Why Jim Cramer sees CrowdStrike as a buy despite its incredible comeback rally

CrowdStrike shares jumped more than 17% to just shy of a new high after posting record fiscal 2027 Q2 net-new annual recurring revenue (NNARR) of $333M, up 51% Y/Y, and adding more than $45M above the high end of guidance. Management also raised its full-year top-line growth forecast on a record current-quarter pipeline. The results followed AI-driven security demand (including a “Mythos moment” effect) and helped lift Palo Alto Networks by 10%+ as investors looked for confirmation in PANW’s next earnings.

Analysis

The key market mechanism is budget reallocation: AI adoption is not just creating a new software category, it is forcing security to become a precondition for deployment. That makes CRWD and PANW less “discretionary SaaS” and more like infrastructure spend, which should support higher renewal durability, faster module adoption, and continued share gains versus weaker enterprise software names. Secondary winners are cloud-security and identity vendors (ZS, OKTA) as customers harden the AI stack end-to-end; secondary losers are lower-priority app software budgets that get crowded out when CISOs re-cut spending priorities.

The bigger near-term question is not demand, but conversion quality. A strong quarter can pull forward bookings and create a valuation air pocket if the next 1-2 prints do not show commensurate billings and remaining performance obligation follow-through, especially after a sharp rerate. Fal.Con and PANW’s print are the next catalysts: if both confirm pipeline strength, the group can sustain a 1-3 month multiple expansion; if not, the post-gap rally is vulnerable to a mean reversion as the market resets to steady-state growth.

Consensus may be missing that the move is broader than one company and narrower than the current enthusiasm implies. If security is now a tax on AI rollout, the real beneficiary is the category itself, but the trade should favor the most operationally levered names while fading crowded “AI software” beta. The thesis breaks if PANW fails to validate the demand acceleration, if CRWD’s pipeline converts poorly into revenue over the next two quarters, or if the stock cannot hold the prior breakout area after the event-driven momentum fades.

Key Decisions for Investors

• Long CRWD on any post-gap consolidation rather than chasing strength; use the prior breakout area as the risk line. Favor a 1-3 month hold for follow-through into Fal.Con, with upside tied to continued pipeline conversion rather than further multiple expansion alone.
• Initiate a PANW call spread into next week’s earnings only if you want to express catch-up upside with defined risk. The trade works best if PANW confirms that the cyber reacceleration is category-wide; if guide is merely in-line, take profits quickly.
• Pair trade: long CRWD / short IGV or a broad enterprise-software basket to isolate the re-rating from AI-driven security spend versus slower discretionary SaaS. This is a cleaner expression than outright beta if the market keeps rewarding cyber as infrastructure.
• Watch ZS and OKTA for sympathy strength over the next 1-2 months; use them as confirmation of a broader security budget unlock. If they lag materially while CRWD/PANW rally, that is a sign the move is company-specific rather than structural.
• Falsifier alert: if CRWD fails to hold its breakout after Fal.Con or PANW does not echo the pipeline tone, reduce exposure quickly. That would suggest the quarter was an event-driven pop, not a durable demand inflection.