Today's show is sponsored by Betterment Advisor Solutions. It's the platform built for segmenting your book and streamlining smaller accounts. The onboarding is automated and paperless, portfolio management is tax efficient, and the client experience is consistent and modern. Betterment Advisor Solutions. Learn more at betterment.com/advisors.
All right, I believe we're live. Investors think about software companies in terms of TAM, and when it comes to cybersecurity in the age of AI, it's impossible not to get excited. My guest today is George Kurtz, president, CEO, and co-founder of CrowdStrike. They're announcing a major acquisition today. Full disclosure, I am a long-term investor and shareholder. George, thank you for doing this. Welcome back to Live from the Compound. We're so happy to see you.
Great to be here, Josh. Always a pleasure.
Awesome. Just a reminder, all standard safe harbor disclaimers apply. No investment advice. I want to get into the state of cybersecurity in 2026, but can I congratulate you first on being the best performing cybersecurity stock of 2025?
You certainly can, and I appreciate it. We put a lot of hard work into it. The team did a great job. When you have the right products and give the right outcomes to customers—stopping breaches and reducing their cost—success tends to follow.
I think the market agrees that you guys are doing exactly that. CrowdStrike is up about 35% over the last 12 months, double the S&P 500, triple one of your largest competitors. Your stock price has outperformed all other publicly traded cyber plays. How does it feel to be a gangster?
You always have to look forward. You're only as good as your last quarter. We focus on building something enduring, caring about customers, and building the best technology. Part of our success has been Falcon Flex licensing, which makes it seamless for customers to buy more without another procurement cycle. Quarter over quarter, we see adoption of another module. Putting it all together has paid dividends.
I want to put up a chart we custom made. This is your quarterly ARR history. Your ARR growth has been about 62x since 2017. If you are a shareholder in any software company and the ARR growth looks like this, you've probably made a lot of money. Would you agree that's among the most important reasons for the stock's success?
Absolutely. Thanks for putting that chart up. It's a very good-looking chart, and we're pretty proud of it. We track that internally. A big part of our success has been ARR growth, consistently above the rule of 40 at the scale we're at. That's not an easy feat. ARR growth and free cash flow give you the real health of the business.
It's not an easy feat to continue along that direction, but having the right products with the right outcomes is important. ARR growth is one of the biggest factors we look at, as well as free cash flow. That gives you the real health of the business.
I'll send you that chart offline. Let's start here. If you had to quantify what's different about the threat landscape going into 2026, what's the biggest shift you're seeing and what metrics do you watch internally regarding attacker advantages or methods?
Right now it's the battle of the agentics. The adversary is taking advantage of agentic AI, and so are we. The way to quantify it is by time. Over the years, we've measured weeks, days, hours, and now minutes. The adversary can operate in about 40 minutes—down from 60 minutes and a couple hours a few years back. We quoted a stat: 51 seconds between when an adversary got onto a system and pivoted. They now use agentic AI to do the work. In the past, an adversary would have a tether to control the system. Now, with agentic AI, they can drop malware that isn't even malware—just prompts. It doesn't phone home. It reasons on the system, figures out what to do, gathers data, and works autonomously. That's the big change: autonomous malware instead of command-and-control infrastructure.
But that article they dropped into the system is now AI-enabled and can carry out whatever it's programmed to do.
It is, and it's different on each system because it's scripts around prompts. It understands what system it's on, what unique data is there, what it has access to, what identities are present. It does everything an adversary would do, but autonomously, and it evolves. That makes it very difficult to identify as agentic malware.
Every company is an AI company now. How does that change the attack surface? Are AI agents, non-human identities, and browser-based workflows the biggest new surfaces? How do you think about cybersecurity in this age?
Take a stroll back to 2022—the ChatGPT moment. Organizations were worried about protecting data. Now in 2026, companies have built their own AI agents with access to data, workflows, compute, and non-human identities. They're essentially superhumans with full access. We're in the early implementation phase of leveraging agentic AI, and it needs protection. Our acquisition of Pangia last year provides guardrails for implementing secure AI and protecting agents. Companies can't say no to AI; they want the benefits, but they have to do it securely.
You've talked about stopping breaches by correlating signals across endpoints, identities, and the cloud. In 2026, what's the most common pattern when a sophisticated intrusion succeeds? What are you telling people to reduce risk?
The simplest way to say it: adversaries don't break in, they log in. Identity is the new perimeter. For e-crime groups, they abuse identity—socially engineer a help desk, get admin credentials. They also compromise session cookies. They steal your token and replay it without logging in, getting past the front door. That's why you need newer technologies like signal and next-gen identity. The number one vector right now is logging in, not breaking in.
You made a $740 million acquisition around continuous identity. Tell us the name of the company, why you bought it, and what it brings to customers.
