexed at least once, about six times as many as a year ago.
The cleanest tell is that Flex new-logo ARR was 34% of net new ARR, a record. New customers are arriving straight into the bundle rather than landing on endpoint and expanding later.
Management also itemised product lines on the call, though not in the filing: Next-Gen SIEM above $695 million (+60%), cloud security above $905 million (+29%) and Next-Gen Identity above $585 million (+34%). Module adoption deepened only at the top end, with 26% of subscription customers on eight or more modules versus 25% last quarter, while the six-plus and seven-plus tiers held flat.
The part nobody asked about
Non-GAAP operating income was a record $371.6 million, a 25.3% margin, up 350 basis points year over year. Non-GAAP diluted EPS was $0.31, up 34.8%, on a post-split basis after the 4-for-1 split that took effect on July 1.
On a GAAP basis CrowdStrike lost $33.2 million from operations, and that loss widened from $30.6 million in the prior quarter. GAAP net income was $5.3 million, or $0.01 a share, on $1.47 billion of revenue.
The reconciling item is one line: stock-based compensation plus related employer payroll taxes of $399.0 million, which is larger than the entire non-GAAP operating income it is excluded from. That is not a rounding adjustment. It is the difference between a company that looks 25% operating-margin profitable and one that does not yet cover its own costs under the rules everyone else reports by. Thirteen analysts asked questions on the call. None of them asked about it.
Record cash flow, quietly worse cash flow
Operating cash flow of $530.3 million was up 59.3%. Free cash flow of $377.4 million was up 33.1% year over year but down 19.4% sequentially, and the gap is entirely infrastructure. Purchases of property and equipment went from $30.5 million a year ago to $124.4 million. Add capitalised software and CrowdStrike is now spending 10.3% of revenue on building things, against 4.1% a year ago.
Podbere guided free cash flow margin to 27.5% in Q3 and at least 30% for the year, which answers the ratio without addressing the build. Nobody asked about that either. Cash still ended at $5,013.8 million.
What the tape actually did
The stock closed the print session at $189.18 and was marked at $209.10 after hours, up 10.53%, having spiked to roughly +12% first and then handed about 150 basis points back. At the time that fade read like a crowded long taking profit. It was the halfway point.
The next session opened at $208.25, never traded below $206.10, and closed at $227.96, up 20.50% on 23.4 million shares — about 1.72 times the previous day's volume, and within 0.5% of the session high, after printing an all-time high of $229.08 intraday. That is a new record close, past the $225.53 set on August 13, and the biggest single-day gain since April 2025. Options had priced about a ±9% move; the realised move was more than double that, and roughly double what the after-hours tape had settled on. Nor was there a give-back: after hours on the 27th the stock sat at $227.70.
One caution on attribution: this was a group move. Okta reported the same evening and closed +28.63%, Salesforce +22.58%, NVIDIA +8.74%. But the cleanest tell is Palo Alto Networks, up 12.83% on no news of its own, three sessions ahead of its own print. SentinelOne added 10.73%, Zscaler 9.98%, Fortinet 9.67%, Cloudflare 8.19%. The cybersecurity ETF BUG gained 10.41% and the software ETF IGV 7.74%, while the S&P 500 managed 0.72% with information technology the only sector in the green. CrowdStrike at +20.50% ran at roughly twice its own sector, so a meaningful share of the move was genuinely its own. Not all of it.
Twenty-five raises, zero upgrades
Positioning going in was long but not uniform: standing post-split targets ran from Berenberg's $180 on a Hold to RBC's $256, with MarketBeat showing a $199.79 consensus against a $218.06 average on stockanalysis.com. Wells Fargo had raised its target to $230 and kept an Equal Weight. Guggenheim stayed Neutral. Arete and Berenberg had both downgraded earlier in the summer on price, not fundamentals.
Then the revision wave landed: 27 dated sell-side actions on August 27, 25 of them price-target raises, and not one rating change in either direction. No upgrades. No downgrades. Nobody moved a recommendation on a day the stock gained 20.5%.
The raises still could not keep up with the price. At $227.96 CrowdStrike closed above both published consensus targets — $214.43 at MarketBeat, $224.98 at stockanalysis.com — even after 25 firms marked their numbers higher that morning. The post-split range now runs from Bernstein's $119 on a Market Perform to Citi's $260. Strip out Bernstein and it is $200 to $260, with the pack clustered at $240 to $250.
Zero upgrades is the tell. Baird, Evercore, Canaccord, Roth, Bernstein and Guggenheim all had the print in hand, all wrote it up positively, and none of them came off the sidelines. Guggenheim's John DiFucci granted that "they did what they said they would and more" — and stayed Neutral. Raising a target to catch up with the price is not the same as changing your mind. The forward multiple, meanwhile, re-inflated from about 135x to about 161.8x in a single session.
The one substantive pushback came from KeyBanc, whose customer conversations "suggest demand has not fully inflected yet." It raised its target to $245 anyway.
What to watch
Whether the retention improvement gets a number. Both net and gross dollar-based retention "improved sequentially," per management, with no figure attached. The last hard gross-retention disclosure was 97%, in Q1 FY26.
Whether the capex line keeps climbing. A quadrupling year over year at 10.3% of revenue is either an AI-inference build with a return attached or the start of a permanently heavier business. Two more quarters will tell.
Whether GAAP catches up. CrowdStrike has now posted three consecutive quarters of positive GAAP net income, and the largest of them was $38.7 million. Until $399 million a quarter of stock compensation stops outgrowing operating income, the non-GAAP margin story and the actual economics are two different stories about the same company.
The quarter was the best in CrowdStrike's history by the metric management picked. The bill for it is still being expensed in shares.