Summary
CrowdStrike's fiscal 2026 first quarter, ended April 30, 2025, showed a clear split between top-line momentum and bottom-line pressure. Revenue rose 19.8% to $1.10 billion. Gross profit increased 17.0% to $814.29 million, but gross margin was 73.8%, down 1.8 percentage points. Subscription demand drove the increase, with the company adding new customers and selling additional sensors and modules to existing customers. Annual recurring revenue reached $4.4 billion as of April 30, 2025. Net new ARR was $193.8 million for the quarter, while the prior-year quarter added $211.7 million. ARR growth was 22%, compared with 33% a year earlier. Remaining performance obligations were $6.80 billion, up 44.7%, and deferred revenue was $3.77 billion, up 22.9%. Backlog stood at approximately $3.0 billion as of April 30, 2025.
Profitability swung sharply negative. Operating loss was $124.66 million, and operating margin was -11.3%, down 12.1 percentage points. Net loss was $110.21 million. Diluted EPS was -$0.44. The company attributed much of the bottom-line pressure to the July 19 Incident and related matters, as well as to charges from the strategic plan announced on May 6, 2025. The filing also points to higher operating expenses across sales and marketing, research and development, and general and administrative functions. The July 19 Incident has led to lawsuits, claims, and inquiries. Management expects continued legal and professional services costs in future periods.
Cash generation remained steady, but capital spending rose. Operating cash flow was $384.11 million, roughly flat compared with the prior-year quarter. Capital expenditures were $85.75 million, up 72.6%. The operating cash flow result contrasts with the GAAP net loss, helped by non-cash charges and working capital changes. The company ended the quarter with 10,363 full-time employees. Deferred revenue and RPO growth suggest a healthy pipeline of contracted business. Still, the company said customer commitment packages after the July 19 Incident have included discounting, additional modules, professional services, flexible payment terms, and subscription period extensions. Those packages have increased contraction and reduced upsell dollar values, and management expects sales cycles to remain elongated.
Looking ahead, CrowdStrike estimated charges of $36.0 million to $53.0 million for the strategic plan. Of that amount, $6.6 million was recognized in the first quarter, and substantially all the remainder is expected in the second quarter of fiscal 2026. The company also flagged seasonality. Net new ARR generation is typically greater in the second half of the year, especially in the fourth quarter. Operating margin is usually lower in the first half because of payroll taxes and annual sales and marketing events. The company said its dollar-based net retention rate can fluctuate from period to period because of large customer contracts and incentives, and it may decline if customers renew with shorter subscription periods, fewer cloud modules, fewer endpoints, or smaller contract values.
The business model remains subscription-led. CrowdStrike sells access to its Falcon platform and cloud modules, generally on a per-endpoint and per-module basis, and recognizes revenue ratably over the subscription term. A substantial majority of customers purchase multi-year subscriptions. Professional services, including incident response and proactive services, primarily serve as a lead generator for subscriptions. The quarter leaves a picture of durable demand offset by incident-related costs, go-to-market friction, and a swing to GAAP losses. The main open question is whether the company can keep ARR growth near 22% while absorbing higher capital spending and the costs tied to the July 19 Incident.
Forecast
No forward guidance in this quarter's filings.
Reported figures
GAAP, from SEC filings| Metric | Q1 FY2026 | Q4 FY2025 | QoQ | Q1 FY2025 | YoY |
|---|---|---|---|---|---|
| Revenue | $1.10B | $1.06B | +4.2% | $921.0M | +19.8% |
| Gross profit | $814.3M | $784.5M | +3.8% | $696.0M | +17.0% |
| Gross margin | 73.8% | 74.1% | -0.3 pp | 75.6% | -1.8 pp |
| Research & development | $334.1M | $315.1M | +6.0% | $235.2M | +42.0% |
| Sales & marketing | $439.6M | $409.5M | +7.4% | $350.1M | +25.6% |
| General & administrative | $165.2M | $145.2M | +13.8% | $103.7M | +59.3% |
| Total operating expenses | $938.9M | $869.8M | +7.9% | $689.1M | +36.3% |
| Operating income (loss) | -$124.7M | -$85.3M | -46.1% | $6.9M | -1897.2% |
| Operating margin | -11.3% | -8.1% | -3.2 pp | 0.8% | -12.1 pp |
| Net income (loss) | -$111.0M | -$92.7M | -19.7% | $46.3M | -339.9% |
| Net margin | -10.1% | -8.8% | -1.3 pp | 5.0% | -15.1 pp |
| Diluted EPS | -$0.44 | -$0.38 | -$0.06 | $0.17 | -$0.61 |
Risks
The July 19 Incident has had and is expected to continue to have an adverse effect on business, sales, customer and partner relations, reputation, results of operations and financial condition. Customers have deferred or declined purchases, terminated or not renewed agreements, and competitors have aggressively approached current and prospective customers and partners.
The company faces securities litigation, derivative litigation, consumer class actions, and government inquiries related to the July 19 Incident. These matters are expected to result in significant costs, management distraction, and potential penalties, injunctive relief, consent decrees, or indemnification claims.
MD&A states the company has experienced delays in creating sales opportunities and longer sales cycles following the July 19 Incident and expects sales cycles to continue to be elongated. Customer commitment packages have resulted, and are expected to continue to result, in increased contraction due to elongated subscription terms and decreased upsell dollar values.
The company reported a net loss attributable to CrowdStrike of $110.2 million in FY2026 Q1, down from net income of $42.8 million in FY2025 Q1, and an operating loss of $124.7 million, down from operating income of $6.9 million. It had an accumulated deficit of $1.2 billion as of April 30, 2025 and may not sustain profitability.
As a cybersecurity provider, the company is a target of cyberattacks, and bad actors have attempted to leverage the July 19 Incident to facilitate malicious activity, including phishing emails posing as CrowdStrike support. A successful compromise of internal systems or third-party service providers could harm reputation and financial results.
Competitors may more successfully incorporate AI into their products, gain or leverage superior access to certain AI technologies, and achieve higher market acceptance of their AI solutions. Market conditions could change rapidly and significantly as a result of technological advancements, including with respect to AI.
On May 6, 2025, the company announced a strategic plan to evolve operations. It estimates $36.0 million to $53.0 million in charges, of which $6.6 million was recognized in FY2026 Q1 and substantially all of the remainder will be incurred in FY2026 Q2. The plan could negatively affect the ability to recruit and retain skilled personnel.
Deterioration in general economic conditions, geopolitical environment, changes and uncertainty regarding trade policies or tariffs, inflation, and interest rate changes have in the past and may in the future cause customers to delay or cut security and IT operations spending, lengthen sales cycles, increase churn, and reduce demand.
The market for security and IT operations solutions is intensely competitive, and competitors may offer lower pricing or bundle competing products. Competitive pricing pressure may reduce gross profits and adversely affect financial results.
The company is highly dependent on CEO George Kurtz and other key personnel, and competition for experienced sales professionals and cybersecurity engineers is intense. The strategic plan could negatively affect the ability to recruit and retain skilled personnel.
International customers accounted for approximately 33% of total revenue for the three months ended April 30, 2025. International operations expose the company to data localization, privacy, anti-bribery, tariff, tax, and other regulatory risks.
The revolving facility and the indenture governing the Senior Notes contain restrictive covenants and cross-default provisions. A breach could result in an event of default, acceleration of indebtedness, or inability to borrow, which could harm liquidity and operations.
SaaS KPIs
All quarters →Backlog
ARR
Summary, forecast, risks and KPIs are extracted from CrowdStrike Holdings, Inc.'s SEC filings for Q1 FY2026 (10-Q / 10-K and the 8-K earnings release); GAAP figures in the summary are checked against the reported XBRL data. They can contain errors; the filings are authoritative. Processed Oct 2, 2026.