While Big Tech is seeing weak price action following capex estimates for 2026, Cloudflare’s earnings report is being met with enthusiasm. Rather than competing with hyperscalers head-on, the company is taking a different route by offering an edge network where latency, global reach and lower costs matter more than compute and scale.  

Key metrics are suggesting an important inflection is underway, which was a theme from our coverage last quarter. Cloudflare reported the strongest revenue growth since Q1 2023. The company’s Q4 revenue grew by 33.6% YoY and 9.3% QoQ to $614.5 million, beating estimates by a solid 3.9%. The company’s Q1 revenue guide also beat estimates by 1%.   

The company reported a record new annual contract value (ACV) in Q4, which grew by nearly 50% YoY and was the fastest growth rate since 2021. Q4 remaining performance obligations (RPO) grew by 48% YoY and was the fastest growth rate since June 2022. Similarly, paying customers grew by 40% YoY and accelerated by 7 percentage points from 33% growth in the previous quarter. Notably, active developers on the Workers platform grew by 50% YoY to 4.5 million.  

Faster and Cheaper for Inference compared to Hyperscalers 

Cloudflare has strong positioning at the network edge for handling connectivity, security and real-time edge execution – all needed for the inference stage of AI. Therefore, companies are layering in and adding Cloudflare while also remaining with hyperscalers, which specialize more in compute and perform better in certain regional zones.  

Many of the wins that Cloudflare highlighted in the opening remarks are from customers that use the Big 3 yet still chose Cloudflare for its time-to-deployment advantages and easier billing structure.  

Here is how management described it: “The hyperscalers are in the business of buying machines and then renting them back so that they basically get 5x what they paid for them over the course of their useful life. And again, it's a great business for them, but it's not the business that Cloudflare is in. Cloudflare is in the business of getting work done. And so what we are constantly doing is having research teams inside of Cloudflare figure out how you can run AI workloads significantly more efficiently. The hyperscalers is actually have no incentive to do that. They don't want AI workloads to be more efficient because that just means you have to lease fewer machines from them. Whereas we — because we only charge you for the actual work that's getting done, that means that we're just getting oftentimes as much as 10x the amount of work off of the same GPU that you might get with a hyperscaler. That advantage is part of how we're able to just bring much more out of the CapEx that we spend than others are.” 

Over two years ago, I wrote a deep dive on Cloudflare entitled “Bringing AI Inference to the Edge.” The analysis connected important dots on how Cloudflare attracts business despite the highly competitive arena of cloud infrastructure. Here’s an excerpt: 

“With Cloudflare’s serverless approach, developers pay for the Javascript runtime once, and then are able to run more scripts without additional costs […] Cloudflare eliminated cold starts entirely with its Workers platform. There are a few milliseconds where Cloudflare can have Workers runtime load a hostname before a TLS certificate is sent back and the original encrypted request is sent. By the time the HTTPS protocol is ready to send secure data between a browser and a website, Cloudflare has the Worker runtime warm. This means Worker executes code the minute the request is received. 

What’s crazy is that Cloudflare rolls out features that exceed hyperscaler performance at minimal cost. It is this combination of competing with the hyperscalers, delivering app performance at faster speeds — while keeping prices low — that is unique to Cloudflare.” 

The advantages pointed out in the October 2023 analysis as to how combining a CDN, reverse proxy, zero-trust and a serverless platform can lead to strong edge performance was echoed again tonight with management stating: “Despite an incumbent offering significant discounts to keep the business, this customer chose Cloudflare because of our next-generation architecture and workers' developer platform, which allowed them to customize their edge traffic. We didn't just replace 3 incumbents we replaced a legacy mindset proving once again that when you give developers the best tools, the entire enterprise follows.” 

Flywheel driven by AI Agents 

Cloudflare’s CEO buried the lead a bit in the opening remarks, finally stating what is perhaps the most important element to his quarter’s beat: AI Agents. Although the key metric was provided for January, it’s clear that Cloudflare is seeing a strong inflection: “Over the month of January alone, the number of weekly requests generated by AI agents more than doubled across the Cloudflare network. This is driving increased demand for our whole platform.” 

According to management, this creates a “virtuous flywheel” as more agents drive more code execution on their Workers Platform, which in turn, drives more demand for their security products and networking services. 

AI agents also drive sheer infrastructure consumption for Cloudflare as agents look at many more sites and are always-on – which leads to more overall usage.  

Here was some commentary from the earnings call: 

“You've got a bunch of the agents of the world that are interacting with the Internet and they're interacting with it at a volume that we've just never seen before. And that's just driving more need for what are classically Cloudflare’s services. So the fact that more than 20% of the Internet sits behind us means that the agents have to interact with us, which means we have a seat at the table in defining exactly what the rules and the rails and the guardrails of the future of agentic commerce is going to look like; and be, and we are sitting in the middle of that.” 

How Capex Compares to Hyperscalers 

Cloudflare’s model is less capital intensive because the edge network architecture shares infrastructure across many workloads. Therefore, their servers don’t sit idle. Another major difference is that Cloudflare charges for execution, rather than pricing based on customers' reserving capacity, which results in optimized runtimes and higher utilization.  

The latency sensitive, short bursts that inference needs is well aligned with Cloudflare’s shared edge infrastructure and execution-based pricing. The higher utilization also avoids the very high capex burden associated with reserving GPUs per customer. 

Although Cloudflare’s operating margin is ticking down, capex relative to revenue growth is better than hyperscalers. The company’s Q4 capex grew by 14.3% YoY to $91 million. Microsoft’s capex in Q4 grew by 65.9% YoY to $37.5 billion in Q4. While, Microsoft’s Q4 revenue grew by a mere 16.7% YoY to $81.2 billion. Cloudflare’s Q4 revenue grew by a stunning 33.6% YoY to $614.5 million. Capex as a percentage of revenue was only 14.8% for Cloudflare compared to 46.1% for Microsoft.  

Cloudflare’s Q4 operating cash flow grew by 49.6% YoY to $190.4 million with an operating cash flow margin of 31%, up 3 percentage points YoY. Similarly, free cash flows grew by 108% YoY to $99.4 million with a free cash flow margin of 16%, up 6 percentage points YoY. 

The company had cash and available-for-sale securities of $4.1 billion, while convertible senior notes outstanding were $3.27 billion at the end of Q4 2025.

Financials 

Q4 Revenue Growth of 33.6% 

Cloudflare reported the strongest revenue growth since Q1 2023. The company’s Q4 revenue grew by 33.6% YoY and 9.3% QoQ to $614.5 million, beating estimates by a solid 3.9%. Revenue growth accelerated 2.9 percentage points from 30.7% growth in Q3 and was primarily driven by strong AI demand for its services, particularly from its enterprise customers. The company guided Q1 revenue of $620 million to $621 million, implying a YoY growth of 29.5% YoY and 1% QoQ and beating estimates by 1%.  

The company’s co-founder and CEO Matthew Prince highlighted the strong AI demand in the earnings call. “We are seeing the shift to AI and agents drive more demand for Cloudflare services. What we're witnessing is a fundamental replatforming of the Internet. AI is driving a paradigm shift in how software is both created and consumed, and that is turning out to be the biggest tailwind for Cloudflare's network and Workers developer platform.  

If you look at the last 30-plus years of the Internet and software ecosystem, they were built for human consumption, people in seats and clicks. Now the agentic Internet is emerging, and we can already see its trends. If humans looked at 5 sites when they were making a decision, agents might look at 5,000.” 

The company 2025 revenue grew by 29.8% YoY to $2.17 billion. Management provided a strong 2026 revenue guide of $2.785 billion to $2.795 billion, implying a YoY growth of 28.7% and beating estimates by 1.8%. 

Key Metrics Strengthen, Aided by Enterprise Transition 

Cloudflare reported a record new annual contract value (ACV) in Q4. Matthew Prince said in the earnings call, “We blew away our previous record for new ACV in the quarter, with strong year-over-year and quarter-over-quarter acceleration. In Q4, new ACV book grew nearly 50% year-over-year, making it not only a record quarter in absolute ACV dollars but also the fastest growth rate we've delivered since 2021.” 

Cloudflare signed the largest annual contract in the company’s history of $42.5 million and management attributed the success to the company’s go-to-market sales strategy. Some of the other customers win this quarter include a leading AI company expanding their relationship with Cloudflare, selecting Cloudflare as their single long-term infrastructure provider with 100% traffic allocation. Another leading AI company expanded their relationship with Cloudflare, signing a 1-year $5.4 million contract for the Workers developer platform and application services. A Fortune 100 technology company expanded their relationship with Cloudflare, signing a 3-year $5.8 million contract, representing a notable upsell from their initial engagement with the company in mid-2025. While a Fortune 500 technology company expanded their relationship with Cloudflare, signing a 2-year $45 million pool of funds contract. 

RPO growth of 48% YoY, fastest since June 2022 

Q4 remaining performance obligations (RPO) grew by 48% YoY and 16% QoQ to $2.496 billion, accelerating from 43% YoY and 8% QoQ growth in Q3. It was the fastest growth rate since June 2022. Current RPO was 63% of total RPO and grew 34% YoY. 

Customers Grew by 40% YoY 

Q4 total customers grew by 40% YoY and 12% QoQ to 332,466. Customer growth accelerated by 7 percentage points from 33% growth in Q3 and 10% QoQ. The company is witnessing a transition from the free tier to small paid accounts, particularly for the developer platform products. 

Cloudflare’s enterprise cohort, or customers contributing >$100K ARR grew by 23% YoY to 4,298. Revenue contribution from large customers was 73% of revenue during Q4, up from 69% in the fourth quarter last year. Revenue from large customers grew by 41% YoY and 9% QoQ to $448.6 million in Q4. 

The company’s largest customers (spending over $1 million) grew by 55% YoY to 269 and added a record of 96 $1 million-plus customers in 2025.

DBNRR of 120% 

The company’s continued significant expansion with the largest customers drove an acceleration in the Dollar-based net retention rate (DBNRR) to 120% in Q4, up 1% sequentially and 9% YoY. It was the highest rate since Q4 2022. 

Q4 Billings Growth of 27% 

The company’s billings grew by 27% YoY and 11% QoQ to $694.9 million. Among the key metrics, billings growth was blemish as it decelerated from 40% YoY and 12% QoQ growth in Q3. 

Margins 

Q4 gross profits grew by 28.8% YoY to $452.5 million. Adjusted gross profits grew by 29% YoY to $460.18 million with an adjusted gross margin of 74.9%, down 270 basis points YoY and 40 basis points sequentially due to higher network expenses from the increase of paid customer traffic.  

Q4 operating loss was ($49.2 million) compared to ($34.7 million) in the same period last year. Adjusted operating income grew by 33.3% YoY to $89.6 million with an adjusted operating margin of 14.6%, which was flat YoY and down 70 basis points sequentially and beat the guidance by 40 basis points. Management Q1 guide is 11.4%. The company reported $132.4 million in stock-based compensation in Q4, which explains the difference between GAAP and non-GAAP operating income.

Q4 net loss was ($12.1 million) compared to ($12.8 million) in the same period last year. Q4 adjusted net profit grew by 55.2% YoY to $106.8 million or 17.4% of revenue compared to 15% in the same period last year. 

Q4 Adjusted EPS grew by 47.4% 

The company’s Q4 adjusted EPS grew by 47.4% YoY to $0.28, beating estimates by 3.2%. GAAP EPS was in line with estimates of ($0.03) compared to ($0.04) in the same period last year. 

Management Q1 adjusted EPS guide of $0.23 was lower than the estimates of $0.25. However, it implies a YoY growth of 43.8%. 

Conclusion: 

The quarter combined accelerating growth, improved profitability and enterprise deal flow to help support our multi-year thesis that Cloudflare’s distributed edge architecture offers a unique advantage for AI inference workloads. 

Agent-driven traffic is growing faster than human-driven usage, generating orders of magnitude more requests. This dynamic creates a powerful flywheel: more agents drive more Workers execution, which in turn increases demand across Cloudflare’s security and networking stack. Unlike prior growth cycles tied to seats or licenses, this model scales directly with usage. 

As we patiently wait for the inference stage to arrive, Cloudflare will benefit – not by outspending hyperscalers on capex, but by extracting more value from every layer of internet traffic that flows through its network.

Royston Roche, Equity Analyst at I/O Fund contributed to this article.

Please note: The I/O Fund conducts research and draws conclusions for the Fund’s positions. We then share that information with our readers. This is not a guarantee of a stock’s performance. Please consult your personal financial advisor before buying any stock in the companies mentioned in this analysis.

Recommended Reading:

• Astera Labs Q4: Solid Beat, but Q1 Margin Guide is Soft
• Reddit Q4: Unwavering Fundamentals; Change in User Reporting Metrics
• Bloom Q4: $20B Backlog, Guides for 58% Revenue Growth
• Coherent Fiscal Q2: Strong Visibility for Back-Half of 2026 and Beyond

Cloudflare beat on the top and bottom lines in Q3, although net retention rate softened again. The company missed on revenue expectations for Q4 with management guiding for a midpoint of $451.5 million, for growth of 24.6% compared to analyst expectations of $455.08 for growth of 25.8%. Management spoke at length about being at an inflection point for a sales organization shift, yet this felt like a speculative discussion as evidence of an inflection was not visible in the Q4 guide.

Key metrics were mixed and revenue growth is getting further away from the coveted 30% mark with a 4-point deceleration in Q4. Yet RPO and customer growth remains persistently strong.

Revenue

Cloudflare reported revenue of $430.1 million in Q3, increasing 28.2% YoY, slowing from the 30.0% YoY increase reported in Q2. Revenue growth had been expected to be steady at ~26% YoY for the next few quarters, which is quite strong for best-of-breed cloud as many >40% revenue growth cloud companies have dipped <20%.

However, Cloudflare guided to just 24.6% YoY growth in Q4, seeing revenue between $451 million and $452 million, shy of the estimate for $455.8 million. This implies a sequential deceleration of ~3.6 points.

For FY24, management slightly raised its guidance, though it seems as if the raise stemmed solely from Q3’s outperformance relative to its initial guide. Cloudflare now sees FY24 revenue of $1.661 to $1.662 billion, a raise of just $3.5 million at the midpoint from its prior view for $1.657 to $1.659 billion. Q3’s $430.1 million sum beat management’s internal guidance by ~$6.5 million, implying that it is the primary factor behind the raised guide given Q4 was a miss.

Margins

Cloudflare reported strong adjusted operating margin of 14.8%, which led to raising its adjusted operating margin guide for FY24 to 13.3%, up from last quarter’s FY24 guide of 11.9%. GAAP operating and net margins continue to make slow progress towards positive territory due to high stock-based compensation of 20.5%.

• GAAP gross margin was 77.7%, down slightly from 77.8% in Q2 but up 1 point from 76.7% in the year ago quarter. Adjusted gross margin was 78.8%, down from 79.0% in Q2 but up slightly from 78.7% in the year ago quarter.
• GAAP operating margin was (7.2%), improving from (8.7%) in Q2 and (11.7%) in the year ago quarter. Adjusted operating margin was 14.8% in Q3, well above the 11.9% guided and improving from 14.2% in Q2 and 12.7% in the year ago quarter.
• For Q4, management guided adjusted operating margin of 11.9%.
• For FY24, management guided for adjusted operating margin of 13.3%, a strong increase from 9.8% at the beginning of FY24 and its previous guide for 11.9% given in Q2. The increased guide is driven by Q2 and Q3’s outperformance, with both quarters seeing adjusted operating margin >14%.
• GAAP net margin was (3.6%), improving slightly from (3.8%) in Q2 and (7%) in the year ago quarter. Adjusted net margin was 16.9%, falling from 17.3% in Q2 but up slightly from 16.5% in the year ago quarter.

EPS

For fiscal year 2024, Cloudflare is expected to report EPS growth of 51% YoY to $0.74. Cloudflare beat slightly on EPS in Q3, while guiding for flat QoQ growth for adjusted EPS for Q4.

Cloudflare is close to GAAP profitability yet it’s not clear given stock-based compensation when the company will tip over the edge. The stated in the investor’s presentation the long-term goal is a 20% adjusted operating margin, which implies GAAP profitability would be narrow, yet achievable. Notably, there is no firm date being provided.

• GAAP EPS was ($0.04), flat QoQ and up from ($0.07) last year.
• Adjusted EPS was $0.20, beating estimates and Cloudflare’s guide for $0.18. This was also flat QoQ and up 25% YoY.
• For Q4, management guided for adjusted EPS of $0.18. For FY24, based on the slight beat in Q3, management raised its adjusted EPS guide to $0.74, up from its previous view for $0.70 to $0.71. This represents YoY growth of 51%.

Cash and Balance Sheet

Cash flow generation remained steady in the quarter as cash flow margins expanded sequentially.

• Operating cash flow was $104.7 million in Q3, for a 20% margin. This improved from a 19% margin in both Q1 and Q2.
• Free cash flow was $43.7 million, for an 11% margin, an improvement from 10% in Q2 and 9% in Q1. The company stated its goal is a 25% FCF margin.
• Cash and available-for-sale securities totaled $1.824 billion while convertible notes totaled $1.286 billion.

Cloudflare’s free cash flow is especially impressive given the company has to build a bigger network and invest in GPUs for edge AI.

“Network CapEx represented 10% of revenue in the third quarter. During the quarter, we saw a notable shift in customer conversations and buying behavior from AI training to AI inference, including our first multimillion dollar workers AI contract. 

This gives us confidence to continue to increase our investment in higher-end GPUs as well as the breadth of our GPU rollout as we provision greater capacity to support demand in 2025. As. A result, we continue to expect network CapEx to increase again in the fourth quarter to reach 10% to 12% of revenue for the full year 2024.”

Key Metrics:

RPO

RPO came in at $1.53 billion for growth of 39% year-over-year and up 6% sequentially. This is higher than the year ago quarter when RPO was at 30% YoY and up 5% sequentially.

Compared to last quarter, RPO reported growth of 37% year-over-year and 6% QoQ, for 69% of total RPO, which means this was technically a stronger quarter on this key metric.

DBNRR

Cloudflare’s DBNRR dropped again in Q3, falling to 110%, compared to 112% in Q2 and 115% in Q1. Throughout 2023, DBNRR hovered around 115% and higher, so the decline over the past two quarters is important to watch. This quarter, management reiterated the decline is being driven by slower net expansion in the larger customer cohorts as they move to “pool of funds” contracts, which shifts billings from annual contracts to pool of funds accounts that are on a monthly basis for three or more years (for larger customers).

Per management again this quarter:

“Our dollar-based net retention was 110%, down 2 percentage points quarter-over-quarter. While customer churn remains consistently low, our shift to more pool of funds deals with our largest customers, which represented nearly 10% of new ACV booked in the quarter, up from 1% a year ago has put downward pressure on dollar-based net retention and change the shape of revenue recognition in the short term. 

Over the long term, however, we believe pool of fund deals are very positive for the business as they represent our largest customers making a broad commitment to Cloudflare's overall platform.”

Customers

Paying customers increased 22% YoY to 221,540, accelerating from 21% in Q2 and 17% in Q1. Management stated on the call they count 35% of the Fortune 500 as customers.

For customers with >$100K ARR, growth decelerated 2 points sequentially to 28% YoY to 3,265 customers. This cohort accounted for 67% of revenue in Q3, flat with Q2 but up from 65% last year. Management pointed out that the 28% resulted in a record addition 219 large customers, referring to the growth remaining high even on a larger base of customers.

Billings

Despite other metrics such as >$100K ARR customers and DBNRR decelerating, Billings accelerated sequentially in Q3. Billings increased 24% YoY to $447.3 million, a 1-point acceleration from 23% growth last quarter.

Earnings Call:

Net Retention Rate; New Sales Org

The tone on the earnings call was more of a “wait and see” tone about the new sales organization reaching an inflection point. On one hand, we are seeing strong total customer growth and billings inflect. Yet, on the other hand, Cloudflare is asking investors to place their trust in the company on the “pool of funds” deals that are causing a rapidly decelerating net retention rate.

What investors should keep in mind is that management is foreshadowing the mixed key metrics could last for a few quarters as current customers shift to the new billing terms: “As we mentioned last quarter, we expect new customers to contribute a higher percentage of our overall year-over-year revenue growth for the next several quarters.”

There was also a note that larger deals were pushed back, yet the miss in Q4 doesn’t inspire confidence they were pushed back only by a quarter: “However, some larger deals slipped out of the quarter in the U.S. in particular, during what was a transitional period under new sales leadership in that region. These deals are still active in our pipeline with many having already closed this quarter.”

The company discussed being at an inflection point, yet as an investor, I prefer more evidence of this with revenue growth inflecting, as well (which did not happen): “All the changes in our sales force may have impacted the short-term cadence of some larger deal cycles. What stood out to me is that the third quarter felt like we hit the inflection point in the rebuild of our go-to-market team.”

However, when pressed, management remained confident it was truly an inflection point. My best guess is the inflection will catch up to revenue perhaps by Q2 given the note it’s a few quarters out.

Timothy Horan   Oppenheimer & Co. Inc.

There's a lot of moving parts, obviously, with the sales productivity and limited capacity there in the pooling. Can you maybe talk about the timing of when revenue growth can accelerate again. Do you think the fourth quarter around 25% guide, is that the bottom? Or do you think it's still a few more quarters out? And related to this, can you update us on what you think the timing of for the $5 billion revenue target that you have? And I had a quick product follow-up.

Thomas Seifert   CFO

Yes. Thank you for the question. As we said before, for us, in our subscription business model, revenue is very much a lagging metric. Sales capacities is a product of the amount of headcount we have and the productivity progress they are making, this translates into pipeline and sales prospects, turns into ACV and then ACV is recognized ratably over the lifetime of the contract as revenue. So it's very much a lagging indicator. And as we said before, models like this, there are slow on their way down, but they're also slowing their way up. 

But the important part is, as you heard in Matthew's prepared remarks that we think we have reached this key inflection point with net sales capacity now, which is the leading growth indicator have been patent. So from there on, we expect sales activity translating the ACV moving forward and going up. And you see this already in those parts of the world where this conversion and transition has happened successfully. Revenue was up 38% already in APAC, and it was up 1% in Europe, which is our highest productivity region has been over the last several quarters. So we think we have bottomed out from a net sales capacity perspective, and move forward from there.”

Capex Spending and Edge AI

Cloudflare has offered visibility in capex spending plans as it builds out GPU-powered edge servers for AI inferencing purposes. This involves large orders of GPUs, to which Cloudflare made it quite clear they are able to work with any hardware on the market and at a high utilization rate.

Given Cloudflare may one day become a leading AI stock, discussions around the AI market are provided for future reference as we along, especially given there is no official AI revenue number being reported by Cloudflare today.

Per the company, there has been progress: “During the quarter, we saw a notable shift in customer conversations and buying behavior from AI training to AI inference, including our first multimillion dollar workers AI contract.”

Notably, there was not an update to the Workers key metric of 2.4 million developers this quarter.

The discussions around one of Cloudflare’s key value propositions was the following:

“And in order to support that, we have made the investments to increase not only just the number, but also the power of the GPUs that we're deploying around the world. What I think is unique about Cloudflare is 2 things. One, we are actually able to deliver inference incredibly close to where anyone is on earth because we've deployed the inference capabilities across at this point, nearly all of our network. 

But in addition to that, we've actually done the work to get higher utilization out of those same GPU resources where what we see when we survey customers that are trying to manage this themselves, through hyperscale public cloud is that they're getting utilization rates that are sort of in the 5% to 10% range of the resources that they're buying.

We're able to deliver much higher utilization. And in the process of that, that means that we can actually pass on the effective savings to our customers. So they not only save in not having to maintain their own team to manage these virtual machines and containers, but they also save because we can just do more with the same GPU resources that are being deployed.”

Conclusion:

Cloudflare is among the highest in terms of valuations for best-of-breed stocks at a 19.7 forward PS. Although this was a decent report with no major red flags, this valuation is not where I’d be buying the stock given the report was not a knockout. The question being considered is if we should close the position since odds are quite high we will get the stock lower.

Recommended Reading:

• Cloudflare Q3 Earnings Preview: All eyes on the guide
• Real Vision Video Interview: Will Nvidia Continue to Dominate AI?
• AMD Q3 2024: GPU Revenue at 22%, and AI PCs have a Leader
• Micron Q4: Data Center Drives Beat, Profitability Soars

CrowdStrike reported a new record for net new ARR in Q4, far surpassing the record it set in the previous quarter, and GAAP margins continued to strengthen. Net new ARR accelerated significantly in the quarter to 27% growth, which is a 14-point acceleration from 13% growth in Q3. This is up from 2% growth for net new ARR in the year ago quarter. The turnaround in this particular key metric is notable, especially compared to other cloud stocks whose key metrics are decelerating. ARR increased 34% to $3.44 billion, which was down 1 percent from 35% growth last quarter.

For FY25, CrowdStrike’s guide was marginally above consensus, yet the market is clearly pleased with the continued expansion in operating and net margins. The turnaround on net new ARR is notable, yet the turnaround on GAAP profitability is what is most impressive compared to its cloud peers, especially considering the far majority of cloud stocks are years away from GAAP profitability (if they ever get there). We covered this in-depth here.

Revenue and EPS:

• Q4 revenue was $845.3 million, beating estimates by $5.3 million, representing YoY growth of 33%. This is down from 36% growth in the previous quarter.
• Q1 revenue was guided between $902.2 million to $905.8 million, representing YoY growth of 30%.
• FY24 revenue was $3.06 billion, an increase of 36% YoY.
• FY25 revenue was guided at $3.925 billion to $3.99 billion, slightly ahead of consensus for $3.94 billion and representing YoY growth of approximately 29% at midpoint.
• Q4 adjusted EPS was $0.95, beating estimates by $0.13 and representing YoY growth of 102%. GAAP EPS was $0.22, compared to ($0.20) in the year ago quarter.
• FY24 adjusted EPS was $3.09, an increase of 101% YoY. GAAP EPS was $0.37, compared to ($0.79) in FY23.
• The bottom line is expected to grow steadily over the next two fiscal years, suggesting that GAAP profitability is permanent. With that said, analyst consensus for next quarter of $0.82 is lower than Q4’s EPS of $0.95. It’s likely we see upward revisions to Q1’s EPS over the next few days, although management guided for an adjusted operating margin that is four points lower QoQ than the current quarter.

Margins:

Margins strengthened across the board – driven by four quarters of GAAP gross margin at 75% and GAAP subscription margin at 78%. For the full year, CrowdStrike nearly broke even from operations, reporting just a ($2 million) loss from operations, or a (0%) margin, an 800 bp improvement from FY23. CrowdStrike also reported its first full year with GAAP net profitability, reporting a 2.9% net margin, compared to an (8.2%) margin in FY23.

Q4 saw net margin more than double sequentially, from 3% in Q3 to 6.4% in Q4, as net income surged 101% QoQ to $53.7 million – this means that CrowdStrike generated 60% of its GAAP net income in Q4 alone.

• Q4 GAAP gross margin was 75.3%, compared to 72% in the year ago quarter.
• Q4 GAAP operating margin was 3.5%, the second straight quarter with a positive margin and an increase from 0.3% in the previous quarter.
  o   To further illustrate CrowdStrike’s margin expansion, GAAP operating income was $30 million this quarter compared to (-$61.5) million in the year ago quarter. This is up from $3.2 million last quarter.
  o   CrowdStrike’s adjusted operating income was $213.1 million for a margin of 25%. The company is guiding for a lower margin next quarter of 21%.
• Q4 GAAP net margin was 6.4%, the fourth consecutive quarter with a positive margin and an increase from 3% in the previous quarter.

Stock based compensation was 20.9% of revenue compared to 20.3% of revenue in the previous quarter for a total of $176.3 million.

Fiscal Year 2024 Margins:

• FY24 GAAP gross margin was 75%, compared to 73% in FY23.
• FY24 GAAP operating margin was (0%), compared to (8%) in FY23.
• FY24 GAAP net margin was 2.9%, compared to (8.2%) in FY23.

For FY2025, the CFO provided the following color: “As a result of increased hiring in the first half of the year, changes to the timing of our merit cycle and the timing of certain marketing programs, we expect operating leverage to be more weighted to the back half of FY '25.”

Cash and Debt:

CrowdStrike is known for its strong cash flow margins and this quarter was no exception. The company raised its FY2025 free cash flow target by 1-point at the midpoint. Per the CFO: “Next, we are raising our free cash flow target for FY '25 from between 30% and 32% to between 31% and 33% of revenue.”

• Q4 operating cash flow was $347 million, representing a 41% margin. Free cash flow in the quarter was $283 million, a 33.5% margin.
• FY24 operating cash flow was $1.16 billion for a margin of 38%. Free cash flow was $938.2 million for a margin of 30.7%.
• Cash, equivalents and short-term investments totaled $3.47 billion.
• Debt totaled $742.5 million.

Key Metrics:

CrowdStrike added a record $281.9 million in net new ARR in Q4, far surpassing its previous net new ARR record of $223 million set just in Q3. Net new ARR increased 27% in Q4, a 14 percentage point acceleration from just 13% growth in Q3.

According to the CFO: “while we do not specifically guide to ending or net new ARR, given the incredible performance of Q4, I will share our currerpnt seasonality assumptions with respect to net new ARR in Q1, which calls for Q1 net new ARR year-over-year growth to be at least double digits up to the low teens.” The CFO is tempering expectations that 27% is not realistic for next quarter, but strong growth is still achievable.

ARR of $3.44 billion was up 34% YoY compared to ARR of $3.15 billion and growth of 35% in the previous quarter. Management has stated: “We continue to aggressively invest in our innovation engine and flank the company to achieve its vision of reaching $10 billion in ARR over the next 5 to 7 years.” That would imply about 200% growth in 5-7 years. The growth of deals with total value exceeding $1 million accelerated to “over 30%” this quarter for 250 customers.

Deferred revenue of $3.05 billion was up from $2.36 billion in the year ago quarter. The sequential increase from $2.5 billion suggests that billings are strong. Billings for this quarter comes to $1.36 billion, up 65% QoQ and up 39% YoY. There was mention on the call that total billings outgrew short-term billings, which translates to customers committing for longer contracts. Management likes to remind analysts that ARR is a better measure of their business, even during quarters when deferred revenue and billings are strong.

Similar to deferred revenue, RPO reported an astonishing surge that points toward CrowdStrike being resilient compared to its peers. RPO was up 35% YoY and up 24% QoQ to $4.6 billion. This is the highest QoQ growth we’ve seen the company report since tracking this metric over the past 11 quarters. Compare the 24% QoQ growth to only 3% QoQ growth last quarter.

Subscription revenue of $795.9 million increased 33% compared to 34% last quarter. Professional Services grew 26.3% for revenue of $49.4 million.

Customers with multiple modules increased 1% across the board, including in the 7+ module cohort, 6+ module cohort, and 5+ module cohort.

Dollar based net retention was 119%, same as last quarter. The company offered visibility (finally) into the quarterly DBNRR over the past year of “Net retention was 119% in Q3, 119% in Q2 and 122% in Q1.” These numbers had been left vague before. It’s softening a bit and 120% is the benchmark CrowdStrike has stated they want to achieve.

 

Earnings Call:

Data-Centric Architecture in a Single Platform:

The predominant question in the Q&A is why is CrowdStrike resilient when peers are not. As you’re likely aware, Palo Alto Network, Fortinet and Zscaler saw turbulence following their earnings reports. Overall, the CEO and management team focused on why a platform is important instead of a fragmented approach to acquisitions from “multi-platform hardware vendors [that] evangelize their stitched together patchwork of point products, masquerading as thinly veiled piecemeal platforms.” Wow, those are strong words. CrowdStrike is not shy about naming the companies they are taking business from. In this call, it was Azure Sentinel, Splunk and Palo Alto Networks. Later on, there was a quote that I think best juxtaposes the differences between the piecemeal platforms and what CrowdStrike is offering:

“So when we think about architecture, architecture does matter and really what we've created is a very data-centric architecture that allows us to get data at scale into our platform, leverage our AI and then create the outcomes. It's that collect once, use many. We have a single platform. Our competitors have many other platforms as they call them. We have a single agent. Our competitors have 5, 6, 7, 8 agents depending on the competitors. 

So when we look at our architecture, it was really designed from the beginning to solve the problems of today and the future problems. And the result of that is ease of use, the outcome that a customer is looking for, stopping breaches and lowering the cost, and future proofing what they want. I've — in a prior life, I've been involved in companies that acquired a lot of products. And I can tell you, it is near impossible to stitch all this stuff together, particularly at the agent level unless you're very diligent about it.

This was further quantified in the opening remarks when it was stated that a recent IDC platform is “showcasing $6 of return for every dollar invested in the Falcon platform.”

We first covered the impact AI can have on lower costs in previous free analysis here and a deep dive on CrowdStrike here.

AI Revenue Won’t be Easy to Detect

It’s important to drop a note that many companies can break out AI revenue, whereas CrowdStrike’s data-driven AI features are inherent to the platform. Therefore, I don’t believe it’s possible to have a separate AI segment the same way other companies offer.

The previous deep dive on CrowdStrike stated the following:

“The statement that CrowdStrike’s data is more valuable is based on the vast number of threats their platform has already detected. Essentially, the argument is that their XDR platform is better than competitors, and therefore, their data is better than competitors, which results in smarter and more accurate AI output. Here is how management spoke about it: “we actually have a very well-defined training set that's annotated based upon all the threat hunting that we've done over the last 10 years.”

Automation reduces the number of false positives. Instead of getting every piece of telemetry that requires the security team to investigate, AI-assisted endpoint detection and response solutions eliminates the noise so that the security team is only responding to those that have the potential to be critical. Fundamentally, cybersecurity is a data problem. CrowdStrike’s Falcon platform ingests, correlates, and queries petabytes of structured and unstructured data from ever-expanding disparate external and internal sources in real-time. It builds rich context and delivers greater visibility by constructing a dynamic representation of data across an organization. As a result, the company’s AI models are often highly accurate in triggering a response.

However, in the earnings report this quarter, the CEO stated a few new things that investors should see creates a more all-encompassing AI platform:

“We collect trillions of threat signals daily creating one of the world's largest and fastest-growing cyber threat data set. From day 1, we've been an AI company, training the industry's most effective and accurate AI models to prevent attacks based upon our data moat.”

Falcon for IT:

On the same note that AI is not a separate revenue segment for CrowdStrike, there are additional ways CrowdStrike plans to leverage its “AI-native” platform. One of the more popular hybrid use case is called Falcon for IT, which allows IT teams to leverage AI and automation to query the IT systems and servers. This is useful for things like fleet management, compliance, and performance monitoring. By using generative AI, IT Teams can query assets for unauthorized software, outdated machines, patch status and also schedule queries to detect anomalies.

I’m highlighting this as a segue into the broader idea that AI and automation is likely to have a large impact on CrowdStrike (and perhaps more immediate) compared to other cloud stocks on the market.

This was the CEO’s commentary on the call:

“Customers are looking for a better solution in this area. And one of the things that we found is that the security team has been solving a lot of IT problems and challenges for IT for a long time, and we really needed to carve out a home for IT. So when you look at some of our competitors in that market, it's — obviously, it's a pretty big market, but having a single agent and the ability to actually solve IT problems, which many of our customers were doing already, is fantastic. 

So again, early days, but the feedback and the interest is off the charts for Falcon for IT, and it goes to the heart of how we built the platform. To collect data, it doesn't have to be security data. It can be almost any data related to either our agent first-party data or now third-party data we can ingest. And that solves many use cases beyond what we originally came to market with. So I think the sky is the limit there.”

FY2025 Net New ARR Commentary

Since ARR and net new ARR is what moves the stock, I wanted to include what the CFO stated in terms of FY2025. It’s very vague but sounds positive in terms of net new ARR building from Q1 and beyond.

Question
Matthew Hedberg (Analyst)

I'll offer my congrats as well, guys. Burt, your new ARR commentary was helpful for Q1. I'm curious, this time last year, I believe you talked about flat net new ARR growth for fiscal '24. And obviously, I think you guys did about 6% this year. Any just sort of like directional guardrails you give us from a full year perspective in terms of just thinking about it from a net new perspective?

Answer
Burt Podbere 

So with respect to ARR, obviously, we don't guide to it. But we have talked about in the past where we've started the year in Q1 and build from there. And that's kind of really all I can really comment on ARR. You can kind of infer where we're going with our guide. And — but at the end of the day, our guide — the methodology has remained consistent, and that's how we think about it.

Conclusion:

CrowdStrike’s post-earnings reaction is as much about CrowdStrike as it is about the weakness of its peers. The excellent timing of the increasing GAAP profitability merging with accelerating key metrics is something we are not likely to see in any other best-of-breed cloud company this earnings season.

The market is anxious to find AI winners early-on. By combining cybersecurity with AI in a single platform with a data-centric architecture, CrowdStrike is emerging as one of the few cloud companies that has resiliency and the AI “it” factor. We continue to believe that 20 Forward P/S is the ceiling for cloud stocks, yet we also continue to believe that CrowdStrike is the leader in the cloud category. For reasons quite apparent this evening, CRWD is one of two that we are interested in owning now and into the foreseeable future out of the dozens and dozens of cloud stocks on the market.

Note: We have updated the analysis on 03/06 with the following: Billings for this quarter comes to $1.36 billion, up 65% QoQ and up 39% YoY.

Recommended Reading:

• CrowdStrike: Steady Growth, Strong Bottom Line — Deep Dive on CrowdStrike
• The Next Market AI Will Disrupt Is Cybersecurity
• Broadcom: Networking/ASICs Giant and The Second Largest by AI Revenue
• Nvidia Fiscal Q4: Yet Another Big Beat and Raise

Cloudflare has leveraged its content delivery network footprint to also offer application and website security. The company further innovated with Zero Trust combined with SASE network connectivity, and also eliminated egress fees for object storage to attract developers. What’s quite rare about Cloudflare is that the company is leveraging its global network to offer compute, storage and application services.

That’s a mouthful. There’s a lot of jargon when discussing Cloudflare that cannot be avoided. What’s important to take away from this analysis is that Cloudflare has laid down important stepping stones to becoming a dominant player in AI. Although we have to focus on the what (product), we also want to connect the dots on the why (strategy). This analysis will break down Cloudflare’s visionary approach on bringing AI inference to the edge; an approach that is a decade or more ahead of the competition. That is, if there is any competition among best-of-breed companies.

The analysis below touches base on Cloudflare’s core products as a CDN and best-of-breed leader in cloud-based security and application security. We will also discuss Zero Trust. However, the point of describing these products is so that I/O Fund Members understand how each of these is interconnected, and how these products uniquely position Cloudflare to capture AI inference at the edge. By my estimation, every market Cloudflare has entered over the past 14 years has been leading up to this point.

Product Overview:

Cloudflare references its business units as “Acts” – Act 1, Act 2 and Act 3. The company defines Act 1 as application security, Act 2 as Zero Trust and Act 3 as the Workers Platform. For our purposes as stock investors, it’s Act 3 we are most interested in. The analysis below makes it abundantly clear as to why Act 3 and the Workers platform is where the most explosive moment could occur.

Before we discuss Cloudflare’s positioning to democratize AI development and bring inference to the edge, it’s well worth the time to discuss the stepping stones that can create a moat of sorts. As stated, the most important section of the analysis begins at Act 3: Workers Platform.

CDN: Content Delivery Network

Cloudflare owns a predominant share of the CDN market. Content Delivery Networks are essentially a middleman that sits between the client/users and the origin server. CDNs contain a cached copy of website content on multiple servers located across the world to help improve page loading times.

When a person visits a website, it will provide the content from the server closest to the end-user, which helps increase the delivery speed of the content. When a website is hosted on a server in the United States, the person browsing the website from any part of the globe, like Asia or Europe, will receive the content from the nearest location instead of the server in the USA.

Pictured Above: CDNs are the middleman between origin servers and client devices.
Source: WallarmWallarm

Cloudflare has 300 points of presence (POPs) which are servers that sit at the edge. Hyperscalers, such as Google, Microsoft and Amazon, offer more centralized data centers. These data centers are geographically distributed but are designed for compute intensive workloads more than speed. Content delivery networks, as the name suggests, are designed for speed because their primary function is to deliver content as quickly as possible. This means smaller servers in more locations, with an emphasis on the network, which is why Cloudflare advertises that 95% of the world’s population is within 50 milliseconds with 12,500 network partners. In contrast, cloud data centers are much larger (think football field size) and are designed for a variety of workloads that are not only more compute intensive but also require a lot of storage.

Before I keep going, I want to make it clear that the Big 3 (AWS, Google Cloud and Azure) also have points of presence (POPs) and edge infrastructure. AWS has 400 points of presence (POPs), Azure 192 POPs, and Google Cloud has 120 POPs. The original dot-com CDN is Akamai, and this company has 4,200 POPs. As inference moves more toward the edge network and edge devices, you can expect the Big 3 will increase the number of POPs and strike close partnerships with telecom companies to leverage millions of 5G points-of-presence (POPs) for fast network speeds.

So then, given that Cloudflare is up against tech’s heavyweights who can build POPs with their large cash reserves and partner with telecoms, what is Cloudflare’s competitive advantage? Sitting at the edge is one of many stepping stones for Cloudflare. But this is where the similarities end.

Reverse Proxy and Anycast:

I want to touch base on reverse proxy and Anycast to help illustrate Cloudflare’s leading position as a middleman. This will also help illustrate how Cloudflare has leveraged its position to greatly improve application performance when we discuss Serverless.

Large Market Penetration:

According to data from W3Techs, 79.9% of websites that use a CDN or reverse proxy rely on Cloudflare.

Source: Intricately and KinstaKinsta

The customer count is high because Cloudflare offers free services. Cloudflare has 1.154 million customers and makes $1.3 billion in revenue whereas Akamai has 143,000 customers and makes $3.8 billion in revenue.

Of the 1.154 million customers, 174,129 have upgraded to Cloudflare’s paid services. This ratio of free to paid is rare. I can’t think of another company offering free enterprise and SMB services at this scale. Customers contributing over $100,000 in revenue have been growing steadily and are now at 2,352. Notably, 31% of the Fortune 1000 use Cloudflare, so it’s not only SMBs that drive revenue.

The benefits of having a free base are that these customers are likely to upgrade to paid services, and free users can be used to test products to eliminate a long quality assurance (QA) process for faster product launches. It also helps illustrate how developer-friendly Cloudflare is, on the core CDN and security products, but also for its Workers platform.but also for its Workers platform.

Reverse Proxy:

Reverse proxy allows for cloud security features by sitting in front of web servers and forwarding client requests to the web servers. By routing through a vendor’s reverse proxy before routing to the server, the vendor has the opportunity to provide cloud-based security. This is important because Cloudflare sits at a critical juncture in the tech stack, to where it can uniquely combine its capabilities as a CDN with application and cloud-based security. Therefore, you can combine fast speeds and better application performance seamlessly with web application firewalls, DDoS protection, API gateways and bot management. 

Pictured Above: By being a reverse proxy, Cloudflare can also be a forward proxy for security services. This allows Cloudflare to become a one-stop-shop that combines many application needs. As more developers use Cloudflare for AI purposes, security features will act as an seamless upgrade. Right now, security drives Cloudflare’s revenue.

Anycast is a Material Differentiator:

Being a middleman between internet traffic and servers creates strong positioning for vendor-related products and services. By being a content delivery network that protects against DDoS attacks, Cloudflare was forced to innovate around how to handle incoming requests.

The Anycast network was designed to be resilient for a surge in traffic by routing incoming traffic to the nearest server. Traffic finds the best path to the most available data center rather than overwhelming the origin server where the request was created. In this case, traffic can be spread across the entire network. According to Cloudflare, the network spans 300 cities, 100 countries with over 12,500 network partners that are connected to Cloudflare. Cloudflare has continually innovated its core products with features such as automatic platform optimization which allows websites to cache static HTML on edge servers.

Anycast has a latency in the milliseconds by answering requests from the edge instead of routing to an origin server. This is important for AI inference, which we will touch on later in the analysis.latency in the milliseconds by answering requests from the edge instead of routing to an origin server. This is important for AI inference, which we will touch on later in the analysis.

Over the past ten years, Anycast has increasingly gotten smarter by using routing algorithms. Today, developers also use the Cloudflare network to proxy requests for APIs. This reduces API latency by placing Cloudflare in front of the API, allowing Cloudflare’s DNS resolver to direct the request to the nearest Cloudflare server.

More on Cloud-based Network Security:

Cloudflare has been forced to innovate to handle DDoS-levels of botnet traffic. By being a middleman, Cloudflare answers a few needs combined into one, which is application speed and performance alongside security. This is rare, as usually security vendors do not typically improve application performance, let alone improve application performance to an extent that exceeds the hyperscalers (reference Serverless section below).

Because Cloudflare has a large global presence, it’s particularly well suited for analyzing traffic to determine security risks. The company is able to analyze and detect attacks by running a background program known as a daemon on every server in every data center. The scans are shared as threat intelligence among the servers in each data center without affecting the latency of the CDN.

Cloudflare is able to mitigate at optimal locations in the tech stack, for example at L4 inside the firewall or at L7 inside the reverse proxy with a 403 error page. The company is advanced at preventing L3 DDoS attacks, which targets network equipment and infrastructure. The benefit of having access to more of the stack for security purposes is that CPU consumption and intra-data center bandwidth remains relatively unaffected. It’s also autonomous so Cloudflare is not using manual employees for this process

Distributed denial-of-service (DDoS) attacks are a type of security threat where botnets create a surge of traffic to a network and crash a targeted site. DDoS attacks are essentially bots that send millions of requests to overload servers and to shut down a specific website by targeting its IP address. Often times, these bots are run from devices infected with malware and operated remotely by an attacker. In 2021, Cloudflare detected and mitigated a 17.2 million request-per-second DDoS attack, which was three times larger than any previous DDoS attack on record. This is two-thirds the average rate per second that Cloudflare had served in all of Q2.

These outages are very common, with some of the larger DDoS attacks taking down popular social media sites and consumer applications like Twitter and Spotify (and countless others throughout the years). During 2020, DDoS attacks surged by 300%. During this time, Cloudflare went from 10% penetration across all websites to 19%.

They can also cross-sell security and CDN customers with WAN-as-service, or Magic WAN, which connects office networks through the local area network. The company also offers application delivery controllers located centrally within a customer’s infrastructure for Layer 3 through Layer 7 security for applications and APIs.

Quick Takeaway:

DDoS helped put Cloudflare on the map, and it’s important to discuss this because Cloudflare is capable of protecting against some of the world’s most prevalent cyberattacks. By providing cloud-based security alongside edge serverless at low prices, Cloudflare has added benefits the hyperscalers do not inherently provide.

Zero Trust:

Following Covid, Zero Trust gained acceptance due to rising security threats from hybrid work teams. Secure access service edge (SASE) is a cybersecurity concept that utilizes Zero Trust to identify users and devices to deliver secure access to specific applications or data. The need for this has grown due to remote teams as SASE allows policy-based security no matter where the user, application or device is located. 

Zero Trust Security is built on the premise that no one should be trusted within or outside the network. In traditional security systems, it is difficult to obtain access from outside the network while those located inside the network were trusted.

With Zero Trust, these trust assumptions are removed with tools such as multi-factor authentication, giving access for a limited time and to also verify, authorize and to have a continuous check on all the data points that are given access.

In this case, Cloudflare uses the company’s proxy infrastructure for both reverse proxy and forward proxy. The company’s edge network is ideal for SASE because the cloud-driven architecture is meant to secure all applications, data, users and devices. Having a footprint of hundreds of POPs enables a security approach that others SASE vendors cannot duplicate.

Quick takeaway:

Cloudflare’s position as the middleman allowed Cloudflare to skate where the puck was going. The company quickly positioned for the Zero Trust market when Covid drove hybrid work environments by releasing Cloudflare One in October of 2020 — which was an incredible 6-7 month turn around from when shelter-in-place began. The cloud firewall approach was able to overcome issues that traditional firewalls, both hardware and virtualized, could not overcome in terms of capacity planning, managing devices, and needing to apply Zero Trust policies across all traffic rather than centralizing traffic to one, physical location. As stated, the company’s edge network is ideal for SASE because the cloud-driven architecture is meant to secure all applications, data, users and devices – and this will come in handy as AI moves more toward the edge.

Act 3: Workers Platform

Cloudflare is not only a CDN and security company. Rather, Cloudflare is being bold by leveraging its global network to offer compute, storage and application services.

The benefit of serverless is to deploy applications without the customer having to provision the compute infrastructure. The servers for executing the code are deployed by cloud service providers, hence it’s “serverless” for the customer. With serverless, it takes minutes to run code. 

Fundamentally, Cloudflare approaches serverless differently than the hyperscalers. Amazon’s (AWS) Lambda functions are executed in containers. When an event triggers the code, a runtime container is started and code is loaded from S3. The container then waits for another execution. If too much time passes, the container is deleted and a new container is required. This is popular because you pay for what you use, and are charged based on the number of requests for your functions. The drawback is that every time a container is spun up, the language runtime is spun up in addition to the code. Moving data centers closer to the edge does not entirely solve this problem because there are fewer machines and less memory, which means cold starts will still occur with a containerized process.

To avoid cold starts, some developers will pay for synthetic requests. This means developers must choose between unreliable execution time with quite a bit of variability (sometimes a few seconds) or they have to pay extra for synthetic requests to keep the function warm.

Cloudflare eliminated cold starts entirely with its Workers platform. There are a few milliseconds where Cloudflare can have Workers runtime load a hostname before a TLS certificate is sent back and the original encrypted request is sent. By the time the HTTPS protocol is ready to send secure data between a browser and a website, Cloudflare has the Worker runtime warm. This means Worker executes code the minute the request is received.

What’s crazy is that Cloudflare rolls out features that exceed hyperscaler performance at minimal cost. It is this combination of competing with the hyperscalers, delivering app performance at faster speeds — while keeping prices low — that is unique to Cloudflare.while keeping prices low — that is unique to Cloudflare.

More on Serverless Cold Starts and Isolates:

Serverless is event-driven, which means when an event is received, it’s spun up and the request is processed. Serverless platforms are free at first but become more expensive as an application scales.

Serverless is billed in two ways:

• Number of requests – billed in increments of every million requests per month
• Compute time – measured in GB per seconds, higher memory execution costs more than lower memory execution
• Data transfer and Storage Costs, this depends on the use case

Cloudflare’s approach to serverless is fundamentally different than the hyperscalers. Amazon’s Lambda is one of the more traditional serverless platforms. As discussed, it works by spinning up a containerized process for code, which if inactive at the time the request is received, leads to “cold starts.” As discussed, a cold start is when a new copy of code is started on a machine, which can cause one to four seconds of lag time. 

Source: Mikhail.io

If an instance is already active, then there is a “warm start” and there is no lag time. You can read about the idle instance lifetimes here in terms of how long an instance can idle before it requires another cold start.

In contrast, the Workers platform uses something called isolates. Isolates allow a single process to run up to thousands of isolates. Although hyperscalers will promote the ability to scale, it can be costly to do so. With Cloudflare’s serverless approach, developers pay for the Javascript runtime once, and then are able to run more scripts without additional costs. The isolate runs faster than a node process, and also uses less memory because isolates do not share or access the memory of another isolate (hence the name isolate). By not sharing memory, there is a security feature to isolates.

Additionally, Cloudflare’s serverless Workers platform does not use containers or virtual machines. This means applications do not require the cold starts that virtual machines require. Instead, code runs close to the “metal” – or in other words, on an edge server. This reduces the request response time compared to serverless platforms offered by hyperscalers such as AWS Lambda, Lambda@Edge, Lambda Native and Google’s Firebase.

Because of some of these fundamental differences, Cloudflare claims to cold start applications within five milliseconds. Per Cloudflare: “Any given isolate can start around a hundred times faster than a Node process on a container or virtual machine.” The company also states: “on startup, isolates consume an order of magnitude less memory.”

Out the gate, the Workers platform was designed to compete with AWS’s Lambda and Lambda@Edge by being faster. According to Cloudflare, Workers was 441% faster than a Lambda function and 192% faster than Lambda@Edge. The speed is possible because Cloudflare offers serverless through its edge network, which is distributed and decentralized.

The Workers Platform is on fire in terms of growth. Per the most recent earnings call: “Our developer platform, Cloudflare Workers, continues its explosive growth. We reached 10 million active Workers applications in Q2, up 250% since December and 490% year-over-year.” These applications were at 2.2 million less than a year ago in Q3, and were at 4.9 million last quarter.

Pictured Above: Cloudflare Workers Platform has seen applications surge. Source: Cloudflare Investor Relations

It’s not clear how much the 10 million is contributing to revenue. Per management: “But I would say that we have been very pleasantly surprised at how quickly the Workers' platform is taking off. But we are not, at this time, optimizing that platform for how can we bring as many dollars out of it as possible.”

However, this is where the magic of a developer moat often starts – a platform that advocates for developers, offers something of value (lower costs, higher performance, more accessibility), and then patiently waits for the tide to come in.

Quick takeaway:

Cloudflare combines executing runtime for an application close to the user and removes cold starts by running isolates that create an advantage at the edge. This is distinct from pushing compute from a centralized data center to the edge. It’s also distinct from containerized processes that require cold starts.

R2 Object Storage

Cloudflare’s R2 storage allows unstructured data to be stored without egress bandwidth fees, which are charged when developers retrieve data from a cloud provider like AWS. This was a bold move by Cloudflare to prove it can compete against a hyperscaler on cloud storage.

The egress fees that Cloudflare is disrupting are essentially a tax without any value. Markups are as high as 7900% in the United States region when calculating what AWS charges. This is an 80X bandwidth markup and was detailed here by Cloudflare’s management. Eliminating egress fees with R2 Storage places Cloudflare in direct competition with Amazon’s S3.

Cloudflare’s motivation is to win over developers and their loyalty. Per the CEO: “We want developers to keep developing, not worrying about their storage bill. Our aim is to make R2 Storage the least expensive, most reliable option for storing data, with no egress charges. I’m constantly amazed by what developers are building on our platform, and look forward to continued innovation as we expand the tools they have access to.”

Primarily, Cloudflare is hoping to attract developers for its Workers platform by eliminating unnecessary fees on cloud storage. R2 Storage will help Cloudflare grow its addressable market and will help the company compete as a best-of-breed player in of multi-cloud.

In response, Amazon lowered prices by up to 31% but this may not be enough if Cloudflare removes egress fees entirely. When Cloudflare announced R2 storage, the company’s co-founder and CEO, Matthew Prince, tweeted, “Why R2? Because it’s S3 minus the one most annoying thing: egregious egress.”

It is interesting to note that Amazon successfully grew by targeting companies that had good margins with a famous quote from Jeff Bezos, “Your margin is my opportunity.” Now, companies like Cloudflare are doing what Amazon did in its early days by toughening the competition. Amazon’s AWS is a profitable powerhouse, and if Cloudflare can attract even a small share of AWS customers, it could be a game-changer for Cloudflare. Per management on the most recent call: “Cloudflare is the most commonly used cloud provider across the leading AI startups. They're using R2 to help arbitrage the lowest GPU cost to train their models.”

R2 Object Storage is growing quickly. Management stated in the last earnings call: “R2 continues to grow and now stores over 13 petabytes of customer data, up 85% quarter-over-quarter. We have 44,000 distinct paying customers with R2 subscription, and brand name customers are beginning to adopt it as their primary object storage solution.”

Inference at the Edge:

There are two primary steps to AI/ML: training and inference. Training is the learning phase and is compute intensive. GPT-3 had 175 billion parameters and required 300 zettaflops and 300,000 billion math operations across it’s training cycle. For the most part, training is done by high performance computing systems and is often done in the cloud instead of on-prem.

However, inference is a different matter entirely. Cloud computing through the hyperscalers has a long transmission delay. What inference needs is speed so it can retain the learning from the training phase, while quickly applying data it’s never seen before. Inference takes batches of real-world data and quickly comes back with an answer or prediction. This is best done at the edge, which includes the edge network that Cloudflare provides, and edge devices, such as smartphones and laptops.

In the inference stage, the compute intensive neural networks are modified for speed and to improve latency. In order to do this, inference is optimized for runtime performance. This allows the computation tasks to be as close to the data source as possible. In many cases, data is produced at the edge, and it’s more efficient and faster to run inferencing at the edge.

For many inferencing tasks, Cloudflare’s distributed edge servers will handle tasks without needing to exchange data with the cloud. This helps to optimize the traffic load. For other tasks, the cloud will act as a backup not only for processing but also for scalable storage. So, it’s important to understand that Cloudflare is not a direct competitor in the traditional sense, but in some cases, compliments the Big 3. Look Cloudflare to play up its multi-cloud approach and the common goal of increasing the number of AI applications and improving accessibility to developers.

It’s true that hyperscalers will increase their edge footprint, and will partner with telecoms for fast speeds. However, AI developers need an advocate, and because Cloudflare owns their infrastructure, their strategy of driving down costs and improving GPU accessibility makes a lot of sense.

There are more details that we will visit later down the line, such as ONNX runtime, which allows Cloudflare to be the middleman as a routing layer between cloud data centers, the edge network and devices – and AI gateways, which allow developers to cache AI responses and monitor performance to mitigate AI costs.

Connecting the Dots:

If we connect the dots, then it becomes clear Cloudflare has a few distinct advantages as the platform of choice for AI developers. Here’s a summary of what’s been discussed:

• Does not rely on Big 3 infrastructure and can drive down costs
• Is faster on performance because of its position at the edge; this lowers costs and latency for AI inference and keeps data as close to the user as possible
• Geographically equipped to handle compliance issues that will inevitably result from using training data for inference. You can read more about ChatGPT running into issues in Italy here.
• The company has moved diligently into compute, storage and application services. Combined with its global network, this positions the company for AI inference as-a-service. There is no other company doing both edge network plus compute and storage except the hyperscalers. However, in some cases such as serverless, Cloudflare exceeds the performance of the hyperscalers
• CDN as a core product and security as a seamless upgrade shows the importance of being a middleman, helping to position Cloudflare to innovate around Serverless in ways that outperform even AWS.   
• Training models is prohibitively expensive by requiring upfront costs, Nvidia GPUs are hard to obtain, and AI development is not democratized for developers with proprietary, blackbox APIs that run counter to an open-source movement (GPT-4 versus Llama). Cloudflare aims to solve these problems by allowing popular models to run closer to the user, which is the next logical step for AI.

Ultimately, the bigger and the faster a network is, the more it’s capable of providing “as a service.” AI can create a fortuitous moment for Cloudflare because the company is positioned to offer AI inference-as-a-service.

Last month, there was an important announcement with Cloudflare launching Workers AI. This new platform is the sum of the parts we discussed in this analysis.

Financials:

Cloudflare is strong on revenue growth with analysts expecting consistency over the next few quarters. This kind of consistency is rare in the cloud and security category. However, Cloudflare is not GAAP profitable and the AI story will take a back seat if there is a FED-related selloff, or if for any other reason we enter a risk-off market for growth stocks.

Revenue and EPS

All numbers are for the current Q2 quarter ending in June and are year-over-year comps unless otherwise stated.

• Revenue grew 31.5% to $308.5 million and was in line with expectations. Next quarter the company is expected to grow 30% to $330.5 million in revenue.
• Full year revenue guidance for 2023 is $1.283 billion to $1.287 billion, representing growth of 31.8% at the mid-point.

Pictured Above: Cloudflare is expected to report consistent growth
Source: YCharts/Seeking Alpha

Adjusted EPS of $0.10 is up from $0.00 in the year ago quarter. The consensus for next quarter is $0.10. However, on a GAAP basis, the company is unprofitable with GAAP EPS of ($-0.28) reported compared to ($-0.13) expected. The miss in GAAP EPS is due to a $50.3 million loss on extinguishment of debt for a negative impact of $0.15 EPS. 

Pictured Above: Bottom line growth on an adjusted basis is expected to slow

Margins:

Cloudflare has a strong gross margin yet stock-based compensation weighs on the GAAP operating margin.

• Gross margin of 75.6% is strong and necessary for this company to expand.
• The operating margin of (-18.20%) compared to (-27.50%) a year ago. However, it got worse QoQ and has remained flat this year with no improvement.
  ·  Stock based compensation is high at 22.2% of revenue.
• Adjusted operating margin improved by 700 basis points YoY to 6.6%.
  ·  Sales and marketing expenses decreased as a percentage of revenue by 300 basis points YoY to 41%.
  ·  R&D expenses decreased by 300 basis points YoY to 17%
  ·  G&A expenses decreased by 200 basis points YoY to 13%.
• Adjusted operating income guidance for the next quarter ranges from $20 million to $21 million or 6.2% of revenue.
• Net margin of (-30.60%) with the net loss increasing last quarter primarily due to the loss on extinguishment of debt of ($50.3 million) due to early repurchase of 2025 convertible senior notes. Per the 10-Q: “In May 2023, the Company repurchased $123.0 million principal amount of the 2025 Notes (the 2025 Notes Repurchases) for $172.7 million in cash, including accrued interest payable of $0.5 million.”
• Adjusted net margin of 10.9% compared to 0.1% in the same period last year.

Source: Cloudflare Investor Relations

Cash Flow and Balance Sheet:

Compared to its peers, Cloudflare’s cash flows are a bright spot. The operating cash flow margin was 21% compared to 16% in the same period last year. Free cash flow improved to 6% from (-2%) in the same period last year and was up 1% sequentially. Previously, management had guided to being breakeven on cash flows in H1 2023.

Thomas Seifert, CFO of the company, had said in the Q4 2022 earnings call, “While we expect free cash flow to trend upward on an ongoing basis, for modeling purposes we anticipate near-term variability in our cash flow generation with the first half of 2023 expected to be relatively breakeven.”

One of the differences between operating cash flow and free cash flow is network capex of 11% in the most recent quarter. Network capex is expected to be 10% to 12% of revenue in FY2023. This is a primary reason as to why FCF can be minimal at times.

The company has cash and available-for-sale securities of $1.59 billion. It repurchased $123 million convertible senior notes in the recent quarter and had an outstanding $1.32 billion.

Key Metrics

Remaining performance obligation (RPO) is declining yet is still above revenue growth. In the recent quarter, RPO grew by 36% YoY and was up 8% QoQ to $1 billion. The deceleration pictured below is quite apparent and RPO will need to accelerate when the AI story plays out.

Source: Cloudflare Investor Relations

The dollar-based net retention rate was 115% in the recent quarter. Management believes that the deceleration in DBNRR is nearing a bottom.

This is very important for Cloudflare to prove to investors as we move through the next few quarters. Thus, we’ve provided the full statement below.

Thomas Seifert said in the recent earnings call, “Our dollar-based net retention rate was 115% during the second quarter, representing a decrease of 200 basis points sequentially. Importantly, renewal rates in the second quarter were consistent with the quarterly average in 2022, which was an all-time high for the company. Instead, similar to the last two quarters, the decline in DNR was again primarily driven by slower expansion in our larger customer cohort. We calculate DNR by comparing the analyzed revenue from paying customers four quarters prior to the annualized revenue from the same set of customers in the most recent quarter. As a result, this will be a lagging indicator of Cloudflare’s underlying business trends. Based on our visibility, we believe the deceleration in DNR is nearing a bottom.”Importantly, renewal rates in the second quarter were consistent with the quarterly average in 2022, which was an all-time high for the company. Instead, similar to the last two quarters, the decline in DNR was again primarily driven by slower expansion in our larger customer cohort. We calculate DNR by comparing the analyzed revenue from paying customers four quarters prior to the annualized revenue from the same set of customers in the most recent quarter. As a result, this will be a lagging indicator of Cloudflare’s underlying business trends. Based on our visibility, we believe the deceleration in DNR is nearing a bottom.”

Source: Cloudflare Investor Relations

• Total paying customers grew by 15% YoY to 174,129.
• Large customers (greater than $100,000 annualized revenue) have declined considerably and is at nearly half the growth rate of 34% YoY compared to last year. This needs to accelerate when the AI story plays out.

Source: Cloudflare Investor Relations

Conclusion:

The goal of the analysis is to make it clear why Act 3 is what we are interested in, and how Cloudflare is uniquely positioned to bring inference to the edge. The Big 3 will also do this with an ever-expanding edge footprint, yet Cloudflare is grassroots enough to attract a large developer following. The company states there are 1 million active developers with 10 million active applications for Workers. This puts Cloudflare well on its way to become a leading developer platform. Five years ago, we pointed toward CUDA being Nvidia’s moat. Cloudflare does not have a moat right now but it certainly could over the next few years. Because of Workers, Cloudflare is at the top of our list for building a position.

There are some caveats — if only investing were so simple that all we had to do was find a great product and a strong management team with a history of executing in new markets. Cloudflare’s financials are not FED-proof. This company is not GAAP profitable and won’t be in the near future. The company is cash flow positive, but it’s minimal and subject to network infrastructure capex.

The FED has the power to overshadow even a multi-generational investment opportunity such as AI. Tech is the most sensitive sector to the FED because tech stocks are long duration assets that are priced according to future cash flows. The longer rates stay elevated, the more likely valuations recede and tech stocks get rerated.

This is why we put risk management in the drivers’ seat by carefully and patiently timing our entriesby carefully and patiently timing our entries. Buying Nvidia at the top last year means you would have to sit through a (-60%) drawdown. This drawdown was steepest the month the H100 shipped. However, buying Nvidia in October means you are sitting on 300% returns. This helps illustrate why identifying a great product is secondary to risk management tools. We expect something similar for Cloudflare — to where timing will be everything.

For real-time trade alerts and weekly 1-hour webinars with the portfolio manager of the I/O Fund, sign up here for Advanced Market Signals.sign up here for Advanced Market Signals.

Royston Roche, Equity Analyst for the I/O Fund, contributed to this analysis.

Recommended Reading:

• Palo Alto Networks: “Firmly” GAAP Profitable
• AEHR Fiscal Q1: More Orders Likely this Fiscal Year
• CrowdStrike: Steady Growth, Strong Bottom Line
• Nvidia Q2 FY24 Earnings: 226% Q3 Data Center Growth is Bonkers

This month, we’ve been looking more closely at the impact AI will have on cybersecurity. We covered CrowdStrike twice recently before earnings here and also after earnings plus a refresher on the product here. On the Essentials side, we highlighted a few companies’ key metrics. On the free side, we published an overview of why the cybersecurity industry will be the next to be disrupted by AI.

Today, we are looking at Palo Alto Networks’ financials, and will follow-up soon with more analysis on Palo Alto’s platform. What we like about PANW is that it gives you the best of both worlds – it has the potential to accelerate in revenue growth from its platform approachits platform approach to cybersecurity and has an enviable bottom line. The value proposition for the platform approach is similar to Microsoft’s value proposition, which is that a platform consolidates many vendors under one umbrella. As AI begins to automate tasks and transform cybersecurity, Palo Alto Networks stands to benefit as a one-stop-shop. Although nearly every cybersecurity company is attempting to acquire startups to become a platform, Palo Alto Networks has a five-year head start.

In the free editorial we published, we highlight that if cybercrime were a country, it would be the world’s third-largest economy, second to the United States and China. The costs that enterprises dedicate to cybersecurity is expected to increase from $8 trillion to $10.5 trillion by 2025. At 12% of IT budgets, what we want to find is the companies that will drive down these costs for enterprises.

Financials:

Palo Alto Networks is GAAP profitable with expanding margins. This has helped PANW outperform against its peers in 2023.

Revenue and EPS:

• Palo Alto’s revenue in the recent quarter ending July grew 26% year-over-year to $1.95 billion. Management guidance in the quarter is in the range of $1.82 billion to $1.85 billion, for growth of 17.4% at the midpoint. This is slightly below consensus of 18%.
• Management is targeting 17% to 19% in revenue and billings growth over the next three fiscal years.

Source: Seeking Alpha

• Palo Alto’s adjusted EPS grew by 80% YoY to $1.44 in the recent quarter, beating estimates by 12.03%.
• Adjusted EPS is expected to grow 40.3% YoY to $1.16 in the next quarter.

Source: Company IR/Seeking Alpha

Margins

Palo Alto is GAAP profitable, which sets it apart from other cloud stocks. Per management: “We are now firmly GAAP profitable with GAAP net income of over $200 million in the quarter.”

The margin expansion below is quite impressive.

• In the most recent quarter, the gross margin expanded 590 basis points YoY to 74.1%.
• The adjusted gross margin increased by 410 basis points YoY to 77.3% and was primarily helped by a higher software mix. The normalization of supply chain costs also helped to improve margins (PANW has hardware exposure) and there were lower costs associated with combining customer service support efforts across the platform. The company also uses generative AI to lower customer service costs.
• The operating margin was 12.98% in the recent quarter compared to 0.99% in the same period last year.
• The adjusted operating margin improved by 760 basis points YoY to 28.4% in the recent quarter. The company’s current business mix and focus on efficiency initiatives have helped to improve margins significantly. The efficiency initiatives include resource utilization and streamlining the sales force.
• The net margin of 12% compares to 0% in the year ago quarter. The company was also able to deliver more profits by focusing on helping their largest customers to upgrade.
• The adjusted net margin of 25% compares to 16% in the year ago quarter.

Looking ahead, management expects adjusted operating margins in the range of 25% for fiscal year 2024, and in the range of 28.5% in fiscal year 2026, with a long-term opportunity to reach the low to mid-30 percentile.

Free Cash Flow:

• Operating cash flow margin of 21% for cash flow of $414 million. Notably, the cash flow margin has been unusually high in previous quarters at 79% margin due to lumpy collections. It was particularly high in fiscal Q1 of last year, ending in October. We are making this note for the upcoming earnings season should cash flow be high again.
• Adjusted free cash flow of 20% for $387.8 million.

The company has managed to generate consistent adjusted free cash flow margins in the past three years, with 32.6% in FY21, 33.3% in FY22, and 38.8% in FY23. The management guide for FY ending July 2024 is a FCF margin of 37.5%. Dipak Golechha, CFO of the company, stated: “This higher operating profitability, strong bookings growth and interest income form the baseline for our free cash flow at higher levels, as we achieved 39% adjusted free cash flow margins in fiscal year 2023.”

Management also stated they are confident of maintaining a baseline of 37% adjusted FCF over the next three years. Some of this longer-term visibility is helped by deferred payments, which were up 400% over a three-year period in Q4.

The company has cash and investments of $5.4 billion. The company repaid 2023 convertible notes of $1.7 billion in cash in the recent quarter. The next repayment is due in 2025 for $2.0 billion and the company plans to settle this in cash.

Key Metrics:

Remaining Performance Obligation (RPO) grew by 30% YoY in the recent quarter to $10.6 billion. Management expects 25% RPO growth annually through FY26.

This statement was quite bullish: “Additionally, we see about two-thirds of our revenue in fiscal year '26, driven by current RPO entering the year highlighting the increase in predictability of our revenue profile.” Not only does this lay a nice foundation for future beats on revenue, but the market tends to reward predictability while it penalizes uncertainty. This really is one of the most bullish things a management team can say.

It’s been discussed on the earnings call that management believes RPO is a better metric than Bookings since it is not impacted by billing terms, such as customers preferring deferred payments in the current environment. This is a common discussion on earnings calls across the board, at the moment. RPO represents the booked business the company expects to recognize as revenue in future periods, and cannot be canceled. The market tends to reward companies that have RPO growth that is higher than revenue growth as it can be a leading indicator as to the health of future revenue growth percentages.

Source: Company IR

Palo Alto’s billings grew by 18% YoY to $3.2 billion. Billings growth is showing a deceleration, although the market was forgiving with strong price action following the earnings report as the company is up against tough comps. Billings grew 44% in the year ago quarter, and so the 18% reported this quarter was better than feared. 

Management guidance for billings is in the range of $2.05 billion to $2.08 billion, representing a YoY growth of 18% at the mid-point for the next quarter. They also expect billings to grow in the range of 17% to 19% for the next three years. The guidance impressed analysts. RBC Capital analyst mentioned in a research note, “The company's Q4 results were generally fine as some metrics were better and some were mixed, but the real highlight was the better-than-expected outlook for billings in FY24 and billings growth through FY26.” , but the real highlight was the better-than-expected outlook for billings in FY24 and billings growth through FY26.” 

Source: Company IR

Next-Generation Security (NGS) ARR grew by 56% YoY to $2.96 billion in the recent quarter. For FY24 management expects NGS ARR in the range of $3.95 billion to $4.0 billion, an increase of 34% to 36%. 

Source: Company IR

Conclusion:

We will dive deeper into Palo Alto’s products and competitive positioning soon. As of now, the chart is not looking like a buy. Although we do not have plans to buy at the moment, we want to be prepared to buy if the chart affords us a good entry, and thus are doing our due diligence now.

Palo Alto’s financials are nearly flawless given the many stumbles its peers have reported this past year. When you combine the unusual performance with an incoming trend like AI-powered threat prevention that can block attacks as they happen and also transform security operations, it’s only prudent for us to put this stock in our pipeline.

For real-time trade alerts and weekly 1-hour webinars with the portfolio manager of the I/O Fund, sign up here for Advanced Market Signals.sign up here for Advanced Market Signals.

Royston Roche, equity analyst for the I/O Fund, contributed to this analysis

 Recommended Reading:

• CrowdStrike: Steady Growth, Strong Bottom Line
• CrowdStrike: On the Brink of Becoming GAAP Profitable
• Marvell’s AI Opportunity Plus Q2 Earnings Notes
• Super Micro Q4 Earnings: Half of Revenue is from AI
• Google Q2 2023 – Year of Execution

CrowdStrike is becoming a strong candidate for the I/O Fund portfolio for the following reasons:

• Larger revenue base than its peers at about $3 billion per year, yet often stronger growth than peers that have half the revenue
• Stronger bottom line than the majority of the 5-year cohort of IPOs that went public around 2018-2020. CrowdStrike is stronger on GAAP earnings and free cash flow.
• CrowdStrike is GAAP profitable for two quarters, although we prefer the company be GAAP profitable from operations. If GAAP operating margin continues on the same trajectory, this could happen soon.

Below, we go into a brief overview of CrowdStrike’s core business, plus a few ways the Falcon Platform has expanded since we last covered the stock. The analysis also discusses the impact AI will have on cybersecurity companies.

CrowdStrike’s Falcon Platform:

CrowdStrike’s Falcon platform delivers comprehensive breach protection against sophisticated attacks on endpoints. Due to the sheer number of endpoints in a corporate network, this is where the majority of attacks are made. Compromised credentials across desktops, laptops, and mobile devices are often the hardest points of access to secure.

Endpoint security refers to protecting the endpoints or entry points of the end-user devices such as desktop PCs, laptops, mobile devices, and servers from being exploited. Originally, CrowdStrike was a EDR platform (endpoint detection and response) until it expanded and adopted the XDR acronym in 2022, which stands for extended, as it includes more data points than a EDR platform. As part of moving from EDR to XDR, CrowdStrike added cloud security to its platform.

Extended detection and response (XDR) is cross-layered detection and response. XDR collects and automatically correlates data across multiple security layers – email, server, cloud workloads, and network – so threats are detected faster and security analysts improve investigation and response times.

CrowdStrike’s AI based security model is focused on collecting large amounts of data, centrally storing it in a single model, and continuously training its algorithms with vast amounts of data. The more data that the Falcon Platform collects, the more intelligent the platform becomes in detecting and stopping breaches.

The company’s cloud-native Falcon platform was built to provide automated protection to stop sophisticated cyber-attacks. It is capable of protecting workloads across servers, laptops, virtual machines, mobile, cloud, and the Internet of Things (IoT). With hybrid deployments, and the internet of things, the risk of cyber-attacks has increased, and the need to protect digital assets has increased.

The Falcon platform has 22 modules offered via a subscription-based model under various categories like cloud security, endpoint security, Crowd XDR, Security & IT Operations, Managed Services, Threat Intelligence, Identity Protection, and Log Management. These modules can be easily deployed on the customer’s endpoints and workloads and can be easily scaled depending on the needs of each customer.

One of the most popular upgrades is Falcon Complete, CrowdStrike’s fully managed detection and response solution that offers Fusion no-code security automation to proactively remediate issues. This helps less technical employees work alongside Falcon Complete throughout IT and security departments. This is important due to a cybersecurity training gap between the small talent pool and the dire need for larger security teams.

The upgrade process for modules within the Falcon Complete tier is driving CrowdStrike’s ongoing growth. For example, the company has been accelerating its growth in subscription customers that adopt five or more modules, six or more modules and seven or more modules. We discuss this more in the Financials Overview below.

This includes modules such as Discover, Spotlight, Identity Protection and Log Management. At one point, the company reported on four or more modules, yet retired this key metric as it became commonplace to upgrade to four. Users download a lightweight agent on each endpoint and cloud workload with only a single agent required to upgrade to more modules.

The agent also protects workloads when offline and sends data to the Falcon platform. The data from workloads are analyzed by machine learning models and are capable of preventing future attacks. The events are sent to the Threat Graph in real-time to be further analyzed.

The Threat Graph is a proprietary and a dynamic graph database. It continuously looks for malicious activity by using Artificial Intelligence. The data needs to be collected only once and can be used to analyze how to prevent future attacks. It also enables the company to introduce new products by using the same data and this is one of the reasons that CrowdStrike was able to rapidly introduce new modules.

The company has a smart filtering system that helps filter enormous amounts of data. The company estimates that a typical endpoint generates 100 GB of unfiltered system event data daily. A typical corporation will have several endpoints. The company’s smart filtering helps reduce the noise, and the Falcon agent only sends the crucial data required for detecting, preventing, and investigating attacks. It thereby improves the performance and allows for efficiently analyzing large volumes of data.

The Threat Graph is a powerful product in preventing breaches as it predicts and prevents modern threats in real-time through endpoint telemetry, threat intelligence and AI-powered analytics. This works alongside the modules to offer a best-of-breed endpoint security solution that offers a combination of agent-based and agentless solutions on one dashboard across public cloud, multi-cloud, and hybrid deployments.

The company feels that agent-based is still essential to offer pre-runtime and runtime protection, whereas according to CrowdStrike, agentless-only solutions offer partial visibility and lack remediation capabilities (i.e., the company is referring to SentinelOne which we’ve covered here and also here). With that said, CrowdStrike has recently enhanced it’s agentless offering with a virtual analyst with generative AI features.

The company has three graphs: Threat Graph, Intel Graph and the Asset Graph.

Threat Graph: As discussed, takes trillions of data points from millions of sensors and enriches the threat intelligence from third-party sources (hence “crowd” strike). This offers full visibility and provides automated threat prevention.

Intel Graph: Offers threat intelligence by correlating massive amounts of data and provides insights into any shifts in tactics or techniques

Asset Graph: Launched last year to increase protection across attack vectors such as cloud, on-premise systems, mobile, IoT and connects them into a unified, visual graph rather than a list.

CrowdStrike’s Land and Expand Strategy:

One of the company’s primary strategies is to use its strong, defensible position on endpoints and expand to other layers in the security stack. As enterprises look to lower budgets, the goal is to have them tap CrowdStrike as a replacement for the fragmented list of security vendors that enterprises currently use. This is a normal cycle for tech innovation to where it can become vertical and fragmented before more horizontal, consolidated platforms emerge.

Endpoints are arguably the most difficult to protect, therefore, it stands that an endpoint security company could expand into other turf by combining endpoint with other products. The company’s most recent expansion includes: cloud security, identity protection and LogScale SIEM.

The most important point for investors to take away from the section below is that the company’s total addressable market (TAM) is growing. It was $25 billion during the company’s IPO in 2019 and is expected to reach $126 billion in 2025 with planned new offerings. expected to reach $126 billion in 2025 with planned new offerings. The TAM is expected to be $71 billion in 2024 with the current portfolio offering.

Of CrowdStrike’s $2.9 billion in ending ARR, nearly $600 million came from cloud security, identity protection and SIEM. We want to highlight these three because they are the fastest growing components within the Falcon platform. As you’ll see, they will also help contribute to an inflection point in net new ARR.

Cloud Security:

According to Checkpoint, cloud-based environments are the second most popular targets for hackers, following corporate and internal networks as the number one. According to Frost & Sullivan, the global cloud workload protection platform market (CWPP) recorded revenue of $3.05 billion, representing growth of 47.9%. The market is expected to grow at a CAGR of 26.3% through 2027 due to “the increasing demand for runtime protection and automated threat response.” The forecast below predicts cloud security will grow at a CAGR of 22.5% through 2032.

Source: GlobeNewsWire

Cloud is a growth lever for CrowdStrike as the company leverages a microservices architecture for rapid and frequent updates. The company offers support for Kubernetes workloads with additional runtime protection and simplified deployment. Kubernetes is automation orchestration for containers and allows for scaling of a container rather than an entire application. Kubernetes was created by Google and is used by 78% of companies managing containers with this open-source system.

Agentless is important for cloud security in order to reduce friction for developers. Instead of requiring an agent for workloads, developers can adopt agentless workload protection that is built into cloud-native applications for total coverage including runtime, plus full automation, including features such as zero trust.

CNAPP, or cloud native application protection platform, is a term coined by Gartner in 2021. Due to Zero Trust being an important component for CNAPP, CrowdStrike competes with Zscaler and Cloudflare in Cloud Security.

Management was recently asked on the earnings call what the benefit is to offering CNAAP from an endpoint security company instead of a Zero Trust company. This is a good question to ask because Zero Trust manages perimeter-less security architectures, and cloud is certainly perimeter-less. Workloads that include both containers and serverless also spin up and down based on demand, and this could also be best served by a Zero Trust company as permissions are more complex given the dynamic quality of cloud workloads.

The primary difference is that Zscaler and Cloudflare will protect the environment by controlling access, whereas CrowdStrike is trained in detecting and responding to threats. Another primary difference is that CrowdStrike only recently began to offer cloud security as it’s traditionally an endpoint company that launched cloud security in 2020, whereas Zscaler and Cloudflare are predominately cloud security companies that grew in prominence by helping companies migrate to the cloud by replacing their traditional VPNs and networking solutions. In contrast, about 10% of endpoints secured by a typical endpoint security company are cloud related. However, over time, cloud security could surpass the endpoint market, and thus, you can expect CrowdStrike to make an outsized effort here.

As to why CrowdStrike would be used for cloud security over ZS and NET, management answered with this: “It's not just around the cloud workload protection, but it's also around the cloud security posture management and everything really from code to cloud.”

Cloud security posture management refers to a comprehensive view of a security landscape to help identify misconfiguration issues or compliance risks. An example of “code to cloud,” is to secure the development pipeline as applications are built from open-source code, libraries, and APIs. CrowdStrike’s management is also stating that workload protection is also important, which refers to real-time threat detection and vulnerability management.

Another interpretation is this – Zscaler and Cloudflare may have been first, but CrowdStrike is better because it consolidates what other best-of-breed companies do while offering more comprehensive coverage. That’s CrowdStrike’s perspective although I’m sure ZS and NET would argue that an endpoint company with $300 million in cloud security revenue does not compare to a company that specializes in cloud migrations and has $1 to $2 billion in revenue.

Notably, in July, it was rumored that CrowdStrike was in negotiations to acquire a startup called Bionic.AI for about $300 million. If this acquisition is officially announced, it would grow CrowdStrike’s cloud security footprint to become more specialized in application visibility. The company uses an AI domain because the solution is agentless.

Identity Protection:

This quarter, identity protection reported $200 million in ending annual recurring revenue, which is up 194% year-over-year. The identity protection adoption rate for new customers grew over 100% year-over-year and the total number of deals tied to identity increased 200%.

According to management, “identity-based attacks represented 62% of all interactive intrusions we observed in the last 12 months.” Also, according to CrowdStrike, 80% of breaches are identity-driven. These attacks are particularly difficult to identify because they mimic typical user behavior. Examples include stolen credentials that are used on other systems, accessing user data stored in Microsoft Active Directory, or man-in-the-middle attack where an attacker intercepts passwords or banking details.

The Falcon Identity Platform offers threat detection and threat protection (that’s a tongue twister!) through behavioral analysis and looks for anomalies across accounts and users, while also tracking authentications for elevated risk. The platform offers authentication protection end-to-end.

LogScale SIEM:

“The number of customers using LogScale grew more than 3x year-over-year. LogScale ending ARR grew over 200% year-over-year and is quickly approaching the $100 million ARR milestone, which we expect to achieve in Q3.” –Q2 2023 Earnings Call

SIEM combines security information and security events into one management tool. SIEM systems log data from many sources to identify deviations and alert the security team. The system is either rules-based or correlates to event log entries. The goal is to find the priorities within a large volume of security data through incident detection.

For example, a user that attempts to login 10 times but fails would be a lower priority event, whereas a user that attempts to login 100 times would be a high priority event as it’s likely a brute-force attack.

SOAR is another acronym used in advanced SIEM, and it stands for security orchestration, automation and response. SOAR platforms ingest alert data, and then automate response workflows. Overall, SOARs are more efficient than SIEM systems by adding in automation through automated playbooks and by using AI to learn pattern behaviors with the goal of predicting threats before they happen. Human analysts are needed to sort through events to determine which ones require prioritizing, while AI learns pattern behaviors to help flag which anomalies are most urgent.

Splunk is a heavyweight in SIEM with $3.7 billion in revenue last year. About two years ago, CrowdStrike acquired a leading SIEM provider called Humio. As stated above, the $100 million does not compare to Splunk, but CrowdStrike’s goal is that those looking to consolidate endpoint protection with SIEM will choose CrowdStrike to drive down costs compared to stringing together many vendors.

Cybersecurity and AI:

Combining cybersecurity with AI has a natural affinity as cyberattacks are computer generated, and in turn, computers are uniquely capable of finding computer-generated threats. For example, Chat-GPT heightens security risks as generative AI is capable of writing malicious code or acting as a sidekick to the human hacker writing malicious code. To level the playing field, the best defense will also be self-learning, generative AI tools.

This is early days, so I don’t want to get too far ahead of ourselves, yet the point is that CrowdStrike already has a strong foundation. Now, we may be layering in a new trend that can drive further growth, which is to protect against the risks that large language models pose. By offering agentless, theoretically, fewer human agents will be needed.

Charlotte AI uses generative artificial intelligence as an agent, or a security analyst. Security professionals can ask the AI assistant questions about threat vectors and receive responses, such as “Which threat actors target us?” It also reduces repetitive tasks by automating them. Rather than relying on existing data sets, generative AI is able to create net-new outputs that are based on patterns and structures inherent to the training data. According to management, a virtual analyst that automates tasks can complete eight hours of work in 10 minutes.to management, a virtual analyst that automates tasks can complete eight hours of work in 10 minutes. Pricing information will become available later this month at the Fal.Con conference.

There will be competitors with generative AI agentless solutions. However, CrowdStrike’s contention is that their data is more valuable, and this is the most important element to AI-related outcomes. The statement that CrowdStrike’s data is more valuable is based on the vast number of threats their platform has already detected. Essentially, the argument is that their XDR platform is better than competitors, and therefore, their data is better than competitors, which results in smarter and more accurate AI output. Here is how management spoke about it: “we actually have a very well-defined training set that's annotated based upon all the threat hunting that we've done over the last 10 years.”

Automation reduces the number of false positives. Instead of getting every piece of telemetry that requires the security team to investigate, AI-assisted endpoint detection and response solutions eliminates the noise so that the security team is only responding to those that have the potential to be critical. Fundamentally, cybersecurity is a data problem. CrowdStrike’s Falcon platform ingests, correlates, and queries petabytes of structured and unstructured data from ever-expanding disparate external and internal sources in real-time. It builds rich context and delivers greater visibility by constructing a dynamic representation of data across an organization. As a result, the company’s AI models are often highly accurate in triggering a response.

What matters to customers is that every threat is detected very quickly, and CrowdStrike proposes a solution that is able to do both because automation and AI is best done at the data level rather than by only managing thousands of user endpoints to mitigate attacks.

Financials:

CrowdStrike’s revenue growth was in the 60% range this time last year, and will exit the year at a 30% growth rate over the span of 18 months. For our purposes, this deceleration is not ideal. However, we are willing to overlook this for two reasons:

• The bottom line has been growing, and this is what separates a cloud company from the long list of cloud companies that are years away from becoming GAAP profitable. In our opinion, to own companies that are not GAAP profitable is to gamble the Fed is done raising rates, which is a complicated gamble as it’s entirely outside of a company’s control.
• CrowdStrike’s key metrics may be pointing toward an acceleration, or at least, an improvement in the growth profile.

In the most recent quarter, CrowdStrike reported revenue of $731.6 million, for growth of 36.7%. For the next quarter, CrowdStrike is guiding for revenue of $775.4M to $778M, for growth of 33.7% at the midpoint.

The company reported adjusted EPS of $0.74 and GAAP EPS of $0.03. This beat estimates of $0.56 and ($0.06). Next quarter, CrowdStrike is expected to report adjusted EPS of $0.74.

This quarter, CrowdStrike earned $36.6 million in interest income, which offset losses from operations at (-$15.4) million. The outcome was a net profit of $8.5 million. Operating losses have improved from (-$48.3) million in the year ago quarter. Ideally, this time next year, CrowdStrike reports GAAP operating profits. The company is certainly on that trajectory.

Margins:

In the most recent quarter, CrowdStrike reported a gross margin of 75%, which has improved one to two basis points over the past few quarters. The adjusted gross margin has also improved one or two basis points to 78%.

The GAAP operating margin reported quite a bit of improvement at (-2%) up from (-9%) in the year ago quarter.

In Q2, there was a sizable beat on adjusted operating profit at $155.7 million, compared to management’s guidance of $120.1M, at the midpoint. Adjusted operating profits have nearly doubled YoY from $87.4M in the year ago quarter.  There was also strong growth QoQ of 34.2%. The last time CrowdStrike grew its adjusted operating margin by four basis points QoQ was in CY 2021. Management has guided flat for fiscal Q3 for $155.4M at the midpoint. The same is true for the adjusted net margin at 25%, which added five basis points QoQ.

As discussed, the GAAP net profits were $8.5 million for a margin of 1%.

Stock based compensation weighs on CrowdStrike’s GAAP operating margin, although less so compared to other cloud companies. In the current quarter, SBC was 22.5% of revenue. This is higher than last quarter at 18.9% of revenue. An analyst asked about this in the call, with management replying with this:

“So, number one, we are going to continue to invest as aggressively as we can while keeping to our commitment to our profitability metrics. And for us, I think that the key here, you had mentioned on the stock-based compensation, a lot of that is based on timing of grants and I think that for us, we're going to continue to use grants to attract and retain. Having said that, we think that we are going to continue to show low dilution, less than 2% this year and strive to keep it under 3% for next year.”

In Q1, the company had stated the following: "Third evolution is GAAP profit which we will continue to focus on and drive towards achieving sustainability. Of course, SBC is the biggest piece of that. We continued to manage SBC and we are going to be mindful balanced with retaining the best and the brightest talent that's paramount for us." 

Key Metrics:

There were two key metrics that are worth pointing out. The first was management’s comments about an inflection in net new ARR in the second half of the year. We had highlighted the importance of this key metric going into the call: “We are interested in this earnings report to see if Crowdstrike bottoms soon in this regard, which would indicate new business is recovering and upgrades are resuming.”

This statement was quite important in terms of confirming what we wanted to see.

“Heading into the second half of the year, we see increased momentum in the business, driven by record levels of new logo and upsell pipeline, record deal registrations from our market-leading partner ecosystem and record levels of customers proudly trusting CrowdStrike to be their long-term security platform consolidator of choice. We are also observing substantial changes in the competitive landscape, uniquely benefiting CrowdStrike. With the business momentum we see and competitive market dynamics, we believe our second half performance will yield double-digit net new ARR growth.”

In the current quarter, net new ARR growth hopefully bottomed at (-10%) decline YoY for $196.2 million. This compares to 44.8% growth in the year ago quarter. The steep difference, and the risk of going double-digit negative, is ultimately why we stepped aside from this company. If we take the current quarter’s results coupled with management’s comments at face value, it appears net new ARR is at an inflection point. 

Pictured Above: Net new ARR is showing signs of bottoming in this quarter, and when coupled with CrowdStrike’s guide that net new ARR will “yield double-digit net new ARR growth”

When providing full year guidance, the company’s CFO, Burt Podbere stated: “We are raising our revenue guidance for the fiscal year and maintaining our net new ARR assumptions for the second half and fiscal year, which call for in line to modestly up net new ARR for the full year.” Using this guidance, we calculate that net new ARR in the 2H 2023 will be around $460 million, representing about 10% YoY growth. The ending ARR is expected to grow 32% YoY to $3.4 billion.

ARR in the current quarter was $2.93 billion for growth of 37% YoY, compared to 42% YoY last quarter. This is a deceleration from the 59% growth in the year ago quarter.

One thing to note is that the company used to report number of subscription customers, and has dropped this key metric from its coverage. Typically, this means the growth rate was undesirable.

However, the number of modules per customer is increasing, and the company has seen a steady acceleration of one basis points or more per quarter in customers adopting 7 or more modules, 6 or more modules, and 5 or more modules.

The second highlight in key metrics was remaining performance obligation (RPO) of $3.6 billion, which was up 43% year-over-year and up 8% QoQ. This accelerated from Q1, which was up 41% YoY and flat QoQ. In the year ago quarter, RPO decelerated in growth from Q1-Q2 from 60% growth in Q1 to 49% growth in Q2. In an effort to find an inflection point, RPO could also be signaling that this quarter might be the bottom.

Per our write-up going into the earnings report, this was a key metric we were watching closely: “It will also be interesting to see if RPO bottoms over the next few quarters. It was at 41.2% growth last quarter.”

Dollar based net retention rate of 120% was lower than last year by five to seven basis points.

Cash Flow:

Operating cash flow of $244.8 million is up from $210 million in the year ago quarter. This represents an op cash flow margin of 33%.

Free cash flow of $188.7 million is up from $2.32M in the year ago quarter. This represents a free cash flow margin of 26%. The company has $3.2 billion in cash and $742M in debt.

After the first two quarters in FY2024, the free cash flow margin is at 29% of revenue, representing 42% YoY growth. As stated in the earnings call, management is on track to reach its goal of a 30% free cash flow margin in FY2024.

A Note on Microsoft:

Big Tech is formidable when it comes to AI because it has the cash reserves coupled with a strong motivation to not only succeed, but rather to “rule them all.” We are talking about companies that have been cash flow positive for decades up against a company that is a fraction of its size. As enamored as we may be with a smaller company taking on Big Tech, Microsoft’s cybersecurity revenue stands 6X-7X larger than CrowdStrike’s revenue today, and there is plenty of cash reserves and adjacent products that can fuel Microsoft’s growth. The reason customers choose Microsoft is because it drives down costs to consolidate cybersecurity with their suite of enterprise software. As a lead investor in OpenAI and ChatGPT, Microsoft is likely years ahead of CrowdStrike when it comes to AI capabilities – especially generative AI.

Conclusion:

We’d like to add cybersecurity to our portfolio on the next pullback. This is one strong candidate and we will cover another strong candidate over the next week or so. Advanced Market Signals members receive real-time trade alerts when we enter a position, along with a 1 hour webinar every week with the I/O Fund Portfolio Manager who discusses what positions he is looking to trim, add, buy or sell. Learn more here.

Recommended Reading:

• CrowdStrike: On the Brink of Becoming GAAP Profitable
• Marvell Q2 Earnings: 7% to 14.4% Incoming AI Revenue
• Marvell’s AI Opportunity Plus Q2 Earnings Notes
• Super Micro Q4 Earnings: Half of Revenue is from AI

We want to put a spotlight on CrowdStrike going into the earnings report tomorrow, and to point out the company was GAAP profitable in the last quarter. This is something that other cloud companies will take years to achieve — if they get there at all.

This was an important accomplishment, yet per management, this will take time to become more consistent: "We also reached GAAP profitability for the first time in company history. While we are very proud of this milestone, we have yet to reach sustained GAAP profitability […] We believe reaching this milestone demonstrates that our financial model will deliver GAAP profitability in due time."we have yet to reach sustained GAAP profitability […] We believe reaching this milestone demonstrates that our financial model will deliver GAAP profitability in due time."

Here’s how CrowdStrike compares to a sample of best-of-breed. For illustrative purposes, much larger companies that have been public for a long time have been omitted (Adobe, Salesforce, Microsoft, etc.). Note that net margin was 0% last quarter while GAAP operating margin was (-2.8%)

CrowdStrike went public in 2019, yet has a cash flow margin of 33% and an operating cash flow margin of 43%. The cash flow margin defies the few, brief years the company has been on the market. Most tech companies are burdened with stock-based compensation or growth tactics that deplete cash, especially in the initial years that follow the IPO. Stock based compensation is at 18.9% in the most recent quarter, and has been trending downward from the 24% range.

One thing to watch for in the upcoming earnings report is the net new ARR, as it had a steep decline last year from a range of 60% growth YoY down to 17% YoY. We covered this in November.

Fast-forward, and net new ARR was down (-8.6%) in the most recent quarter and is expected to be (-11.3%) in the current quarter. The decline pictured below is expected to continue this quarter.

We are interested in this earnings report to see if Crowdstrike bottoms soon in this regard, which would indicate new business is recovering and upgrades are resuming. Per management in the last earnings call: “When we look at our pipeline for the remainder of the year, we expect this trend to continue, giving us confidence in our ability to deliver net-new ARR growth in the back half of the year.”

ARR has been more resilient, but per some comments on various earnings calls, it’s expected to exit FY2024 at “low 30%” growth. I’m curious if this will beat as the year goes on, and if FY2024 is a bottom for ARR, as well.

It will also be interesting to see if RPO bottoms over the next few quarters. It was at 41.2% growth last quarter.

Revenue and EPS:

Crowdstrike is expected to report revenue of $724.4 million in the upcoming earnings report, due on August 30th. This will represent growth of 35.4%.

Next quarter, the company is expected to report revenue of $774.5 million for growth of 33.3%.

Expected adjusted EPS this quarter is $0.56 which is 55% higher than last year’s Q2 at $0.36.

Margins – Reported Last Quarter:

The most important takeaway is that margins are very strong for Crowdstrike compared to its peers.

• Last quarter, the gross margin of 76% expanded by 200 basis points compared to the year ago quarter.
• The adjusted gross margin of 78% improved by 100 basis points compared to the year ago quarter. Subscription gross margin also improved 100 basis points.
• The GAAP operating margin of (-3%) improved from (-4.90%) in the year ago quarter. Although it’s promising that the margin is close to reaching GAAP operating profitability, the quarter ending in April tends to have the better margin profile.
• Adjusted operating margin of 17% was flat year-over-year.
• GAAP net margin of 0% improved from (-6.5%) in the year ago quarter.
• The adjusted GAAP net margin of 20% improved from 15.3% in the year ago quarter.

Margins – In the Upcoming Quarter:

Management guided for $120.1 million at the midpoint in adjusted operating income, which represents an adjusted operating margin of 16.6%.

Management also guided for $133.3 million for net profits, for a margin of 18.4%

If CrowdStrike reports as expected, it’ll be some of the best margins the company has reported.

Cash Flow:

• Last quarter, operating cash flow was $300.9 million for a margin of 43%.
• The free cash flow was $227.4 million, for a margin of 33%.

There is $1.91 billion on the balance sheet and $739 million in debt.

Conclusion:

This is a brief note to say we are watching CrowdStrike very closely. This is not an earnings call rather it’s a few bullet points prior to earnings to organize our thoughts should there be a strong ER. If it’s a weak ER, we will put the company on hold until next quarter. 

 Recommended Readings:

• Nvidia Q2 FY24 Earnings: 226% Q3 Data Center Growth is Bonkers
• Marvell Q2 Earnings: 7% to 14.4% Incoming AI Revenue
• Alphabet Q2 Earnings: More on the Year of Execution
• Cloud Earnings Review: Digging Deeper on Best-of-Breed
• Datadog Q4 Earnings: A Candid, Conservative Management Style