CrowdStrike Holdings, Inc. (CRWD) Q4 2023 Earnings Call Transcript

CrowdStrike Holdings, Inc. (NASDAQ:CRWD) Q4 2023 Results Conference Call March 7, 2023 5:00 PM ET

Company Participants

Maria Riley - VP, IR

George Kurtz - President, CEO and Co-Founder

Burt Podbere - CFO

Conference Call Participants

Saket Kalia - Barclays

Sterling Auty - MoffettNathanson

Joel Fishbein - Truist

Matt Hedberg - RBC

Rob Owens - Piper Sandler

Andrew Nowinski - Wells Fargo

Tal Liani - Bank of America

Hamza Fodderwala - Morgan Stanley

Brian Essex - JP Morgan

Gabriela Borges - Goldman Sachs

Brian Colley - Stephens

Ittai Kidron - Oppenheimer

Patrick Colville - Scotiabank

John DiFucci - Guggenheim

Operator

Thank you for standing by, and welcome to CrowdStrike Holdings Fourth Quarter and Fiscal Year 2023 Financial Results Conference Call. At this time, all participants are in a listen-only mode. After the speaker presentation, there will be a question-and-answer session. [Operator Instructions]

I would now like to hand the call over to Maria Riley, Investor Relations. Please go ahead.

Maria Riley

Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, President and Chief Executive Officer and Co-Founder of CrowdStrike; and Burt Podbere, Chief Financial Officer.

Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth and expected performance including our outlook for the first quarter and fiscal year 2024 and any assumptions for fiscal periods beyond that are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties.

We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise. Further information on these and other factors that could affect the Company’s financial results is included in the filings we make with the SEC from time to time including the section titled Risk Factors in the Company’s quarterly and annual report.

Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings press release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today.

With that, I will now turn the call over to George to begin.

George Kurtz

Thank you, Maria, and thank you all for joining us.

CrowdStrike delivered a record fourth quarter that exceeded our expectations across the board. I will focus my comments today on a few key points.

First, CrowdStrike is executing exceptionally well in a challenging macro environment. We believe this is best showcased by the fourth quarter’s record net new ARR of $222 million, record net new customers of 1,873, strong retention rates, record operating income, record free cash flow of $209 million and a rule of 81 on a free cash flow basis.

Second, the dual mandate of high efficacy and low total cost of ownership faced the CrowdStrike strength as a leading consolidator. CrowdStrike’s growing market share showcases the Falcon platform’s advanced AI and technology leadership that drives better security outcomes, automation and lower TCO for customers.

And third, our conviction in CrowdStrike’s expansive opportunity continues to grow. We see a massive opportunity to leverage our AI-driven collect data once, reuse many times platform to expand share across our markets. As Burt will discuss, we are continuing our thoughtful and balanced approach to investing to drive both, top line and bottom line growth. We remain steadfast in our vision to grow ending ARR to $5 billion by the end of fiscal year 2026 and to reach our target operating model sometime within fiscal year 2025.

The key to our success in the fourth quarter was execution and strong market demand for the Falcon platform. We converted our pipeline into wins and built a record Q1 pipeline even as sales cycles elongated as we saw late in Q3, and we did not see the typical budget flush as organizations continue to work through macro concerns. Our competitive win rate remained high and ASPs remain consistent, and we ended the year with a best-in-class gross retention rate and a strong net retention rate.

We believe our strong fourth quarter performance and record Q1 pipeline demonstrates the mission-critical nature of cybersecurity for modern businesses, the resiliency of our market and CrowdStrike’s growing leadership as the cybersecurity platform of record. I’d like to thank each and every CrowdStriker for their dedication and hard work in making the fourth quarter our best quarter to date. As a team, we should be proud of the amazing accomplishments we have achieved and excited about the opportunities ahead of us.

We’ll take a moment to highlight several year-over-year milestones that CrowdStrike team delivered in FY23 that I’m most excited about. Ending ARR grew 48% to reach $2.56 billion. Net new ARR grew 22% to reach $828 million, setting a new record. Our emerging product category contributed $182 million to net new ARR, which was 22% of all net new ARR and a 97% increase. Emerging products ended ARR growing 116% to $339 million, surpassing CrowdStrike’s total ARR at the time of IPO in 2019. This included a standout year for our Identity Protection modules, which contributed over $100 million in ending ARR and over 1,000 net new identity customers. Additionally, LogScale posted over 200% ending ARR growth.

From a public cloud deployment view, ending ARR surpassed the $200 million milestone to reach $224 million. And we added a record 6,694 net new customers for the fiscal year to bring us to 23,019 subscription customers, a 41% increase. CrowdStrike now serves 556 of the Global 2000, 271 of the Fortune 500 and 15 of the top 20 U.S. banks.

On the bottom line, FY23 operating and net income growth well outpaced revenue growth, showcasing the leverage in our model. Non-GAAP operating income grew 81% year-over-year to reach a record $356 million. Non-GAAP diluted EPS grew 130% to reach a record $1.54. Free cash flow grew 53% to reach a record $677 million, and we achieved at least 30% free cash flow margin for the third consecutive year.

Our market leadership continues to grow as customers are voting for their platform of choice with their wallets. CrowdStrike ranked first in IDC’s annual Worldwide Modern Endpoint Security Market Share report for the third consecutive year with 17.7% market share, outpacing all vendors by posting the largest increase in revenue and market share.

The efficacy of the Falcon platform continues to be widely tested and recognized for delivering superior outcomes regardless of whether you are looking at MITRE, TrustRadius, G2, Frost & Sullivan, Forrester Wave, SE Labs, Gartner Peer Insights or Gartner Magic Quadrant, Falcon’s superior technology has been awarded a lead or a number one position.

This was most recently highlighted by winning the 2023 SE Labs award for Best EDR and Best Product Development. This is the third consecutive time that CrowdStrike has won in the best EDR category, further reinforcing our innovation in endpoint security and putting us in the pole position to help customers enter the XDR era.

Additionally, CrowdStrike was once again positioned as a leader furthest to the right for completeness of vision in Gartner’s Magic Quadrant for endpoint protection platforms for the third consecutive year. We believe this recognition highlights our long-standing track record of disruptive innovation, including our use of AI and indicators of attack to stop cyber adversaries in real time.

While the use of AI has become a new topic of the day, it is not new to CrowdStrike. We were a pioneer in applying AI and cybersecurity. The Falcon platform was designed from the ground up to effectively process and correlate the massive volume of data required for effective AI and leverage it across our entire platform. From prevention through to detection and response, this enables Falcon to spot fainter signal and identify activity earlier in the kill chain.

We have become experts in leveraging data science to deliver best-of-breed attack discovery and prevention for our more than 23,000 customers. This drives immense leverage across the platform and better, more efficient outcomes for our customers.

There is a clear mandate from customers: they want to reduce cost and headcount, reduce the number of point products and agents, reduce complexity and simplify operations. This mandate is even more acute for customers given the current macro climate, and it is the exact imperative that Falcon platform was built to deliver from day one with its advanced AI engine and collect once, reuse many architecture.

CrowdStrike delivers on these customer mandates with our hallmark immediate time to value that accelerates cost savings for the customer. Let’s take a look at a few customers that are using CrowdStrike to drive consolidation, lower TCO and realize better outcomes within their environment.

One of our marquee enterprise customer wins this quarter was with a leading financial institution in the Fortune 50 that is consolidating on Falcon and replacing four vendors and multiple play products including Symantec, Trellix, Trend Micro, and Aqua. Their testing proved Falcon’s superior visibility, protection and threat hunting abilities over both, incumbent and prospective new vendors. These factors, along with Falcon’s holistic approach to protecting the cloud environment with our integrated CNAPP offering drove the decision to adopt the Falcon platform.

Another customer win I’d like to highlight was with a multinational fintech company looking for a security partner to consolidate their hodgepodge of legacy and next-gen vendors. This customer identified eight vendors they could eliminate with their initial deployment of Falcon, including Microsoft, Carbon Black, Trellix, Trend Micro, Sophos, ESET, F-PROT and ClamAV. The Falcon platform provides them the ability to significantly reduce their complexity, reduce agent bloat, reduce TCO and improve security outcomes.

Additionally, this customer purchased LogScale to store its security data to gain better performance and avoid the high cost associated with existing log management solutions.

Another LogScale win this quarter was with a leading global financial institution that wanted to increase the volume of Falcon data retained as well as gain faster query results and avoid the high cost associated with expanding the usage of their legacy log management system. Their testing showed that LogScale delivered query speed, orders of magnitude faster than their existing tools. This customer is now ingesting close to 40 terabytes of data per day with plans to standardize on LogScale across their organization over time.

The next exciting win I’d like to share with you is an expansion to Falcon Complete with one of the largest global transportation and logistic companies. In a highly targeted sector by cyber adversaries, this customer wanted a round-the-clock 365-day stock. While this customer had budget and headcount reserve to build out an internal stock, after performing a thorough cost-benefit analysis, this customer determined that Falcon Complete, including Falcon Complete for identity threat protection would deliver the best coverage, protection and value without adding headcount.

Falcon Complete for identity threat protection was a key aspect to the win as they sought to run an effective and mature identity security program without the burden, cost and time associated with managing it internally.

Even if doing fewer internal resources has become the new normal for many companies, the outcome of stopping breaches remains the number one priority for CISOs and CIOs. As cited in our global threat report, the threat landscape remains elevated with an observed 50% increase in the number of interactive intrusion campaigns and 95% growth of the number of cloud exploitation cases in 2022.

Compromising on security can easily translate to compromised coverage, added complexity and catastrophe. Let me be clear, there is no participation trophy for coming in second place when up against cyber adversaries. Good is never good enough on the cyber battlefield and perceived free is never free. To demonstrate my point, I’d like to share a recent win with a company that suffered a breach after relying on an OS vendor that claimed their legacy signature-based product was good enough to take on today’s threat actors.

This company had initially chosen Microsoft to replace existing AV products across their estate, but quickly ran into trouble when they discovered that Defender could not be fully deployed within their heterogeneous environment leaving their service vulnerable. Unfortunately, it did not take long for threat actors to find these gaps and breach their environment.

They turn to one of our incident response partners, a leading global SI that uses Falcon as a key part of the responsive remediation service. During the engagement, the customer found that Falcon provided 2.5 times more coverage than Defender and was much simpler to operationalize. It quickly became obvious to this company why AI protection was far superior to signature-based technologies, and they needed world-class protection across heterogeneous operating systems. The CISO also determined that excluding the cost to remediate the breach, Defender cost twice as much and would still fall short of functionality, simplicity and efficacy of Falcon. Having lost faith in Microsoft’s low-cost, good enough promise this new CrowdStrike customer adopted Falcon Complete.

Our professional services organization is a strong lead generation engine for the Falcon platform. The average ARR per dollar of professional services revenue derived from organization’s new to CrowdStrike through our incident response or proactive services grew to $6.07 as of January 31, 2023. To summarize, every dollar from these professional services engagements in the past two years has turned into $6.07 of ARR.

Our thriving partner ecosystem is also growing to become a powerful source of lead generation. In FY23, MSSP ending ARR grew over 100% and partner-sourced ending ARR grew over 50% year-over-year. Additionally, revenue through channel partners grew to 83% of total revenue, strategically expanding and investing in our partner ecosystem with the goal of further expanding our reach within the enterprise as well as down market in the SMB is one of our top initiatives in FY24.

As we recently announced, we entered into a new multifaceted strategic partnership with Dell to deliver the Falcon platform to Dell’s customers globally. The Falcon platform is now offered through Dell’s global go-to-market organization via several avenues, including a traditional resell agreement on device for new purchases made through Dell’s direct sales team and as the cornerstone to Dell’s managed cybersecurity service offering.

While it is still early days for this new go-to-market partnership, we expect it to significantly expand our reach across the market from large enterprises to the small S in the SMB. Customers have chosen CrowdStrike as the platform of choice and so has Dell.

We had tremendous initial success with our Falcon Go bundle which was specifically designed as a starter package or a landing point for smaller businesses with 100 endpoints or less, that may be more price sensitive. We launched Falcon Go a little more than two quarters ago and have already added over 1,000 net new customers through the program.

We believe this early success reaching the S in the SMB demonstrates the immense demand for CrowdStrike’s best-in-class endpoint protection, even among the smallest and cost-conscious organizations.

In late January, we launched the next-gen iteration of our e-commerce engine with the goal of removing even more friction out of the buying process and driving higher connection between digital top of funnel and conversion into buying. We view these advancements in our e-commerce engine as a differentiator. And within just a few weeks post launch, we have seen a dramatic increase in no-touch digital conversions.

The market dynamics in the SMB are velocity driven and very different from our traditional enterprise customer base. To accelerate growth and drive market share within the massive SMB opportunity, as well as increase growth through all of our channels, we changed the organizational structure and created a new leadership role with the appointment of Daniel Bernard as Chief Business Officer. Daniel has a proven track record in leading channel partnerships and business development at several high-growth SaaS, cloud and cybersecurity companies and is most recently recognized for transforming SentinelOne’s market awareness.

I’d also like to welcome Raj Rajamani to the CrowdStrike team who also joined us from SentinelOne. Reporting to Amol Kulkarni, Raj is our Chief Product Officer for data, identity, cloud and endpoint. I’ve worked with Raj in the past, and I’m excited to have him join our team as we continue to drive disruptive innovation.

And finally, I’m extremely proud to congratulate Mike Sentonas on his promotion to President. Mike has been an invaluable contributor to CrowdStrike’s success and as President, he has responsibility for meeting the company’s product and go-to-market functions. These leadership changes are designed to drive greater focus and alignment across our key growth initiatives and enable me to spend more time with customers as we scale CrowdStrike to achieve our vision of $5 billion in ending ARR and beyond.

In summary, CrowdStrike is executing across all facets of our strategy, winning in our markets and providing customers with protection that powers them.

With that, I will turn the call over to Burt to discuss our financial results in more detail.

Burt Podbere

Thank you, George, and good afternoon, everyone.

As a quick reminder, unless otherwise noted, all numbers, except revenue mentioned during my remarks today are non-GAAP.

We delivered an exceptional fourth quarter and a strong finish to the year with $221.7 million in net new ARR, bringing ending ARR to $2.56 billion, up 48% over last year.

In the quarter, we saw strong expansion within our customer base, including an 8-figure net new ARR expansion. Ending ARR for the $1 million-plus cohort grew 57% year-over-year. We now have over 400 subscription customers with ending ARR over $1 million at an average of 10 modules.

Overall, in Q4, we landed a record number of net new customers fueled by growth in enterprise, non-enterprise and public sector accounts.

We continue to be very pleased with the success of our land and expand strategy. Our dollar-based net retention rate was above the 120% benchmark throughout the year, ending Q4 at 125.3%, which is higher than last year and on a much bigger base.

For the interim FY23 quarters, net retention was 127.6% in Q3, 127.6% in Q2 and 125.5% in Q1. Our best-in-class gross retention rate remained exceptionally strong at 98.0% as of year-end.

Subscription customers with 5 or more, 6 or more and 7 or more modules grew 52%, 62% and 75% year-over-year, respectively. Now, the respective module adoption cohorts represent 62%, 39% and 22% of subscription customers, respectively.

Given the strong momentum we have seen with our Falcon Go bundle of three modules for very small businesses, we are now excluding these customers from our module adoption metrics and have provided comparable metrics for prior periods in the investor presentation on our website.

Additionally, given the growing number of smaller end customers that we serve through our MSSP partners, which we estimate exceeds 18,000 and our downmarket bundles, as George discussed, we don’t believe that quarterly fluctuations in our new logo metric appropriately reflects the health of our business as we have discussed previously. Therefore, we are moving to reporting logo metrics on an annual basis only. We look forward to providing additional details, including the usual annual deep dive of our customer cohorts on our investor webinar scheduled for April 4th.

Moving to the P&L. Total revenue grew 48% over Q4 of last year to reach $637.4 million. Subscription revenue grew 48% over Q4 of last year to reach $598.3 million. Professional services revenue was $39.1 million, setting a new record for the 10th consecutive quarter and representing 53% year-over-year growth. This brings total revenue growth for FY23 to 54%.

In terms of our geographic performance in Q4, we continued to see strong growth in the U.S. at 44% and international revenue growth at 57% year-over-year. Fourth quarter total and subscription non-GAAP gross margins were 75% and 77%, respectively. Looking into Q1, we expect subscription gross margin to increase by up to 1 percentage point quarter-over-quarter, driven by cost optimization.

Total non-GAAP operating expenses in the fourth quarter and fiscal year 2023 were $385.0 million and $1.35 billion, respectively. Operating expenses in fiscal year 2023 were 60% of revenue compared to 63% of revenue in fiscal year 2022. In Q4, our Magic Number was 1.1, reflecting the continued efficiency of our go-to-market engine. Fourth quarter non-GAAP operating income grew 19% year-over-year to reach a record $95.6 million, and we reported operating margin of 15%.

Looking at fiscal year 2023, non-GAAP operating income growth outpaced revenue growth, increasing 81% year-over-year to reach $355.6 million and 16% of revenue, picking up 235 basis points of operating margin for the year.

As our Magic Number and Rule of 40 reflect, we have a highly efficient model. For the past three years, we have grown operating income faster than revenue, and we remain focused on continuing to drive efficiency, balancing robust growth with increased leverage.

In FY23, we took advantage of opportunities we saw in the labor market and expanded the team by 46% over last year. We are now more than 7,000 CrowdStriker strong. This gives us a significant head start to achieving our goals for FY24 and enables us to significantly moderate the pace of new hires while continuing to invest responsibly for the long term.

Non-GAAP net income attributable to the CrowdStrike in Q4 grew to a record $111.6 million or $0.47 on a diluted per share basis. Our weighted average common shares used to calculate fourth quarter non-GAAP EPS attributable to CrowdStrike was on a diluted basis and totaled approximately 240 million shares.

We ended the fourth quarter with a strong balance sheet. Cash, cash equivalents and short-term investments increased to approximately $2.71 billion. Cash flow from operations grew 71% year-over-year to a record $273.3 million. Free cash flow grew 65% year-over-year to a record $209.5 million or approximately 33% of revenue. This brings free cash flow for the year to $676.8 million or 30% of revenue.

Before I move to our guidance, I’d like to provide a few comments about how we view the ongoing impact of the current macro climate on our business and a few modeling notes.

We delivered a record Q4 and have a record Q1 pipeline. However, given continued increased budget scrutiny and elongated sales cycles, we believe it is prudent to maintain the FY24 ARR assumptions we discussed on our last earnings call that normalized the first half of the year for the current macro environment with a full year net new ARR assumption of roughly flat to very modestly up year-over-year, albeit on a higher base than expected three months ago. This would imply a low-30s ending ARR growth rate for the year.

As our guidance implies, we expect to deliver operating margin leverage for the full year with operating income growing faster than revenue. In terms of seasonality, we expect operating margin leverage to be more weighted to the back half of the year in comparison to FY23. We expect to deliver a free cash flow margin of approximately 30% of revenue in FY24. This assumes CapEx as a percentage of revenue to be between 6% and 8% for FY24 and approximately $32 million in cash outlay for income taxes compared with $12 million in FY23.

The midpoint of our FY24 non-GAAP income guidance assumes $129 million in interest income, and we expect interest expense to remain consistent with FY23. And lastly, as implied in our guidance, we expect weighted average diluted share count to increase less than 2% in fiscal 2024.

For the first quarter of FY24, we expect total revenue to be in the range of $674.9 million to $678.2 million, reflecting a year-over-year growth rate of 38% to 39% and with subscription revenue being the dominant driver of growth. We expect non-GAAP income from operations to be in the range of $107.1 million to $109.5 million, and non-GAAP net income attributable to CrowdStrike to be in the range of $121.1 million to $123.5 million. We expect diluted non-GAAP net income per share attributable to CrowdStrike to be in the range of $0.50 to $0.51 utilizing a weighted average share count of 241 million shares on a diluted basis.

For the full fiscal year 2024, we currently expect total revenue to be in the range of $2,955.1 million to $3,014.8 million, reflecting a growth rate of 32% to 35% over the prior fiscal year. Non-GAAP income from operations is expected to be between $474.0 million and $518.7 million. We expect fiscal 2024 non-GAAP net income attributable to CrowdStrike to be between $535.9 million and $580.7 million. Utilizing 243 million weighted average shares on a diluted basis, we expect non-GAAP net income per share attributable to CrowdStrike to be in the range of $2.21 between $2.39.

We look forward to sharing additional details about our business on our next investor webinar scheduled for April 4th.

George and I will now take your questions.

Question-and-Answer Session

Operator

[Operator Instructions] Our first question comes from the line of Saket Kalia of Barclays.

Saket Kalia

Hey. Good afternoon, guys. Thanks for taking my question here. George, maybe for you…

George Kurtz

Hey, Saket. Thanks.

Saket Kalia

Hey George. Maybe I’ll direct my one question to you. Very helpful customer example there of that Microsoft switch out. The numbers certainly wouldn’t indicate it, but curious if you can just talk about the general competitive environment, particularly with respect to Microsoft and how, if at all, that competitive backdrop is impacting industry pricing?

George Kurtz

Sure. Thanks, Saket. Our ASPs remain consistent. Certainly, you’ve seen what we’ve been able to do in the SMB market. And I think we’ve been very focused on that where we have run some promotions, which is where we designed the promotions to be run. But I think when you look at the competitive positioning, just as an example, in IDC’s modern endpoint security market share, as I pointed out, were 17.7%. And we gained 3.8 percentage points, which is more share gain than any other vendor, including outpacing Microsoft.

And what customers are really telling us is that Microsoft’s good enough, security is not good enough. And we’ve been winning because of our coverage across multiple operating systems, the complexity of Microsoft, 6 consoles. In fact, just today alone, they had 6 signature updates. And in January, as I call them the 3 Cs, the last one is catastrophe, during our incident response engagements, the majority of the systems that are breached are using Defender.

So, when you wrap all that together, we feel good about our competitive positioning. And again, from a pricing perspective, ASPs have remained consistent.

Operator

Thank you. Our next question comes from the line of Sterling Auty of MoffettNathanson.

Sterling Auty

So my question actually is on, George, what you touched on with SMB. I’m wondering if you can kind of go a layer deeper in terms of what you’re doing to drive the business there because that’s one area that we’ve seen some sluggishness out of vendors. What are you doing to drive the velocity in that business? And how much durability do you think that gives you?

George Kurtz

Well, we’re really excited about that segment. As I mentioned, we hired Daniel Bernard, who was at SentinelOne. He’s now our Chief Business Officer. And a big part of his remit, not only in channel and partnerships is the SMB market. You saw the partnership with Dell. We’re excited about that as an exclusive partner for the endpoint piece in their market.

And then when we think about Falcon Go, it really is a very lightweight bundle that is perfect for the SMB market, the SME/SMB. So, we can go down market. We’ve got some updates that we’ve done in our e-commerce engine to make it even more frictionless to acquire customers. And we’ve seen great adoption in those markets. And it’s not only delivering what we believe is the best technology but making it also the best go-to-market motion with our partnerships and channels.

So, we continue to focus on that. We’re still in the early innings of our SMB journey. But again, customers are wanting this. They’re telling the likes of Dell that they want our technology, which is why we were selected by Dell and more to go, but early innings and very favorable in the SMB market.

Operator

Thank you. Our next question comes from the line Joel Fishbein of Truist.

Joel Fishbein

Congrats, Mike, on the promotion. Burt, for you. Just -- you had a very tough comp this quarter, and you called out the 8-figure net new ARR expansion. Just like to get any more color on any larger deals that contributed to the quarter? And obviously, this is a big renewal quarter, how those trended as well? That would be really helpful. Thank you.

Burt Podbere

Hi Joel. Yes, we were really pleased with being able to sell an 8-figure deal into an existing client. I think in general, we were really happy with the overall mix of our $1 million-plus deals as well as our SMB. So overall, just a really well-balanced quarter, and we’re really happy with that result.

Operator

Our next question comes from the line of Matt Hedberg of RBC.

Matt Hedberg

George, a lot of great year-end metrics. I think the emerging product growth is particularly exciting. And identity really sticks out to us from what you said and what we’ve been hearing. Fast forward a year from now, which emerging product do you think we’ll look back at having the biggest incremental impact on fiscal ‘24 and why?

George Kurtz

Well, we continue to be excited about identity, as you called out. It’s a big business for us. It’s one of those modules that’s super easy to turn on this tremendous amount of competitive differentiation between what we have in a single agent and how it actually works versus our competitors, including the likes of Microsoft. So, we feel really good about that.

And then, I called out LogScale. I think that -- to have one of the largest financial institutions in the world adopt our technology, battle tested. They understand the scalability and what it’s able to do in sub-second search results, we’re incredibly excited about that.

And even the surface, which is enterprise attack surface management has been one of our fastest-growing sort of early adopter modules post acquisition. So, by and large, when you look at sort of the kind of emerging business, including cloud, great opportunities there, fantastic growth. And I think it really showcases the power of the platform.

Operator

Our next question comes from the line of Rob Owens of Piper Sandler.

Rob Owens

Building on Matt’s question a little bit, are you seeing those emerging modules as the tip of the spear as you’re seeing new customer acquisition at this point? And can you give us some color with regard to that?

George Kurtz

Sure. When we think about how a customer can come into the CrowdStrike family, it’s certainly -- the traditional way has been on the endpoint, your core modules of AV, EDR, things of that nature. But when you look at something like surface, it’s so easy to get up and running. Just you can get a trial, you can use it, you don’t have to install anything. And we see customers coming in, in various ways.

I think LogScale is another good example. Someone might have a need for a collection of data at scale and looking at the cost and expense of the current SIM and looking at this and saying, "Hey, can we give something that’s faster, better, cheaper," and they might enter that way. And then even when you think about our cloud offering, we have plenty of customers that actually come to us in the cloud first before they actually deploy us on their internal network.

So, I think we’ve got enough modules and coverage and breadth in the environment, in the marketplace that customers can get to us in various ways, depending on what their needs are.

Operator

Our next question comes from the line of Andrew Nowinski of Wells Fargo.

Andrew Nowinski

Okay, great. Thank you. Great quarter and nice recovery from last quarter, despite not seeing a real change in the macro. I just had a question on the Dell partnership. So, I thought that was really interesting. And I know you said it will help you reach SMB customers all the way up to large enterprise. But, can you give us any more color around maybe how that partnership will work? And any sort of framework for how you’re thinking about it as it relates to your fiscal ‘24 guidance?

George Kurtz

Sure. Let me take the first part of that. So when we think about what we’re doing with Dell, we’ll be on the box. So, you can check the button and it will be shipped on a box as you buy a Dell computer. We’ll actually -- Dell will have the ability to actually sell subscriptions to customers. I think they cover 96% of the Fortune 500, so large and small customers. And SMB bundle, so they actually have a device as a service, which is really interesting, and that’s a subscription service they have will be part of that. And then part of their managed service, they actually selected us to drive their managed service on the endpoint side.

So, there’s various go-to-market motions with them, which we’re really excited about. And again, I think it showcases our technology leadership in the market and the customer pull because customers have been clamoring this technology to Dell.

So Burt, do you want to talk about the outlook?

Burt Podbere

Sure. Thanks, George. Look, the partnership is just getting started. So, we have not factored that into our guidance. As with any new alliance, it does take time to ramp, but we are excited to be reengaged with Dell.

Operator

Our next question comes from the line of Tai Liani (sic) [Tal Liani] of Bank of America.

Tal Liani

Did you say Tal Liani?

Operator

Yes, sir. Please go ahead.

Tal Liani

Okay. Sorry. I didn’t hear my name. I have a few questions. So, you beat on revenues, great numbers, but gross margin was down and EBIT is kind of not above -- not much above expectations. So, is the pricing environment deteriorating? Did you have to give price concessions in order to grow faster, or is it the impact of Microsoft? Just anything about pricing and the difference between the beat on revenues and margins? Maybe, I’ll start with that.

Burt Podbere

Sure. So first, on gross margin, it’s not really about pricing. I think we expect it to fluctuate quarter-over-quarter. And as I said in the prepared remarks, we expect it to increase up to 1% in Q1. But there are a few things that are impacting gross margin in the short term, which will pay dividends in the long term.

One is we’re continuing to invest in our data centers. And as we continue to do that, that is going to impact our gross margin again in the short term, but long term, that’s what we believe is the right strategy. And second, with our acquisition of Humio, it’s not been fully synchronized. So when that does happen, that will take some pressure off of our COGS. So, those two things are really some of the drivers on the cost side. And I think as we continue to move into Q1 and beyond, we’ll be looking for more of that cost optimization. And I still strongly and firmly believe in our long-term model, which talks about our subscription gross margin going up to 82-plus-percent.

Operator

Our next question comes from the line of Hamza Fodderwala of Morgan Stanley.

Hamza Fodderwala

George, you talked about AI being nothing new in cybersecurity. Obviously, there’s a lot of focus on it these days from customers. Can you talk about how you’re equipping yourself to sort of handle this growing threat around AI? And how being on the end point gives you that strategic real estate to attack this growing opportunity in threat?

George Kurtz

Sure. Thanks. And when we think about AI, we really are one of the pioneers in AI from a security perspective. We started the Company leveraging big data AI to be able to identify threats that have never been seen before and prevent against those. We continue to build out our AI capabilities across all of our different modules with the massive data and telemetry that we collect every week. It’s mind-boggling. We can use that to continually train and learn. And our AI continues to get smarter as we put more data into the system.

So, when we think about stopping breaches, the tip of the spear really is the endpoint, the workloads. That’s where the adversaries are targeting, and that’s where they’re focused on stealing data and encrypting it and breaking in and doing damage. And I think when you look at our technology lead in this area, we’ve proven our efficacy through various testing outlets. We continue to get incredible scores. And at the end of the day, it’s really about the brand promise of stopping breaches. And AI is a massive part of what we’re able to do to implement how we stop those breaches, and it does represent a competitive advantage and moat for us.

Operator

Our next question comes from the line of Brian Essex from JP Morgan.

Brian Essex

I guess, Burt, for you, would like to dig in a little bit in terms of the levers that you see for margin expansion. I appreciate the commentary that you had on accelerated hires in 2022, and it sounded like some moderation in 2023, but you’ve already hit free cash flow margins of about 30% on operating margins of about 15%. As we kind of model out and fine tune our models over the next few years, how should we think about the levers that you have for better operating profitability and cash flow? What should the spread between the two be? And how should we think of -- obviously, you’ve consistently been conservative. But just want to understand how you’re thinking about the spend versus growth and prioritization given the success that we’ve seen so far with the margin expansion? Thank you.

Burt Podbere

Yes, great question. So number one, we’re going to continue our balanced approach to supporting our rapid growth at even our greater scale with profitability. I think it’s always going to be a slider and I think we’ve done a great job in being able to manage that growth, not at all cost, but with a realized at the bottom. I mean, operating at a Magic Number above 1 and a rule of 81 on a free cash flow basis are best in class. And we’re excited about being able to continue to monitor that and watch that.

Look, I think we posted record operating income in Q4 and FY23, growing operating margin to 16% for the year. I think that -- what we talked about last quarter with respect to our hiring and our pace of hiring, we’ve taken a really solid approach about moderating the pace of hiring for this year. And I think that it goes to watching how and who we’re hiring with an increased eye to making sure we’re hiring the best. And for us, that really matters, and we’re going to get the results that we want to get by doing that.

Operator

Our next question comes from the line of Gabriela Borges of Goldman Sachs.

Gabriela Borges

So, I’d like to ask you the rate of change question on the budgeting environment. Last quarter you gave a statistic on deals taking 11% more [ph] to close. So looking for a quantitative update there. And then any qualitative overlay either from yourself -- or from you George on what you’re sharing from customers, I’m willingness to spend an endpoint in 2023 versus maybe what they were expecting 90 days ago? Thank you.

Burt Podbere

Hi Gabriela, it’s great to hear your voice. So first, deals did take longer to close this quarter. We did see that and we do anticipate to see those headwinds continue throughout next year. And for us, as we think about next year, our thoughts are consistent with what we said last quarter. I’ll turn it over to George.

George Kurtz

Yes. In terms of modernizing their security stack, I think that’s front and center. There isn’t a CIO that I haven’t talked to that doesn’t want to consolidate their hodgepodge of technologies out there. And again, that goes beyond just endpoint, right, in terms of the things that we offer and the capabilities and the outcomes.

And if you think about the endpoint market itself, as we talked about, the IDC numbers, were 17.7%, there’s a lot more to go, right? There’s still a massive, massive amount of legacy technology that’s out there. And again, customers are looking to really take a modern platform approach and consolidate their spend.

So, it’s been something that customers are not looking to just stick with what they have and breaches are not getting any better. They’re getting worse, threat actors are being more sophisticated and it’s going to require better protection with a better outcome.

Operator

Our next question comes from the line of Brian Colley of Stephens.

Brian Colley

So, I’m curious on the XDR front, if you’ve seen an acceleration in XDR adoption since you introduced Falcon Insight XDR and new pricing strategy there. And then also wondering if you could kind of share what the average ARR or ASP uplift has looked like from those customers that have implemented an XDR strategy.

George Kurtz

Yes, sure. So, we haven’t given that level of information now specific to XDR. So I can’t comment on that. But when we think about XDR, I think as an industry, it’s still in the early innings. We’re of course, one of the pioneers of EDR. We’ve extended that out into XDR with the integrations. I think we’ve got some incredible partners that we’re flowing data into the CrowdStrike platform and being able to make advanced decisions on whether something is good or bad across multiple platforms including CrowdStrike and it’s been well received so far, but still in the early innings.

Burt Podbere

I’d just add that we are seeing great early traction.

Operator

Thank you. Our next question comes from the line of Ittai Kidron of Oppenheimer.

Ittai Kidron

I was hoping I could get some more color on the SMB. Clearly, it’s a very big opportunity for you then -- and with the Go bundles you’re doing --off to a very good start there. But maybe as a point of reference, can you tell us how much of your revenue or ARR is concentrated in that tier? How do you -- how much do you think -- where do you think that can go within a year’s time?

And also, Burt, specifically on the dollar retention rate, I can’t imagine that the expansion opportunity with those type of customers is similar to that any of enterprise customer. So, how do I think about the impact of those -- of the growing mix of those type of customers on the dollar based retention rates?

Burt Podbere

So look, we’re really excited about our SMB space. George talked about Daniel Bernard coming on board. We think we’ve got great products for them to come in and to expand. It’s not just limited to our enterprise, although certainly the MBR [ph] is going to be driven by our enterprise customers.

For dollar based and retention, as I think about next year, I think we’re going to see slightly more net new ARR coming from expansion deals than net new ARR coming from new logos. I think that we’ve got this incredible base of 23,000 subscription customers today, and we can certainly continue to add more modules to their security stack and continue to delight them. So, that’s how we think about the splits.

Operator

Our next question comes from the line of Patrick Colville of Scotiabank.

Patrick Colville

Hey. This is Patrick Colville from Scotiabank. My question is about net cash. You guys have about $2 billion of net cash on the balance sheet. We saw CRM, we saw Workday and just last week, Snowflake announced buyback programs. Do you think that’s something that you guys might consider on a go-forward basis to limit dilution in calendar 2023 and beyond?

Burt Podbere

Yes. Look, we will evaluate every quarter that proposition. So, I think that’s just a quarter-by-quarter decision that will come up. But we do look at it. We do look at what’s happening in the environment. There are many factors that would go in to decide whether we were going to do something like that. So, it’s really on a quarter-by-quarter basis where we would do the evaluation.

Operator

Our next question comes from the line of John DiFucci of Guggenheim.

John DiFucci

George, I sort of have a follow-up to several of the questions there. It has to do with the enterprise versus the mid-market and new logos versus add-on sales. I mean, I would think like it’s a lot tougher to sell to new logos in this macro backdrop, especially in enterprise, but you obviously sold a lot of new logos this quarter, and it sounds like a lot to the mid-market and SMB. I guess, can you remind us how you think a typical mid-market customer or SMB customer? Will they eventually buy as many modules as enterprises? I could see how they could, because -- since it really makes security easier for them -- to have an integrated solution. But then again, it’s tough to say. I mean, the mid-market customers are typically much less sophisticated buyers of IT. Just curious your thoughts there.

George Kurtz

Sure. So, let’s think about this on a worldwide basis. The mid-market customer in the U.S. is much different than a mid-market customer in APAC, as an example, right? So the sizing is quite different. But when you think about sort of non-enterprise customers, they still have all the same problems. These are billion-dollar companies that have one IT person -- two IT people, half a security person. And we think that’s a perfect opportunity for Falcon Complete, where we can sell them multiple modules. We’ve added now identity into Falcon Complete, end-to-end, we can service that account and basically take a lot of the burden away. In a challenging macro environment they’re getting more headcount, but they still have a great risk from a security perspective, so. And that’s the mid-market all the way down to SMB. We have very small companies that are Flacon Complete customers.

So, if they can’t quite digest everything that we have, that’s okay. What they’re buying is an outcome, and our outcome is stopping the breaches, reducing complexity and lowering their overall cost. And that is resonating with customers as we consolidate in this challenging macro environment.

Operator

Thank you. I would now like to turn the conference back over to George Kurtz for closing remarks. Sir?

George Kurtz

Great. I want to thank all of you today for your time. We certainly appreciate your interest and look forward to seeing you at our upcoming investor webinar. Thanks so much. And we’ll see you soon.

Operator

This concludes today’s conference call. Thank you for participating. You may now disconnect.