The Q2/FY27 guide is strong, and commentary around Mythos impact is positive, suggesting continued engagement from long-term bulls.
FY27 NNARR growth was raised by 520 bps to ~27.7% at the midpoint, implying acceleration over FY26 and a stronger second half despite tougher comparisons.
Management tied demand to various initiatives like "Mythos," Project Glasswing, Project QuiltWorks, and the need to secure AI agents, developer tools, and cloud workloads.
AIDR ending ARR grew over 250% quarter-over-quarter, with a >$50M Q2 pipeline, and management believes AIDR can ultimately be larger than EDR.
Customer conversations around RSA and Mythos shifted towards securing Shadow AI, identity, MCP-type services, and endpoint AI workloads, indicating new demand drivers.
AI token spend has created new budgets, and security is being incrementally funded around AI adoption.
Next-gen SIEM, Cloud, and Next-gen Identity produced record Q1 NNARR and now exceed $2B in combined ending ARR, with strong growth in Falcon Shield ARR and Next-gen Identity NNARR.
Management highlighted the third consecutive quarter of endpoint ARR growth acceleration and entered Q2 with a record endpoint pipeline, framing endpoint as the control point for AI.
Flex ending ARR surpassed $1.9B, growing 99% year-over-year, with over 1,900 Flex customers, and Re-Flex customers showed significant uplift.
FQ1 non-GAAP operating margin and free cash flow exceeded Street expectations, and FY27 FCF margin guidance remained at 30%+ despite the growth raise.
Confidence in deal velocity and pipeline is driven by Claude Code adoption and agent-management urgency, with AIDR being incremental and Next-gen SIEM still early in greenfield adoption.
The company's ability to sustain high-20s NNARR growth for FY27 is a key positive data point, and AIDR is seen as a new category the company is structurally positioned to own.
If AIDR, Next-gen SIEM, identity, and cloud continue to scale, the company can remain a 20%+ grower for longer than typical software companies at its scale.
The budget narrative has shifted, with AI creating new attack surfaces and incremental security budgets, rather than being a threat to security vendors.
Falcon Flex provides a commercial mechanism for customers to expand into new modules, and new models will accelerate demand.
The company is well-positioned to capture incremental value in the security value chain due to its broad telemetry, workflow ownership, and closed-loop security capabilities.
CRWD: Q1 NN ARR of $256M missed buy-side expects > $275M. Q2/FY27 guide strong and commentary positive around Mythos impact, but still a high bar to meet.
Q1 NN ARR of $256M missed buy-side expectations of >$275M, indicating the performance was not good enough against heightened expectations.
The company needs NNARR growth to reaccelerate above 50% for the remainder of the year, which would require a Q2 NNARR result roughly 20% above expectations.
The FQ1 ARR beat was only around $6M, much smaller than the typical recent beat range, and NNARR missed the buyside bogey.
Billings missed and RPO declined quarter-over-quarter, suggesting some bookings indicators were less clean than the revenue, operating margin, and free cash flow results.
Bears question whether the FY27 guide assumes a lot of second-half improvement at a time when NNARR comparisons become much harder.
The durability of growth is a concern, as AIDR is early, the $50M AI pipeline is not yet large enough to materially impact total ARR, and AI security adoption could take time to convert into enterprise-wide deployments.
The company already trades at an extreme premium compared to security and software peers, so even solid low-20s revenue growth with 30%+ FCF margin may struggle if growth does not materially reaccelerate.
remediation, response, governance, and audit workflows. As a result, platform vendors with broad telemetry, workflow ownership, and closed-loop security capabilities—such as PANW, MSFT, CRWD, GOOGL, and CYBR—appear best positioned to capture incremental val...