CRWD: The Threat Became the Thesis

In late February, the market felt that artificial intelligence was bad news for CrowdStrike (CRWD). By late August, AI was the reason the company gave for the best quarter in its history.

Both reactions trace back to one place. CRWD made its low on February 23, the day cybersecurity stocks slid after Anthropic launched Claude Code Security, a tool that scans software for flaws and suggests fixes. Six months later, CEO George Kurtz used the company's earnings release to credit what he called the Mythos moment (Anthropic again, a newer model) with convincing the mass market that AI adoption needs security.

And somewhere in between, the threat became the thesis. The stock has roughly tripled off that February low and set a new all-time high on September 29.

Crowds change their minds all the time, so the flip on its own isn't all that remarkable. What caught our attention was the order in which things happened.

Falcon, Briefly

First, a quick sketch of the business as the company describes it. CrowdStrike sells the Falcon platform, which its annual report calls "the operating system for cybersecurity." A single lightweight sensor sits on a customer's devices and reports back to a cloud platform built with AI at its core. It made its name protecting endpoints (laptops, servers and the like) and has since grown to cover cloud workloads, identity and data under one roof. The pitch to customers is consolidation. Fewer vendors, one agent, one platform.

The road ahead, per management, runs through securing AI itself. The August release reported record net new annual recurring revenue of $333 million, up 51% from a year earlier, and lifted the full-year outlook for that measure to 34% growth. Kurtz describes securing AI as the largest market opportunity the company has ever had.

One line in that same release is worth a second look, and it isn't a number. Down in the fine print at the bottom, CrowdStrike says Falcon runs on real-time indicators of attack.

Two Kinds of Evidence

That phrase has some history behind it. For years, security teams leaned mostly on indicators of compromise (IOC): a known malicious file, a flagged IP address, a piece of code someone had seen before. CrowdStrike's own explainer is blunt about the weakness, calling IOC monitoring "reactive in nature." By the time one turns up, the intruder is usually already inside. Indicators of attack take the other road. Rather than hunting for fingerprints after the fact, they watch behavior while the attack is still unfolding.

Swap the intruder for a crowd of investors, and the idea holds up surprisingly well.

Headlines, downgrades and the tidy explanations that follow a big move are indicators of compromise. They're real, and they're useful. They're also forensic. Most of the time they describe something that has already happened.

Price is closer to an indicator of attack. It's the crowd acting in real time, often before anyone has settled on the words for what it's doing. Reading that behavior is what Elliott Wave is for, and CRWD's last seven months make the case better than we could on our own.

The Threat

Pressure had been building for weeks. Through early February, the fear that AI would hollow out big parts of the software business was running hot, and CRWD sold off with the group. Then Claude Code Security arrived. On February 23, CrowdStrike fell about 11% in what a Baird analyst told Reuters was a "panic-driven, narrative-led selloff." Adjusted for the four-for-one split in July, the stock bottomed that day at $85.68, close to 40% below its November peak.

Spring brought worse headlines, at least on paper. In late March, Fortune reported on a leaked Anthropic draft describing Mythos, and security stocks slumped again. On April 7, Anthropic unveiled Claude Mythos Preview along with Project Glasswing, a group of companies given early access for defensive work, CrowdStrike among them. That same day, as it later came out, Treasury Secretary Scott Bessent and Fed Chair Jerome Powell called the heads of major banks to Washington for an urgent meeting on the model's cyber risks.

For a security stock, it's hard to dream up a scarier headline. CRWD jumped about 6% the day after the Glasswing news, then gave it back once the meeting was reported, trading around $93.

And it held. The loudest alarm of the whole cycle went off, and the February low stayed intact. The fingerprints still said breach. The behavior had already moved on.

The Thesis

Somewhere in there the mood turned, and the headlines took their time noticing. Wall Street began talking about that Glasswing seat as an advantage instead of a footnote. By early June, the stock had climbed roughly 90% from its March earnings report.

Then came a day we find telling. On June 4, right after first-quarter results and the split announcement, CRWD fell 7%. Reuters ran the story under a headline saying the Mythos moment had failed to cheer investors. So the new story was already out there, at full volume, and price shrugged it off. If the narrative were doing the steering, that's a strange thing to see.

By late August, the phrase had moved from the headlines into the company's own release. Kurtz wrote that "the Mythos moment translated into mass-market acceptance that AI adoption needs security." The same model that prompted an urgent Treasury meeting in April had become, four months later, the CEO's explanation for record demand.

That's the threat becoming the thesis. Look at the order, though. Price bottomed in February. It made a higher low in April, under the worst headlines of the year. The company's own version of events arrived in late August, six months after the low.

So what is the behavior saying now?

Sentiment Is Speaking

Garrett Patten has provided us with a larger point of view and a road map that places price midway through a wave 3 rally structure. Zac Mannes also shared a chart that agrees and stretches out even farther in time.

The main takeaway from these charts is that as long as price holds support, both structures favor the bullish path. Near-term support is at the $239 area. If price breaks below there, Garrett's chart shows a wider wave 'iv' pullback, marked in red, targeting the $230 to $235 zone. Below $200 would require a revision to the bigger bullish scenario shown here.  

Closing

CrowdStrike built a business on the idea that fingerprints come late. Find one, and the intruder has probably been inside for a while. Headlines work much the same way. February's selloff coverage and April's Treasury meeting marked fear at, or already past, its peak. August's press release described a rally that was well underway by the time anyone put it in writing.

The behavior got there first both times. For now, it's still leaning higher.