CrowdStrike Holdings, Inc. (CRWD) Earnings Call Transcript & Summary

And welcome to this critical session here at Davos 2025, the 55th year of the World Economic Forum. Crisis to Confidence in Cyberspace, that's the mission of the 45 minutes we have together. I'm John Defterios. I'm a senior fellow here at the World Economic Forum. I'm a professor of business at NYU Abu Dhabi, and I spent my last 10 years of my time as a correspondent with CNN as Emerging Markets Editor based in Abu Dhabi and the connectivity we see from the Gulf here to Europe, United States and obviously, Asia. We want to welcome our viewers on the live stream here who are watching. This is an excellent session because in the last 2 years of the Global Risk Report for the World Economic Forum, we've seen that cybersecurity and cyber threats rank either 4 or 5 in the world, rightly so. But I would say, as a former journalist, it doesn't earn its fair share unless there's a crisis that happens. We kind of think it's business as usual. Companies are ready to respond, but with the on-take of artificial intelligence now and then over the next decade and then phasing into quantum computing, it's going to be more of our common vernacular, and I don't think the world is ready for that, and we want to address what it means. But at the center of our discussion today is not only dealing with cyber threats, but it's also the impact that cyber threat does have and then obviously, what impact it has potentially on a brand and reputation going forward. I want to thank the team that runs cybersecurity at the World Economic Forum. I've had a chance to work with them for the last 2 years. They hold an annual gathering for themselves in November. They've put out an outlook report in the last week, and we'll make reference to it here in the discussion. If you'd like to do social media and provide some feedback here on this session, the hashtag is WEF25, and we're going to be taking questions from the floor about 15 minutes out. We invite those watching us on the live stream to do the same. Let me welcome George Kurtz. He's the Chief Executive Officer and Founder of CrowdStrike Inc. Welcome to you. Oyku Isik is a professor of Digital Strategy and Cybersecurity at IMD Business School. She focuses not only on the response by leaders in the cyber space and technology, but also the impact it has on brands. So it's great to have you. And George Oliver, Chairman and Chief Executive Officer of Johnson Controls. The two of you, G1 and G2, as we said in our pre-meetings, have dealt with different incursions, and they've learned a lot through that exercise. I'm going to ask them about it, but also they can share their leadership and what was required after having a cyber threat. And Oyku, it would be great to have you weigh in on what it takes to be a leader today and how much should be devoted in terms of time and attention to cyber, and then what impact it does have on a brand. I think it's a phenomenal topic that they've undertaken here. To provide some context, we have a cyber report that was put out in the last week here for the World Economic Forum, and they also did polling from that cybersecurity gathering that they had at the end of 2024, which I'll make reference to for those watching on the stream and here -- and live in the audience. I want to reference a recent report from the World Economic Forum in collaboration with the University of Oxford. It defines cyber resilience as the organization's ability to minimize the impact of significant cyber incidents on its primary goals and objectives. So if we can bring that graphic up here. And what we're looking at here is the incident, absorbing it as a chief executive or as a company and then the recovery. You can see that the recovery stretches out almost on a flat line here. What we're looking for and what I'd love to glean from the panel is like that V-shaped recovery, the preparedness, the resilience that you try to build into an organization here. And I made reference to the Global Cybersecurity Outlook report in 2025. It was just released last week. Supply chain interdependencies represent the greatest challenge. The report identified 6 components, and if we can bring that up on the screen, please, that companies need to contend with in this world of cyber complexity; geopolitical tensions, which are on the rise, and we heard from the European Union President today talking about this fractured world and how to respond; cybercrime sophistication and many actors in play here; supply chain interdependencies, I've made reference to that initial survey; regulatory requirements, AI and emerging tech, which I talked about in my opening comments; cyber skills gap, which I think is interesting. Only 13% of companies feel like they have the right cyber skills internally. There's a shortage of talent worldwide. Women in cyber is a big issue, which I think Oyku could address. And then 33%, 1/3 of the company said cyber espionage and a loss of IP as their top concerns. I made reference to the fact that both CrowdStrike and Johnson Controls had cyber incidents. So I think it's excellent that you're willing to come on the stage and talk about it.

So George, as a CEO, take us through it. So what would like to manage something that hits a company that has a very good reputation? Did the scale of the incursion surprise you? And then how did you deal with it as a CEO? And how did your organization respond and look at you and say, what do we do next?

Yes. So first, great to be here. Just to maybe reframe it, we didn't have an incursion, we had an outage. So July 19 was an interesting day, I guess, for us and the rest of the world, as you might imagine. And when something like this happens, you have to go back to your muscle memory, right? And we actually do work with a lot of companies that have cyber intrusions, and we have that muscle memory. So we activated our crisis response team. We knew what the issue was. We were able to roll back the issue really within probably 70 minutes, but there's complexities in the operating systems to be able to recover some of those systems, therefore, you had a much bigger outage. So once that was unfolding, then you kind of see the scale of it. And part of the challenge, I'm not sure everyone sort of remembers or has a good appreciation, but there was another technology outage, a different company that had an outage at the same time. So what we needed to do was we needed to deconflict what was our issue, which we know how it happened, and we rolled it back. And we had to deconflict that from what was happening with another service provider, right? Because all you hear is outage, so what's ours, what's theirs. In any event, we couldn't control that piece, but what we wanted to do was to be front and center. And there were 2 things that really came to mind. Number one, first, was the customer, putting the customer first. You can see the scale of our customer base, right? We wanted to make sure that we got to our customers, we were working with them to roll it back, and there's things that we did to automate the rollback for them. But just the complexities of the operating system, there were manual things that had to take place as part of that. We needed to be able to get out and educate and tell people what it was they needed to do. And the hard part is some of it required physical interaction. So you had to have key strokes and people have to type things in. And there's a lot that went into it, even though it was a relatively simple set of commands for people that don't understand what -- how to do that, it takes time, but you have to get that information out. So one of the key things for me was take care of the customers. And the second piece, as this was unfolding is, we needed to let the world know this wasn't a cyber attack because people didn't know, right? And this is where I basically said, "Look, I've got to get on TV." And this is within a few hours.

Even though people don't watch TV anymore, that's part of the challenge.

We needed to be on the TV. Well, first thing we did was we got on Twitter.

Yes, there you go.

And we announced it. And then we had continuous updates, right? And this is -- this sometimes can be hard because you've got teams of lawyers, teams of PR people, teams -- you go on and on as a big company, right? And you have to make a decision. And it's not easy in the first few hours without having all of the facts, and it's a bit of the fog of what's happening, again, what's ours, what's theirs, how do we make sure we get the right message out. But for me, it was really important to be able to get the message out. It wasn't a cyber attack. We knew what the incident was. We rolled it back very quickly, and then we were in the recovery mode working with customers. And I think that really helped to settle a lot of folks down. And then the heavy lifting of making sure that we can bring systems back online was an ongoing effort.

I'm going to circle back about your leadership because I want to bring in G2, as we said here. George Oliver, am I correct in saying you're going to retire pretty soon? What a way to go out, right? Because you had a very big cyber crisis. Is that the first major crisis you dealt with at Johnson? And then -- and I'd love to get the other George's input on this. As the CEO, like what's the first thought that goes through your mind when you get hit that hard? And I'd love to get Oyku's view on leadership, and how do you prepare for a new era of a challenge that probably wasn't in our vernacular 10 years ago?

So I think it would be helpful to talk a little bit about Johnson Controls, so you get an idea of what our infrastructure is like and the journey that we've been on. So at Johnson Controls, we're about $28 billion globally. We operate in 100-plus countries. We're very distributed. And we're a company that has been made up of a lot of acquisitions with a lot of multiple systems that have come together into one. And so we've been on a journey on how do we take all of those systems streamline, get to one ERP, get to one operating system with similar type systems deployed. And we've been on a journey, and cybersecurity has been a key element of that. So as we're addressing technical debt, how do we make sure that when we look at our infrastructure, we have over 100,000 devices, 100,000 users and hundreds of thousands of applications? And so just to give a simple lesson, it's all about response. It's sensing at the device level. It's understanding access and understanding where the people that are coming into your network, where they're operating and then it's about applications and access to applications. So we're -- all of that was being built and making sure that we're resilient. So when we had the incident or the -- there's always incidents, and they're typically managed and contained. It's all about response. It's sensing and response no matter what level the incident is. And you'll find that whether it'd be a device or whether it'd be where someone's user credentials got compromised, there's going to be events. It's the ability to be able to sense and respond. So we did get an attack, and we're able to respond pretty quickly. It did impact some of our network. And what I would say the most important thing is being -- is planning for what is -- in the event that -- if you do have an event, not only from a technical standpoint, what's the response. But from a leadership standpoint, how do you respond? And what are your business continuity plans? And so immediately, it was on a weekend, you get notified that some of our systems were compromised and then you go to work. And it's easy to kind of try to self -- do a self-assessment or you can stand up and lead. And so that day, we had our full extended leadership team across the globe activated, really assessing to make sure we understood exactly what was compromised, what is our plan. And the -- as we work through that, we continued to operate. And so we continued to stay focused on customers. The other thing is this idea of as you -- as George said, as you learn, you'll maintain transparency with your constituents because that's -- from a trust and respect and maintaining relationships is important. So right from the Board to customers and making sure that as you're working with customers, you're keeping them informed relative to now where we are relative to being able to continue to support them with critical services. We're a building solutions company. So we do a lot of service, maintaining our customers' environment on a real-time basis. So that's important. So that really played out well for us. And then we sit up our leadership team on a daily basis and also engage partners. So when you have a lot of technology like we do deployed, we maintain strong relationships with all of our partners. And so we not only activated our internal team and leadership with our business continuity, but also engaged all of our technology partners to make sure that we: number one, understood and assess the incident and making sure that then we were working together to be able to effectively address it on -- what I would say on the critical path to make sure that we're positioned with speed to be able to mitigate the risk and ultimately, continue to operate. That's what we did. So I was extremely proud of -- it was a -- what I would say is -- and then we can talk a little bit more about this in the discussion, that cybersecurity is going to be part of the culture, and it's going to be embedded in everyone's behavior.

For every company, would you suggest? Because you're a very connected company, obviously, CrowdStrike is the same...

When you go through -- because you always are training and you're always putting together processes so that you mitigate any risk and any exceptions. But as you get into any type of incident, you understand, okay, was it a device? Was it a user credential? Was it access that wasn't -- once you get into, then you make sure that you create redundancies and then automation and the work that we're doing with CrowdStrike is a lot of the sensing and then the automation, then you have intelligence not only from a device, but from a user standpoint. And then you can -- it's all about response. When you see something that's not right, how do you then respond? So part of that was when you go through this, then every leader in the company becomes an expert because not only are they -- they're involved previously, but really getting to that level of detail. And we have 100,000 colleagues across the globe, then from a leadership standpoint, making sure that they're totally aligned and behaving with their actions, whether it be their access or how they're using devices, so that they are ultimately making sure that all of the securities that we have in place are being fully consumed and put to work. And so for us, it was -- as we look back, it was a test of our culture, our ability to be able to respond and activate a global team and really continue to be able to operate the company, while we're mitigating the incident and ultimately, getting back to full operation. So I was extremely proud of the team, and really a lot of our partners stood up with us to make sure that every step of the way they were playing their role in supporting us to mitigate what we saw as being the contributing factors.

Okay. You raised a great point. It's a great leaving=off point to Oyku. First, can you spend 10 seconds to tell the audience what your specialty is because it will help us in terms of the context of your research, Oyku?

Yes, of course. As a professor of IMD Business School, we actually exclusively do executive education. So first of all, it's a privilege to listen to two leaders talking about their experiences. This is what really makes a big difference. And my research is really on about chief information security officers and behaviors of organizations when it comes to dealing with cyber attacks.

Perfect. Okay. Good. We have this case, where could have a prisoner's dilemma because you're in the game together, right? And you have this trust built up and then you face a strike, and then that cohort starts to look at you and say, "Okay, I put all my trust in you and there was a failure." And then there could be panic from that partner, or as George was explaining, everybody rallied to the cause. So what does your recent research advise future-looking CEOs? Because we know that threats are rising, and we'll get into this discussion about the developed and the developing world, right, and those vulnerabilities a little bit later. But -- and also that brand narrative that I addressed in my opening comments about rebuilding trust very quickly during an incident because we want that V-shape to rise quickly. Go ahead.

I love that visualization, the V-shape, and we talked about [ shrinking the V ], right?

Pretty good team that we work with.

Exactly. Exactly. And there are 2 things that George talked about the muscle memory. I love that as a reference because that only happens if you think detailed enough of scenarios and if you practice enough, right? And George talked about how it's part of the culture and how quickly you were able to continue working, right, servicing your customers. So first half of that V, absorbing the incident. That's a great example of that. So you were prepared, the culture was there, so you were able to -- despite the incident, were able to operate. And the other one, the significant part of the resilience, is that we actually can practice this enough so that we can, after absorbing, recover from the experience. So I think there were 2 really good examples of long-term thinking, and answering your question, the necessary shift from more traditional, short-term cybersecurity thinking to a long-term resilience building thinking is, I think, with these 2 examples is greatly represented here.

Good. But who would have thought 5 years ago that the brand would suffer if you don't respond? I mean George was saying, "Look, I was ready to communicate." Both of you said, "I had to communicate to my partners, my customers." And then you had to say, "I need to get ahead of the curve here." Go ahead, Oyku.

Because -- you talk about trust, right? How do we build trust? And the first question that comes to mind, especially -- there are, of course, anecdotes we can learn from when it comes to doing research. It all comes down to, how do I quantify trust? What you mean trust? Is it the financial health of the organization? Or are we talking about finding your way to measure the reputation of the organization? What we know from -- if we look at trust from financial health perspective, to be honest, we don't know much. We only have very little research on this because it's very difficult to collect reliable data at large scale to really understand, and the research are all over the place. But when you look at trust from a reputation perspective, then we know for sure. Minor incidents -- we tend to actually forget, organizations do recover from minor incidents relatively quickly with minimal stock value impact. But for major incidents, we do have evidence that it really takes quite a bit of time to recover back. But I want to add something here that most people don't think about, which ties back to preparation, is that what type of incidents we're talking about makes a difference, and we know this from research. So if it's an internal cyber threat, in the perspective, the trust on the organization really decreases. If this is an external threat, there's a threat actor, then really it is less of a trust issue on the services of the organization.

Excellent.

If it's negligence, then the question arises around the culture of the organization, for instance.

Good. Both of your comments led me to believe if you had to do this again, what would you have done differently? And there's always that question that comes up because you have businesses that need to sell cyber safety and security and fortifications. And when do you know you have the right tools? Go ahead, George.

Well, you never want to be in a position, but you have to prepare for it, right? And this is what we're talking about. We help a lot of companies go through incidents, and we drill ourselves. And this particular one, it's hard to put this in the playbook of what happens, right? But we used the same, again, muscle memory to be able to roll things out and activate our teams. I think as you go through any of these, there's always areas where you can pick at and go, "Okay, we could have done that better or we could have communicated this." Or you come up with various scenarios. But I think, by and large, something like this, in any incident, if you are upfront, if you're transparent, if you communicate not only one time but frequently, and this was a big part of our response was we immediately said internally and then we've said externally, "We will tell everyone as much as we know as soon as we know it." And basically, we had a whole portal that we stood up, right? And then as we knew things, you just went to the portal and you got updated, right? So I think that really served us well. And what I would...

Has the business been hurt as a result of it? Now would you say the CrowdStrike brand suffered?

I think the trust is even up more. I mean I've -- walking around Davos, I run into CEOs of many of our companies, and they say -- I had one organization say, "We actually use CrowdStrike in our [indiscernible] as a prototype for how you should respond." It was just last night. So I think, again, everyone's going to have their own opinion, but I think our customers have looked at it. And I think anyone in business or IT realizes things happen, and it's really how you respond. And we want to be known for our response to this, not necessarily the incident that actually happened. So that's the way we would look at it. And again, could we do things better? I'm sure. But I think overall, with trust and transparency and communication, we did the best we could with what we had in front of us.

Oyku?

May I quickly add here?

Yes, of course. Yes.

Because we really do know that during the incident, communication is the biggest differentiator. And being transparent, honest and owning up to it does make a big positive impact on the image of the organization. But I wonder what you think about the possibility that in your case, product stickiness and vendor lock-in, how much that play in, right? Clearly, for smaller organizations, this may lead to customers leaving, but I wonder if you -- if there was a way for you to kind of measure the impact of that?

Oyku, that's a great question. We are going to look at the vulnerabilities of SMEs in our next round, so I'm glad you brought it up. Go ahead, George.

Yes. I think when you look at this, I mean, we're a public company, we've talked about our retention rates, right? They're 97-plus, which is fantastic. So even after the incident, I think when you -- to your point about the product and the stickiness, I mean the good news is we've got the best product in the market. So customers like it. And I'll just tell you a quick story with a customer, who is a large financial services company, went through what happened, why it happened and why it won't happen again. And they said, "Look, you've got 10 years of trust deposits in the bank, 10 years of trust deposits. And on the 19th, you had a withdrawal. But net, you're positive. Net, you're way positive.

That was nice of a financial services company to say it. [indiscernible].

But they went to -- this system went to the Board and said, "If it wasn't for CrowdStrike, they recovered pretty quickly. If it wasn't for CrowdStrike of 10 years of protecting them, it would be a much different story." And this is, again, building trust over time. And I think that has really helped us out with a great product.

Right. We're -- I don't want to get into Midwestern values, but the company is based in Milwaukee, Wisconsin and very -- and for those who knows -- know America, that's where they value it. I'm from the West Coast, so it's a little bit different mindset of like blue sky thinking.

I would like to contribute to the last question about the 2 things that come to my mind because we -- cybersecurity, of course, is a top priority across all companies. And then it's more about how is that then built into your operating system so that all of the key metrics, response times, if there's any exceptions around sensing of devices or any as far as the strategy around user access, really, the CEO, at least should understand that. I mean understanding what their network is, how that's configured. And then from a cybersecurity metric, they should be embedded in their operating metrics across the company. And that allows every leader to really understand how they lead cybersecurity, right? Typically, I think historically, it's been more of an IT type metric. So I would say: number one, making that front and center, really understanding your infrastructure and network, how that's made up with devices, users, applications. And then the whole strategy is sensing and then reacting when there is anything unusual in the most simplest form. And the second is, and I think this is where George comes in, George 1 comes in, I purposely -- and I'm an engineer, so I can consume technology and we're going through all of the reviews and felt that we had all of the best technologies and capabilities deployed. What I learned was the technology development is so rapid, and now with the threats being much more sophisticated because of AI and other capabilities, that being first on the state of the industry. And so I spent time with a number of other CEOs in the cybersecurity to make sure that I fully understood as far as our -- the work that we have done to build our security, I understood then how does that compare to what you'd consider the next-generation kind of best-in-class. And I think that's helped the organization so that as we're prioritizing where we're now deploying resources and the like, it's, I think, pretty clear that everyone know why we're doing what and when.

Okay. And my question on values, what did you learn about the values of your organization during the crisis?