CrowdStrike is a cloud-native endpoint cybersecurity company. It competes directly with SentinelOne, Microsoft Defender and Palo Alto. Its bread-and-butter is called endpoint detection and response (EDR), which replaces legacy anti-virus (AV). Beyond EDR, it offers applications in cloud security, log management, identity, data and so much more. These products form the “Falcon Platform." Falcon’s edge is in its ability to digest near-endless amounts of data to power uplifted and automated breach protection. Scale across a broad range of products means broader, better access to data, which is perpetually recycled to consistently augment Falcon efficacy. All of this is done with a single console and agent, ensuring superior interoperability. This process entails a large base of tools to cross-sell without incremental complexity or CRWD cost. That’s a powerful & structural margin tailwind for this model.

Important Endpoint Security Acronyms:

Important Cloud Security Acronyms (alphabet soup, I know):

AI:

In the realm of GenAI, Charlotte AI is CrowdStrike’s security copilot. It levels up the capabilities of security analysts by actively detecting anomalies, orchestrating remediation and fixing issues in an automated, triaged fashion. It’s a force multiplier for efficiency gains in a world where most companies are starved for more security resources and talent.

CrowdStrike also offers a slew of its own security agents that are “mission ready to deliver machine-speed capabilities and accelerate outcomes.” Agents include automated malware analysis, threat hunting and search tools along with many others. These form its “Agentic Security Workforce.”

There are many more agentic AI products to discuss. To avoid making this 101 section 5+ pages, here is the link to the full Fal.Con 2025 review (section 5). It covers all of the recent AI launches and more.

Important Log Management Ideas & Becoming the Security Operations Center (SOC):

CrowdStrike’s ability to ingest, use and recycle high-fidelity security data is vital for every product it offers. This is how it can become the de facto “Security Operations Center,” (SOC) as SOC status requires a holistic view of assets and brings complete hygiene under one vendor. SOC relies heavily on CrowdStrike’s endpoint and data cores. To ensure best usage of this data, Security Information and Event Management (SIEM) aggregates security logs/data so that organizations uncover and remediate threats faster. This is what combines and makes sense of all needed data to enable a single SOC viewpoint with native access to a wonderfully broad suite of integrated modules.

Simply put, this drives faster time to detection and remediation and cuts customer costs. Falcon Fusion Security Orchestration, Automation and Response (SOAR) is what turns this bird’s-eye view into actionable workflows to fix and proactively prevent issues. Finally, its exposure management products ensure proper asset configuration with sound computer hygiene and minimal permissions. Exposure management includes vulnerability management to uncover weak spots while Attack Surface Management aggregates ecosystem entrances to enable protection from a consolidated viewpoint. Tools like Charlotte AI Agentic Response are quickly upgrading these capabilities.

Generally speaking, SOC and its various components enable CrowdStrike to ingest more data, understand its clients more effectively, and recycle data. It then can introduce more and more modules and base that product roadmap on observed pain points, rather than guesses.

Network & Identity Security Expansion:

CrowdStrike offers a unified Falcon Identity security offering, which conjoins existing capabilities and “protects every human and non-human identity across the full lifecycle in any environment.” Specifically, it offers:

Falcon Flex:

Falcon Flex is CrowdStrike’s selling program which bolsters customer “flex”ibility over product purchases. It allows clients to pay for only the modules they need, as they need them. There are no pre-set commitments and no mandated usage; they can run through credits at their leisure. This will be the firm’s main go-to-market strategy going forward, as it has shown to lower cross-selling friction, raise deal size and create stickier customers. With this, customers can use exactly what they want, when they want, which reduces selling friction and reduces procurement cycle. 

July 2024 Outage Impact Reminder:

As a reminder, CRWD created “Customer Commitment Packages” (CCPs) in response to its 2024 outage. These offer temporary discounts, trials and/or comped professional services help. Customers have mainly chosen free product trials, which is what CRWD wanted (larger contracts post CCP expiry). CCPs mostly end after next quarter, with concessions leading to temporary growth and margin headwinds still prevalent in this quarterly report.

Guidance includes Seraphic and SGNL M&A, which will boost ARR and revenue by $6.5M and $4M respectively. That's not material based on the size of this business (about 0.1%). These two acquisitions, alongside Onum and Pangaea purchases, lowered EBIT guidance by $77M and EPS guidance by $0.315. On the other hand, CrowdStrike elongated the timeline for sales commission amortization from four years to five years. Similarly to extending the useful life of a GPU for a company like Meta, this boosts profitability. That added $90M to annual EBIT guidance and $0.275 to annual EPS guidance. Excluding all of this, the revenue and ARR beats would have been the same. The EBIT beat would have been slightly smaller, and the EPS beat would have been slightly larger. 

At $405/share, CrowdStrike trades for 97x forward earnings and 70x FCF. EPS is expected to grow by 30% this year and by 27.5% next year. Free cash flow is expected to grow by 47% this year and by 29% next year. 

Falcon Flex-ing Their Muscles:

Falcon Flex is killing it. The go-to-market approach is now up to $1.69B in ARR, representing 120% Y/Y growth. That builds on excellent momentum from last quarter when they generated 200% Y/Y Flex growth. Customer count also continues to grow rapidly as they’ve gone from 1,000 to 1,600 in the last 6 months. That sounds even more impressive when considering the average CrowdStrike Flex customer spends $1M annually on the platform (across 10 modules on average).

It's important to note that a lot of this ARR growth is cannibalistic, as CrowdStrike prioritizes this go-to-market method as its primary strategy now and going forward. And despite that reality, the incremental benefits are still crystal clear. 

The point of Flex is to eliminate procurement cycles for customers adding new products, which should help with easier product experimentation, cross-selling, and ARR per customer gains. They call it a “re-flex” when a customer comes back for more consumption commitments after depleting existing credits before contract maturity. And re-flex momentum is excellent. 23% of Falcon Flex customers have now reflexed compared to 5% just three quarters ago. When this happens, the average ARR uplift is 26%... and CRWD is not done there. Thanks to the strong time-to-value and return on investment that CrowdStrike's products provide, customers are now coming back to re-flex a second time under the same contract term, which is delivering another 48% ARR uplift on average. 6% of Flex customers have now done this as the product offering structure works like an absolute charm.

This is exactly what CrowdStrike wanted to see: more seamless usage across its broad product base driving larger, stickier contracts. There's a reason why virtually every other major cybersecurity vendor in public markets has copied this approach since CrowdStrike implemented it. 

Partnerships:

CrowdStrike's go-to-market approach continues to be greatly amplified by partners from around the ecosystem. System integrators are leaning on Falcon as the SOC of the modern AI security era and are increasingly preferring this suite over competitors. Their managed security service providers (MSSP) business has moved from an eight-figure bucket to a $1.3B business since FY 2023. Their relationships with hyperscalers also get better with time, as they just wrapped up a year in which AWS sourced ARR rose 50% Y/Y. 

Perhaps more notably, they're starting to get friendlier with Microsoft. It's one thing to see CrowdStrike working with Alphabet and AWS in the world of security, but MSFT is a direct competitor, and the two have fiercely battled against each other in endpoint security for years and years. There have been some signs of them starting to work a little better together in support of a better overall ecosystem health, but news this past quarter was, in my mind, more notable. Customers are now able to use Microsoft Azure credits on CrowdStrike Falcon products as CrowdStrike embeds itself in that giant marketplace. That is huge. AWS and GCP are sizable sources of demand for CrowdStrike, and they haven't been able to achieve that from Azure up until now. They're calling it a “watershed moment,” and they're not being dramatic. 

3 Main Growth Vectors – Cloud, SIEM & Identity:

CrowdStrike’s three largest growth vectors delivered 45% Y/Y ARR growth to cross $1.9B. 

Cloud specifically rose by 35% Y/Y to cross $800M, marking its second consecutive quarter of Y/Y acceleration. Just like in previous quarters, Kurtz talked about CrowdStrike's runtime cloud security as a key differentiator in markets. Many other companies are capable of offering configuration analysis and hygiene to tell customers where vulnerability might be or where breaches might pop up. Far fewer are actually able to prevent breaches in real time across cloud infrastructure environments. Falcon thrives in this area, so the cloud business is thriving too. This pillar delivered an eight-figure contract during the quarter as CrowdStrike's cloud offerings reduced mean time to detection and response by 90%.

SIEM, revenue rose by 75% Y/Y to cross $585M. Large total cost of ownership advantages over competition are understandably proving valuable for this segment. The Onum acquisition, which gave it the assets needed for this real-time data-pipeline, is proving to be another great one for the company. As a reminder, its ability to scan and vet data before it’s stored, cuts costs and latency. It can handle 5x more events per second vs. competitors, cut storage costs by up to 50% and accelerate incident response by 70%. Onum is a force multiplier for Falcon SIEM, especially in the age of AI when clear, scalable data pipelines are the difference between high-quality agentic outputs, and worthless wastes of money.

Leadership spent more time on identity security this quarter than the other two areas. ARR rose by 34% Y/Y to cross $520M. PAM is the primary driver of the acceleration here, as that new module rapidly ramped and generated 170% Q/Q growth. Falcon Shield was another big contributor with 300% Y/Y growth. Seamless protection across both human and machine-based identities as the population of enterprise agents exponentially grows requires consistent, reliable, and secure permission procedures. That is what Falcon has built this pillar to provide. 

Identity Security is going to get two large capability injections via SGNL and Seraphic purchases. Considering great identity security is about shrinking the attack surface to tighten focus, sharpen permissions and broaden coverage, SGNL should prove to be highly valuable for Falcon. The company provides just-in-time access so that company employees only can use data when they need it. There is no perpetual permission or a come-as-you-please approach here. The AI-powered product can scalably and granularly grant entry on a case-by-case basis, greatly reducing vulnerabilities and chances of an ecosystem being breached. This embraces a zero trust-like philosophy we talk about all the time in Zscaler, Palo Alto, and other cybersecurity reports. 

And with Seraphic, CrowdStrike will be able to provide secure enterprise browser capabilities for its customers as well. In the age of agentic AI, where customers are interacting with Claude and Perplexity and Gemini and ChatGPT via web browsers, this is becoming all the more important. The deal timing makes sense. 

AI Positioning & Disruption Risk:

Kurtz does think AI will disrupt and displace some software companies. He just doesn't think CrowdStrike will be one of them. He split this conversation into two groups. Group one is the “nice to have” applications that enhance productivity, rely solely on seat-based expansion, and function as disparate point solutions. These routinely tie certain workflows together to enhance collaboration in a way that AI can seamlessly emulate, rather than providing unique value and assets to enhance the quality of individual workloads and measured outcomes. Group 2 will "thrive.”

These companies are unified platforms with years or decades of experience delivering for their customers across a plethora of use cases. That reality means having access to proprietary data generated from their scaled base of sensors and edge case know-how that a cloud security demo cannot come close to even sort of replacing. CrowdStrike is excellent at what it does because it has done it at a high level for a long time and obsessively used all insight and information generated from its business to constantly improve. Large language models don't have access to this vast base of sensors or the coinciding data. Instead, they're scraping from Reddit, Wikipedia, and whatever other low-quality user-generated source they can find. Good luck trusting that to secure your entire business. CrowdStrike thinks it's in the sweet spot of being able to readily use the great technology created from model builders (which are partners), as well as its own models, agents, and data. This amplifies the value realized from this important technological wave and to stay ahead of existing and any potential new competitors. His argument sounded nearly identical to the case I've been making about which pockets of enterprise software are safe and which might not be. So, I wholly agree. 

Kurtz is confident that CrowdStrike is in Group 2 and this data advantage is a large reason why. They also are confident in their holistically broad coverage of all AI layers. They're not offering piecemeal protection for some assets… They have customer coverage for everything. The company secures next-gen GPU infrastructure, Dell, Supermicro and other AI factories, neoclouds and hyperscalers, frontier model builders, and a rapidly growing list of AI applications and agents under one roof. Not only will that drive better interoperability in larger deal sizes, but it will also continue to deliver the high-fidelity data that continues to allow CrowdStrike to differentiate as their landscape rapidly evolves. And finally, they're confident in their market positioning over the long haul because hallucination rates prevalent throughout AI models are simply not acceptable in the realm of cybersecurity. These processes need to be near-perfect, and any mistake, let alone a mistake 5% of the time, will not be tolerated. 

“AI use necessitates AI security. Every enterprise deploying AI needs an independent protection layer for visibility, compliance, and enforcement. As AI adoption grows, CrowdStrike becomes even more of a necessity to these organizations.” – Co-founder/CEO George Kurtz 

“The pace of AI innovation is broadly misunderstood. Novel discoveries are often interpreted as the death knells of existing categories. The market is questioning enterprise software's role in an agentic world. In the same way that we anticipated the cloud revolution, we pioneered and built for the agentic revolution.” – Co-founder/CEO George Kurtz 

AI Innovation:

Charlotte delivered 6X Y/Y usage growth and 3X Y/Y ARR growth as interest in this AI assistant remains strong. Between this and 10 other Falcon agents, the company is beginning to see the expected proliferation, which should be a precursor to scaled revenue contributions in the future. They're seeing exactly what they need to see. 

AI detection and response (AIDR) is now in general availability. The debut has gone very well as customers enjoy broader visibility over their AI assets, faster detections, and a more actionable ability to fix issues and breaches as they pop up. It's a similar idea to its EDR and XDR products, this time for agentic assets. 

Core Endpoint Momentum:

Endpoint growth accelerated for a second consecutive quarter as its most mature offering enjoys strong demand tailwinds from AI. Kurtz used examples like OpenClaw and how that product has directly supported demand for better endpoint protection. As leadership put it, "endpoint" is the "epicenter" of AI usage, and agents should be a convincing tailwind for overall demand. 1,800 AI applications are already running on its endpoint platform, and that's only the beginning.

This doesn't need to be very long. CrowdStrike is one of the best companies on the planet, and AI is not going to change that. If anything, it's going to make that even more clear to everyone over the coming years. They are elite in every sense, with the team products and know-how to profitably compound at a strong clip for many more years to come. The only issue I have with the company is the valuation, which is the sole reason I don't currently own shares. It's as simple as that. 

Broadcom creates & sometimes manufactures a slew of semiconductor-related equipment within data center, networking and industry-specific use cases. Chips and high-performance compute (HPC) can’t all be packed into the same corner of a data center. GPUs must be able to connect to one another to drive better bandwidth and performance, with faster, more efficient model training and inference to cut costs. This is where Broadcom thrives. 

It also offers a range of software tools, which significantly broadened out with its VMware acquisition. VMware offers virtual, localized layers of software that sit on top of hardware. This allows the centralized hardware to run several different operating systems. The company, which is now a Broadcom unit, calls these “virtual machines” or virtual private clouds. By reducing hardware requirements, VMware saves its clients money. 

This company does not compete with Nvidia in terms of designing GPUs. It does, however, create application-specific integrated circuits (ASICs) for more specialized workloads. It also makes variable processing units (XPUs), which are the high-performance accelerator subsection of ASICs. All XPUs are ASICs but not all ASICs are XPUs. These are often used to optimize data center, networking and GPU performance. In some cases, this can replace various needs for more generalized chips like GPUs. Furthermore, its core niche focuses on networking and connectivity, which competes with Nvidia’s switches and its SpectrumX networking product.

At $317/share, Broadcom trades for 27x forward EPS. bPS is expected to grow by 51% this year and by 41% next year.

Semiconductor Solutions – AI Compute Momentum:

Broadcom's five large XPU customers all continue to briskly grow. Google TPU growth throughout FY2026 has been excellent, and is expected to strengthen in FY 2027. The newer Anthropic relationship is progressing nicely as they’re well on their way to deploying 1 gigawatt of TPU capacity – with three more coming in FY2027. For context, 1 gigawatt is worth roughly $20B in revenue for AVGO. That's not a perfect science, as rack scale deployments include more 3rd-party components and are lower margin than deals involving more of its standalone XPUs. Customers 4 and 5 are expected to deliver 100% Y/Y growth in FY 2027 following a strong end to this year. 

And now there's a sixth customer. OpenAI is using Broadcom for its own custom accelerator initiative. There is one gigawatt of compute planned for FY 2027. 

Semiconductor Solutions – AI Compute Positioning:

The theme for all these customers is that Broadcom continues to work very closely with them, support them across several parts of the chip creation process, and collaborate on roadmap plans spanning multiple years. From design, to packaging, to networking, and so much more, Broadcom is a scaled, trusted, and highly valuable partner for these vendors that continues to consistently shrink time to market, alleviate supply bottlenecks, and accelerate customer demand. They were careful to include this color in the prepared remarks, as there were a few risks analysts wanted to ask about pertaining to their next few years of growth. 

First, there's a growing belief that 2026 CapEx guidance from Mega Caps will mark peak growth for the cycle. These companies are spending virtually all of their free cash flow on compute infrastructure and other projects. Many don't believe that will remain the case in 2027 and beyond. I think that's a real possibility. Investors will not accept virtually zero cash flow forever, and the sense of urgency to catch up on modern infrastructure deployments will eventually wane as supply begins to catch up to demand. The debate is whether that will happen next year, more years from now, or further down the road. The company does not seem to think that will be a 2026 or 2027 issue. Based on close partnerships with these six scaled clients, Broadcom has confidence to secure supply through 2028 to support strong growth within every single one of these design collaborations. They committed to Y/Y growth in FY 2028, which was nice to hear, but is already expected. Consensus expects north of 20% year-over-year growth for that period. The company thinks momentum for both training and inference workloads will remain very strong, at least for the next 10 quarters, which is why it's so motivated to build out inventory ahead of that expected ramp. Their visibility is excellent, and they've seen all the supply bottlenecks creeping up throughout supply chains. They know that  avoiding those bottlenecks makes them an invaluable vendor, and tightens already close customer relationships. 

The other risk analysts wanted to learn about is the prospect of customer-owned tooling (COT) becoming more popular. This isn't a new issue, but there has been more news about some companies like Microsoft trying to do things on their own. Broadcom's performance lead over the best of these COT-based products is 2x, and they don't think that gap will be closed in the coming years. They spoke about how challenging it is to run this end-to-end process, and how it can't be a customer's 15th priority. Broadcom lives for this as priority one, which is why it remains so confident in leveraging its world-class research teams and balance sheet to stay ahead of the pack. 

Finally, they were asked about more partners working with a larger number of vendors in the design process. Tan again pointed to the multi-year dense nature of its customer relationships, providing significant visibility and giving them confidence in multi-year forecasts. They're not worried about losing market share to others like Marvell. 

Semiconductor Solutions – AI Networking:

Its data center-focused Ethernet switch called Tomahawk 6 continues to thrive. The unmatched switching capacity of 102 terabits per second is deeply resonating and leading to a fantastic ramp. They expect momentum to remain fantastic through FY 2027 when they introduce the seventh generation of this product. This will double the performance of this current market leader. 

Broadcom remains adamant that copper is by far the best solution for moving data to and from processors. Eventually, co-packaged optics will become the better option. For an investor's sake, just know that co-packaged optics uses light to move data to and from processors rather than copper.  Considering Broadcom is also the leader for that technology, they're well positioned for whenever that day comes. For now, copper is the most efficient, cost-effective, and performant solution in markets, so that will remain the focus for current offerings. 

Infrastructure Software:

Within 1% Y/Y infrastructure software revenue growth, VMware enjoyed 13% growth with 19% Y/Y ARR growth. They do not think the hardware virtualization services that VMware provides are vulnerable to AI disruption. They view AI as a large tailwind for this business, just like they do for the other bucket. Most of the call was spent on semiconductor solutions and we didn't get much more detail on why they view themselves as safe beyond being a leaned-on conduit for software-based hardware optimizations. Still good to hear. 

Really good performance. They are winning large, sticky, and long-term relationships with key custom accelerator providers. They're taking considerable market share in AI-related networking based on a performance lead that looks to be sustainable through next year. AVGO is defending its turf on the infrastructure software side and offering investors an exciting level of visibility – at least over the next six quarters. There are growing signs that XPUs are becoming popular for expanding use cases, compared to their generalist GPU peers, and that should support demand for Broadcom services.  

It's going to remain extremely important to fixate on any and all signs of this historic supercycle beginning to lose some of its incredible steam. As long as this cycle continues to rage, Broadcom should continue to perform very well. Signs of cycle longevity from this quarter and the next 6 look relatively good, and I think bulls should be pleased. All I will say is that things can and eventually will change very quickly. Demand visibility is great until those megacaps see investor demands for cash flow. Markets are inherently forward-looking and they will sniff out any sign of demand weakness before those signs become obvious. That has happened throughout history for every single semiconductor cycle we have ever seen. Despite this cycle being far bigger than any other, that will likely happen here too. It's just so tough to determine when that will occur, and again, present signs remain quite good.

For now, the elite financials and the Broadcom party rages on.