On July 19, 2024, a faulty CrowdStrike update knocked an estimated 8.5 million Windows computers offline, Microsoft estimated. Flights were grounded. Hospital systems were disrupted. Checkout terminals froze. It was not a cyberattack. It was a self-inflicted software failure, and one of the largest IT outages in history.
Nearly two years later, CrowdStrike is not talking like a company still trapped by that failure.
On Wednesday, CrowdStrike reported fiscal first-quarter revenue of $1.39 billion, up 26% from a year earlier. Net new annual recurring revenue, the fresh subscription business signed in the quarter, hit a first-quarter record of $256 million, up 32%. Total recurring revenue reached $5.51 billion. Free cash flow hit a record $468 million. CrowdStrike raised its full-year growth forecast and announced a 4-for-1 stock split – the corporate equivalent of a victory lap.
[See Related: Microsoft Build 2026: Top 5 Cybersecurity Takeaways]
The numbers showed a company that had largely repaired the business damage from those dark outage days. The earnings call showed something more ambitious: CrowdStrike wants investors and customers to rethink what the company is.
Founder and CEO George Kurtz called the quarter a “Mythos moment,” his shorthand for the point when frontier AI became powerful enough to change the economics of finding and exploiting software flaws.
For CrowdStrike, that is more than a threat warning. It is a business reset. For more than a decade, the company has been defined by endpoint detection and response, the software sensors that watch laptops, servers and workloads for signs of attack. Kurtz is now arguing that same footprint gives CrowdStrike a claim on the security layer for enterprise AI.
In CrowdStrike’s telling, cybersecurity is no longer just a defensive line item. It is becoming the infrastructure companies need before they can safely put AI agents to work.
For those that don’t speak fluent vendor, Mythos refers to Claude Mythos Preview. This is Anthropic’s restricted frontier model for vulnerability discovery. Anthropic said the model found a 27-year-old OpenBSD vulnerability, a 16-year-old FFmpeg bug and a Linux kernel exploit chain. The company is limiting access through Project Glasswing, a defensive program for vetted partners. CrowdStrike is one of them.
CrowdStrike has moved quickly to turn Mythos into a market narrative. Project Glasswing gave it early access. Project QuiltWorks gave it a partner coalition. Charlotte AI AgentWorks and Agentic MDR gave it product packaging. The name-dropping matters less than the overall direction CrowdStrike is headed. It is trying to define the AI-security category before customers decide what that category is.
The clearest sign of the pivot is AIDR, CrowdStrike’s name for AI detection and response, launched to customers in December. Kurtz told analysts AIDR is becoming a new growth pillar. He said ending ARR for the product grew more than 250% sequentially, with a fiscal second-quarter pipeline above $50 million.
“In my career, I have never seen adoption happen this fast,” he said. Then he went further saying AIDR could become a larger opportunity than EDR, the endpoint detection and response market that made CrowdStrike famous.
In plain English, CrowdStrike is trying to reposition itself from a company that protects endpoints to a company that protects AI where it actually operates. That means watching agents as they run, make tool calls, access files, invoke APIs and move data. The company already has sensors on endpoints. It wants customers to see that footprint not as yesterday’s endpoint estate, but as tomorrow’s AI security control plane.
The problem for CrowdStrike is that everyone else saw the same opening.
SentinelOne is pushing agentic investigations and autonomous security operations through Purple AI. Palo Alto Networks is selling Prisma AIRS as a way to secure autonomous AI agents from design to runtime. Zscaler joined Project Glasswing and is framing zero trust as protection for AI agents that access data and take action on behalf of users. Fortinet is wrapping agentic AI, managed detection and endpoint security into its broader Security Fabric architecture.
That does not make CrowdStrike’s pitch wrong. CrowdStrike now has to show that AIDR is not just EDR with an AI label, that customers will pay for it at scale, and that its endpoint footprint gives it a real advantage over rivals racing toward the same budget.
The first-quarter numbers show CrowdStrike has largely recovered from 2024. The AI push shows where it wants the next wave of growth to come from.
This earnings season made one thing clear: cybersecurity vendors are no longer just warning that AI will help attackers. They are telling boards that AI adoption depends on them.
Now customers have to decide which of those claims are security architecture, and which are just the latest coat of AI paint.
