Crowdstrike Holdings Inc (CRWD)
Growth Momentum at Next Gen Cybersecurity Play
We looked at Crowdstrike in September 2023 with an update in March 2024. These notes can be found here and here.
The original reason for looking at it was a request from a subscriber for younger companies whose phase of high growth, and the consequential high share price appreciation, is still in the future.
This reader was perhaps inspired by Ian Cassell who said:
“By the time everyone calls it a great business, the exceptional returns are usually in the rearview. The time to buy is when it is misunderstood, undiscovered and under-appreciated.”
We looked at CRWD but were cautious as we were out of our circle of competence. The company was not profitable. We normally only look at highly profitable companies with high and rising ROEs /ROCE etc and generating lots of cash flow.
Cybersecurity is difficult for a non-technical generalist like me to understand and there are many players in the space all of which makes predicting the winners an even more difficult task than is normally the case.
We look at the company again in the light of this week’s quarterly results
The key relevant metrics are given below.
Total Revenue, Annual Recurring Revenue (ARR), Operating Cash Flow and Free Cash Flow all grew between 27% and 35% (YoY). The QoQ growth was also healthy in the range 6% to 10%. (26% to 46% annualised).
CRWD has experienced. The rate of revenue growth (blue line in the chart above) has slowed as comparisons become difficult, but it is still at an impressive 33%.
Another key statistic is the percentage of customers who are buying multiple modules. Once a customer has been set up on the CRWD Falcon platform, it is relatively easy for them to buy additional modules. From the company’s point of view, the sales cost of getting the customer to buy another module is almost zero. Therefore, a rise in the percentage of customers buying more than 4 modules (there are 23 modules in total) is an important positive sign. As the table above shows, there has been a slight increase in the proportion of customers buying 5+ modules.
The tend on profits is less clear but the chart above shows, the company has been profitable for three quarters now and has left the days of operating losses behind.
Looking forward, equity analysts expects net profit and EPS to grow strongly in the next three years. The chart below shows the analysts’ consensus earnings estimates. They are forecast to rise steadily for the next three years.
The company strong cashflow generating capabilities has boosted cash and equivalent and strengthened the balance sheet.
Crowdstrike business approach
This is described in detail in our original note referenced above.
CrowdStrike was formed in 2012 and their aim was to take a very different approach to the legacy players (McAfee etc). They wanted to build the first “Security Cloud platform”.
They leveraged the network effects of crowdsourced data applied to modern technologies such as AI, cloud computing, and graph databases.
They built the Falcon Platform to detect threats and stop breaches. It is comprised of two integrated technologies:
1. A Lightweight agent and
2. A Threat Graph.
Falcon Platform now is a series of tightly interconnected applications that offer the customer more than just improved security - it also has better visibility and the opportunity to simplify and consolidate historically complicated and cumbersome functions.
For many years companies tended to buy products to meet new threats as they emerged and ended up with a hodgepodge of products from various suppliers which may be the “best in class” for specific problems but worked imperfectly as a complete security solution.
Many entities are now looking to reduce the number of vendors drastically and focus on those few suppliers who can offer a full-suite or “platform” solution.
A local device is installed at each endpoint (on Desktops, mobile phones, tablets etc.) and it provides protection but also gathers data which is sent to a central unit which uses AI/ML to analyse the output. A large company or organisation may have tens of thousands of such devices.
“We believe our approach has defined a new category called the Security Cloud, which has the power to transform the cybersecurity industry the same way the cloud has transformed the customer relationship management, human resources, and service management industries.”
“Using cloud-scale AI, our Security Cloud enriches and correlates trillions of cybersecurity events per week with indicators of attack, threat intelligence and enterprise data (including data from across endpoints, workloads, identities, IT assets and configurations) to create actionable information, identify shifts in adversary tactics and automatically detect and prevent threats in real-time across our customer base.”
There is a network effect at work as many users’ data is continuously fed to a central platform which
spots threat patterns and acts to benefit all users.
The huge volumes of data generate by the lightweight agents goes to the Falcon Platform and is analysed by the Threat Graph.
“Our Threat Graph processes, correlates, and analyses this data in the cloud using a combination of AI and behavioural pattern-matching techniques. By analysing and correlating information across our massive, crowdsourced dataset, we are able to deploy our AI algorithms at cloud-scale and build a more intelligent, effective solution to detect threats and stop breaches that on-premises or single instance cloud products cannot match.”
The scale of the data being handled is huge.
“We handle 4 trillion events per week. These are signals that come into our platform, right? We have one of the largest Kafka clusters in the world. So we're competing with the Facebooks and the Googles, et cetera, for talent just because of the sheer scale that we operate in. 4 trillion events per week. So as today starts and ends, we will have handled more events in our platform, these signals that come into our platform that Twitter has tweets in an entire year.”
The legacy solutions were based on a “trust but verify” approach which means once you are verified upon entering the network, you are essentially trusted within the system thereafter.
Those with malicious intent only need work out how to fool the system once. Now “trust but verify” is being increasingly being replaced by the Zero Trust approach. Zero Trust requires users to be authenticated, authorized, and validated before granted access.
Highlights from the Q! FY 2024 earnings conference call
Demand momentum remains strong.
“We started the year from a position of momentum and exceptional strength, outperforming our guided metrics.”
“Even as we continue investing in growth, we're adding sales capacity, investing in our market leading brand, and accelerating innovation while firmly on the path to $10 billion in ending ARR.”
“The foundational theme underpinning CrowdStrike's result is the power of the Falcon platform to consolidate cybersecurity at scale. This is coupled with the market's unequivocal desire for a single AI powered software platform consolidator.”
Customers want to reduce or consolidate the number of cybersecurity vendors.
“We're consistently hearing that customers want to partner with us as they consolidate, standardizing their cybersecurity future on the Falcon platform and investing their trust in CrowdStrike as cybersecurity's North Star.”
CRWD believe they have the best platform.
“We built the right architecture from the start, the industry's lightest weight, easiest to install sensor, embedded with AI, no system reboot required, a single AI native platform console, not disparate stitched together or siloed multi platforms.”
“Our architecture built from the start with what I refer to as gold plated plumbing allows the Falcon platform to gracefully land, retrieve data once and then flight, infinite security, IT, data and compliance capabilities without any friction.”
“Our 28 modules are best-in-class on a standalone basis as rated by applicable leading industry analysts. Yet combined and natively built into the single Falcon platform, our solution modules work even better together, unlocking customer value characteristics of a virtuous flywheel. The sum of platform adoption is even greater than the individual parts.”
CRWD discussed Artificial Intelligence (AI) at the last conference call.
“We introduced Charlotte AI, an exciting new generative AI security analyst utilizing CrowdStrike's high fidelity data advantage. We believe Charlotte AI will power a newly minted Tier-1 analyst to yield the results of an advanced Tier-3 analyst, the net benefit to the customer, faster results, better security outcomes, and lower overall costs.”
Charlotte AI is a virtual SOC (Securities Operations Centre) Analyst which is used to analyse and respond to the various threats being detected.
“As I mentioned, when we launched Charlotte AI in public preview is the fact that it really is a virtual analyst, a SOC (security operations centre )analyst, which are super expensive and hard to maintain. So for our purposes, when we look at the total value to a customer, if we can create more virtual analysts, just as an example that takes eight hours of work and compresses it into 10 minutes.”
CRWD believes the AI tools gives them a big advantage.
“We stand out in our ability to secure diverse attack surfaces with the industry's highest protection levels, expanding cloud, data, device, identity, third-party sources and beyond, natively alerting in one place and automatically responding across the platform at machine speed.”
Deploying Falcon delivers significant tangible savings to clients.
“A recent IDC report quantifies CrowdStrike's extreme cost savings. For every $1 invested in Falcon Solutions, our customers recognized $6 of cost savings.”
When we discussed CRWD ‘s competitors in previous notes we mentioned companies such as Palo Alto Networks (PANW), Zscaler (ZS) and Fortinet (FTNT). In addition, to these stand-alone players the biggest threat was the giant Microsoft (MSFT) with its formidable enterprise sales force.
CRWD claims customers are dissatisfied with MSFT products.
“There's a widespread crisis of confidence among security and IT teams within the Microsoft security customer base.”
They have developed products which boost the effectiveness of Microsoft Defender.
“At the request of organizations saddled with Microsoft E5 licensing, we delivered Falcon for Defender, a platform on-ramp to help organizations of all sizes start utilizing Falcon to secure their Microsoft Defender usage.”
“(CRWD Secured) a seven-figure deal in a Fortune-100 healthcare company who was using Microsoft and experienced a breach. Our industry leading IR team deployed more than 46,000 sensors in days stopping the adversary, restarting business, and importantly keeping this business out of promotional vendor fanfare. This customer immediately adopted Falcon Complete, Identity, Falcon Cloud Security, LogScale next-gen SIEM, and Charlotte AI.”
Problems with Microsoft Products is giving them any entry to clients to whom they are selling their products.
“With Falcon for Defender organizations using Microsoft now have what we call Vsquared. Validation and Verification, a missing third-party protection layer for their security programs. And with our sensor already deployed on customer systems, we're dropping anchor on the beachfront real estate to not only transform cybersecurity but also stop breaches. Feedback has been overwhelmingly positive. CISOs now have the ability to reduce monoculture risk from only using Microsoft products and cloud services.”
CRWD also works with Managed Security Service Provider (MSSP). MSSPs like Deloitte, EY, TCS and Accenture etc offer network security services to their own customers including SMEs.
“In our MSSP business, one of our fastest growing segments, partners are coming to us to migrate their customers off legacy and substandard point products as well as multi-platform vendors.”
“Mandiant is migrating its Mandiant-managed defence MDR customers to the Falcon platform. Recognizing our market leadership and the need to deliver services on the best technology platform, CrowdStrike is the natural choice to migrate their customers off legacy AV and other point products.”
“Our top 50 partners in every geography are growing and telling us they're doing less and less with other vendors, instead increasing their focus and business results on Falcon.”
The GenAI boom is leading to huge datacentre investments by the Cloud Hyperscalers among others. This is creating significant demand.
“CrowdStrike is at the epicentre of securing the workloads driving the AI revolution. We're the next conversation.”
“Jensen Huang, Founder and CEO of NVIDIA recently validated this by stating in our Q1 partnership announcement that,-Pairing NVIDIA accelerated computing and generative AI with CrowdStrike cybersecurity can give enterprises unprecedented visibility into threats to help them better protect their businesses.-”
“One of the world's leading hyperscalers (thought to be Amazon Web Services) grew their adoption of the Falcon platform, standardizing on the Falcon cloud security in an eight-figure deal.”
“In a public press release, this customer (AWS) and partner extolled the unified nature of our security platform and their ability to consolidate multiple cloud security point products on Falcon Cloud Security.”
“As of Q1, Falcon has been selected by 62 of the Fortune 100 as their cloud security provider of choice. CrowdStrike pioneered the creation of the identity detection and response category. Our identity protection module continues to be the only single agent solution on the market, giving us a major competitive advantage.”
“Over the past 12 months, our industry leading incident responders in our partner network used Falcon to respond to thousands of breaches, cementing CrowdStrike as the industry's incident response authority. These engagements often convert to net new Falcon customers.”
Operating expenses are falling as a percentage of revenue which suggests that there is some operating leverage which will boost margins.
“Total non-GAAP operating expenses in the first quarter were $522.5 million or 57% of revenue compared to 61% of revenue in the prior year.”
The outlook for the next quarter and the full fiscal year is for revenue and cash flow growth of about 31%.
“When you look at someone like AWS, they're obviously looking for the best cloud technology in the market. We believe we have it and it's fantastic to be able to continue to expand our relationship.”
They guided for Stock-based compensation dilution for 3% in the next year.
Their target is to reach $10bn ARR number in five to seven years.
Summary
The quarterly numbers showed strong growth momentum for CRWD.
They continue to see strong sales and cash flow growth.
Analysts are forecasting strong EPS growth in the next four year at least
CRWD’s integrated open platform with single endpoints which allow for easy expansion seems to be winning over customers.
Sales are benefitting from the trend towards vendor consolidation, dissatisfaction with Microsoft products and the need to secure the rapidly expanding new GenAI driven workloads in the cloud.
They have collaboration with AWS and Nvidia.
The numbers and the companies’ statements indicate that CRWD do seem to have some reasonably strong advantages relative to their competitors.
Competitors have cited difficult demand conditions in the most recent quarterly reports
Valuation
The analysts’ projection are currently for an EPS of $ 6.5 in FY 27. This implies a forward Price Earnings ratio of will be about 52 times. This suggests the shares are a expensive despite the strong investor demand
We supplemented this “back of the envelope” calculation with a DCF for which we made several assumptions. These include the following:
Revenue will grow between 31% in the next 5 years Operating margins will be about 26%.
The weighted average cost of capital (WACC) is 8.8%.
The long-term growth rate is 5.5%.
With these and other assumptions, we estimate the fair value of the CRWD share to be ~$ 350. As usual, we must state the caveat that these numbers are highly sensitive to the inputs. A small change in the inputs can lead
This suggests the shares are fairly valued at the current price.
Conclusions
The shares have been trading sideways for the last three months.
They jumped up 10% in response to the strong results.
We have a 1% holding in CRWD in our portfolio.
We do not want to add to it at the current valuation but will reconsider if the price fall by 20% to 25%.