Hello, and welcome to CrowdStrike's Fiscal Second Quarter 2025 Financial Results Conference Call. At this time, all participants are in a listen-only mode. After the speakers' presentation, we will conduct a question-and-answer session. Please be advised that today's conference is being recorded. I would now like to hand the call over to Maria Riley, Vice President of Investor Relations. Maria, please go ahead.

Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, President and Chief Executive Officer and Co-Founder of CrowdStrike; and Burt Podbere, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth, including projections, and expected performance, including our outlook for the third quarter and fiscal year 2025, and any assumptions for fiscal periods beyond that are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events, or otherwise. Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time-to-time, including the section titled Risk Factors in the company's Quarterly and Annual Reports. Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings press release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today. With that, I will now turn the call over to George.

I would like to start today's remarks with my apology to everyone impacted by our Channel File 291 Incident, which transpired on July 19. I also want to take this moment to show my gratitude to everyone who worked with us through the incident. Thank you to our customers and partners for your continued trust. Thank you to our team of relentless CrowdStriker’s for living our mission. Thank you to the broader cybersecurity and IT community for standing with us as we face the most challenging event in our company history. The magnitude of the July 19 incident will never be lost on me and my commitment is to make sure this never happens again. The days following the incident were among the most challenging in my career because I deeply felt what our customers experienced. Our response to the July 19 incident was immediate, deliberate, and focused. We activated CrowdStrike's crisis response plan to lead through the incident. We clearly communicated status with customers, partners in the market at large on our website, social media, email, phone, and broadcast. Our technical teams devised new automated recovery techniques for accelerated response. Our efforts were 100% focused on bringing impacted devices back online with the highest level of speed and transparency. This included the mobilization of CrowdStrikers in our partner community to communicate proactively and transparently with customers, as well as the market at large, and then recover impact at hosts. For many, recovery was within hours. We've already implemented the following actions to build a more resilient Falcon platform. First, enhanced content visibility and control. While sensor version control was always a cornerstone of the Falcon operational experience, we've already released new content control configurations. This allows customers to choose when and where new Falcon content is deployed with new…

Thank you, George, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers except revenue mentioned during my remarks today are non-GAAP. In today's discussion, I will briefly summarize our second quarter financial results and provide our assumptions and investment priorities for the second half of the fiscal year. The strength of our second quarter results, we believe demonstrates our resilience, focused execution, commitment to financial discipline, and the long-term durability of our business. Despite the challenges of the last couple of weeks of the quarter, we delivered better-than-expected revenue, operating profit, and net income. In Q2, ending ARR grew 32% year-over-year to $3.86 billion, of which $218 million was net new added in the quarter, up 11% over Q2 of last year, and within our previously stated assumptions for the quarter. In Q2, we achieved our second largest quarter of all time for net new customer additions, expansion business, and net new ARR contribution from cloud, identity, and LogScale combined. Prior to July 19, we are on pace to deliver net new ARR growth well ahead of these results. The July 19 incident had a significant impact on the last two weeks of the quarter, as we rapidly mobilized teams to assist customers, but we continued to close deals, including a nine-figure in deal value expansion. While deals can push in any given quarter, this quarter we experienced elevated levels with more than $60 million in deals that we had line of sight for the quarter and remain open as of Monday. We expect these deals to close in future quarters. Our retention metrics and module adoption metrics remained strong in Q2, highlighting our deep partnership with customers and the significant value the Falcon platform delivers. Our dollar based gross and net retention rates were consistent…

Thank you. [Operator Instructions] Our first question comes from Hamza Fodderwala at Morgan Stanley. Unmute your line and ask your question.

Great. Thank you for taking my question, and congrats on the strong results. I wanted to commend you, George, Mike (ph), and the entire CrowdStrike team for your response and transparency since the outage event. So there's been a lot of talk, George, around whether Microsoft or customers perhaps may want to limit kernel access for future updates. I'm curious, in response to this outage, whether or not CrowdStrike will have to rearchitect their approach to the Falcon agent. And if so, would that be a meaningful undertaking that might push you away from the future innovation roadmap? Thank you.

Thank you, Hamza. Yeah. Let me try to -- let me just try to take you through this with a little bit of detail. So despite a lot of the false narratives and misinformation from our competitors, I want to be clear that this was not a kernel update, this was a code update -- it was not a code update, it was a configuration update, and we already covered the remediation in our prior remarks. When we think about the architecture of what we've built and rearchitecting it, I've got to set the record straight on that as well. We have best-in-class architecture and we lead the industry for a reason. We have greater efficacy, greater manageability, and greater scalability than our competitors, and I just want to give you an example of that. If you look at the latest MITRE (ph) results, Falcon had 98% coverage, our next-gen competitor had 79% coverage. It took Falcon 4 minutes for mean time to detection. It took our competitor 47 minutes. And the list goes on and on. If we think about the architecture as well, we have a very lightweight agent, requires 100 megs of storage, our competitor, as a heavy agent requires 3 gigabytes of storage in the Windows environment. So we didn't become number one in the market by having a poor architecture. We became number one by having a great architecture. We talked about what we've changed here in terms of our configuration updates and we feel confident about that going forward, and our customers feel confident about that. So we'll continue to work with Microsoft as part of the ecosystem as they look to provide further enhancements around kernel access, but just to be clear, there are thousands of software kernel drivers that are out there that go well beyond security, like VPN, virtualization software, IT management software, backup software and a lot more. So we are one part of the ecosystem, and we're certainly a player that's going to help and work with Microsoft as they think about adding other mechanisms to allow the ecosystem to flourish.

Our next question comes from Brian Essex with JP Morgan. Please unmute your line and ask your question.

Great. Good afternoon, and thank you for taking the question. Congratulations from me on; one, a fantastic response to the incident; and then two, execution on the back of that is impressive. I guess, George, for me, obviously, you've got peers out there talking about benefiting their pipeline, we still have to see that in their numbers, but from your perspective, we'd love to get some insight into what you're seeing from the pipeline. Obviously, you've called out the $60 million in deals that kind of pushed into 3Q, but from a competitive perspective, what are you seeing in terms of the number of peers that are invited into the process, maybe a little color around the conversations that you're having at the C level that are leading to some of those extended sales cycles, that would be really helpful to get that insight?

Sure. Obviously, there's a lot of noise in the marketplace and we can only control what we can control, and I think the best way for me to articulate that is to just recount some of the conversations. I had two customer calls this morning and most of them start out the same. They talk about our response, how transparent we were, and how we dealt with the problem. We talked about some of the mitigating steps that we've taken and it generally ends with we want to do more with CrowdStrike. I had one this morning, which was a customer that had an impact, we talked through it. They were satisfied with the controls we put in place, and in fact, on the call, they basically said we won the next-gen SIEM project they had, which we won against another next-gen SIEM competitor. So this is what we're seeing. And again, I'm recounting my calls and many, many of them sort of starting in the same way. So that gives me encouragement again that we've built a lot of trust with our customers over time and we put a lot of trust in the bank. Yes, we had an issue on July 19. We've been very clear about that and very transparent, but consistently, the calls have been, you have saved us way more times than this incident and we are all in on CrowdStrike and we're all in, for all the reasons we've talked about in the past, the consolidation play, the ability to save time, money, get better outcomes, and take four, five, six, and seven products and move them to the Falcon platform. That hasn't changed before the 19th of July and hasn't changed after the 19th of July and this is what customers are coming back to us with.

The next question comes from Saket Kalia with Barclays. Please unmute your line and ask your question.

Okay. Great. Can you hear me? Hey, George. Can you hear me?

Yes. We can hear you. Go ahead.

Okay. Sorry about that. Awesome, sorry about that guys. Thanks a ton for taking my question and offer my congrats as well just on the resilience here in the face of a very tough couple of weeks. George, maybe my question is for you. I'd love to just touch on Falcon Flex a little bit. This was something that you were investing in before the outage as well, but it sounds like it's something that can also be helpful for customers to maybe drive better security outcomes as well. Can you just maybe touch on that and how it's maybe helping that conversation post-outage?

Sure. Well, when we think about Falcon Flex, this was born out of demand from our customers. If you look at our module attach rates, which we've gone through again many times in the past and they continue to go up as customers rely more and more on CrowdStrike, they came to us and said, hey, we want an easier and more flexible way to consume your Falcon platform. When you start with one module, when I started the company and you're at 28 days is a lot that you have to go through with a customer, and we wanted to meet customers where they wanted us to be, which is more CrowdStrike, make it easier through procurement cycles, and then ultimately allow them to consume it how and when they wanted to consume it. So we started down this journey a while back and it continues to gain a lot of traction with our customers. We've taken this and you heard this in my prepared remarks, and we are able now through our customer commitment package to be able to offer Falcon Flex. And again, some of the things that we went through, whether it's modules or time or what have you, we can allow our customers to be able to consume that as part of the customer commitment package. And we think overall, it's great for our customers because we're coming to the table and solving business problems. And also, it's great for CrowdStrike long-term because we're allowing them a very flexible model to continue to consume CrowdStrike, which they know and love.

Our next question comes from Tal Liani with Bank of America. Please unmute your line and ask your question.

Here we go. Now you can hear me. Last night there was one of your competitors that said that customers would be more afraid now to buy -- to put all the eggs in one basket, meaning buy more modules from a single vendor and they'll opt for diversification of customers -- sorry, vendors. And for you, at least in previous quarters, I didn't calculate this quarter, but about two-thirds of your growth came from upsell to existing customers, and the question is whether you have any evidence if the event change the appetite of customers to buy from a single vendor -- to buy from you specifically? Have you seen any change of customers willing to buy up -- your ability to upsell to them, the other modules, etc.? And there is just -- I know it's one question, but there's just one thing that is a follow-up on something, Burt, the full year EPS guidance translates into a very big 4Q EPS, if you can somehow go over it to make sure that we have the right numbers. Thanks.

Okay, Tal. Let me take the first part. So when we think about more modules, it gets back to what I just went through, customers want to do more with us. Obviously, we talk about what happened, and it's not going to happen again, but they want to buy more from us. And again, customers' comments back to me are, they don't want to go backwards. They don't want a bunch of disparate products. They don't want a bunch of different consoles. And they specifically told me that the adversary lives in the gaps between products, in the SIEMs between products. So what they're looking for is the ability to cover more of their estate, right, to have a complete view. And when you look at next-gen SIEM, it allows us to take telemetry and logs in from other systems beyond the first-party data that CrowdStrike is generating. So I would say, the long and the short of that is customers don't want to go backwards and have a patchwork of products. They are still focused on the consolidation piece and they're looking at us as one of the key consolidators in the market.

Yeah. So on your question with respect to EPS, as we thought about the impacts to non-GAAP operating income, we talked about the -- some of the headwinds that we had, mostly driven from revenue side of the house, and we tried to be consistent in the way that we approached the guide on both Q3 and full year. So that's how we thought about it when we gave our guidance.

The next question comes from Joel Fishbein with Truist. Please unmute your line and ask your question.

Thanks for taking my question and also really great transparency, George and Burt. Thank you very much. My question is on guidance methodology. Burt, can you just go through a little bit of how you came up with the guide for the back half of the year considering all the moving pieces? And I guess the question, how it changed relative to how you've done your guidance before, that would be really helpful. Thank you.

Sure. On the revenue side, the biggest impact comes from the customer commitment package that George walked through. So that's the one that's going to drive the biggest impact. And we walked through the numbers in terms of revenue, the impact, we said $60 million in the back half, $30 million in Q3, and $30 million in Q4. So that was the biggest driver on revenue. And then obviously that falls down to non-GAAP operating income. And so we did -- as we thought about it and we thought about how it impacts everything from revenue to EPS, we really took that prudent approach. There has been nothing in terms of big changes in terms of how we guide it, we guide to what we see, not to what we don't see. But again, the biggest impact was the -- how the customer commitment actions impacted both the top and bottom, and they were consistent in how we applied the approach.

Our next question comes from Gabriela Borges with Goldman Sachs. Please unmute your line and ask your question.

Hi. Good afternoon. Thank you. I would love to get a little bit more detail, George and Burt, on the customer commitment packages. And you mentioned a couple of dynamics there alongside duration and concessions, maybe just a little more on how you came up with that $30 million number in 3Q and 4Q, and what are some of the guardrails and how you think about the appropriate amount of duration or discounting or concessions that you want to give a customer to keep them happy and satisfied with the CrowdStrike platform? Thank you.

Thanks, Gabriela. So in terms of how we came about the $60 million in the back half, we'll just focus on the net new ARR. We thought about three things, right? We thought about, hey, we've got -- we talked about the delay in pipeline generation, so that has an impact. We talked about longer sales cycles, that's due to increased scrutiny and that's not just for us, but that's for, I think, most people in software and tech. And then we talked about the muted upsell value. So we took all those things into consideration when we thought about the impact on the customer commitment packages. As far as the packages themselves, you're right, we have different pieces within the package. George outlaid them pretty well. We talked about some of them being discounts. We talked about some of them being duration. Duration has an impact, of course, on net new ARR. But we also talked about product and product will have an impact more on COGS. So that's going to impact the bottom. So we took all those factors together to come up with our guide and that's how we came up with the $60 million.

Our next question comes from Rob Owens with Piper Sandler. Please unmute your line and ask your question.

Yeah, Burt. I guess as a follow-on to that -- thanks for taking my question here. The $60 million through the remainder of this year, but you talked about some of the weakness potentially persisting for a year in terms of net-new ARR. So I know you're not guiding to the out year, but as we kind of contemplate this, should we think about this more on a 12-month basis? And then as the selling of these customer commitment packages starts to anniversary or more normalizing relative to net new ARR growth and relative to maybe where margins were historically? Thanks.

Thanks, Rob. So I think that this type of -- this type of incident has a half light, right? So there'll be a diminishing impact over time, so Q3 will be harder than Q4. Q4 will be harder than Q1, and so on and so forth. I think the biggest piece for us is that when we get to the back half of next year, we'll start to see an acceleration in the business, and that's the big-picture, and that's what I want everybody to walk away from.

Our next question comes from Matt Hedberg with RBC. Please unmute your line and ask your question.

Thanks for taking my questions. Actually, maybe a little bit of follow-up to Rob's question. I think, Burt, you kind of addressed it, but do you think part of that acceleration is some of these commitments then expanding usage? In other words, what's a bit of a headwind now is part of that broader commitment that just kind of compounds on itself? In other words, is that part of that tailwind that we should think about next year? Is this renewal cycle of these commitments?

Yeah. This is George. So when we think about the consumption of Falcon Flex, typically what we've seen is customers can do more of it faster than they originally anticipate because we're providing value. So when we think about to Burt's comments next year, obviously, be more modules in use and I think we have the ability to go back to those customers and understand what other things we can do for them, including looking at additional flex opportunities based upon what they've been using over the last period of time. Anything to add to that?

Yeah. No, I think it's -- what George had talked about, it's seeding for the future, and I think that starts to take -- start to take play back half of next year.

Our next question comes from Fatima Boolani with Citi. Please unmute your line and ask your question.

Good afternoon. Thank you for taking my questions. I appreciate it. George, and even Burt, please chime in, so on this procurement vehicle, Falcon Flex, clearly, you've seen a tremendous amount of positive data points, you shared them in the script, $700 million deal value created with just one year in the market. I'm wondering if this is now going to be the predominant go-to-market approach for you all in terms of incentivizing broader portfolio adoption. And then related to that, Burt, as we think about extrapolating some of the financial implications in the out years beyond your framed guidance, how should we think about renewal cycles and renewal conversations coming up that you could potentially steer towards these contracts such that you do still get an elongated period of maybe net new ARR growth. Can you help me sort of straddle those two? Thank you.

Yeah. So when we think about Falcon Flex, again, born out of what customers wanted. We've seen tremendous success with it because it opens up the entire product portfolio to our customers. They can pick and choose what modules they want. They can leverage it where they want it as they acquire new companies as an example. It's very easy for them to add new modules or new endpoints or cloud workloads. It minimizes procurement cycles. So it's a great thing for customers, it's a great thing for us, and it is a prime -- one of the primary mechanisms we're using from a go-to-market motion going forward. So it is something that we put in place. We've seen the tremendous results from it, and we'll continue to lead with that into our customer base.

Yeah. So all those things are the things that we're looking for. And as I think about the future in terms of our renewal opportunities, the Flex does offer more ability for the customers to consume more, to take on more, and that just bodes well for our renewal cycles, right? We want them to do that. And so by seeding them now, that's only going to bode better for us in the future and better for the customers more importantly. I think they're going to benefit more and more as, look, we're going to come up with new products, right, and those are going to be available to them. And so that's how we think about the renewals and the new renewal possibilities as we look out into the future.

Our next question comes from Andrew Nowinski with Wells Fargo. Please unmute your line and ask your question.

Okay. Good afternoon. Thank you for taking the question. And I'm sure every organization that was impacted appreciates the transparency and the contrite response you have today. So I wanted to ask about really on the renewal cycle as well. I was wondering if you could just give us any more color around the mix of renewals throughout the year. I would imagine Q4 is typically has the most renewals out of all four quarters, but maybe if you could just provide more color on the mix, maybe which quarter do you think there's more risk to a higher mix of renewals in case they don't potentially renew? Thank you.

Thanks, Andy. So two things. So one, there is definitely seasonality, right, in our business and we've talked about it, you've highlighted Q4, that's typically our highest quarter of deals. And I think, second, what I talked about earlier, it's -- this idea of a half-life. The closer you are to the sun, the hotter it is, the more difficult it is in terms of the headwinds. And as you move farther and farther out, you see more relief, so the impact gets less. So if you combine those two things, that's how we would think about the renewal cycle.

Our next question comes from Roger Boyd with UBS. Please unmute your line and ask your question.

Great. Thanks for taking the questions and I will add my congrats on the response and resilience demonstrated over the last month. George, just on the hypergrowth modules, nice to see that group past $100 billion collectively -- $1 billion collectively. It sounded like the timeline, you reiterated the $10 billion ARR target. It sounded like the timeline got pushed towards the longer side of the five to seven-year range you provided before. I would just love to get kind of your view on the durability of growth there. I get there's a lot of uncertainty, but just kind of any view on how you expect it to play out is the right view that you just see this as kind of a one-year speed bump towards those longer-term guidance?

Yeah. I'll start and then I'll turn it over to Burt. When we think about the durability of CrowdStrike, I think we've demonstrated it this quarter. We've had a history of durable growth because we're solving real problems for customers. And when you look at some of the businesses that we talked about, Identity and Cloud and next-gen SIEM, $1 billion is incredible and you look at the growth rate. So we've got multiple vectors of growth for CrowdStrike. We've got a massive TAM opportunity that's only getting bigger. And we always at CrowdStrike have and will continue to take a long-term view of the market. So we're going to deal with this in the short-term, and then obviously, I think this sets us up well for the future. Burt?

Yeah. So, Roger, the key here is that we remain committed to reaching the $10 billion in ARR by the end of 2031. I mean that's the -- that was part of the range that we gave out in prior periods and we're still committed to it.

Our next question comes from Joseph Gallo with Jefferies. Please unmute your line and ask your question.

Hey, guys. Thanks for the question. Can you just update us on the federal momentum? You're entering their biggest quarter, and how should we think about that business? Does the IT outage slow momentum there given they're typically pretty conservative? Thanks.

Sure. Well, Q3 obviously is the federal quarter. I think we've got good momentum. We've done, I think, well with the sister relationship that we have. And as many things in the federal space, it takes time and we continue to build momentum and win deals in those categories, and not only federal, but we think about state and local, incredibly strong across-the-board, and we're just talking about the U.S., right? We do this for the rest of the world. So we like our opportunity there. Those are always long-term opportunities, but we're certainly encouraged in terms of the success that we've had so far.

Our next question comes from Gregg Moskowitz with Mizuho. Please unmute your line and ask your question.

Okay. Thank you for taking the question and also well done in terms of transparency. I had a clarification just on the customer commitment packages and CrowdStrike's future expansion strategy. Is part of the plan effectively giving away modules to existing customers for upwards of the year? In other words, when you speak about an expectation of muted upsell dollar values and temporarily higher levels of contraction, is this part of the seeding strategy that you're referring to?

I'll start with -- we always want to do the right thing for the customer, and customers -- we're solving business problems and they like our technology, they love our technology, right? So when we think about the opportunity to drive greater platform adoption, certainly that should be added into the conversation. And what we've seen over time and we've built a history of greater module adoption, you can see that since you've been tracking us from our IPO. So from that standpoint, we do think the long-term opportunity proves well for CrowdStrike, and having customers use more modules is always a good thing, and that's what we're focused on.

Thank you. This concludes today's question-and-answer session. I would now like to turn the call back over to George Kurtz for closing remarks.

So thank you all for your time today. We appreciate your continued support and look forward to seeing you at our upcoming investor event at Falcon. Thank you.