Good morning, everyone, and welcome back to the CUBE's live coverage of Fal.Con 2026, of course, the CrowdStrike show. I'm your host, Rebecca Knight, alongside Dave Vellante, the co-founder of CUBE Research. We are so excited to welcome back to the show George Kurtz, the founder and CEO of CrowdStrike.
Yeah. No, we're delighted to have you. So I want to start with your opening yesterday on the keynote. You opened with the Hugging Face incident, and you said that almost everyone in the industry drew the wrong conclusion about what happened because the agents weren't attacking, they were cheating on a test. Walk our viewers through that distinction and why it matters so much.
Well, I think there's a couple of points to that. Number one, yes, they were cheating on a test and they did break out. And I think part of my pitch was really the fact that the industry got lucky that they were just cheating on a test. But I think the real view—and I think this is where people were maybe looking at it and saying, "Okay, this is incredible"—we had agents that were able to take an attack end-to-end. We had the ability to create these message boards and attack systems and all the things that you probably read about, and that's all true. But the piece that they missed and where I really think they drew the wrong conclusion was the defenders didn't have the same AI as the offense. And this was the missing element, which obviously is part of our announcements of what we came out with, because you can look at this attack and it was a watershed moment for how it operated and what it did. One, the industry got lucky, but two, it really highlighted the fact that advanced AI, frontier-capable AI, wasn't in the hands of the defenders. And that's the key, and that was really the basis for what I tried to bring home at the conclusion of the presentation.
Well, it's great to have you back, George. Thanks for spending some time with us. I've got to say, I think your guns are actually bigger than Jensen's, you know, Jensen—
He told me that when I was in his office.
So I thought you were going to have to sick like Warlock Spider on him or something to, you know, get him in a headlock.
Next time we'll do a gun-off.
So yeah, I love it. So you had Jensen, LBT, and Greg Brockman up on stage, which was quite a statement. So congratulations on getting those guys live. I mean, a lot of times Jensen will, you know, Zoom in.
So you got accelerated computing, you got CPUs, and you had models, and of course cybersecurity was obviously the theme. And I want to understand what the message is in assembling those pieces. Cybersecurity has traditionally been a layer in the stack. Is it increasingly becoming—is Falcon a control plane now for the AI stack and for the AI economy? How do you look at it?
I really do think it's a control plane because when you look at where AI takes place, first you need GPUs to create AI. Hence Jensen's here. We had a great discussion. But once you create AI, then you have to consume it. You have to interact with it. You have the whole inference model, right? And this inference and the consumption really is taking place—I talked about the endpoints, obviously could be in a cloud container workload. We cover both of those.
But that is something that, again, we've built from the ground up, and we're known probably as the largest pure-play endpoint vendor in the entire world in terms of the number of security agents that we have out there. So our ability to actually create a control plane around how agents operate: First of all, where are the agents? Because you can't even find them. Number two is: What are they doing? Are they touching data they shouldn't be touching? Are they connecting to systems they shouldn't be connecting to? And what are their identities? So with our Signal AI acquisition, you'll hear more about that, some of the cool things that we're doing with it. We can create the control plane both at runtime and also in the identity layer to be able to identify, control, and protect those agents and make sure they don't do bad things.
The timing of Signal is just actually amazing. I mean, again, good to be talented and lucky sometimes. But does that position that you're taking mean that you have to be neutral across, you know, the ecosystem silicon, models? Or you've got deep integration with Nemotron, and doesn't that create, you know, preferred partners? How do you think about that?
Well, I think you have to look at who the biggest players are in ecosystems and we tend to work with them, right? Whether it's Nvidia, or Intel, or AMD. You look at the models, the Frontier Labs, we work with both of those. So I think you have to look at where AI is being created, how it's being consumed. Of course, the hyperscalers—you look at AWS, one of our biggest customers, one of our design partners for things like GuardDuty, which we'll talk about.
But you have to realize that it's about the ecosystem, which is why we're here. It's a massive event. Right now it's quiet because we got in before everything started. It'll be buzzing here right after the keynotes. And without the ecosystem—and this is one of the things that I really learned in security a long time ago—is you cannot be successful without a true ecosystem. And that's why we had all of our partners come in. That's why we have this event here, which I think is becoming an industry standard. And we'll continue to expand that out and work with partners as they continue to thrive in the AI economy.
Well, DB is doing a great job. I call him the ecosystem alpha, and he's delivered on that promise.
On the earnings call, you called the Mythos moment—you talked about how it accelerated your business. I had a little kind of more tongue-in-cheek response. I wrote that Mythos turned chaos into cash, which it did at $333 million in new ARR. But I don't want to attribute all of that ARR growth and new logos to just Mythos. So what specifically changed in the buying process? Did boards release new budget? Did they pull projects forward? What specifically changed that you noticed?
Well, I think when you look at the Mythos moment, you have the fact that people obviously want to understand where their vulnerabilities are. They want to protect against advanced AI attacks. Great. But what it really did is it raised the level of visibility and security to the highest level I've ever seen. Certainly boards have to deal with this; it's compliance mandates. But when every board member is asking for a briefing—I was in briefings with boards left, right, and center. We were all over the place talking to board CEOs. CEOs are calling me all hours of the night, top CEOs in the world going, "Hey, what does this mean? What can we do about it?" Right?
So I think that level of visibility I've never seen, and then that transcended into, "Okay, well, what are all the things we have to do? We have to modernize our stack because it's not about just finding the vulnerabilities and trying to patch them." It's thinking about the complete life cycle from, okay, how do we deploy software? How do we understand the vulnerabilities? How do we fix them? How do we prioritize? Right? It's all about now exploitability because you hit the sound barrier on patching. You find all these vulnerabilities, you create a patch for them, but you can't patch fast enough.
So people are looking at new models to be able to roll these things out immediately and then roll things back. And I mean, it's a whole new world. Obviously, if you're a cloud-first company, it's a lot easier because you have more like templates. But when you have these older companies that are established, you can't just say, "I'm going to patch everything all at once." So that visibility drove performance. Next-gen SIEM agents create more digital exhaust, drove more business in identity, drove more business obviously in AID, but it was across the entire platform. And it was because of the visibility that Mythos provided.
How did those conversations go, those middle-of-the-night conversations with board members who might not have the same technical expertise that you have, but are understandably nervous about this new threat landscape?
It's a very good question, and I spent a lot of time trying to explain that Mythos didn't come up with a new way to break into something. And what I mean by that is like a technique that's never, ever been seen before. It isn't a mythical sort of cyber weapon that you see in the movie that all of a sudden came up with something new. What it did is it found more vulnerabilities and it compressed the timeline. So you're finding more vulnerabilities, you're compressing the timeline and being able to do that. And its big sort of focus was being able to chain all these low-risk vulnerabilities together to be able to compromise a system.
And I always use the analogy, human kind of remembers seven things, and an agent is just unlimited, right? So it can keep track of all these unlimited things where, if you looked at something that was in front of you, you can probably remember a few items and you know how to put them together. It has an unlimited amount of what it can put together. So all these small little things that are on the periphery that are minor—they may seem minor, but when you chain them all together, they're additive, and then you have the ability to compromise a system. So my point is I spent more time saying the world is not going to end, there are solutions for it, and it didn't come up with a new way to attack something that's never been seen before. We actually instrument for this. It's just more of it and faster.
And that's the right posture. Your narrative—and Sam has been very open about it, he's called it an accident. You guys actually participated, I think, in the postmortem. I think you left it at that.
I want to introduce some buyer data. We have a data partner called Qualtrics, a new company, and they've automated—they've got basically an AI expert network that goes out and does these surveys. They shared with me 1,250 CrowdStrike customers that they've interviewed. These are half-hour, 45-minute interviews. Of those 1,250, only three mentioned Flex by name, which I found fascinating.
The way they communicated about their relationship with you was, you know, one agent—they use the term agent, I know you use the term sensor—simplification, fewer tools, faster onboarding, better economics. And I wrote, "Wall Street hears Flex, but the customers are buying value." And I presume that's exactly how Flex is supposed to work. You guys mentioned Flex about 50 times on the earnings call. Do you communicate Flex differently to customers than you do to Wall Street, or do you use the same language? I mean, Wall Street you talk ARR uplift. What's the customer metric, and how do you communicate to customers about that value?
Well, it's an interesting point. And I don't know all the survey data, but certainly the larger enterprises are going to be the biggest Flex customers. Now, we go all the way down, and we moved to a Flex-first model this year, meaning that as a sales rep, if you weren't quoting something on Flex, you'd have to get approval for it for whatever reason, right? Sometimes in government you can't use it, procurement or whatever.
But long story short on that is we always talk about the value: How do we come in? You've got too much stuff. Everyone has one of everything and two of everything else. They tell me this: "George, we got one of this and two of everything else. We've got to get rid of it. We're spending too much money. How do we consolidate with you? And we're happy to give you more spend, but we've got to get rid of a whole bunch of tools, right? One in, two out." And that's the focus.
And the way we wrap that up, of course, is in Flex. So the procurement people certainly know Flex. And I think when you get down to some of the operators, again, what they know is they now have the ability to use any of the tools that are available on the platform, and they just need to pull it down, and then it burns down on their commitment. So they look at the outcome of it and the ease of it. And maybe they forget the name of it, but they're signing up in droves. We did 935 new Flex deals last quarter, which is an absolute record because we moved into a Flex-first selling motion.
Well, it's interesting. So procurement does see it as a contracting vehicle, but the operators see it as a value vehicle. And that's interesting what you're saying. I've got to go back to Qualtrics and sort the data on large customers and small customers and see what this—
I mean, if you look at the numbers just in terms of dollar volume, it's almost $2.3 billion of Flex that we have in our customer base.
So you can see where it's skewed into these large enterprises that want to buy more and consume more and get the best discounts. But it's certainly available to all the smaller companies as well.
And we observed in the data your go-to-market emphasis earlier this year on new logos was again timing—
What's interesting—and you may not know this, or maybe you do, you're well-read—is that Flex is the term that we created. Now everyone copies that term, right? Which is now—I always say my example is that you don't ask somebody for a facial tissue, you say, "Give me a Kleenex," right? And now everything's a Flex.
Consider the compliment.
And I'm going to ask you a little later on about why it's hard to copy-paste that. But I wanted to give you another Qualtrics data point, which was amazing. Of those 1,250, 217 they were querying about intentions. Not one, not a single one indicated an intention to churn, which is unprecedented. I mean, you usually find one or two.
There was one happy customer that called it—he said it was an OEM tax, but again, he said, "We love these guys." So he said, "You have to do your due diligence." Yeah. And so I want you to explain the platform economics and how it continues to benefit customers because you don't want to, rather than increasing your pricing power, you don't want to repeat the cloud bill narrative, right? You're in a new era now. So I wonder if you could address that.
Well, what we always try to do is to certainly sit down, as I mentioned, and talk about value. What can we take out? And there's two pieces: the cost of the software and then operationalizing it. And we always get into a debate of, okay, well, so-and-so might be cheaper. Okay, but how many people does it take to actually operate the thing? Well, it's an army of people because you've got six consoles and it's all disjointed. Okay, well, what are the outcomes you're going to get? Like, are you going to have a problem or not have a problem? And even things like Falcon Complete, which is our MDR service, how many people would you actually have to hire to replicate what we can do 24/7 with the expertise that we have and the service level agreements we have?
So we kind of go through all that and then present that as some real value that will accrue back to the customer. But I think where you're going in terms of pricing, it's a new world. You have to think about how customers want to buy things and where they have pain. Where they have pain right now is sort of an unlimited token budget—not unlimited budget, but unlimited spend that they see in front of them with a limited budget, and they want visibility.
So part of what we try to do with Flex is we give them visibility into their spend. And then even with some of the newer products like AID that are more token-based, there is an element that is a certain set number of tokens so you can cover your entire enterprise. There's inputs to that, but then if you need more, you certainly can add more token packs from Falcon Flex. So what we try to do is create a bit of a hybrid where people don't have this sticker shock or these ups and downs. The biggest thing, particularly if you're a public company, is you don't like the variability. You'll pay a little extra, but you just don't want to be shocked by the ups and downs. And that's what we try to do with our customers.
Well, the other piece of the Qualtrics data is there's clear indications that customers are seeing CrowdStrike as increasingly economically attractive, which is maybe different than it was a few years ago. Michael Sentonas said that was maybe competitive FUD, but I'll leave it at that. In Breaking Analysis last week, my weekly column, I stole your line. I said, "You can't vibe code Falcon."
