Hello, and welcome to CrowdStrike's Fiscal Q1 2026 Financial Results Conference Call. At this time, all participants are in a listen-only mode. After the speaker's presentation, we will conduct a question-and-answer session. Please be advised that today's conference is being recorded. I would now like to hand the call over to Maria Riley, Vice President of Investor Relations. Maria, please go ahead.
Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, Chief Executive Officer and Founder of CrowdStrike, and Burt Podbere, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth, including projections, and expected performance, including our outlook for the second quarter and fiscal year 2026, and any assumptions for fiscal periods beyond that, are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties.
We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events, or otherwise. Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the company's quarterly and annual reports. Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings press release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8K filed with the SEC today. With that, I will now turn the call over to George.
Thank you, Maria, and thank you all for joining our Q1 FY 2026 earnings call. Our fiscal year started from a position of strength. While the market navigates evolving conditions, CrowdStrike is capitalizing on accelerated demand through continuous innovation, increasing win rates, and platform consolidation at scale. We consolidate point products without compromise, and most importantly, CrowdStrike stops the breach. In Q1, where we met or exceeded our key metrics, highlights include: 1. Q1 net new ARR of $194 million, double-digit millions ahead of our expectations. 2. Q1 ending ARR surpassing $4.4 billion, maintaining our leadership as the only pure-play cybersecurity software company of this size. 3. Subscription gross margin of 80%, demonstrating our AI platform efficiency. 4. Sustained 97% gross retention as customers remain firmly committed to Falcon. 5. Free cash flow of $279 million, or 25% of revenue, demonstrating double-digit quarter-on-quarter growth. And 6.
Added $774 million of total Falcon Flex account value, bringing the total deal value of accounts that have adopted Falcon Flex to $3.2 billion, growing 31% sequentially and more than six times year over year. Seeing our customers and ecosystem embrace Falcon Flex at this speed and scale gives me confidence, confidence in improving sequential net new ARR growth next quarter and accelerating back-half net new ARR. Falcon Flex is significantly evolving our go-to-market and customer experience. The subscription model sparks Falcon platform adoption, delivers point product consolidation, and fuels partner success. I'd like to share where we are with Falcon Flex, as well as a thematic customer win showcasing the power of the model. In less than two years since starting Falcon Flex, we've closed more than $3.2 billion of total account deal value across more than 820 accounts that have adopted the subscription model.
Here are the trends we're seeing: 1. Customers spend more. The average Flex customer deal size is greater than $1 million in ending ARR. 2. Customers commit to longer durations. The average Flex subscription length is 31 months. 3. Flex customers adopt Falcon faster. More than 75% of Flex contracts are already deployed. The outcome of these points taken together is a phenomenon we're already seeing. Reflexes: 39% of Flex customers have already deployed their initial contract demand plan and have returned to us for a reflex. These customers' initial Flex contracts were 35 months, nearly three years on average, and within just five months, they came back to CrowdStrike wanting more of the Falcon platform to achieve their cybersecurity consolidation goals. The model we pioneered is a game changer.
Flex accelerates what would have taken years of module sales cycles into rapid platform transformations, unlocking adoption and spend while creating even more platform stickiness. Now, let's witness Flex in action at a Fortune 100 technology firm. We began our relationship with this account pre-Falcon Flex when they selected CrowdStrike to displace and consolidate a point product EDR and legacy AV. Our initial EDR contract was for $12 million over a three-year term. When we launched Falcon Flex, this customer took the opportunity to accelerate their cybersecurity modernization, executing a five-year, $100 million-plus contract. This is the power of Flex: evolving Falcon from what was a singular outcome sale into a multidimensional platform experience more than eight times the size of the initial deal.
This transformational Flex contract was for securing cloud workloads, expanding in other business units, next-gen SIEM to replace two legacy SIEMs, and broad-based adoption of Falcon Complete to standardize detection and response. Within just nine months of the initial Flex contract, this customer had already utilized 95% of their initial subscription and still had more point products to consolidate and cybersecurity outcomes to deliver. As a result, in Q1, this customer reflexed to realize the following new outcomes: expansion of Falcon endpoint protection across multiple additional business units, replacing and consolidating cloud protection with Falcon Cloud Security, which has since become the standard across a vast and growing cloud estate. Identity protection became an imperative across sensitive assets. Next-gen SIEM quickly became the central enterprise data store, replacing multiple legacy SIEMs and expanding beyond security use cases into IT. Data protection is replacing legacy DLP from endpoint to cloud.