CrowdStrike: A Strength I Didn’t Know About (NASDAQ:CRWD)

Introduction

Almost two weeks ago, CrowdStrike (NASDAQ:CRWD) released its first report since the massive outage you have all heard about. The incident happened on July 19th.

It makes no sense to discuss the outage again, as there were enough reports already.

At the same time, the price had been up a quarter since the beginning of August, setting high expectations for the earnings release.

Let’s examine the results to see what happened.

The Numbers

Revenue was up 31.7% year over year to $963.87 million, beating the estimates by $5.55 million.

The ARR (annual recurring revenue) was up 32% as well, to $3.86 billion.

The non-GAAP earnings per share were up 41% year over year, from $0.74 to $1.04, beating the estimates of $0.97.

Free cash flow was up 44% year over year, from $189 million to $272 million, a free cash flow margin of 28%.

With that free cash flow margin, we can also calculate The Rule of 40, which adds up the FCF margin with the revenue growth. With 32% revenue growth and 28% FCF margin, we get to a Rule of 40 number of 60, which is very high and shows the power of CrowdStrike, even in these difficult times.

Of course, the question was what the impact would be going forward. That’s why the guidance was probably the most-watched number. Everybody knew CrowdStrike would not meet the consensus numbers, but the question was how much the company would miss the consensus.

Guidance

Management is known for providing conservative guidance. With the outage debacle, I expected impact, but I’m not sure how much, of course. As the impact will only be really clear in the next quarter and maybe even only fully in the calendar year 2025, guidance was a focal point for me and probably all of the analysts.

For Q3 2025 (CrowdStrike’s fiscal year is one year ahead of the calendar year), the company sees revenue coming in at $979.2 to $984.7 million, 2.8% under the consensus. That’s better than I expected. Sure, it’s only up 2% from this quarter, but it’s still growth.

Non-GAAP EPS are seen at $0.80 – $0.81, 16.4% lower than the consensus of $0.96.

For the full year, including the fourth quarter of this calendar year, total revenue is estimated to be between $3,890 and $3,902.2 million, 1.5% lower than the consensus of $3.96B. Non-GAAP EPS are expected between $3.61 and $3.65, while the consensus stood at $3.91, 7.7% lower than the consensus.

My first conclusion was that CrowdStrike does NOT see a significant drop in new customers or customers leaving, but it has to give discounts because they messed up, so profitability will be lower. Of course, that’s just a first impression. We go deeper into management’s comments to see if that working thesis holds up. But first, something else.

CrowdStrike’s Platform

CrowdStrike is often described as an endpoint protection company, but it’s not. It’s a full platform and the company showed this in its earnings presentation.

Now, as you can see from the image, there are many competitors, but none that do everything CrowdStrike does. That’s why the subtitle on this image is very important: “Our Single Platform Consolidates Point Products and Lowers TCO.”

This is crucial to understand. Many companies use CrowdStrike as a full platform, and it’s not so easy to replace one single platform with multiple alternatives. Or, in other words, it’s hard to add complexity in your stack instead of simplifying it. CEO George Kurtz also emphasized this:

Customers’ comments back to me are, they don’t want to go backwards. They don’t want a bunch of disparate products. They don’t want a bunch of different consoles.

And:

Customers don’t want to go backwards and have a patchwork of products. They are still focused on the consolidation piece and they’re looking at us as one of the key consolidators in the market.

That can also be seen in the number of modules customers take. 65% of CrowdStrike’s customers have 5 modules or more, 45% have 6 or more and 29% have 7 or more.

But the last number on this slide is maybe even more important. 48% of customers that spend more than $100,000 a year have more than 8 modules. That shows how deeply embedded CrowdStrike is in many enterprises. It’s hard to rip that out and start all over again. Especially because if you switch, you are not sure the new player will not have the same issue. Mistakes are human and always will be.

The implication is also that there are always modules in CrowdStrike that are growing at record speed. CrowdStrike pointed them out.

And if you look at the TAM (total addressable market, which is per year), you see there’s still a lot of market territory to gain.

As you see, there’s a 2024 TAM of $100 billion dollars. But that is expected to grow to $225 billion in 2028. That’s a CAGR of 22.8% per year. If the TAM is expected to grow this fast and CrowdStrike can just keep up or do a bit better than its market, this promises many years of high growth left.

CrowdStrike’s Surprising Strength

I contacted two cybersecurity consultants I know. Steven advises and implements cybersecurity products and platforms for medium-sized and big companies. Pablo is an auditor, mostly but not exclusively focused on penetration testing, commonly known as pen testing. They both prefer CrowdStrike, and Steven advises taking CrowdStrike in 80% to 85% of the situations. Just for more context, they don’t know each other.

Both tell me that the attitude toward CrowdStrike is not very favorable in IT departments, as most that work with CrowdStrike had to deal with the outage, which meant extra work. Some were even summoned during their holidays. So, it would be strange if sentiment about CrowdStrike was very positive now. But on the other hand, most understood that this could happen to anyone. The feeling that’s left is mostly: “Ok, we understand, but it still stinks, and we expect some kind of compensation.”

When I asked why the companies didn’t want to change, the answers both consultants gave were “too much work,” “no good alternatives,” and “too important for auditing purposes.” I had not expected that last one, so I pushed a bit more and gathered some valuable insights.

When we talk about security audits, those can be internal or external, like the friend who (mostly) does pen testing. Think of compliance checks, risk assessments, pen testing and other things. CrowdStrike is often seen as better for audits for several reasons, compared to competitors like Palo Alto Networks, Microsoft, or SentinelOne (names I threw at them). Together, they named five reasons:

1. The platform’s single, unified dashboard makes this information easily accessible, unlike other systems where auditors might struggle with multiple interfaces and scattered data.

2. CrowdStrike’s cloud-native architecture. Especially Palo Alto Networks with both on-premise and cloud hybrids was seen as behind here. CrowdStrike’s 100% cloud-based system reduces complexity. It makes it easier for auditors to know that all endpoints are covered and secure, which makes their audit process quite a bit faster.

3. Granular data and reporting. When auditors must dig into specific incidents, CrowdStrike delivers the necessary details quickly and efficiently. This was especially seen as a weakness for SentinelOne, that involves much more manual work.

4. Proactive threat hunting. Auditors appreciate systems that don’t just react to threats but actively search for them. This reduces the number of incidents that require explanation and leads to smoother, cleaner audits. Here, Microsoft Defender was named as weaker than CrowdStrike.

5. CrowdStrike minimizes false positives, making auditor’s work much easier. Its seamless integration and user experience make the audit process less tedious compared to other platforms, where auditors might spend excessive time sorting through irrelevant data.

Auditing was an element I had not thought of as being a competitive advantage for CrowdStrike, so I learned a lot here. If you have more data on this, feel free to share in the comments!

Of course, CrowdStrike remains a very performant cybersecurity solution and CEO George Kurtz emphasized that again:

If you look at the latest MITRE results, Falcon had 98% coverage, our next-gen competitor had 79% coverage. It took Falcon 4 minutes for mean time to detection. It took our competitor 47 minutes.

Insights From The Earnings Call

1. Sorry

Founder and CEO George Kurtz started the earnings call as I wanted him to start it.

I would like to start today’s remarks with my apology to everyone impacted by our Channel File 291 Incident, which transpired on July 19. I also want to take this moment to show my gratitude to everyone who worked with us through the incident. Thank you to our customers and partners for your continued trust. Thank you to our team of relentless CrowdStriker’s for living our mission. Thank you to the broader cybersecurity and IT community for standing with us as we face the most challenging event in our company history.

The magnitude of the July 19 incident will never be lost on me and my commitment is to make sure this never happens again. The days following the incident were among the most challenging in my career because I deeply felt what our customers experienced.

That’s how you should do that, humble, acknowledging you were wrong and thanking the people you need to thank.

2. Fixing it

CrowdStrike has taken 4 steps to enhance the reliability of the roll-outs.

1. Enhanced Content Visibility and Control: The company released new content control configurations. These allow customers to choose when and where new Falcon content is deployed, which was not the case before.

2. Content QA Enhancements: In response to recent issues, CrowdStrike has shipped an upgraded content validator and interpreter, which both failed and this caused the outage.

3. External Review and Validation: CrowdStrike has engaged two independent third-party software security vendors to review the Falcon sensor code and the overall quality control process.

4. Enhanced Content Release Process: CrowdStrike has revamped its content release process. It now includes multiple layers of testing, sample testing, internal lab testing, canary systems testing, early access soaking, and a staggered concentric ring deployment that is in sync with the customer policy settings.

These are good but also very necessary steps. Customers need to see that CrowdStrike does really everything to restore their trust, and this is a part of that process. Customers get more control, which is always important.

3. The outage impact

Of course, this was the main point I wanted to hear about. Unlike what I thought, the incident had immediate repercussions as well. George Kurtz:

As the July 19 incident was in the final two weeks of the quarter when a meaningful portion of our sales typically close, it delayed deals into subsequent quarters. The vast majority of these deals remain in our pipeline.

George Kurtz also shared two post-incident deals for Falcon Cloud Security, one 8-figure deal and one 9-figure deal. For SIEM, there were two post-incident 8-figure deals. This shows again that companies have not stopped trusting CrowdStrike. George Kurtz:

I’m reassured by customers’ and prospects’ feedback, wanting to do more with CrowdStrike post-incident as evidenced by multiple seven and eight figure platform expansions with most opting for multi-year deals.

CFO Burt Podbere was also clear with some pieces of data:

Customer retention remains remarkably strong and we do not expect this to meaningfully change in the foreseeable future. Gross retention was 98% at the end of Q2 and dollar-based churn in the last five weeks as of Friday was modestly lower than the same period last year.

But that didn’t mean he denied that there was an impact:

We expect to see extended sales cycles for both new and existing customers, with additional scrutiny requiring higher levels of approval at the CEO and in some cases, Board of Directors level.

CrowdStrike is also focusing on longer deals for more products. That will have an impact. Again Podbere:

We estimate these packages will impact net new ARR and subscription revenue by approximately $60 million and professional service revenue by high-single digit million dollars in the back half of FY ’25.

And later in the Q&A part:

And we walked through the numbers in terms of revenue, the impact, we said $60 million in the back half, $30 million in Q3, and $30 million in Q4. So that was the biggest driver on revenue.

And then obviously that falls down to non-GAAP operating income.

Of course, there will also be an impact on payment terms for customers, and the company expects higher G&A (general and administrative) costs because of the outage. Read: paying lawyers.

He also emphasized that CrowdStrike did not see any change to its long-term goals. Podbere:

Additionally, we remain committed to reaching $10 billion in ending ARR by the end of fiscal year 2031 and achieving our target non-GAAP operating model on an annual basis by fiscal year 2029.

The goals were shared again in the presentation.

Valuation

With more visibility from management about the impact of the outage and with the stock down about 35% from its high, how is the valuation impacted?

To me, valuations remain always subjective. Judging growth companies based solely on a PE ratio still makes very little sense. The question may then be about the right metric, and the answer there is much more complicated. But overall, I use this framework.

CrowdStrike is still in the high-growth phase right now. It crossed the profitability line in all manners, but it’s still growing revenue at more than 30%. That means that EV/Gross profit is probably the best metric to look at. So, let’s look at that first.

If we divide $57.47 billion by $2.65 billion, we see that the EV/gross profit is 21.68. That looks quite reasonable for a company growing this fast. It’s not very cheap, though. In early 2023, CrowdStrike’s stock traded at around 15 times EV/gross profit. But overall, 21.68 times looks reasonable.

While EV/Gross profit looks like the best metric at this point, let’s also look at the metrics from ‘mature growth,’ even though CrowdStrike is not there yet. For mature growth, you think of growth somewhere in the low or mid-teen range. But still, extra data won’t hurt.

The trailing twelve months P/FCF is 48, which is not cheap, of course, but for a company that’s growing this fast, it’s not the best metric to look at. On a forward basis, so for 2025, this drops to about 41, but we have to be careful about the impact of the outage in the next year.

When I combine all the valuations, I see CrowdStrike as fairly valued or slightly undervalued right now.

I don’t see CrowdStrike as a screaming buy here, but I think that if you focus on the long term, it could be attractive to add to your position or start one. At this price, I think CrowdStrike is a buy.

Conclusion

The quarter and the guidance were better than expected. My main question going into this quarterly earnings report was: “Is the investment thesis damaged or broken?” My answer (for now, things can always change) is a clear no, clearer than I had anticipated, which is great. The market seems to agree because just before releasing this article, the stock was up significantly.

Because I don’t see a material impact on the long-term thesis, I think it can still make sense to buy CrowdStrike now. It may have some impact over the short term, but it seems quite limited. Over the longer term, this too shall pass. The valuation looks reasonable but, in turn, you get higher uncertainty, of course, although those worries were calmed to a big extent during this quarter.

In the meantime, keep growing!