10-Q: CrowdStrike Reports Q2 Loss Amid July 19 Incident Costs

CrowdStrike Holdings, Inc. reported a net loss for the second quarter and first half of fiscal 2026, primarily driven by increased operating expenses and significant costs related to the July 19 Incident.

Summary

• Total revenue increased by 21% to $1.17 billion for the three months ended July 31, 2025, and to $2.27 billion for the six months ended July 31, 2025, compared to the prior year periods.
• Subscription revenue grew 20% to $1.10 billion for the quarter and $2.15 billion for the six months.
• Professional services revenue increased 45% to $66.0 million for the quarter and 26% to $118.7 million for the six months.
• The company reported a net loss attributable to CrowdStrike of $77.7 million ($0.31 per share) for the quarter, a significant decline from a net income of $47.0 million ($0.19 per share) in the prior year.
• For the six months, the net loss was $187.9 million ($0.75 per share), compared to a net income of $89.8 million ($0.37 per share) in the prior year.
• Gross margin decreased to 73% for the quarter (from 75%) and 74% for the six months (from 75%), primarily due to increased stock-based compensation and data center depreciation.
• Operating expenses surged by 36% for both the three and six months periods, reaching $971.6 million and $1.91 billion respectively, driven by increases across sales & marketing, R&D, and G&A.
• Annual Recurring Revenue (ARR) grew 20% year-over-year to $4.66 billion as of July 31, 2025, a deceleration from 32% growth in the prior year.
• Net new ARR for the three months ended July 31, 2025, was $221.1 million, slightly up from $217.6 million in the prior year, but for the six months, it decreased to $414.8 million from $429.3 million.
• The July 19 Incident (a content configuration update causing system crashes) has led to significant legal and professional services expenses, sales delays, and longer sales cycles, impacting key metrics and results.
• Costs associated with the July 19 Incident, net of insurance receivable, amounted to $75.4 million for the six months ended July 31, 2025.
• A strategic plan initiated on May 6, 2025, involved a 5% workforce reduction (approximately 500 positions) and resulted in charges of $38.4 million for the quarter and $45.0 million for the six months, primarily for severance and stock-based compensation.
• Cash and cash equivalents stood at $5.0 billion as of July 31, 2025.
• The company acquired Adaptive Shield for $213.7 million in cash (net) in November 2024 and Flow Security for $96.4 million in cash (net) in March 2024.
• A subsequent event on August 25, 2025, announced the acquisition of Onum Technology Inc. for approximately $290.0 million, expected to close in Q3 fiscal 2026.

Sentiment

Score: 3

Explanation: The sentiment is negative due to a significant shift from profitability to substantial net losses, driven by a major product incident (July 19 Incident) and associated legal/remediation costs, as well as increased operating expenses. While revenue growth remains, the deceleration in ARR growth and the ongoing adverse impact on sales cycles and customer contracts are concerning. The workforce reduction and declining gross margins further contribute to a cautious outlook, despite strong cash reserves and strategic acquisitions.

Positives

• Total revenue grew by 21% for both the three and six months ended July 31, 2025, demonstrating continued top-line expansion.
• Subscription revenue, the core business, maintained strong growth at 20% for both periods.
• Professional services revenue showed robust growth of 45% for the quarter and 26% for the six months, indicating strong demand for incident response and proactive services.
• Annual Recurring Revenue (ARR) increased by 20% year-over-year to $4.66 billion, reflecting ongoing customer commitment.
• Net new ARR for the quarter ($221.1 million) slightly exceeded the prior year's quarter ($217.6 million), suggesting some stabilization in new business despite challenges.
• The dollar-based net retention rate continued to be strong, indicating existing customers are largely renewing and expanding their subscriptions.
• The company maintains a strong liquidity position with $5.0 billion in cash and cash equivalents as of July 31, 2025.
• Strategic acquisitions of Adaptive Shield and Flow Security have been completed, and the acquisition of Onum Technology Inc. is planned, indicating continued investment in expanding platform capabilities and market reach.
• The enactment of the One Big Beautiful Bill Act (OBBBA) in the U.S. is expected to have an immaterial favorable effect on the income tax provision and cash flows from operations due to tax reforms like R&D expenditure deduction and accelerated depreciation.

Negatives

• The company reported a significant net loss of $77.7 million for the three months and $187.9 million for the six months ended July 31, 2025, a substantial decline from profitability in the prior year periods.
• Operating expenses increased significantly by 36% for both the three and six months periods, outpacing revenue growth and leading to operating losses.
• Gross margin declined by 2 percentage points for the quarter and 1 percentage point for the six months, primarily due to higher stock-based compensation and data center depreciation.
• Professional services gross margin saw a notable decrease of 4 percentage points for the quarter and 10 percentage points for the six months, driven by increased consulting expenses.
• Year-over-year ARR growth decelerated to 20% from 32% in the prior year, indicating a slowdown in the rate of recurring revenue expansion.
• Net new ARR for the six months ended July 31, 2025, decreased to $414.8 million from $429.3 million in the prior year, suggesting challenges in new customer acquisition or expansion.
• The July 19 Incident continues to have an adverse effect on business, sales, customer and partner relations, and reputation, leading to significant legal and professional services expenses ($75.4 million for six months).
• The July 19 Incident has caused delays in sales opportunities, longer sales cycles, and increased contraction due to customer commitment packages (discounts, extensions).
• The strategic plan involved a 5% workforce reduction, incurring $45.0 million in charges for the six months, reflecting restructuring costs.
• The company has an accumulated deficit of $1.3 billion as of July 31, 2025, and may not achieve or sustain profitability in the future.

Risks

• The July 19 Incident has had, and is expected to continue to have, an adverse effect on business, sales, customer and partner relations, reputation, results of operations, and financial condition, including ongoing legal proceedings and inquiries.
• Failure to effectively manage rapid growth could adversely affect business and results of operations.
• The company has a history of losses and may not be able to achieve or sustain profitability in the future.
• Dependence on the adoption of cloud-based SaaS-delivered endpoint security solutions; a lack of widespread adoption or reduction in demand could harm the business.
• Inability to successfully enhance existing products and introduce new ones in response to rapid technological changes and evolving security threats could harm competitive position.
• Difficulty in attracting new customers or retaining existing ones, or increasing sales to them, could harm future results of operations.
• Long and unpredictable sales cycles, exacerbated by uncertain economic conditions and the July 19 Incident, require considerable time and expense without guaranteed sales.
• Intense competition in the cybersecurity market could lead to market share loss, reduced revenue, and lower gross margins.
• Real or perceived defects, errors, or vulnerabilities in solutions, or failure to detect/prevent incidents, could harm brand and reputation.
• As a cybersecurity provider, the company is a target of cyberattacks; compromises of internal networks or data could damage reputation and financial results.
• Reliance on third-party data centers (e.g., AWS) and colocation data centers; disruptions could negatively affect platform performance and reliability.
• Reliance on key technical, sales, and management personnel; the loss of one or more key employees could harm the business.
• Inability to attract and retain qualified personnel due to intense competition and stock price volatility.
• Results of operations may fluctuate significantly due to various factors, making future results difficult to predict.
• Failure to maintain and enhance the CrowdStrike and Falcon brands and reputation as a provider of high-efficacy security solutions could adversely affect the business.
• Claims by others of intellectual property infringement could result in significant costs and harm the business.
• Compliance with stringent, complex, and evolving data privacy and security laws (e.g., GDPR, CCPA, U.K. GDPR, EU AI Act) and contractual obligations could increase costs and expose the company to liability.
• Failure to comply with other applicable laws and regulations (e.g., export controls, anti-corruption) could subject the company to fines, penalties, and loss of customers.
• Ongoing and future litigation, including class action and derivative lawsuits related to the July 19 Incident, could result in substantial damages, legal costs, and diversion of management attention.
• Warranty claims, product returns, and product liability claims from real or perceived defects or misuse, and indemnity provisions, could expose the company to substantial liability.
• Future acquisitions, strategic investments, partnerships, or alliances could be difficult to identify and integrate, divert management attention, disrupt business, and dilute stockholder value.
• Exposure to credit risks of certain customers and end-users, especially during economic downturns, could adversely impact financial condition.
• Risks associated with equity investments, including partial or complete loss of invested capital and volatility in fair value.
• Expectations regarding ESG factors may impose additional costs and expose the company to risks.
• Business is subject to risks of catastrophic events (natural disasters, public health crises, man-made problems) that could disrupt operations.

Future Outlook

The company expects to continue incurring significant legal and professional services and other expenses related to the July 19 Incident in future periods. Sales cycles are expected to remain elongated, and customer churn and impact to key metrics and revenue may occur in future periods due to the incident. The company anticipates sales and marketing and research and development expenses to increase in dollar amount as it invests for future growth, but expects them to decrease as a percentage of total revenue over time. General and administrative expenses are also expected to increase in dollar amount. The company expects its existing cash, cash equivalents, cash flows from operations, and revolving credit facility to be sufficient to meet anticipated cash needs for working capital and capital expenditures for at least the next 12 months. The acquisition of Onum Technology Inc. for approximately $290.0 million is expected to close in the third quarter of fiscal 2026.

Management Comments

• Our future success depends in large part on the growth in the market for cloud-based SaaS-delivered endpoint security solutions.
• Our future growth depends in large part on our ability to acquire new customers.
• Our ability to increase revenue depends in large part on our ability to retain our existing customers and increase the size of their subscriptions.
• We believe that our market opportunity is large and requires us to continue to invest significantly in sales and marketing efforts to further grow our customer base, both domestically and internationally.
• We expect our general and administrative expenses to increase in dollar amount for the foreseeable future given the additional expenses for accounting, compliance, and investor relations as we grow as a public company.
• The July 19 Incident has adversely affected our results of operations, and we currently expect a number of factors relating to the incident to adversely affect our key metrics and results of operations in future periods.
• While we have maintained high dollar-based gross retention rates following the incident, we have experienced delays in creating sales opportunities and longer sales cycles, including delays in customer purchasing decisions.
• We expect sales cycles to continue to be elongated in future periods.
• Customer commitment packages introduced following the July 19 Incident have resulted, and are expected to continue to result, in increased contraction, due to elongated subscription terms, and decreased upsell dollar values.
• We expect our gross profit to increase in dollar amount and our gross margin to increase modestly over the long term as we grow our business, although our gross margin could fluctuate from period to period depending on the interplay of these factors.
• We expect that the combination of our existing cash and cash equivalents, cash flows from operations, and the Revolving Facility will be sufficient to meet our anticipated cash needs for working capital and capital expenditures for at least the next 12 months.

Industry Context

CrowdStrike operates in the intensely competitive and rapidly evolving cybersecurity market, which is characterized by continuous technological advancements, including the increasing integration of AI. The company's focus on cloud-based SaaS-delivered endpoint security aligns with a growing industry trend, though adoption rates remain a key factor. The July 19 Incident highlights the inherent risks in the cybersecurity sector, where product failures can severely impact reputation and customer trust, leading to competitive pressures from rivals seeking to capitalize on such events. The company's strategic acquisitions of Adaptive Shield and Flow Security, and the planned acquisition of Onum Technology Inc., reflect a broader industry trend of consolidation and expansion into adjacent security areas like SaaS security posture management and data security solutions to offer more comprehensive platforms.

Management Changes

Corporate Governance

Legal Proceedings

• A putative class action lawsuit was filed on July 30, 2024, and an amended complaint on January 21, 2025, against the company and officers alleging federal securities law violations related to the July 19 Incident. A motion to dismiss was filed on April 7, 2025.
• Two putative class action lawsuits were filed on August 5 and August 19, 2024, against CrowdStrike, Inc. related to passenger airline flight disruptions caused by the July 19 Incident. These were consolidated on November 6, 2024, and a consolidated complaint was filed on December 6, 2024. The district court granted the motion to dismiss on June 18, 2025, but plaintiffs filed a notice of appeal on June 25, 2025.
• Multiple derivative lawsuits were filed against officers and directors (September 4, September 11, September 20, 2024, April 9, April 10, July 3, July 17, 2025) alleging breach of fiduciary duty, unjust enrichment, and federal securities law violations related to the July 19 Incident. Most have been consolidated and stayed pending resolution of the putative securities class action.
• Delta Airlines, Inc. filed a complaint on October 25, 2024, against CrowdStrike, Inc. alleging computer trespass, breach of contract, fraud, product defect, and negligence related to the July 19 Incident. CrowdStrike's motion to dismiss was granted in part and denied in part on May 16, 2025.
• The company has received requests for information from the U.S. Department of Justice and the U.S. Securities and Exchange Commission relating to revenue recognition, ARR reporting for certain customers, and the July 19 Incident and related matters. The company is cooperating with these inquiries.
• Some customers and third parties have asserted claims against the company, and inquiries from other governmental authorities have been received, all related to the July 19 Incident.

Related Party Transactions

• The company committed up to $10.0 million to CrowdStrike Falcon Fund LLC (Original Falcon Fund) and an additional $50.0 million to CrowdStrike Falcon Fund II LLC (Falcon Fund II), in exchange for 50% of the sharing percentage of any distribution. Entities associated with Accel own the remaining 50% of the sharing percentage of the Falcon Funds. The company is the manager and controls investment decisions, consolidating the Falcon Funds.

Stakeholder Impact

• **Shareholders:** Experienced significant dilution of ownership interests due to net losses and increased operating expenses. The July 19 Incident and associated legal costs have negatively impacted financial performance. The share repurchase program aims to provide value, but its effectiveness is uncertain. Potential for further stock price volatility due to ongoing litigation and market perception.
• **Employees:** Approximately 500 positions (5% of global workforce) were reduced as part of a strategic plan, impacting affected employees. Stock-based compensation remains a significant component of overall compensation, and volatility in stock price could affect retention and motivation. The company continues to invest in attracting and retaining qualified personnel.
• **Customers:** The July 19 Incident caused system crashes for some Windows users, leading to disruptions and potential loss of trust. Customer commitment packages (discounts, extensions) were offered, which may benefit customers but impact the company's revenue recognition. Longer sales cycles and potential churn are noted. The company is investing in enhancements to software resiliency and customer controls.
• **Partners:** The July 19 Incident negatively impacted existing or prospective partners' ability or willingness to promote products or services. Competitors are aggressively targeting partners. Maintaining successful relationships with channel and technology alliance partners is crucial for future growth.
• **Creditors:** The company maintains compliance with financial covenants under its revolving credit facility and Senior Notes indenture. Strong cash reserves ($5.0 billion) provide a buffer, but increased indebtedness and potential for further losses could be a concern if not managed effectively.

Next Steps

• Continue remediation and other efforts in connection with the July 19 Incident.
• Address ongoing lawsuits, claims, and inquiries related to the July 19 Incident.
• Invest significantly in sales and marketing efforts to further grow the customer base domestically and internationally.
• Continue investing in technology architecture and software platform, including AI, to enhance existing solutions and develop new ones.
• Complete the acquisition of Onum Technology Inc., expected to close in the third quarter of fiscal 2026.
• Monitor and comply with new accounting pronouncements (ASU 2025-05, ASU 2024-03, ASU 2023-09).
• Continue to evaluate the need for a valuation allowance on deferred tax assets.
• Manage and adapt to evolving data privacy and security laws and regulations globally.

Key Dates

Recommendation

CrowdStrike's Q2 2026 filing presents a mixed picture. While revenue growth remains strong at 21% and ARR increased by 20% year-over-year, the company reported a significant net loss for the quarter and six-month period, a stark contrast to prior-year profitability. This shift is primarily attributable to substantial increases in operating expenses, particularly general and administrative costs, heavily influenced by the ongoing legal and remediation expenses related to the July 19 Incident. The incident has also led to elongated sales cycles and increased customer contract 'contraction' (e.g., shorter terms, fewer modules), which could impact future revenue quality and growth. The deceleration in ARR growth from 32% to 20% is a notable concern. However, the company maintains a robust cash position of $5.0 billion, indicating strong liquidity to weather current challenges and fund strategic initiatives, including recent and planned acquisitions. The workforce reduction, while incurring short-term costs, aims for long-term efficiency. For a seasoned investor, the current situation warrants a 'Hold' recommendation. The underlying business (cybersecurity, cloud-native platform) remains strategically important and growing, but the immediate financial performance is under pressure from the July 19 Incident and increased investment. A 'Hold' allows investors to monitor the company's ability to mitigate the incident's impact, restore profitability, and demonstrate sustained ARR growth without the significant one-time costs. A 'Sell' would be premature given the strong market position and cash reserves, while a 'Buy' would be too aggressive given the current profitability challenges and ongoing legal uncertainties.

Keywords

Cybersecurity, Cloud Security, SaaS, Endpoint Security, XDR, AI-native platform, Falcon platform, Threat Intelligence, Data Protection, Risk Management, ARR, Net Retention Rate, SEC Filing, 10-Q, CrowdStrike