CrowdStrike: Stronger Than Ever (NASDAQ:CRWD)

Introduction and investment thesis

CrowdStrike (NASDAQ:CRWD) has been the modern endpoint security leader in the market for years, gradually extending its product suite to become a one-stop-shop security platform. Before the general macroeconomic slowdown in 2022 the company consistently managed to deliver beat-and-raise quarters demonstrating rock solid fundamentals since its IPO back in June, 2019. At the end of FY23 this streak has come to an end as the growth in net new ARR (the growth in new business) began softening steeply.

After two quarters of negative ~10% yoy net new ARR growth the tide seems to be turning for the second half of the year. Besides easier yoy comparisons, a steadily growing IT security market, success in emerging product categories and the increasing number of consolidation deals are fueling this turnaround. As these trends seem to be only in the early innings, I believe that the upcoming turnaround should be the start of the next prolonged beat-and-raise cycle. Based on the company’s updated operating model this cycle should be characterized by further improving margins from already impressive levels.

The current valuation of shares is far from reflecting this prolonged turnaround in my opinion, which makes me conclude that shares provide an excellent long-term investment opportunity for the upcoming years. Based on Q2 earnings and the recent Investor Briefing at Fal.con I believe the 2023 rally is just the beginning.

Q2 earnings highlights, and the early signs of a turnaround

For the first sight, there have been no major positive surprises in the Q2 FY24 earnings release. Quarterly revenue reached $731.6 million (+~37% yoy) surpassing the average analyst estimate of $724.4 million only by a thin margin:

Compared to the trend of previous quarters the magnitude of the beat (~1%) has been a slight disappointment. Q3 FY24 revenue guidance of $775-778 million has been also in line with the $774 million average analyst estimate.

Looking at annual recurring revenue (ARR), a more forward-looking indicator for topline growth investors could see a further slowdown. It came in at $2.93 billion growing 37% compared to Q2 last year, a 5%-point decrease from the 42% yoy growth rate in the Q1 quarter:

Digging deeper this has been the result of a ~10% decline in net new ARR for the second consecutive quarter, to which I already referred in the preamble:

There have been 3 quarters over the past two years when CrowdStrike managed to grow its net new ARR by over $200 million, which it didn’t manage to exceed this year. On the chart above we can see that this resulted in net new ARR growth falling from ~40-50% to negative ~10% over the course of a few quarters.

According to management comments the main reasons behind this have been elongation of sales cycles and the increasing share of contracts with multi-phase subscription start dates. As investors already know, this resulted from general IT budget scrutiny in a fragile macroeconomic environment, which still persists based on the Q2 earnings call.

Based on the information above it was no wonder that the initial market reaction to the earnings release has been somewhat negative. However, the earnings call that followed and the supplemental financial information that has been published afterwards gave reason for optimism, which sent shares higher by ~9% the following day.

The most important information piece in the supplemental financial information that CrowdStrike provides is remaining performance obligations (RPO) in my opinion. It can be found on the top of the last page, but also in every 10-Q filing. Unfortunately, the company switched to providing only rounded numbers from the Q2 quarter in both sources, which impairs the accuracy of RPO-based forecasts to some extent. Nonetheless, it’s enough for analyzing the big picture, which looks as follows:

The most recently published data point for RPO has been $3.6 billion for the end of Q2 FY24, which could be somewhere between the $3.55-3.64 billion range. Regardless of the exact number, it’s a positive sign that after a surprising qoq decrease in the Q1 quarter the company’s contracted backlog increased again. On the top of that, the estimated yoy growth rate of 44% showed an increase of a few %-points over the Q1 quarter, providing an encouraging sign for accelerating topline growth for the back half of the year.

This observation has been also confirmed by management on the Q2 earnings call:

“Heading into the second half of the year, we see increased momentum in the business, driven by record levels of new logo and upsell pipeline, record deal registrations from our market-leading partner ecosystem and record levels of customers proudly trusting CrowdStrike to be their long-term security platform consolidator of choice. We are also observing substantial changes in the competitive landscape, uniquely benefiting CrowdStrike. With the business momentum we see and competitive market dynamics, we believe our second half performance will yield double-digit net new ARR growth.” – George Kurtz, President, CEO and Co-Founder

I believe these comments speak for themselves, however it’s worth to make a reality check before getting overexcited.

Looking at the consolidation narrative it’s worth to analyze module adoption trends as these could provide a good indication for replacing competing solutions. Of course, there are several customers who just start using a given solution, but I suppose a significant number of them decides to switch from a competing product to utilize CrowdStrike’s platform solution. Looking at most recent module adoption trends below we can see that more and more customers opt for using several modules, which I believe supports the consolidation narrative:

In the top of that, the company closed over 80% more deals involving 8 or more modules in Q2, which has been a significant acceleration from over 50% in the Q1 quarter. This shows that customers increasingly prefer to land big, another sign that they prefer to consolidate on CrowdStrike’s security stack.

Based on the above, I believe that the competitive landscape is changing in favor of the company as customers increasingly seek to consolidate on platform solutions instead of using several point solutions. This should further ignite M&A activity in the sector in my opinion, where the latest Cisco-Splunk deal could have been an important milestone. According to management CrowdStrike is also open for M&A in the back half of the year as other opportunities possibly emerge.

Emerging modules as new growth drivers

An important driver of increased module adoption is the great success of CrowdStrike’s emerging modules, where the company provided investors increased visibility for the first time. Three of these modules, Cloud Security, Identity Security and LogScale stand out with their strong growth momentum and increasing scale. These solutions together made up roughly 20% of total ARR in the Q2 quarter growing over 115% yoy.

Cloud Security has been the biggest contributor among them with almost $300 million in ARR for Q2 growing 70% yoy. This has been followed by Identity Security with $200+ million ARR growing almost 200% yoy. The adoption rate of new customers increased by over 100% yoy in Q2, showing strong demand for the product. Finally, LogScale, CrowdStrike’s log management solution based on Humio’s technology grew its ARR by more than 200% yoy and more than tripled its customer count over this period. ARR is expected to reach the $100 million-mark next quarter.

As these solutions make up an increasing share of the company’s total ARR they could soon become the main growth drivers. During the past twelve months net new ARR tracked around $800 million, with ~1/3 coming from the solutions mentioned above. In the light of the fact that the Identity Security solution was only introduced in Q3 FY21, while LogScale only in Q1 FY22 I think this is an outstanding achievement. CrowdStrike managed to grow these businesses (both externally and internally) into one of the most important topline growth drivers within a few years proving its true competitive moat within the space.

Based on current penetration ratios these solution are only at the beginning of their multiyear hypergrowth journey, which signals continued strong topline growth for the upcoming years:

In the light of these trends, it’s no wonder that management predicts a significantly better second half for FY24, with net new ARR growing in double-digit territory.

Besides shorter term revenue dynamics these solutions should be important growth drivers for the longer run as well by reaching revenue of $4.5-6 billion over the next 5-7 years based on company estimates:

Together they should account for a total TAM of ~$64 billion almost 30% of the company’s total expected TAM that time.

Besides these emerging modules there are also other important reasons why strong topline growth should be sustained over the longer run. One of these is the low penetration of CrowdStrike in many segments of the market, which can be seen below:

There is still a large runway in the public sector with less than 1% logo penetration, where the recently granted Impact Level 5 Provisional Authorization from the United States Department of Defense can be an important catalyst. Looking at smaller companies there is still a long way to go, where the recently launched Falcon Go bundle seems to gain further traction.

Finally, despite these encouraging trends the company isn’t falling behind on innovation as evidenced by the recent introduction of Falcon Foundry, the industry’s first no code application development platform. In addition, CrowdStrike’s AI engine, Charlotte AI is continuously developed further, which could be also an important competitive advantage on the longer run. I believe these projects provide sound evidence that CrowdStrike will continue to be the category leader in IT security for the foreseeable future and drive further consolidation on its continuously improving platform.

Rock solid margin profile

Besides encouraging revenue trends for the upcoming years, the margin profile of the company reached an infection point recently.

First, CrowdStrike managed to reach GAAP profitability for the second quarter in a row and plans to keep this habit on an ongoing basis.

Second, by reaching record non-GAAP operating margin of 21.3% in Q2 it has been the first time that the company reached its long-term operating margin target of 20-22%. With this milestone all key margin-related long-term targets have been met, most of them significantly sooner than planned:

Third, the company doesn’t aim to stop at this point and raised the stakes for the upcoming years. At the Investor Briefing at Fal.con Burt Podbere, CFO announced surprisingly ambitious targets for the next 3-5 years in my opinion, which look as follows:

Based on the table above there seems to be still some leverage left on the gross margin front. This should result from further decreasing hosting costs, which make up more than 50% of cost of goods sold. Recent trends seem encouraging, which should give reason for further optimism:

Looking at S&M, R&D and G&A expenses we can see that there is still some leverage left resulting from increasing economies of scale. Over the next 3-5 years this could drive further 400 bps operating margin improvement in the form of proportionally decreasing S&M (-200 bps) and G&A (-200 bps) expenses, which should give a significant boost to the bottom line.

These beneficial trends could boost the company’s operating margin target by further 900 bps, it’s free cash flow margin target by further 500 bps. I believe only a few of us expected such a significant improvement in the company’s margin profile over the upcoming years, especially that the company had already a best-in-class margin profile. I think this information didn’t receive enough attention and it should be an important catalyst for shares over the upcoming quarters/years.

Just looking at the projected FCF margin of 34-38% and assuming a ~30% revenue growth rate for the upcoming years CrowdStrike should be a Rule of 60-70 company over the medium term. Meanwhile many other SaaS companies struggle to reach even the magical 40 threshold recently, which makes me think that CrowdStrike shares should trade at comparatively richer multiples over the next couple of years. However, when I look at current valuation, I see that this is far from priced in.

Conservative valuation in the light of significantly improving fundamentals

Currently, CrowdStrike has a market cap of $38 billion with FY24 sales expected to reach a little more than $3 billion. This results in a Price/Sales ratio of ~12.6. If we assume that the company manages to grow its revenues by an average of 30% over the upcoming 3 years (slightly more aggressive than current analyst consensus) the multiple should drop to ~5.7 if there would be no change in the share price (hypothetical case).

Applying a 25% net margin this would result in a forward P/E ratio of 22.8, only slightly above the current forward P/E of 18 for the S&P500. I strongly believe that in 3 years’ time this wouldn’t be a realistic scenario, CrowdStrike shares should still trade at a significant premium by that time. Assuming a multiple of 36, double that of the S&P500 and somewhat higher than the current forward P/E of 28.6 at Microsoft (MSFT), would mean ~60% share price appreciation from current levels within 3 years. I believe this could be a realistic scenario.

Increasing competition from Microsoft

I believe the most important risk factor for CrowdStrike is the strong competition from Microsoft in the endpoint security space. Microsoft Defender is rapidly gaining traction among more price-sensitive customers, which resulted in Microsoft overtaking CrowdStrike in endpoint security market share in 2022:

Although CrowdStrike managed to increase its market share by 2.5%-points in 2022 Microsoft managed to grow it by whopping 7.7%-points to almost 19%. This shows that the aggressive push of MSFT in the space provided strong results, which could be a threat for CrowdStrike over the upcoming years. Luckily, no other players seem to provide a real competitive threat, and it’s important to note that the whole market grew 27% yoy. So, there is not so much to worry currently, but a possible pricing war ignited by MSFT could be a possible threat.

Based on another helpful slide from the company’s recent Investor Briefing this isn’t happening yet:

As it can be seen from the chart above average selling prices are steadily trending upwards, which shows that customers are willing to pay for added value.

Conclusion

CrowdStrike has been the fundamentally soundest emerging SaaS company over the past several years in my opinion. Based on recent trends and the company’s updated operating target model this should hold over the upcoming years as well. I believe current valuation of shares is far from reflecting this, which provides a good long-term investment opportunity at this point. As the fundamental profile of the company matures, I believe even somewhat risk-averse investors could build out smaller positions as the volatility of the share price should gradually decrease.