Did CrowdStrike’s Q3 Earnings Just Kill the Bear Case?

For four months, owning  CrowdStrike stock has felt like holding a ticking time bomb. Ever since the infamous July 19th outage in 2024 crashed 8.5 million Windows devices, the market has been waiting for the other shoe to drop. The bear case was simple and terrifying: “Customers are angry. They will leave. SentinelOne and Microsoft will eat their lunch.”

Image by Joachim Schnürle from Pixabay

CrowdStrike’s Q3 FY’26 results, released on Wednesday, didn’t just disprove that thesis; they nuked it from orbit.

With Net New ARR accelerating 73% to a record $265 million, CrowdStrike proved that in enterprise software, Pain is temporary, but a Platform is forever.

Let’s strip away the “Outage” noise and look at the new reality. This isn’t a damaged brand; it is a “Systemically Important Institution” trading at a discount to its own dominance.

The Narrative Flip: From “Liability” to “Essential Utility”

The market expected an apology tour. Instead, they got a victory lap.

• The Fear: Customers would flee to Microsoft Defender or SentinelOne to “diversify” risk.
• The Reality: The customer base is likely still growing. Although the company didn’t break down user numbers, the strong Net New annual recurring revenue (up 73% year-over-year) requires that revenue added from new customers and existing customer expansions outweigh any losses from churned customers.
  • The “Aha” Moment: Why didn’t they leave? Because they can’t. Replacing CrowdStrike isn’t like switching email providers; it’s like replacing the nervous system of your company. The cost of switching (downtime, integration pain) is infinitely higher than the risk of staying.
• The Signal: Not only did they stay, they bought more. 49% of subscription customers now use six or more modules (up from prior quarters). Customers aren’t diversifying away from CrowdStrike; they are consolidating onto it to save money.

The Valuation Sanity Test: The “Premium” Returns

Let’s look at the price tag compared to the neighbors.

• CrowdStrike P/S: about 22x FY’27 Sales.
• SentinelOne P/S: 5x Sales.
• Palo Alto Networks P/S: ~11x Sales.

The Distortion: CrowdStrike trades at a massive premium to its peers. Is it justified?

• The “Rule of 40” Check: CrowdStrike is a rare beast that balances hyper-growth (29% Revenue Growth last year) with massive profitability (25% Free Cash Flow Margin).
• The Comparison: SentinelOne is growing fast but is still burning cash (negative operating margins). Palo Alto is profitable but growing slower. CrowdStrike is the only one giving you Growth + Cash Flow at scale.
• The Verdict: You are paying a “Ferrari” price, but the engine just proved it can survive a crash test and still win the race.

The New Moat: “Falcon Flex” is the Trap

This is the most underrated part of the earnings report. The outage forced CrowdStrike to get creative, and they accidentally built a better mousetrap: Falcon Flex.

• The Product: Instead of buying separate modules (Endpoint, Identity, Cloud), customers sign a massive “Flex” contract and use whatever they want, whenever they want.
• The Trap: It lowers the friction to try new tools.
  • The Data: Flex customers use ~9 modules on average (vs. non-Flex customers).
  • The Result: Once a customer starts using CrowdStrike for Identity and Cloud, they are mathematically locked in. This effectively kills the “Point Solution” competitors (like Okta or Wiz) inside those accounts.

The Competitive Landscape: The “Microsoft” Myth

The biggest bear argument was that Microsoft would win because “Defender is free/good enough.”

• The Reality Check: The outage ironically highlighted Microsoft’s vulnerability. The fact that a single update could brick 8.5 million Windows machines reminded CIOs that Microsoft is the single point of failure, not CrowdStrike.
• The Win: Management highlighted record wins in Next-Gen SIEM (Security Information and Event Management), effectively replacing legacy tools like Splunk. They aren’t just defending endpoints anymore; they are becoming the Data Lake for the entire security operation.

What Can Stop Them Now?

The “Outage Risk” is now a known. What is the new risk?

• Legal Liability: The lawsuits from the outage (Delta Air Lines, etc.) are still pending. While likely manageable, a massive billion-dollar settlement could hurt cash reserves.
• Valuation Compression: At 22x Sales, the stock is priced for perfection again. If growth decelerates, the multiple will contract painfully.

Our Take

CrowdStrike has officially exited the “Penalty Box.” The Q3 earnings report proved that the company has Pricing Power (Net New ARR up 73%) that rivals Apple or Microsoft.

• Bull Case: Falcon Flex becomes the standard, driving module adoption to 15+, and CrowdStrike becomes the “Salesforce of Security.”
• Bear Case: Legal battles drag on, and the premium valuation leaves no room for error if the macroeconomy slows.

The Prediction: The “Redemption Trade” is real. The outage was a stress test, and CrowdStrike passed. 

A Multi-Asset Portfolio Beats Picking Stocks Alone.  Individual picks are volatile, but diversified assets offset each other. A multi-asset portfolio helps you stay the course, capture upside, and reduce downside. The asset allocation framework of Trefis’ Boston-based, wealth management partner yielded positive returns during the 2008-09 period when the S&P lost more than 40%. Our partner’s strategy now includes the Trefis High Quality Portfolio, which has a track record of comfortably outperforming its benchmark that includes all three – the S&P 500, S&P mid-cap, and Russell 2000 indices.

Invest with Trefis Market Beating Portfolios

See all Trefis Price Estimates