Ben’s Portfolio update end of December 2022

Ben’s Portfolio update end of December 2022


2020 63.6% (Since May 12, 2020)
2021 13.1%
2022 -60.7%
YTD Month
Jan -19.9% -19.9%
Feb -18.7% 1.4%
Mar -21.3% -3.2%
Apr -37.8% -21.0%
May -50.5% -20.4%
Jun -53.5% -6.0%
Jul -49.6% 8.3%
Aug -46.0% 7.3%
Sep -50.7% -8.8%
Oct -52.1% -3.0%
Nov -58.3% -12.8%
Dec -60.7% -5.9%

These are my current positions:

Dec Nov Oct Sep Aug Jul
Snowflake 20.5% 18.7% 18.2% 17.1% 16.6% 13.4%
Datadog 17.4% 16.3% 14.8% 15.4% 17.6% 20.6%
Cloudflare 13.5% 13.0% 12.4% 10.1% 10.4% 6.7%
Zscaler 11.6% 13.5% 13.1% 12.0% 10.6% 11.1%
Crowdstrike 11.1% 12.0% 14.0% 12.3% 12.5% 13.4%
SentinelOne 8.3% 8.0% 10.0% 9.1% 7.8% 7.7%
Nvidia 6.5% 7.3% 5.5% 5.0% 5.7% 7.3%
Monday 6.0% 5.1% 4.8% 5.2% 4.7% 4.6%
Enphase 3.3% 3.9% 3.5% 3.3% 3.1% 3.3%
TradeDesk 1.9% 2.1% 2.0% 2.3% 2.2% 1.7%
ZoomInfo 0.0% 0.0% 1.8% 4.6% 4.6% 4.1%
Hubspot 0.0% 0.0% 0.0% 3.7% 4.2% 6.1%

Company comments:


There is no way to say it nicely: Crowdstrike disappointed this quarter on several fronts: Revenue came in significantly lower than I had expected at $581M (53% YoY, 8.5% QoQ) vs. my expectation of $594M (56% YoY, 11% QoQ). Now, this QoQ percentage delta between my expectation and reality was similar as the delta I saw with Datadog and Cloudflare. But the reason I didn’t revise my expectations for CRWD after DDOG and NET reported was because I thought cybersecurity would be much less affected by macro. And this believe was cemented by the strong report of Palo Alto which reported before Crowdstrike. So this believe, at least with regard to Crowdstrike, was apparently wrong. Unless, … is there something more fundamentally wrong with Crowdstrike? Do any of the other metrics shine some light on this question? Let’s dig in:

While last Q, I praised their net new ARR sequential growth of 14.5%, this metric dropped to -9.1% this Q. Note that “in Q3, we saw approximately $10 million more ARR deferred into future quarters”. Just for perspective, net new ARR sequential growth has never been below PLUS 11.8% in any Q3, so it dropped relatively hard. For comparison, Datadog (which is much more seasonal due to their non-subscription model) dropped by -30% and Cloudflare which is much less seasonal than DDOG dropped -13.5%. Again, perspective is important: For Cloudflare this number has never been below PLUS 14.4% in any Q3. So this drop can probably be blamed on macro rather than something fundamentally wrong with Crowdstrike. Still, it goes to show that Crowdstrike is less macro resilient than I thought. And my guess is that I am not alone with this surprise. I think even CRWD’s management didn’t expect that drop in revenue growth since they beat their guidance by a historically low 1.4% at the midpoint. With one exception in the previous quarter (3.7% beat), this beat was never below 4% and above 5% for the most part of FY22/23.

The second front on which Crowdstrike disappointed this Q was customer growth. I wanted to see around 10% QoQ, but what we got was a historical low of 7.4%, down from 9.7% last Q and 12.3% last year. On the other hand, a dim light at the end of the tunnel was their continued march in customer’s multi-product adoption, with 5+ and 7+ products customer percentage cohorts adding one percentage point, to 60% and 21%, respectively and 6+ products customers staying flat QoQ at a record 36%. And “While sales cycles lengthen, we believe the vast majority of these deals are not lost, just delayed”. The other reason to be a bit careful interpreting total customer numbers is that CRWD (like Sentinel) partners with MSSPs (managed security service provider) and many CRWD customers can be masked by a single MSSP. So it is a little hard to make sense of customer growth numbers in a macroeconomic environment where SMBs, which are more likely to use an MSSP, suffer more than enterprise customers.

I see their remaining performance obligations (RPO) as another dim light at the end of the tunnel. While QoQ RPO growth was still slightly below historical levels of around 8.5%, 13.5% and 16% in Q1, Q2 and Q3 of FY21/22, this metric has now re-accelerated from 4% in Q1 to 6.4% in Q2 to now 11.6% in Q3 of FY23. I take this re-acceleration, while somewhat expected due to seasonality, as a good sign, because if something was fundamentally wrong with Crowdstrike’s business, we probably wouldn’t have seen any re-acceleration here. What is even more comforting is what we see when we look under the hood: While deferred revenue (typically the larger portion of CRWD’s RPO) grew 9.3%, which is within the typical historical range of Q1 to Q3 of around 10%, their sequential backlog growth jumped from -10% in Q1 to -0.1% in Q2, to now +18,2% in Q3! So in comparison to last Q we are talking about an extra $120M in contracted revenue that hasn’t made it to the top line yet (on top of last Q’s backlog of $662M). My guess is that the reason for this backlog increase is that customers have been delaying to fulfill their contractual obligations due to macro (rather than Crowdstrike delaying their fulfillment to customers, which wouldn’t make much sense). For example, customers are “looking at starting those subscription dates at staggered times (…) the good news is that those deals are confirmed. They are locked in. We signed the deal. (…) And they will be in the RPO calculations.” So that would certainly support Crowdstrike’s macro headwind story.

Another bright spot was that their NRR “was above our benchmark and consistent with Q2, maintaining the highest level since Q3 in fiscal 2021.” And “Gross retention also maintained its record level”.

On the profitability front Crowdstrike pretty much delivered as expected. Pretty much steady operating and net income margins and the expected bump in FCF margin to 30%, in-line with previous Q3’s.

Finally, next Q revenue guidance, which is again around 7% at the midpoint can be interpreted in a binary fashion: If we expect the same 1-2% beat as we saw this Q, this is a bad guide that points to strengthening headwinds for Crowdstrike. If, on the other hand they can beat again around 3-4% (and somehow I feel this would be very optimistic) it would mean the headwinds are subsiding and we are looking at re-accelerating revenue growth, which would be fantastic - And even though a 3-4% beat would still be significantly below historical averages, I have my doubts about the second scenario and not only because they didn’t increase full year guidance, but for example because of their slowing customer growth. But who knows? There is always noise in numbers and we might be surprised positively for once.


Aside from Monday, Zscaler was the only company that met my revenue expectation this Q: They delivered $355.6M (11.8% QoQ, 54.2% YoY) and I had expected $356M from their guidance alone. The last four quarters billings had suggested a bit more though (based on that I had expected $363M or 14% QoQ). In any case, given how our other companies performed so far this season, Zscaler’s revenue growth stands out positively.

There is however potential (emphasis added) trouble looming for Zscaler: Their billings came in significantly lower than I had expected, only at $340M (vs. my expectation of $380M). “Billings grew 37% against a difficult comparison. Normalized for higher billings duration a year ago, billings grew 42% as customers continue to embrace our Zero Trust Exchange platform to secure the digital transformation”. So assuming that Zscaler’s QoQ billings growth percentages in Q2, Q3 and Q4 will repeat last year’s, I am now modeling 4Q23 YoY revenue growth closer to 45%, down from my original model which predicted 50%. But the real question is whether that assumption is a good one. As a reminder, billings is the quarterly revenue plus the delta in deferred revenue. So I have a couple thoughts here: First, a reduced deferred revenue (dropped -1.5% QoQ, negative for the first time in 11 quarters) could just mean increased efficiency which isn’t necessarily a bad thing. Although to be honest, I don’t think that is the case here. Second, the lower billings this quarter (and maybe also a lower billings next quarter) could be just macro talking and if the longer term narrative is in-tact, billings could easily ‘catch-up’ in the coming quarters, especially if future customers just delayed buying ZS’s products, and/or if existing customers delayed buying more. And if it is just current macro that caused them to delay, they will probably jump on board later, which will compensate for the drop now. “we’re seeing deals getting larger as customers are trying to consolidate more and accelerate their security transformation around our Zero Trust Exchange. Customers are expanding their commitments with us from a targeted use case to a much broader platform-centric approach. In our opportunity pipeline, we’re actively working on more multiyear and multi-pillar opportunities than we historically have. While good for our business, larger deals take longer to close as customers introduce more checks and reviews”. So at this point, I wouldn’t put too much emphasis on modeling revenue growth out to Q4 as only time can tell. However, that shouldn’t stop us from digging a bit deeper:

Customer growth numbers provide evidence for the hypothesis that the lower billings was partially a result of fewer new customers. >$100k ARR customers grew 6.1% QoQ, down from 10.5% last Q and 9.2% last year. >$1M ARR customers grow 6.4%, down from 13.5% last Q and 10.9% last year, so a clear deceleration in both cohorts.

Coming to profitability, Zscaler was one of the few companies this Q that kept increasing their spending in operating expenses ‘as usual’, spending 48.7%, 13.9% and 7.0%, in S&M, R&D and G&A. As a result their operating income margin stayed flat QoQ and they still managed to add a whole percentage point to their net margin, which is now at 12.4%. FCF margin did tick up this Q as expected and reached 27% and gross margin stayed roughly flat at 81.4% (81.6% last Q).

Finally, guidance for last Q was $340M at the midpoint, which they beat by 4.6%, similar to previous beats. That tells me that Zscaler has better visibility than those companies who only beat by 1-2% when typically delivering much higher beats. With that I think it is reasonable to predict another 4-5% beat of their newest, relatively weak guidance of $365M at the midpoint. This would put them at $380M to $383M in revenue next Q, which would equate to only 7% QoQ growth. But they increased their full-year guide by a healthy 2%, which tells me that they are bullish about their further outlook. On the profitability outlook, I expect good progress since they guided for $42.5M in operating income next Q. If they beat that by only 9% it would already put them back to 12% operating income margin. For reference, last Q they beat this guide by 12.3% and before that, it was only 9% in 2Q22 and in-between 14% and 40% in the other FY22 quarters.


Like most of my other companies (with exception of ZS and MNDY) Snowflake also turned in revenue below my expectations. Product revenue was $523M (12.1% QoQ, 67.3% YoY) versus my expected $536M (15% QoQ, 72% YoY). And aside from that, the main issue I have with this quarter’s report is their next quarter’s product revenue guide of only 2.8% QoQ. Applying the same beat we saw this quarter (4%), that brings me to just under 7% QoQ growth, which would be their slowest quarter by far. Will this be the quarter where Snowflake gets hit hard by macro?

Since Snowflake’s revenue is consumption based (and not subscription based) and because customers usually take about 6-9 months to ramp consumption it is a little more tricky to answer this question from the numbers alone. One indication I see is that they grew customers by only 6.4% in 1Q23, in comparison to the 9.7% in the quarter before (4Q22). Maybe the more interesting datapoint though are their strategic customers which are likely to ramp the most - the Global 2000 customers (currently 40% of revenue and “G2K customers only represent $1.3 million of trailing 12-month product revenue on average”): they grew only by 3.1% in Q1, down from 5.2% in 4Q22. So when SNOW reports 4Q23, we will be exactly 3 quarters after the one quarter where customers grew significantly less. So there will be a revenue impact of those customers growing slower which will be felt 6-9 months later due to the delayed ramp-up in consumption. “And remember, when a booking comes in, it takes a while before you really start to see meaningful revenue from those customers. Generally, it’s a six-month lag before they really ramp up (…) [and later in the Q/A:] it takes me six, nine months to ramp them”. So we are talking about part of the last and the ongoing quarter which would explain the Q3 revenue growth slow down as well as next Q’s projected slower revenue growth. And current macro leading existing customers holding back on consuming AND the holiday season in Q4 (with only 30% of scheduled jobs and 70% human) might come on top of that. Note that in 2Q23 Global 2000 customer growth was down even more. Only 2.8% QoQ. With that I will be prepared for next report’s guidance for Q1, 2024 also to be on the slower growth side. The good news is, however, that Global 2000 customer growth percentage almost doubled in Q3 from the 2.8% in the previous quarter. So bottom-line, the customer growth dynamics that has a 6-9 month delayed impact on revenue growth will produce some revenue growth headwinds for the next and maybe the next two quarters and we might see a bigger jump up in revenue growth after that. Of course, only time will tell, so take all of this with a grain of salt. Most importantly we should keep the bigger picture in mind: “The opportunity to have is massive and will take years to unfold”:

We did sign a $100 million contract in the quarter, again, with an existing customer on renewal. And we will have $100 million plus contracts this quarter, in Q4, with customers that I know are running out of credits and want a – to lock in for a long-term. So it’s just going to take time to grow these customers. Just like it took us, I think Capital One is one of our – is our largest customer. It’s taken them 5.3 years to get to where we are now. Most of our top 10 customers, with the exception of [ph] 1 we’ve been 4.6, 5 years (00:33:50) old customers to get into that top 10. And we think that trend will continue that it will take customers that long to ramp to get to – that those sizes.

There are three more reasons why I believe Snowflake will turn around quickly after 4Q23/1Q24:

  1. They pre-announced full year FY24 guide with a strong guide of 47% YoY product revenue growth, setting the bar pretty high with all those beats and raises to come.

  2. They grew >$1M customers again by 41 (last Q was 40), which translates to 16.7% QoQ growth. Combine this with their >150% NRR and you have a recipe for growth like I don’t see it with any other company I currently own (aside from maybe Sentinel).

  3. Last Q they promised “we expect we’ll have add big increase in RPO” and they delivered: while RPO was stagnating around $2.6B in the last 3 quarters, we saw a jump to an incredible number of $3B (55% of which is current, meaning to make it to the top-line within the next 12 months). So QoQ RPO growth re-accelerated meaningfully from -1.4% in Q1 to 4.1% in Q2 to now 10.6% in Q3. And we will probably see a further increase in RPO in Q4: “Q4 will always be our largest addition to RPO”.

In my October recap I wrote “On the margin front I would especially like to see continued operating income margin improvement, which would tell me that they are continuing their march towards profitability.” Well, they also delivered here: operating income margin jumped to +8%, up from 4% last Q and 3% last year. They also started stating non-GAAP net income and delivered a 7% margin, up from 1% last Q and up from 3% last year. So well done on both fronts. FCF margin stayed pretty much constant at 12% in comparison to last Q, but was up from 7% last year.

Finally, just a side note for those who remember Zscaler being criticized for their long ~1year sales cycles, here is an interesting quote about SNOWs large company customers: “What I want to remind you, though, too, is selling into a Global 2000 is not a one or two-quarter event. These are one to two-year sales cycles.


Similar to Crowdstrike, Sentinel missed my revenue expectations by delivering $115M in revenue (12.5% QoQ, 106%YoY growth), vs. my expected $121M (17% QoQ, 116% YoY). And while 106% YoY growth sounds amazing we need to keep in mind that this number is only so high because of the revenue they bought with the Attivo acquisition. So taking this into account it looks to me that S was in fact affected slightly more negatively than Crowdstrike if I compare last Q’s organic QoQ revenue numbers with this Q’s QoQ revenue numbers:

CRWDs QoQ revenue growth dropped by ~12% from 9.7% to 8.5%

Sentinels organic QoQ revenue growth dropped by ~37% from 19.8% to 12.5%

A similar picture emerges when I compare Q1 QoQ customer growth numbers with this Q’s QoQ customer growth numbers (didn’t compare to Q2 because of Attivo and don’t have organic numbers here).:

CRWDs QoQ customer growth dropped by ~25% from 9.9% in Q1 to 7.4% in Q3

Sentinels organic QoQ revenue growth dropped by ~32% from 11.2% in Q1 to 7.6% in Q3

The second revenue metric to look at here is ARR and specifically net new ARR: Making the best possible case for Sentinel, their net new ARR dropped by at least 25% QoQ this quarter: Organic net new ARR in Q2 was $64.6M, which now dropped to inorganic net new ARR of $48.8M! If we factor out the extra (unknown) net new ARR that Attivo brought, this percentage drop will be even larger. CRWD on the other hand dropped by only by 9% from $218M to $198M net new ARR. So for Sentinel to grow their net new ARR number by 20% next quarter should be piece of cake, given the big drop now. And for reference, S grew net new ARR in previous Q4’s by 42% in 4Q22, by 83% in 4Q21 and by 38% in 4Q20 as this is their seasonally strongest quarter. So if they really only manage 20% in Q4 that would be anything but good. Sure CRWD’s net new ARR dropping by 10% in Q4 wouldn’t be a reason to celebrate either, but they have historically grown net new ARR much less in Q4 than Sentinel, more like 22-27%, also exhibiting much less seasonality in net new ARR than Sentinel. And again, the point I am trying to make here is not that Crowdstrike is doing great at the moment, but rather, that relatively speaking Sentinel suffers in a very similar way than Crowdstrike, maybe even slightly more.

So revenue growth, net new ARR and customer growth tells me that both CRWD and S were affected in a similar fashion which points to just macro and nothing else. Elongating sales cycles also impacted Sentinel’s revenue and ARR growth as “several large deals that pushed beyond Q3 had already closed in Q4 with some closing just days after the quarter ended. That was several million dollars of secured deals that simply didn’t close in time. (…) Compared to our expectations, the lower net new ARR was largely due to macroeconomic conditions impacting the timing and size of new enterprise deals.” Management is optimistic and they “believe these natural factors are temporary, and there is no change to the long-term opportunity for our leading next-generation security.” If that will indeed be the case, I expect a period of ‘catch-up’ that will create temporary tailwinds for growth. If and when that happens, we should be mindful of that and remember that it might be a temporary boost in metrics.

So while Sentinel is currently suffering with revenue growth, they did great on the profitability side: last quarter they had made a big jump towards profitability, expanding their operating income margin by over 40% from the prior year. They had mentioned though that this was partly a result of them pushing some expenses into Q3 and Q4. So I honestly didn’t expect them to further improve this quarter. But they did, by another 14% QoQ! So we are looking at a company that just five quarters ago had an operating income margin of -100%. Keep in mind, that this figure doesn’t mean that the company burned through all their revenue, no no, it means that they burned twice the amount of money they made on sales in this quarter! And look where we are now, 5 quarters later this number has come down to -43%. What is also very much worth mentioning here is how they managed to do this. Because it is easy for a company to simply stop spending money on S&M or R&D, but that is not what we want to see as investors because that would likely hurt future revenue growth. We want to see how the business scales and revenue eventually outgrows their expenses. Well, I was happy to see total operating expenses to actually stay flat QoQ at $132M. So they still spent the same amount of money they did last quarter, but the margin improved by 14% because their sales grew by 12.5%. You might ask, well, what if they just pushed out those expenses they were talking about to Q4 and we will get the shock next quarter? First, Tomer said it explicitly in the call: “We’ve expanded operating margins by over 25 percentage points year over year for five consecutive quarters. We expect that to continue in Q4”. And second, the good news is that they guided for an operating income margin of -39% in Q4 and based on their beat history, they should be able to beat this by at least 10%, which would be fantastic. Especially in a time of macro headwinds where sales growth slowed significantly. Just imagine what will happen once macro headwinds fade. While they might never re-accelerate revenue growth to historical annualized QoQ growth rates of 19% (100% YoY) or more, just because they are growing into large numbers quickly, I don’t think they actually need to in order to continue their march towards profitability while still scaling their expenses and sales; “We will continue to calibrate investments to support our growth and reach profitability in FY ’25”.

One comment that surprised me a bit was “So, we do expect free cash flow to hit [breakeven] before, you know, profitability”. If they can do that, it would be great given their much worse FCF margins improved much slower in the last 3 quarters (-70% → -65% → 56%) than did profitability margins (NM: -73% → -55% → 38%). That would mean some big big steps up in FCF.

Sentinel’s NRR was 134%, slightly down from Q2’s 137%, but up from last year’s 130% as “this is driven by footprint expansion and rapid adoption of our adjacent solutions by our 9,000-plus customers”. It is worth pointing out here that Sentinel’s NRR is tied for second highest (after Snowflake) of all the Cloud companies that Jamin Ball is following in his clouded judgement newsletter. That is dozens of companies! And even more noteworthy given that Sentinel serves many SMBs, which are normally churning more than enterprise customers.

It also looks like Sentinel is doing really well in Cloud Workload Security, “which once again remained our fastest-growing solution in Q3”. It even appears that their customers which use endpoint protection from a competitor, prefer Sentinel’s Cloud solution, “The leading software companies selected Singularity Cloud despite having deployed a competitive next-gen EDR solution on their endpoints (…) we’ve seen that dynamic now play for few good quarters (…) we go in and unlock accounts that otherwise have been running somebody else on the endpoint side. And as you can imagine, we got two main competitors (…) But at the end of the day, it allows us to come in with a truly unique offering right now for cloud workload protection that is far superior to what any other endpoint vendor can provide on the cloud side”. That is interesting as you might think businesses pick one vendor and stick with it for all their solutions.

One reminder on customer count is that we count each MSSP as a single customer. Therefore, with some direct SMB customers facing budgetary pressures, much of that impact is offset by the strength and shift to our MSSP ecosystem.” The whole customer counting gets biased by MSSPs so I have a hard time interpreting their customer growth numbers. For example, could that mean that a >100k customer is in reality the sum of many SMBs? I guess certainly yes, if this customer is a MSSP. If that is the case and SMBs are delaying cyber security purchases more than enterprises at the moment, that would explain the drop to 10% QoQ “large” customer growth, which is down significantly from 20% QoQ growth last year. So I am not sure what to make of that. Certainly muddies the waters. “a lot of these customers that we’ve had in the quarter are actually masked by one master MSSP service provider that basically on boards all of these customers.

Wrapping it up

Our companies (including cyber security) saw a lot more macro impact this Q. But there are many signs that their underlying performance metrics have at least stabilized and we might even start to see some improvements in the next two quarters, which would be a welcome relieve from a tough year of investing. So here is to just that: May we, together with our companies, continue to grow in 2023!

Thanks for reading and a happy new year to all of you!

Past recaps

July 2022: Ben’s Portfolio end of July 2022 - Saul’s Investing Discussions - Motley Fool Community

August 2022: Ben’s Portfolio end of August 2022 - Saul’s Investing Discussions - Motley Fool Community

September 2022: Ben’s Portfolio update end of September 2022

October 2022: Ben’s Portfolio update end of October 2022

November 2022: Ben’s Portfolio update end of November 2022