CrowdStrike: Macro Induced Slowdown Is An Opportunity (NASDAQ:CRWD)

CrowdStrike (NASDAQ:CRWD) is a leader in the endpoint and cloud security markets, a large and rapidly growing market that appears to be consolidating around a handful of platforms. This market presents a large long-term opportunity, but growth is currently stalling due to macroeconomic uncertainty. Investors are not looking through current headwinds though, creating an opportunity for long-term investors.

While there has been a slowdown as customers pause spending, growth remains robust. Emerging products continue to be an area of strength for CrowdStrike, enabling high growth even as the core business reaches massive scale. The emerging products category includes Discover, Spotlight, Identity Protection and LogScale modules. CrowdStrike’s Identity Protection solutions are the largest contributor to ARR within the emerging category, and Q3 was another record quarter. Management has suggested that identity has the potential to be become an important part of the platform over time. Identity-based attacks have become common place, and this is often around Microsoft (MSFT) technologies in Active Directory. Preempt can also help customers with IGA and PAM. For example, one customer needed CrowdStrike’s identity product to pass their PAM audit, despite having PAM software.

LogScale also performed well in the third quarter, with CrowdStrike securing wins across a number of verticals, including financial services, insurance, technology, retail, energy and telecommunications. During the quarter, CrowdStrike finalized the acquisition of Reposify, the external attack surface management vendor. Reposify helps customers identify and eliminate risk from vulnerable and unknown assets before an attacker can exploit it. CrowdStrike’s public cloud business also continues to grow ARR at over 100% YoY and their CNAPP solution has won a number of industry awards.

Macroeconomic headwinds increased through the third quarter, causing net new ARR to come in below expectations. Customers have responded to macro uncertainty by requiring additional approvals, which have lengthened some deal timelines. The impact of this has been concentrated amongst smaller customers, with average days to close increasing by approximately 11% and net new ARR contribution decreasing by $15 million relative to Q2. Despite sales cycles lengthening, CrowdStrike continues to believe that the vast majority of these deals are just delayed and not lost. Customer additions also slowed during the quarter, despite CrowdStrike’s POV win rate increasing meaningfully against more complex solutions that require a greater headcount to manage.

Amongst enterprise customers, sales cycles remained consistent with the previous quarter, although some customers have signed contracts with multi-phase subscription start dates to manage operating expenses and cash flows. In comparison to the previous quarter, approximately $10 million more ARR was deferred into future quarters by this type of arrangement and this situation is expected to be ongoing. The flexibility being provided by CrowdStrike highlights the current weakness in the market.

ARR for CrowdStrike’s $1 million plus cohort surpassed $1 billion in the third quarter, growing 67% YoY. This cohort now represents approximately 43% of CrowdStrike’s total ARR. These customers are standardizing on Falcon and consolidating vendors, which provides up-sell opportunities and should contribute to low churn and help reduce the burden of sales and marketing expenses.

Ending ARR grew 54% YoY in the third quarter and net new ARR grew 17%. The composition of net new ARR was weighted toward CrowdStrike’s $1 million-plus customer cohort, although no single deal had an outsized contribution. Revenue growth internationally (72% YoY) was also far stronger than in the US (46% YoY).

CrowdStrike’s management has suggested that based on Q3 results, net new ARR would be down sequentially by up to 10% in the fourth quarter. This weakness is also in part due to CrowdStrike not expecting a typical Q4 budget flush. For the fourth quarter of FY2023, total revenue is expected to be up 44-46% YoY. For FY2024, management has projected that net new ARR will be roughly flat, implying a low 30% ending ARR growth rate and a subscription revenue growth rate in the mid to low-30s. Despite this slowdown, CrowdStrike entered Q4 with a record pipeline and continues to have strong competitive win rates, consistent ASPs and high retention rates.

Customer adds slowed in the third quarter, a figure that is dominated by SMBs, although average revenue per customer has steadily increased over the past 18 months. Headwinds in the SMB customer segment appear to be industry wide, rather than a CrowdStrike specific issue though, with a number of peers facing the same problem.

In the past CrowdStrike has focused on enterprise customers, initially targeting organizations with more than 7,500 employees. Focus is shifting to smaller organizations though, with products like Falcon Go and Falcon Complete appealing to this customer segment. Falcon Complete can help customers to control costs by decreasing headcount or holding headcount stable.

In line with this shift, CrowdStrike recently announced that Daniel Bernard and Raj Rajamani have joined CrowdStrike as Chief Business Officer and Chief Product Officer respectively. Bernard and Rajamani were previously at SentinelOne (S) as the Chief Marketing Officer and Chief Product Officer. This is an interesting development as CrowdStrike credits the two as being key architects of SentinelOne’s go-to-market and product strategy. The impact of this is not clear, but it appears to be a validation of SentinelOne’s approach, and an increase in focus for CrowdStrike on channel partners and the SMB segment.

Upstream indicators of demand for CrowdStrike’s services have so far been fairly robust, although signs of weakness may be beginning to show. Search interest for CrowdStrike pricing has steadily increased over the past seven years, punctuated by dips with unknown drivers. Search interest began to dip again in recent weeks, but it is not clear that this will translate to softer demand growth going forward.

The number of job openings mentioning CrowdStrike in the job requirements has also shown signs of weakness recently. There is potentially a seasonal component to this, although the current drop looks worse than previous years. Given that CrowdStrike’s pricing is based around workloads, job openings may not correlate that well with demand growth, although it should at least be directionally indicative.

CrowdStrike’s subscription gross profit margins have softened slightly in recent quarters, despite management suggesting that ASPs have not been under pressure. Service gross profit margins have also been trending down, possibly indicating that services are being used to sweeten deals more than has been the case in the past. CrowdStrike continues to believe that with the investments they are currently making they can get gross margins above 80%.

While CrowdStrike has always been an efficient company, management is responding to the current macro environment by balancing growth with profitability and free cash flow. CrowdStrike continue to target ARR of $5 billion by the end of FY2026 and 20-22% operating profit margins by FY2025.

A large part of achieving this target will be reducing the burden of R&D spend and making the salesforce more productive. For example, CrowdStrike is currently realigning its marketing initiatives and increasing its focus on brand awareness to drive pipeline growth. CrowdStrike is also gaining significant leverage from their partner ecosystem, with partner-sourced ARR growing 55% YoY.

CrowdStrike has compelling unit economics, as indicated by their high gross margins, high gross retention rates (98%) and magic number of 1.2x. While CrowdStrike is not yet profitable, they are already beginning to generate large amounts of free cash flow, and as investments moderate margins will improve. CrowdStrike’s current lack of profitability says far more about the failures of accounting standards to reflect the economics of a SaaS business than it does about CrowdStrike.

CrowdStrike slowed their pace of hiring significantly in 2022, and provided that growth remains robust in 2023, this should create a large amount of operating leverage. The slowdown in hiring started in the last few weeks of the third quarter, at the same time that management suggested demand weakness became more apparent. The large drop in open positions in December 2022 is somewhat concerning as this type of behavior is abnormal for a business that is performing in line with management expectations.

Sales job openings have not been particularly impacted by the hiring slowdown, although the end of the year has been associated with a surge in sales hires in the past, which did not occur in 2022. This would suggest that CrowdStrike is still trying to grow their salesforce while focusing on improving the productivity of existing reps.

Engineering job openings have been far more impacted, which would suggest that CrowdStrike is trying to bring down the burden of R&D expenses.

CrowdStrike’s enterprise win rates remain high and win rates amongst smaller customers improved in the third quarter. Management has stated that it doesn’t see another true consolidator like Falcon that can reduce costs, reduce complexity and stop breaches.

CrowdStrike recently suggested that Falcon’s low false positive rate is an important feature for customers, as it allows them to investigate and remediate incidents faster. This is potentially a shot at SentinelOne, which has received some criticism for having a high false positive rate.

CrowdStrike also believes that despite their premium pricing, the Falcon platform offers a lower TCO. For enterprise customers, CrowdStrike estimates that on average operational efficiency is improved 68%, equating to an offset of approximately 3.5 full-time employees.

Microsoft is often considered a large threat to next-gen security vendors, which is not unreasonable given their distribution footprint and existing relationships with a massive number of customers. Company’s like CrowdStrike and SentinelOne appear somewhat dismissive of Microsoft Defender as a threat though. George Kurtz has referred to Defender as a legacy, signature-based AV product and stated that a lot of customers come to CrowdStrike after falling victim to ransomware while using Microsoft technology. Similar to SentinelOne, CrowdStrike has also highlighted the deceptively high costs of managing Microsoft’s software.

CrowdStrike now appears attractively priced given the company’s strong competitive position, attractive unit economics and robust growth. The market is far too focused on performance over the next 12 months and accounting profits which do not reflect the reality of CrowdStrike’s business. With CrowdStrike’s ability to generate profits set to become clear over the next few years and inflation fears beginning to recede, CrowdStrike’s stock should be nearing a bottom, absent a collapse in demand.