CrowdStrike: The Ripple Effects Are Just Beginning (NASDAQ:CRWD)

Last week, CrowdStrike Holdings, Inc. (NASDAQ:CRWD) provided initial guidance based on reading from the global outage caused in July. The cybersecurity specialist cut guidance, but the market applauded the limited impact on business so far. My investment thesis remains ultra-bearish in terms of shares trading at an extreme valuation, with clients already pulling back from signing new deals.

Focus on FQ3 guidance

On July 19, CrowdStrike caused a global outage, impacting at least 8.5 million customer devices using Microsoft (MSFT) via a Channel File 291 incident. Most customers were back online within hours and some within days, but CrowdStrike is currently in a $500 million lawsuit with Delta Air Lines (DAL) due to a weekend-long outage that caused 7K flights to be canceled.

The cyber security company has a quarter ending in July, so clearly the outage would have limited impact on FQ2 results. The real key to the investment story is the ripple effects in the coming quarters.

CrowdStrike reported the following results for the quarter ended July 31:

The first key is that the company still beat consensus targets by more than $5 million, similar to previous quarters. On the FQ2’25 earnings call, CEO George Kurtz discussed the deferral of customer contracts as follows:

Because the July 19 incident occurred in the last two weeks of the quarter, when a significant portion of our sales typically close, it delayed transactions in subsequent quarters. The vast majority of these deals remain in our course.

CrowdStrike still closed some very large contracts by the end of the quarter, indicating that existing customers were less hesitant, but the CFO continued to provide more details about the deals being promoted. According to the executive, none of these deals closed on the Aug. 28 earnings date, or nearly a month after the end of the quarter:

The July 19 incident had a significant impact on the last two weeks of the quarter as we quickly mobilized teams to assist clients, but continued to close deals, including a nine-figure deal value expansion. While deals can push in any quarter, this quarter we experienced high levels over $60 million in deals that we had line of sight for the quarter and remain open since Monday. We expect these transactions to close in the coming quarters.

These delayed offers influence future results to the extent that these customers ultimately sign up with CrowdStrike. If the cybersecurity specialist loses customers like Delta Air Lines in the process, the numbers could get ugly and fast.

CrowdStrike guided FQ3 revenue from $979 million to $984 million for ~25% growth. Guidance is for the growth rate to decline 7 percentage points from the 32% growth rate in the most recently reported quarter.

More importantly, CrowdStrike missed consensus estimates of $1.01 billion by nearly $20 million. Also key, the company only expects revenue to grow by about $20 million sequentially, leading to limited growth in the coming quarters.

For example, CrowdStrike just added nearly $63 million in sequential revenue, and last Q3 sequential revenue growth was nearly $55 million on a ~$230 million revenue base smaller. Management suggests the remaining 2 quarters have about $30 million in subscription revenue reductions due to customer incentives to extend subscription commitments to the Falcon platform, apparently unrelated to the outage and odd timing.

The key is whether CrowdStrike can convince new customers to sign up for services or, conversely, existing customers to extend services. Although Elon Musk suggested his firms, adze (TSLA), SpaceX, and Twitter/X have removed CrowdStrike products, most companies aren’t willing to aggressively remove services knowing a replacement needs to be added, so any retention incentives would make sense for existing customers.

SentinelOne (S) recently reported quarterly results with the expectation of taking market share from CrowdStrike due to the disruption. The cybersecurity company didn’t report any major revenue guidance, but management did make the following statement on its recent earnings call:

At Black Hat a few weeks ago, we heard from companies looking to diversify their cybersecurity technologies and mitigate the risk of another global outage. There has been a lot of excitement and interest in SentinelOne.

Companies do not make quick decisions. They have to figure out how to make the transition, but this change is a positive for SentinelOne in the broader enterprise security landscape. This will play out for years as companies search through the web of debt and risk uncovered by this historic disruption.

Cyber ​​security sales cycles can take 9 to 12 months, so the tipple effects will last until next July.

Gloss Over Impact

The stock was already in decline prior to July 19th, with CrowdStrike failing to break above $400 just a few weeks prior and closing on July 18th at $343. Shares have dipped to late-2023 lows around $200, but CrowdStrike has already rebounded aggressively to $275 where there is strong resistance now.

Market cap is back at $68 billion with an EV of $65 billion based on a net cash balance of $3 billion. Investors quickly moved past the ripple effects of the disruption to already pay a premium price for the stock.

CrowdStrike is just shy of $1 billion in quarterly revenue, while the stock has an EV of $65 billion. The stock now trades at a forward EV/S multiple of 16x, while Palo Alto Networks (PANW) trades below 13x and SentinelOne is at 9x.

Even if an investor believes CrowdStrike will stabilize with growth rates in the mid-20% range, the stock should trade much closer to the valuations of peers in the cybersecurity space.

Not to mention that the full outcome of any litigation is unknown. CrowdStrike suggests that contractual obligations and insurance should limit any financial impact, but should not pay a premium for a company with unknown litigation and slower growth rates.

The company clearly suggests that new deals will likely require CEO approval and, in some cases, Board approval, pushing the deals for likely quarters. In reality, customers may not be willing to move to CrowdStrike until up to 6 months of incident-free operations escape executive restrictions.

The risk is that growth slows further in FQ4 and the market doesn’t seem to understand that the weak revenue guidance is entirely due to lower revenue for additional customer engagements. Even if growth rates remain around 20%, CrowdStrike should trade more in the range of 7x to 10x EV/S targets, similar to where SentinelOne is already trading despite even higher growth targets sales.

Take away

The main takeaway from investors is that the ripple effects of the global outage are only now starting to catch up to CrowdStrike’s quarterly expectations. The current quarter will have the biggest impact, while investors are still paying massive premiums for the stock. CrowdStrike still has considerable headwinds ahead.