Crowdstrike Q121 recap

CRWD - Q121

Supplemental info:…
Buynhold take:
CC transcript:…
CC recap (Starrob):…
CC recap (sarksnz):
CC recap (sjo):…
TomG comments:…
BigECat compares cybersecurity co metrics:…

Revenue 178.1M +85%

  • Sub Rev 162.2M +89%
  • Pro Svcs 15.8M +57%
    ARR 686.1M +88%
  • Net new ARR 85.7M +65%
    Adj Sub Gross Profit 127.0M +100.6% !!
    Adj Sub Gross Margin 78% +500bps !!
    Adj Op Inc 1.2M (vs -21.9M) swung pos
    … margin 0.7% (vs -22.7%) !! +510bps seq
    Adj Inc 4.5M (vs -22.1M) swung pos
    Opex 153.6M +66.1%
    CFFO 98.6M +6942%
    FCF 87.0M (vs -16.1M) swung pos
    … margin 48.8% (vs -16.7%) !!! +6550bps, +1550bps seq
    Cash 1.0B
    Custs 6261 +105% !!, +15.3% seq
    Empl 2854
    $NER >120%

COVID-19 response:

Chief Product Officer blog post:…
CEO statement:…

  • surge relief plan (called the Burst Licensing Program) that allowed customers to increase the number of protected endpoints temporarily, for free for 60d

  • new Falcon Prevent for Home Use program to allow admins to install Falcon Prevent on employee’s home systems and devices

  • new COVID-19 related resource page:

  • are helping customers with payment plans, where necessary

  • now have 11 modules and 11 app store partners

  • 73% US, 14% EMEA, 8% APAC, 5% other

  • 55% of custs have 4+ modules, 35% have 5+ modules

  • EPP module named Leader in Forrester Wave: EDR Q120 report, with highest score in 11 criteria

  • highest rated vendor in 2020 Gartner Peer Insights Customer’s Choice for EDR for 2nd yr in row

  • new SI and MSSP partnerships in Europe

  • uptick in use of Falcon Discover (IT Hygiene) and Spotlight (Vuln scanning) products by IT & security teams

  • 45% of custs now use Falcon Discover, to view inventory and usage and detect vulnerable areas

  • Falcon for Mobile has had major uptake by school districts, for securing mobile devices

  • focusing on deep partnerships that are bearing fruit

  • 75% sequential increase in ending ARR is coming from AWS partnership

  • protecting cloud workloads is greenfield space; seeing good adoption in container protection

  • during rollout of new cust (European logistics co), they stopped a ransom-ware incident and helped remediate on non-protected endpoints

  • another new cust (major food conglomerate) replaced 4 separate vendors, across dozens of subsidiaries

  • as incident remediation services help non-customers, in response they see $3.73 of sub rev for every $1 on incident response or proactive svcs

  • getting larger initial lands, impacting $NER

CEO in CC: "Overall, it could not be more pleased and inspired by the superior execution and dedication to our customers by every CrowdStriker. Now more than ever, it is important that we step up, fight the good fight with our customers and stay ahead of the adversaries. The COVID-19 pandemic has created a breeding ground for cyber crime. The past couple of months have represented one of the most active threat environments we have ever seen. The threat environment is even more heightened for healthcare and frontline organizations as they contend with increased remote workers, limited staff and increased patient care needs. We enable our customers to stay ahead of these threats whether they are at home, in the office or in the cloud.

… Cybersecurity is mission-critical. And even in this challenging macroeconomic backdrop, customers have continued to prioritize cybersecurity investments. This includes those customers and industries most impacted by shelter in place orders such as airlines and hospitality. In addition to effective and superior cybersecurity, CIOs and systems are looking for a strategic partner to help them easily accommodate a remote workforce, simplify their operations, bridge the skills gap and reduce cost."

My stance: Great execution and especially great movement in margins. Gross margins are rising, and adj gross profit is growing more than top line. Adj op margin has now swung positive, while FCF margin went from -16.7% to 48.8% YoY (15 of those percentage points in the last Q alone). Customers grew 105% while operating leverage is kicking in.

I like this execution very much. Over last 4Qs:

Revenue growth 94%, 89%, 89%, 85%
QtoQ cust gain +23%, +30%, +19%, +15%
Adj Op Margin -19%, -13%, -4.4%, 0.7%
FCF Margin -27%, 5.6%, 33.3%, 48.8%

Top line growth is staying in the high 80s. At first blush, I was slightly disappointed by the fact that QoQ revenue went down 4 points instead of hitting clear tailwinds from work-at-home. Why didn’t revenue growth re-accelerate? But go back and look at this company’s immediate response to the COVID pandemic. Crowdstrike allowed customers to surge the # of endpoints they wanted protected FOR FREE for 60 days, as well as allowed them to protect their employee’s personal devices (laptops and smartphones) if they used them for business use.

Crowdstrike made a conscious choice to help their customers in a time of need; instead of hamstringing customers during this immediate transition to stay-at-home (and the resulting confusion it surely caused), they allowed their customers a huge amount of flexibility over that first 60 days (from March 20), in order to figure out how to transition their workforce in this extreme situation.

CEO in Q&A on the free 60d window for surge in endpoints: "Well, I think in general, we think work from home and work from anywhere is a meaningful opportunity. Obviously, we were flexible with our licensing, which we thought was the right thing to do from our customers, and that’s still running out. We’ve had a lot of customers take advantage of that. And so a lot of over-deployment, which helped them. And ultimately, our goal is to be able to go back and draw them up and move them into paying program.

… The feedback that we’ve gotten so far has been fantastic. In fact, we have customers asking for a permanent work from home program for the home users. And if you think about in today’s environment, lots of people use their own computer at home, they try to connect with a VPN, customers need it to be a little bit more flexible depending on their industry. So having the home users protected, which are often exposed to something that they could bring into the corporate network, which again is disappearing is important for many of these large institution. So I do think there is some good opportunities going forward as we look to close out those programs."

I highly respect that decision and what it says about mgmt. They turned around and gave a huge amount of flexibility to their customers, in what was likely a trying time for them to have to immediately adapt to a new reality that scattered their workforce. Some of that surge in company-owned and employee-owned devices may have been temporary, but now those customers have had time to adapt, catch up, and get used to this new environment. Now that we are >60 days into this pandemic (and beyond the window for free bursting of licenses), the company will now get to see the financial benefit of the large increase in protected devices due to stay-at-home. And even with all that free add’l usage of their platform by existing customers, gross margins managed to go up another percentage point QoQ as op margins swung positive.

So all that said… this was a great quarter, but also keep your eyes on the next one. This Q was guided to 71-74% growth and hit 85%. Next Q, they guided for 72-76% (with them saying they expect higher churn). Any guesses for Q2 top line growth? I hope to see that tailwind I wanted to see this Q, now that the surge in devices can fully hit the books. One thing to note, however, is that they continue to hire, and expect increased opex in Q2. Due to “timing of expenses and seasonality of new hires” they expect op and FCF margins to dip negative next Q.

long CRWD


Some other good CRWD tidbits lately…

Ronjob on how CRWD stands out over MSFT:…

Albert Wang - CRWD comparison to other SaaS platforms, and competition review:…
… right before Q1 earnings so shows Q4

  • Ever-increasing security threats
  • Outpaced demand for security
  • WFH trends
  • Exceptionally low churn
  • Cloud-based and easily deployable
  • AWS marketplace

CEO interview:…

On how pandemic will play out from here: “I think it will be a hybrid environment. You’re going to have some folks go back to work, you’re going to have split shifts. … I don’t call it work from home. I call it work from anywhere, and that’s a movement. Really, that’s a subset of digital transformation, and digital transformation is not a one-time hit. It’s a very sustainable trend.”