On April 7, 2026, Anthropic announced it was entering cybersecurity.

Claude Mythos — Anthropic's most powerful model yet — was being given to a handful of Fortune 500 partners including Apple, JPMorgan, Amazon, and Palo Alto Networks, under a program called Project Glasswing. The pitch: an AI system that can find and fix vulnerabilities in your code at a speed and depth no human team can match. Three weeks later, Anthropic rolled out Claude Security to every Enterprise customer in public beta.

Wall Street did what Wall Street does. It panicked first and read the press release second.

Then Q4 results came out. ARR crossed $5 billion. Net new ARR was a record $331 million, up 47% year-over-year. Free cash flow hit $376 million in a single quarter. Module adoption rates kept climbing — half of CrowdStrike's customers now run six or more modules, a quarter run eight or more. The stock initially dropped 4% on the print, then rallied 42% in the following month as investors absorbed what was actually happening: CrowdStrike is winning, not losing, the AI fight.

So we have to ask three questions. Is the AI threat to CrowdStrike real? Are the numbers as strong as the headlines suggest? And at $617 per share, are we paying a fair price for one of the best businesses in software?

This analysis answers all three. By the end, you'll know what CRWD actually generates in cash, whether the balance sheet is built to absorb shocks, what management is doing with the cash they earn, and what the stock is really worth.

CrowdStrike sells software that protects companies from getting hacked. Endpoint protection, identity security, cloud workload protection, threat intelligence, SIEM, log management are all different rooms in the same house. The house is called the Falcon platform. It runs in the cloud. It uses a single lightweight piece of software (called a sensor) installed on every laptop, server, and cloud workload a customer owns. From that one sensor, CrowdStrike can activate any of 33 different modules, similar to turning on different rooms with the same key. The benefit is customers don’t have a stack of vendors to manage.

The way CrowdStrike makes money is simple: customers pay an annual subscription. The more modules they use, the more they pay. As of Q4 FY26, 50% of customers run six or more modules, 34% run seven or more, and 24% run eight or more. That last number was zero a few years ago. When a customer adopts a new module, CrowdStrike doesn't sell them a new product — it just turns on a switch. That's why the gross margins are 75% on a GAAP basis and 81% on the subscription line specifically.

Two revenue segments. Subscription is everything: $4.56 billion in FY26, or 94.9% of the business. Professional services — incident response, consulting, training — is the other $247 million, just 5.1% of revenue. Subscription is where the value lives. Professional services exists mostly to land new customers and prove the platform in a crisis.

On market position: Gartner ranks CrowdStrike in the top three for Endpoint Detection and Response (EDR), behind Microsoft Defender but ahead of every other dedicated security vendor. In MITRE ATT&CK evaluations — the closest thing the industry has to a fair fight — Falcon consistently posts the highest prevention efficacy of any tested vendor. CrowdStrike isn't the biggest cybersecurity company by revenue (that's Palo Alto Networks at ~$8.5B). But it's the fastest-growing major player at scale, and on next-gen workloads — cloud, identity, AI — it's the platform other companies are measured against.

Revenue grew 22% in FY26, from $3.95 billion to $4.81 billion. Subscription revenue specifically grew 21%, from $3.76 billion to $4.56 billion. That's deceleration from FY25 (29%) and FY24 (36%), but at $5 billion of scale, every point of growth is harder to add. The absolute dollars added — $858 million in FY26 — were larger than the entire revenue of the company in FY20.

ARR — annual recurring revenue, which is the forward-looking version of subscription revenue — ended FY26 at $5.25 billion, up 24% year-over-year. Net new ARR for the year was $1.01 billion, up 25% from FY25. The Q4 net new ARR number was the headline: $331 million, up 47% YoY. That acceleration in the second half is a clear sign the July 19, 2024 outage is in the rearview mirror — customers are buying more, not less.

Two things to call out. First, GAAP net income has bounced between profit and loss because of stock-based compensation, which I'll cover in the Shares Outstanding section. Second, the operating cash flow margin dipped from 42% in FY23 down to ~34% in FY26. That's not a business deteriorating. That's the company offering "customer commitment packages" (CCPs) after the July 19 outage, which front-loaded discounts and extended billing terms. Management has guided FCF margin back to 30%+ in FY27, with a long-term target of 34–38%. The bounce-back is already starting.

Free cash flow grew 22.7% in FY26 to $1.31 billion — the highest in company history. Over the past five years, FCF has grown at a 44% compound annual rate. The business prints cash, and the rate at which it prints is accelerating in absolute dollar terms.

Normalized FCF note: FY25 FCF of $1.07 billion was depressed by the CCPs offered after the July 19 incident. FY26 FCF of $1.31 billion is the cleaner, more representative baseline. I'm using $1.31B as my normalized FCF base for valuation.

CrowdStrike's balance sheet is a fortress.

Debt to Free Cash Flow: Total debt of $820 million divided by normalized FCF of $1.31 billion equals 0.63x. That's well under the 3x threshold for "Great." CrowdStrike could pay off every dollar of debt with just seven months of free cash flow. Most companies couldn't do it in seven years.

Debt to Equity: $820M debt / $4.43B equity = 0.19x. Down from 0.24x last year and 0.34x two years ago. The ratio is improving every year because equity is growing faster than debt.

Excess Cash: Total cash and short-term investments of $5.23 billion minus total debt of $820 million equals net cash of $4.41 billion — about 3.8% of the company's market cap sitting in cash. That gives management flexibility to acquire (SGNL, Seraphic, Onum, and Pangea all closed in the last year), to repurchase shares, or to weather any future incident without missing a beat.

Interest Coverage: This one looks ugly on the surface — GAAP operating income is negative, so the ratio is negative. But on a cash basis, FY26 interest expense was $28 million against operating cash flow of $1.6 billion. They earn ~57x their interest bill in operating cash. The "negative" GAAP ratio is an artifact of SBC, not a real financial concern.

Balance sheet verdict: Great. Best-in-class. There is no leverage risk here.

CrowdStrike pays no dividend.

That's the right call. A company growing free cash flow at 20–30% per year and earning ~80% subscription gross margins should reinvest every dollar into the platform — new modules, new geographies, AI infrastructure, tuck-in acquisitions, and yes, opportunistic buybacks. The day CRWD pays a dividend will be the day growth has slowed enough that reinvestment opportunities have run out. That's not today.

For income investors looking for yield, this is not your stock. For growth investors looking to compound, the absence of a dividend is a feature, not a bug. This belongs in the growth sleeve of a portfolio

This is where I have to be a buzzkill for a minute.

Diluted weighted-average share count has grown from 227 million in FY22 to 258 million in FY26. That's a 13.7% increase over four years, or roughly 3.3% annual dilution. The primary driver is stock-based compensation. SBC in FY26 was $1.10 billion, equal to 22.8% of revenue. Twenty-three cents of every revenue dollar is being paid to employees in stock.

Here's the honest framing. SBC at 23% of revenue is high — even for high-growth software, where 15–18% is more typical. It's the single biggest reason CrowdStrike still posts GAAP operating losses despite generating $1.3 billion of free cash flow. The cash didn't go out the door to fund operations; it was paid to employees in stock that they later sold, which dilutes existing shareholders. That's a real cost.

The good news: dilution is decelerating. Management has authorized $950 million in remaining share buybacks and has started using them. Net new annual recurring revenue per share is growing faster than share count. Diluted EPS grew 15% in FY26 even with the share creep.

The watch item: I want to see SBC as a percentage of revenue drift toward 15% over the next three years. If it doesn't, the buyback program becomes mandatory rather than opportunistic. For now, the FCF growth more than offsets the dilution, however this is the largest single risk to per-share value besides the AI competitive threat (more on that in Section 9).

On a reported basis, CrowdStrike's 5-year average GAAP ROIC is roughly -3%, against a 5-year average WACC of 7.5%. That's a -10.5% spread. On paper, the company has been destroying shareholder value for half a decade.

That's not what's actually happening. Here's the math behind the math:
The reason ROIC is negative isn't that the business is unprofitable. It's that GAAP operating income subtracts $1.1 billion of stock-based compensation as if it were a cash expense. Strip out SBC and look at cash returns instead:

Without stock based compensation, $CRWD ( ▼ 5.66% ) has a ROIC of 31%. On a cash basis, CrowdStrike is creating value.

So which is it? Value creator or destroyer? Both, technically, depending on how you count. The honest answer is that the economic picture is clearly value-accretive, but the accounting picture won't catch up until SBC moderates as a percentage of revenue. As that happens (and it will, software companies don't get to pay 23% of revenue in stock forever as they mature), returns will turn positive and the gap will close.

Trend: Improving on the cash side. The accounting side requires patience

CrowdStrike generated $1.61 billion of operating cash flow in FY26. Here's where it went.

Two things stand out. First, almost half of the cash being generated is being plowed back into the business — about 19% into property and equipment (mostly data center buildout for AI infrastructure), 24% into acquisitions (SGNL, Seraphic, Onum, Pangea — all adding capability to the Falcon platform), and the rest into capitalized software development. That is exactly what you want from a growth company at this stage.

Second, the other half is being stockpiled on the balance sheet. Cash and equivalents went from $4.3 billion at the start of FY26 to $5.2 billion at the end. Management has authorized $950 million in remaining share buybacks and is starting to deploy them in FY27.

The translation: Management is playing offense (M&A, AI infrastructure, R&D) while building optionality on the balance sheet for either an opportunistic buyback or a larger strategic acquisition. No dividend, no debt paydown — both appropriate for a company at this stage of growth.

Before the DCF, we have to address the elephant. Anthropic, the maker of Claude, is entering cybersecurity directly. Project Glasswing gives Claude Mythos to a small group of partners including Palo Alto Networks. Claude Security launched in public beta on April 30, 2026 to every Enterprise Claude customer. The pitch is simple: AI agents that read your codebase, find the vulnerabilities a rules-based scanner would miss, and propose fixes.

Is this an existential threat to CrowdStrike? No. Here's why.

What Anthropic is building competes with application security companies — Snyk, Veracode, Checkmarx, the appsec scanning category. It does not compete with what CrowdStrike actually does, which is endpoint, identity, cloud workload, and SIEM protection at runtime. Reading code for vulnerabilities is a development-time problem. Stopping a ransomware attack on 100,000 laptops in real-time is a runtime problem. They're related but not the same.

Is this a competitive headwind? Yes, in two ways.

First, the broader AI-native trend. Anthropic isn't the only one. There are dozens of well-funded AI-native security startups challenging the legacy stack — and unlike legacy SIEM, EDR was already an AI-native category that CrowdStrike pioneered. Falcon was built on machine learning from day one. CrowdStrike is positioned to defend, not be displaced, because it has 33 modules, $5.25 billion in ARR, single-sensor architecture, and a moat in data — every detection trains the next one.

Second, hyperscaler bundling. Microsoft Defender continues to be free-with-E5, and AWS GuardDuty/Inspector keep expanding. This pressures pricing at the low end of the market. But CrowdStrike's customer base — large enterprises that need best-in-class detection — has consistently chosen specialized over bundled. The 115% net retention rate says customers are spending more, not less, despite Microsoft being in the room.

My read: Anthropic and the AI wave are real, but they're attacking categories adjacent to CrowdStrike's core, not the core itself. The bigger competitive question is whether CrowdStrike can use AI faster than its peers can use it against them. Module adoption rates (50% of customers on 6+ modules, up from negligible four years ago) and 24% ARR growth at $5B scale say yes — for now.

Net cash add-back: $4,410M

DCF Output:

Fair Value Range (±10%): $542 – $662

Current price: $641.051 - within the fair value range.

If you reverse the DCF and solve for what FCF CAGR the current price of $617 implies, holding terminal multiple at 50x and WACC at 7.54%, the market is pricing in roughly a 26–27% sustained 5-year FCF CAGR. My estimate is 24.5%. The market is asking for slightly more growth than my base case but is not asking CrowdStrike to be heroic. Given the FY27 guidance of $5.87–$5.93 billion in revenue and 30%+ FCF margin (which implies ~$1.77 billion of FCF), the market's expectation is reasonable — but it leaves very little margin for error.

CrowdStrike is a premium asset trading at the upper end of its fair value range. Net new ARR of $331M (+47%) in Q4 was a record. ARR crossed $5 billion. Customer module adoption is accelerating. Free cash flow margin is set to expand back toward the long-term 34–38% target. And the balance sheet — $4.4 billion in net cash — gives management the optionality to either buy back stock aggressively if the price dips or fund the next platform expansion.

The margin of safety is thin, and the Anthropic / AI-native threat is real but adjacent. A meaningful pullback below ~$580 would convert this from "Buy at fair value" to "Buy at a discount." Investors who own this for the long term should add patiently; investors who don't own it should start a position now and add on weakness. Premium companies deserve premium prices, and CrowdStrike has earned it.

Disclaimer: This analysis is published by The Investing Department for educational purposes only. It is not financial advice. Always do your own research and consult a qualified financial advisor before making any investment decisions.