CrowdStrike Holdings, Inc. (CRWD) Earnings Call Transcript & Summary

For those of us who have been at the conference for the last couple of days. The number of thought leaders in AI on this stage, you have talked about cyber security. We're pretty much batting 10 out of 10. So really excited to have George Kurtz, CEO and Co-Founder of CrowdStrike on stage with me. George, thank you for being here.

Great to be here.

George, I want to start off with some of the most exciting announcements at Falcon from last week because as far as industry conferences go, the combination of having Jensen, but leaders from Entropic, OpenAI, all of the enterprise customers in one place along with, I think it was 11,000 customers. Was really a different level of confidence than what we've seen before. And I want to start with one very specific announcement that you announced, which was SafeMind. So to bring the audience up to speed, SafeMind is crowd strike taking Nemotron and applying it to very specific proprietary CrowdStrike data to create a continuous penetration testing loop. George, maybe I'll turn it over to you, tell us a little bit about the evolution of this idea and why it's important.

Sure. So it was a fantastic event. We had over 10,000 customers became really an industry conference, and we were lucky enough to have Jensen and Lip-Bu Tan and Brockman here and others. So it was great from that standpoint. I think when you look at SafeMind, it goes well beyond the models, right? We think about it as really an agent system, which consists of the models in the harness. It's very important to put those together. And if I was to distill it down into 3 areas, you have a red model, which is the offensive model, Red Tempest, and you have a blue model, Blue Solano, which is our defensive model, and then you have a harness that works in combination with that. So I would say, I don't know, maybe 6-plus months ago, I sat down with Jensen and we were talking about security and really the conversation was we need to do something to provide defenders with what they were lacking and give them sort of a fighting shot in the agentic world that we live in today. So they're great partners. And part of what we did was we started the cybersecurity Super Intelligence Lab led by Bartley Richardson, who came from NVIDIA. So that kind of helped. And the whole idea was how do we work in tandem with NVIDIA to leverage the Nemotron models, use multiple ones, but Nemotron Ultra 3 and basically create something that was bespoke for CrowdStrike and its rich data set and its history of collecting all this data. But the whole idea, just to summarize, and we'll get back to the questions here is, with the harness and with the red and the blue models, you have this continuous loop where the defense is always learning from the offense. And one of the things in Jensen was insisting on it, which was like we need to have a digital twin because we talked about all of the other areas in technology driving and robotics that have digital twins so that we can very quickly simulate this environment. So we can run in the digital twin or it can run in the real world.

I want to put 2 potential bottlenecks in front of you on SafeMind adoption going exponential. The first is CSOs are a pretty conservative bunch, and we've been talking about automating the stock for a very long time, and it's still like pulling teeth. How you get CSO comfortable with something as important as pen testing being automated in a continuously?

Well I think it starts with like we already know the -- we're on the system. So we already know what the systems are. We already know the identities. We already know the exposures, the passes vulnerability management aspect of it. And we built an incredible digital twin, sometimes you call with digital cousin, everything is not exact. But basically, it allows us to very quickly simulate what that environment looks like. And I think that's the first part in getting people comfortable with the sort of technology. Now if you want to leverage this internally or you want to leverage it externally and you want to just consume the models directly, you're going to be able to do that for companies that are part of trusted access program, but within the technology itself. There'll be some guardrails around it, but the digital twin will serve as a way to really very quickly cumulate what could happen. And that's very exciting and important for customers.

The other pushback that we've heard just in the last week or so is, okay, well, if you look at the publicly available Nemotron benchmarks, they're not on the frontier. And so there is a progression that will happen over time here. But why does that not matter for CrowdStrike to have an incredibly performance, frontier model solution or a cyber frontier mode?

We're not trying to solve the Millennium like math problems, right? So what we're trying to solve is the hardest security problems and Nemotron is very good for our purposes. And the key, as I mentioned, is the training, the data, but the model -- the harness. So even if you take our harness and you apply it to any of the frontier models, we actually get better results. So when you put those in combination and you actually spend the time to do the training and really adjust it for what we wanted, you get fantastic results for the security use case. And I think you've been a big proponent of these sort of verticalized take models that you've written about in the past. And I think there -- there's a lot of opportunity. Open weight, I think, is really part of the future. Now for customers that all have choice. We've got partnerships. I know we'll talk about with Anthropic and OpenAI. That will be available through the platform. You want to use our model is fantastic. But you can consume it through our harness or you can consume it through MCP, but obviously, we've got a monetization strategy around tokens to be able to do that. So if you look at the benchmarks that we put out, we haven't tested against Astra, but we were getting as good or better performance for a much, much lower price. What we talked about was a remediation in the Frontier model was about $10 for that remediation activity. And in ours, it was $0.03 with the same results because of the way we've built it and the way we can operate it. So I do think Open weight will have a massive impact on the entire AI industry. And one of the reasons why we're proponents and I know Jensen was up here earlier. But when he came to our conference, he basically said, like we are the poster child for why they built Nemotron and sort of the partnership with NVIDIA to get it to the place. I mean, we shortcut a lot of time because of the relationships and understanding how their models work where we didn't have to figure it all out from scratch they provided what we needed.

Jensen earlier, he was incredibly bullish on the CrowdStrike opportunity. The one other thing he said that I want to pick your brain on is, he talked about the commercial opportunity for Frontier Labs in security. And I know that, that can be via partnership, as you just alluded to, how do you think about the risk that the Frontier model slimline converges with the security sibling over the medium term?

Well, there's always going to be a role. And I think you have to look at where these models are really good. And where it all kind of interplays with security. So first, when you look at these models, I mean, they've come a long way, they're incredible just from January to where we are today and what they can do. And the -- there will always be a role and success for both Frontier and for companies like CrowdStrike. I had dinner with Marco, your CIO at Goldman last night, a very, very sharp guy. I think you might have been around on stage, I'm not sure, but incredibly sharp. And we talked about kind of the rules and being a Formula One guy, he sort of said, "Look, if I need Formula One sort of results in the most critical areas of alpha, and I don't care about the money I spend, I'm going to go to the frontier, but his comment was, for all the other things, I'm going to leverage these sort of open weight models." And that makes a lot of sense to me. So when you look at Frontier labs and again, they're partners of ours. They're very good at obviously finding the sort of -- if they can write code they could understand vulnerabilities and they can create patches. But -- and they can sift through lots of data. But these things are not in line, and they're not taking action in real time. So while there's a tremendous amount of benefit, there is a massive opportunity for companies like CrowdStrike who have all the data. We're the system of record. We're in line. We're a net data creator $7 trillion events per day. And all of the models that we train on our data, there is no edit CrowdStrike security data that somebody can just train on. And I think working together and giving customers choice is a great outcome.

There's one other architectural question that I think is relevant here. So when you and the team founded CrowdStrike 10-plus years ago now. There was an architectural change in end point such that the incumbents endpoint, when they try to address it, they sort of really struggled. And CrowdStrike was able to out innovate with next-generation ADR and all of the modules have followed. How do you think about the risk that AI creates an architectural shift such that all of the domain experience of the last 10-plus years is not the same domain experience that can be applied to the next one?

I actually think it becomes even more important because it starts with the data. You don't have a AI without the training data, like period, right? So if you train it on garbage or your synthetic data is not where it needs to be, you're going to get substandard outcomes. So when we think about these architectural shifts, it actually plays into our hands because we have all this data. And sometimes, the one thing it's better to be lucky than good. We actually had annotated this data for the last 10 years. We started doing this before there was Gen AI. And that data is basically in a format for the most part, and there's always curation we have to do, that it was incredible for training. So that creates a mode, this data mode that we have creates a barrier for, I think, others, and it plays into our hands in terms of this inflection point. that we see in AI today. And we see the results of it based upon what we've just built. The good news is we are an AI company from the beginning. It started machine learning. And obviously, now we've got many opportunities in front of us with a genetic AI.

I know it's only being a handful of business days and all of the products released at Falcon. And the reality is you wouldn't have put these types of products in front of customers if you didn't think they were going to be hugely popular. My question to you is, what surprised you in the feedback? And is there anything -- whether us that came down the pipe that made you think cut, that should really be on the product road map?

Well, we'll take Guardian as an example. This is one that I announced and we shipped that day. And from a Guardian perspective, this is really falls under the category of AI VR, AI detection and response. And what that means is we've basically moved from sort of just EDR of protecting a human in a computer or a cloud workload to protecting the agent, everything the agent does, everything the agent touches. And we think it's a bigger opportunity potentially than EDR because on average, at least the math is, there'll be 90 AI agents for a human. Now obviously, I think it would be unlimited. And it doesn't mean why can't you have 1,000 or what have you. So we actually worked on that. And it's a great story because we had so much feedback from customers in what they wanted. So we bought Pangea which really did prompt inspection. And then we are our customers saying, "Well, we don't know where all these AI agents are." It's AI agents run a muck. And the CEO on down and the Board is saying, we have to deploy AI agents but we can't go fast enough because of the security issues. So they told us this, I mean, every customer was saying this. And we had a piece of it. So what we did is we created a Tiger team internally about 6 months ago. And this is a great example of like how you have to operate today. And I said, okay, we're going to put a Tiger team in place and we're going to start. So I had a kickoff meeting, and it was a smaller group, but then 200 people show up. Everybody wanted to be part of the Tiger team. And I'm like, this is not a Tiger team. So I disinvited 200 people, and then I reinvited and I had picked the best all stars from CrowdStrike, like it was a privilege to be in this team. Then we ran 3 meetings a week that I was on status meetings. And to be honest, it was no different than when I started the company, it was like, here's what we want, here's what we're going to build, change that, move that. I don't like the color. I mean, is that level of detail, and it's incredible because -- I mean the good news is with the platform, 80% of the stuff is built. We don't have to build agents and workflows. I mean, we created a new workflow, but we don't have to build the architecture around it. So within a very short period of time with a small team and leveraging AI, we've got an incredible product out. So that when I got on stage, I was able to announce Guardian -- it went live while I spoke and then our customers were turning it on and using it in the workshops in the afternoon. So that one is super exciting, and I think it's going to be a total home run for us.

And when they turn it on, it consumes less credit?

Well, if you license it through Flex, it consumes Flex credit, it really consumes tokens, which again, are made available through Flex. But part of Flex, as you probably saw in the last quarter, did 935, Flex were $2.3 billion worth of total Flex contracts. And we've gone to a flex first selling motion, which means like if you wanted to sell something that wasn't flex, you'd have to get it approved up through probably the President -- Head of Sales, President of the company. So not to say that some of them don't get through for whatever reason. But at the end of the day, we tripled the amount of Flex deals last quarter than we've done.

There are a lot of technical decisions made early on in CrowdStrike with the lightweight sensor that you have and the knowledge graph and all that good stuff, threat graph. My question for you is, if you think about the pace of agent attack for lack of a better word. Is there a scalability upgrade that has to happen? And I guess, we can take it in 2 ways. One, internally for your own architecture did you have to upgrade to be able to meet pace and speed of agentic attacks? And then two, we can talk about customers.

The good news is that we've built the technology and the platform to be scalable. So when we think about attacks and when we think about a genetic attacks, there's 2 things that you have to really keep in mind. Number one is things happen faster and more of them happen. This is the simple explanation. The agents haven't figured out some new miraculous way or class of attacks that have never been seen before that we're not covering for, okay? So you have more attacks and they come faster. That's the big piece. And obviously, these agenetic attacks are good because they can shrink so many different vulnerabilities together, really esoteric things that a human couldn't keep track of to be able to find an access path and we've all heard and read the hugging phase examples. So from that standpoint, we have the technologies. And we've understood what was happening. We talked about this breakout time. It used to be days and hours and minutes. It was 27 minutes last year with 27 seconds we saw in some cases. And part of what I talked about at Falcon is this window has now collapsed in like because of the new Apex Predator is the agent state, not the nation state and now everyone can operate with nation state capabilities. So we, of course, keep adapting. But the big part is making sure that you've got the right AI internally with the right speed and the platform to keep up with what the adversary is doing.

This leads to the modernization question. I think about your share in even classic endpoint, for example, let alone your share and next-generation SIM, which is going to be benchmarking below what endpoint is because it's newer. There's a lot of heavy lifting that customers select you from a modernization standpoint. Talk to us about some of those conversations. When enterprises call you in and say, look, we haven't historically been a CrowdStrike customer, how do you walk them through legacy to NextGen across the key pillars?

I think we just want to start with what are you trying to solve, and we have a lot of customers that I think we're looking -- sometimes legacy technology is just there's inertia, right? Hey, we'll get around to it whenever we get around to it. Half the market is still legacy. So -- and we're -- we've got massive customers, but half the market is still legacy. So plenty of headroom in front of us. But I think with this ethos moment, what we're seeing now is customers going, hey, maybe the legacy is not [indiscernible], maybe it's time to make a change. And there's always these technology inflection points that people go wait on it. We got to do something different. And I think ADR or Guardian is the product will actually spur more activity around what we had is not going to work and how do we modernize this. And some of the companies that we've won and we've got a great amount of net new logos, you would look at those -- if you knew the names, you go, I can't believe for 15 years, you've been on legacy technology. But they still are, and we're happy to have them over. But it's taking them on the journey. Let's solve what you have today, maybe you want AIDR, your SIM is outdated. -- you're spending too much money. You've got one of every tool and 2 of everything else, like how do we get rid of this stuff. And that's really the conversation, which leads to flex and then also the demand planning that we do year-over-year, which has been great in having customers actually consume more Flex sooner.

What about in terms of budget, one of the industry conversations that we've been having is CSOs generally have more of a car blank than they did a year ago because enterprises are so determined to make AI a reality. When they get that card block, how do they then match a specific security products, I guess, depends very much on the problem they're trying to solve? But maybe just give us some high level commentary on what you're seeing at a budgetary level.

Well, from a budgetary level, it really starts with what problem are they trying to solve? So one of our largest customers -- one of the scales work with us as a design partner for Guardian. And they came to us and they said, "We want these things get will be designs unbelievable have them as a design partner." And I said, okay, well, what does success look like when this thing pops out the other end, what does it look like? And what are you looking for? And it wasn't a feature. It wasn't a technology sort of widget that they wanted as success. The #1 thing was we want to go faster in AI deployment. The CEO wants us to go faster. And we're actually -- we can't go fast enough. So when you have that level of support at the CEO level down. What we're seeing is that basically, security is hitting the gas pedal for the first time for IT rather than hitting the brake pedal. . And this, I think, we talked about this before we got on stage, it's really the first time I've seen hitting the gas pedal and security rather than hitting brakes. So that gives you additional budget where it's the CTO, the CT -- the Chief Data Officer, whatever it might be saying, we got to go faster, we need security to be part of it.