CRWD · CrowdStrike Holdings, Inc. · Stock research

even# CRWD — CrowdStrike Holdings, Inc.

Current Thesis

The July read published here — did not survive August. CrowdStrike closed 2026-08-07 at $214.42, a 52-week high with zero distance to it, after a 62.5% three-month advance; the $138 weekly-close break named in the prior note was never approached. What changed is that the AI-security narrative acquired its own event stream instead of borrowing the sector's: the 2026-08-04 Threat Hunting Report reframed AI as attack surface, weapon and defence simultaneously, Fal.Con 2026 sold out at a record pace, and the sell-side reset targets a second time in late July (BofA to $230 from $187.50 on 2026-07-27, Morgan Stanley to $227 from $172, Loop Capital initiating Buy at $230 on 2026-07-28). The narrative leg an investor is buying now is agentic AI creates new, budget-bearing attack surface, and CrowdStrike's Falcon platform is where enterprises consolidate it. The cost of that leg is that it is being bought at a record close, above the aggregate 12-month analyst average of $206.01, into a Q2 FY2027 print expected ~2026-09-02 that lands inside Fal.Con week.

Bullish and bearish views on CrowdStrike Holdings, Inc.

The model's bull view on CrowdStrike Holdings, Inc. (CRWD), in brief: 2026-08-04 Threat Hunting Report gave the AI-security thesis quantified content: AI-enabled adversary activity up 89% during 2025; 88% of attacks exploiting vulnerabilities with public proof-of-concept code began within 48 hours of PoC release from January through June 2026… The bear view: Price sits above where the sell-side average sits: the aggregate 12-month target of $206.01 is below the 2026-08-07 close of $214.42. Both cases follow in full.

Bull Case

• 2026-08-04 Threat Hunting Report gave the AI-security thesis quantified content: AI-enabled adversary activity up 89% during 2025; 88% of attacks exploiting vulnerabilities with public proof-of-concept code began within 48 hours of PoC release from January through June 2026; China-nexus adversaries inside 24 hours.
• The same report supplies a direct volume-of-work argument for the platform: AI-agent-triggered detection leads grew at 2.5x the rate of human-triggered leads, and 87% of identified software-registry threats in 1H 2026 involved malicious npm packages, including STARDUST CHOLLIMA's injection into 131 Mastra AI framework instances.
• Sell-side repriced upward again after the July fade: BofA $230 from $187.50 (2026-07-27), Loop Capital initiation at Buy/$230 (2026-07-28), Argus $230 from $200, Morgan Stanley $227 from $172 — the last of these is the same house that sat at the low end of the post-split cluster on 2026-07-07.
• Q1 FY2027 on 2026-06-03 was a beat-and-raise: adjusted EPS $1.10 vs $1.07 consensus, revenue $1.386B vs $1.363B, FY2027 adjusted-EPS guide lifted to $4.88–$4.96.
• Demand-side third-party framing turned louder: Dan Ives said on 2026-07-30 that cybersecurity spending could double within three years; cyber names including CRWD and PANW were bid on 2026-08-02 on AI-agent hack fears, and the $130M Coldcard hack on 2026-08-05 pulled cyber ETFs into retail view.
• Fal.Con 2026 (2026-08-31 to 2026-09-03, Mandalay Bay) sold out at a record pace with more than 10,000 attendees and 4,000 organisations from 71 countries — a demand datapoint that is checkable rather than surveyed.
• The 2026-06-16 closure of the Delta outage probe, with CrowdStrike cleared, removed the largest single legal overhang from the July 2024 sensor-push failure.

Bear Case

• Price sits above where the sell-side average sits: the aggregate 12-month target of $206.01 is below the 2026-08-07 close of $214.42. The $230–$235 cluster is the bull tail, not the centre of gravity.
• The company's own Q2 bar is narrow: guidance of adjusted EPS $1.16–$1.17 against $1.16 consensus and revenue $1.436B–$1.442B against $1.434B, issued 2026-06-03. On a name that has run 62.5% in three months, an in-line print is a de-rating risk.
• The 2026-06-03 beat-and-raise produced a sell-the-news reaction. That precedent is 90 days old and unrepaired as a pattern — the print reaction, not the print, is the variable.
• Part of the August bid is incident-driven: the 2026-08-02 move was a sector jump on AI-agent hack fears shared with PANW, and the 2026-08-05 Coldcard headline was written as an ETF story. Event-driven bids decay when the next incident does not arrive.
• Retail-facing coverage is clustering: Benzinga's "Why Is CrowdStrike Stock Surging on Tuesday?" (2026-08-04), a five-year-returns backtest piece (2026-08-06), and a whale-alert screen listing (2026-07-28) inside a ten-day window.
• The 4-for-1 split that began trading 2026-07-02 changes no cash flow; it widened accessibility into exactly the window where headlines are densest.

Setup & Price Structure

All levels are split-adjusted (4-for-1 effective 2026-07-02); multiply by four to compare with pre-July quotes.

• Last completed daily close 2026-08-07: $214.42, which is also the 52-week high — 0.0% distance, the tightest possible reading.
• RSI(14) at 62.2 into a record close. MEASURED: momentum is not at an extreme. INFERRED: an advance that makes new highs without pushing RSI above 70 has been stair-stepping rather than going vertical, which is a different structure from the June sell-the-news spike.
• Three-month return +62.5%. The move that carried price through the July range is recent and steep, so the base beneath it is young and untested.
• TradingKey logged +3.34% on 2026-08-04 and +3.52% on 2026-08-07 — two 3%-plus sessions inside four trading days, i.e. daily ranges expanding into the high rather than contracting.
• Crowding observables, stated as observables: price above the $206.01 consensus average target; a print expected ~2026-09-02, 25 days from the price basis; retail-framed coverage clustering 2026-07-28 through 2026-08-06; a sold-out user conference opening 2026-08-31. The filings feed carries no insider transactions for this window, so no Form 4 read is available either way.
• The prior note's $138 weekly-close condition is now far below market and no longer describes the structure at risk. The live question is whether the August leg holds; a weekly close below $190 would give that leg back and put price beneath the consensus average target.

Catalyst Calendar (next 30 days)

• 2026-08-30 — Day Zero 2026 Threat Research Summit opens (runs to 2026-09-01), ahead of the main conference.
• 2026-08-31 — Fal.Con 2026 opens at Mandalay Bay, Las Vegas (through 2026-09-03). Historically the venue for product and platform announcements; sold out at record pace per the company.
• ~2026-09-02 (est.) — Q2 FY2027 results. Company guidance issued 2026-06-03 is adjusted EPS $1.16–$1.17 and revenue $1.436B–$1.442B. Net-new ARR and the FY2027 raise are what the print resolves. Date is the widely reported expectation; company confirmation is the item to verify.

What Would Change Our Mind

Two things break this. The first is the August leg failing to hold — the advance from the late-July target reset to the 2026-08-07 record close is the entire structure being bought, and a weekly close below $190 surrenders it and returns price beneath the $206.01 consensus average target. The second is the ~2026-09-02 print arriving with net-new ARR decelerating or an FY2027 guide merely reiterated rather than raised: that would repeat the 2026-06-03 sell-the-news reaction from a materially higher base and with the sell-side already at $227–$235 on the high side.

A softer flip: if the Fal.Con window (2026-08-31 to 2026-09-03) and the print both pass without price making a new high, the narrative moves from ACCELERATING to SATURATED — the events came and went, everyone who was going to hear the AI-agent-security story has heard it, and the marginal buyer is paying above the average target for continuation.

Life-cycle read: ACCELERATING. What dates it: fresh coverage initiation on 2026-07-28 (Loop Capital, Buy/$230), a second wave of target resets 2026-07-27 through early August, a self-generated news event on 2026-08-04 (Threat Hunting Report) that moved the stock 3.34% that session, and a record close on 2026-08-07. What argues against the label and would flip it: the retail-framed coverage cluster of 2026-08-04 to 2026-08-06 and price trading above the $206.01 average target are late-cycle markers, not early ones.

Correlation Notes

• Cyber software is one exposure, not four: CRWD, PANW, ZS and S move together on theme headlines — the 2026-08-02 AI-agent hack story named CrowdStrike and Palo Alto in the same breath. OKTA/identity adds a correlated second vector as CrowdStrike extends into non-human identity.
• ETF flow is a live transmission channel: the 2026-08-05 $130M Coldcard hack was covered as a cybersecurity-ETF story, so basket buying can lift CRWD without any company-specific input.
• CRWD remains a long-duration, premium-multiple software name; a rate or risk-off impulse compresses the whole cohort regardless of net-new ARR.
• Fal.Con week (2026-08-31 to 2026-09-03) plus the expected ~2026-09-02 print compress company news and sector conference news into the same five sessions, so single-day moves in that window will be difficult to attribute cleanly.