CrowdStrike at $5.25B ARR just posted its largest quarter of net new ARR ever — $331M, up 47% year-over-year. The first pure-play cybersecurity company to cross $5B in ARR. The first year ever above $1B in net new ARR. Record operating income, record free cash flow, record EPS.
The narrative 12 months ago was that AI would eat cybersecurity alive — that hyperscalers would bundle it away, that LLMs would commoditize detection, that CrowdStrike specifically was in trouble.
The results say otherwise.
And yet … the stock traded down. Why? The markets didn’t just want to see strong growth continue. They wanted to see acceleration in the Age of AI. And while Crowdstrike is predicting continued strong growth, it’s not predicting acceleration.
Here are 5 Interesting Learnings from CrowdStrike’s Q4 FY2026 at $5.25B in ARR:
1. Net Retention Accelerated to 115% — and Has Been Improving All Year
CrowdStrike’s dollar-based net retention rate hit 115% in Q4, up from 112% in Q1, 111% in Q2, and 114% in Q3. Gross retention held at 97% every single quarter of the year.
At $5B+ in ARR, NRR is supposed to compress. The law of large numbers. The “good enough” effect. The maturation of the installed base. CrowdStrike is running the opposite direction.
115% NRR at this scale means existing customers are buying more — not less — every year. That’s not a feature of the market. That’s a product and platform motion that is actively working. Customers who land on Falcon keep expanding into more modules, more clouds, more use cases.
For founders building B2B businesses: NRR is the single most important metric in your business, and it almost always compresses as you scale. CrowdStrike is a reminder that it doesn’t have to — if the platform is broad enough and the expansion motion is deliberate enough.
2. Falcon Flex Is a $1.69B ARR Machine Growing 120% — And Customers Keep “Re-Flexing”
Falcon Flex — CrowdStrike’s flexible consumption model that lets customers consume across the platform without renegotiating contracts — is one of the most interesting commercial innovations in B2B right now.
The numbers: $1.69 billion in Flex ending ARR, up over 120% year-over-year. 1,600+ Flex customers. 380+ customers have already “Re-Flexed” — meaning they expanded their Flex agreement. Nearly 100 customers have Re-Flexed multiple times.
The average ARR lift for a customer after adopting Flex is 26%.
Think about that. You sign a customer into a flexible consumption model. They expand on their own, in their own time, without your sales team having to go back in and renegotiate. And 380+ of them have done it more than once.
This is the land-and-expand motion at its theoretical best. The product earns expansion. The commercial model doesn’t block it. Most B2B companies never crack this at scale. CrowdStrike has.
3. The “New” Platform Businesses Hit $1.9B ARR Combined, Growing 45% YoY
CrowdStrike’s three emerging platform pillars — Cloud Security, Next-Gen SIEM, and Next-Gen Identity — collectively crossed $1.9 billion in ending ARR, growing over 45% year-over-year.
Breaking it down:
- Cloud Security: $800M+ ARR, growing 35%+ YoY
- Next-Gen SIEM (LogScale): $585M+ ARR, growing 75%+ YoY
- Next-Gen Identity: $520M+ ARR, growing 34%+ YoY
These are each businesses that would be standalone unicorns. They are all growing faster than the 24% company average. And they are all being pulled by AI — every enterprise standing up AI infrastructure creates new cloud attack surfaces, new identity threat vectors, new log volumes that legacy SIEM can’t handle.
The point here for founders: CrowdStrike built the core endpoint business to dominance, then systematically expanded into adjacent categories. Each adjacency was defended by the same data advantage and the same single-sensor platform. That $1.9B in “new” ARR growing 45% is what category expansion looks like when done right.
4. Charlotte AI Is Up 6x and AI-DR Grew 5x in One Quarter … But None of It Is Discretely Monetized Yet
This is the most important number in the entire earnings report for understanding where CrowdStrike is going.
Charlotte AI usage up 6x year-over-year. AI Detection and Response (AI-DR) up 5x in a single quarter — after being available for just a few weeks. Pangea gaining traction. Agentic workflows being deployed across the Falcon platform.
None of it shows up as a discrete revenue line. It’s all bundled into platform ARR.
Every other major enterprise software company right now is racing to put a price on AI agents — Salesforce with Agentforce, ServiceNow breaking out AI SKUs, Workday introducing AI-specific pricing tiers. CrowdStrike is sitting on what might be the most defensible AI agent use case in all of enterprise software — autonomous threat detection and response, running on the richest security data set in the world — and hasn’t put a separate price on it yet.
That’s either a deliberate land-and-expand strategy (drive adoption first, monetize once it’s sticky, which is very on-brand for CrowdStrike) or it’s a massive untapped revenue lever that simply hasn’t shown up in the numbers yet. Probably both.
The moment CrowdStrike introduces discrete AI agent pricing — even modest consumption-based tiers — it becomes a credible re-acceleration story. The usage growth is already there. The monetization isn’t. Watch this space closely in FY27.
5. Remaining Performance Obligations Jumped to $9B — Up 38% YoY
ARR gets most of the attention. The RPO pipeline is the signal most people miss.
CrowdStrike’s remaining performance obligations grew to $9.0 billion at end of Q4, up from $6.5 billion a year ago — a 38% increase. That’s contractually committed revenue sitting in the pipeline waiting to be recognized.
RPO growing 38% while ARR grows 24% means forward revenue visibility is expanding faster than current revenue. Customers are signing longer, larger contracts. The backlog is building. Q1 FY2027 pipeline reportedly grew 49% year-over-year.
This is the number that tells you whether the next 4-6 quarters are already sold. At $9B in RPO on a $5.25B ARR base, CrowdStrike has roughly 1.7x coverage. That’s not a company worried about demand. That’s a company that already knows what the next few years look like.
Vibe Coding Isn’t Denting Crowdstrike. The Numbers Are Epic. But …
The bears had a compelling narrative. AI disrupts security. Hyperscalers bundle it away. CrowdStrike is too big to grow.
CrowdStrike answered with the best quarter in its history. $331M net new ARR. 115% NRR accelerating. $9B RPO. $1.69B in Flex ARR growing 120%.
At $5.25B ARR growing 24%, with NRR accelerating, Flex compounding, and a TAM doubling by 2030 — this is what it looks like when a category leader runs toward AI, not away from it.
The category is not being disrupted. The category is expanding. And CrowdStrike is taking more than its share of it.
But … Here’s the Catch: The Markets Want to See Acceleration. And They’re Not Getting It.
Stock dropped after hours despite the beat. That’s worth understanding.
The guidance for Q1 FY2027: ~$250M in net new ARR. Down from $331M this quarter. That’s not a typo — CrowdStrike is guiding to a meaningful sequential step-down.
Yes, seasonality is real. CrowdStrike’s Q4 is always their strongest quarter, and they’re explicitly guiding to their normal pattern of ~41% of net new ARR in H1 and 59% in H2. This isn’t new. The step-down is expected internally.
But the market isn’t just comparing to last quarter. It’s asking: is the growth rate re-accelerating? And the honest answer is: not yet.
- FY26 ARR growth: 24%
- FY27 ARR guidance: ~23%
- FY27 net new ARR implied: ~$1.24B — up 23% from FY26’s $1.01B
That’s consistent growth, not compounding acceleration. At $5B+ ARR, 23% is genuinely impressive. But the markets have priced CrowdStrike as a company that should be re-accelerating on the back of AI demand — and this guidance says “steady” not “faster.”
The long-term target of $20B ARR by FY2036 requires compounding at roughly 14% annually from here. Achievable. But that means the growth rate has to slow further over time, not expand. The market knows this math.
Here’s the founder takeaway: there’s a real difference between “great results” and “results that change the narrative.” CrowdStrike delivered great results. What would change the narrative is a quarter where net new ARR guidance accelerates — where AI demand starts visibly bending the curve upward rather than sustaining it.
That may still come. The $9B RPO, the 49% pipeline growth, the 5x jump in AI-DR adoption in a single quarter — those are leading indicators that could support acceleration in H2 FY27 or beyond. But the market is pricing for proof, not promise.
The best quarter in CrowdStrike’s history was not enough to convince the market the best is still ahead. That’s a high bar. And honestly, for a company at this scale and valuation, it’s probably the right bar.
