CrowdStrike’s 4QFY26 Earnings: The Data Pipeline Disguised as a Security Company

CRWD (earnings): Q4 net new ARR $331M (record), gross retention 97% post-outage, full-year ARR >$1B first time. Thesis: not security vendor but data infrastructure—telemetry from 100Ms endpoints = irreplicable switching cost. SIEM $585M ARR (+75% YoY), Flex converts budget to consumption w/380 renewals at +50% ARR. Bull: SIEM displaces Splunk/Sentinel, MACC wins materialize, reclassification to infra = $650 (19% IRR). Bear: MSFT bundles free alternative, ARR disclosure change = $230 (-17% IRR). Base $390-420 already priced. Track Q1 NNA (May), SIEM >$750M (Aug), 10-K language (Mar). At $391 you're betting on reclassification catalyst.

Read full article (10 min)