CrowdStrike Holdings, Inc. (CRWD) Earnings Call Transcript & Summary

All right. Well, good morning, everybody. Thank you for being here for the last day of our Morgan Stanley TMT Conference. Really appreciate it. And we are really excited to have the team from CrowdStrike. We have Founder and CEO, George Kurtz; as well as CFO, Burt Podbere. Thank you so much for coming. As a brief programming note, for important disclosures, please see the Morgan Stanley research disclosure website at www.morganstanley.com/researchdisclosures. And with that, George, Burt, thank you so much for being here.

Great to be here. Thank you. Yes.

Great to be here.

Okay. I thought we would just start off a little bit on the state of the union in terms of the demand environment, the macro you had, your Q4 earnings a couple of days ago. Talk a little bit about what you're seeing in terms of overall demand and some of the major sort of highlights coming out of that quarter.

Sure. I think if you look back over the last couple of months, just in general from a market perspective, we saw a bit of a trough, right, in the general market of October, November. And as we progressed through November, December and January, it gets back to what I said before, security is something that you just can't put off indefinitely. And certainly, in January, we saw fantastic activity. And I think it goes to the fact that people are still flighting their projects. They're still executing on them. And if we have the ability, which we do, to be able to save time, money and have a better outcome, that's what customers are buying. So overall, there's still headwinds in the environment, but I think getting in front of the deals is really important and making sure that we're really showing a tangible return to our customers in terms of ROI and TCO.

Burt, anything to add to that?

Yes. I think at the end of the day, you can just see that our AR balance jumped up because of the strong January. And it goes to the fact that, as George mentioned, we had a lot of customers that say, hey, we're going to start the new year and we got to make sure our security stack is in check.

Got it. So let's dig right into what some of the investors might be picking on coming out of that quarter. So the first thing was gross margins not just last quarter, I think over the last several quarters, it's been trending down a little bit. Some have surmised maybe that's pricing. Do you care to dispel that notion?

Yes, it's not so much pricing. I think at the end of the day, we've been doing a lot of investing, right, in our own infrastructure. And I did give some additional information in our Q1 that we're going to -- we're expecting to see up to 1% increment in our subscription gross margin, and that's going to be because some of the fruits of our labors are going to pay off. So we wanted to give that notion. And then if you think about our opportunity in gross margin, it comes in twofold, obviously, the top, more modules that come out, our ability to continue to sell the platform, our ability to continue to drive costs down, getting better outcomes for customers, that's -- customers that's there. And then on the bottom, we have an opportunity on our COGS side of the house to optimize both our public and private clouds. And so for us, we see a great opportunity. We've been investing for years on our private cloud. And we've made some great strides there, and we look forward to being able to get to the top end of our long-term range because of those investments that we are making today. It's not all going to come at once but it will come over time.

Just to follow on that, too, one of the things that we talked about was Humio which is now LogScale. They had their own architecture. It's mostly in the public cloud. So there's a migration process to optimize the balance between public and private cloud there, and that's still ongoing. So that's one of the areas that we also talked about. And I think in general, when you look at some of the acquisitions we've done, there is a level of investment. There's no acquisition we've ever done that operates at the scale that we operate, so we've got to make sure that we can take those great technologies. We've done a few, and then we can scale them up to make them work from people in an infrastructure perspective.

Got it. I want to go back to some of the debates on the endpoint market. So CrowdStrike pioneered the market for EDR. And there's still a big sort of legacy installed base for EPP vendors. And those EPP, those legacy antivirus vendors used to compete a lot on pricing. What did CrowdStrike do to, one, innovate on that and then ultimately expand the market? Because today, you're still premium price. You're still about 15% to 20% higher ASP than a lot of your competitors, which I know is not exactly like-for-like. So what was the additional value that you brought to really help expand this market?

Well, I think it starts with the fact that when I started the company, it was really to build a platform company and started with the right architecture. And really, the first incarnation of the product was to build a very scalable agent, didn't require reboots, allowed us to collect data at scale. And once we have that, then we built all the other components around that, all the AI elements, all the prevention. And that has really served us well because when we think about visibility at EDR, at the end of the day, it's about stopping breaches, and we do that better than anyone that's out there. But from a business model perspective and talking about ASPs, our ability to actually install and get immediate time-to-value and have a customer up and running, and many of the largest financial services companies in the world use us as an example, they would budget, in the traditional world, 2 years to roll out an agent. In ours, it's a couple of weeks at best. So that immediate time-to-value allows us to provide -- have a pricing advantage, I think, over others because when you look at not just the price but the total cost to operationalize it, it's actually much lower than our competitors. And that's really what we focus on, better outcomes, better cost savings and overall less complexity in the environment.

Got it. So the endpoint really is just the insertion point, if you will. Ultimately, it's taking the telemetry from those endpoints and using that telemetry to stop breaches. That kind of segues into the next question around AI. Why do you think owning the endpoint enables you to equip your customers or defend your customers against this growing sort of threat opportunity as it relates to AI as well as what that means for CrowdStrike?

AI seems to be the new buzzword this year, right? So the good thing is we started that many, many years ago and really helped pioneer using AI to prevent security breaches. And we've obviously evaluated that over time. But when we think about AI, there's a couple of key components to it: one, you have to feed the right data into it. You think about ChatGPT. Without data, it doesn't do anything, right? So we've got over 7 trillion signals and events that we collect per week. It's actually probably more than that at this point. And it's really about taking the data and having it organized in a way that we can train the algorithms to get the best outcome. So from that perspective, we've been doing this a long time. We continue to add more capabilities there. And what's really important to realize is in order to stop these breaches, you do need a sophisticated level of AI. And you can't just depend on signatures. And you look at our competitors, whether it's a Microsoft or whether it's a McAfee or Symantec, they're all signature-based, right? That's primarily their defense mechanisms. So AI is a big component and having this data moat where not only do we collect data, because it's one thing to take a pile of data but it's actually organized via our Threat Graph in a way that allows us to effectively train on the information we get to get the best outcome.

How much of a telemetry would you say comes from the endpoint like today as far as the threat data you're collecting?

Well, we talk about the stats and we get trillions of events per week from the endpoint. So over 165 different countries. And again, it's one thing -- those are nice stats but it's really the fact the way it's organized with our Threat Graph. We've built a proprietary graph database that provides a temporal element to organizing the data. So we never lose the state of the data from the endpoint. So as -- it's not just a, hey, we collect a discrete piece of data and forward it into a data lake. It's actually all linked together. And this linking over time is really a key element to it. That's used to help stop breaches but it's also used to train the algorithms because we know the complete flow of what happened. So it's one thing to collect data. It's another thing to actually collect the right data in the right order to be able to get the right outcome.

Got it. So we like the emerging module growth. But I think some people sort of backing out the net new ARR from the emerging modules, did surmise that the net new ARR from the core endpoint, if you will, I guess, declined a little bit based on some estimates out there. So just level set on that. Is that related at all to maybe some of the headwinds that we're seeing in the PC market or otherwise?

No, I think it's more like we had a great -- we had a record Q3 with respect to our emerging products, right? And so when you carry that forward to the entire first half, it's -- if you're having a record ordinary emerging product, it's going to come from somewhere in your overall ARR ending balance. So that's how we really look at it, right? We have success in that emerging piece, right? So if you have a total number, something else is going to be not a record. And in Q3, we saw that in emerging markets. So we're really excited about that.

Great. I want to talk a little bit about the Dell partnership. This is a partnership that you were able to reengage with. How does that relationship work? Just maybe explain high level how the economics work around that?

Well, we're super excited about that. And I think you heard from the conference call, we've been focusing on going down-market into the SMB market. So what does that mean? I'm going to answer your question but I just want to put a little bit of context around it. We've started in the enterprise and we dominate in that area and we're not going to deviate from that. We've got 1/4 of the Global 2000. There's another 3/4 to go so that is not going to change. But the way the technology works, it's super easy to install and very effective. We can go all the way down-market to the smallest SMBs. And we've been working on things like Falcon Go, our trial to pay as well as our e-commerce engine, which we just have a new release that came out to remove a lot of the friction. One of the things I've done recently is, as we talked about last night at dinner, has hired Daniel Bernard from SentinelOne, who has done a great job in the past with the sort of relationships. And this is the third deal that he's actually done with Dell. So we were able to take a relationship that we had that was put on pause, after VMware bought Carbon Black. That relationship has now changed with Dell. We then inserted ourselves back in and now we have a great partnership. So what does that mean? There's really 4 key areas to the Dell partnership. First one is shipping on box, which is not really on box. It's an entitlement, right? So we can activate from the business computers, if you will, smallest SMBs to the largest enterprises. There is an area where Dell sellers will actually sell Falcon subscriptions and they get compensated. This is key as if it was a Dell product. There's no difference. This is huge. The third area is device-as-a-service. So you can actually -- instead of buying a PC, you can kind of rent it monthly. We're part of that bundle. And then the last piece is actually the managed service that we're a key component of. So we're just getting started in kind of reenergizing that relationship, and we're really excited about the future opportunity of it.

And Burt, that's not reflected in the guide whatsoever?

No, all gravy. It does take time, these relationships to develop, right? Flighting it both on the go-to-market as well as the tech and making sure it all works. So we're excited about the opportunity. It could be a meaningful part of our net new ARR in years to come but it does take time.

I think the key piece of that, and I know Burt is going to manage the number of elements and your answer but -- his answer to your question, but what's important to realize is Dell didn't pick anyone, right? They came back to CrowdStrike. Why? Because they had the best technology and the fact that their customers were asking for it.

Got it. So I think -- when I think about CrowdStrike sort of growth going forward, there's 2 ways you can go, very broad and attractive really large set of customers. And then you're also going deeper within that enterprise installed base with the emerging modules. I want to go a little bit on the broad side of the equation. So there's 175 million endpoints on Symantec or Symantec rather is on 175 million endpoints, I think 150 million-plus on Trend Micro. CrowdStrike, based on our estimates, has less than 50 million. When you think about going into the SMB where the ASPs are lower, how do you think about that impacting your margins?

Well, there's a couple of embedded pieces in that. First, we haven't given out how many endpoints we're on. So I'll just make sure that I...

The Morgan Stanley estimate.

Okay, it's a Morgan Stanley estimate. The second piece of that is as we think about ASPs because you go down-market, it doesn't mean your ASPs go lower. SMBs pay a lot of money and there's only a few of them that's at the highest price, right? So I think it might be a little bit of a misnomer that you're actually not going to -- from a price per endpoint, you won't get as much or more on the SMB market. Just pricing. Now in terms of raw dollars, that's going to be a smaller deal than a larger enterprise. So when we look at going down-market and we look at the ability to have no-touch models like our e-commerce engine or like a Dell or we talked about the 18,000 managed service customers we have, those are very efficient routes to market that we're going to continue to invest in. It's a big focus for me. It's a big focus for Daniel. And just to put it in perspective in terms of market opportunity, 18,000 managed service customers is fantastic, right? But if you put it in perspective, there are 50 million small businesses that have 5 to 250 endpoints, 5 to 250. So we're 18,000 customers of 50 million. It's crazy. So from that standpoint, we do think it is a very effective and highly leveraged route to market in what we're putting together.

Got it. Maybe shifting to the emerging modules. So on the earnings call, you talked about a big win with a financial services customer, I think, on LogScale. I think that was also a replacement with -- of an incumbent. How much was that customer paying on the incumbent? And can you give us a rough sense of how much they're paying CrowdStrike?

Yes. So that -- I'll do the best I can to try to answer your question with probably not everything that you want. But when we think about what it was, it was a shift of spend and a reduction of overall cost. So the incumbent is still there but they were paying a lot of money for that and they were tired of the fees they were paying. They're still paying it, not at that level. And they wanted to get the right performance. So what we were able to do is put LogScale in and they battle-tested it, 40 terabytes a day. They were able to get sub-second results in our product versus 2-day results, it literally took 2 days for a query to come back in the other product. So, a, let's start with better outcomes. The second piece is because this data was flowing into CrowdStrike, and by the way, it was this CrowdStrike Falcon data, they then reduced their overall spend with the other vendor. Now the other vendor's still there but their overall spend is down. And the opportunity for us is we started with just CrowdStrike data. The next opportunity is to take all of the security data and then from there to move into the IT and the ops function. So for us, it was a great way to run side by side. And similar to the way we actually started CrowdStrike, when we first got on the endpoints, we didn't say just take out McAfee and Symantec. We said, "Hey, run it side by side." And we have a great opportunity over time to be able to replace a lot of those other functions in that spend.

I did go off-script with that question. Sorry, Maria. The other one I wanted to talk a little bit about was identity protection. So you bought this company, Preempt, a couple of years ago. About a little under $7 million of ARR and you surpassed $100 million of ARR in that identity protection module. How is that different relative to the traditional IEM companies out there like an Okta? And how big do you think that business can be for CrowdStrike?

It's a great question, one I really want to make sure that everybody's heads up on so I can go through what it all means because you get a lot of this. So let's level set on identity. So there's really 3 key areas of identity. First is to create the identity. So you've got something like Active Directory, create identities. Well, if one identity is good, why isn't 20? So we have 20 identities for all these different services that are out there. Now I have 20 identities, it's a nightmare. Now I need a single sign-on. I've got Okta thing, right? So you need to consolidate the identity you create, you consolidate. And then the third area is you actually protect. We are in the third area. That's why it's different from the first 2. We're not creating the identity. We're not consolidating the identity. We're protecting the identity. And when we look at that, it's very differentiated. Why? Because it's in the category of identity threat detection and prevention because we give deep visibility into the directory services and where we protect the credential from being abused. We have a whole AI layer on top of it, which prevents things like lateral movement in an environment and the spread of ransomware. That has been very effective for us, and you've seen the -- it was less than 7 when we got it, now it's over 100. And by the way, there's a whole bunch of months we didn't sell it as we were integrating the agent. So we really just hit the gas a few quarters ago, right? So think about that. Why is it effective? Because the most valuable real estate and in the state is the domain controller. We're on it, and it's a matter of just flipping an entitlement to be able to implement our solution.

Got it. A couple more questions, and then I want to open up the audience for Q&A. Cloud security, I think your public cloud deployment ARR surpassed $200 million this quarter. There's been a lot of debate around whether an agent-based approach is the best for securing cloud workloads or if it's agent list because you get more coverage and faster deployments. And level set that conversation for us. Why do you think CrowdStrike's approach is better?

I think it's very simple. If you buy in the philosophy that you actually have to prevent breaches, you're never going to do that with an agentless approach. It's a compliance and reporting tool. There's -- you're not in line in the past. So you've now reported. You have a problem and you've reported that you might have had a breach. Okay. Having an agentless approach is important. And by the way, we have both. So the real power in our cloud security is the fact that we combine agentless with agent cloud workload protection. So when you hear agentless, you can think about reporting and compliance. And when you hear cloud workload protection, you can think about prevention capabilities. You're going to need both. And I think this has been validated in the market that you need both. And the good news is this is something that we've been building and have talked about over the last 18 months. So it's not one or the other, but you have to look at what you're going to use each one for in the overall outcome. And the ability with 1 SKU to be able to combine both of those, we think, is a winning formula, which is what we have.

Got it. Burt, question for you. Just on the free cash flow margin, so CrowdStrike always had really good profitability. But the free cash flow margins does include some amount of multiyear billings. In this environment, it seems like customers want to pay less upfront for the most part. So I guess a 2-part question. One is, does CrowdStrike incentivize upfront payments? And two, how do you get comfortability in sustaining 30% free cash flow margin when there could be that duration risk, if you will?

Yes. So one, we don't incent payments upfront. So there's no discount for, let's say, a 3-year deal and pay it all upfront. So we don't discount that. And in terms of how we get comfortable on the -- and what I talked about in our 30% free cash flow margin, a lot of it is driven by the leverage in the model. That's going to go to the bottom. And so for us, we talked about leverage for this year in terms of my last guidance. And I reiterated our 30% free cash flow margin, and that's how we got comfortable more than anything else.

Got it. Let's not forget the 3% to 4% coupon, right, on the cash? Any questions from the audience? Got 1 over here.

Maybe just a question about R&D priorities. I've noticed you've increased in the last quarter, and I guess, just investing in emerging modules. How do you kind of think about balancing that and kind of eventually going to gain leverage to reach your medium-term operating margin targets?

I'll talk about the number and then George can talk about -- so yes, the big picture on R&D is that we are -- we take a look at the full year, we're under -- we're actually in our long-term target model. We're at the higher end, which is okay. We think that spend in R&D that we got to stay ahead of the innovation curve. That's what technology companies -- successful technology companies do. It's really hard to bring in great talent engineers and making them productive. We're really happy of where we ended. I'll turn it over to George in terms of what he thinks his priorities are.

Yes. I think just to follow on with the macro part of the question, we're an innovation company. We're not an aggregator. We're an innovator. And I think that's really important. We've -- a lot of the things that we talk about today, we invented, and Gartner gave a different name to it or a new name to it. So -- which is fine. But when you think about areas of investment, well, we bought LogScale. Well, we've got to invest in it and we got to scale it up, right? We bought other technologies in the Falcon service technology. We got to invest in it. We have XDR. XDR is a multiyear journey. It's not just a product, right? It's a philosophy, and it's something that we've been focused on for many years but you have to invest in it. So we're in line with Burt's model. And overall, we need to come into the year with enough ramp capacity in areas like cloud as well. There's a lot more to do in cloud so that we can hit the overall product goals that we have. But I think, as Burt said, we're in line with his overall model.

Any other questions? Okay. I want to talk a little bit about capital allocation. So CrowdStrike has, I think, a little over $2 billion in net cash now. How do you think about the use of that cash? What are the main priorities?

Yes. So first of all, we're -- in terms of what we saw the other day with more interest rate hikes, we did a bond and making more money on the bond than we're paying, so that's pretty good. But then generally, though, we really think that there's going to be a real opportunity in the private markets in the near to midterm future. And as private companies look and see what their opportunities are, potentially joining CrowdStrike could be a really good one. And we want to be there to be able to take advantage of that.

In terms of M&A, just your thoughts on build versus buy. I mean, you've been largely an organic company. Are we thinking about sort of tuck-in type acquisitions like Preempt or Reposify or would you be open to something larger if it made sense?

I think we stick to what we really like and what's worked and we love great teams. We love great technologies, and it's even better if they have no go-to-market because we don't have to pay for that. So if you look at those acquisitions, they've all been great teams, all been great technologies. And as soon as we've got them into the CrowdStrike machine on the technology side as well as the sales machine, we've seen these all go up. And I think that's a winning formula. We're always looking at the best players that are out there, but we kind of like that model. And we certainly think that the environment is going to be even better for that as private companies go to market looking for next rounds and things of that nature. We've already seen sort of expectations soften up a bit in the private market. So that's probably where we'll remain focused.

Got it. You brought up Daniel Bernard. One of the things that I think he's been doing is really accelerating CrowdStrike momentum in the channel, it sounds like, particularly down-market. So talk a little bit about the leverage that you're looking to get from MSSPs. And how do you think that can really accelerate your net retention rate, in particular, as they're allowed to sell more and more modules?

MSSPs is a key route to market for us. As we said, we gave out the number, but there's a lot more to go. And part of bringing Daniel on board, he's a seasoned expert in that market, and we've been spending a lot of time together in managed service providers and other channel partners and really focused on, okay, we're spending a lot of money with them. They're bringing us a lot of money. How do we dramatically upsize the business with each of these key partners? And there's a level of focus in this area that we've never had before. I've actually broken it out from the sales organization and created that Chief Business Officer role so that we can really get the leverage that we want in the model. So I'm really excited about it. And I think what we have done and what we will do in the managed service market is incredibly important to our future success.

Yes. And then also the e-commerce channel, that's been an important driver and also very low-touch type sale. Burt, what are the generally high level, what the margins look like there? And how big is that business for CrowdStrike?

Look, it's a really important business for us. We took a look at it last thing and what they did and George is close with some of the folks over there to take the learnings and make it really efficient. So I look to that as one of those areas where it's going to continue to help us with our unit economics as well as volume, right, to come into that, swipe the card, off you go with our tech. That's pretty compelling. George and I like to talk about the fact that we're selling while we sleep. That's an engine that's going to allow that to happen.

And for me, a big part of that was to just look, what's been successful? And for me, I wanted to take a lasting e-commerce engine like and combine that with a SolarWinds inside sales force, right, to be able to go to market. So what's the proof point of that? We've had customers come in, swipe a credit card for $2,000 and great to have an AV product, okay? So that automatically goes into our inside sales team and we're saying, okay, what outcome are you looking for? Do you have enough people? Do you have a compliance mandate? And that $2,000 transaction -- this is one of many, by the way, but that $2,000 transaction left the building 2 weeks later at an additional $40,000. So a total of $42,000 that they actually spent because we upsold them the Falcon Complete, again, a very differentiated service offering. And they could never replicate what we're doing for $40,000 if they try to hire the people to do it.

Got it. Last question for me just on federal. So I think you mentioned CrowdStrike has 40 U.S. government agencies -- excuse me, 40 of the U.S. state governments or customers. Federal activity has been picking up quite a bit over last year. There's been a lot of initiatives from the Biden administration. Just talk a little bit about your pipeline there and what the opportunity do you see.

Yes. In fact, I was just there probably a month ago. It's a robust business for us. We've got the big CISA win. We've got a handful of agencies out of the 100 that are there. And that gives us, obviously, a license to hunt. And I think the validation that CISA brings to us is really important because I mean, they looked at everything that was out there and chose us as being the best technology. So that's an ongoing effort. You've got to fight everything from just kind of inertia within some of these organizations to continuing budget resolutions. And that takes time. But over time, we have the ability to continue to replace the incumbents that are out there. And that really has been the focus.

All right. Great. With that, I have about 3 seconds left so I'll give you some time back. Thank you so much, George and Burt, and thank you everyone for coming.

Thank you so much.

Thanks so much.