Note: Beth Kindig contributed to this article
We pointed out recently that the market has indiscriminately penalized tech stocks across the board and cybersecurity stocks are simply caught in the cross fire. Q1 earnings proved that cybersecurity stocks are insulated from supply chain issues and remain a number one priority across corporate budgets. Specifically, cybersecurity-related companies reported top line and bottom-line beats plus a handful raised guidance while consumer-related tech and less cash efficient cloud verticals lowered or missed guidance this past quarter.
We also covered the high probability that cybersecurity would show strength prior to earnings in our quarterly webinar. You can reference this discussion in our Q2 webinar at minute 30:09.
If you look closely, the market has been efficient recently across the cloud sector as the top valuations in the category are those with healthy top lines balanced with a positive free cash flow margin.
Source: YCharts
CrowdStrike recently released strong results as revenue grew 61% year-over-year to $487.8 million and beat the Wall Street revenue estimates by 5%. The company has also been delivering strong free cash flow, and in the most recent quarter, the company reported a free cash flow margin of 32%. The company’s modern cybersecurity products and good fundamentals has prompted us to revisit the stock. Notably, we've owned Crowdstrike twice in the past and the stock has treated us well.
Security Software Market
According to the C-Suite surveys, cybersecurity remains a top priority in corporate spending. Enterprise spending is expected to increase in 2022 from the previous year, according to Chief Information Security Officer (CISO) surveys. Considering the level of cloud spending in both 2020 and 2021, an increase in already high budgets is impressive. The CISO survey states that 44% expected budgets to increase in 2022 compared to 41% in 2021, and only 2% expected a decrease compared to 6% the previous year.
According to the Morgan Stanley CIO surveys, security software is the least likely to be cut if the economy worsens in 2022. To some degree, this could make cybersecurity a safe haven for investors over the next few years.
Similarly, Security Software ranked the second highest priority among CIOs when asked which external IT spending will see the most significant increase in spending in 2022.
According to Gartner’s CIO survey concluded in 2021, cyber and information security is the top priority of planned investments by companies for 2022. Monika Sinha, VP at Gartner, said, “There is a continued need to invest in cybersecurity as the environment becomes more challenging. A high level of composability would help an enterprise recover faster and potentially even minimize the effects of a cybersecurity incident.”
CrowdStrike Product Overview:
CrowdStrike was founded with the goal of reinventing security for the cloud era. CrowdStrike’s Falcon platform delivers comprehensive breach protection against today’s most sophisticated attacks on the endpoint. Due to the sheer number of endpoints in a corporate network, this is where the majority of attacks are made. Compromised credentials across desktops, laptops, and mobile devices are often the hardest points of access to secure.
Ponemon Institute conducted a survey in 2019 where IT security professionals reported that 68% of IT professionals had experienced one or more endpoint attacks, up from 54%. The survey is a bit outdated yet illustrates how hackers use endpoints specifically to gain access to data assets and IT infrastructure. At the time, the average endpoint breach costs $9 million.
CrowdStrike’s AI based security model is focused on collecting large amounts of data, centrally storing it in a single model, and continuously training its algorithms with vast amounts of data. The more data that the Falcon Platform collects, the more intelligent the platform becomes in detecting and stopping breaches.
The company’s cloud-native Falcon platform was built to provide automated protection to stop sophisticated cyber-attacks. It is capable of protecting workloads across servers, laptops, virtual machines, mobile, cloud, and the Internet of Things (IoT). With hybrid deployments, and the internet of things, the risk of cyber-attacks has increased, and the need to protect digital assets has increased.
The Falcon platform has 22 modules offered via a subscription-based model under various categories like cloud security, endpoint security, Crowd XDR, Security & IT Operations, Managed Services, Threat Intelligence, Identity Protection, and Log Management. These modules can be easily deployed on the customer’s endpoints and workloads and can be easily scaled depending on the needs of each customer.
One of the most popular upgrades is Falcon Complete, Crowdstrike’s fully managed detection and response solution that offers Fusion no-code security automation to proactively remediate issues. Translation: less technical employees can work alongside Falcon Complete throughout IT and security departments. This is important due to a cybersecurity training gap between the small talent pool and the dire need for larger security teams.
The upgrade process for modules within the Falcon Complete tier is driving Crowdstrike’s ongoing growth. For example, the company recently reported over 100% growth year-over-year in ending ARR for the Discover, Spotlight, Identity Protection and Log Management modules. The company also stated “the number of customers adopting 6 or more and 7 or more modules grew more than 100% year-over-year” –this is due to Crowdstrike increasing the number of modules they offer for trial from 4 to 12 in the most recent quarter.
This is not to be confused with subscription customers that adopted 6 or more modules, which grew 35%, yet may be a leading indicator of what is to come if the trials were this popular. At the end of Q1 FY2023, 71% of subscription customers had four or more modules and 59% had five or more modules. The company is “retiring” the four or more modules key metric moving forward as it’s becoming commonplace to upgrade to this number of modules.
The users need to download a lightweight agent on each endpoint and cloud workload with only a single agent required to upgrade to the various modules. The agent also protects workloads when offline and sends data to the Falcon platform. The data from workloads are analyzed by machine learning models and are capable of preventing future attacks. The events are sent to the Threat Graph in real-time to be further analyzed.
The Threat Graph is a proprietary and a dynamic graph database. It continuously looks for malicious activity by using Artificial Intelligence. The data needs to be collected only once and can be used to analyze how to prevent future attacks. It also enables the company to introduce new products by using the same data and this is one of the reasons that CrowdStrike was able to rapidly introduce new modules.
The company has a smart filtering system that helps filter enormous amounts of data. The company estimates that a typical endpoint generates 100 GB of unfiltered system event data daily. A typical corporation will have several endpoints. The company’s smart filtering helps reduce the noise, and the Falcon agent only sends the crucial data required for detecting, preventing, and investigating attacks. It thereby improves the performance and allows for efficiently analyzing large volumes of data.
The Threat Graph is a powerful product in preventing breaches as it predicts and prevents modern threats in real-time through endpoint telemetry, threat intelligence and AI-powered analytics. This works alongside the modules to offer a best-of-breed endpoint security solution that offers a combination of agent-based and agentless solutions on one dashboard across public cloud, multi-cloud, and hybrid deployments. The company feels that agent-based is still essential to offer pre-runtime and runtime protection, whereas according to Crowdstrike, agentless-only solutions offer partial visibility and lack remediation capabilities (i.e., the company is referring to SentinelOne which we’ve covered here and also here).
The company has three graphs: Threat Graph, Intel Graph and the recently-launched Asset Graph.
Threat Graph: As discussed, takes trillions of data points from millions of sensors and enriches the threat intelligence from third-party sources (hence “crowd” strike). This offers full visibility and provides automated threat prevention.
Intel Graph: Offers threat intelligence by correlating massive amounts of data and provides insights into any shifts in tactics or techniques
Asset Graph: Newly-launched to increase protection across attack vectors such as cloud, on-premise systems, mobile, IoT and connects them into a unified, visual graph rather than a list.
We’ve discussed with both Datadog and SentinelOne why standardization is key to a cloud company’s long-term growth (and survival really). Crowdstrike is a prime example of this as endpoint security companies are able to slowly move into new territory. The Humio acquisition was discussed on the call as analysts were wondering if Crowdstrike has been taking territory from SIEM vendors. Because the endpoints are arguably the most difficult to protect, I would expect both Crowdstrike and SentinelOne to successfully take more turf across security vendors as they move through product expansion.
According to the recent report from International Data Corporation (IDC), CrowdStrike is ranked No.1 in Worldwide Corporate Endpoint Security Market Share with 12.6% of the $10.3 billion market, up from 6.3% in 2019. The company is also the largest vendor in the modern endpoint security submarket with a 15.5% market share in 2021, up from 12% in 2020. Similarly, CrowdStrike has been named as the leader in ‘The Forrester Wave’ Endpoint Detection and Response Providers, Q2 2022. Source: Investor Presentation. It has also ranked No. 1 in the coveted 2021 Fortune 50 list, which is the list of companies that have best prospects for future growth.
As we discussed in our Q2 webinar at minute 30:09, cybersecurity is one of the only areas where spending is increasing following tech-heavy budgets in 2020 and 2021. Here is what Crowdstrike in regards to this point:
Joseph GalloJoseph Gallo
You’ve alluded to it and so far the numbers appear to indicate that cyber and your business is resilient. But George, in your convos with customers and Burt, in your guidance methodology, is the world a little less rosy than it was a quarter ago? Are you seeing any change in the velocity of deals closing or hesitation from customers? And if you could break that into by geo or deal size, that would be great. Thanks.
George KurtzGeorge Kurtz
Yes, I’ll try the first part. No, we haven’t seen any slowdown in terms of the willingness to buy security. It continues to be the number one risk factor for any Board of Directors. Again, when you look at some of the e-crime impact and taking out business, it is not a discretionary spend. It’s — in the hierarchy of corporate needs, it’s probably shelter.No, we haven’t seen any slowdown in terms of the willingness to buy security. It continues to be the number one risk factor for any Board of Directors. Again, when you look at some of the e-crime impact and taking out business, it is not a discretionary spend. It’s — in the hierarchy of corporate needs, it’s probably shelter.
We’ve also hammered on standardization and the driving down of costs in the Q2 webinar at 34.45 prior to this earnings season. Here is what Crowdstrike’s CEO George Kurtz had to say about this in the most recent earnings call following our webinar:
And in fact, when you look at the current environment, we have a customer saying we want to consolidate more. We want to go in with — all in with CrowdStrike. We want to get rid of this extra spend that we have in other areas, too many agents. And we can upsize our deals while decreasing the overall security spend by consolidating things like vulnerability management, by consolidating log management capabilities, et cetera. We can put it together and give them a much more effective technology with better outcome, lower cost and lower management concerns.we have a customer saying we want to consolidate more. We want to go in with — all in with CrowdStrike. We want to get rid of this extra spend that we have in other areas, too many agents. And we can upsize our deals while decreasing the overall security spend by consolidating things like vulnerability management, by consolidating log management capabilities, et cetera. We can put it together and give them a much more effective technology with better outcome, lower cost and lower management concerns.
The company’s total addressable market (TAM) is growing. It was $25 billion during the company’s IPO in 2019 and is expected to reach $126 billion in 2025 with planned new offerings. The TAM is expected to be $71 billion in 2024 with the current portfolio offering.
Financials:
The company’s revenue growth has been strong. In the recent quarter, revenue grew by 61% YoY to $487.8 million. Subscription revenue which accounted for 94% of the total revenue, grew by 64% YoY to $459.8 million. The management expects revenue to grow 52% in the next quarter to $515 million at the mid-point of the guidance.
Source: YCharts
The company’s key performance metrics are strong. Its annual recurring revenue (ARR) grew by 61% YoY to $1.92 billion, with a net new ARR of $190.5 million in the recent quarter. The company’s dollar-based net retention rate (DBNRR) was above 120% in the recent quarter. This is the 17th consecutive quarter of above 120% DBNRR which shows the company’s strong retention metrics.
The company’s subscription customers grew by 57% YoY to 17,945. It has a strong base of enterprise customers. As of January 31, 2022, the company’s customers include 65 of the Fortune 100, 254 of the Fortune 500, and 15 of the top 20 U.S. banks.
Source: Investor Presentation
The company has stable gross margins. In Q1 FY2023, the company reported a gross margin of 74% which was at the same level as Q1 FY2022. It shows that the company has been able to maintain its cost of revenue in proportion to the increase in its revenues. Similarly, the subscription gross margin was 77% in both Q1 FY 2023 and Q1 FY2022. The adjusted subscription gross margin was 79% and was within management’s target of over 77% to 82%.
The operating margins are improving. The loss from operations reduced from -$31.3 million (-10%) in the Q1 FY2022 to -$23.9 million (-5% of revenue) in the recent quarter. The company’s operating expenses as a percentage of total revenue fell by 5.53%. Particularly, sales and marketing expenses fell by 4.95%. Its strong subscription business model is also helping the company to improve its operating leverage. The adjusted operating income was $83 million (17% of revenue) in the recent quarter when compared to $29.8 million (10% of revenue) in the same period last year. The management’s target range for the adjusted operating margin is over 20% to 22% which it expects to reach in FY2025.
Source: YCharts
The net loss was -$31.5 million (-6.5% of revenue) in Q1 FY2023 compared to -$85 million (-28% of revenue) in the same period last year. While the company’s margins are improving, as explained in the above paragraph. The wider difference in the net loss reduction was primarily due to the provision of taxes related to the Humio acquisition, which was included in the Q1 FY2022. The company reported an adjusted net income of $74.8 million compared to an adjusted net income of $23.3 million in the same period last year.
The company's cash flows are also good. In the recent quarter, the company reported a free cash flow of $157.5 million (32% of revenue). In the words of George Kurtz, President, CEO, and Co-Founder, “In 8 out of the last 10 quarters, we have delivered 30% or greater free cash flow margin. Our powerful combination of growth, profitability and cash flow is reflected in our continued performance well in excess of the SaaS industry’s Rule of 40 benchmark. In Q1, we achieved a Rule of 78 on a non-GAAP operating income basis and when calculated on a free cash flow basis, a Rule of 93.”
The company also raised the revenue guidance for FY 2023 ending January to $2.19 billion to $2.21 billion from the earlier guidance of $2.13 billion to $2.16 billion, representing a YoY growth of 52% at the mid-point of the revised guidance.
Valuation
The company is currently trading at a P/S ratio of 23 and a forward P/S ratio of 17. Its forward P/E ratio is 137. When we compare on a fwd P/S ratio, the company has a slightly higher valuation than SentinelOne and Cloudflare. However, the company ranks the best when we compare on a fwd P/E ratio. This metric will gain importance since, in the current environment, investors are looking for companies with profits. So, we believe that CrowdStrike has a better chance to outperform. The valuation is good when compared to its peers and taking into consideration the cash flows along with improving margins.
Note: Zscaler is not an exact comparable in the below chart since its fiscal year ends in July, while the other companies have their fiscal year ending December/January.
Wall Street Analysts notes
Morgan Stanley analyst Hamza Fodderwala upgraded the stock to overweight from equal weight. The analyst said, “CrowdStrike (CRWD) is seeing further adoption based on conversations with Chief Information Officers and is seeing 100% growth from its non-endpoint offerings, which now account for 15% of its annual recurring revenue, showing that its total addressable market could be $30B bigger than first thought.”
Oppenheimer analyst Ittai Kidron lowered the company’s price target to $250 from $300 and kept an Outperform rating. He said, “CrowdStrike reported a strong Q1, beating expectations behind continued momentum for its emerging modules and strong customer growth.” He adds, “While the guidance is somewhat conservative and takes into account the potential for macroeconomic headwinds, the analyst remains bullish and believes CrowdStrike is in the early innings of addressing a massive growth opportunity.”
Piper Sandler analyst Rob Owens lowered the company’s price target to $230 from $250 and kept an Overweight rating on the shares. He said, “The company reported another strong beat and raise quarter that saw all metrics come in ahead of Street expectations.” He adds, “While a $22M annual recurring revenue beat on the Street number is a smaller magnitude beat compared to recent quarters, the solid growth and margin dynamics at near $2B scale is impressive”.
Risks to consider
CrowdStrike faces tough competition from legacy providers and also innovative companies like SentinelOne. We have SentinelOne in our portfolio because we like this company’s growth profile while being centered within the (relative) safe haven of cybersecurity. We feel this is a great sector to hold a higher growth position.
The company has been undergoing losses since its inception. At the same time, the losses are being narrowing. However, if the company cannot achieve consistent profitability in the coming years, it could adversely affect the stock.
Valuation is less of a concern now than it was in the past.
Conclusion
The Cybersecurity sector will perform well as corporations and governments must protect their digital assets as breaches are very costly. We believe that companies like CrowdStrike, which have their products built for the cloud and specialize in endpoints, will stand to benefit, and will have defensible positions as they expand into other markets. We also like the improving financials, particularly the solid free cash flows, which is an important financial metric in the current uncertain macro environment.