CRWD Q1 2026: FalconFlex Usage Sparks Net New ARR Acceleration
- FalconFlex Rapidity & Reflex Adoption: Customers are burning through their FalconFlex subscriptions at a faster-than-anticipated pace, then “reflexing” to secure additional licenses—this behavior is accelerating net new ARR growth and deepening overall platform adoption.
- Next Gen SIEM Platform Advantage: The built‐in Next Gen SIEM capability, which displaces legacy solutions like Splunk and QRadar, provides customers with an integrated, cost‐effective solution that enhances competitive positioning and drives higher win rates.
- Robust Channel Momentum: There is significant growth in channel performance, with the MSSP channel now accounting for more than 15% of deal value, underscoring strong partner engagement and scalable revenue opportunities.
- Regulatory scrutiny risk: The company has received information requests from the DOJ and the SEC regarding revenue recognition and ARR reporting for certain transactions, which could signal potential future regulatory and accounting challenges.
- Revenue versus ARR divergence: The impact of CCP-related revenue amortization is causing a temporary separation between ARR and revenue recognition, potentially complicating the assessment of underlying organic growth.
- Volatile subscription dynamics: The accelerated consumption of FalconFlex licenses—with customers burning through their contracted credits faster than expected and needing to reflex for additional usage—may lead to lumpy ARR inflows and uncertainty in future subscription revenue stability.
Metric | YoY Change | Reason |
---|---|---|
Total Revenue | ~20% increase (Q1 FY2026 guidance at $1,100.6M–$1,106.4M) | Revenue Growth: The Q1 FY2026 guidance reflects a continuation of strong revenue performance, building on FY2025 results which saw a 29% revenue increase driven by a 31% growth in subscription revenue. This robust prior performance provides the foundation for the current period’s growth expectations. |
Non-GAAP Income from Operations | Increase inferred via improved margins | Operating Margin Improvements: Although FY2025 saw significant investments—with sales & marketing up 34% and R&D up 40%—the Q1 FY2026 guidance indicates a non-GAAP operating margin target of approximately 21%. This suggests that the company expects efficiency gains and returns on prior investments to start translating into better operating income. |
Non-GAAP Net Income and EPS | Adjusted due to tax rate changes | Tax and EPS Adjustments: In FY2026, CrowdStrike adopted a long-term non-GAAP tax rate of 22.5% to achieve consistency. This change yields an estimated impact of $(0.19) per share at the midpoint for Q1 FY2026, affecting comparability with previous periods where the tax rate treatment differed. |
Incident-Related Costs | Significant one-off costs in Q1 FY2026 | Incident-Related Expenses: Q1 FY2026 is expected to incur approximately $73M for outage-related costs and an additional $43M due to flexible payment terms under customer commitment packages from late FY2025. These are non-recurring costs that were not seen in previous periods and thus contribute to the altered financial picture this period. |
Net New ARR | ~21–23% seasonal decline from Q4 FY2025 | Seasonal ARR Trends: A typical Q4-to-Q1 seasonal decline of 21–23% in net new Annual Recurring Revenue is anticipated, reflecting historical patterns. Despite this seasonal dip, the company’s earlier performance has set the stage for anticipated net new ARR acceleration in the latter half of FY2026, paving the way for further growth in FY2027. |
Presentation of Non-GAAP Measures | Change in calculation affecting comparability | Non-GAAP Measure Adjustments: Effective February 1, 2025, payroll taxes related to employee stock-based awards (amounting to $42.2M in FY2025) were excluded from non-GAAP results. This change alters the comparability of current period metrics with those of previous periods, requiring a careful reassessment of performance trends. |
Metric | Period | Previous Guidance | Current Guidance | Change |
---|---|---|---|---|
Total Revenue | Q1 FY2026 | $1,100.6M to $1,106.4M | no current guidance | no current guidance |
Non-GAAP Income from Operations | Q1 FY2026 | $173.1M to $180.0M | no current guidance | no current guidance |
Non-GAAP Net Income Attributable to CrowdStrike | Q1 FY2026 | $162.1M to $167.5M | no current guidance | no current guidance |
Non-GAAP Diluted Net Income Per Share | Q1 FY2026 | $0.64 to $0.66 | no current guidance | no current guidance |
Metric | Period | Guidance | Actual | Performance |
---|---|---|---|---|
Total Revenue | Q1 2026 | $1,100.6 million to $1,106.4 million | $1,103.4 million | Met |
Topic | Previous Mentions | Current Period | Trend |
---|---|---|---|
FalconFlex Subscription Dynamics | Consistently discussed in Q2 2025 ( ), Q3 2025 ( ), and Q4 2025 ( ) as a transformative model driving rapid adoption, consolidation, and multi‐module deals. | Q1 2026 continues to highlight FalconFlex as a “game changer” with rapid customer adoption, faster consumption and “reflex” deals that drive net new ARR ( ). | Consistently positive. The narrative remains strong across periods with evolving examples of accelerated revenue and adoption, reinforcing its role as a core growth lever. |
Next Gen SIEM Platform Adoption and Competitive Positioning | Addressed across Q2 2025 ( ), Q3 2025 ( ), and Q4 2025 ( ) with emphasis on triple-digit growth, customer wins displacing legacy SIEMs, and robust competitive positioning. | Q1 2026 reflects continued strong momentum with triple-digit ARR growth, significant customer wins and an integrated offering that consolidates disparate legacy systems ( ). | Sustained bullish sentiment. The platform continues to consolidate market share and underscores CrowdStrike’s competitive edge. |
Robust Channel and Partner Engagement | Extensively covered in Q3 2025 ( ) and Q4 2025 ( ) with emphasis on high partner‑sourced business percentages, growth of GSIs, MSSPs and hyperscaler engagements. | Q1 2026 mentions growing MSSP channel momentum with 15% of bookings coming from MSSPs and an ongoing partner-first approach ( ). | Stable with incremental improvement. While the core message remains positive, Q1 focuses on MSSP momentum as a notable channel advancement. |
Regulatory Scrutiny and ARR/Revenue Recognition Divergence | Mentioned in Q3 2025 ( ) regarding temporary ARR/revenue divergence caused by Customer Commitment Packages; Q2 2025 had no details. | Q1 2026 introduces new regulatory disclosures with DOJ/SEC requests along with explanation of a temporary ARR/revenue divergence of approximately $10–15 million per quarter ( ). | Ongoing concern. The theme remains present, now coupled with regulatory inquiries, though the divergence is described as temporary. |
AI Platform Performance: Charlotte AI and Emerging AI Trends | Discussed in Q2 2025 ( ), Q3 2025 ( ), and Q4 2025 ( ) with consistent emphasis on operational transformation in SOCs, rapid efficiency gains and a growing role in securing AI environments. | Q1 2026 reinforces Charlotte AI’s transformative role in SOC operations with high adoption and cost-saving benefits, alongside broader emerging AI trends that stress the need for securing expansive AI agent ecosystems ( ). | Highly positive and transformative. Consistent acceleration in use and impact across periods with a broadened emphasis on securing the growing AI landscape. |
AWS Marketplace Expansion and Cloud Security Growth | Q2 2025 ( ), Q3 2025 ( ) and Q4 2025 ( ) detailed significant expansion in AWS Marketplace sales and robust growth in cloud security ARR and customer wins. | No specific discussion in Q1 2026. | Dropped from current discourse. Despite strong historical emphasis, this topic is not mentioned in Q1 2026, suggesting a possible shift in focus or temporary deprioritization. |
Operating Margin and Financial Performance Challenges | Examined in Q2 2025 ( ), Q3 2025 ( ) and Q4 2025 ( ), highlighting strong non‑GAAP margins alongside challenges from incident‑related expenses and CCP effects. | Q1 2026 reports a non‑GAAP operating margin of 18% with strategic investments and specific Q1 challenges (e.g. outage expenses and ARR recognition adjustments) ( ). | Mixed but improving. While operational challenges persist, strategic investments and margin expansion plans are prominent; investors should watch progress against guidance. |
Deceleration in Growth of Emerging Products (Cloud & Identity) | Q4 2025 noted concerns over deceleration for cloud and identity – with CEO remarks on CCP elements driving short‑term slowdown ( ) – while Q2 and Q3 highlighted robust growth in both areas ( ). | Q1 2026 makes no mention of deceleration, instead emphasizing strong momentum, renewed customer wins, and continued expansion in cloud and identity capabilities ( ). | Shift to optimism. What was framed as a deceleration concern in Q4 has been replaced by renewed confidence and strong growth sentiment in Q1. |
Reliance on External Technologies for Internal Efficiencies | Q3 2025 ( ) and Q4 2025 ( ) discussed leveraging partner technologies (Salesforce, ServiceNow, etc.) and AI tools that substantially improved employee efficiency and automated reporting. | Q1 2026 did not specifically address this topic. | Topic dropped in current remarks. Previously emphasized as a driver of internal efficiency, its absence in Q1 suggests either integration into broader AI or a lower priority for discussion in this period. |
Platform Consolidation and Module Upsell Strategy | Consistently analyzed in Q2 2025 ( ), Q3 2025 ( ) and Q4 2025 ( ), with Falcon Flex and CCPs driving multi‐module deals and deeper customer commitment. | Q1 2026 reaffirms the strategy where Falcon Flex continues to accelerate platform consolidation, with customers ‘reflexing’ and rapidly expanding module adoption ( ). | Steadily bullish. The strategic narrative remains unchanged, underscoring sustained platform consolidation and higher upsell potential as a fundamental growth driver. |
Impact of External Incidents on Revenue Growth (July 19 Incident) | Q2 2025 described significant delays in deals and ~$60 million impact from CCPs; Q3 2025 detailed extended sales cycles, ARR contraction adjustments, and headwinds, while Q4 2025 blended incident‑related concerns with minimal revenue disruption ( ). | Q1 2026 focuses on regulatory inquiries linked to the July 19 incident without detailing its immediate revenue impact, suggesting a shift toward addressing compliance and reporting matters ( ). | Evolving focus. While prior periods emphasized immediate revenue and sales cycle impacts, Q1 now spotlights regulatory follow‑up, indicating a more mature phase of incident management. |
Potential Architectural Changes due to External Policies | Only discussed in Q2 2025 ( ), where CEO George Kurtz clarified that no re‑architecting was needed despite external policy pressures. Q3, Q4 had no mention. | No discussion in Q1 2026. | Disappeared from current discourse. This topic seems to have been resolved or deprioritized following assurances in Q2, with no further emphasis in later periods. |
-
ARR Divergence
Q: Why do revenue and ARR diverge today?
A: Management explained that CCP-related amortization causes a near-term revenue hit while ARR remains strong and is expected to accelerate in the back half. -
CCP Impact
Q: How does CCP boost future ARR growth?
A: They detailed that as Flex credits are burned faster, customers “reflex” into new, larger contracts, directly driving net new ARR and margin expansion. -
Free Cash Flow
Q: What is the free cash flow outlook?
A: The team projects a robust free cash flow margin near 30%, underpinned by operational efficiencies and larger, longer deals. -
Falcon Flex Usage
Q: Which products benefit most from Flex?
A: Management noted that next gen SIEM and identity/cloud solutions are the key drivers, as the model shifts focus from module-by-module sales to delivering overall customer outcomes. -
Flex Reflex Revenue
Q: How is a rapid Flex burn reflected in ARR?
A: Once customers exhaust their Flex licenses quickly, they “reflex” into new purchases that immediately convert into net new ARR. -
SIEM Displacement
Q: Which legacy SIEMs are being replaced?
A: They pointed out that customers are moving away from Splunk and QRadar in favor of an integrated, next-generation SIEM solution. -
AI Demand
Q: What drives current and future AI demand?
A: The call emphasized that tools like Charlotte AI are streamlining SOC operations now, while protections for autonomous agents herald vast long-term opportunities. -
Identity Vision
Q: What is your vision for identity management?
A: They are broadening their identity offering into privileged access and more comprehensive consolidation to better serve customer needs. -
Budget & ROI
Q: How do customers budget for rapid Flex usage?
A: Through detailed demand planning, customers replace disparate point solutions, realizing clear ROI benefits from an all-in-one subscription model. -
Sales Go-to-Market
Q: How has the sales process evolved with Flex?
A: The sales force is reoriented to focus on demand planning and outcomes rather than selling individual modules, which has been well received. -
US Fed & Regulatory
Q: Any comments on US Fed and related inquiries?
A: They acknowledged questions from regulators regarding revenue recognition, yet stressed that their strong execution remains the priority. -
Macro Trends
Q: How did April and May trends compare?
A: Despite mixed signals, management reported steady overall execution and continued strong momentum in ARR growth.