CrowdStrike Q1 2025 Earnings Analysis

Dive into $CRWD CrowdStrike’s Q1 2025 earnings with review of financial performance, key metrics, operating expenses, dilution, customer growth, future outlook

Financial Results:

↘️$1,103M rev (+19.8% YoY, +4.2% QoQ) missed est by -0.1%🔴

↘️GM* (77.7%, -0.6 PPs YoY)🟡

↘️Operating Margin* (18.2%, -3.3 PPs YoY)🟡

↘️FCF Margin (25.3%, -9.7 PPs YoY)🟡

↘️Net Margin (-10.0%, -14.6 PPs YoY)🟡

↗️EPS* $0.73 beat est by 12.3%

*non-GAAP

Revenue By Segments

Subscription

↗️Subscription Revenue $1,051M (+20.5% YoY)

↘️GM* (80.0%, -0.4 PPs YoY)

Professional Services

➡️Professional Services Revenue $53M (+7.8% YoY)🟡

↘️GM* (31.0%, -9.4 PPs YoY)

Key Metrics

➡️DBGR Gross Retention Rate 97% (97% LQ)

↗️ARR $4.44B (+21.6% YoY, +194 net new ARR)🟢

↗️RPO $6.80B (+44.7% YoY)🟢

↗️Billings $1,146M (+22.4% YoY)🟢

Customer Engagement with Multiple Modules

➡️% of customers using 6+ Modules (48%, 48% LQ)

➡️% of customers using 7+ Modules (32%, 32% LQ)

↗️% of customers using 8+ Modules (22%, 21% LQ)

Regional Breakdown

↘️United States $741.9M rev (+17.8% YoY, 67% of Rev)

↗️Europe, Middle East, and Africa $176.4M rev (+24.6% YoY, 16% of Rev)

↗️Asia Pacific $112.8M rev (+20.6% YoY, 10% of Rev)

↗️Other $72.3M rev (+29.3% YoY, 7% of Rev)

Operating expenses

↗️S&M*/Revenue 33.4% (+1.1 PPs YoY)

↗️R&D*/Revenue 19.8% (+1.5 PPs YoY)

↗️G&A*/Revenue 6.3% (+0.1 PPs YoY)

Quarterly Performance Highlights

↘️Net New ARR $194M (-8.5% YoY)

↗️CAC* Payback Period 26.7 Months (+9.0 YoY)🟡

↘️R&D* Index (RDI) 1.09 (-0.59 YoY)🟡

Dilution

↘️SBC/rev 23%, -2.8 PPs QoQ

↘️Basic shares up 2.5% YoY, -0.0 PPs QoQ

↘️Diluted shares down -0.7% YoY, -2.8 PPs QoQ🟢

Guidance

↘️Q2'25 $1,144.7 - $1,151.6M guide (+19.1% YoY) missed est by -1.0%🔴

➡️$4,743.5 - $4,805.5M FY guide (+20.8% YoY) in line with est

Key points from Crowdstrike’s First Quarter 2025 Earnings Call:

Financial Performance

CrowdStrike posted a strong Q1, exceeding expectations. Net new ARR was $194M, significantly above guidance. Total ARR reached $4.44B, up 22% YoY, reflecting strong expansion and platform penetration.

Revenue grew 20% YoY to $921M, with $868M from subscriptions. Free cash flow was $279.4M, or 25% of revenue. Non-GAAP operating income was $201.1M (18% margin). Cash and equivalents rose to $4.61B, underscoring financial strength.

Falcon Platform

Falcon comprises over 30 modules and is central to CrowdStrike’s consolidation strategy. Platform adoption deepened:
48% of customers use ≥6 modules, 32% use ≥7, and 22% use ≥8.

Falcon now includes adjacencies such as privileged identity access, AI model protection, and agentless cloud workloads. It replaces legacy EDR, SIEM, DLP, and VM solutions, driving cross-sell and long-term stickiness.

A key challenge is shifting customer focus from module-level buying to outcome-driven procurement, addressed via Falcon Flex.

Falcon Flex

Falcon Flex drove significant commercial success. $774M in Flex deal value was added in Q1, bringing total to $3.2B, a 6x YoY increase. Over 820 accounts have adopted Flex.

Average Flex deal exceeds $1M in ARR with an average contract term of 31 months. Notably, 39 customers reflexed within 5 months, compressing multi-year expansions into a single sales cycle.

Sales motion now emphasizes demand planning over module selling. Flex also improves pricing leverage and simplifies procurement.

Falcon Cloud Security

Cloud ARR growth accelerated YoY. The suite—covering CWPP, CSPM, SaaS security, and runtime protection—leverages a unified agent/agentless architecture.

A 7-figure expansion was secured after a breach at a tech firm using a competitor’s CSPM. CrowdStrike replaced the tool and expanded into cloud protection.

The launch of Cloud Data Protection added visibility into data movement and compliance. Differentiation remains strong due to hyperscaler-agnostic architecture and full-stack integration.

Falcon Identity Protection

Falcon Privileged Access became generally available, adding native just-in-time controls. A 7-figure expansion by a foreign government replaced legacy tools.

The solution delivers visibility into stale accounts, shared credentials, and unmanaged assets. Growing enterprise demand for zero trust is fueling rapid adoption.

CrowdStrike now competes directly with standalone identity providers by embedding enforcement into the Falcon Platform.

Falcon Exposure Management

Falcon launched AI-powered network vulnerability scanning, closing gaps vs. legacy VM players.

A financial services customer purchased coverage for 120,000 endpoints, displacing both its VM and ASM vendors.

Charlotte AI enhances the module by automating prioritization and response. The unified view across managed and unmanaged assets strengthens Falcon’s disruptor status in vulnerability management.

Charlotte AI

Charlotte AI expanded to cover full detection triage. A global healthcare provider executed an 8-figure Flex expansion after displacing its legacy SIEM.

Charlotte now functions as a virtual SOC analyst, enabling automated reasoning, response, and machine-speed triage.

This innovation is reducing alert fatigue and compressing incident response times, with broad integration across Falcon modules.

Next-Gen SIEM

Next-Gen SIEM delivered triple-digit ARR growth. CrowdStrike displaced legacy incumbents like Splunk and QRadar with faster queries, lower TCO, and built-in data integrations.

All customers now receive 10GB/day of SIEM data within their license. Wins included a 7-figure deal with a payments company and a healthcare provider adopting Falcon SIEM with Charlotte AI.

The platform is positioned as a fully integrated analytics engine, not just a data repository.

Product Announcements

Key innovations this quarter:

• Cloud Data Protection

• AI Model Scanning & Security Dashboards

• Falcon Privileged Access

• Adversary Overwatch for SIEM

CCP Program & July Outage

The July 2023 outage and CCP program had a $61M cash impact in Q1. Amortization of CCP incentives also created $11M revenue divergence, expected to continue at $10–15M per quarter through Q4.

ARR remains unaffected. Module retention is ~95%, and customer churn impact is minimal.

Partner & Marketplace

Partners sourced 60% of Q1 deal value. MSSP contribution rose to 15%, up from mid-single digits.

GuidePoint became the fifth $1B+ partner, joining AWS, CDW, SHI, and Optiv. NVIDIA designated Falcon as the default cybersecurity layer for its AI Factory.

A strategic partnership with Microsoft now aligns adversary nomenclature to aid global threat attribution.

Customer Wins

A Fortune 100 tech firm expanded from a $12M EDR deal to a $100M+ Falcon Flex agreement, reflexing again within 9 months. Adoption included Falcon Complete, identity, cloud, SIEM, DLP, and Charlotte AI—replacing 8+ vendors.

A global healthcare provider displaced its legacy SIEM and deployed Charlotte AI. A 7-figure Flex expansion improved operational outcomes and SOC efficiency.

A financial institution migrated 120K devices to Falcon Exposure Management. A breached tech firm replaced its CSPM with Falcon Cloud. A foreign government onboarded Falcon Identity for real-time enforcement.

Operating Investments

Non-GAAP operating expenses were $656M, or 59% of revenue, reflecting investments in AI, GTM, platform resilience, and customer success.

A May strategic realignment will shift resources to cloud, identity, exposure, SIEM, and AI. FY27 operating margin target raised to ≥24% with free cash flow target >30%.

Retention Metrics

Gross retention held at 97%, module retention ~95%, and net retention was described as “consistently strong.”

Fast Flex adoption and reflexes are compressing customer expansion cycles and increasing lifetime value.

Strategic Challenges

Despite macro volatility, CrowdStrike delivered consistent execution. Investment prioritization and GTM discipline helped drive performance.

Focus areas include platform differentiation, education on outcome-based procurement, and continued MSSP scaling.

Share Buyback

Board approved a $1B share repurchase, reflecting confidence in long-term growth, cash generation, and valuation.

Growth Outlook

Revenue growth for FY26 guided at $4.74B to $4.81B, representing 20–22% YoY growth.
Subscription revenue divergence (due to CCP) is expected to persist through Q4 but normalize afterward.
Q2 revenue: $1.145B–$1.152B (+19% YoY)
Q2 non-GAAP income: $226.9M–$233.1M
Non-GAAP EPS: $0.82–$0.84

Management expects Q2 net new ARR growth to be 2x last year’s Q1–Q2 sequential growth.

Back half ARR acceleration will be driven by:

• Reflex adoption

• GTM optimization

• Expanded adoption in SIEM, identity, cloud

• AI-native features

CrowdStrike reiterated its long-term goal of reaching $10B in ARR through continued platform expansion and Flex penetration.

Management comments on the earnings call.

Product Innovations

George Kurtz, Chief Executive Officer and Founder
“Our innovation and commercial success was recognized in the 2025 Frost Radar Cloud and Application Runtime Security Report, where we scored highest out of all vendors on the innovation index.”

Burt Podbere, Chief Financial Officer
“We achieved strong non-GAAP operating income performance alongside strategic upfront investments in internal automation, go-to-market, and AI innovation. We expect these investments to fuel our growth in the back half of FY2026 and beyond.”

Falcon Platform

George Kurtz, Chief Executive Officer and Founder
“We consolidate point products without compromise, and most importantly, CrowdStrike stops the breach.”

Burt Podbere, Chief Financial Officer
“Deep platform adoption with subscription customers with six, seven, and eight or more modules representing 48%, 32%, and 22% respectively demonstrates our success in cross-sell and platform expansion.”

Falcon Flex

George Kurtz, Chief Executive Officer and Founder
“Flex accelerates what would have taken years of module sales cycles into rapid platform transformations, unlocking adoption and spend while creating even more platform stickiness.”

George Kurtz, Chief Executive Officer and Founder
“The key to Flex is it does change our selling motion where we’re not selling module by module, but we’re selling outcomes, and we’re doing demand planning with our customers.”

Burt Podbere, Chief Financial Officer
“We saw $774 million in Falcon Flex account value added in Q1 alone, over double what we did a year ago—highlighting Flex’s outsized contribution to our performance.”

Falcon Cloud Security

George Kurtz, Chief Executive Officer and Founder
“Our native unified offering combines cloud workload protection, posture management, application security, and SaaS security on a single backend and with both agent and agentless form factors.”

George Kurtz, Chief Executive Officer and Founder
“A rapid platform expansion including Falcon Cloud Security quickly illustrated the difference between just alerting on a breach and actually stopping one.”

Falcon Identity Protection

George Kurtz, Chief Executive Officer and Founder
“Today, CrowdStrike customers experience just-in-time access and permissions for critical applications and services all within our single AI-native platform.”

George Kurtz, Chief Executive Officer and Founder
“By consolidating on CrowdStrike in that area, it’s a win for them, and it’s a win for us. So we’ll continue to add more and more capabilities, and it does unlock a new TAM for us.”

Falcon Exposure Management

George Kurtz, Chief Executive Officer and Founder
“With the launch of AI-powered network vulnerability assessment, CrowdStrike now delivers unified exposure management for both managed and unmanaged devices.”

George Kurtz, Chief Executive Officer and Founder
“Now with network vulnerability scanning, this customer is moving away from their long-standing legacy VM vendor and their existing attack surface management vendor as well.”

Charlotte AI

George Kurtz, Chief Executive Officer and Founder
“Charlotte AI enables this customer’s level one threat analyst team—delivering on the promise of agentic security today.”

George Kurtz, Chief Executive Officer and Founder
“With the launch of Charlotte AI’s expanded detection triage, customers now have access to an agentic SOC analyst delivering autonomous expert-level triage, reasoning, and response at machine speed.”

Next-Gen SIEM

George Kurtz, Chief Executive Officer and Founder
“Our Next-Gen SIEM delivered triple-digit ending ARR growth while displacing antiquated, expensive, and poor-performing point products.”

George Kurtz, Chief Executive Officer and Founder
“This is one of the most exciting areas that we have. It feels a lot like the legacy AV market when I started the company.”

George Kurtz, Chief Executive Officer and Founder
“We’re creating even deeper tie-ins across the rest of the CrowdStrike and third-party ecosystem.”

Competitors

George Kurtz, Chief Executive Officer and Founder
“Customers are looking for better, faster, and better value. That’s what we’re delivering, and it’s all in an integrated package.”

George Kurtz, Chief Executive Officer and Founder
“We are now in a market that we weren’t necessarily in, and we’re having an impact on the competitive environment.”

Customers

George Kurtz, Chief Executive Officer and Founder
“We began our relationship with this account pre-Falcon Flex when they selected CrowdStrike to displace and consolidate a point-product EDR and legacy AV… now they spend nearly 20x their initial EDR purchase.”

George Kurtz, Chief Executive Officer and Founder
“It just incentives to use more and more of those [modules]. So that’s the way we see it—it’s a demand planning exercise with real tangible ROI and financial benefits.”

Strategic Partnerships

George Kurtz, Chief Executive Officer and Founder
“A marquee partnership with Microsoft, which we announced yesterday, highlights our bold ecosystem leadership.”

George Kurtz, Chief Executive Officer and Founder
“Together, we take the guesswork out of adversary attribution for the benefit of our joint customers and the entire market.”

George Kurtz, Chief Executive Officer and Founder
“NVIDIA’s recently announced Enterprise AI Factory, their reference AI architecture, integrates Falcon as the cybersecurity standard.”

International Growth

Burt Podbere, Chief Financial Officer
“We saw strength in multiple geographies including the U.S., Europe, Canada, Japan, and Latin America.”

George Kurtz, Chief Executive Officer and Founder
“We won our largest Latin American deal of all time through our MSSP channel last quarter.”

Challenges

George Kurtz, Chief Executive Officer and Founder
“I can only focus on what we can control, and I think the team did a fantastic job in an environment that had a lot of noise to power through it and deliver the results that we delivered.”

Burt Podbere, Chief Financial Officer
“The company received requests for information from the DOJ and the SEC relating to revenue recognition and reporting of ARR for certain transactions, the July 19 outage, and related matters.”

Future Outlook

George Kurtz, Chief Executive Officer and Founder
“Q2 will be a quarter of improving sequential net new ARR growth followed by back-half net new ARR acceleration.”

Burt Podbere, Chief Financial Officer
“We now anticipate an FY2027 improved free cash flow margin of more than 30% and non-GAAP operating margin of at least 24%.”

George Kurtz, Chief Executive Officer and Founder
“CrowdStrike is best positioned to protect the workloads, identities, data, and infrastructure for the AI age and the superhuman AI agents themselves.”

Thoughts on Crowdstrike Earnings Report $CRWD:

🟢 Positive

• Total ARR reached $4.44B, up +21.6% YoY, with $194M net new ARR

• Subscription revenue grew +20.5% YoY to $1,051M, with high gross margin 80%

• Free cash flow was $279.4M or 25.3% of revenue

• EPS (non-GAAP) beat by +12.3%, coming in at $0.73

• Billings rose +22.4% YoY to $1,146M

• RPO increased +44.7% YoY to $6.80B

• Charlotte AI, Next-Gen SIEM, and Falcon Cloud Security drove large 7–8 figure expansions

• Falcon Flex total value reached $3.2B, up 6x YoY, with 820+ accounts

• MSSP channel scaled to 15% of deal value, aiding SMB and midmarket growth

• Share buyback of $1B authorized, indicating confidence in cash flow and valuation

• GuidePoint Security became the 5th $1B+ partner

• Gross retention rate remained flat at high level 97%

🟡 Neutral

• Gross margin (non-GAAP) at 77.7%, down -0.6 PPs YoY

• Operating margin (non-GAAP) at 18.2%, down -3.3 PPs YoY

• Professional services revenue rose +7.8% YoY to $53M, but margin fell to 31%

• Net new ARR declined -8.5% YoY, but trend is healthy (-31% YoY in Q3 2024 and -21% in Q4 2024)

• Revenue of $1,103M missed estimates by -0.1%

• Customer module adoption flat at 48% for 6+ modules, 32% for 7+

• CAC payback increased to 26.7 months from 17.7 YoY

• Diluted share count down -0.7% YoY, offsetting dilution pressures

🔴 Negative

• Net margin (non-GAAP) declined to -10.0%, down -14.6 PPs YoY

• Free cash flow margin dropped -9.7 PPs YoY, despite healthy absolute cash generation

• Q2 revenue guidance of $1.145B–$1.152B came in -1.0% below consensus

• R&D Index fell to 1.09, down -0.59 YoY

• U.S. revenue growth slowed to +17.8% YoY, below international rates

• CCP program and July 2023 outage created $61M cash impact and $11M in revenue headwind per quarter through Q4 FY26

Thank you for reading!

Follow me for more frequent updates on X/Twitter and Threads, and on LinkedIn. For visual infographics, check out Instagram, and for portfolio changes, follow me on Savvy Trader.

Disclaimer: This earnings review is for informational purposes only and does not constitute financial, investment, or trading advice.