Morgan Stanley is betting that CrowdStrike's growth engine still has plenty of fuel. In a new research note, the investment bank said it expects the cybersecurity firm to report fiscal third-quarter net new annual recurring revenue (ARR) of $400-405 million, a figure that would top current Wall Street expectations. The bank also projects revenue of $1.56-1.57 billion for the quarter, above the roughly $1.53 billion analysts have been modeling.
The optimism hinges on a trend that has been reshaping the cybersecurity market: platform consolidation. Instead of juggling a patchwork of point products from different vendors, many companies are choosing to centralize more of their security needs with a single provider. CrowdStrike's Falcon platform—which offers everything from endpoint protection to cloud security and threat intelligence—has become a prime beneficiary of that shift.
What is ARR and why does it matter?
Annual recurring revenue is a key metric for subscription-based software companies. It represents the value of recurring revenue a company expects to receive over the next 12 months from existing customers, assuming no cancellations or upgrades. For investors, ARR is a quick pulse check on demand: rising ARR means customers are spending more, while slowing growth can signal weakening pricing power or competitive pressure.
Net new ARR—the change in total ARR from one quarter to the next—is especially important because it strips out the noise of existing renewals. It shows how much fresh business a company is winning. Morgan Stanley's forecast of $400-405 million in net new ARR for CrowdStrike's fiscal third quarter suggests the company is still adding customers and expanding existing accounts at a healthy clip.
Why consolidation is a tailwind
Cybersecurity has become one of the most crowded corners of the software market. For years, companies bought separate tools for antivirus, email security, identity management, and cloud protection. That approach worked when threats were simpler, but it created complexity and blind spots. Security teams now face a barrage of alerts from multiple systems, and managing dozens of vendors has become both costly and inefficient.
Platform consolidation addresses those pain points. By moving more workloads onto a single platform like Falcon, customers can reduce integration headaches, lower training costs, and get a more unified view of threats. For CrowdStrike, that means each customer relationship can grow deeper over time—a dynamic that Morgan Stanley believes will continue to drive ARR growth.
The bank's note echoes a broader theme in the software industry: companies are increasingly favoring platforms over point solutions, especially in areas where security is mission-critical. That trend has helped CrowdStrike maintain growth rates that many larger software peers would envy, even as overall IT budgets face scrutiny.
What it means for investors
For everyday investors, the Morgan Stanley forecast is a signal that CrowdStrike's growth story may not be fading as quickly as some feared. The stock has been a volatile performer, with concerns about competition and valuation often weighing on sentiment. But if the company delivers net new ARR in the range the bank expects, it would suggest that demand for its platform remains robust.
It's worth noting that ARR growth is not the same as profitability. CrowdStrike has been investing heavily in sales and marketing to fuel expansion, and those costs can pressure margins in the short term. Still, strong ARR growth is often a leading indicator of future revenue and cash flow, which is why analysts and investors watch it so closely.
The bank's revenue estimate of $1.56-1.57 billion also implies that CrowdStrike is not just adding new customers but also getting more value from existing ones. That combination—new logos plus expansion—is the recipe for sustained growth in subscription businesses.
Risks to watch
No forecast is guaranteed. CrowdStrike operates in a fiercely competitive market, with rivals like Microsoft and Palo Alto Networks vying for the same security budgets. A slowdown in enterprise IT spending or a major security incident at a customer could also weigh on results. Additionally, the company's valuation has historically been rich, meaning any miss on expectations could trigger sharp sell-offs.
Investors will get a clearer picture when CrowdStrike reports its fiscal third-quarter earnings, typically in late November or early December. Until then, the Morgan Stanley note adds to the case that the company's growth runway remains intact, even as the broader tech sector faces headwinds from higher interest rates and cautious corporate spending.
For those watching the cybersecurity space, the key question is whether platform consolidation is a temporary tailwind or a lasting shift. Morgan Stanley's view suggests it's the latter—and that CrowdStrike is well positioned to capture more of that spending.
