Key Takeaways:
CrowdStrike's AI Detection and Response product saw annual recurring revenue nearly triple sequentially in Q2 FY26, positioning it as a potential growth engine for the cybersecurity firm.
CrowdStrike's AI Detection and Response (AIDR) product saw annual recurring revenue nearly triple sequentially in Q2 FY26, as enterprises rushed to secure AI deployments and the product's separate pricing model unlocked incremental revenue from existing customers.
CrowdStrike management said AIDR is priced separately from the company's core endpoint detection and response offering, allowing it to generate additional revenue from its existing customer base. The product runs on the same Falcon agent already deployed, reducing the need for another security agent on endpoints. This deployment model lowers adoption barriers because customers do not need to install new software or manage additional agents across their infrastructure.
The company uses a token-based pricing model for AIDR. Customers receive a defined amount of token usage based on the size of their environment and can purchase additional token packs as usage rises. AIDR can also be consumed through Falcon Flex, giving customers a simpler way to expand usage as AI adoption increases. CrowdStrike said a large bank adopted AIDR in an eight-figure Falcon Flex deal to gain AI usage visibility and prevent data exfiltration, while other customers paired AIDR with identity products to secure AI deployments.
Growing enterprise AI adoption is creating demand for these capabilities. Companies are deploying more AI applications and agents, which increases the risk of data leakage, misuse and unauthorized access. The new AI threat landscape — including prompt injection attacks, model manipulation and sensitive data exposure through AI tools — has pushed security teams to seek dedicated visibility and control over AI usage rather than relying on traditional endpoint protection alone.
Competitive pressure builds in AI security
CrowdStrike faces competition from Palo Alto Networks and SentinelOne, both expanding their AI security offerings. Palo Alto Networks reported Next-Gen Security ARR growth of 60 percent year over year in Q3 FY26, driven by adoption of its AI-driven XSIAM platform, SASE and software firewalls. SentinelOne has also invested in AI-powered threat detection capabilities.
AIDR's near-tripling ARR shows strong early momentum. The separate pricing model, easy deployment and growing need to secure AI agents suggest AIDR could become an important contributor to CrowdStrike's future growth. The product's incremental nature — generating additional revenue from the existing customer base without requiring new agent deployments — gives it a favorable margin profile.
For investors, the question is whether AIDR can sustain this trajectory and meaningfully contribute to CrowdStrike's total ARR. The product's token-based consumption model could provide an additional source of recurring and usage-based revenue over time, similar to how cloud providers monetize consumption. If AIDR continues to grow at this pace, it could become a meaningful driver of overall ARR growth in coming quarters, reinforcing CrowdStrike's competitive position in the AI security market.
This article is for informational purposes only and does not constitute investment advice.
