FQ1'27：AI驱动网络安全升级紧迫性

Peter Weed+1 917 344 8390peter.weed@bernsteinsg.com RatingMarket-Perform Price Target CRWD 413.00 USD(368.00OLD) CrowdStrike (CRWD) FQ1'27: AI driving cyber-upgrade urgency CrowdStrike’s FQ1’27 earnings came in with a relatively normal top line beat (+1.7% atmidpoint) and ARR (+$6MM, or nearly $5MM organically), but really showed well with astrong FY raise, particularly in ARR +$53. The company pointed to an improving demandenvironment between enterprise leaders need to secure AI, and increased urgencygenerated by Anthropic’s “Project Glasswing” industry initiative (CrowdStrike is one ofthe lead signatories of the group). On the back of this, CrowdStrike convened “ProjectQuiltWorks” in April, to marshal its close industry partners to help address the “chaos” (asanother leading cybersecurity CEO put it to us) that enterprise buyers felt after the initialAnthropic Mythos cybersecurity announcement in early April. Close Date3 Jun 2026CRWD Close Price (USD)747.61Price Target (USD)413.00Upside/(Downside)(45)%52-Week Range785.66/342.72SPX7,553.68FYEJanDiv YieldNAMarket Cap (USD) (M)190,327EV (USD) (M)185,961 AI and broader products all showed strength on this backdrop.AIDR offering grew>250% QoQ, and Charlotte AI ARR accelerated sequentially. Even base capability needsupgrade, with ½ enterprise seats still on Antivirus — this urgency extends to companiesmodernizing their endpoint and threat intelligence seen in record Net New ARR across Cloud+ Next Gen Identity + Next Gen SIEM together. Part of the tailwind is customers embracingthe Flex license model, with QoQ growth in excess of $200MM ARR (reaching $1.9B+) as~300 new customers signed Flex deals (reaching 1900+ in FQ1) — these customers areimportant, as their renewals are showing 26% ARR uplift. The bottom line followed in kind.79% Non-GAAP GM was +50bps vs. consensus, andNon-GAAP OpM of 23.5% for an even larger +70bps vs. consensus. This latter result was inspite of R&D costs that ran hot (90 bps higher % of revenue than expected). Investment Implications The stock price remains the only thing holding us back from recommending CrowdStrike. Weraise our growth duration ~1% point in the next few years due to AI tailwinds. Using 50/50sector multiples regression (16x P/NTM revenue up from 15x), and DCF (unchanged 10%WACC, 3% growth) we update our PT to $413 and maintain our MP rating. DETAILS NOTES FROM OUR CALLBACK WITH THE MANAGEMENT (PRESIDENT, CFO) The company’s increased confidence in deal velocity and strong pipeline is driven by Claude Code adoption and theurgent need, emerging since March, to manage agents.By April, following Mythos, every board member and CEO wasfocused on what actions they could take. Tracking net new numbers from Anthropic, much of which is tied to Claude Code,provides visibility into forward demand, as all of these agents ultimately need to be secured. Management believes Mythos triggered a broad rethink among CEOs and CISOs, prompting a reassessment oflongstanding software vulnerabilities that predated AI but were largely ignored.While organizations are eager toaccelerate AI deployment, they increasingly recognize that security is a prerequisite for doing so at scale and speed. Strength in AIDR is not displacing growth in other parts of the business but instead represents incremental demandthat serves as a tailwind.The AI pipeline increased by $50M, which is incorporated into guidance. Next-Gen SIEM remains strong and continues to grow, with a significant untapped opportunity as the company hasyet to reach greenfield adoption beyond its existing endpoint customer base.Every customer is Next-Gen SIEM capableand receives 10Gb for free. Both endpoint and Next-Gen SIEM have substantial room for expansion, supported by multipletailwinds, including the fact that roughly 50% of the market still relies on legacy AV. Flex is accelerating following the company's transition to a Flex-only licensing model, which is commitment basedinstead of consumption based.The entire sales force and partner ecosystem have migrated to Falcon Flex, which shoulddrive increasing momentum and expansion over time. When asked about SentinelOne's path to success, management emphasized that achieving scale and winning largeenterprise customers are critical, both of which are already firmly held by CrowdStrike and another major competitor. EXHIBIT 1:We expect CRWD's ARR YoY growth rate to stabilize back into the mid-20%s by the end of FY27. EXHIBIT 2:NRR continued to bounce back after its Q2’26 bottom that was mostly due to the outage impacts. Weestimate that over coming quarters NRR will stabilize as the outage impacts wear off in FY27. APPENDIX - FINANCIAL FORECASTS BERNSTEIN TICKER TABLE I. REQUIRED DISCLOSURES References to "Bernstein" or the “Firm” in these disclosures relate to the following entities: Bernstein Institutional Services LLC(April 1, 2024 onwards), Sanford C. Bernstein & Co., LLC (pre April 1, 2024), Bernstein Autonomous LLP, B