CrowdStrike Holdings, Inc.

Moat: 3.5/5

Understandability: 3/5

Balance Sheet Health: 4/5

CrowdStrike is a cybersecurity firm that specializes in cloud-delivered endpoint protection and threat intelligence, relying heavily on the power of its AI-powered Falcon platform to offer comprehensive security solutions.

Investor Relations Previous Earnings Calls

The moat, understandability, and balance sheet health scores reflect a conservative evaluation to ensure a margin of safety in any assessment.

Business Overview and Moat Assessment

CrowdStrike’s core business revolves around providing cybersecurity solutions via its Falcon platform, which operates in a cloud-native model. The platform’s modules focus on areas such as endpoint security, threat intelligence, cloud security, identity protection, and security and IT operations. Their main product offering is a cloud-delivered endpoint protection solution, which can be thought of as a tool that sits on individual computers and devices and stops threats before they can get into the system.

  • Moat Rating: 3.5/5

    • Why a Moat: CrowdStrike’s moat is primarily based on three key aspects: the network effect arising from the scale of data collected by their cloud platform, the high switching costs customers experience and brand recognition. The sheer amount of data the platform ingests from different sources every day creates superior machine learning models to identify cyber threats more effectively and improve the company’s products. Further, they leverage their massive amounts of data in the creation of highly valuable security intelligence reports for customers. Once a customer has invested time and energy integrating with the Falcon platform, they are unlikely to switch to another offering, because of costs and time associated with changing platforms. Finally, their brand has become synonymous with endpoint security across multiple industries.
    • Limitations on the Moat: However, while strong, their moat isn’t impregnable. The cybersecurity industry is extremely competitive with constant innovation occurring and it is possible that newer companies will innovate faster than CrowdStrike. A lot of their core competitive strength lies in the AI models they make, if a competitor were to have models that are sufficiently better than theirs, that would greatly harm CrowdStrike and erode their moat. Also, their products are not a monopoly, they are not the only ones in the business and can be substituted for different products. Moreover, it is difficult to track over the long-term whether a cybersecurity moat will be able to sustain over time because the environment can change rapidly with cybercriminals always devising new tools to try to breach defenses. Thus, even for a market leader such as CrowdStrike, a margin of safety must be baked into the valuation to account for these risks.

Legitimate Risks That Could Harm the Moat and Business Resilience

  • Technological Disruption: The rapid pace of innovation in cybersecurity means that new technologies and approaches could render CrowdStrike’s solutions less effective over time. Competitors might come up with more effective defense mechanisms or products, thus eroding CrowdStrike’s advantage.
  • Intense Competition: The cybersecurity market is very crowded and companies will have a tough time maintaining profits for prolonged periods due to competition. If a competitor develops a better and more effective platform, they could entice customers to leave CrowdStrike with lower prices. Further, many of the products that the company sells are also sold by other companies, making them very substitutable, and the pricing pressure is very high for the industry.
  • Data Breaches: Given the sensitivity of security data, any data breach could severely erode the company’s reputation and affect its brand image and customer trust. It is of extreme importance to secure customer’s data, and any major mishaps in this area could damage long-term profitability.
  • Integration Challenges: As CrowdStrike expands its product offerings and integrates acquired technologies, managing different platforms and ensuring smooth integration could lead to operational complexities and potential business disruption.
  • Macroeconomic Conditions: High interest rates could also lead to lower valuations for the company. Also, a reduction in global growth will likely affect technology and IT spend as companies will spend less on upgrading security systems.
  • Regulatory Changes: Changes in privacy laws and regulations (such as GDPR) could impact how CrowdStrike can collect and use customer data, potentially affecting the effectiveness of its tools.

Business Resilience CrowdStrike exhibits high business resilience because of several factors, primarily revolving around the high switching costs that exist for their customers. As a result, if their sales were to decline in a recession, it would not affect the overall business by much as there will be a stable recurring revenue stream. Further, they have a lot of high-quality customers which provides some revenue diversification. Finally, their position as one of the clear market leaders means they are less likely to be replaced by some new competitor quickly.

In-Depth Financial Analysis

  • Revenues Distribution:
    • CrowdStrike generates revenue primarily from subscription services, which is why their revenue model is relatively stable and recurring. They offer security modules such as Endpoint Protection, Identity Protection, Cloud Security, and more.
    • The company’s customers are fairly diversified and come from various sectors with no concentration in any particular area.
  • Trends in the Industry:
    • The cybersecurity market is currently booming and is expected to continue to do so. As cyber threats become ever more complex, so does the need for highly performant cybersecurity tools.
    • A lot of companies are adopting cloud-based solutions for their security needs, giving companies such as CrowdStrike an inherent advantage due to their platform’s cloud-first design.
  • Margins:
    • CrowdStrike operates with good gross margins, in line with other software businesses. They also maintain high operating leverage, as a larger part of their expenses remain fixed, thus any additional revenue greatly increases profitability.
  • Competitive Landscape:
    • The cybersecurity space is incredibly crowded with a lot of new innovative players. Many companies with different approaches and solutions offer strong competition to CrowdStrike, which could impact its ability to grow.
    • A lot of companies operate in a more all-encompassing way than CrowdStrike, and offer more than just endpoint security solutions to their customers, which allows those customers to consolidate their security vendors to only a few. As this trend increases, CrowdStrike will need to either broaden its product offerings or partner with other companies that cover such gaps.
  • What makes the company different?
    • The company’s Falcon platform, being built natively on the cloud, provides superior performance and reliability, and allows them to scale easier than companies that have a more on-premise or hybrid offering.
    • CrowdStrike’s AI models and their network effect have allowed them to provide superior security data and threat intelligence reports that competitors cannot match.
    • They are a well-established brand and one of the top leaders in the endpoint security space, which makes them a natural first choice for companies seeking a good security partner.

Financial Highlights and Analysis

  • Revenues
    • CrowdStrike’s revenue growth is still robust with current numbers showing 33%+ year-on-year growth. Subscription revenue continues to drive most of the revenues and is a recurring stream.
    • The company is experiencing strength in its new modules (such as Identity Protection and Data Protection) and is also expanding its presence in cloud security and managed threat response.
  • Profitability * Their gross margins are consistent at ~75% and they have been able to maintain their operating leverage well. However, their profits have been negatively impacted by a large increase in marketing expenses and research and development. * Stock-based compensation is very high and is diluting share holders’ equity, this expense should be taken into account when looking at the numbers. Also, large acquisition costs for companies such as Reposify, are impacting overall profitability negatively. * Despite these costs, their GAAP gross profits and non-GAAP net income, have grown immensely.
  • Balance Sheet
  • The company has a very robust balance sheet with over $3 billion in liquid investments and no debt. Although, they have reported large operating and non-operating losses, they have very good cash flow from operations. * They have reported good growth in deferred revenue, meaning that future revenue is already booked for the upcoming years.
  • Intangible assets, mainly acquired goodwill, constitute the majority of assets on the balance sheet.
  • Their current ratio is healthy and is above industry average, meaning they have sufficient short-term capital to take care of liabilities.
  • Their operating cash flow is increasing, which shows they are able to convert earnings into cash to maintain a good financial position.

Recent Concerns and Management Outlook

  • One of the largest concerns that has been raised by analysts is regarding an increase in operating expenses, especially with marketing and R&D. These increasing costs could negatively impact future profitability unless they bring a higher revenue in the long-run.
  • There are also concerns about increased competition in the endpoint security and related markets. The company has a large amount of competition, and that could negatively impact their ability to generate and retain customers over the long-term.

  • The management, however, notes that they are taking actions to improve profitability. They are also making new product offerings and expanding their current platform. Further, they believe the increased spending will be beneficial in the long-term and will bring greater revenue in the future.

  • Understandability Rating: 3 / 5
    • The company’s core concept, cloud-based security, is relatively simple, but the underlying technology and details of their modules are more complex to understand. Their financials have a few caveats, especially regarding share-based compensation, and require understanding of GAAP reporting principles. Overall, not as complicated as something like a medical or pharmaceutical company, but also not as simple as a pure-retail company.
  • Balance Sheet Health Rating: 4 / 5
  • CrowdStrike possesses a very healthy balance sheet with a lot of cash reserves and no debt and they also generate very high cash flow from operations, allowing them to effectively grow the business. However, their increasing reliance on stock-based compensation and the accounting complexities of acquisitions somewhat weaken their balance sheet. Despite this, they have high liquidity and very robust asset quality, which gives them a higher rating on balance sheet health.