CRWD

AI-native security ops platform, mid-recovery from the July 19 2024 channel-file incident that crashed 8.5M Windows hosts globally and forced a customer commitment package (CCP) of ~$60M+ in subscription credits absorbed across FY25-FY26.

Bull case:

- ARR re-acceleration: net-new ARR returned to growth Q4 FY25 after 3 quarters of CCP drag; consensus modeling clean compares from Q2 FY26

- Module density: 48% of subscribers run 6+ modules vs 32% three years ago - expansion within installed base masks new-logo softness

- Charlotte AI + Falcon Flex: usage-based licensing converts shelf-ware into in-quarter consumption; Flex deal count crossed $1B in account-value Q4 FY25

- Identity + cloud are the two fastest-growing module groups; both compete directly with $OKTA, $S, and $ZS in greenfield AI-agent security spend

- Operating margin re-expanding back toward pre-incident 22%+ as CCP rolls off

Bear case:

- $S (SentinelOne) and Microsoft $MSFT Defender taking share in mid-market - CRWD net-new logo growth still below pre-incident trend

- Delaware shareholder suit + Delta Air Lines $500M outage claim unresolved; tail legal exposure not quantified

- Stock trades ~22x forward sales after recovery - any RPO miss compresses multiple fast

- Stargate / hyperscaler AI security spend may route through cloud-provider native tooling ($MSFT, $GOOGL) rather than third-party platform

- Channel-file episode permanently raised procurement scrutiny on single-vendor security stacks