10-Q: CrowdStrike Reports Q1 Net Loss Amidst July 19 Incident Fallout, Despite Strong Revenue Growth

CrowdStrike Holdings, Inc. reported a net loss of $110.2 million for the first quarter of fiscal year 2026, a significant shift from profitability, as revenue grew 20% year-over-year to $1.1 billion, impacted by costs related to the July 19 Incident and strategic restructuring.

Summary

• CrowdStrike Holdings, Inc. reported total revenue of $1,103.4 million for the three months ended April 30, 2025, an increase of 20% compared to $921.0 million in the same period last year.
• Subscription revenue grew 20% year-over-year to $1,050.8 million, while professional services revenue increased 8% to $52.7 million.
• The company recorded a net loss attributable to CrowdStrike of $110.2 million, or $(0.44) per diluted share, for the quarter, a notable decline from a net income of $42.8 million, or $0.17 per diluted share, in the prior year period.
• Operating expenses surged by 36% to $938.9 million, leading to an operating loss of $124.7 million, compared to an operating income of $6.9 million in the previous year.
• Annual Recurring Revenue (ARR) reached $4.44 billion as of April 30, 2025, representing a 22% year-over-year growth, though net new ARR added for the quarter was $193.8 million, down from $211.7 million in the same period last year.
• The July 19 Incident resulted in $38.7 million in associated expenses recognized in the quarter, contributing to the increased general and administrative costs.
• The company announced a strategic plan on May 6, 2025, estimating $36.0 million to $53.0 million in charges, with $6.6 million recognized in Q1 fiscal 2026, primarily for severance and stock-based compensation.
• The board of directors approved a share repurchase program of up to $1.0 billion of Class A common stock on June 3, 2025.
• Cash and cash equivalents stood at $4.61 billion as of April 30, 2025, with net cash provided by operating activities at $384.1 million for the quarter.

Sentiment

Score: 4

Explanation: The sentiment is moderately negative due to the significant shift from net income to a substantial net loss, driven by increased operating expenses and the ongoing financial and reputational impact of the July 19 Incident. While revenue and ARR growth remain strong, the decline in net new ARR and the expected continued elongation of sales cycles present notable concerns for future profitability and growth trajectory.

Positives

• Strong year-over-year total revenue growth of 20% to $1,103.4 million, driven primarily by subscription revenue.
• Subscription revenue increased by 20% to $1,050.8 million, indicating continued demand for the core platform and cloud modules.
• Annual Recurring Revenue (ARR) grew 22% year-over-year to $4.44 billion, demonstrating continued customer base expansion and value.
• Maintained high dollar-based gross retention rates, indicating strong customer loyalty despite recent challenges.
• Robust cash and cash equivalents balance of $4.61 billion, providing significant liquidity.
• Generated positive net cash from operating activities of $384.1 million, reflecting healthy operational cash generation.
• Board approval of a $1.0 billion share repurchase program signals confidence in the company's valuation and commitment to shareholder returns.
• Successful acquisitions of Adaptive Shield and Flow Security enhance the company's SaaS security posture management and data security solutions, respectively.

Negatives

• Shift from a net income of $42.8 million in the prior year to a net loss of $110.2 million for the three months ended April 30, 2025.
• Operating expenses increased significantly by 36% year-over-year to $938.9 million, outpacing revenue growth.
• General and administrative expenses saw a substantial 59% increase, primarily due to $38.7 million in expenses associated with the July 19 Incident and $6.6 million in strategic plan charges.
• Professional services gross margin decreased significantly from 28% to 11%, primarily due to increased consulting expenses.
• Net new ARR added for the quarter decreased to $193.8 million from $211.7 million in the comparable prior year period, indicating a slowdown in new business generation.
• The July 19 Incident has led to delays in creating sales opportunities and longer sales cycles, impacting customer purchasing decisions and potentially future upsell values.
• Unrealized losses of $1.6 million were recognized on privately held equity securities, including impairment, for the quarter.

Risks

• The July 19 Incident has had, and is expected to continue to have, an adverse effect on the company's business, sales, customer and partner relations, reputation, results of operations, and financial condition, including ongoing legal proceedings and inquiries.
• Failure to effectively manage rapid growth could adversely affect business and results of operations.
• The company has a history of losses and may not achieve or sustain profitability in the future, despite achieving profitability in fiscal 2024.
• Dependence on the adoption of cloud-based SaaS-delivered endpoint security solutions; a lack of widespread adoption could harm business.
• Inability to successfully enhance existing products and introduce new ones in response to rapid technological changes and evolving security threats could harm competitive position.
• Failure to attract new customers or retain existing customers and expand their subscriptions could harm future results of operations.
• Long and unpredictable sales cycles, exacerbated by economic conditions and the July 19 Incident, require considerable time and expense without guaranteed sales.
• Intense competition in the cybersecurity market could lead to loss of market share, reduced revenue, and adverse financial results.
• Real or perceived failures, defects, errors, or vulnerabilities in solutions could harm brand and reputation.
• As a cybersecurity provider, the company is a target of cyberattacks; compromises of internal networks or data could damage reputation and financial results.
• Reliance on third-party data centers (e.g., AWS) and own colocation data centers exposes the company to service disruptions.
• Loss of key technical, sales, or management personnel, including the CEO, could harm the business.
• Inability to attract and retain qualified personnel in a competitive labor market could harm the business.
• Results of operations may fluctuate significantly due to various factors, making future results difficult to predict.
• Failure to maintain and enhance the CrowdStrike and Falcon brands and reputation as a provider of high-efficacy security solutions could adversely affect business.
• Claims by others of intellectual property infringement could result in significant costs and harm business.
• Compliance with stringent, complex, and evolving data privacy and security laws (e.g., GDPR, CCPA) and contractual obligations poses significant risks and costs.
• Failure to comply with other applicable laws and regulations could subject the company to fines, penalties, and loss of customers.
• Ongoing litigation and potential future legal proceedings could result in substantial costs, diversion of management attention, and adverse impacts.
• Warranty claims, product returns, product liability, and indemnity provisions could expose the company to substantial liability.
• Future acquisitions, strategic investments, partnerships, or alliances could be difficult to integrate, divert management attention, and dilute stockholder value.
• Reliance on a limited number of suppliers for equipment components could lead to supply chain disruptions and increased operating costs.
• Exposure to credit risks of certain customers and end-users, particularly during economic downturns, could adversely impact financial condition.
• Incorporation of open source software could negatively affect the ability to sell the Falcon platform and lead to litigation.
• Utilization of AI technologies could expose the company to liability, ethical concerns, and regulatory scrutiny.
• Failure to meet service level commitments under customer contracts could obligate the company to provide credits and harm business.
• The market price of common stock may be volatile, and sales of substantial amounts of common stock could reduce its price and dilute ownership.
• The share repurchase program may not result in benefits to stockholder value.
• Lack of or unfavorable research reports from industry or financial analysts could cause stock price decline.
• The company does not intend to pay dividends in the foreseeable future, relying on stock price appreciation for investor returns.
• Provisions in charter documents and Delaware law could make an acquisition of the company more difficult.
• Indebtedness could adversely affect financial condition, limiting ability to obtain additional financing or requiring cash flow dedication to debt service.
• Inability to generate sufficient cash to service indebtedness could lead to liquidity problems or forced asset sales.
• Breach of covenants under debt instruments could result in default and acceleration of indebtedness.
• Cross-default provisions could accelerate all indebtedness if covenants are breached.
• Failure to maintain an effective system of internal controls could impair ability to produce timely and accurate financial statements.
• The business is subject to risks of catastrophic events, including natural disasters and man-made problems, which could disrupt operations.

Future Outlook

CrowdStrike expects to continue significant investments in sales and marketing and research and development to drive future growth. Operating expenses are anticipated to increase in dollar amount for the foreseeable future. The July 19 Incident is expected to continue to adversely affect key metrics and results of operations in future periods, leading to elongated sales cycles, delays in customer purchasing decisions, increased contraction, and decreased upsell dollar values. The strategic plan announced on May 6, 2025, aims to yield greater efficiencies as the company scales, with most associated costs expected in the second quarter of fiscal 2026. The company expects its existing cash, cash flows from operations, and revolving credit facility to be sufficient for anticipated cash needs for at least the next 12 months.

Management Comments

• "Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report." George Kurtz, President, Chief Executive Officer, and Director.
• "Based on my knowledge, the financial statements, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of the registrant as of, and for, the periods presented in this report." George Kurtz, President, Chief Executive Officer, and Director.
• "We believe our future success depends in large part on the growth in the market for cloud-based SaaS-delivered endpoint security solutions."
• "We have incurred, and expect to continue to incur, significant legal and professional services and other general and administrative expenses associated with the July 19 Incident in future periods."
• "While we have maintained high dollar-based gross retention rates following the incident, we have experienced delays in creating sales opportunities and longer sales cycles, including delays in customer purchasing decisions. We expect sales cycles to continue to be elongated in future periods."
• "Customer commitment packages introduced following the July 19 Incident have included discounting, additional modules, professional services, flexible payment terms or subscription period extensions. Our customer commitment packages have resulted, and are expected to continue to result, in increased contraction, due to elongated subscription terms, and decreased upsell dollar values."
• "We expect that the combination of our existing cash and cash equivalents, cash flows from operations, and the Revolving Facility will be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 12 months."

Industry Context

The cybersecurity market is intensely competitive, fragmented, and characterized by rapid technological changes, evolving security threats, and frequent introduction of new products. CrowdStrike operates in the cloud-based SaaS-delivered endpoint security market, which is still in its early stages of adoption. The company positions its Falcon platform as an AI-native, cloud-native unified platform for the XDR era, aiming to define a 'Security Cloud' category. The industry is seeing increased integration of AI, with competitors also incorporating AI into their products. There's a continuous shift from on-premise legacy products to cloud solutions, but many organizations are still hesitant to abandon existing investments. The demand for cybersecurity professionals is increasing due to rising cyberattacks, intensifying competition for talent. Geopolitical tensions and macroeconomic factors, including inflation, are influencing customer spending and sales cycles in the broader IT and security sectors.

Comparison to Industry Standards

• The document highlights that the use of SaaS solutions for security and IT operations is at an early stage, implying that CrowdStrike is operating in a growing but still maturing market, where widespread adoption is not yet guaranteed.
• The company faces intense competition from a diverse set of players, including legacy antivirus providers (e.g., Symantec, McAfee), alternative endpoint security providers, network security vendors (e.g., Palo Alto Networks, Fortinet), cloud security vendors (e.g., Zscaler, Wiz), identity security vendors, professional service providers, and legacy SIEM vendors (e.g., Splunk, IBM QRadar).
• CrowdStrike's strategy of leveraging AI and a cloud-native platform aligns with broader industry trends towards advanced threat detection and integrated security solutions, differentiating itself from traditional signature-based approaches.
• The mention of longer sales cycles and increased scrutiny of budgets by current and prospective customers due to uncertain economic conditions is a common challenge across the enterprise software and cybersecurity industries.
• The company's focus on a 'land-and-expand' model, where customers start with a few modules and add more over time, is a common and effective growth strategy for SaaS companies, aiming to increase customer lifetime value.

Corporate Governance

Legal Proceedings

• A putative class action lawsuit was filed on July 30, 2024, against the Company and certain officers in federal court in the Western District of Texas, alleging violations of federal securities laws, with an amended complaint filed on January 21, 2025, and a motion to dismiss filed by defendants on April 7, 2025.
• Two putative class action lawsuits were filed on August 5, 2024, and August 19, 2024, against CrowdStrike, Inc. in the Western District of Texas, related to passenger airline flight disruptions allegedly caused by the July 19 Incident; these were consolidated on November 6, 2024, and a consolidated complaint was filed on December 6, 2024, asserting negligence and public nuisance, with a motion to dismiss filed by the company on February 4, 2025.
• Three derivative lawsuits were filed on September 4, September 11, and September 20, 2024, against certain officers and directors, and the Company as nominal defendant, in federal court in the Western District of Texas, alleging breach of fiduciary duty, unjust enrichment, and federal securities law violations; these were consolidated and stayed on November 21, 2024.
• An additional derivative lawsuit was filed on April 9, 2025, in federal court in the District of Delaware, asserting similar claims, but was voluntarily dismissed without prejudice on May 22, 2025.
• Two more derivative lawsuits were filed on April 10, 2025, in federal court in the Western District of Texas, asserting similar claims, which were consolidated and stayed on May 23, 2025.
• Delta Airlines, Inc. filed a complaint on October 25, 2024, against CrowdStrike, Inc. in Georgia, alleging computer trespass, breach of contract, fraud, strict-liability product defect, gross negligence, and deceptive practices; CrowdStrike's motion to dismiss was granted in part and denied in part on May 16, 2025.
• The Company has received requests for information from the U.S. Department of Justice and the U.S. Securities and Exchange Commission relating to revenue recognition, ARR for certain transactions, the July 19 Incident, and related matters, and is cooperating with these inquiries.
• Some customers and third parties have asserted claims or publicly threatened litigation against the Company in connection with the July 19 Incident, and the Company expects to incur significant legal and professional services expenses related to these matters.

Related Party Transactions

• The company has committed up to $10.0 million to CrowdStrike Falcon Fund LLC (Original Falcon Fund) and an additional $50.0 million to CrowdStrike Falcon Fund II LLC (Falcon Fund II), in exchange for 50% of the sharing percentage of any distribution by these funds. Entities associated with Accel collectively own the remaining 50% sharing percentage of the Falcon Funds. The company consolidates these Falcon Funds, which invest in privately-held companies.

Stakeholder Impact

• Shareholders: Experienced a net loss for the quarter, which could negatively impact stock price. The approval of a $1.0 billion share repurchase program may provide some support to shareholder value. Potential for dilution from future equity raises is noted.
• Customers: The July 19 Incident has led to delays in purchasing decisions, longer sales cycles, and customer commitment packages (discounts, additional modules, flexible payment terms, subscription extensions), which could impact customer satisfaction and retention.
• Employees: Increased employee-related expenses and stock-based compensation. The strategic plan involves charges for severance payments and employee benefits, indicating potential workforce adjustments. Competition for qualified personnel remains intense.
• Suppliers: Reliance on a limited number of suppliers for critical equipment components exposes the company to supply chain disruptions and potential increased operating costs.
• Creditors: The company has significant long-term debt ($744.4 million) and is subject to restrictive covenants under its credit facility and senior notes, which could limit financial flexibility if breached.
• Regulatory Bodies: The company is subject to ongoing inquiries from the U.S. Department of Justice and the SEC regarding revenue recognition, ARR, and the July 19 Incident, which could lead to further investigations or penalties.

Next Steps

• Substantially complete actions associated with the strategic plan by the end of the second quarter of fiscal 2026.
• Continue to incur significant legal and professional services and other expenses associated with the July 19 Incident and related matters in future periods.
• Continue to invest significantly in sales and marketing efforts to further grow the customer base domestically and internationally.
• Continue to invest in research and development to enhance the technology platform and product functionality, including AI integration.
• Potentially pursue acquisitions of businesses, technologies, and assets that complement and expand the functionality of the Falcon platform.
• Adopt ASU 2023-09, Improvements to Income Tax Disclosures, in the fourth quarter of fiscal year 2026.
• Continue evaluating the impact of ASU 2024-03, Income Statement—Reporting Comprehensive Income—Expense Disaggregation Disclosures, for future adoption.
• Execute the share repurchase program of up to $1.0 billion of Class A common stock, with timing and amount determined at the company's discretion.

Key Dates

Recommendation

Keywords

Cybersecurity, Endpoint Security, SaaS, Cloud Security, AI-native, XDR, Security Cloud, Threat Intelligence, Risk Management, Corporate Governance, Financial Reporting, SEC Filing, 10-Q, CrowdStrike, CRWD, Falcon Platform, Incident Response, Data Protection, Identity Protection, Exposure Management, Generative AI