CRWD CFO update


There’s a young whippersnapper out there named Brad Freeman (Hi Brad!) whom I believe also resides on our board and pipes up from time to time, and who writes a thoughtful substack about the companies he owns. His most recent issue is here, with what felt like an important section about CRWD.

The link to his newsletter is here:…

The part about CRWD is below with some dialogue questions tossed in by yours truly.

Also, I hope Monkey’s not violating either Brad’s good faith analysis which is open to the public for free, yes?, nor some kind of copyright thingamajig. If so, please delete.

But if all is good on the legalese front, then take that SentinelOne (which Monkey also owns)so all is fun and games in a juicy fruity food fight)! And yet, let’s see if we can get the facts to stand up straight…

CrowdStrike (CRWD) — CFO Burt Podbere Interviews with Jefferies and Needham + A Case Study & Some Market Share Data
a. Podbere Interviews
On competition (he was specifically asked about SentinelOne in both conferences) and pricing pressure:
“SentinelOne does a great job setting up awesome demos that look great. What happens after that is another story. We frequently talk about vendors choosing them and then boomeranging back to us because it just doesn’t scale and doesn’t deploy without a lot of false positives. This has been the most favorable competitive environment that we’ve ever seen.”

Monkey: There’s marketing and there’s lying. Which is the CRWD CFO doing when he says “it just doesn’t scale and doesn’t deeply without a lot of false positives.” Can we get an expert’s eye on this technical issue?

“Our win rates against the competition have never been stronger while we maintain and increase our pricing… This goes back to what we’ve been talking about — we’re selling a platform and value. We’re actually going in and offering better efficacy and lower total cost of ownership when you pull out the extraneous tools and consolidate on CrowdStrike. Better efficacy at a lower price which you can see in our numbers. People are willing to pay for the best. I think about our market leadership role and where it stands as similar to a Salesforce or ServiceNow. As they increased their leadership, competitors fell by the wayside. That’s what we’re seeing.”

Monkey: Because CRWD is 4x the size of S, its rate of growth is obviously decelerating while S is still o the upswing. But based on the above spin, that does not preclude astoundingly successful business performance–follwed by stock price in the longer-term-- which can last for decades “as a platform” if the platform really is the leader. Question: who’s buying the “platform” pitch as a differentiator between CRWD and the competition?

The demand pipeline is currently sitting at record size. While the pandemic did serve as a tailwind (needed to protect all the new remote endpoints for distributed workforces), the company continues to have no trouble finding new annual recurring revenue (ARR).

CrowdStrike continues to grow its proportion of multi-year deals vs. single year deals — this inherently lends itself to better retention and more cross-selling.

On sentiment that other players have more AI and automation built into their platform:
“When you’re known for better efficacy and lower false positive rates that is evidence of our AI/ML working better.”

Monkey: Fact check?

On why CrowdStrike chose to be cloud native with no parallel on-premise platform:
Burt pointed to two key benefits of being cloud native and exclusive:

Ability to ingest, organize and conceptualize data more seamlessly with more scale.

Immediate “time to value” for on-boarded customers.

“With respect to if a lack of an on-premise (prem) offering prevents us from expanding into different industries or geographies, we sell everywhere — across the world and to every industry. We have turned down many opportunities that have asked for on-prem, and what happens is that those companies end up coming to the cloud. Eventually, it will happen for everybody.”

He reminded us that Salesforce also has no on-premise solution.

On the Cybersecurity and Infrastructure Security Agency (CISA) win:
“The CISA deal was extremely competitive and we won because of our efficacy. We’ll start in a few agencies. From there, we’ll be able to sell to more and more agencies. They’re a big seat at the table for all civilian agencies so winning that is an on-ramp into much bigger things. The ARR will ramp over the next 3 quarters.”

CrowdStrike expects this to become “one of its largest clients” and is currently contributing $0 in ARR for the company. The growth here is entirely ahead of it.

Monkey: Slowing growth you say… Reminds me of ZS when lots of bald apes here sold out of it prematurely…

On the cloud workload opportunity:
“Cloud workload protection (CWP) is a greenfield opportunity. It’s not like there’s a legacy player out there and we’re taking market share from them. There’s not even a legacy player there. The $10-$15 billion market is completely underserved. We think there’s a real opportunity for net new ARR to be 50% or more from CWP in the future.”

On costs moving forward:
R&D spend will outpace S&M spend going forward.

CrowdStrike expects share dilution to be in the 5-6% annual range going forward to compensate employees in a tough environment for hiring and retaining cybersecurity talent.

b. Transpak Case Study
Transpak — a logistics company founded 70 years ago in Silicon Valley — was struggling to fend off malware attacks and other breaches amid its rapid growth. The company evaluated several close alternatives and chose CrowdStrike’s Falcon Platform due to its ease of deployment, seamless anti-virus replacement/upgrading, and immediate time to value.

“The tools that CrowdStrike Falcon provides give me the ability to sustain our business processes to keep the systems running. I wish I had more tools that were as easy to deploy, maintain and manage as the CrowdStrike Falcon Platform. It increased the value of my security program.” — Direct of IT at TransPak Mark Sauer

Transpak also purchased Falcon OverWatch to take advantage of CrowdStrike’s managed hunting team.

c. Market Share Update
In late 2020, CrowdStrike published a graphic depicting its 12% market share within modern endpoint security. For 2021, it was ranked #1 by IDC for modern endpoint security share. CrowdStrike now boasts a 14.2% market share. There remains a long, long runway of legacy business for next-generation vendors like CrowdStrike to take.

So between Brad’s commentary and Monkey’s quips and questions, let’s get to discussing. Monkey himself thinks the reports of Crowdstrike’s demise as an intelligent and fruitful investment going forward is greatly exaggerated.


Monkey (long CRWD and S and ZS and NET and DDOG in a happy little basket of safety)


Hi Monkey,

Yes you will have false positives when you mass deploy a solution that blocks requests through AI. I’m not sure on the details in what situations SentinelOne fails to deploy at scale, perhaps has to do with specific environments - fundamentally their platform is very different than Crowdstrike and requires higher local storage availability in order to run - so maybe the limitations is related to that.

I think trying to figure out who has the better tech is an uphill battle which will be solved in May when the 2022 Gartner MQ for end point security is scheduled to come out. Until then we will hear a lot of comments and the fight will carry on. Currently SentinelOne is not even ranked as number 2 in Gartner MQ 2021.