Cloudflare has leveraged its content delivery network footprint to also offer application and website security. The company further innovated with Zero Trust combined with SASE network connectivity, and also eliminated egress fees for object storage to attract developers. What’s quite rare about Cloudflare is that the company is leveraging its global network to offer compute, storage and application services.

That’s a mouthful. There’s a lot of jargon when discussing Cloudflare that cannot be avoided. What’s important to take away from this analysis is that Cloudflare has laid down important stepping stones to becoming a dominant player in AI. Although we have to focus on the what (product), we also want to connect the dots on the why (strategy). This analysis will break down Cloudflare’s visionary approach on bringing AI inference to the edge; an approach that is a decade or more ahead of the competition. That is, if there is any competition among best-of-breed companies.

The analysis below touches base on Cloudflare’s core products as a CDN and best-of-breed leader in cloud-based security and application security. We will also discuss Zero Trust. However, the point of describing these products is so that I/O Fund Members understand how each of these is interconnected, and how these products uniquely position Cloudflare to capture AI inference at the edge. By my estimation, every market Cloudflare has entered over the past 14 years has been leading up to this point.

Product Overview:

Cloudflare references its business units as “Acts” – Act 1, Act 2 and Act 3. The company defines Act 1 as application security, Act 2 as Zero Trust and Act 3 as the Workers Platform. For our purposes as stock investors, it’s Act 3 we are most interested in. The analysis below makes it abundantly clear as to why Act 3 and the Workers platform is where the most explosive moment could occur.

Before we discuss Cloudflare’s positioning to democratize AI development and bring inference to the edge, it’s well worth the time to discuss the stepping stones that can create a moat of sorts. As stated, the most important section of the analysis begins at Act 3: Workers Platform.

CDN: Content Delivery Network

Cloudflare owns a predominant share of the CDN market. Content Delivery Networks are essentially a middleman that sits between the client/users and the origin server. CDNs contain a cached copy of website content on multiple servers located across the world to help improve page loading times.

When a person visits a website, it will provide the content from the server closest to the end-user, which helps increase the delivery speed of the content. When a website is hosted on a server in the United States, the person browsing the website from any part of the globe, like Asia or Europe, will receive the content from the nearest location instead of the server in the USA.

Pictured Above: CDNs are the middleman between origin servers and client devices.
Source: WallarmWallarm

Cloudflare has 300 points of presence (POPs) which are servers that sit at the edge. Hyperscalers, such as Google, Microsoft and Amazon, offer more centralized data centers. These data centers are geographically distributed but are designed for compute intensive workloads more than speed. Content delivery networks, as the name suggests, are designed for speed because their primary function is to deliver content as quickly as possible. This means smaller servers in more locations, with an emphasis on the network, which is why Cloudflare advertises that 95% of the world’s population is within 50 milliseconds with 12,500 network partners. In contrast, cloud data centers are much larger (think football field size) and are designed for a variety of workloads that are not only more compute intensive but also require a lot of storage.

Before I keep going, I want to make it clear that the Big 3 (AWS, Google Cloud and Azure) also have points of presence (POPs) and edge infrastructure. AWS has 400 points of presence (POPs), Azure 192 POPs, and Google Cloud has 120 POPs. The original dot-com CDN is Akamai, and this company has 4,200 POPs. As inference moves more toward the edge network and edge devices, you can expect the Big 3 will increase the number of POPs and strike close partnerships with telecom companies to leverage millions of 5G points-of-presence (POPs) for fast network speeds.

So then, given that Cloudflare is up against tech’s heavyweights who can build POPs with their large cash reserves and partner with telecoms, what is Cloudflare’s competitive advantage? Sitting at the edge is one of many stepping stones for Cloudflare. But this is where the similarities end.

Reverse Proxy and Anycast:

I want to touch base on reverse proxy and Anycast to help illustrate Cloudflare’s leading position as a middleman. This will also help illustrate how Cloudflare has leveraged its position to greatly improve application performance when we discuss Serverless.

Large Market Penetration:

According to data from W3Techs, 79.9% of websites that use a CDN or reverse proxy rely on Cloudflare.

Source: Intricately and KinstaKinsta

The customer count is high because Cloudflare offers free services. Cloudflare has 1.154 million customers and makes $1.3 billion in revenue whereas Akamai has 143,000 customers and makes $3.8 billion in revenue.

Of the 1.154 million customers, 174,129 have upgraded to Cloudflare’s paid services. This ratio of free to paid is rare. I can’t think of another company offering free enterprise and SMB services at this scale. Customers contributing over $100,000 in revenue have been growing steadily and are now at 2,352. Notably, 31% of the Fortune 1000 use Cloudflare, so it’s not only SMBs that drive revenue.

The benefits of having a free base are that these customers are likely to upgrade to paid services, and free users can be used to test products to eliminate a long quality assurance (QA) process for faster product launches. It also helps illustrate how developer-friendly Cloudflare is, on the core CDN and security products, but also for its Workers platform.but also for its Workers platform.

Reverse Proxy:

Reverse proxy allows for cloud security features by sitting in front of web servers and forwarding client requests to the web servers. By routing through a vendor’s reverse proxy before routing to the server, the vendor has the opportunity to provide cloud-based security. This is important because Cloudflare sits at a critical juncture in the tech stack, to where it can uniquely combine its capabilities as a CDN with application and cloud-based security. Therefore, you can combine fast speeds and better application performance seamlessly with web application firewalls, DDoS protection, API gateways and bot management. 

Pictured Above: By being a reverse proxy, Cloudflare can also be a forward proxy for security services. This allows Cloudflare to become a one-stop-shop that combines many application needs. As more developers use Cloudflare for AI purposes, security features will act as an seamless upgrade. Right now, security drives Cloudflare’s revenue.

Anycast is a Material Differentiator:

Being a middleman between internet traffic and servers creates strong positioning for vendor-related products and services. By being a content delivery network that protects against DDoS attacks, Cloudflare was forced to innovate around how to handle incoming requests.

The Anycast network was designed to be resilient for a surge in traffic by routing incoming traffic to the nearest server. Traffic finds the best path to the most available data center rather than overwhelming the origin server where the request was created. In this case, traffic can be spread across the entire network. According to Cloudflare, the network spans 300 cities, 100 countries with over 12,500 network partners that are connected to Cloudflare. Cloudflare has continually innovated its core products with features such as automatic platform optimization which allows websites to cache static HTML on edge servers.

Anycast has a latency in the milliseconds by answering requests from the edge instead of routing to an origin server. This is important for AI inference, which we will touch on later in the analysis.latency in the milliseconds by answering requests from the edge instead of routing to an origin server. This is important for AI inference, which we will touch on later in the analysis.

Over the past ten years, Anycast has increasingly gotten smarter by using routing algorithms. Today, developers also use the Cloudflare network to proxy requests for APIs. This reduces API latency by placing Cloudflare in front of the API, allowing Cloudflare’s DNS resolver to direct the request to the nearest Cloudflare server.

More on Cloud-based Network Security:

Cloudflare has been forced to innovate to handle DDoS-levels of botnet traffic. By being a middleman, Cloudflare answers a few needs combined into one, which is application speed and performance alongside security. This is rare, as usually security vendors do not typically improve application performance, let alone improve application performance to an extent that exceeds the hyperscalers (reference Serverless section below).

Because Cloudflare has a large global presence, it’s particularly well suited for analyzing traffic to determine security risks. The company is able to analyze and detect attacks by running a background program known as a daemon on every server in every data center. The scans are shared as threat intelligence among the servers in each data center without affecting the latency of the CDN.

Cloudflare is able to mitigate at optimal locations in the tech stack, for example at L4 inside the firewall or at L7 inside the reverse proxy with a 403 error page. The company is advanced at preventing L3 DDoS attacks, which targets network equipment and infrastructure. The benefit of having access to more of the stack for security purposes is that CPU consumption and intra-data center bandwidth remains relatively unaffected. It’s also autonomous so Cloudflare is not using manual employees for this process

Distributed denial-of-service (DDoS) attacks are a type of security threat where botnets create a surge of traffic to a network and crash a targeted site. DDoS attacks are essentially bots that send millions of requests to overload servers and to shut down a specific website by targeting its IP address. Often times, these bots are run from devices infected with malware and operated remotely by an attacker. In 2021, Cloudflare detected and mitigated a 17.2 million request-per-second DDoS attack, which was three times larger than any previous DDoS attack on record. This is two-thirds the average rate per second that Cloudflare had served in all of Q2.

These outages are very common, with some of the larger DDoS attacks taking down popular social media sites and consumer applications like Twitter and Spotify (and countless others throughout the years). During 2020, DDoS attacks surged by 300%. During this time, Cloudflare went from 10% penetration across all websites to 19%.

They can also cross-sell security and CDN customers with WAN-as-service, or Magic WAN, which connects office networks through the local area network. The company also offers application delivery controllers located centrally within a customer’s infrastructure for Layer 3 through Layer 7 security for applications and APIs.

Quick Takeaway:

DDoS helped put Cloudflare on the map, and it’s important to discuss this because Cloudflare is capable of protecting against some of the world’s most prevalent cyberattacks. By providing cloud-based security alongside edge serverless at low prices, Cloudflare has added benefits the hyperscalers do not inherently provide.

Zero Trust:

Following Covid, Zero Trust gained acceptance due to rising security threats from hybrid work teams. Secure access service edge (SASE) is a cybersecurity concept that utilizes Zero Trust to identify users and devices to deliver secure access to specific applications or data. The need for this has grown due to remote teams as SASE allows policy-based security no matter where the user, application or device is located. 

Zero Trust Security is built on the premise that no one should be trusted within or outside the network. In traditional security systems, it is difficult to obtain access from outside the network while those located inside the network were trusted.

With Zero Trust, these trust assumptions are removed with tools such as multi-factor authentication, giving access for a limited time and to also verify, authorize and to have a continuous check on all the data points that are given access.

In this case, Cloudflare uses the company’s proxy infrastructure for both reverse proxy and forward proxy. The company’s edge network is ideal for SASE because the cloud-driven architecture is meant to secure all applications, data, users and devices. Having a footprint of hundreds of POPs enables a security approach that others SASE vendors cannot duplicate.

Quick takeaway:

Cloudflare’s position as the middleman allowed Cloudflare to skate where the puck was going. The company quickly positioned for the Zero Trust market when Covid drove hybrid work environments by releasing Cloudflare One in October of 2020 — which was an incredible 6-7 month turn around from when shelter-in-place began. The cloud firewall approach was able to overcome issues that traditional firewalls, both hardware and virtualized, could not overcome in terms of capacity planning, managing devices, and needing to apply Zero Trust policies across all traffic rather than centralizing traffic to one, physical location. As stated, the company’s edge network is ideal for SASE because the cloud-driven architecture is meant to secure all applications, data, users and devices – and this will come in handy as AI moves more toward the edge.

Act 3: Workers Platform

Cloudflare is not only a CDN and security company. Rather, Cloudflare is being bold by leveraging its global network to offer compute, storage and application services.

The benefit of serverless is to deploy applications without the customer having to provision the compute infrastructure. The servers for executing the code are deployed by cloud service providers, hence it’s “serverless” for the customer. With serverless, it takes minutes to run code. 

Fundamentally, Cloudflare approaches serverless differently than the hyperscalers. Amazon’s (AWS) Lambda functions are executed in containers. When an event triggers the code, a runtime container is started and code is loaded from S3. The container then waits for another execution. If too much time passes, the container is deleted and a new container is required. This is popular because you pay for what you use, and are charged based on the number of requests for your functions. The drawback is that every time a container is spun up, the language runtime is spun up in addition to the code. Moving data centers closer to the edge does not entirely solve this problem because there are fewer machines and less memory, which means cold starts will still occur with a containerized process.

To avoid cold starts, some developers will pay for synthetic requests. This means developers must choose between unreliable execution time with quite a bit of variability (sometimes a few seconds) or they have to pay extra for synthetic requests to keep the function warm.

Cloudflare eliminated cold starts entirely with its Workers platform. There are a few milliseconds where Cloudflare can have Workers runtime load a hostname before a TLS certificate is sent back and the original encrypted request is sent. By the time the HTTPS protocol is ready to send secure data between a browser and a website, Cloudflare has the Worker runtime warm. This means Worker executes code the minute the request is received.

What’s crazy is that Cloudflare rolls out features that exceed hyperscaler performance at minimal cost. It is this combination of competing with the hyperscalers, delivering app performance at faster speeds — while keeping prices low — that is unique to Cloudflare.while keeping prices low — that is unique to Cloudflare.

More on Serverless Cold Starts and Isolates:

Serverless is event-driven, which means when an event is received, it’s spun up and the request is processed. Serverless platforms are free at first but become more expensive as an application scales.

Serverless is billed in two ways:

• Number of requests – billed in increments of every million requests per month
• Compute time – measured in GB per seconds, higher memory execution costs more than lower memory execution
• Data transfer and Storage Costs, this depends on the use case

Cloudflare’s approach to serverless is fundamentally different than the hyperscalers. Amazon’s Lambda is one of the more traditional serverless platforms. As discussed, it works by spinning up a containerized process for code, which if inactive at the time the request is received, leads to “cold starts.” As discussed, a cold start is when a new copy of code is started on a machine, which can cause one to four seconds of lag time. 

Source: Mikhail.io

If an instance is already active, then there is a “warm start” and there is no lag time. You can read about the idle instance lifetimes here in terms of how long an instance can idle before it requires another cold start.

In contrast, the Workers platform uses something called isolates. Isolates allow a single process to run up to thousands of isolates. Although hyperscalers will promote the ability to scale, it can be costly to do so. With Cloudflare’s serverless approach, developers pay for the Javascript runtime once, and then are able to run more scripts without additional costs. The isolate runs faster than a node process, and also uses less memory because isolates do not share or access the memory of another isolate (hence the name isolate). By not sharing memory, there is a security feature to isolates.

Additionally, Cloudflare’s serverless Workers platform does not use containers or virtual machines. This means applications do not require the cold starts that virtual machines require. Instead, code runs close to the “metal” – or in other words, on an edge server. This reduces the request response time compared to serverless platforms offered by hyperscalers such as AWS Lambda, Lambda@Edge, Lambda Native and Google’s Firebase.

Because of some of these fundamental differences, Cloudflare claims to cold start applications within five milliseconds. Per Cloudflare: “Any given isolate can start around a hundred times faster than a Node process on a container or virtual machine.” The company also states: “on startup, isolates consume an order of magnitude less memory.”

Out the gate, the Workers platform was designed to compete with AWS’s Lambda and Lambda@Edge by being faster. According to Cloudflare, Workers was 441% faster than a Lambda function and 192% faster than Lambda@Edge. The speed is possible because Cloudflare offers serverless through its edge network, which is distributed and decentralized.

The Workers Platform is on fire in terms of growth. Per the most recent earnings call: “Our developer platform, Cloudflare Workers, continues its explosive growth. We reached 10 million active Workers applications in Q2, up 250% since December and 490% year-over-year.” These applications were at 2.2 million less than a year ago in Q3, and were at 4.9 million last quarter.

Pictured Above: Cloudflare Workers Platform has seen applications surge. Source: Cloudflare Investor Relations

It’s not clear how much the 10 million is contributing to revenue. Per management: “But I would say that we have been very pleasantly surprised at how quickly the Workers' platform is taking off. But we are not, at this time, optimizing that platform for how can we bring as many dollars out of it as possible.”

However, this is where the magic of a developer moat often starts – a platform that advocates for developers, offers something of value (lower costs, higher performance, more accessibility), and then patiently waits for the tide to come in.

Quick takeaway:

Cloudflare combines executing runtime for an application close to the user and removes cold starts by running isolates that create an advantage at the edge. This is distinct from pushing compute from a centralized data center to the edge. It’s also distinct from containerized processes that require cold starts.

R2 Object Storage

Cloudflare’s R2 storage allows unstructured data to be stored without egress bandwidth fees, which are charged when developers retrieve data from a cloud provider like AWS. This was a bold move by Cloudflare to prove it can compete against a hyperscaler on cloud storage.

The egress fees that Cloudflare is disrupting are essentially a tax without any value. Markups are as high as 7900% in the United States region when calculating what AWS charges. This is an 80X bandwidth markup and was detailed here by Cloudflare’s management. Eliminating egress fees with R2 Storage places Cloudflare in direct competition with Amazon’s S3.

Cloudflare’s motivation is to win over developers and their loyalty. Per the CEO: “We want developers to keep developing, not worrying about their storage bill. Our aim is to make R2 Storage the least expensive, most reliable option for storing data, with no egress charges. I’m constantly amazed by what developers are building on our platform, and look forward to continued innovation as we expand the tools they have access to.”

Primarily, Cloudflare is hoping to attract developers for its Workers platform by eliminating unnecessary fees on cloud storage. R2 Storage will help Cloudflare grow its addressable market and will help the company compete as a best-of-breed player in of multi-cloud.

In response, Amazon lowered prices by up to 31% but this may not be enough if Cloudflare removes egress fees entirely. When Cloudflare announced R2 storage, the company’s co-founder and CEO, Matthew Prince, tweeted, “Why R2? Because it’s S3 minus the one most annoying thing: egregious egress.”

It is interesting to note that Amazon successfully grew by targeting companies that had good margins with a famous quote from Jeff Bezos, “Your margin is my opportunity.” Now, companies like Cloudflare are doing what Amazon did in its early days by toughening the competition. Amazon’s AWS is a profitable powerhouse, and if Cloudflare can attract even a small share of AWS customers, it could be a game-changer for Cloudflare. Per management on the most recent call: “Cloudflare is the most commonly used cloud provider across the leading AI startups. They're using R2 to help arbitrage the lowest GPU cost to train their models.”

R2 Object Storage is growing quickly. Management stated in the last earnings call: “R2 continues to grow and now stores over 13 petabytes of customer data, up 85% quarter-over-quarter. We have 44,000 distinct paying customers with R2 subscription, and brand name customers are beginning to adopt it as their primary object storage solution.”

Inference at the Edge:

There are two primary steps to AI/ML: training and inference. Training is the learning phase and is compute intensive. GPT-3 had 175 billion parameters and required 300 zettaflops and 300,000 billion math operations across it’s training cycle. For the most part, training is done by high performance computing systems and is often done in the cloud instead of on-prem.

However, inference is a different matter entirely. Cloud computing through the hyperscalers has a long transmission delay. What inference needs is speed so it can retain the learning from the training phase, while quickly applying data it’s never seen before. Inference takes batches of real-world data and quickly comes back with an answer or prediction. This is best done at the edge, which includes the edge network that Cloudflare provides, and edge devices, such as smartphones and laptops.

In the inference stage, the compute intensive neural networks are modified for speed and to improve latency. In order to do this, inference is optimized for runtime performance. This allows the computation tasks to be as close to the data source as possible. In many cases, data is produced at the edge, and it’s more efficient and faster to run inferencing at the edge.

For many inferencing tasks, Cloudflare’s distributed edge servers will handle tasks without needing to exchange data with the cloud. This helps to optimize the traffic load. For other tasks, the cloud will act as a backup not only for processing but also for scalable storage. So, it’s important to understand that Cloudflare is not a direct competitor in the traditional sense, but in some cases, compliments the Big 3. Look Cloudflare to play up its multi-cloud approach and the common goal of increasing the number of AI applications and improving accessibility to developers.

It’s true that hyperscalers will increase their edge footprint, and will partner with telecoms for fast speeds. However, AI developers need an advocate, and because Cloudflare owns their infrastructure, their strategy of driving down costs and improving GPU accessibility makes a lot of sense.

There are more details that we will visit later down the line, such as ONNX runtime, which allows Cloudflare to be the middleman as a routing layer between cloud data centers, the edge network and devices – and AI gateways, which allow developers to cache AI responses and monitor performance to mitigate AI costs.

Connecting the Dots:

If we connect the dots, then it becomes clear Cloudflare has a few distinct advantages as the platform of choice for AI developers. Here’s a summary of what’s been discussed:

• Does not rely on Big 3 infrastructure and can drive down costs
• Is faster on performance because of its position at the edge; this lowers costs and latency for AI inference and keeps data as close to the user as possible
• Geographically equipped to handle compliance issues that will inevitably result from using training data for inference. You can read more about ChatGPT running into issues in Italy here.
• The company has moved diligently into compute, storage and application services. Combined with its global network, this positions the company for AI inference as-a-service. There is no other company doing both edge network plus compute and storage except the hyperscalers. However, in some cases such as serverless, Cloudflare exceeds the performance of the hyperscalers
• CDN as a core product and security as a seamless upgrade shows the importance of being a middleman, helping to position Cloudflare to innovate around Serverless in ways that outperform even AWS.   
• Training models is prohibitively expensive by requiring upfront costs, Nvidia GPUs are hard to obtain, and AI development is not democratized for developers with proprietary, blackbox APIs that run counter to an open-source movement (GPT-4 versus Llama). Cloudflare aims to solve these problems by allowing popular models to run closer to the user, which is the next logical step for AI.

Ultimately, the bigger and the faster a network is, the more it’s capable of providing “as a service.” AI can create a fortuitous moment for Cloudflare because the company is positioned to offer AI inference-as-a-service.

Last month, there was an important announcement with Cloudflare launching Workers AI. This new platform is the sum of the parts we discussed in this analysis.

Financials:

Cloudflare is strong on revenue growth with analysts expecting consistency over the next few quarters. This kind of consistency is rare in the cloud and security category. However, Cloudflare is not GAAP profitable and the AI story will take a back seat if there is a FED-related selloff, or if for any other reason we enter a risk-off market for growth stocks.

Revenue and EPS

All numbers are for the current Q2 quarter ending in June and are year-over-year comps unless otherwise stated.

• Revenue grew 31.5% to $308.5 million and was in line with expectations. Next quarter the company is expected to grow 30% to $330.5 million in revenue.
• Full year revenue guidance for 2023 is $1.283 billion to $1.287 billion, representing growth of 31.8% at the mid-point.

Pictured Above: Cloudflare is expected to report consistent growth
Source: YCharts/Seeking Alpha

Adjusted EPS of $0.10 is up from $0.00 in the year ago quarter. The consensus for next quarter is $0.10. However, on a GAAP basis, the company is unprofitable with GAAP EPS of ($-0.28) reported compared to ($-0.13) expected. The miss in GAAP EPS is due to a $50.3 million loss on extinguishment of debt for a negative impact of $0.15 EPS. 

Pictured Above: Bottom line growth on an adjusted basis is expected to slow

Margins:

Cloudflare has a strong gross margin yet stock-based compensation weighs on the GAAP operating margin.

• Gross margin of 75.6% is strong and necessary for this company to expand.
• The operating margin of (-18.20%) compared to (-27.50%) a year ago. However, it got worse QoQ and has remained flat this year with no improvement.
  ·  Stock based compensation is high at 22.2% of revenue.
• Adjusted operating margin improved by 700 basis points YoY to 6.6%.
  ·  Sales and marketing expenses decreased as a percentage of revenue by 300 basis points YoY to 41%.
  ·  R&D expenses decreased by 300 basis points YoY to 17%
  ·  G&A expenses decreased by 200 basis points YoY to 13%.
• Adjusted operating income guidance for the next quarter ranges from $20 million to $21 million or 6.2% of revenue.
• Net margin of (-30.60%) with the net loss increasing last quarter primarily due to the loss on extinguishment of debt of ($50.3 million) due to early repurchase of 2025 convertible senior notes. Per the 10-Q: “In May 2023, the Company repurchased $123.0 million principal amount of the 2025 Notes (the 2025 Notes Repurchases) for $172.7 million in cash, including accrued interest payable of $0.5 million.”
• Adjusted net margin of 10.9% compared to 0.1% in the same period last year.

Source: Cloudflare Investor Relations

Cash Flow and Balance Sheet:

Compared to its peers, Cloudflare’s cash flows are a bright spot. The operating cash flow margin was 21% compared to 16% in the same period last year. Free cash flow improved to 6% from (-2%) in the same period last year and was up 1% sequentially. Previously, management had guided to being breakeven on cash flows in H1 2023.

Thomas Seifert, CFO of the company, had said in the Q4 2022 earnings call, “While we expect free cash flow to trend upward on an ongoing basis, for modeling purposes we anticipate near-term variability in our cash flow generation with the first half of 2023 expected to be relatively breakeven.”

One of the differences between operating cash flow and free cash flow is network capex of 11% in the most recent quarter. Network capex is expected to be 10% to 12% of revenue in FY2023. This is a primary reason as to why FCF can be minimal at times.

The company has cash and available-for-sale securities of $1.59 billion. It repurchased $123 million convertible senior notes in the recent quarter and had an outstanding $1.32 billion.

Key Metrics

Remaining performance obligation (RPO) is declining yet is still above revenue growth. In the recent quarter, RPO grew by 36% YoY and was up 8% QoQ to $1 billion. The deceleration pictured below is quite apparent and RPO will need to accelerate when the AI story plays out.

Source: Cloudflare Investor Relations

The dollar-based net retention rate was 115% in the recent quarter. Management believes that the deceleration in DBNRR is nearing a bottom.

This is very important for Cloudflare to prove to investors as we move through the next few quarters. Thus, we’ve provided the full statement below.

Thomas Seifert said in the recent earnings call, “Our dollar-based net retention rate was 115% during the second quarter, representing a decrease of 200 basis points sequentially. Importantly, renewal rates in the second quarter were consistent with the quarterly average in 2022, which was an all-time high for the company. Instead, similar to the last two quarters, the decline in DNR was again primarily driven by slower expansion in our larger customer cohort. We calculate DNR by comparing the analyzed revenue from paying customers four quarters prior to the annualized revenue from the same set of customers in the most recent quarter. As a result, this will be a lagging indicator of Cloudflare’s underlying business trends. Based on our visibility, we believe the deceleration in DNR is nearing a bottom.”Importantly, renewal rates in the second quarter were consistent with the quarterly average in 2022, which was an all-time high for the company. Instead, similar to the last two quarters, the decline in DNR was again primarily driven by slower expansion in our larger customer cohort. We calculate DNR by comparing the analyzed revenue from paying customers four quarters prior to the annualized revenue from the same set of customers in the most recent quarter. As a result, this will be a lagging indicator of Cloudflare’s underlying business trends. Based on our visibility, we believe the deceleration in DNR is nearing a bottom.”

Source: Cloudflare Investor Relations

• Total paying customers grew by 15% YoY to 174,129.
• Large customers (greater than $100,000 annualized revenue) have declined considerably and is at nearly half the growth rate of 34% YoY compared to last year. This needs to accelerate when the AI story plays out.

Source: Cloudflare Investor Relations

Conclusion:

The goal of the analysis is to make it clear why Act 3 is what we are interested in, and how Cloudflare is uniquely positioned to bring inference to the edge. The Big 3 will also do this with an ever-expanding edge footprint, yet Cloudflare is grassroots enough to attract a large developer following. The company states there are 1 million active developers with 10 million active applications for Workers. This puts Cloudflare well on its way to become a leading developer platform. Five years ago, we pointed toward CUDA being Nvidia’s moat. Cloudflare does not have a moat right now but it certainly could over the next few years. Because of Workers, Cloudflare is at the top of our list for building a position.

There are some caveats — if only investing were so simple that all we had to do was find a great product and a strong management team with a history of executing in new markets. Cloudflare’s financials are not FED-proof. This company is not GAAP profitable and won’t be in the near future. The company is cash flow positive, but it’s minimal and subject to network infrastructure capex.

The FED has the power to overshadow even a multi-generational investment opportunity such as AI. Tech is the most sensitive sector to the FED because tech stocks are long duration assets that are priced according to future cash flows. The longer rates stay elevated, the more likely valuations recede and tech stocks get rerated.

This is why we put risk management in the drivers’ seat by carefully and patiently timing our entriesby carefully and patiently timing our entries. Buying Nvidia at the top last year means you would have to sit through a (-60%) drawdown. This drawdown was steepest the month the H100 shipped. However, buying Nvidia in October means you are sitting on 300% returns. This helps illustrate why identifying a great product is secondary to risk management tools. We expect something similar for Cloudflare — to where timing will be everything.

For real-time trade alerts and weekly 1-hour webinars with the portfolio manager of the I/O Fund, sign up here for Advanced Market Signals.sign up here for Advanced Market Signals.

Royston Roche, Equity Analyst for the I/O Fund, contributed to this analysis.

Recommended Reading:

• Palo Alto Networks: “Firmly” GAAP Profitable
• AEHR Fiscal Q1: More Orders Likely this Fiscal Year
• CrowdStrike: Steady Growth, Strong Bottom Line
• Nvidia Q2 FY24 Earnings: 226% Q3 Data Center Growth is Bonkers

This month, we’ve been looking more closely at the impact AI will have on cybersecurity. We covered CrowdStrike twice recently before earnings here and also after earnings plus a refresher on the product here. On the Essentials side, we highlighted a few companies’ key metrics. On the free side, we published an overview of why the cybersecurity industry will be the next to be disrupted by AI.

Today, we are looking at Palo Alto Networks’ financials, and will follow-up soon with more analysis on Palo Alto’s platform. What we like about PANW is that it gives you the best of both worlds – it has the potential to accelerate in revenue growth from its platform approachits platform approach to cybersecurity and has an enviable bottom line. The value proposition for the platform approach is similar to Microsoft’s value proposition, which is that a platform consolidates many vendors under one umbrella. As AI begins to automate tasks and transform cybersecurity, Palo Alto Networks stands to benefit as a one-stop-shop. Although nearly every cybersecurity company is attempting to acquire startups to become a platform, Palo Alto Networks has a five-year head start.

In the free editorial we published, we highlight that if cybercrime were a country, it would be the world’s third-largest economy, second to the United States and China. The costs that enterprises dedicate to cybersecurity is expected to increase from $8 trillion to $10.5 trillion by 2025. At 12% of IT budgets, what we want to find is the companies that will drive down these costs for enterprises.

Financials:

Palo Alto Networks is GAAP profitable with expanding margins. This has helped PANW outperform against its peers in 2023.

Revenue and EPS:

• Palo Alto’s revenue in the recent quarter ending July grew 26% year-over-year to $1.95 billion. Management guidance in the quarter is in the range of $1.82 billion to $1.85 billion, for growth of 17.4% at the midpoint. This is slightly below consensus of 18%.
• Management is targeting 17% to 19% in revenue and billings growth over the next three fiscal years.

Source: Seeking Alpha

• Palo Alto’s adjusted EPS grew by 80% YoY to $1.44 in the recent quarter, beating estimates by 12.03%.
• Adjusted EPS is expected to grow 40.3% YoY to $1.16 in the next quarter.

Source: Company IR/Seeking Alpha

Margins

Palo Alto is GAAP profitable, which sets it apart from other cloud stocks. Per management: “We are now firmly GAAP profitable with GAAP net income of over $200 million in the quarter.”

The margin expansion below is quite impressive.

• In the most recent quarter, the gross margin expanded 590 basis points YoY to 74.1%.
• The adjusted gross margin increased by 410 basis points YoY to 77.3% and was primarily helped by a higher software mix. The normalization of supply chain costs also helped to improve margins (PANW has hardware exposure) and there were lower costs associated with combining customer service support efforts across the platform. The company also uses generative AI to lower customer service costs.
• The operating margin was 12.98% in the recent quarter compared to 0.99% in the same period last year.
• The adjusted operating margin improved by 760 basis points YoY to 28.4% in the recent quarter. The company’s current business mix and focus on efficiency initiatives have helped to improve margins significantly. The efficiency initiatives include resource utilization and streamlining the sales force.
• The net margin of 12% compares to 0% in the year ago quarter. The company was also able to deliver more profits by focusing on helping their largest customers to upgrade.
• The adjusted net margin of 25% compares to 16% in the year ago quarter.

Looking ahead, management expects adjusted operating margins in the range of 25% for fiscal year 2024, and in the range of 28.5% in fiscal year 2026, with a long-term opportunity to reach the low to mid-30 percentile.

Free Cash Flow:

• Operating cash flow margin of 21% for cash flow of $414 million. Notably, the cash flow margin has been unusually high in previous quarters at 79% margin due to lumpy collections. It was particularly high in fiscal Q1 of last year, ending in October. We are making this note for the upcoming earnings season should cash flow be high again.
• Adjusted free cash flow of 20% for $387.8 million.

The company has managed to generate consistent adjusted free cash flow margins in the past three years, with 32.6% in FY21, 33.3% in FY22, and 38.8% in FY23. The management guide for FY ending July 2024 is a FCF margin of 37.5%. Dipak Golechha, CFO of the company, stated: “This higher operating profitability, strong bookings growth and interest income form the baseline for our free cash flow at higher levels, as we achieved 39% adjusted free cash flow margins in fiscal year 2023.”

Management also stated they are confident of maintaining a baseline of 37% adjusted FCF over the next three years. Some of this longer-term visibility is helped by deferred payments, which were up 400% over a three-year period in Q4.

The company has cash and investments of $5.4 billion. The company repaid 2023 convertible notes of $1.7 billion in cash in the recent quarter. The next repayment is due in 2025 for $2.0 billion and the company plans to settle this in cash.

Key Metrics:

Remaining Performance Obligation (RPO) grew by 30% YoY in the recent quarter to $10.6 billion. Management expects 25% RPO growth annually through FY26.

This statement was quite bullish: “Additionally, we see about two-thirds of our revenue in fiscal year '26, driven by current RPO entering the year highlighting the increase in predictability of our revenue profile.” Not only does this lay a nice foundation for future beats on revenue, but the market tends to reward predictability while it penalizes uncertainty. This really is one of the most bullish things a management team can say.

It’s been discussed on the earnings call that management believes RPO is a better metric than Bookings since it is not impacted by billing terms, such as customers preferring deferred payments in the current environment. This is a common discussion on earnings calls across the board, at the moment. RPO represents the booked business the company expects to recognize as revenue in future periods, and cannot be canceled. The market tends to reward companies that have RPO growth that is higher than revenue growth as it can be a leading indicator as to the health of future revenue growth percentages.

Source: Company IR

Palo Alto’s billings grew by 18% YoY to $3.2 billion. Billings growth is showing a deceleration, although the market was forgiving with strong price action following the earnings report as the company is up against tough comps. Billings grew 44% in the year ago quarter, and so the 18% reported this quarter was better than feared. 

Management guidance for billings is in the range of $2.05 billion to $2.08 billion, representing a YoY growth of 18% at the mid-point for the next quarter. They also expect billings to grow in the range of 17% to 19% for the next three years. The guidance impressed analysts. RBC Capital analyst mentioned in a research note, “The company's Q4 results were generally fine as some metrics were better and some were mixed, but the real highlight was the better-than-expected outlook for billings in FY24 and billings growth through FY26.” , but the real highlight was the better-than-expected outlook for billings in FY24 and billings growth through FY26.” 

Source: Company IR

Next-Generation Security (NGS) ARR grew by 56% YoY to $2.96 billion in the recent quarter. For FY24 management expects NGS ARR in the range of $3.95 billion to $4.0 billion, an increase of 34% to 36%. 

Source: Company IR

Conclusion:

We will dive deeper into Palo Alto’s products and competitive positioning soon. As of now, the chart is not looking like a buy. Although we do not have plans to buy at the moment, we want to be prepared to buy if the chart affords us a good entry, and thus are doing our due diligence now.

Palo Alto’s financials are nearly flawless given the many stumbles its peers have reported this past year. When you combine the unusual performance with an incoming trend like AI-powered threat prevention that can block attacks as they happen and also transform security operations, it’s only prudent for us to put this stock in our pipeline.

For real-time trade alerts and weekly 1-hour webinars with the portfolio manager of the I/O Fund, sign up here for Advanced Market Signals.sign up here for Advanced Market Signals.

Royston Roche, equity analyst for the I/O Fund, contributed to this analysis

 Recommended Reading:

• CrowdStrike: Steady Growth, Strong Bottom Line
• CrowdStrike: On the Brink of Becoming GAAP Profitable
• Marvell’s AI Opportunity Plus Q2 Earnings Notes
• Super Micro Q4 Earnings: Half of Revenue is from AI
• Google Q2 2023 – Year of Execution

CrowdStrike is becoming a strong candidate for the I/O Fund portfolio for the following reasons:

• Larger revenue base than its peers at about $3 billion per year, yet often stronger growth than peers that have half the revenue
• Stronger bottom line than the majority of the 5-year cohort of IPOs that went public around 2018-2020. CrowdStrike is stronger on GAAP earnings and free cash flow.
• CrowdStrike is GAAP profitable for two quarters, although we prefer the company be GAAP profitable from operations. If GAAP operating margin continues on the same trajectory, this could happen soon.

Below, we go into a brief overview of CrowdStrike’s core business, plus a few ways the Falcon Platform has expanded since we last covered the stock. The analysis also discusses the impact AI will have on cybersecurity companies.

CrowdStrike’s Falcon Platform:

CrowdStrike’s Falcon platform delivers comprehensive breach protection against sophisticated attacks on endpoints. Due to the sheer number of endpoints in a corporate network, this is where the majority of attacks are made. Compromised credentials across desktops, laptops, and mobile devices are often the hardest points of access to secure.

Endpoint security refers to protecting the endpoints or entry points of the end-user devices such as desktop PCs, laptops, mobile devices, and servers from being exploited. Originally, CrowdStrike was a EDR platform (endpoint detection and response) until it expanded and adopted the XDR acronym in 2022, which stands for extended, as it includes more data points than a EDR platform. As part of moving from EDR to XDR, CrowdStrike added cloud security to its platform.

Extended detection and response (XDR) is cross-layered detection and response. XDR collects and automatically correlates data across multiple security layers – email, server, cloud workloads, and network – so threats are detected faster and security analysts improve investigation and response times.

CrowdStrike’s AI based security model is focused on collecting large amounts of data, centrally storing it in a single model, and continuously training its algorithms with vast amounts of data. The more data that the Falcon Platform collects, the more intelligent the platform becomes in detecting and stopping breaches.

The company’s cloud-native Falcon platform was built to provide automated protection to stop sophisticated cyber-attacks. It is capable of protecting workloads across servers, laptops, virtual machines, mobile, cloud, and the Internet of Things (IoT). With hybrid deployments, and the internet of things, the risk of cyber-attacks has increased, and the need to protect digital assets has increased.

The Falcon platform has 22 modules offered via a subscription-based model under various categories like cloud security, endpoint security, Crowd XDR, Security & IT Operations, Managed Services, Threat Intelligence, Identity Protection, and Log Management. These modules can be easily deployed on the customer’s endpoints and workloads and can be easily scaled depending on the needs of each customer.

One of the most popular upgrades is Falcon Complete, CrowdStrike’s fully managed detection and response solution that offers Fusion no-code security automation to proactively remediate issues. This helps less technical employees work alongside Falcon Complete throughout IT and security departments. This is important due to a cybersecurity training gap between the small talent pool and the dire need for larger security teams.

The upgrade process for modules within the Falcon Complete tier is driving CrowdStrike’s ongoing growth. For example, the company has been accelerating its growth in subscription customers that adopt five or more modules, six or more modules and seven or more modules. We discuss this more in the Financials Overview below.

This includes modules such as Discover, Spotlight, Identity Protection and Log Management. At one point, the company reported on four or more modules, yet retired this key metric as it became commonplace to upgrade to four. Users download a lightweight agent on each endpoint and cloud workload with only a single agent required to upgrade to more modules.

The agent also protects workloads when offline and sends data to the Falcon platform. The data from workloads are analyzed by machine learning models and are capable of preventing future attacks. The events are sent to the Threat Graph in real-time to be further analyzed.

The Threat Graph is a proprietary and a dynamic graph database. It continuously looks for malicious activity by using Artificial Intelligence. The data needs to be collected only once and can be used to analyze how to prevent future attacks. It also enables the company to introduce new products by using the same data and this is one of the reasons that CrowdStrike was able to rapidly introduce new modules.

The company has a smart filtering system that helps filter enormous amounts of data. The company estimates that a typical endpoint generates 100 GB of unfiltered system event data daily. A typical corporation will have several endpoints. The company’s smart filtering helps reduce the noise, and the Falcon agent only sends the crucial data required for detecting, preventing, and investigating attacks. It thereby improves the performance and allows for efficiently analyzing large volumes of data.

The Threat Graph is a powerful product in preventing breaches as it predicts and prevents modern threats in real-time through endpoint telemetry, threat intelligence and AI-powered analytics. This works alongside the modules to offer a best-of-breed endpoint security solution that offers a combination of agent-based and agentless solutions on one dashboard across public cloud, multi-cloud, and hybrid deployments.

The company feels that agent-based is still essential to offer pre-runtime and runtime protection, whereas according to CrowdStrike, agentless-only solutions offer partial visibility and lack remediation capabilities (i.e., the company is referring to SentinelOne which we’ve covered here and also here). With that said, CrowdStrike has recently enhanced it’s agentless offering with a virtual analyst with generative AI features.

The company has three graphs: Threat Graph, Intel Graph and the Asset Graph.

Threat Graph: As discussed, takes trillions of data points from millions of sensors and enriches the threat intelligence from third-party sources (hence “crowd” strike). This offers full visibility and provides automated threat prevention.

Intel Graph: Offers threat intelligence by correlating massive amounts of data and provides insights into any shifts in tactics or techniques

Asset Graph: Launched last year to increase protection across attack vectors such as cloud, on-premise systems, mobile, IoT and connects them into a unified, visual graph rather than a list.

CrowdStrike’s Land and Expand Strategy:

One of the company’s primary strategies is to use its strong, defensible position on endpoints and expand to other layers in the security stack. As enterprises look to lower budgets, the goal is to have them tap CrowdStrike as a replacement for the fragmented list of security vendors that enterprises currently use. This is a normal cycle for tech innovation to where it can become vertical and fragmented before more horizontal, consolidated platforms emerge.

Endpoints are arguably the most difficult to protect, therefore, it stands that an endpoint security company could expand into other turf by combining endpoint with other products. The company’s most recent expansion includes: cloud security, identity protection and LogScale SIEM.

The most important point for investors to take away from the section below is that the company’s total addressable market (TAM) is growing. It was $25 billion during the company’s IPO in 2019 and is expected to reach $126 billion in 2025 with planned new offerings. expected to reach $126 billion in 2025 with planned new offerings. The TAM is expected to be $71 billion in 2024 with the current portfolio offering.

Of CrowdStrike’s $2.9 billion in ending ARR, nearly $600 million came from cloud security, identity protection and SIEM. We want to highlight these three because they are the fastest growing components within the Falcon platform. As you’ll see, they will also help contribute to an inflection point in net new ARR.

Cloud Security:

According to Checkpoint, cloud-based environments are the second most popular targets for hackers, following corporate and internal networks as the number one. According to Frost & Sullivan, the global cloud workload protection platform market (CWPP) recorded revenue of $3.05 billion, representing growth of 47.9%. The market is expected to grow at a CAGR of 26.3% through 2027 due to “the increasing demand for runtime protection and automated threat response.” The forecast below predicts cloud security will grow at a CAGR of 22.5% through 2032.

Source: GlobeNewsWire

Cloud is a growth lever for CrowdStrike as the company leverages a microservices architecture for rapid and frequent updates. The company offers support for Kubernetes workloads with additional runtime protection and simplified deployment. Kubernetes is automation orchestration for containers and allows for scaling of a container rather than an entire application. Kubernetes was created by Google and is used by 78% of companies managing containers with this open-source system.

Agentless is important for cloud security in order to reduce friction for developers. Instead of requiring an agent for workloads, developers can adopt agentless workload protection that is built into cloud-native applications for total coverage including runtime, plus full automation, including features such as zero trust.

CNAPP, or cloud native application protection platform, is a term coined by Gartner in 2021. Due to Zero Trust being an important component for CNAPP, CrowdStrike competes with Zscaler and Cloudflare in Cloud Security.

Management was recently asked on the earnings call what the benefit is to offering CNAAP from an endpoint security company instead of a Zero Trust company. This is a good question to ask because Zero Trust manages perimeter-less security architectures, and cloud is certainly perimeter-less. Workloads that include both containers and serverless also spin up and down based on demand, and this could also be best served by a Zero Trust company as permissions are more complex given the dynamic quality of cloud workloads.

The primary difference is that Zscaler and Cloudflare will protect the environment by controlling access, whereas CrowdStrike is trained in detecting and responding to threats. Another primary difference is that CrowdStrike only recently began to offer cloud security as it’s traditionally an endpoint company that launched cloud security in 2020, whereas Zscaler and Cloudflare are predominately cloud security companies that grew in prominence by helping companies migrate to the cloud by replacing their traditional VPNs and networking solutions. In contrast, about 10% of endpoints secured by a typical endpoint security company are cloud related. However, over time, cloud security could surpass the endpoint market, and thus, you can expect CrowdStrike to make an outsized effort here.

As to why CrowdStrike would be used for cloud security over ZS and NET, management answered with this: “It's not just around the cloud workload protection, but it's also around the cloud security posture management and everything really from code to cloud.”

Cloud security posture management refers to a comprehensive view of a security landscape to help identify misconfiguration issues or compliance risks. An example of “code to cloud,” is to secure the development pipeline as applications are built from open-source code, libraries, and APIs. CrowdStrike’s management is also stating that workload protection is also important, which refers to real-time threat detection and vulnerability management.

Another interpretation is this – Zscaler and Cloudflare may have been first, but CrowdStrike is better because it consolidates what other best-of-breed companies do while offering more comprehensive coverage. That’s CrowdStrike’s perspective although I’m sure ZS and NET would argue that an endpoint company with $300 million in cloud security revenue does not compare to a company that specializes in cloud migrations and has $1 to $2 billion in revenue.

Notably, in July, it was rumored that CrowdStrike was in negotiations to acquire a startup called Bionic.AI for about $300 million. If this acquisition is officially announced, it would grow CrowdStrike’s cloud security footprint to become more specialized in application visibility. The company uses an AI domain because the solution is agentless.

Identity Protection:

This quarter, identity protection reported $200 million in ending annual recurring revenue, which is up 194% year-over-year. The identity protection adoption rate for new customers grew over 100% year-over-year and the total number of deals tied to identity increased 200%.

According to management, “identity-based attacks represented 62% of all interactive intrusions we observed in the last 12 months.” Also, according to CrowdStrike, 80% of breaches are identity-driven. These attacks are particularly difficult to identify because they mimic typical user behavior. Examples include stolen credentials that are used on other systems, accessing user data stored in Microsoft Active Directory, or man-in-the-middle attack where an attacker intercepts passwords or banking details.

The Falcon Identity Platform offers threat detection and threat protection (that’s a tongue twister!) through behavioral analysis and looks for anomalies across accounts and users, while also tracking authentications for elevated risk. The platform offers authentication protection end-to-end.

LogScale SIEM:

“The number of customers using LogScale grew more than 3x year-over-year. LogScale ending ARR grew over 200% year-over-year and is quickly approaching the $100 million ARR milestone, which we expect to achieve in Q3.” –Q2 2023 Earnings Call

SIEM combines security information and security events into one management tool. SIEM systems log data from many sources to identify deviations and alert the security team. The system is either rules-based or correlates to event log entries. The goal is to find the priorities within a large volume of security data through incident detection.

For example, a user that attempts to login 10 times but fails would be a lower priority event, whereas a user that attempts to login 100 times would be a high priority event as it’s likely a brute-force attack.

SOAR is another acronym used in advanced SIEM, and it stands for security orchestration, automation and response. SOAR platforms ingest alert data, and then automate response workflows. Overall, SOARs are more efficient than SIEM systems by adding in automation through automated playbooks and by using AI to learn pattern behaviors with the goal of predicting threats before they happen. Human analysts are needed to sort through events to determine which ones require prioritizing, while AI learns pattern behaviors to help flag which anomalies are most urgent.

Splunk is a heavyweight in SIEM with $3.7 billion in revenue last year. About two years ago, CrowdStrike acquired a leading SIEM provider called Humio. As stated above, the $100 million does not compare to Splunk, but CrowdStrike’s goal is that those looking to consolidate endpoint protection with SIEM will choose CrowdStrike to drive down costs compared to stringing together many vendors.

Cybersecurity and AI:

Combining cybersecurity with AI has a natural affinity as cyberattacks are computer generated, and in turn, computers are uniquely capable of finding computer-generated threats. For example, Chat-GPT heightens security risks as generative AI is capable of writing malicious code or acting as a sidekick to the human hacker writing malicious code. To level the playing field, the best defense will also be self-learning, generative AI tools.

This is early days, so I don’t want to get too far ahead of ourselves, yet the point is that CrowdStrike already has a strong foundation. Now, we may be layering in a new trend that can drive further growth, which is to protect against the risks that large language models pose. By offering agentless, theoretically, fewer human agents will be needed.

Charlotte AI uses generative artificial intelligence as an agent, or a security analyst. Security professionals can ask the AI assistant questions about threat vectors and receive responses, such as “Which threat actors target us?” It also reduces repetitive tasks by automating them. Rather than relying on existing data sets, generative AI is able to create net-new outputs that are based on patterns and structures inherent to the training data. According to management, a virtual analyst that automates tasks can complete eight hours of work in 10 minutes.to management, a virtual analyst that automates tasks can complete eight hours of work in 10 minutes. Pricing information will become available later this month at the Fal.Con conference.

There will be competitors with generative AI agentless solutions. However, CrowdStrike’s contention is that their data is more valuable, and this is the most important element to AI-related outcomes. The statement that CrowdStrike’s data is more valuable is based on the vast number of threats their platform has already detected. Essentially, the argument is that their XDR platform is better than competitors, and therefore, their data is better than competitors, which results in smarter and more accurate AI output. Here is how management spoke about it: “we actually have a very well-defined training set that's annotated based upon all the threat hunting that we've done over the last 10 years.”

Automation reduces the number of false positives. Instead of getting every piece of telemetry that requires the security team to investigate, AI-assisted endpoint detection and response solutions eliminates the noise so that the security team is only responding to those that have the potential to be critical. Fundamentally, cybersecurity is a data problem. CrowdStrike’s Falcon platform ingests, correlates, and queries petabytes of structured and unstructured data from ever-expanding disparate external and internal sources in real-time. It builds rich context and delivers greater visibility by constructing a dynamic representation of data across an organization. As a result, the company’s AI models are often highly accurate in triggering a response.

What matters to customers is that every threat is detected very quickly, and CrowdStrike proposes a solution that is able to do both because automation and AI is best done at the data level rather than by only managing thousands of user endpoints to mitigate attacks.

Financials:

CrowdStrike’s revenue growth was in the 60% range this time last year, and will exit the year at a 30% growth rate over the span of 18 months. For our purposes, this deceleration is not ideal. However, we are willing to overlook this for two reasons:

• The bottom line has been growing, and this is what separates a cloud company from the long list of cloud companies that are years away from becoming GAAP profitable. In our opinion, to own companies that are not GAAP profitable is to gamble the Fed is done raising rates, which is a complicated gamble as it’s entirely outside of a company’s control.
• CrowdStrike’s key metrics may be pointing toward an acceleration, or at least, an improvement in the growth profile.

In the most recent quarter, CrowdStrike reported revenue of $731.6 million, for growth of 36.7%. For the next quarter, CrowdStrike is guiding for revenue of $775.4M to $778M, for growth of 33.7% at the midpoint.

The company reported adjusted EPS of $0.74 and GAAP EPS of $0.03. This beat estimates of $0.56 and ($0.06). Next quarter, CrowdStrike is expected to report adjusted EPS of $0.74.

This quarter, CrowdStrike earned $36.6 million in interest income, which offset losses from operations at (-$15.4) million. The outcome was a net profit of $8.5 million. Operating losses have improved from (-$48.3) million in the year ago quarter. Ideally, this time next year, CrowdStrike reports GAAP operating profits. The company is certainly on that trajectory.

Margins:

In the most recent quarter, CrowdStrike reported a gross margin of 75%, which has improved one to two basis points over the past few quarters. The adjusted gross margin has also improved one or two basis points to 78%.

The GAAP operating margin reported quite a bit of improvement at (-2%) up from (-9%) in the year ago quarter.

In Q2, there was a sizable beat on adjusted operating profit at $155.7 million, compared to management’s guidance of $120.1M, at the midpoint. Adjusted operating profits have nearly doubled YoY from $87.4M in the year ago quarter.  There was also strong growth QoQ of 34.2%. The last time CrowdStrike grew its adjusted operating margin by four basis points QoQ was in CY 2021. Management has guided flat for fiscal Q3 for $155.4M at the midpoint. The same is true for the adjusted net margin at 25%, which added five basis points QoQ.

As discussed, the GAAP net profits were $8.5 million for a margin of 1%.

Stock based compensation weighs on CrowdStrike’s GAAP operating margin, although less so compared to other cloud companies. In the current quarter, SBC was 22.5% of revenue. This is higher than last quarter at 18.9% of revenue. An analyst asked about this in the call, with management replying with this:

“So, number one, we are going to continue to invest as aggressively as we can while keeping to our commitment to our profitability metrics. And for us, I think that the key here, you had mentioned on the stock-based compensation, a lot of that is based on timing of grants and I think that for us, we're going to continue to use grants to attract and retain. Having said that, we think that we are going to continue to show low dilution, less than 2% this year and strive to keep it under 3% for next year.”

In Q1, the company had stated the following: "Third evolution is GAAP profit which we will continue to focus on and drive towards achieving sustainability. Of course, SBC is the biggest piece of that. We continued to manage SBC and we are going to be mindful balanced with retaining the best and the brightest talent that's paramount for us." 

Key Metrics:

There were two key metrics that are worth pointing out. The first was management’s comments about an inflection in net new ARR in the second half of the year. We had highlighted the importance of this key metric going into the call: “We are interested in this earnings report to see if Crowdstrike bottoms soon in this regard, which would indicate new business is recovering and upgrades are resuming.”

This statement was quite important in terms of confirming what we wanted to see.

“Heading into the second half of the year, we see increased momentum in the business, driven by record levels of new logo and upsell pipeline, record deal registrations from our market-leading partner ecosystem and record levels of customers proudly trusting CrowdStrike to be their long-term security platform consolidator of choice. We are also observing substantial changes in the competitive landscape, uniquely benefiting CrowdStrike. With the business momentum we see and competitive market dynamics, we believe our second half performance will yield double-digit net new ARR growth.”

In the current quarter, net new ARR growth hopefully bottomed at (-10%) decline YoY for $196.2 million. This compares to 44.8% growth in the year ago quarter. The steep difference, and the risk of going double-digit negative, is ultimately why we stepped aside from this company. If we take the current quarter’s results coupled with management’s comments at face value, it appears net new ARR is at an inflection point. 

Pictured Above: Net new ARR is showing signs of bottoming in this quarter, and when coupled with CrowdStrike’s guide that net new ARR will “yield double-digit net new ARR growth”

When providing full year guidance, the company’s CFO, Burt Podbere stated: “We are raising our revenue guidance for the fiscal year and maintaining our net new ARR assumptions for the second half and fiscal year, which call for in line to modestly up net new ARR for the full year.” Using this guidance, we calculate that net new ARR in the 2H 2023 will be around $460 million, representing about 10% YoY growth. The ending ARR is expected to grow 32% YoY to $3.4 billion.

ARR in the current quarter was $2.93 billion for growth of 37% YoY, compared to 42% YoY last quarter. This is a deceleration from the 59% growth in the year ago quarter.

One thing to note is that the company used to report number of subscription customers, and has dropped this key metric from its coverage. Typically, this means the growth rate was undesirable.

However, the number of modules per customer is increasing, and the company has seen a steady acceleration of one basis points or more per quarter in customers adopting 7 or more modules, 6 or more modules, and 5 or more modules.

The second highlight in key metrics was remaining performance obligation (RPO) of $3.6 billion, which was up 43% year-over-year and up 8% QoQ. This accelerated from Q1, which was up 41% YoY and flat QoQ. In the year ago quarter, RPO decelerated in growth from Q1-Q2 from 60% growth in Q1 to 49% growth in Q2. In an effort to find an inflection point, RPO could also be signaling that this quarter might be the bottom.

Per our write-up going into the earnings report, this was a key metric we were watching closely: “It will also be interesting to see if RPO bottoms over the next few quarters. It was at 41.2% growth last quarter.”

Dollar based net retention rate of 120% was lower than last year by five to seven basis points.

Cash Flow:

Operating cash flow of $244.8 million is up from $210 million in the year ago quarter. This represents an op cash flow margin of 33%.

Free cash flow of $188.7 million is up from $2.32M in the year ago quarter. This represents a free cash flow margin of 26%. The company has $3.2 billion in cash and $742M in debt.

After the first two quarters in FY2024, the free cash flow margin is at 29% of revenue, representing 42% YoY growth. As stated in the earnings call, management is on track to reach its goal of a 30% free cash flow margin in FY2024.

A Note on Microsoft:

Big Tech is formidable when it comes to AI because it has the cash reserves coupled with a strong motivation to not only succeed, but rather to “rule them all.” We are talking about companies that have been cash flow positive for decades up against a company that is a fraction of its size. As enamored as we may be with a smaller company taking on Big Tech, Microsoft’s cybersecurity revenue stands 6X-7X larger than CrowdStrike’s revenue today, and there is plenty of cash reserves and adjacent products that can fuel Microsoft’s growth. The reason customers choose Microsoft is because it drives down costs to consolidate cybersecurity with their suite of enterprise software. As a lead investor in OpenAI and ChatGPT, Microsoft is likely years ahead of CrowdStrike when it comes to AI capabilities – especially generative AI.

Conclusion:

We’d like to add cybersecurity to our portfolio on the next pullback. This is one strong candidate and we will cover another strong candidate over the next week or so. Advanced Market Signals members receive real-time trade alerts when we enter a position, along with a 1 hour webinar every week with the I/O Fund Portfolio Manager who discusses what positions he is looking to trim, add, buy or sell. Learn more here.

Recommended Reading:

• CrowdStrike: On the Brink of Becoming GAAP Profitable
• Marvell Q2 Earnings: 7% to 14.4% Incoming AI Revenue
• Marvell’s AI Opportunity Plus Q2 Earnings Notes
• Super Micro Q4 Earnings: Half of Revenue is from AI

We want to put a spotlight on CrowdStrike going into the earnings report tomorrow, and to point out the company was GAAP profitable in the last quarter. This is something that other cloud companies will take years to achieve — if they get there at all.

This was an important accomplishment, yet per management, this will take time to become more consistent: "We also reached GAAP profitability for the first time in company history. While we are very proud of this milestone, we have yet to reach sustained GAAP profitability […] We believe reaching this milestone demonstrates that our financial model will deliver GAAP profitability in due time."we have yet to reach sustained GAAP profitability […] We believe reaching this milestone demonstrates that our financial model will deliver GAAP profitability in due time."

Here’s how CrowdStrike compares to a sample of best-of-breed. For illustrative purposes, much larger companies that have been public for a long time have been omitted (Adobe, Salesforce, Microsoft, etc.). Note that net margin was 0% last quarter while GAAP operating margin was (-2.8%)

CrowdStrike went public in 2019, yet has a cash flow margin of 33% and an operating cash flow margin of 43%. The cash flow margin defies the few, brief years the company has been on the market. Most tech companies are burdened with stock-based compensation or growth tactics that deplete cash, especially in the initial years that follow the IPO. Stock based compensation is at 18.9% in the most recent quarter, and has been trending downward from the 24% range.

One thing to watch for in the upcoming earnings report is the net new ARR, as it had a steep decline last year from a range of 60% growth YoY down to 17% YoY. We covered this in November.

Fast-forward, and net new ARR was down (-8.6%) in the most recent quarter and is expected to be (-11.3%) in the current quarter. The decline pictured below is expected to continue this quarter.

We are interested in this earnings report to see if Crowdstrike bottoms soon in this regard, which would indicate new business is recovering and upgrades are resuming. Per management in the last earnings call: “When we look at our pipeline for the remainder of the year, we expect this trend to continue, giving us confidence in our ability to deliver net-new ARR growth in the back half of the year.”

ARR has been more resilient, but per some comments on various earnings calls, it’s expected to exit FY2024 at “low 30%” growth. I’m curious if this will beat as the year goes on, and if FY2024 is a bottom for ARR, as well.

It will also be interesting to see if RPO bottoms over the next few quarters. It was at 41.2% growth last quarter.

Revenue and EPS:

Crowdstrike is expected to report revenue of $724.4 million in the upcoming earnings report, due on August 30th. This will represent growth of 35.4%.

Next quarter, the company is expected to report revenue of $774.5 million for growth of 33.3%.

Expected adjusted EPS this quarter is $0.56 which is 55% higher than last year’s Q2 at $0.36.

Margins – Reported Last Quarter:

The most important takeaway is that margins are very strong for Crowdstrike compared to its peers.

• Last quarter, the gross margin of 76% expanded by 200 basis points compared to the year ago quarter.
• The adjusted gross margin of 78% improved by 100 basis points compared to the year ago quarter. Subscription gross margin also improved 100 basis points.
• The GAAP operating margin of (-3%) improved from (-4.90%) in the year ago quarter. Although it’s promising that the margin is close to reaching GAAP operating profitability, the quarter ending in April tends to have the better margin profile.
• Adjusted operating margin of 17% was flat year-over-year.
• GAAP net margin of 0% improved from (-6.5%) in the year ago quarter.
• The adjusted GAAP net margin of 20% improved from 15.3% in the year ago quarter.

Margins – In the Upcoming Quarter:

Management guided for $120.1 million at the midpoint in adjusted operating income, which represents an adjusted operating margin of 16.6%.

Management also guided for $133.3 million for net profits, for a margin of 18.4%

If CrowdStrike reports as expected, it’ll be some of the best margins the company has reported.

Cash Flow:

• Last quarter, operating cash flow was $300.9 million for a margin of 43%.
• The free cash flow was $227.4 million, for a margin of 33%.

There is $1.91 billion on the balance sheet and $739 million in debt.

Conclusion:

This is a brief note to say we are watching CrowdStrike very closely. This is not an earnings call rather it’s a few bullet points prior to earnings to organize our thoughts should there be a strong ER. If it’s a weak ER, we will put the company on hold until next quarter. 

 Recommended Readings:

• Nvidia Q2 FY24 Earnings: 226% Q3 Data Center Growth is Bonkers
• Marvell Q2 Earnings: 7% to 14.4% Incoming AI Revenue
• Alphabet Q2 Earnings: More on the Year of Execution
• Cloud Earnings Review: Digging Deeper on Best-of-Breed
• Datadog Q4 Earnings: A Candid, Conservative Management Style