TL;DR
The comp illusion: Q3’s 73% new ARR surge flatters last year’s post-outage disaster; the real growth rate is ~20%, not a re-acceleration
The opacity tell: Flex margins are undisclosed and SIEM ARR went silent—both matter more than “record quarter” headlines
The valuation trap: At 24x forward revenue, the stock requires flawless execution for 5+ years; margin of safety is zero
The most important thing to understand about CrowdStrike’s third quarter is that two stories are being told. The first is the one management wants you to hear: a triumphant rebound from last year’s outage, with net new ARR up 73% YoY and guidance affirmed. The second story is the one the data tells: this is a recovery to trend, not a re-acceleration beyond it. The market is pricing the latter while getting the former.
The Comp Illusion
Let’s start with the numbers, because everything else follows from here. CrowdStrike reported $265 million in net new ARR, a figure management described as “one of our best quarters in company history.” And compared to the $153 million from Q3 last year—the post-outage disaster quarter—it certainly looks that way. But last year’s Q3 wasn’t a normal baseline; it was a six-sigma event where customers froze purchase decisions en masse.
The relevant comparison is Q3 FY24, the last “normal” third quarter before the outage. Against that baseline, net new ARR growth was 19%. That’s solid, but it’s not spectacular. It’s also not an acceleration. The overall ARR growth rate ticked up from 22% to 23%—a 100 basis-point move that, in a business with quarterly volatility, is statistical noise, not signal.
This matters because the narrative of “re-acceleration” is what justifies CrowdStrike’s premium valuation. But the data doesn’t support it. What we’re seeing is a recovery to low-20s growth, not a breakout to mid-20s or 30s. The outage is behind them, yes. But the business is growing at roughly the same rate it was before the outage. The only difference is that now it’s comping against the outage, which flatters the optics.
The Flex Question
If the top-line growth story is a mirage, then what’s actually interesting about this quarter? The answer is Falcon Flex.
George Kurtz is the best communicator in enterprise software, and his performance on the earnings call was characteristically masterful. He described Flex as “revolutionizing how customers procure and deploy the Falcon platform,” emphasizing that customers can now activate a module within an hour. What he’s really saying is that CrowdStrike has found a way to eliminate its biggest enemy: the enterprise procurement cycle.
A six-month procurement process gives competitors time to undercut on price, gives Microsoft time to bundle Defender for “free,” and gives CFOs time to defer spending. Flex eliminates that friction by turning budget into pre-committed credits. The psychology is clever: once cash becomes “Flex chips,” it feels like house money. A CISO can deploy a new module without a fresh approval cycle. The behavioral lock-in is real and powerful.
The numbers support this: Flex ARR now exceeds $1.35 billion, up over 200% YoY. More than 200 customers have “re-Flexed,” doubling sequentially, and those re-Flexing customers show a ~50% ARR uplift on average.
But here’s what Kurtz didn’t say: we have no idea what Flex-specific margins look like. Multi-year consumption deals typically involve 20-30% discounts, and the fact that subscription gross margin is stable at 81%—rather than expanding as Flex scales—suggests the economics may be less favorable than traditional licensing. If Flex is dilutive to gross margin, that’s a material trade-off for the accelerated upsell it enables. The silence is noteworthy.
The SIEM Silence
The opacity around Flex economics is compounded by another omission: SIEM ARR. Last quarter, management disclosed that SIEM ARR was approximately $430 million. This quarter, Kurtz celebrated a “record net new ARR quarter” for Next-Gen SIEM, citing EY’s selection of the platform for its global managed services.
What he didn’t mention was the actual SIEM ARR figure.
If SIEM had grown to $600 million or $700 million, Kurtz would have told us. He always does when metrics are accelerating. The silence is a tell. SIEM is real, and the AWS partnership—making Falcon the default SIEM in AWS Security Hub—is meaningful distribution. But distribution isn’t revenue until customers convert. This is a FY28 story, not a FY26 story.
The Microsoft Problem (Why the Opaques Matter)
Which brings us to the structural challenge that makes these questions about margins and disclosure urgent: Microsoft.
Kurtz claimed on the call that CrowdStrike’s “competitive win rates are at all-time highs” in the enterprise. I believe him. Companies with 10,000+ endpoints that can afford best-of-breed security will pay for CrowdStrike’s single-agent architecture and superior protection.
But the mid-market and SMB are different. Microsoft bundles Defender with E5 licenses for “free.” When a 500-person company’s CFO asks why they’re paying CrowdStrike $50 per endpoint, that’s a hard conversation. CrowdStrike’s answer is Falcon Go, a simplified SMB product, but this is playing defense in a segment where economics structurally favor the bundler.
I suspect CrowdStrike’s market share in sub-1,000 endpoint accounts is declining, even as enterprise share grows. The AWS partnership makes sense through this lens: AWS doesn’t have a competitive SIEM, so it’s using CrowdStrike to fight Microsoft’s Sentinel. It’s an alliance of convenience, and it’s strategically smart. But it also reveals that even CrowdStrike needs partners to compete with Microsoft’s distribution.
The Valuation Problem
All of this leads to the central problem: price. CrowdStrike trades at 24x forward revenue, a 50-100% premium to comparable growers like Cloudflare or Zscaler. The premium is for quality—the platform thesis, Kurtz’s execution, the single-agent architecture. That’s defensible.
What’s not defensible is that this price requires perfection. To justify a $125 billion enterprise value at a terminal 20x free cash flow multiple, CrowdStrike needs to generate $6.25 billion in FCF. At a 35% FCF margin, that implies $17.9 billion in revenue—3.7x current levels. Achieving that over 7-8 years requires:
- 20%+ growth sustained for 5+ years
- FCF margins expanding from 24% to 35%+
- No meaningful share loss to Microsoft bundling
- Successful SIEM monetization at scale
- Clean resolution of the DOJ/SEC inquiry
- No macro-driven enterprise spending pause
Each assumption demands near-perfect execution. The margin of safety is zero.
The Bottom Line
The business is healthy. The outage is behind it. Growth has stabilized in the low-20s, and platform consolidation is real: 49% of customers now have six or more modules, up from 45% a year ago. These are positive developments.
But at $517, you’re paying for a re-acceleration narrative that the data doesn’t support. The real story is more prosaic: a high-quality cybersecurity platform growing at a solid clip, facing competitive pressure in the mid-market, and testing a new consumption model with undisclosed economics.
The easy comps lap in Q4. FY27 guidance will need to demonstrate 20%+ growth without outage tailwinds. SIEM will need real numbers, not just “record quarter” claims. Until then, the risk-reward is skewed to the downside.
A great business at 18-20x forward revenue is a fair price. At 24x, it’s a great business with no margin for error. CrowdStrike is the former priced as the latter.
Disclaimer:
The content does not constitute any kind of investment or financial advice. Kindly reach out to your advisor for any investment-related advice. Please refer to the tab “Legal | Disclaimer” to read the complete disclaimer.