I'll give folks a couple of minutes here to settle in, but good afternoon to everyone joining us here and folks joining and tuning in on the webcast. My name is Fatima Boolani. I jointly head up our software equity research franchise here at Citi, and I am so privileged and delighted to be able to put a capstone on Citi's 2026 TMT Conference on day three with a keynote session with the CFO of CrowdStrike, Burt Podbere. Thank you so much for being here.
Fatima, always a pleasure. Thanks for having me.
Burt, I want to start our conversation off with a statement. It has never been a more exciting or important, or consequential time to be a cybersecurity company. With that in mind, to set the tone of our discussion and our dialogue, can you give us a state of the union on the business, on the financials, on the overall strategy, and specifically, the key messages that you want to really hammer home post your second fiscal quarter results and on the back of your annual user and partner conference, Fal.Con, last week?
Yeah, thanks. Hi, everybody. Great to be here, and I love talking about the Mythos moment. The Mythos moment happened back in April, and there was a lot of activity around that, a lot of things that came out of that. You had good stuff, not such good stuff. But for us, it was a defining moment with respect to, hey, conversations are happening faster than they ever have happened before, and then they turned it into ARR for Q2. Q2 results were sensational, Fatima. It was our best quarter in company history.
Whether it was net new ARR, non-GAAP profitability, we had a record Q2 free cash flow quarter. The numbers backed up the comments that the Mythos moment for us was real, and it was more than just conversations, but it was ARR. Then you went into products. We had great product growth across the board. Next-Gen SIEM, Cloud, Next-Gen Identity. You had AIDR, which was great. You had Exposure Management, on and on and on. Flex, which is our go-to-market license, which is the most elegant license I think not only security, but software has ever seen, did really, really well. It was one of those moments where you're getting data and you're saying, "Wow, this data is super impressive with Flex."
The top 10 deals of the quarter by deal value were all Flex deals, not non-Flex deals. We were excited about that. Then you mentioned Fal.Con. Fal.Con was us coming out and saying, "Hey, we can be super innovative as well. We don't have to be a startup." We came out with some stuff, whether it was SafeMind or Guardian. Whatever it was, it was really, really well-received. Then, of course, I have to add my two cents, and I pulled in some long-term targets, $10 billion and $20 billion. I pulled those in. I think all that combined led for a really, really good Fal.Con. So, that's the state of the union, and hopefully that resonates with everybody here.
Burt, Fal.Con was clearly eventful from a product announcement and a financial and target model expectations update. We'll come back to that because there's a lot of layers of those onions to peel. But Fal.Con last week, record-breaking attendance for you. It is your biggest pipeline generator for the business. Interestingly, this year, the timing of the event clearly transpired and potentially even benefited from this post-Mythos moment and the Hugging Face incidents that we continue to hear about in the headlines in the news. I want to ask you, Burt, you see and speak to a lot of customers at these events. What was clear? What was the most distinct thread in your Chief Information Security Officer and buyer conversations this year at Fal.Con versus years prior?
Yeah. Well, certainly it was about protecting the agents. Protecting these AI agents, and customers were after three things, really. They said, "Look, with these agents that are coming out, we need visibility. We need control. We need to control what and when these agents go out. We need guardrails around this. We need audit. It's got to be auditable. All this stuff that's going out, we need to understand what's going on with the reporting. We're getting questions from regulators, etc , et c." I'll throw in a fourth, cost.
We need to be able to control the cost of this stuff. So, those are the four things that the folks in security were talking to us about. By the way, they were talking to us about it before the conference. We have offsites with the management team. About 50 of us go somewhere and we figure out what we are going to do for the next 10 years. But on this particular offsite, which happened just after Mythos, we had a CIO from a Fortune 50, and they were on a screen like this. There are 50 of us there, like this room here, but smaller. 50 of us, and he was on the Zoom, and you saw the panic in his eyes.
He is like, "My CEO wants AI deployed everywhere, and I am scared to death that we are going to be putting out these agents, and we are not only going to be opening the back door, we are going to be opening the front door for the adversaries. Help us." We went through what I just went through all of you folks, in terms of what he was looking for and then we worked collaboratively with him and his team to put out Guardian and we couldn't be more pleased.
So the CIOs and CISOs, that was the main theme that they were kind of focused on. "Help us." Which is very different from the past where we are prospecting, we are going out to look for customers. Customers are coming to us, prospects are coming to us, going, "Well, we have a real need and we think you can help us, so please pick up the phone and let's talk." And we did more of that than almost anything else we have ever done.
Burt, one of the lines of conversations and consistent conversations and debate, frankly, that I have interfaced with investors on is this notion of, well, the environment, the cyber attack landscape has never been more pernicious. It has never been as demanding. It has never been as sophisticated, ever, even in prior computing cycles. So, the question and the debate is, well, in the post-Mythos moment and these Hugging Face in the headlines, why aren't we necessarily seeing massive budgetary explosion?
Now, certainly we saw some of the tinges of that in your second fiscal quarter. But how would you allay concerns or sort of emphasize to investors that maybe the Mythos moment isn't a moment, it's actually an era of sustainably and durably capturing more growth and budget. So really the pain point is why didn't we see a budgetary explosion immediately after these events like we maybe saw in the past?
Yeah, it is a great question, Fatima. First of all, I am driving to your conference and I am listening to the radio and there is some guy talking about AI doom, and I am kind of listening to this going, "Okay, well, he is not all wrong." But then there are companies like us who can help stop and prevent the doom. What does that all mean? You think about the landscape and the threat landscape. Look, years ago, the number one threat actor were these nation-state attacks. They would hire 1,000 people, they would put them in a bunker 65 ft below the ground, and they would come up with all these sophisticated ways to disrupt companies, attack companies, change election results, all of this kind of stuff.
Today, it is now in somebody's living room. These attacks can be generated in somebody's living room with all these agents that are as sophisticated as anybody that we have ever seen before. We are in this really kind of strange period where people are figuring out how to use these things mostly for good, but some for bad. For the bad, what has really happened is, number one, it is not just the volume of attacks that have gone through the roof. Speed. The speed of these attacks has never been faster. You have seen the sophistication. It has never been more creative in terms of how to attack somebody and steal their prized possessions.
You are seeing all that combined and the threat landscape is just exploded in terms of the surface of attack, and you need companies like us to help plug the dam. Fortunately for us, we feel that sometimes it is better to be lucky than good. We have talked a little bit about that, and what do I mean by that is that AI is consumed at the endpoint, and last I checked, we really know how to run an endpoint business. It really came to us, and the great news is we are prepared.
We are prepared. We launched a battle-tested product called Guardian that actually prevents the breach on these agents that people are building faster than you can drink your coffee. It is incredible what we are seeing in the space. Look, I actually think that we are in the greatest transformation of technology the world has ever seen. I have been in security a long time, I have been in software a long time. I have never seen anything like this. The consumption of AI is through the roof, and we just happen to be in the right position to help secure the AI.
Burt, you alluded to this in talking about some of the highlights from Fal.Con, but some of the things that stood out to us certainly was there was a pretty curated slate of very high impact SKU expansions and product introductions. The velocity of the innovation was clear, but specifically, with the launch of AI Guardian and SafeMind, those two specifically come to mind.
Can you give us, and maybe help us with some parameters as to which one of the newest product introductions you expect to have most salient impact on your financial performance and your financial momentum near term? Asking this going back to, hey, the budgetary consciousness has never been on as high alert, right? So where would those killer products be where you're commandeering the budget?
Yeah. So obviously we haven't released SafeMind yet, so it's early days. So nothing really contemplated in the financials for this fiscal year. We contemplated it next year, but it's still early days. We've still to launch it. I think Guardian, as part of the AIDR category, I think that's going to have some legs. On that one, I would say the following, I think that AIDR as a category will be bigger than EDR. Let me repeat that. AIDR as a category will be bigger than EDR. That's our view. That just tells you what's out in front of us. In terms of near term, I mean, have your pick.
You've got Next-Gen SIEM, Identity, you've got Cloud, you've got Exposure Management, on and on and on. These products are doing really, really well. Last quarter was our best quarter in company history. We did $333 million net new ARR, 31% growth year-over-year. These are big numbers. I gave increased guidance, and we'll talk about that, I'm sure, all because of the momentum we're seeing. You talked about in your earlier question about why aren't we seeing this uptick from the Mythos moment more than what we're seeing?
I come back and I go, "Well, for us, it was pretty good." I'm not so sure others are benefiting the way we are, because we're here at the right moment, and it goes back to being an endpoint company. AI is consumed at the endpoint. You're going to hear a lot of other folks talk about, well, it's all about workflow, or it's all about network, or it's all about this, that, and the other thing. No. Do your homework, do your reading. AI is consumed at the endpoint.
We see network traffic before it even goes to the network, before it's encrypted. When you think about that, it's hard to refute the comments that I'm making. For us, we're proving it with the numbers. Words are cheap. Talk is cheap. Show me the scoreboard. We did that last quarter for sure and certainly in some of the guidance that I gave.
Burt, just drawing from your past experience in having been a pretty critical vendor in securing prior computing cycles, I think a helpful frame of reference that you've provided is let's think about the monetizable opportunity for you for AI security from the standpoint of, hey, if we're going to be spending $1 trillion of CapEx and generating $3 trillion of demand on all this AI infrastructure, well, there's going to be some proportion of that that's going to have security wrapped around it, right?
I think your framing has been for every dollar of AI demand, there's going to be $0.03-$0.04 maybe of cybersecurity spend. Can you walk us through kind of some of the foundational underpinnings of your thought process there? What sort of led you to this being an appropriate mental model for folks to think about in terms of the incrementality of market opportunity for you?
Yeah. Let's start with the budgets. Look, if a company is breached, they're going to find the money. Let's start there. Now companies are really getting worried, and Boards are getting really worried about their companies in terms of how do we prevent from getting breached. They're looking and they're coming to us. We're getting calls from folks that you all would know in this room, CEOs of very prominent companies that are calling us directly and saying, "What do we need to be worried about? How can you help protect us?"
This is not the CIO, this is not the CISO, this is the CEO of Fortune 500 companies calling us and asking us for help. Board members from these companies calling us and saying, "What do we need to be thinking about as Board members? We want to make sure we're doing the diligent thing." The budgets, they're going to come from net new, but they're also going to be coming from other areas. As AI becomes more prolific within organizations and organizations are going to become more efficient and effective of what they do, dollars are going to free up.
We're already seeing it. We think that we're in a great spot to capture more of those dollars, and become more of a strategic partner for these firms. They're looking to us for help. By the way, we do pick up the phone. We are one of those companies that picks up the phone, answers calls from the management team all the way down. It's part of our culture. When things are good and when things are not so good. We're there for our customers.
When we say we're customer-focused, we are customer-focused. Look, we got a CEO, he's across the bridge over there. He comes from Jersey. This guy doesn't stop. He's still a founder. Think about that. Still a founder. Most of our competitors are not founders, and there is a difference. This guy wrote the most selling cyber book in the world history called Hacking Exposed. This guy built a cybersecurity company for cybersecurity professionals. That's what he did. Because he's a founder, there's no rest. There's no rest for those who kind of work with him day- to- day.
George doesn't have an off button, I hear.
There's no off button. It's just go. The great news is he's a really good human being. This guy has a great reputation. He's tough as nails, and to work for him is brutal. It's kind of like he is on, that means you are on. I'm coming to my 11th year next week, and I reflect back and I say, "Man, keeping up with that guy was a real challenge for me in my career, and I've never been happier, I've never learned more." I went on stage for our sales kickoff. We had about, I don't know, 3,000, 4,000 sales folks, and I said two things. I said a bunch of stuff, but I said two things that they needed to remember.
One, don't make deals with customers that are on the side because we'll find out about it and you're sacked. There's no room for it. Number two is never bet against George. That's a real bad bet. That guy just keeps going. The innovation that you've seen at Fal.Con, the go-to-market engine that he's built, the taking out friction through our Flex offering, we'll talk about that, I'm sure. The way that he kind of gets the most out of his team, right? It's focused. I've never met a more purposeful man in my life, and it shows again in the scoreboard-
Yep.
...shows in the numbers.
In talking about George, I have to harken back to July 2024. That was a very pivotal moment for you as a company. The business financially and strategically is in a dramatically different place since July 2024, when you did have the outage that was heard around the world and felt around the world. Burt, what I want to ask you, between you and George, what have been some of the factors in navigating through this period where you are absolutely now in the free and clear? What has surprised you the most, and how has that experience influenced the way you have managed the business, managed operations, and frankly, steward capital?
Yeah. That was an event, and look, I never want to go through it again, but there were some silver linings, right? Our touchpoints with customers were through the roof. We talked to almost all of our customers. Sometimes it was groups of 1,000, whatever it was. We were on the phone, all of us. We were in a room, I do not know, about for 50 people, and on the Board, the whiteboard, you would have Burt that took all the companies that thought we were going to go broke, so I had to go through our financials.
You had the bigger companies that George took. Mike Sentonas, our President, he took more of the technical challenges, on and on and on down the line. 50 of us, and we all had companies that were associated with our name or events that we had to go to. Silver lining there is just more touchpoints with our customers. The biggest, I guess, surprise was this, from that point on till now, is the speed of AI adoption. It's incredible. We've never seen anything like this in our lifetimes, and maybe we never will again.
The speed of AI adoption needs security, right? Somebody asked me the other day, they said, "Well, who runs sidecar with the AI providers, the frontier models, to make sure that it gets out and used accordingly?" I said, "Well, you're going to have these folks over here saying they need that, and these folks over here saying they need this." At the end of the day, they need security. Just to my former example with the CIO talking about, "Hey, I can't deploy without you guys." With that in mind, we're partners to all these folks, right?
We're enablers for AI adoption. We used to talk about security following the technology curve. Now we're talking about security following the AI adoption curve which is much steeper than the technology curve. It's been really good for us. You saw it in the numbers, you saw it in the guide, and you're seeing it in the business. You're probably hearing it in my voice. I've never been more excited to be at the company, I've been at the company 11 years, in terms of what's in front of us.
Burt, Flex and the Flex motion was given birth, the concept and the procurement vehicle sort of came into being after the event. At nearly 40% of the ARR mix today, you're just two years in. Can you give us some perspectives and shed light on the design and contours of some of these commercial engagements, the adoption, and then the economic impact? I know you sort of peppered in some stats earlier. Ultimately, what have you learned and changed in the Flex process programming in the two years since introduction?
Yeah. For those that aren't familiar with Flex, it's the most elegant go-to-market, I think, that's ever been invented. I wish I could take credit for it. It was the customers coming to us and saying, "Hey, you now have 25 modules. You have 26. How do we get access to all of it?" We kind of worked through, with our customers, what would make the most sense for them. We wanted to make it really easy. As I said earlier, George is from Jersey. He's just, "How do we make this so easy for customers to purchase?"
We came up with this license where basically, you negotiate once, and then you've got a deal for a period of time, and then you're able to add more, but not renegotiate terms. It's already done. It's just adding another PO to an existing contract where the blocker is me, the CFO. But if the business unit owner goes to the CFO and says, "Hey, I need more for CrowdStrike, but I'm going to give you back X for something else, and the X is going to be more than what we're asking for CrowdStrike," well, you don't need to be a CFO to do the math to say, "Okay, let's go do that."
In the entire life of software and security for sure, no one really was able to kind of grab onto a license where you have three winners at the same time. You have the economic buyer, you have the vendor, us, and procurement. I've never seen all three of those win at the same time. The economic buyer wins because they're able to consolidate, get the best outcomes at a cheaper cost. We win because we're locking in our customers for longer, bigger contracts, and being bigger supporters and bigger advocates and trusted advisors. Procurement wins because they're after the biggest discount.
The biggest discounts are our Flex contracts. They get paid based on additional discounts they're able to achieve. Guess what? Flex allows for exactly that. You have three winners, and then you saw some of the stats. We now have over 2,900 customers on Flex. You mentioned the 40% uplift when we move somebody from a non-Flex to a Flex. That's up from 34% the year before. You're looking at folks that are able to look at Flex and look at us and become meaningfully involved with us with a Flex contract, and you've seen some of the data with respect to you know what it looks like in terms of re-Flex.
That's when a customer comes back to us after the original contract. Let's say these contracts are, I don't know, pick a term, five years, six years, seven years, whatever the number is. When we originally came out with this thing, Fatima, we said, "Well, maybe we'd get a re-Flex halfway through the contract," or whatever it was. It's eight months. People are coming back to us on average eight months into the contract, not even a year, and adding more. You've got re:Flex Dynamics which surprised us in a very positive way, meaning that customers are moving to us faster and with more.
As you think about Flex as the de facto, not even dominant, just the de facto sales motion, how long should we expect to get to 100% of the ARR mix being Flex, part A? Part B is, as you cycle through and build more data points around re:Flex behavior, re-re:Flex behavior, and then dare I say re-re-re:Flex behavior, again-
Multi re:Flex
We probably need to figure out a better term for that. What should that natural cadence be? Because I think from a financial standpoint, is there a concern or risk that you might be in a period where it could act like an ELA cliff, ELA-style cliff to your numbers, right? If you can help assuage some of those concerns-
Yep.
...as you drive more success with these very meaty, long duration Flex deals.
Perfect. A couple of big-picture items on Flex. Number one, it's a commitment model, not a consumption model. That's number one. Number two, it's not an ELA. You're not getting an all you can eat license with us. You have access to everything, but it is not an ELA. I lived through those, didn't like those. No.
Not great.
No, not great. It was painful as a CPA. When I think about the re:Flex and the multi re:Flex data, I think one of the strongest pieces of data we have with Flex in general is the multi re:Flex. So when a customer comes back more than once, it's a 53% uplift from when they first initiate a deal with us. 53%. That's massive. To me, out of all the Flex stats that we gave out on the earnings call and at Fal.Con, that one stood out to me more than any of the others.
The other ones were really strong. But that one kind of said to me that, hey, look, customers are going more with us. Customers want to put their chips in with us and be our partners. To me, there was nothing more evident than, again, the scoreboard. Now, why does Flex really work for us and maybe not so much for others? You have seen probably other Flex type of licenses that other companies have come out with. Some companies, they do not even change the name. They call it Flex.
Imitation is the-
Imitation-
...sincerest form of flattery.
...fair dues. Here is the difference. For Flex to really work, you need multiple products. We got 34 today, and they need to be turned on instantaneously, right? Time to market, instantly. You need those two things, and if you do not have those two things, Flex is not going to be as powerful for you at all. When we thought about it, we had that in mind. What are the things that are going to make Flex kind of What is the mode around Flex? It is those two things. I as an accountant worked on, for you guys and for myself and my own sanity, I wanted to make sure that the revenue recognition was the same as a non-Flex contract.
Ratable recognition, so we worked with the auditors to be able to do that. Today, there is no mixed models for me. No confusion. It is the same. There's no additional things you need to add to your model or subtract or take out or fix. It's one model before and after Flex. It saves me from doing a lot of conversation around mixed models and saves you in terms of being able to understand our business and make the appropriate investment decisions.
What's that journey to 100% ARR mix?
Oh, yeah. Sorry about that one. The journey is-
It was a multi-headed question.
...multi-headed question. Many of your questions are always multi-headed. I have to-
It is my specialty.
I need my notes to kind of keep up. So right now, we are Flex first. Basically, if you want to have a non-Flex item, you have got to go to our President for an exception. That is more painful. It is more scrutiny. Tell me exactly why the customer does not want to have a Flex license. Have you done your job? It is not what you want to do. Plus, you get paid more with a Flex license. There are all these incentives to make sure that that happens. I actually do see a world where there is no other license. It is just Flex.
Burt, you said 34 modules under the umbrella today. I know you love all your modules equally. But, in the spirit of it being fantasy football season, what are the modules in the portfolio that are in their rookie season that you feel very good about? What are the modules that are your GOATs, your MVPs that are driving the bus?
Yeah. Giants going to have a good year this year? I think so, right? Maybe.
Feels like a Chiefs Super Bowl year to me again.
Yeah. There's always hope at the beginning of the year with the Giants, so hopefully you guys do well. For us, though, we've got multiple opportunities, right? Clearly the rookies, you've got Guardian. That's a as I said, that AIDR category is going to be, I think, bigger than EDR as a category. Then obviously SafeMind, we're the world's first security frontier model. I have high hopes for that one, too. I think it's going to get a lot of usage. I think we're going to have a different monetization go-to-market with respect to pricing on that one.
There'll be pack of tokens, then off you go with the upsell and additional packs. Then you got the ones that we've disclosed for so many years, and you got Cloud. It's over a $900 million business growing 29% year-over-year. You've got Next-Gen SIEM just under $700 million, growing 60% year-over-year. You got Next-Gen Identity just under $600 million, growing 33% year-over-year. All three of those can be IPOs in today's world, which is different than when we went public, which the bar is higher, I think, today to go public than when we went out. But all three of those today can be IPOs. You got Exposure Management, which has grown over the last quarter. Exposure Management is going to be huge.
You've seen in the news Anthropic finding all these vulnerabilities, millions and millions of vulnerabilities. There's no chance anybody could patch all those in a reasonable amount of time. But our Exposure Management, what does it do? It takes all those vulnerabilities and prioritizes them for you so you know where to focus and can use us to help patch and remediate. That is a benefit of what we are seeing with some of the great things that are coming out of the Anthropic and OpenAI's of the world, is they are able to find things out, and then we can come in, prioritize them for you, and make it real. We are excited about Exposure Management in a big way.
Obviously, I think when you look at Endpoint and what has been happening there, you have had four quarters in a row, we have had acceleration in the Endpoint. That is because, again, go to the scoreboard. We have done that because that is where AI is consumed. Everybody can talk about whatever they want, go to the scoreboard. I used to always get the question about pricing about, "Okay, God, you are pricing to the bottom. You are pricing security to the bottom." I am like, "What? My margins are best in breed.
That dog doesn't hunt." So, you guys are all financial experts. You look at the numbers. You look at the numbers first, do that in this case as well, and the narrative should then play to the numbers. If it doesn't, well, then do you have belief in these other companies or less belief? More belief? Less belief. So that is how I think about it. So products, it is like pick your favorite pet, right? It is like they are all kind of special to me. I see just dramatic opportunity in front of us.
Burt, with Exposure Management, it seems that that is really hitting escape velocity, just right place, right time. What would behoove you in terms of what parameters are you stress testing to be able to give investors some more visibility around that quantitatively?
Yeah.
Largely because the word vulnerability at this conference was one of the most oft-cited kind of term at the conference. What would compel you to say, "Hey, this gives me confidence to carve this piece of the business out and talk about it in the same breath as your other almost $1 billion businesses like Cloud, NG SIEM, and Identity"?
Yeah. We're rapidly approaching the same cadence of disclosures for Exposure Management.
Okay.
We gave out some data in the past. We talked about it being a $300 million business a few quarters ago in ARR. It's definitely on that path. I think that it increased quarter-over-quarter in terms of its growth. I'm excited about Exposure Management, and I'm excited about disclosing more data of Exposure Management as I am AI. Down the track, I'm excited to be able to give out numbers and disclosures on Guardian. More on, and maybe as a group, maybe I'll break that one out, but as a group of different products that we have that are AI-related, whether it's Charlotte or even Breakout, obviously SafeMind.
There's a few products in there that I would kind of categorize. I'm going through it now in my own head, I want to give you guys as much knowledge as you can to make the most informed decision you can. I've been pretty good about transparency. It's been, I think, one of our hallmarks, in terms of giving you guys enough data to make the best decision you can. Highest and best use of your dollars. I think I'm going to be giving those out in the not-too-distant future. Bear with me as I go through when I'm going to be disclosing this stuff. But yeah.
No, we appreciate that. We talked a lot about Flex as a conduit for more wallet share penetration and expansion. I want to talk to you about QuiltWorks as another go-to-market mechanism, where you're finding strength in numbers by building very close partnerships with a very diverse constituency.
Yeah.
Let's say, right? Same question around go-to-market, and your ability to build consensus and a consortium-focused go-to-market. Tell me about, and tell us about QuiltWorks and how that's distinct from traditional partner go-to-market motions.
Yeah. QuiltWorks, we handpicked a bunch of companies to help us think through and go- to- market on a variety of things. It could be in terms of looking at your health of your security stack. Right? Can use them and us to kind of go in and say, "Hey, guys, you're way below the bar." Right? "And here's how we can help you." Today we have 25 companies within QuiltWorks. They've generated or helped us generate $400 million in pipeline in TCV. It's clearly working. And it gets us closer with the ecosystem.
We plan to have more in QuiltWorks. We think that it's a real powerful way to go- to- market. We've got a great go-to-market motion on our partner side. DB, who runs our entire kind of alliances, GSIs, partners, QuiltWorks, you've had the chance to meet him. He's special. Before CrowdStrike, even during CrowdStrike, I always thought that companies kind of failed badly, certainly in security, on the partner side, on the go-to-market side. This guy transformed it for me, took it to a different level. QuiltWorks is only one piece of it. The hyperscaler marketplaces is another one. Look at all the work we've done with Amazon. We're even in with Microsoft.
Your arch- nemesis-
Yeah.
...in some ways.
In fairness with the folks over at Microsoft, we're trying to work together for resiliency together. So we do things in partnership even with Microsoft. Thank God Satya has about five businesses that are bigger than security to think about. But they're everywhere, right? Their OS is everywhere. So, for us, the QuiltWorks piece is just another element of expanding our footprint and our reach, right? We've got great depth, and these guys add breadth. QuiltWorks is something that continues to add breadth in terms of our reach, and I think it's brilliant.
I think another one of the models that you helped pioneer was the ability to, with the benefit of united and unified terms and conditions, help customers retire their hyperscaler spend towards CrowdStrike's portfolio of products. I know that was one of a more pioneering effort for you. Where are you on that journey with respect to GMV done with AWS, GMV done with Azure, and then certainly we can't leave GCP out of the mix.
We have it all with those guys. It's a model that works. Everybody's making money on it. That's the key, is you got to make sure that your partners make money. If partners are making money with you, they're going to stick with you, and they're going to do more with you. Microsoft's such a big company. As I said, they have businesses much larger than security. There are pieces of the business that make sense that we work together on. No one was more surprised than me two years ago when Satya was on video at Fal.Con.
We were trying to work together on resiliency, and today we're actually doing business with them even though we're competing. As the industry collides, you'll probably see more of that really, I think, in a good way. I think it's a positive thing. Look, we're still competing as hard as we can in the marketplace for customer dollars. There's no doubt. But where we can work together, we will. A lot of that is because of DB and the team that DB has assembled. These are top-shelf folks. Changed my whole view on go-to-market on the partnership side. I come from the old school where you take your head of sales who needs to do something else, and you put them out there and hope for the best.
This is not who we are. Let's get the best person for the job, whatever it is, wherever they are, and make them the leader and fortify them. Don't starve them, fortify them. At first, I'm the first to ask the questions about, "You need how much to do what? What marketing programs for your partners do you want to do? How much do we want to spend?" I'm kind of like T-Rex, right? Like, "Ah." Wait a second. I've promised the street that we're not growth at all costs. We're very judicious about how we deploy our capital. But he comes with ROI.
I want to segue into a conversation about competition. As you've gained prominence and yourself grown significantly larger and much bigger, I'd argue your competitive set isn't your normal and usual suspects, right? How do you look at the landscape today, and who do you see as your prime competitors? Let's talk about the Frontier labs. Can we put some of the fears and concerns to bed around their potential ability to usurp or commoditize any parts of your portfolio and value proposition? So yeah, just kind of broad strokes, the competitive landscape and what you are seeing today.
I love that question. Who are my competitors? It is Microsoft. It is not even close. We have a section with Palo Alto and a section with Splunk and what have you. Microsoft is our biggest competitor. Now, having said that, the Frontier models, I love that question. Let us make no mistake about it. The Frontier models for us, the Frontier labs, these are friends of ours, period. Great customers of ours, great partners of ours. We had Ash from Anthropic in the investor session.
He came up on stage and said, "We are using CrowdStrike to secure our business. CrowdStrike is the security operating system of our business." He said it on stage. It is on video. You can go back and listen to it. The reason is that we are enabling the Frontier models. They see us as a catalyst because they want deployment everywhere, but they know that there are CISOs out there and CISOs out there and companies out there that are fearful of these things going rogue. Whatever, pick one. Hugging Face is one of them.
Whatever it is, they want us to secure it. So they are our biggest proponents. What gives us confidence that, well, they just cannot create a CrowdStrike? I asked Graham, I am going to say it again, and he said, "Look, our cloud code and our really smart developers, they cannot build a CrowdStrike." We cannot reason our way to CrowdStrike. The other side of the coin is they do not have the data. We are net data creators. These labs need data. They need data with context. We have both those things. The partnership is really hand in glove.
We have all the data. We have the context around the data. You can use our data to be able to do whatever you need to do to give the highest and best outcomes for your customers, whoever they might be. We feel that we are in a fantastic position with respect to the Frontier labs to be their partners for years to come. They know it. Not only the Frontier labs, we had Jensen on stage. He is talking about how much of a partnership we have with NVIDIA. Because they recognize the same thing. They have got to make their chips safe. So George and folks like Jensen, they are trying to change the world, and I am happy to have a front row seat.
Burt, on this theme of competition, I want to expand the definitional scope of it a little bit. About 15% of your business today is services. So professional services and by way of incident response, breach assessment, breach remediation. Frankly, that would bring you some pretty unique angles and perspectives from a product development standpoint.
I want to ask you about how does the strategic nature, or how does your professional services franchise stand to become more strategic in the era of AI, where we are going to see higher volumes and variety and sophistication of breaches, number one. And number two, where do you sort of draw the lines and rules of engagement with some of your partners who potentially can compete or would theoretically compete with you in that area? How do you grapple those dynamics?
Yeah. So on our P&L that we break out our services line item, it is about 5%, so it is not a big piece of our business. Having said that, it is extremely strategic, as you are pointing out. Because we will go in and someone will be using some shabby technology and get breached, and we come in and fix it. That is what that business is.
But we also do assessments with QuiltWorks, for example, and do some kind of forward-looking things to preventative medicine, if you will, to kind of make sure that the health of these companies is in good shape. So for me, I think about professional services as the tip of the spear. It is our biggest lead gen. I think it is one of those things that, hey, I love it. I want them for one thing, selfishly, cross-sell my product. Whatever you do, be friends with the customer, be there for them. They talk to the customers a lot. Cross-sell the product. We track that, obviously. That's what I care about.
What do those metrics look like on the cross-sell?
We haven't been giving them out, but they're healthy. Maybe that's another one I might give out more of, certainly with QuiltWorks and everything else. But we have given it out in the past, so we have done it, and it's pretty robust and exciting for me. I don't care who uses our services and what they use our services for, and even if you're a competitor in my services business and we're in a competitive environment and okay, we lose, but they use our tech afterwards, I'm a happy guy. Win-win. Look, I want my services business to do well. I want my services business to win. I want my services business to grow. But it's not first of mind. It's the cross-sell. It's all about product.
I want to shift gears into talking and asking you about how CrowdStrike is consuming and running on AI. So the influence of AI and how you've managed the business, and managed a disciplined cost structure and envelope. How are you balancing accelerating AI adoption at CrowdStrike internally, but also driving efficiencies that are visible on the P&L and to investors?
Yeah. Let's take a look at the P&L. Let's start with sales. The sales team has AI type of tools that we use to help them with respect to prospecting, finding out what customers are using, how much they're using. So we're using AI for all that information. Go down to gross margin, our DevOps. We've got very healthy gross margin. We're knocking on the door of my long-term model, which is 20%. Sorry, 30%. Where are we now? 20%. I'd love to be
30% at the, sorry, gross margin, I'd like to be between 82% and 85% is my model. We're at 81%, so we're knocking on the door. We use AI in the DevOps area, which is basically our data centers, and we use AI to help find multiple data stores so that we can consolidate those. Then you go down the P&L into our operating model. So you got R&D. We're using AI, coders are using AI. I think like everybody else, coders or the traditional coders are turning into reviewers.
They're turning into folks that can use 10 agents and just review and make sure the code that the agents are spitting out is accurate and correct. So you're becoming really efficient at what you're doing, and you're accelerating what you're doing in your business from an R&D perspective. Even in G&A, think about legal. You have all these companies that are out there doing good work that we can leverage. Legora is one of them that's out there that you can leverage and you can look at a contract and just isolate all the non-unique and unique terms. We're using it there. I use it in finance for automation. I close my books, by the way, in a day. So in one day.
Wow.
I can go to you guys. Now, the auditors take time to go review everything, but I am ready to go to you guys to the street in a day. One quarter, it was day zero I could go to you guys. That is a lot of automation. That is a lot of AI in there to help me through that. So it is manifesting itself across every line in the P&L.
In terms of top line, in terms of bottom line, we are trying to be efficient with our use. When I budget, so I have lines in the budget for every group, and I budget a certain amount of AI spend tokens. So I have amount of tokens that each group can have, and that is what you have, and here is your overall envelope, expense envelope, and tokens is part of it. AI is part of it.
Sure.
We have technology that can monitor usage, meter usage, so if you are over a certain amount, you are cut off, and then we investigate why you are burning through tokens faster than you should. If it is for good stuff, great, you get more. If you are building a game, you are out. So we do monitor this stuff. So we are using it prevalently in our work.
Burt, I think it is important spending a little bit more time on the gross margin banding that you shared, 82%-85%. As the business continues to become more data intensive in terms of telemetry generation from agents and a bigger footprint, what are some of the things that you are doing to be able to maintain such a high watermark of gross margins as you are ingesting even greater torrents and avalanches of data and digital exhaust to be more efficacious for your customers?
Look, this is my favorite topic.
Love gross margins.
Gross margin.
You were at 30% gross margin-
I know
12 years ago.
We were talking about that when we were private, and I said, "I'm going to turn this company around and I'm going to help take it public on gross margins." We've done a great job, obviously. But we got more to go. When we think about who we are today, we've got public Cloud, private cloud. On the public side, there are partners that are doing great. We look for less expensive areas by geo. There could be, for example, Amazon has West- 2 versus West- 1, which is a lower cost, colo, and we use more of that. We're now pretty big, and so we consume more.
We leverage the discount capability with the public clouds. Private side, we have our own clouds and we're looking for opportunities through AI, some of it, in terms of multiple data stores. But also, migrations. What are the expensive things that we're paying for in the Cloud that we could do ourselves? I feel good about our trajectory to get to even the higher end of the long-term model and gross margin because of those things. I think it really helps. Now, I'm sure that some of you are thinking, well, for your own data centers, isn't the cost of a big iron expensive for you folks?
Yeah, I talked about it at Fal.Con. It's gone up to 11%-12%, or projecting to go up to 11%-12%. But I've already baked that into my free cash flow for a margin for FY 2028. I said it's going to be 32.5%. I've taken up my free cash flow margin, knowing that I'm still going to have some of these expenses that I'm going to have to pay for with respect to more expensive hardware. I feel pretty good about all of that combined.
This is a great way for me to round trip back to our opening dialogue around your medium-term financial targets, which you did update last week. Whereas we were looking at a $20 billion ARR target in FY 2036, we're now talking about that within FY 2035. Whereas we were looking at a $10 billion ARR bogey in fiscal 2030, we're look-
[inaudible]
fiscal 2031, excuse me.
2031, yep.
We're now looking at it within fiscal 2030.
Yep.
What are the three most sensitive or influential catalysts that would have those outcomes happen in fiscal 2029 and in fiscal 2033?
Yeah, look, Guardian, that could be something that can propel it for sure. You have just the continuation of the big three that I like to call them, Next-Gen SIEM, Cloud, Next-Gen Identity. Next-Gen Identity is going to We'll probably talk about it if we have time. But that's a huge catalyst for us. We've spent a lot of money, we've bought a lot of companies within that category, and it's done extremely well. As I said, that is part and parcel with what we're seeing in this AI revolution. I think that those are some of the things that can continue to help us get to those targets in the first place, and hopefully if they do really, really well, exceed them.
And remember, when we think about the $20 billion, we gave some examples at Fal.Con that we only need to penetrate those TAMs at about 3.5% across the board. 3.5%. We are averaging 4%. And one does well, you are miles past it. I get really excited about how low the bar is in terms of market penetration to get there on a product basis. I think that with our go-to-market engine, Flex, all these things combined, I feel really good about bringing in those dates with hitting $10 billion and $20 billion.
Burt, I want to end our conversation asking you about capital allocation, especially around M&A, your size, your scale, alongside how rapidly we are watching IT lines blur between one another. How do you think about transformational and larger M&A? You have got the share price currency for it. You have got the market size and dominance and heft for it. What is the framework for M&A today and how has that evolved in the last two years?
It has actually stayed pretty constant. We are looking for great tech and great people. It starts there. We are not buying ARR like some of our competitors. Look, if we found a much bigger company, and it obviously came with ARR, but it had great people, great tech, we are going to do it. The bar for us is not price. Obviously, it is an input, is price, but it is the tech. If a company that we are looking at has an agent and we cannot smash that agent into ours, it is an immediate no. If we do not see a path, or the path is going to be too long and we got to rewrite the whole thing, no, we are not buying it.
Having said that, if we see a path, then that has passed that bar. And for us, it is about the seamless integration. That is the starting point. Price, we negotiate and whatever it is, if it makes sense, we are going to find a way, but it is really about the tech. For me, I would love to do bigger deals. I would like to do more deals, I would like to do bigger deals, I would like to do it all. But in this case, the CFO is not the gatekeeper. It is the tech people. It has to fit in.
When we bought Preempt, which was the base of our security product, we knew that at the time it was going to be a year and a half to integrate, and we said it is worth it. So we bought it, we waited the year and a half, we integrated it seamlessly, and then we started to sell it, and you see the results today. Today, with AI and everything else, we think that if there is a technology like that today, we would be able to integrate it a hell of a lot faster, maybe even as quick as half the time. These are all good things for us to be thinking about M&A.
I think George, our CEO, and our President, Mike Sentonas, they get 10 calls a week. I get calls from your other side, on the investment banking side, "Burt, think about this one, think about that one." Then we have a whole ecosystem of folks that constantly are calling us with respect to the companies that they think could fit well with us. We have a huge and healthy pipeline. We also have hired a guy out of Okta to run our corp dev, Peter Zyskowski . He is a machine.
He is able to siphon through all these companies and give us the take on them pretty fast. Rapidly understanding how they can fit into our company. We do have a machine, but we are not out there buying ARR. That is not who we are. Buying great tech, great people, that is never going to change. Big company could come with ARR, and so be it. We will be prepared for that.
Burt, my last question for you is what is one consistent, palpable, salient investor misunderstanding or misperception that you would like to wave away?
Yeah. The one thing that I would love to leave you all with is that the Mythos moment wasn't just the start of something. It is going to be enduring, it is long, and it is not just about Guardian. It is about selling the platform. The conversations that we have seen, the demand that we have seen post the Mythos moment has been incredible. It is in the numbers. It is back to the scoreboard. I would love to leave you all with the notion that the Mythos moment wasn't just about Guardian. It was about folks consolidating with us.
Highest and best use of their dollars going with us, being a strategic partner with us, growing with us, and us being able to enable them to roll out agents, but also protect all their other environments, whether it is Cloud, whether it is endpoint, whatever it is. I think that's the biggest It's not a misconception, it's something that maybe the light bulb doesn't go off for everybody to say it's more than just Guardian, what we saw with the Mythos moment.
That's the biggie for me. I think we're at this moment in time where it doesn't come too often. This was a gift. This is a gift to us, and I'll take gifts. But I think it's a big one. I think it's transformative for us as a company. I think it could be the biggest act in our company history. Hopefully you get the same feeling in listening to me talk today and your great questions to get that feeling. That's truly how I feel.
Burt, fortune favors the ready.
Yeah.
We're watching. Thank you so much.
Thank you. Great to be here.
This was fantastic. I appreciate it.
Thanks, guys.