Morgan Stanley sees CrowdStrike’s AI-security platform expanding its addressable market and supporting durable growth

Overview

The report reviews CrowdStrike’s Fal.Con conference and concludes that the company’s expanding AI-security portfolio materially broadens its market opportunity. Morgan Stanley remains Overweight and argues that CrowdStrike’s data, installed sensor base and platform breadth support durable growth and its $238 price target.

Core views

Morgan Stanley argues that AI adoption is creating a security bottleneck for enterprises as cyber vulnerabilities grow and time to exploit shrinks. In its view, organizations need greater control both when deploying AI in their own environments and when defending against AI-enabled threats. The report says CrowdStrike is well positioned because it can combine an installed sensor base, proprietary security data and a broad Falcon platform to address this need. It estimates the company’s CY34 TAM at roughly $565 billion, including approximately $215 billion of AI-security opportunity, or about 38% of the total. Management’s assumption that only about 3.5% share is needed to reach $20 billion of ARR is viewed as conservative, particularly given Morgan Stanley’s reseller checks indicating continued displacement of incumbents. The conference introduced several AI products intended to convert this opportunity into higher-value security workloads. Guardian, the report’s principal near-term catalyst, expands CrowdStrike’s AIDR offering from AI discovery and prompt protection into full-lifecycle runtime visibility, control and enforcement across endpoint, cloud and SaaS. The earlier AIDR offering had ARR nearly triple quarter on quarter in F2Q27; with Guardian’s broader functions and management’s expectation of higher pricing, Morgan Stanley sees scope for continued adoption as customers standardize AI security on Falcon. The report views SafeMind as the potentially larger long-term opportunity. Its cybersecurity-specific models and harnesses use roughly 7 trillion security events per day from Falcon telemetry: Red Tempest searches for vulnerabilities and attack paths, while Blue Solano detects threats, stops breaches and uses existing security tools to respond. Management testing indicated 29%–37% better detection than selected frontier models at up to 99% lower cost per task, while the security-specific harness reduced false positives from about 80% at the general-model layer to about 20%. Morgan Stanley believes this proprietary-data loop can improve newer products and accelerate AI adoption in security operations. The firm also highlights Agentic SOC, Agentic Identity Provider and AI Gateway as extensions of Falcon’s coverage across security operations, identity and enterprise AI traffic. Taken together, it believes these modules strengthen CrowdStrike’s ability to capture AI-security spending and reinforce its broader platform advantage. The report continues to expect core endpoint share gains, rising uptake of SIEM, identity protection and cloud security, and favorable AI positioning to support 20%+ long-term top-line growth. It also forecasts durable 25%+ FCF CAGR over the next three years, supported by expected topline re-acceleration, margin improvement and what it describes as a defensible moat across the security stack. Management’s operating framework provides the near-term evidence for the thesis. FY27 outlook calls for roughly 34% net-new ARR growth, while FY28 guidance calls for another 20%+ despite a more difficult comparison. Morgan Stanley calculates that this implies about 24.6% FY28 ending-ARR growth to roughly $8.23 billion, around 1%–2% above pre-event Street estimates. Management also added more than $200 million to FY27 net-new ARR since introducing a 20% growth target at the prior Fal.Con, ultimately raising the outlook to roughly 34%. Morgan Stanley does not assume the same cadence will recur, but sees the history as evidence of possible upside if demand and execution remain strong. From the implied FY28 ARR base, only roughly 9% FY29 net-new ARR growth would be needed to reach $10 billion by FY29, leaving the pulled-forward FY30 target with cushion. The company also guided to FY28 FCF margin of 32.5%+, versus 30%+ in FY27, despite higher capital expenditure and continued AI-product investment. Morgan Stanley’s $238 target remains based on applying a 60x multiple to its $5.44 billion CY30 FCF estimate and discounting it at a 12% WACC. This corresponds to roughly 34x EV/CY27 sales, or approximately 1.4x growth-adjusted. In its base case, the firm expects CY30 ARR of $13.7 billion, a 22% five-year CAGR; revenue of $12.1 billion, a 21% five-year CAGR; and operating margin expansion from 22% in CY23 to 37% in CY30. Its bull case is $308, based on $6.54 billion of CY30 FCF, a 65x multiple and a 12% discount rate; it assumes $14.7 billion of ARR, $13.1 billion of revenue and a 41% operating margin in CY30. Its bear case is $103, using $3.4 billion of CY30 FCF, a 40x multiple and a 12% discount rate; it assumes $11.1 billion of ARR, $9.8 billion of revenue and a 31% operating margin in CY30.

Analysis framework

Morgan Stanley combines conference observations and management guidance with product adoption evidence, reseller checks, ARR and margin forecasts, and a scenario-based discounted free-cash-flow valuation. It assesses whether CrowdStrike’s data and platform advantages can convert a larger AI-security TAM into sustained ARR growth and cash-flow expansion.

Methodology notes

• Valuation methodsDCF (Discounted Cash Flow)

  Discounted CY30 free-cash-flow valuation

  Morgan Stanley values CrowdStrike by applying scenario-specific multiples to estimated CY30 free cash flow and discounting the result back at a 12% WACC.

• Industry AnalysisSupply-demand framework

  AI-security TAM and enterprise security demand analysis

  The report links rising AI adoption and cyber threats to increased security spending, then assesses CrowdStrike’s potential share of the expanded market.

• Competition & strategyEconomic Moat and Competitive Advantage

  Platform, telemetry and installed-base advantage

  Morgan Stanley argues that CrowdStrike’s proprietary security data, sensor base and integrated product portfolio differentiate its AI-security offerings and can support share gains.

Asset mapping & comparison

Structured mapping from thesis to named assets (strengths, weaknesses, peers, risks).

• CrowdStrike Holdings Inc (CRWD)

  Primary covered company; positioned to benefit from expanding AI-security demand and Falcon platform adoption.

  Strengths

  Proprietary Falcon telemetry, installed sensor base, broad security platform, AI-security product launches and continued share-gain potential.

  Comparison

  Morgan Stanley views the target valuation as a premium to large-cap SaaS and security peers, supported by growth and platform differentiation.

  Risks

  Competition may make customer acquisition more difficult; lower-cost alternatives could pressure premium pricing; a softer hiring environment could reduce upsell activity.

Key data

• CY34 total addressable market~$565BManagement’s expanded opportunity estimate for CrowdStrike.
• AI-security TAM~$215BAbout 38% of the ~$565B CY34 TAM.
• FY27 net-new ARR growth outlook~34%Management outlook as of F2Q27.
• FY28 net-new ARR growth framework20%+Initial FY28 target despite a tougher comparison.
• Implied FY28 ending ARR~$8.23BMorgan Stanley estimates roughly 24.6% growth and 1%–2% above pre-event Street estimates.
• FY28 FCF margin guidance32.5%+Versus 30%+ in FY27.
• Base-case CY30 FCF$5.44BValued at 60x and discounted at a 12% WACC for the $238 target.
• SafeMind detection performance29%–37% better detection; up to 99% lower cost per taskVersus selected frontier models in management testing.

Impact & implications

Morgan Stanley believes CrowdStrike’s new AI-security products increase both its addressable market and its ability to monetize the Falcon platform through broader functionality and potentially higher pricing. The firm sees management’s pulled-forward ARR milestones, initial FY28 growth framework and FCF-margin guidance as reinforcing visibility into durable growth.

Risks

• Competition could make new-customer acquisition more difficult.
• Lower-cost alternatives could commoditize CrowdStrike’s premium pricing.
• A softer hiring environment could pressure upsell activity.

What to watch

• Execution against FY28 guidance for 20%+ net-new ARR growth.
• Adoption and pricing traction for Falcon Guardian and the broader AI-security portfolio.
• Whether SafeMind’s detection, cost and false-positive advantages translate into customer adoption.
• Endpoint-security demand and the pace at which XDR, identity and cloud-workload protection TAM opportunities materialize.