CrowdStrike Beats Estimates with ARR of $5.51 Billion, Announces 4-for-1 Stock Split and Drops 13% in After-Hours Trading
Record Net New ARR of $256 million and a 4-for-1 stock split raised the annual guidance, but billings below consensus punished the stock after the market closed on June 3.
CrowdStrike reported revenue of $1.39 billion in the first fiscal quarter of 2027, a 26% year-on-year increase, with Annual Recurring Revenue (ARR) of $5.51 billion. The results, disclosed on June 3 after the market close, included a record Net New ARR of $256 million, a 32% year-on-year increase, and a 520 basis-point elevation in the annual growth forecast for Net New ARR, now at 27.7% at the midpoint. The company's stock, however, fell 13% in after-hours trading due to billings falling short of consensus expectations and a tepid reaction to the second-quarter revenue guidance.
The board also announced a 4-for-1 stock split. Each shareholder registered on June 25 will receive three additional shares for each share held, with adjusted trading set to begin on July 2. The operating cash flow for the quarter was a record $591 million, and free cash flow, also a record, closed at $468 million. GAAP net income was $27.8 million, or $0.11 per diluted share.
The Pitch for AI Security Infrastructure
George Kurtz, founder and CEO, stated on the call that CrowdStrike is critical security infrastructure for AI, essential for the successful adoption of AI by companies. This statement operates as a competitive positioning thesis against Microsoft Defender, Palo Alto Networks, and SentinelOne, at a time when sell-side analysts are pricing endpoint security according to the level of direct exposure to the workloads of autonomous agents. The company cited the QuiltWorks coalition, announced in May, and the AIDR product as indicators of a revenue inflection linked to AI, although it did not specify how much of the Net New ARR for the quarter came from these lines.
The defence came at the right time. Microsoft, at Build 2026 on June 2, announced MAI-Code-1-Flash and MAI-Thinking-1 as its first proprietary models independent of OpenAI, aggressively pitching native integration of Defender with Copilot for enterprise clients. In contrast, CrowdStrike maintains hyperscaler-agnostic architecture, and Anthropic's entry into Project Glasswing, with CrowdStrike's participation in the consortium for critical infrastructure defence, signalled a public endorsement of this strategy also on June 3.
Why Billings Hurt the Stock
Billings, a metric that anticipates future revenue, fell short of street consensus, and the second-quarter revenue guidance was modest compared to the average of estimates. The sell-side reading was that the ramp-up of new products has not yet compensated for the normalisation of the Falcon Flex effect, a flexible subscription programme that seasonally distorted Net New ARR in FY26. The 13% decline in after-hours trading erases about half of the gains made by the stock since the previous quarter's announcement in March.
The context is tied to the incident of July 19, 2024, when a faulty Falcon sensor update caused a global disruption in Windows hosts, leading to downtime for Delta Airlines, the NHS in the UK, and banks in Japan and Australia lasting hours to days. The company entered FY26 with retention under pressure and offered Falcon Flex and multi-year discounts to contain churn. The average contract price has normalised over the past two quarters, but the sell-side remains demanding on billings as proof that the contractual base is indeed repositioned.
What Changes for the CISO in Three Geographies
For the CISO in London, Tokyo, or São Paulo contemplating Falcon renewal, the operational numbers for the quarter are more robust than the immediate stock reaction suggests. Record Net New ARR, consolidated ARR of $5.51 billion, and an increase in annual guidance are consistent signals of a stable corporate base. In the UK, NHS hospitals that returned to Falcon after the 2024 incident now operate under contracts with stricter update staging SLAs, a practice that CrowdStrike subsequently generalised through sensor canary releases. In Japan, the METI and FSA have maintained the provider's qualification for critical infrastructure since 2022, with the renewal of technical criteria on an annual cycle.
The upsell window for Charlotte AI and AIDR is now open, and the signal for the corporate buyer is clear: the multi-year discount offered in FY26 to contain churn should not be repeated in upcoming renewals. Those who renewed during the peak of the crisis are locked in at the previous price for another twelve to eighteen months; those who wait will pay full price for the architecture that the company describes as the default path to secure autonomous agents in production. The interpretation for IT consulting firms selling Falcon implementation is that the discount-driven phase has now ended, and the next wave of revenue will come from AI upsell, not from acquiring new logos.