CrowdStrike Holdings, Inc. stock

AI-native security ops platform, mid-recovery from the July 19 2024 channel-file incident that crashed 8.5M Windows hosts globally and forced a customer commitment package (CCP) of ~$60M+ in subscription credits absorbed across FY25-FY26.

Bull case:

• ARR re-acceleration: net-new ARR returned to growth Q4 FY25 after 3 quarters of CCP drag; consensus modeling clean compares from Q2 FY26
• Module density: 48% of subscribers run 6+ modules vs 32% three years ago - expansion within installed base masks new-logo softness
• Charlotte AI + Falcon Flex: usage-based licensing converts shelf-ware into in-quarter consumption; Flex deal count crossed $1B in account-value Q4 FY25
• Identity + cloud are the two fastest-growing module groups; both compete directly with $OKTA, $S, and $ZS in greenfield AI-agent security spend
• Operating margin re-expanding back toward pre-incident 22%+ as CCP rolls off

Bear case:

• $S (SentinelOne) and Microsoft $MSFT Defender taking share in mid-market - CRWD net-new logo growth still below pre-incident trend
• Delaware shareholder suit + Delta Air Lines $500M outage claim unresolved; tail legal exposure not quantified
• Stock trades ~22x forward sales after recovery - any RPO miss compresses multiple fast
• Stargate / hyperscaler AI security spend may route through cloud-provider native tooling ($MSFT, $GOOGL) rather than third-party platform
• Channel-file episode permanently raised procurement scrutiny on single-vendor security stacks