Cyber security discussion after earnings

So SentinelOne came out with earnings this week and it appears that they do not have the same issues as Crowdstrike seemed to portray (as Saul had pointed out in an earlier post).

There have been a number of good posts on the subject so I don’t want to repeat any thoughts but I did notice there was a few comments about market share changing and I wanted to point out some comparisons and my interpretations.

First let’s look at overall revenues and growth percentage:

| Ticker | Revenues | % Increase|
….PANW ——-1.6 B ————- 25%
….CRWD —— 581M ———— 53%
……….S ——- 115M —————106%

I know that most understand these numbers but it is always good to put things in context. PANW is the big dog here but a lot of the revenue is firewalled systems. Many here believe that the firewalled systems are going away. I am not so sure and believe there are many companies / applications that may want to keep them firewalled, perhaps even permanently. And by my calculations this portion of the business is GROWING in the low single digits. Not nearly as exciting AS THE SAAS portion, but the growth is slower because these systems have been around and most companies have security for them already. But, to be clear, this business is still growing, not shrinking, as many seem to believe. Also importantly, it is very profitable, with PANW showing $1.2 B in free cash flow this quarter. Quite amazing when you think about it for a company with a market cap of $48 B. So 5% FCF generation in a rapidly growing company! I mean Wow!

The second point to make is that CRWD is much bigger than Sentinel, 5 times bigger in revenue actually. And to be fair, CRWD is somewhat bigger than PANW in cloud software which will be clearer in a moment.

But the main reason for my post is the SAAS portion of these companies. So let’s look at that on an ARR basis

Ticker. | ARR (M$) | % Incr. |ARR incr (M$)|
…PANW———2100. — 67.% —— 843.
…CRWD —— 2340 — 54.% —— 811.
……… S ——— 487 — 106.%. —— 251.

So first, PANW is growing faster (this qtr) but somewhat smaller in total sales. But let’s go back to the topic of market share. When comparing companies of different sizes, this can be a little tricky. Sure, Sentinel’s absolute market share is increasing more rapidly, but in this case it is a growing overall market. It’s a little tougher to use the numbers to say they are taking share from anyone else.

Further, since this is a “land and expand” type market where it is acknowledged that once you have selected a vendor that changing vendors is difficult. In this case, the absolute sales increase (ie new business and last column in the above table) may be more important than the percentage. After all, how many years of “land and expand” growth is left and how long would it take for S to actually pass either of its competitors. It is safe to say, it will be awhile. I won’t calculate an exact number because using one quarter’s growth to do so seems unfair and misleading and their growth will clearly slow as they get bigger. In any event it is not clear to me who is the better bet in this regard.

I would also say that the ARR numbers are so close between CRWD and PANW, it is tough to call a winner even now. Slightly larger market share for CRWD, slightly higher sales growth for PANW (ignoring the one qtr % sales growth for now). The only advantage I would give to PANW is the very successful and growing firewalled business for two reasons. One, we already agreed that switching vendors is a pain, I would say that holds even if the incumbent is in firewalled security. Two, the tremendous free cash flow allows PANW to invest the resources to win in the Cloud space. But clearly, an eventual winner is not assured here and in fact the answer may be all 3 winners in a huge and growing market.

So, no answers from me here. All three companies are still doing very well if reviewed individually. One exception being that I don’t like the trend and management statements from CRWD for this quarter. This will need to be watched closely.

But anyone who thinks they know the eventual winner in this industry is smarter than me, which is why I own all three.

Long S, CRWD, and PANW and PANW Tickerguide.


PS, is anyone knows how to fix the tables in the new system. Let me know and I will edit it to be more readable!

I found that no one seems to have pointed out that, the 2.1B ARR from Palo Alto network comes from two parts:

  1. Prisma Cloud, which is Zero Trust and competitor to ZScaler.
  2. Cortex, which competes with Crowdstrike.

So I think it’s not an apple to apple comparison.



Wasn’t most of the zero trust for PANW selling to existing customers? Easier to sell to current legacy systems. I don’t follow them closely though.


Two interesting inputs from monkeydluffy and FinallyFoolin, but I want to make sure I don’t miss the point.

Straight apples to apples comparisons hardly ever exist and the fact that they are cross selling to existing customers sound like a competitive advantage. But, and I easily may be missing the point, I get the feeling that both of you are trying to use these facts as the reason that PANW is winning, somehow discounting the benefit.

To my way of looking at it, being able to bundle various cyber needs is an advantage as well as using existing customers to sell peripheral products.

All goodness and an advantage to my eyes. Am I missing something?