CrowdStrike: Top Dog In Cybersecurity
Summary
- CrowdStrike is an innovator in cybersecurity.
- The company has developed multiple moats to stave off competition from competitors.
- There is a lot of optionality embedded within the Falcon platform to further increase the company's TAM.
- CrowdStrike sells at a premium valuation of 30X FWD sales but that premium valuation seems deserved in comparison to peer companies.
- The stock is currently a buy for aggressive growth investors.
CrowdStrike (NASDAQ: NASDAQ:CRWD) is a cybersecurity company that provides a variety of toolsets for companies to safely manage any remote computing device that has the ability to connect to a corporate network. This is a service that has become increasingly important, as the types of tools that CrowdStrike offers helps to prevent situations like the recent SolarWinds Hack.
However, simply because the service that CrowdStrike provides is important, doesn't automatically make the stock a buy. Cybersecurity companies are often hard to invest in for several different reasons. So, is CrowdStrike a buy? Let's investigate.
Revenue Growth And Margins
Source: Author
In the latest quarter, total revenue was $264.9 million, a 74% increase, compared to $152.1 million in the fourth quarter of fiscal 2020. While revenues are still growing briskly, one thing to pay attention to is that revenue is starting to decelerate sharply on a quarterly Y/Y basis.
Revenue growth has dropped from 90% in Q3 to 74% in Q4 on a Y/Y basis and CrowdStrike is guiding for a Y/Y growth rate of 62% to 64% for Q1 of FY '22. There are some investors that have concerns about this revenue growth deceleration at the current valuation.
CrowdStrike Margins
Source: MacroTrends
SaaS business models often produce strong operating leverage, meaning that a good SaaS business has the ability to make more money from each additional sale without having to increase their costs to produce further sales. High operating leverage is just another way of saying that a business is scalable and that as sales increase, profitability increases.
The Gross Margin or the amount of extra profit the business makes for every unit sold, is an important indicator of how scalable a business can be. In an ideal world, a good SaaS business model should have a gross margin in the 75%–80% range after the business reaches scale.
CrowdStrike gross margins on a trailing 12-month ((TTM)) basis was 74%, compared to 73% at the end of Q3, which is a continuation of a trend of increasing gross margins.
Operating margins on a trailing 12-month (TTM) basis is also steadily increasing and has reached -10.58%, compared to -14% at the end of Q3. Net margins (TTM) were -10.59, compared to -13.40% at the end of Q3.
As CrowdStrike continues growing its customer base, the company should continue to show operating margin expansion over the long term and also eventually become profitable.
Cash Flow And Balance Sheet
Cash flow from operations in the fourth quarter grew to $114.5 million, and free cash flow increased to $97.4 million, setting new records for both metrics. CrowdStrike's free cash flow (FCF)has been growing strongly since recovering from the gloom and doom impact of COVID during its second quarter of FY21, where it recorded FCF of $32.42 million.
In a Seeking Alpha article written by Bert Hochfeld, he mentioned his belief that SaaS stocks will continue to appreciate at strong rates throughout 2021 with stock performance tracking the growth in FCF. Monitoring CrowdStrike's FCF might therefore be an important metric for investors to monitor to see if that FCF growth will continue throughout the year..
CrowdStrike has a free cash flow margin of 36.69%, as of January 2021. CrowdStrike's FCF margin is the highest among all of the cybersecurity companies that I have looked at and is considered on the high end among all SaaS stocks.
CrowdStrike ended Q4 2021 with $1.92B in cash and 778.99M in total debt. CrowdStrike has a debt to equity ratio of 0.89, a quick ratio of 2.50, a current ratio of 2.65. The above metrics show that CrowdStrike has the ability to easily get rid of its current liabilities and is in a good position with its balance sheet.
SaaS Metrics
CrowdStrike continued firing on all cylinders in Q4 2020 with its SaaS business model producing 75% Annual Recurring Revenue (ARR) growth Y/Y while surpassing the $1 billion ARR milestone to reach $1.05 billion.
CrowdStrike's ARR was driven by record Net New ARR of $143 million. Net New ARR = New ARR from new customers + Expansion ARR from existing customers – Churned ARR.
In addition to outstanding Net New ARR numbers, CrowdStrike's net new customer growth accelerated during the quarter to a record 1,480 net new subscription customers. CrowdStrike is not only gaining customers at a relatively high rate but is also retaining most of those customers.
CrowdStrike's dollar-based net retention rate reached 125% as of the end of FY '21, up from 124% at the end of FY '20. Generally, for a SaaS company, any number above 120% is excellent. In addition, the company's Gross Retention Rate remained best in class at 98% at year-end. For an Enterprise SaaS company, 90% is often considered a good Gross Retention Rate.
Magic number
The Magic number is an interesting SaaS metric that shows the sales efficiency of a company. CrowdStrike monitors their Magic Number to ensure that they continue scaling their business efficiently.
Generally, any number above .75 means that a company has room to spend more on Sales & Marketing. Any number below .75, means a company may need to reassess their customer acquisition strategy and perhaps lower their customer acquisition cost (CAC).
CrowdStrike ended Q4 with a Magic Number of 1.3 and in the conference call, the CFO acknowledged that the Magic Number was high and attributed the high number to the fact that CrowdStrike's go-to-market engine was so efficient.
In Q4, we ended with a Magic Number of 1.3, which remains very high. We attribute this to our frictionless go-to-market engine, including our digital lead generation and self-service e-commerce capabilities, and while to a lesser degree, some benefit from reduced travel due to COVID-19 restrictions.
Source: CrowdStrike CFO Burt Podbere - Q4 FY2021 Earnings Call
CrowdStrike's relatively high Magic Number gives the company room to raise investments in international geographies, as well other marketing programs and also gives the company the ability to continue to hiring aggressively.
CrowdStrike Advantages
There is little doubt that CrowdStrike is the beneficiary of secular trends driving companies toward digital transformation. Companies have been moving away from on-prem servers and towards the cloud even before the pandemic and COVID-19 only accelerated that trend..
Covid-19 shelter-in place directives accelerated digital transformation by forcing people to work from home or other remote locations. Increased mobile "Bring Your Own Device" use is a prime factor in forcing companies to upgrade to next-gen security solutions to help protect mobile, cloud and container applications that legacy security products are less effective at protecting.
The structure of CrowdStrike's cloud native platform is uniquely designed to protect against new age threats which are designed to take advantage of the fact that the cybersecurity perimeter has disappeared.
CrowdStrike is an Innovator in Cybersecurity
The cybersecurity industry is engaged in an adversarial intelligence war pitting a company's security platform against the hackers, crackers and bad actors of the world. In a world that is similar to spy vs spy, the bad guys are often faster in finding and exploiting vulnerabilities in corporate and governmental computer networks than many legacy security platforms are able to keep up with, which is why there are so many security breaches making the news recently.
It takes innovation and speed to win against the adversaries that want to break into a computer network and CrowdStrike has developed an innovative platform named Falcon that is built natively upon cloud and machine learning technologies which gives the platform the ability to respond quickly to prevent intrusions or unwanted activity.
The Falcon platform learns to identify threats by using information gained from a sophisticated signatureless, 15MB machine learning model that is trained on more than 30 billion daily computer events that are recorded in what CrowdStrike calls the Threat Graph. The Threat Graph is the first purpose-built graph database for cybersecurity.
CrowdStrike Has Several Moats
CrowdStrike competes in several different cybersecurity areas. Primary antivirus adversaries include McAfee (NASDAQ: MCFE) and Symantec (NASDAQ: NLOK). In endpoint security, CrowdStrike competes against the likes of Cylance (NYSE: BB) and Carbon Black (NYSE: VMW). In network security, CrowdStrike battles against Palo Alto Networks (NYSE: PANW) and FireEye (NASDAQ: FEYE).
What makes CrowdStrike a difficult company for legacy cybersecurity companies to copy is that CrowdStrike has developed quite a lead in the data that they have collected for their Threat Graph and that lead only grows stronger over their legacy competitors because each time CrowdStrike gains a new customer, they add even more data to the Threat Graph, thereby extending the data lead.
This gives CrowdStrike a Network Effect moat, because as each new customer joins the platform, the more effective the platform as a whole becomes in detecting, preventing and blocking intrusions for both new and existing users. The more effective the platform becomes, the easier it becomes for CrowdStrike to take market share from competitors. Network effect, such as the one CrowdStrike has, is often considered the most powerful economic moat because of its compounding nature.
The Threat Graph's cloud native nature also provides CrowdStrike with an Economic Moat from increased economies of scale. CrowdStrike has distinct cost advantages that are estimated to provide a 7.5X lower Total Cost of Ownership (TCO) over competitors' on-premise solutions.
Source: CrowdStrike Threat Graph Presentation
The CrowdStrike Falcon Platform is actually a series of modules that includes various cybersecurity toolsets like Falcon Prevent, which is a Next Generation Antivirus (NGAV); Falcon Insight, which provides Endpoint Detection and Response (EDR); Falcon OverWatch, a Managed Threat Hunting Service; Falcon Discover, which provides Security Hygiene; and Falcon Intelligence, which gives Cyber Threat Intelligence.
Companies have discovered as they transition from on-prem to the cloud that it is easier to manage many different cybersecurity toolsets on just one platform and that makes CrowdStrike attractive. In addition, there is currently a talent shortage in cybersecurity personnel that are able to manage all the different security tools and Chief Information Security Officers within many different companies only believe that the problem will worsen. Cybersecurity Ventures projects a staggering 3.5 million unfilled cybersecurity jobs globally in 2021.
The cybersecurity talent shortage benefits CrowdStrike because one of the consequences of companies buying additional modules on the Falcon platform is that it makes the decision to switch security vendors much more difficult by raising the switching costs. The amount of time, effort and money that it would require to hire cybersecurity personnel to manage disparate security tools from different vendors to replace Falcon modules makes the decision to switch away from the Falcon platform cost prohibitive.
As of last quarter, CrowdStrike’s subscription customers that have adopted four or more modules, five or more modules and six or more modules increased to 63%, 47%, and 24%, respectively, as of January 31, 2021.
CrowdStrike has Optionality
A company has optionality when additional optional investment opportunities are discovered that are beyond the initial opportunity. When a company decides to pursue an optional investment it can create additional value to the overall business that might not be obvious at first sight to investors. One of the first things that I look at in a potential investment is whether a company has the potential to develop and grow other adjacent businesses. A lot of upside beyond many analyst's initial projections about a company come from optionality.
The most famous example of a company with optionality is Amazon (AMZN). When Amazon first started all analysts saw was a bookstore and everyone that analyzed Amazon called the company "overvalued" based only upon the bookstore business. Very few people saw the optionality that Amazon had down the road to create value with so many different adjacent businesses like AWS and Amazon Video.
CrowdStrike started off as a tool that unified a next-generation antivirus, endpoint detection and response (EDR), and a 24/7 threat hunting service. However, CrowdStrike has also built its platform to be extensible and that gives CrowdStrike optionality. Over the years, CrowdStrike has consistently added new adjacent capabilities to the Falcon platform via new modules which have created additional value.
Source: CrowdStrike Presentation
One service that CrowdStrike has recently added was Zero Trust capabilities with the acquisition of Preempt. Preempt Security is a leading provider of Zero Trust and conditional access technology for real-time access control and threat prevention. CrowdStrike plans to incorporate Preempt into its Falcon ZTA module which now puts CrowdStrike into some competition with Okta (NASDAQ: OKTA). The Zero Trust capabilities is expected to increase CrowdStrike's TAM by $2.2B.
Another service that CrowdStrike has moved into is log management and observability solutions, which CrowdStrike has recently entered with the acquisition of Humio. This puts CrowdStrike into direct competition with companies like Splunk (NASDAQ: SPLK), Elastic (NYSE: ESTC), Sumo Logic (NASDAQ: SUMO), and Datadog (NASDAQ: DDOG) in a new lucrative field for CrowdStrike that is expected to increase the TAM by $4.1B.
What other new services could CrowdStrike eventually provide down the road? CrowdStrike has not ever expressed an interest in moving into consumer facing internet security, so currently no one has modeled a possible consumer security business into CrowdStrike's future. Could CrowdStrike eventually provide a consumer level offering and vastly increase its addressable market far beyond what analysts are considering today? That is what is meant by optionality.
Valuation
| Company | Mkt Cap (billions) | Price/Sales (FWD) | Price/Cash Flow (TTM) | EV/EBITDA (FWD) | Revenue Growth (FWD) % | FCF Margins (TTM) % |
| CrowdStrike (CRWD) | $40.11 | 30.13 | 111.56 | 257.59 | 53.96% | 36.69 |
| Palo Alto Networks (PANW) | $31.46 | 7.41 | 22.16 | 32.21 | 19.62% | 32.69 |
| OKTA (OKTA) | $28.55 | 25.60 | 217.85 | NM | 33.72% | 13.79 |
| ZScaler (ZS) | $23.50 | 36.29 | 169.22 | 258.71 | 40.93% | 11.48 |
| FireEye (FEYE) | $4.68 | 4.64 | 49.09 | 31.61 | 6.69% | 27.18 |
NM - Non Meaningful Value
Almost no investor ever buys a stock without considering the valuation. CrowdStrike has a forward Price to Sales of 30.13 and a Free Cash Flow multiple of 111, which is a higher valuation than many other peer security companies with the exception of maybe Zscaler (NASADAQ: ZS).
There is little doubt that CrowdStrike sells at a premium valuation, especially for a company that is currently not profitable on a GAAP basis. However, CrowdStrike's premium valuation seems deserved because it is projected to grow much faster than other peer companies within the security industry, while also rapidly growing FCF.
On the opposite side, there are investors that believe CrowdStrike being valued at 30 times FWD sales is risky, especially as the company continues to show quarterly year over year revenue deceleration in the face of intensifying competition while in a rising bond yield environment.
The current market appears driven by a seemingly endless liquidity provided by the Fed and a $1.9 billion stimulus package by the Biden Administration. There is a fear among some investors that a bubble has formed in the stock prices of many different tech companies like CrowdStrike and that with any hint of inflation, the bubble may burst, with many high valuation stocks taking the brunt of the downside.
Bottom Line For Investors
Despite a few short term risks, CrowdStrike has strong secular tailwinds behind it in the cybersecurity industry. The company continues to take market share from legacy companies and has also shown significant operating leverage in the latest quarter and looks to be close to producing profitable growth. CrowdStrike is fundamentally one of the top performing SaaS stocks in the market today.
CrowdStrike is a high quality growth company that aggressive investors can buy right now at current prices, however, more conservative investors should consider putting the stock on a watchlist to buy on any major pullbacks in the stock price.
This article was written by
Analyst’s Disclosure: I am/we are long CRWD. I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.
Seeking Alpha's Disclosure: Past performance is no guarantee of future results. No recommendation or advice is being given as to whether any investment is suitable for a particular investor. Any views or opinions expressed above may not reflect those of Seeking Alpha as a whole. Seeking Alpha is not a licensed securities dealer, broker or US investment adviser or investment bank. Our analysts are third party authors that include both professional investors and individual investors who may not be licensed or certified by any institute or regulatory body.
Recommended For You
Comments (20)
Sure revenue growth is decelerating. That's different than revenue is decreasing. And the revenue growth is still market leading. Also the two mentioned acquisitions will add to revenues.
Beyond that, there's near hundred percent customer retention, and near 130 percent net $ retention rate, and increasing margins.
As for interest rates rising? CRWD doesn't need to borrow to run the business. And they are not diluting by selling new shares. So...
So, richly valued? Yes. Overvalued? Well, I thought the recent drop to low to mid 170's was about as low as we'd see, and added at $175. I doubt I'll have any regrets.
I always don’t understand the cyber security industry . Fastly said they have signal sciences , elastics has the end game programme . DT snd ddog also have their cyber security elements . Are they also end to end ?
"cloud native"It is a native of the cloud - it was never a product designed to be installed on customer's equipment.
AHhh.. Thank you!