{
  "@context": "https://orbyd.app/schemas/dossier.v1.json",
  "ticker": "CRWD",
  "name": "CrowdStrike Holdings, Inc.",
  "url": "https://orbyd.app/dossiers/CRWD/",
  "json_url": "https://orbyd.app/dossiers/CRWD.json",
  "status": "DORMANT",
  "current_conviction": "MEDIUM",
  "graded_conviction": null,
  "archetype": {
    "code": "a1",
    "n": 1
  },
  "current_thesis": "Agentic-AI security is now CRWD's own narrative, not a borrowed sector bid: the 2026-08-04 Threat Hunting Report and a second sell-side reset (BofA $230, Loop initiation $230) carried price to a record $214.42 close on 2026-08-07. Buying here is above the $206.01 consensus average target, into a ~2026-09-02 Q2 print landing inside sold-out Fal.Con week.",
  "invalidation_trigger": "A weekly close below $190 surrenders the August breakout leg and returns price beneath the $206.01 consensus average target; secondary, the ~2026-09-02 Q2 FY2027 print passing with net-new ARR decelerating or FY2027 guidance merely reiterated.",
  "catalyst_date": "2026-09-02",
  "outcome": "OPEN",
  "outcome_date": null,
  "invalidation_fired": null,
  "themes": [
    "cybersecurity",
    "ai-datacenter-infrastructure"
  ],
  "tags": [],
  "sources": [],
  "notes": [
    "4-for-1 split began trading 2026-07-02 — divide any pre-July quote or price target by four before comparing with current levels.",
    "Fiscal year ends January 31, so \"FY2027\" is the year ending 2027-01-31; Q2 FY2027 covers the quarter ended July 2026.",
    "Cyber exposure double-counts easily: CRWD, PANW, ZS, S and OKTA respond to the same theme headlines and often on the same session.",
    "The July 2024 sensor-push outage remains the reference event for platform-risk headlines; the Delta probe closed 2026-06-16 with CrowdStrike cleared.",
    "Fal.Con 2026 (2026-08-31 to 2026-09-03) and the expected Q2 print fall in the same week, so company and conference news overlap."
  ],
  "body_markdown": "\neven# CRWD — CrowdStrike Holdings, Inc.\n\n## Current Thesis\nThe July read published here — did not survive August. CrowdStrike closed 2026-08-07 at $214.42, a 52-week high with zero distance to it, after a 62.5% three-month advance; the $138 weekly-close break named in the prior note was never approached. What changed is that the AI-security narrative acquired its own event stream instead of borrowing the sector's: the 2026-08-04 Threat Hunting Report reframed AI as attack surface, weapon and defence simultaneously, Fal.Con 2026 sold out at a record pace, and the sell-side reset targets a second time in late July (BofA to $230 from $187.50 on 2026-07-27, Morgan Stanley to $227 from $172, Loop Capital initiating Buy at $230 on 2026-07-28). The narrative leg an investor is buying now is *agentic AI creates new, budget-bearing attack surface, and CrowdStrike's Falcon platform is where enterprises consolidate it*. The cost of that leg is that it is being bought at a record close, above the aggregate 12-month analyst average of $206.01, into a Q2 FY2027 print expected ~2026-09-02 that lands inside Fal.Con week.\n\n## Bull Case\n- 2026-08-04 Threat Hunting Report gave the AI-security thesis quantified content: AI-enabled adversary activity up 89% during 2025; 88% of attacks exploiting vulnerabilities with public proof-of-concept code began within 48 hours of PoC release from January through June 2026; China-nexus adversaries inside 24 hours.\n- The same report supplies a direct volume-of-work argument for the platform: AI-agent-triggered detection leads grew at 2.5x the rate of human-triggered leads, and 87% of identified software-registry threats in 1H 2026 involved malicious npm packages, including STARDUST CHOLLIMA's injection into 131 Mastra AI framework instances.\n- Sell-side repriced upward again after the July fade: BofA $230 from $187.50 (2026-07-27), Loop Capital initiation at Buy/$230 (2026-07-28), Argus $230 from $200, Morgan Stanley $227 from $172 — the last of these is the same house that sat at the low end of the post-split cluster on 2026-07-07.\n- Q1 FY2027 on 2026-06-03 was a beat-and-raise: adjusted EPS $1.10 vs $1.07 consensus, revenue $1.386B vs $1.363B, FY2027 adjusted-EPS guide lifted to $4.88–$4.96.\n- Demand-side third-party framing turned louder: Dan Ives said on 2026-07-30 that cybersecurity spending could double within three years; cyber names including CRWD and PANW were bid on 2026-08-02 on AI-agent hack fears, and the $130M Coldcard hack on 2026-08-05 pulled cyber ETFs into retail view.\n- Fal.Con 2026 (2026-08-31 to 2026-09-03, Mandalay Bay) sold out at a record pace with more than 10,000 attendees and 4,000 organisations from 71 countries — a demand datapoint that is checkable rather than surveyed.\n- The 2026-06-16 closure of the Delta outage probe, with CrowdStrike cleared, removed the largest single legal overhang from the July 2024 sensor-push failure.\n\n## Bear Case\n- Price sits above where the sell-side average sits: the aggregate 12-month target of $206.01 is below the 2026-08-07 close of $214.42. The $230–$235 cluster is the bull tail, not the centre of gravity.\n- The company's own Q2 bar is narrow: guidance of adjusted EPS $1.16–$1.17 against $1.16 consensus and revenue $1.436B–$1.442B against $1.434B, issued 2026-06-03. On a name that has run 62.5% in three months, an in-line print is a de-rating risk.\n- The 2026-06-03 beat-and-raise produced a sell-the-news reaction. That precedent is 90 days old and unrepaired as a pattern — the print reaction, not the print, is the variable.\n- Part of the August bid is incident-driven: the 2026-08-02 move was a sector jump on AI-agent hack fears shared with PANW, and the 2026-08-05 Coldcard headline was written as an ETF story. Event-driven bids decay when the next incident does not arrive.\n- Retail-facing coverage is clustering: Benzinga's \"Why Is CrowdStrike Stock Surging on Tuesday?\" (2026-08-04), a five-year-returns backtest piece (2026-08-06), and a whale-alert screen listing (2026-07-28) inside a ten-day window.\n- The 4-for-1 split that began trading 2026-07-02 changes no cash flow; it widened accessibility into exactly the window where headlines are densest.\n\n## Setup & Price Structure\nAll levels are split-adjusted (4-for-1 effective 2026-07-02); multiply by four to compare with pre-July quotes.\n\n- Last completed daily close 2026-08-07: $214.42, which is also the 52-week high — 0.0% distance, the tightest possible reading.\n- RSI(14) at 62.2 into a record close. MEASURED: momentum is not at an extreme. INFERRED: an advance that makes new highs without pushing RSI above 70 has been stair-stepping rather than going vertical, which is a different structure from the June sell-the-news spike.\n- Three-month return +62.5%. The move that carried price through the July range is recent and steep, so the base beneath it is young and untested.\n- TradingKey logged +3.34% on 2026-08-04 and +3.52% on 2026-08-07 — two 3%-plus sessions inside four trading days, i.e. daily ranges expanding into the high rather than contracting.\n- Crowding observables, stated as observables: price above the $206.01 consensus average target; a print expected ~2026-09-02, 25 days from the price basis; retail-framed coverage clustering 2026-07-28 through 2026-08-06; a sold-out user conference opening 2026-08-31. The filings feed carries no insider transactions for this window, so no Form 4 read is available either way.\n- The prior note's $138 weekly-close condition is now far below market and no longer describes the structure at risk. The live question is whether the August leg holds; a weekly close below $190 would give that leg back and put price beneath the consensus average target.\n\n## Catalyst Calendar (next 30 days)\n- **2026-08-30** — Day Zero 2026 Threat Research Summit opens (runs to 2026-09-01), ahead of the main conference.\n- **2026-08-31** — Fal.Con 2026 opens at Mandalay Bay, Las Vegas (through 2026-09-03). Historically the venue for product and platform announcements; sold out at record pace per the company.\n- **~2026-09-02 (est.)** — Q2 FY2027 results. Company guidance issued 2026-06-03 is adjusted EPS $1.16–$1.17 and revenue $1.436B–$1.442B. Net-new ARR and the FY2027 raise are what the print resolves. Date is the widely reported expectation; company confirmation is the item to verify.\n\n## What Would Change Our Mind\nTwo things break this. The first is the August leg failing to hold — the advance from the late-July target reset to the 2026-08-07 record close is the entire structure being bought, and a weekly close below $190 surrenders it and returns price beneath the $206.01 consensus average target. The second is the ~2026-09-02 print arriving with net-new ARR decelerating or an FY2027 guide merely reiterated rather than raised: that would repeat the 2026-06-03 sell-the-news reaction from a materially higher base and with the sell-side already at $227–$235 on the high side.\n\nA softer flip: if the Fal.Con window (2026-08-31 to 2026-09-03) and the print both pass without price making a new high, the narrative moves from ACCELERATING to SATURATED — the events came and went, everyone who was going to hear the AI-agent-security story has heard it, and the marginal buyer is paying above the average target for continuation.\n\n**Life-cycle read: ACCELERATING.** What dates it: fresh coverage initiation on 2026-07-28 (Loop Capital, Buy/$230), a second wave of target resets 2026-07-27 through early August, a self-generated news event on 2026-08-04 (Threat Hunting Report) that moved the stock 3.34% that session, and a record close on 2026-08-07. What argues against the label and would flip it: the retail-framed coverage cluster of 2026-08-04 to 2026-08-06 and price trading above the $206.01 average target are late-cycle markers, not early ones.\n\n## Correlation Notes\n- Cyber software is one exposure, not four: CRWD, PANW, ZS and S move together on theme headlines — the 2026-08-02 AI-agent hack story named CrowdStrike and Palo Alto in the same breath. OKTA/identity adds a correlated second vector as CrowdStrike extends into non-human identity.\n- ETF flow is a live transmission channel: the 2026-08-05 $130M Coldcard hack was covered as a cybersecurity-ETF story, so basket buying can lift CRWD without any company-specific input.\n- CRWD remains a long-duration, premium-multiple software name; a rate or risk-off impulse compresses the whole cohort regardless of net-new ARR.\n- Fal.Con week (2026-08-31 to 2026-09-03) plus the expected ~2026-09-02 print compress company news and sector conference news into the same five sessions, so single-day moves in that window will be difficult to attribute cleanly.",
  "first_seen": "2026-05-15",
  "last_analyzed": "2026-08-08T14:49:49+00:00",
  "last_synthesized": "2026-08-08",
  "last_update_source": "watchlist_research",
  "license": "Content © orbyd. Cite the canonical URL."
}