CrowdStrike CEO warns AI will trigger explosion of cyber attacks with shrinking patch windows

Editor’s note: A previous version of this article stated that this was Crowdstrike’s first-ever positive GAAP net income, which was incorrect. We regret the error.

You’re going to have a higher volume of attacks because AI is out there. It’s going to find vulnerabilities that have never been found before, and you’re going to have less time to actually patch these vulnerabilities.

George Kurtz, CEO of CrowdStrike Holdings (NASDAQ:CRWD | CRWD Price Prediction)

The specific number Kurtz offered is the one I keep coming back to. Today it takes an adversary roughly five days on average to build a working exploit after a vulnerability is announced. With AI, Kurtz expects that window to collapse to five minutes. That’s a complete collapse of the time organizations have to respond.

The interviewer framed the sharper question: how did anyone think AI from companies like Anthropic would disrupt CrowdStrike, when in reality AI makes CrowdStrike’s product more essential than ever? Kurtz agreed entirely. His argument is that this environment accelerates adoption of security technologies that create mitigating controls, providing protection while patches are being applied.

If adversaries move at AI speed, organizations can’t rely on patch cycles alone. They need a platform that provides active protection in the gap between “vulnerability discovered” and “patch deployed.” That’s precisely what the Falcon platform is built to do.

The Numbers Behind the Thesis

CrowdStrike just posted its strongest year on record. Ending ARR hit $5.25 billion, up 24% year-over-year, and the company called itself the fastest pure-play cybersecurity software company to reach that milestone. More telling: net new ARR of $330.7 million in Q4 FY26 was a record, up 47% year-over-year.

Falcon Flex ending ARR grew more than 120% year-over-year to $1.69 billion, which tells you customers are consolidating more of their security stack onto a single platform rather than spreading spend across vendors. That’s a stickiness signal, not just a growth one.

The company also posted positive GAAP net income at $38.69 million in Q4 FY26, compared to a $86.29 million GAAP loss in the prior year period.

The analyst consensus skews heavily toward buy. Of 56 analysts covering the stock, 42 rate it a buy and 14 a hold, with a consensus price target of roughly $490 against a current price of $426.51. The stock is up 31% over the past year but down 9% year-to-date, which is worth examining against the AI threat acceleration thesis.

If Kurtz is right that AI compresses exploit timelines from days to minutes, then the cybersecurity market doesn’t shrink in an AI world. It becomes non-negotiable infrastructure. CrowdStrike’s long-term target of $20 billion in ending ARR by FY36 starts to look less like ambition and more like a floor.