CrowdStrike Stock: Valuation Looks Stretched (NASDAQ:CRWD)

CrowdStrike (NASDAQ:CRWD) is a best-in-class cybersecurity vendor that continues to establish a presence across a growing range of end markets. CrowdStrike’s endpoint agent is a strategically important asset that provides access and data, the value of which has been increased by the cloud. Unlike legacy cybersecurity vendors, CrowdStrike has a sustainable competitive advantage in a large and rapidly growing market. The value of this is compounded by the company’s sticky revenues and highly efficient business. All of this is increasingly understood by the market though, and hence priced into the stock. While CrowdStrike is not necessarily overvalued at current levels, it is unlikely to offer compelling returns from current prices.

Market

While the macro environment remains challenging, with elevated deal scrutiny and elongated sales cycles, CrowdStrike had a strong October. Cybersecurity demand remains solid, and in some areas CrowdStrike has seen budgets shift from IT to security. While markets now appear to be pricing in a large growth acceleration for many stocks, I would not anticipate more than a fairly modest increase in growth for most stocks.

Longer term, CrowdStrike is likely to continue benefitting from strong demand for next-gen security solutions and an expanding addressable market as it broadens its platform. For example, CrowdStrike estimates that its TAM will expand to 225 billion USD by 2028. Even within its core endpoint market, there is still significant room for growth as an estimated 48% of the market is still using legacy AV.

CrowdStrike

The rise of the internet and cloud computing has dramatically reshaped barriers to entry in cybersecurity, and this is now becoming increasingly understood by investors. Distributed and diverse workloads, along with increasingly sophisticated attacks, require solutions that leverage big data and AI to stay abreast of a rapidly evolving threat landscape. This has increased the size of the market and is causing the market to coalesce around platforms built on data assets. Customer consolidation on platforms is also increasing retention rates and contributing to higher margins for cybersecurity leaders. It is also making point solutions unviable in the long run as standalone products. CrowdStrike is one of the clear winners in this process, with an ever-expanding portfolio of solutions that continues to be adopted across its customer base.

CrowdStrike continues to build out its platform, enhancing existing solutions and introducing new solutions:

• CrowdStrike’s Exposure Management solution saw strong demand in its first quarter on the market
• The release of Raptor standardizes all of CrowdStrike’s customers on LogScale, further enabling SIEM and XDR use cases on Falcon
• Falcon for IT is a new module that aims to unify IT and SecOps
• Falcon’s new data protection module prevents data exfiltration and allows CrowdStrike to pursue the large Data Loss Protection opportunity
• Falcon Foundry is a no-code application development solution that enables customers to easily build on Falcon
• CrowdStrike recently released the beta and pricing for Charlotte AI, the company’s generative AI-powered assistant
• The acquisition of Bionic expands CrowdStrike’s cloud security offering into application security posture management

LogScale

CrowdStrike believes that the SIEM market is ripe for disruption, as legacy solutions have a number of issues. This includes the fact that legacy SIEM solutions are ingesting non-native data and rely on slow index-based searches. I have written about this in more depth previously and expect CrowdStrike’s solution to rapidly gain market share in the coming years.

CrowdStrike’s Raptor solution benefits from data gravity, with Falcon producing 85% of the data in SIEMs. For this reason, product portfolio breadth should also increase the value of CrowdStrike’s SIEM solution. Raptor makes it easier for customers to build their security and data lake efforts on top of LogScale. LogScale surpassed 100 million USD ARR in Q3 despite only 3% of customers having adopted the product.

Identity

Approximately 80% of attacks exploit identity-based vectors, making identity security critical. While Microsoft’s (MSFT) Active Directory provisions identity and Okta (OKTA) controls access, CrowdStrike prevents identity attacks.

CrowdStrike has over 2,000 identity customers and its identity ARR is in excess of 200 million USD, growing nearly 200% YoY. Only 9% of customers have adopted CrowdStrike’s identity solution so far though, providing significant room for growth. CrowdStrike estimates its identity TAM will be 17 billion USD in 2028.

Cloud

The shift to the cloud is increasing the number of workloads that need to be protected, expanding CrowdStrike’s TAM. CrowdStrike believes that its cloud business is advantaged by the fact it offers integrated agent and agentless technology. Agents provide detection and response, whereas the agentless approach is better suited to compliance and reporting. CrowdStrike recently enhanced its cloud offering with the acquisition of Bionic, an application security posture management provider.

CrowdStrike’s cloud business currently has around 300 million USD ARR, with around 34% of customers having adopted CrowdStrike’s cloud security. The number of CrowdStrike public cloud customers increased 45% YoY, which CrowdStrike has suggested is the result of it replacing point solution CSPMs. Growth of the cloud business has been accelerating and CrowdStrike entered the fourth quarter with a record pipeline.

Financial Analysis

CrowdStrike ended the third quarter with 3.15 billion USD ARR, up 35% YoY. Net new ARR was a record 223 million USD, a 13% increase YoY, and it was this acceleration that has helped to reignite sentiment towards CrowdStrike’s business.

CrowdStrike’s gross retention rate remains high, although its dollar-based net retention rate ticked slightly lower in the third quarter, in part because customers are now landing larger. On average, new customers are initially purchasing 4.8 modules, leaving less room for expansion. While this may be viewed negatively by investors, from a financial perspective it is preferable if revenue is high initially rather than building slowly over time. Customers continue to adopt more modules though, contributing to expansion.

CrowdStrike is guiding to 837-840 million USD revenue in the fourth quarter, which would represent a 31-32% YoY growth rate. Longer term, CrowdStrike is targeting 10 billion USD ARR over the next 5-7 years, implying a 19-27% annual growth rate. Cloud, identity, and LogScale are expected to provide close to half of this ARR.

CrowdStrike still has plenty of room for growth, with customer penetration still relatively low, particularly amongst smaller organizations. This is something CrowdStrike is trying to change through partnerships and its Falcon Go product.

While net new ARR picked up in the third quarter, the macro environment remains soft, and there is little evidence of a sustained rebound in demand. For this reason, I believe it is worthwhile to remain cautious regarding near-term growth expectations.

CrowdStrike’s gross profit margins continue to improve on the back of stable pricing and data center and workload optimization initiatives. Over 50% of CrowdStrike’s non-GAAP COGS are hosting-related, providing a large cost reduction opportunity just from insourcing cloud infrastructure as the company scales. CrowdStrike is also benefitting from the low incremental cost associated with delivering additional solutions.

CrowdStrike’s operating profit margins also continue to improve on the back of higher gross profit margins and operating leverage. While CrowdStrike is already generating significant free cash flow, its business appears poised to be registering consistent GAAP profitability in coming quarters.

CrowdStrike is now targeting 28-32% non-GAAP operating profit margins. Based on the company’s current metrics (customer acquisition costs, churn, revenue per customer, etc.) I believe that this is overly conservative and expect GAAP margins closer to 35%, assuming competitive dynamics do not change significantly.

Conclusion

While CrowdStrike is a unique company worthy of a premium valuation, the recent increase in price is beginning to make the company’s valuation look stretched. 2024 should be another year of robust growth, and there is near-term potential for margin expansion if growth reaccelerates and sentiment continues to pick up. Investors should not lose sight of the fact that CrowdStrike’s business is maturing though, and as it does its revenue multiple will naturally gravitate towards the low teens / high single digits. I don’t necessarily believe the stock is overvalued at the moment, but it is also unlikely that the stock offers strong double-digit returns over a longer time frame from its current price. In addition, multiple compression is a significant risk if the macro environment softens or CrowdStrike stumbles.