CrowdStrike (CRWD) Q2 FY2027 Earnings Call: Q&A Summary

Q: Saket Kalia from Barclays asked what transpired after the Mythos moment and what drove the upside in the second quarter.

A: George Kurtz explained that the Mythos moment acted as a growth tailwind, with demand driven by the need to protect against rogue AI agents and shadow AI, alongside strength in cloud, identity, next-gen SIEM, endpoint, and exposure management.

Q: Brian Essex from JPMorgan asked about the durability of the strength beyond the next quarter and the visibility into next year.

A: George Kurtz stated the tailwind is sustainable because AI adoption is in early days and companies require security to deploy AI safely, while Burt Podbere noted the record Q3 pipeline and the 1,150 basis point increase in the FY '27 net new ARR growth outlook as evidence of durability.

Q: Gabriela Borges from Goldman Sachs asked how the company advises clients on moving agents from sandboxed environments to production with enterprise data.

A: George Kurtz noted that customers need an identity control plane for nonhuman identities, data protection, and runtime visibility to understand agent activity, and CrowdStrike provides the guardrails for identity, data, execution, and network connectivity.

Q: Matt Hedberg from RBC asked about the current threat landscape and why CrowdStrike is uniquely positioned even if Frontier labs release their own security solutions.

A: George Kurtz stated CrowdStrike is uniquely positioned due to 15 years of rich threat and attack data used to train models, which is not available outside the company, and the fact that they are net data creators constantly updating algorithms based on endpoint data.

Q: Fatima Boolani from Citi asked where the company is seeing the most outsized traction on a SKU basis as organizations move to production-grade AI.

A: Burt Podbere explained that Flex is driving platform consolidation, with cloud, next-gen SIEM, and next-gen identity ending ARR reaching $2.1 billion, up 39% year-over-year, while exposure management and AIDR also showed strong performance.

Q: Meta Marshall from Morgan Stanley asked if the land motion for next-gen SIEM is changing and if customers are putting more data into the SIEM.

A: George Kurtz said the product is easy to deploy because the data is already in the platform, and customers are rapidly expanding other data sources like SaaS and cloud agents to instrument cross-domain attacks, making it a disruptive, high-value offering.

Q: Adam Tindle from Raymond James asked if AIDR is incremental to EDR and how the ramp compares to other products.

A: George Kurtz clarified that AIDR is a separate, incremental module priced separately that uses the same agent, making deployment friction-free, and the ramp has been incredible as customers need to scale AI deployments rapidly.

Q: Roger Boyd from UBS asked if customers are requesting token-based pricing and how it is incorporated in Flex contracts.

A: George Kurtz stated that token-based pricing is already part of AIDR, allowing customers to budget for usage and buy extra packs if needed, all consumable via Falcon Flex licensing to avoid runaway costs.

Q: Robbie Owens from Piper Sandler asked about the evolution of the exposure management market and why CrowdStrike is winning.

A: George Kurtz explained that companies are struggling to patch vulnerabilities fast enough against autonomous agents, so they need to prioritize exposures and understand attack paths, which CrowdStrike delivers autonomously within the Falcon platform.

Q: Mike Cikos from Needham asked how customers are using CrowdStrike to implement and enforce AI governance guardrails.

A: George Kurtz said the platform allows customers to set policies, minimize false positives, and track token usage to manage costs, serving as a one-two punch of protection and cost management for IT infrastructure.

Q: Patrick Colville from Scotiabank asked for details on the 8-figure Frontier lab deal and the broader category of protecting these labs.

A: George Kurtz stated these companies need visibility, protection, control, and compliance as they scale, and CrowdStrike is integrated into their ecosystems from chips to applications, making the company well-positioned to support their growth.

Q: Joseph Gallo from Jefferies asked about the endpoint acceleration, specifically if it is driven by new logos or premium SKUs and how much runway remains.

A: George Kurtz said growth is driven by the need to protect AI consumed on endpoints, and since about half the market still uses legacy AV that cannot identify rogue AI agents, there is significant opportunity for net new wins and cross-selling.

Q: Todd Weller from Stephens asked how impactful QuoteWerks was in the quarter and if it is a partner-led motion for assessments.

A: George Kurtz confirmed it is a partner-led motion where partners leverage the platform to find vulnerabilities and understand exposure, which leads to platform pull-through, and it has been a successful initiative that the company plans to expand.