CrowdStrike: Sustainable Data Advantage

CrowdStrike's (NASDAQ:CRWD) product strength and go-to-market efficiency continue to hold the company in good stead, even in a deteriorating macro environment. While investors are generally focused on near-term uncertainty, CrowdStrike's growth at scale and improving margins are worthy of a premium valuation. The next 1-2 years may remain volatile, but CrowdStrike is highly likely to continue taking market share in the long-run and will be highly profitable when the company stops investing in growth.

Market

CrowdStrike stated that the demand environment was resilient in the first quarter of FY2024. Deal scrutiny remains elevated and sales cycles are longer than usual, particularly for larger deals. Despite this, CrowdStrike’s pipeline is strong, and the company is seeing momentum in consolidation deals. While CrowdStrike is clearly facing headwinds due to the macro environment, this commentary is fairly positive in comparison to many SaaS companies.

CrowdStrike

CrowdStrike’s strong performance in a difficult market is likely being driven in large part by its newer products, like LogScale and Cloud Security. Indexless ingestion is a potentially important differentiator for CrowdStrike, providing a fast, cost-efficient and scalable solution. CrowdStrike and SentinelOne (S) are both taking an indexless approach to managing security data. With index-free logging, data is stored in buckets, which are labeled with information that enables the query engine to decide if data should be included or not. Indexless approaches eliminate data schema requirements from the ingestion process and index limitations from querying. This is beneficial for unstructured data and enables faster results at a fraction of the cost compared to traditional approaches.

Within cloud, CrowdStrike believes that the integration of agent and agentless technology is an important differentiator. Other approaches include:

• Palo Alto (PANW) primarily uses an agent-based approach
• Wiz takes an agentless approach, believing that APIs provide the necessary visibility
• SentinelOne’s Linux eBPF agent architecture captures process-level telemetry with no kernel interference, potentially proving greater stability and resource efficiency

Charlotte

Charlotte is a recently introduced SOC assistant that leverages generative AI to lessen the learning curve for security analysts. This could help to drive faster results, better security outcomes and lower costs for customers.

This type of technology will likely soon be table stakes, but CrowdStrike potentially has a data advantage. CrowdStrike has over 10 years of attack data, its threat graph and continuous human feedback from OverWatch, Falcon Complete and its Intel teams. Even if LLMs become a commodity, this data could allow Charlotte to outperform comparable services, like SentinelOne’s Purple AI.

While data is often believed to confer companies with a sustainable competitive advantage, this may not always necessarily be the case. Data generally has diminishing marginal returns, meaning that companies with access to smaller datasets can potentially catch up to competitors over time, unlike if value were to accumulate linearly or exponentially with the volume of data. In addition, the cost of generating unique data which continues to create value generally increases over time, as most new data will simply replicate existing data.

In cybersecurity applications, the nature of threats changes over time, meaning that past data becomes stale and access to a constant source of new data is imperative. Although the value of data may not scale exponentially, new data is likely to continue to hold significant value, making it more likely that access to the largest dataset will confer a strategic advantage. In addition, cybersecurity applications are also likely to have a long tail of critical data, and the ability to collect data from this long tail is likely to confer a strategic competitive advantage.

OT Security

OT Security is a 10 billion USD opportunity and a potential growth area for CrowdStrike. Management recently stated that CrowdStrike is deployed in a lot of IoT use cases.

OT devices mostly interact with other machines, such as Industrial Control Systems. Their purpose is to ensure that the ICS assets are operating correctly and meet the high availability and uptime requirements of these devices. In the past OT systems have often been air gapped, but IoT is changing this, necessitating some form of protection. Most OT devices have limited computing power and run older OSs, complicating protection. Use of endpoint protection has also been limited by concerns that endpoint technology could interfere with plant systems.

CrowdStrike believes that IoT is driving the adoption of more homogeneous OT systems, supporting the adoption of endpoint protection. The company's lightweight agent should be able to deliver visibility and protection, which can be supported with vulnerability management.

IL5

CrowdStrike was recently granted Impact Level 5 Provisional Authorization from the US DoD. A range of DoD unclassified National Security Systems can now deploy CrowdStrike’s platform to protect data, which will allow CrowdStrike to expand its Defense and Intelligence business. IL5 is the highest level of authorization granted to controlled, unclassified information.

Partners

CrowdStrike is extending its endpoint leadership position into the partner ecosystem, which should help the company increase penetration of SMBs. The company has seen some success with Falcon Go amongst SMBs, but still needs to ramp distribution through channel partners.

Of the top 25 MDR vendors, 88% have built their MDR services on top of the Falcon platform. CrowdStrike also recently entered into a strategic partnership with Pax8. Pax8 has over 30,000 MSP partners globally that serve the SMB market, which should help CrowdStrike displace legacy AV and Next-Gen vendors.

CrowdStrike's partnership with Dell is yet to really gain traction, but should be a source of growth amongst SMBs in time. The partnership aims to deliver the Falcon platform to Dell customers. Dell customers can receive an entitlement for CrowdStrike with their Dell purchase, Dell sellers will also be incentivized to sell Falcon subscriptions, CrowdStrike can also be included as part of a device-as-a-service rental package or as part of a managed cybersecurity service.

Competition

CrowdStrike is the clear leader in endpoint security, and competition has never really been a large concern. CrowdStrike's ability to drive strong expansion within existing customers in a difficult market, even as its customer base matures, indicates the company is having success in newer areas like SIEM, cloud security and identity.

Microsoft is often considered a serious threat, but Microsoft’s advantage lies in its relationships and ability to bundle products, rather than the strength of its security products. CrowdStrike’s win rates against Microsoft are high, and CrowdStrike believes it can demonstrate better technical and financial outcomes for customers. CrowdStrike reportedly beats Microsoft 80% of the time, and win rates against other competitors were strong in the first quarter.

Financial Analysis

The macro environment is clearly impacting CrowdStrike’s growth, but the company is still generating robust growth at scale. Revenue growth in FY2024 is expected to be 34-35% YoY.

Growth continues to come from a solid mix of new customers and expansion within existing new customers. CrowdStrike’s DBNRR remained above 120% in the first quarter, driven by customers adopting a greater number of modules. Over 50% more deals involving eight or more modules were closed in the first quarter compared to a year ago.

The number of job openings mentioning CrowdStrike in the job openings has continued to edge up in recent months, which could indicate that end market demand is solid.

CrowdStrike is also driving gross profit margins higher across both subscriptions and services. This is likely in large part due to a greater focus on costs, but also suggests that pricing is stable.

Operating profit margins haven't changed significantly over the past few years, but a moderation in investments and continued growth should begin to yield gains going forward.

The number of CrowdStrike job openings has declined over the past few months, which should support margins going forward, but also suggests that the demand environment is still weak.

Valuation

It is easy to take a cursory look at a company like CrowdStrike and believe it is significantly overvalued and cannot generate GAAP profits. An understanding of the company's competitive position, market opportunity and unit economics suggests that the stock will do well over the long run.