Opportunity Dispatch is in beta
Opportunity Dispatch

Investor Day Recap · CRWD

CrowdStrike pulls in $10 billion and $20 billion ARR milestones by a year, guides fiscal 2028 net new ARR growth of 20%-plus

CrowdStrike now expects $10 billion of ending ARR within fiscal 2030 and $20 billion within fiscal 2035, each a year earlier than its prior dates, and issued initial fiscal 2028 guidance for net new ARR growth of 20%-plus, at least $1,626 million. CFO Burt Podbere set a fiscal 2028 free cash flow margin expectation of 32.5%-plus. The company also unveiled SafeMind, a cyber-specific frontier model family sold through token packs, and Falcon Guardian for AI agent security.

CrowdStrike Investor Briefing at Fal.Con, September 2, 2026
Published November 1, 2026Written with help from AI, edited by Sebastian Clarke.

In this recap16 sections
  1. Overview of CrowdStrike
  2. $10 billion within fiscal 2030, $20 billion within fiscal 2035
  3. SafeMind: a cyber-specific frontier model with token pricing
  4. Guardian turns AIDR into a priced category
  5. Members from here
  6. The 3.5% share math behind $20 billion
  7. Falcon Flex, new logos and the $29 billion whitespace
  8. Gross margin drivers and the R&D budget
  9. Anthropic's marketplace, NVIDIA and CoreWeave

For reference

  1. Key updates and announcements
  2. Financial targets
  3. New products, customer wins and partnerships
  4. Why management believes it can deliver
  5. Cash flow and capital allocation
  6. What wasn't said
  7. Q&A
  8. Sources

Overview of CrowdStrike

CrowdStrike sells the Falcon platform, a cloud-native security platform built on a single lightweight agent that protects endpoints and cloud workloads, identity and data, as the company describes itself in its earnings release for the quarter ended July 31, 2026. In its results for that quarter, the second of fiscal 2027, filed August 26, 2026, the company reported total revenue of $1.47 billion, a 26% increase from $1.17 billion a year earlier, of which subscription revenue was $1.40 billion, up 27%. Ending annual recurring revenue was $5.84 billion as of July 31, 2026, up 25% year-over-year, with $332.8 million of net new ARR added in the quarter. The release reported non-GAAP income from operations of $371.6 million, GAAP net income attributable to CrowdStrike of $5.3 million, free cash flow of $377.4 million and cash and cash equivalents of $5.01 billion. CFO Burt Podbere said in the release that the company was raising its full-year fiscal 2027 net new ARR growth outlook to 34% at the midpoint, and the release guided fiscal 2027 ending ARR of $6,603.0 million to $6,611.9 million and total revenue of $5,991.1 million to $6,011.1 million. The release also noted an agreement to acquire the technology assets of XM Cyber, a Schwarz Digits company.

$10 billion within fiscal 2030, $20 billion within fiscal 2035

Mike Sentonas, CrowdStrike's president, opened his session with the figure reported the previous week: $5.8 billion of ending ARR at the end of the second quarter of fiscal 2027, a 23% CAGR over two years from $3.9 billion at the same point in fiscal 2025. That is about 30% of the way to the $20 billion ending ARR target the company set at its briefing a year earlier. CrowdStrike now believes it can reach $10 billion of ending ARR within fiscal 2030 and $20 billion within fiscal 2035. CFO Burt Podbere said the prior dates had been the end of fiscal 2031 for $10 billion and the end of fiscal 2036 for $20 billion. "The business is firing and there's a huge opportunity," Podbere said of the reason for moving the dates. The presentation shows the path from $10 billion to $20 billion as a 15% CAGR.

CrowdStrike now targets $10 billion of ending ARR within fiscal 2030 and $20 billion within fiscal 2035, a year earlier than before on each.
CrowdStrike now targets $10 billion of ending ARR within fiscal 2030 and $20 billion within fiscal 2035, a year earlier than before on each.Source: CrowdStrike, investor day presentation, p. 53.

Podbere also gave initial fiscal 2028 guidance for net new ARR: growth of 20% or more over fiscal 2027, or at least $1,626 million against the fiscal 2027 midpoint of $1,355 million. He noted he was going out with the number at Fal.Con, "well before end of Q4". He traced the fiscal 2027 net new ARR guide through five revisions: 20% growth at last year's Fal.Con ($1,135 million), 20% on a larger base at the third-quarter fiscal 2026 call ($1,187 million), 22.5% after the fourth quarter ($1,239 million), a 520-basis-point raise to 27.7% after the first quarter of fiscal 2027 ($1,291 million) and 34% after the second quarter ($1,355 million), for a cumulative raise of $220 million.

Initial fiscal 2028 guidance calls for net new ARR growth of 20% or more, or at least $1,626 million.
Initial fiscal 2028 guidance calls for net new ARR growth of 20% or more, or at least $1,626 million.Source: CrowdStrike, investor day presentation, p. 103.

On cash, CrowdStrike expects a free cash flow margin of 30%-plus in fiscal 2027 and 32.5%-plus in fiscal 2028, with fiscal 2028 capital expenditure at 11% to 12% of revenue, which Podbere called a slight increase. He said the prices of storage and other inputs had gone up and that the company had locked in certain pricing with its strategic vendors. The fiscal 2029 target model was left where it was: non-GAAP subscription gross margin of 82% to 85% against 81% in the first half of fiscal 2027, operating margin of 28% to 32% against 24%, and free cash flow margin of 34% to 38% against 30%, with sales and marketing, R&D and G&A already inside their bands. "I'm not extending it out, keeping it as it is," Podbere said.

SafeMind: a cyber-specific frontier model with token pricing

George Kurtz, CEO and founder, said the company had announced a Cyber Superintelligence Lab the previous day, which he framed as a frontier lab focused solely on cybersecurity problems rather than on selling tokens. The lab's output is SafeMind, which Kurtz called cybersecurity's first frontier model and harness family: open-source and open-weight models combined with CrowdStrike data and CrowdStrike harnesses, developed with NVIDIA. It comprises two models, Red Tempest, an offensive model that finds vulnerabilities, exploits and ways to attack, and Blue Solano, a defensive model that learns from the red model, detects threats and uses cyber tooling to stop attacks, linked in what the presentation calls a learning loop. One use case Kurtz described is a digital twin of a customer's environment in which the two models run automated red-and-blue testing to show which exposures are exploitable, since "you can't patch everything".

On benchmark tests run with the SafeMind harness, Blue Solano's detection rate was 37% better than one frontier lab's and 29% better than another's; Red Tempest cost 66% and 78% less per task than the two frontier labs; Blue Solano was up to 99% more cost effective; and SafeMind detection was six times faster than current methods. Kurtz said the models were trained on security and threat data accumulated over 15 years, and that CrowdStrike generates 7 trillion security events a day, employs 270 PhDs, 300 AI researchers and 500 threat researchers, and invests more than $1 billion in R&D. In the partner panel, Bartley Richardson, CrowdStrike's chief AI and autonomous systems officer, said SafeMind showed a 70% increase in accuracy versus an off-the-shelf model and harness and a 99% cost reduction versus a leading frontier model in a leading harness, taking the cost per remediated detection from $10 to 3 cents.

The commercial point for investors is a new pricing unit. "There's now token pricing, which will be a different monetization stream that will be open to CrowdStrike," Kurtz said. SafeMind will be sold as an initial token pack plus token expansion packs, all through Falcon Flex. CrowdStrike plans to size a token pool for a customer's whole estate and set bands of usage from which customers can burst up, because customers "don't like variability" or runaway spend. A routing layer lets customers use CrowdStrike's models, other open-source models or frontier models, which Kurtz said opens a way to distribute and monetize frontier labs' technology through the platform. SafeMind will live in the Falcon platform, where the red and blue models power existing modules, and will also be made available directly to customers and governments through the QuiltWorks partner program, in preview and rolled out over the back half of the year. In the Q&A, Kurtz said SafeMind can only be consumed by Falcon Flex customers. Podbere said SafeMind is not in this year's guidance: "It's contemplated for next year, but just remember it's early days with this thing". Asked whether the business would weigh on margins, he said CrowdStrike will price tokens with costs baked in and that there is no change to how the model is built.

Guardian turns AIDR into a priced category

Kurtz repeated his view that AI security will be bigger than EDR. Ending ARR from AIDR grew more than 79 times in the three quarters after launch, against more than 10 times for EDR over the same span after its launch, which Kurtz called "escape velocity". He cited an estimate of 90 agents per employee and argued the number is effectively unbounded, so the addressable market "really doesn't have an upper bound". AIDR, AI detection and response, is the category CrowdStrike says it pioneered, and Guardian is the product.

Guardian was developed with Amazon as the biggest design partner and was switched on live during Kurtz's keynote. It discovers agents and shadow AI, controls and observes agent runtime, and detects and stops threats, fusing prompt visibility with the sensor's view of the operating system. Kurtz stressed it covers agents running on endpoints, in ephemeral cloud containers and as SaaS agents. He also argued full traceability of what an agent did will be mandated for regulated companies, making it "a must-have technology". Sentonas said the product became generally available to every customer within the first 30 seconds of the announcement, as a licensed entitlement on a sensor updated weeks earlier, and that it was built in-house using capabilities from the Pangea acquisition plus the sensor and platform. The demonstration played in the session described a Fortune 500 company finding 18,000 AI agents on its endpoints, of which 300 had been approved. Sentonas also announced an AI Gateway that morning, and Kurtz said AIDR integrates into other vendors' gateways where CrowdStrike's agent is absent.

Asked about pricing, Kurtz said "pricing will go up on Guardian," that the existing AIDR module will be retired, and that the category name stays AIDR with Guardian as the product. The presentation frames the future of endpoint protection as a triangle of workloads (cloud and endpoint), next-gen identity and AIDR through Guardian.

Share this recap