CrowdStrike posts strong Q3 with ARR acceleration, but valuation and post‑incident renewal risks keep us cautious

What happened

CrowdStrike reported a broadly strong Q3: ARR reached $4.66B, net new ARR accelerated sharply, subscription revenue and gross margins remained high, and free cash flow hit a record in the quarter. Management reiterated FY26 revenue guidance and a 21% non‑GAAP tax rate while explicitly warning of longer sales cycles and renewal/expansion uncertainty tied to the July 19 incident. Core operational metrics—GAAP subscription gross margin around 77%, non‑GAAP near 80%, and $221M net new ARR—support the consolidation and cross‑sell thesis for the Falcon platform. That said, GAAP losses persist, the business still trades at rich multiples (EV/EBITDA ~26) and management disclosures make clear execution and renewal risks that could impair growth or margins. The quarter validates demand and cash generation but does not remove the key post‑incident and valuation risks, leaving the investment case unchanged and the stance cautious.

Implication

Treat the quarter as confirmation of product demand and strong cash conversion rather than a buy signal at current multiples. Monitor dollar‑based net retention, net new ARR, deferred revenue trajectory, and subscription gross margins—deterioration on any of these would be an early warning sign. Because GAAP losses remain and the stock trades at a premium, there's limited margin of safety; multiple compression would meaningfully hurt returns if growth slows. If subsequent quarters show sustained ARR reacceleration, normalized sales cycles, and stable DBNR, upgrade to BUY could be warranted; conversely, evidence of contracting terms or prolonged elongation would justify moving toward SELL. Until that evidence appears, prefer trimming into strength or waiting for a clearer risk/reward setup rather than adding fresh exposure.

Thesis delta

The new coverage confirms Q3 ARR acceleration and strong cash flow, modestly reducing execution uncertainty around demand. However, it does not alter our core concerns—post‑incident renewal behavior, elongated sales cycles, and a rich valuation—so our recommendation remains HOLD pending clearer evidence of durable DBNR and sustained outperformance.