Well, good morning, everybody. Thank you for being here for the last day of our Morgan Stanley TMT conference. Really appreciate it. We are really excited to have the team from CrowdStrike. We have Founder and CEO, George Kurtz, as well as CFO, Burt Podbere. Thank you so much for coming. As a brief programming note, for important disclosures, please see the Morgan Stanley Research Disclosure website at www.morganstanley.com/researchdisclosures. With that, George, Burt, thank you so much for being here.
Great to be here. Thank you.
Great to be here. Thank you. Yep.
Okay. I thought we would just start off a little bit on the, on the state of the union in terms of the demand environment, the macro. You had, you know, your Q4 earnings a couple days ago. Talk a little bit about what you're seeing in terms of overall demand and some of the major sort of highlights coming out of that quarter.
Sure. I think if you, if you look back over the last couple of months, just in general from a market perspective, we saw a bit of a trough, right, in the general market of October, November. You know, as we progress through November, December, January, it gets back to what I said before, security is something that you just can't put off indefinitely. Certainly in January, we saw fantastic activity, and I think it goes to the fact that people are still flighting their projects. They're still executing on them. If we have the ability, which we do, to be able to save time, money, and have a better outcome, that's what customers are buying.
Overall, there's still headwinds in the environment, but, you know, I think getting in front of the deals is really important and making sure that we're really showing a tangible return to our customers, in terms of ROI and TCO.
Burt, anything to add to that?
Yeah, I think, you know, at the end of the day, you can just see that, you know, our ARR balance jumped up because of the, you know, the strong January. It goes to, you know, the fact that as George mentioned, we had a lot of customers that say, "We're gonna start the new year and we gotta make sure our security stack is in check.
Got it. Let's dig right into what some of the investors might be picking on coming out of that quarter. The first thing was gross margins. Not just last quarter, I think over the last several quarters, it's been trending down a little bit. Some have surmised maybe that's pricing. You care to dispel that notion?
Yeah. It's not so much pricing. I think at the end of the day, we've been doing a lot of investing, right, in our own infrastructure. I did give, you know, I did give some additional information in our Q1 that we're expecting to see up to 1% increment in our subscription growth margin, and that's gonna be because some of the fruits of our labors are gonna pay off. We wanted to give that notion. If you think about, you know, our opportunity in gross margin, it comes in twofold. Obviously, the top, more modules that come out, our ability to continue to sell the platform, our ability to continue to drive costs down, getting better outcomes for customers, that's there.
On the bottom, we have an opportunity on our cog side of the house to optimize both our public and private clouds. For us, we see, you know, great opportunity. We've been investing for years on our private cloud, and we've made some great strides there, and we look forward to being able to get to the top end of our long-term range because of those investments we're making today. It's not all gonna come at once, but it'll come over time.
Just to follow on that too, one of the things that we talked about was Humio, which is now Falcon LogScale. They had their own architecture. It was mostly in the public cloud. There's a migration process to optimize the balance between public and private cloud there, and that's still ongoing. That's one of the areas that we also talked about. I think in general, when you look at some of the acquisitions we've done, there's a level of investment. There's no acquisition we've ever done that operates at the scale that we operate, so we've got to make sure that we can take those great technologies, we've done a few, and then we can scale them up to make them work from, you know, people in a infrastructure perspective.
Got it. Got it. I wanna go back to some of the debates on the endpoint market. CrowdStrike pioneered the market for EDR, and there's still a big sort of legacy install base for EPP vendors. Those EPP, those legacy antivirus vendors used to compete a lot on pricing. What did CrowdStrike do to, one, innovate on that and then ultimately expand the market? You know, today you're still premium price. You're still about 15%-20% higher ASP than a lot of your competitors, which I know is not exactly like for like. What was the additional value that you brought to really help expand this market?
Well, I think it starts with the fact that when I started the company, it was really to build a platform company, and started with the right architecture. Really, the first incarnation of the product was build a very scalable agent, didn't require reboots, allowed us to collect data at scale. Once we had that, then we built all the other components around that, all the AI elements, all the prevention. That has really served us well because when we think about visibility and EDR, at the end of the day, it's about stopping breaches, and we do that better than anyone that's out there.
From a business model perspective, and talking about ASPs, our ability to actually install, get immediate time to value, and have a customer up and running, and many of the largest financial services companies in the world use us as an example. They would budget in the traditional world, two years to roll out an agent. In ours, it's, you know, a couple of weeks at best. That immediate time to value allows us to provide, you know, have a pricing advantage, I think, over others because when you look at not just the price, but the total cost to operationalize it's actually much lower than our competitors. That's really what we focus on, better outcomes, better cost savings, and overall less complexity in the environment.
The endpoint really is just the insertion point, if you will. Ultimately, it's taking the telemetry from those endpoints and using that telemetry to stop breaches. That kind of segues into the next question around AI. Why do you think owning the endpoint enables you to, you know, equip your customers or defend your customers against this growing sort of threat opportunity as it relates to AI, as well as what that means for CrowdStrike?
AI seems to be the new buzzword this year, right? The good thing is we started that many, many years ago and really helped pioneer using AI to prevent security breaches. We've obviously evaluated that over time. When we think about AI, there's a couple of key components to it. One, you have to feed the right data into it. You think about ChatGPT, without data, it doesn't do anything, right? We've got over 7 trillion signals and events that we collect per week. It's actually probably more than that at this point. It's really about taking the data and having it organized in a way that we can train the algorithms to get the best outcome. From that perspective, we've been doing this a long time. We continue to add more capabilities there.
What's really important to realize is, in order to stop these breaches, you do need a sophisticated level of AI, and you can't just depend on signatures. You look at our competitors, whether it's a Microsoft or whether it's a McAfee or Symantec, they're all signature based, right? That's their primarily defense mechanisms. AI is a big component, and having this data moat where not only do we collect data, 'cause one thing to take a pile of data, but it's actually organized via our Threat Graph, in a way that allows us to effectively train on the information we get to get the best outcome.
How much of the telemetry would you say comes from the endpoint, like today, as far as the threat data you're collecting?
We talk about the stats, we get trillions of events per week from the endpoints, over 165 different countries. again, it's one thing. You know, those are nice stats, but it's really the fact the way it's organized with our Threat Graph. We've built a proprietary graph database that provides a temporal element to organizing the data, so we never lose the state of the data from the endpoint. as it's not just a, "Hey, we collect a discrete piece of data and forward into a data lake." It's actually all linked together, and this linking over time is really a key element to it. That's used to help stop breaches, but it's also used to train the algorithms because we know the complete flow of what happened.
It's one thing to collect data, it's another thing to actually collect the right data in the right order to be able to get the right outcome.
Got it. We like the emerging module growth, but I think some people sort of backing out the net new ARR from the emerging modules did surmise that the net new ARR from the core endpoint, if you will, I guess, declined a little bit, based on some estimates out there. Just level set on that. You know, is that related at all to maybe some of the headwinds that we're seeing in the PC market or otherwise?
No, I think it's more like, you know, We had a record, you know, Q3 with respect to our emerging products.
Mm-hmm.
Right? When you carry that forward to the entire first half, you know, it's gonna If you're having a record quarter in your emerging product, it's gonna come from somewhere, in your overall, you know, ARR ending balance. That's how I really look at it, right? We had success in that emerging piece, right? If you have a total number, something else is gonna be not a record. In Q3 we saw that in emerging markets, so we're really excited about that.
Great. I want to talk a little bit about the Dell partnership, that this is a partnership that you were able to re-engage with. How does that relationship work? Just maybe explain high level how the economics work around that.
Well, we're super excited about that. I think you heard from the conference call, you know, we've been focusing on going down market into the SMB market. What does that mean? I'm gonna answer your question, but I just wanna put a little bit of context around it. We've started in the enterprise, and we dominate in that area, and we're not going to deviate from that. We've got a quarter of the Global 2000. There's another three quarters to go. That is not gonna change. The way the technology works, it's super easy to install and very effective. We can go all the way down market to the smallest SMBs.
We've been working on things like Falcon Go, our trial to pay, as well as our e-commerce engine, which we just have a new release that came out to remove a lot of the friction. One of the things I've done recently is, as we talked about last night at dinner, is hire Daniel Bernard from SentinelOne, who has done a great job in the past with these sort of relationships. This is the third deal that he's actually done with Dell. We were able to take a relationship that we had that was put on pause after VMware bought Carbon Black. That relationship has now changed with Dell. We inserted ourselves back in, and now we have a great partnership. What does that mean? There's really four key areas to the Dell partnership.
First one is shipping on box, which is not really on box, it's an entitlement, right? We can activate from the business computers, if you will, smallest SMBs to the largest enterprises. There is an area where Dell sellers will actually sell Falcon subscriptions, and they get compensated, this is key, as if it was a Dell product. There's no difference. This is huge. The third area is device as a service, so you can actually, instead of buying a PC, you can kind of rent it monthly. We're a part of that bundle. The last piece is actually the managed service that we're a key component of. We're just getting started in kind of re-energizing that relationship, and we're really excited about the future opportunity of it.
Burt, that's not reflected in the guide whatsoever.
Nope.
All gravy.
It does take time, though, to these relationships to develop, right? Flighting it both on the go-to-market as well as the tech and making sure it all works. You know, we're excited about the opportunity. It could be a meaningful part of our net new ARR in years to come, it does take time.
I think the key piece to that, and I know Burt is gonna manage the number of elements and your answer, but his answer to your question, what's important to realize is Dell could have picked anyone, right? They came back to CrowdStrike. Why? Because best technology and the fact that their customers were asking for it.
Got it. Got it. I think, you know, when I think about CrowdStrike sort of growth going forward, there's two ways you can go very broad and attract a really large set of customers, and then you're also going deeper within that enterprise install base with the emerging modules. I want to go a little bit on the broad side of the equation. You know, there's 175 million endpoints on Symantec, or Symantec rather is on 175 million endpoints, and 150 million+ on Trend Micro. CrowdStrike, based on our estimates, is, you know, less than 50 million. When you think about going into the SMB, where the ASPs are lower, how do you think about that impacting your margins?
Well, there's a couple of embedded pieces in that. First, we haven't given out how many endpoints we're on, so I'll just make sure that.
The Morgan Stanley estimate.
Okay.
Okay.
that's-
Okay
the Morgan Stanley estimate. The second piece of that is, as we think about ASPs, because you go down market doesn't mean your ASPs go lower.
Mm-hmm.
SMBs pay a lot of money. If there's only a few of them, that's at the highest price, right? I, you know, I think it might be a little bit of a misnomer that you're actually not gonna, from a, from a price per endpoint, you won't get as much or more on the SMB market, just pricing. Now, in terms of raw dollars, you know, that's gonna be a smaller deal than a, than a larger enterprise. When we look at going down market, and we look at the ability to have no-touch models like our e-commerce engine or like a Dell or, you know, we talked about the 18,000 managed service customers we have, those are very efficient routes to market that we're gonna continue to invest in.
It's a big focus for me, it's a big focus for Daniel. Just put it in perspective in terms of market opportunity, 18,000 managed service customers, fantastic, right? If you put it in perspective, there are 50 million small businesses that have 5 to 250 endpoints. 5 to 250. We're 18,000 customers of 50 million. It's crazy. From that standpoint, we do think it is a very effective and highly leveraged route to market in what we're putting together.
Got it. Got it. Maybe shifting to the emerging module. On the earnings call, you talked about a big win with a financial services customer, I think, on LogScale.
Mm-hmm.
I think that was also a replacement of an incumbent. How much was that customer paying on the incumbent, and can you give us a rough sense of how much they're paying, CrowdStrike?
Yes. I'll do the best I can to try to answer your question with probably not everything that you want. When we think about what it was, it was a shift of spend-
Mm-hmm
... and a reduction of overall cost. The incumbent's still there, but they were paying a lot of money for that, and they were tired of the fees they were paying. They're still paying it, not at that level, and they wanted to get the right performance. What we were able to do is put LogScale in, and they battle tested it 40 terabytes a day. They were able to get sub-second results in our product versus two-day results. It literally took two days for a query to come back in the other product. A, let's start with better outcomes. The second piece is because this data was flowing into CrowdStrike, and by the way, it was just CrowdStrike Falcon data, they then reduced their overall spend with the other vendor.
Now, the other vendor is still there, but their overall spend is down. The opportunity for us is we started with just CrowdStrike data. The next opportunity is to take all of the security data, and then from there, to move into the IT and the ops function. For us, it was a great way to run side by side, and similar to the way we actually started CrowdStrike when we first got on the endpoints, we didn't say, "Just take out McAfee and Symantec." We said, "Hey, run it side by side, and we have a great opportunity over time to be able to replace a lot of those other functions and that spend.
Got it. I did go off script with that question. Sorry, Maria. The other one I wanted to talk a little bit about was identity protection. You know, you bought this company, Preempt, couple years ago, about a little under $7 million of ARR, and you just surpassed $100 million of ARR in that identity protection module. How is that different relative to the traditional IM companies out there, like an Okta?
Mm-hmm.
How big do you think that business can be for CrowdStrike?
It's a great question, one I really want to make sure that everybody's, you know, heads up on, so I can go through what it all means, 'cause you get a lot of this. Let's level set on identity. There's really three key areas of identity. The first is to create the identity. You've got something like Active Directory to create identities. Well, if one identity is good, why isn't 20? We have 20 identities for all these different services that are out there. Now I have 20 identities, it's a nightmare. Now I need a single sign-on. I've got Okta Ping, right? You need to consolidate the identities. You create, you consolidate, and then the third area is you actually protect. We are in the third area. That's why it's different from the first two. We're not creating the identity.
We're not consolidating the identity. We're protecting the identity. When we look at that, it's very differentiated. Why? Because, you know, it's in the category of identity threat detection and prevention. We give deep visibility into the directory services, and we protect the credential from being abused, we have a whole AI layer on top of it, which prevents things like lateral movement in an environment and the spread of ransomware. That has been very effective for us, and you've seen the, you know, it was less than seven when we got it, and now it's over 100. By the way, there's a whole bunch of months we didn't sell it as we were integrating the agent. We really just hit the gas a few quarters ago, right? Think about that. Why is it effective?
The most valuable real estate in a, in an estate is the domain controller. We're on it, and it's a matter of just flipping an entitlement to be able to implement our solution.
Got it. Got it. A couple more questions, and then I wanna open up the audience for Q&A. Cloud, cloud security. I think your public cloud deployment ARR surpassed $200 million this quarter. There's been a lot of debate around whether an agent-based approach is the best for securing cloud workloads or if it's agentless because you get more coverage and faster deployments and level set that conversation for us. Why do you think CrowdStrike's approach is better?
I think it's very simple. If you buy into the philosophy that you actually have to prevent breaches, you're never gonna do that with an agentless approach. It's a compliance and reporting tool. You're not in line in the path. You've now reported you have a problem, and you've reported that you might, you know, you might have had a breach. Okay. Having an agentless approach is important, and by the way, we have both. The real power in our cloud security is the fact that we combine agentless with agent cloud workload protection. When you hear agentless, you can think about reporting and compliance, and when you hear cloud workload protection, you can think about prevention capabilities. You're gonna need both. I think this has been validated, you know, in the market that you need both.
The good news is this is something that we've been building and have talked about over the last 18 months. It's not one or the other, but you have to look at what you're gonna use each one for and the overall outcome. The ability with 1 SKU to be able to combine both of those, we think is a winning formula, which is what we have.
Got it. Burt, question for you. Just on the free cash flow margins, CrowdStrike's always had really good profitability, but the free cash flow margins does include some amount of multi-year billings. In this environment, it seems like customers wanna pay less upfront for the most part. I guess a two-part question. One is, does CrowdStrike incentivize upfront payments? Two, how do you get comfortability in sustaining 30% free cash flow margin when there could be that duration risk, if you will?
Yeah. One, we don't incent payments upfront, so there's no discount for, let's say, a three-year deal and pay it all upfront. We don't discount that. In terms of how we get comfortable. What I talked about in our 30% free cash flow margin, a lot of it is driven by the leverage in the model. That's gonna go to the bottom. For us, we talked about, you know, leverage for this year in terms of my last guidance, and, you know, I reiterated our 30% free cash flow margin, and that's how I got comfortable more than anything else.
Got it. Let's not forget that 3%-4% coupon, right, on the, on the cash. Any questions from the audience? Got one over here.
Hey, George and Bert. Thanks for taking the time.
Sure.
Sure.
Maybe just a question about R&D priorities. I've noticed you've increased in the last quarter, and I guess just investing in emerging modules, how do you kind of think about balancing that and kind of eventually getting, gaining leverage to reach your medium-term operating margin targets? Thanks.
I'll talk about the number, then George can talk about... Yeah, no. The big picture on R&D is that if you take a look at the full year, we're actually in our long-term target model. We're at the higher end, which is okay. We think that, you know, spend in R&D, that's, we gotta stay ahead of the innovation curve. That's what technology companies, successful technology companies do. It's really hard to bring in great talent and engineers and making them productive. We're really happy of where we ended up. I'll turn it over to George in terms of what he thinks his priorities are.
Yeah. I think just to follow along with the, with the macro part of the question, we're an innovation company. We're not a, we're not an aggregator. We're an innovator, and I think that's really important. A lot of the things that we talk about today, we invented, and Gartner gave a different name to it or a new name to it. Which is fine. When you think about areas of investment, we bought LogScale. We've got to buy, invest in it, and we got to scale it up, right? We bought, you know, other technologies in the Falcon Service technology. We got to invest in it. We have XDR. XDR is a multi-year journey. You know, it's not just a product, right?
It's a philosophy, and it's something that we've been focused on for many years, but you have to invest in it. We're in line with Burt's model, and overall, we need to come into the year with enough ramp capacity in areas like cloud as well. There's a lot more to do in cloud so that we can hit the overall product goals that we have. You know, I think as Burt said, we're in line with his overall model.
Any other questions? Okay. I want to talk a little bit about cap allocation. CrowdStrike has, I think, a little over $2 billion in net cash now. How do you think about sort of the use of that cash? What are the main priorities?
First of all, we're, you know, in terms of, you know, we saw the other day with more interest rate hikes, you know, we did a bond, and we're making more money on the bond than we're paying, so that's pretty good. In generally though, you know, we, we really think that, you know, there's gonna be a real opportunity in the private markets, you know, in the, in the, in the near to midterm future. As, as private companies look and see what their opportunities are, you know, potentially joining CrowdStrike could be a really good one, and we wanna be there to be able to take advantage of that.
In terms of M&A, you know, just your thoughts on build versus buy. I mean, you've been largely an organic company. Are we thinking about sort of tuck-in type acquisitions like Preempt or Reposify, or would you be open to something, you know, larger if it made sense?
I think we stick to what we really like and what's worked, and we love great teams, we love great technologies, and it's even better if they have no go-to-market because we don't have to pay for that. If you look at those acquisitions, they've all been great teams, all been great technologies, and as soon as we've got them into the CrowdStrike machine, you know, on the technology side as well as the sales machine, you know, we've seen these all go up. I think that's a winning formula. We're always, you know, looking at the best players that are out there, but we kinda like that model, and we certainly think that the environment's gonna be even better for that as private companies go to market looking for next rounds and things of that nature.
We've already seen sort of expectations soften up a bit in the private market. That's probably where we'll remain focused.
Got it. You know, you brought up Daniel Bernard. One of the things that I think he's been doing is really accelerating, CrowdStrike momentum in the channel...
Mm-hmm
... it sounds like, particularly downmarket. Talk a little bit about the leverage that you're looking to get from MSSPs, and how do you think that can really accelerate your net retention rate in particular as they're allowed to sell more and more modules?
MSSPs is a key route to market for us. As we said, we gave out the number, but there's a lot more to go, and part of bringing Daniel on board is he's an expert in that market, and we've been spending a lot of time together at managed service providers and other channel partners, and really focused on, okay, we're spending a lot of money with them. They're bringing us a lot of money. How do we dramatically upsize the business with each of these key partners? There's a level of focus in this area that, you know, we've never had before. I've actually broken it out from the sales organization and created that chief business officer role so that we can really get the leverage that we want in the model.
I'm really excited about it, and, I think what we have done and what we will do in the managed service market is incredibly, you know, important to our future success.
Yeah. And then also the e-commerce channel, you know, that's been an important driver and also, very low-touch type sale. Burt, what are the, generally high level, what the margins look like there, and how big is that business for CrowdStrike?
Look, it's a really important business for us. You know, we took a look at Atlassian and what they did, and George is close with some of the folks over there to take the learnings and make it really efficient. I look to that as one of those areas where it's gonna, you know, continue to help us with our unit economics as well as volume, right? To come into that, swipe the card, off you go with our tech, that's pretty compelling. George and I like to talk about the fact that, you know, we're selling while we sleep. That's an engine that's gonna allow that to happen. For me, a big part of that was to just look, you know, what's been successful?
For me, I wanted to take an Atlassian e-commerce engine like and combine that with a SolarWinds inside sales force, right, to be able to go to market. What's the proof point of that? You know, we've had customers come in, swipe a credit card for $2,000, and great, they have an AV, you know, product. Okay? That automatically goes into our inside sales team, and we're saying, "Okay, what outcome are you looking for? Do you have enough people? Do you have a compliance mandate?" This is one of many, by the way, but that $2,000 transaction left the building two weeks later, an additional $40,000. A total of $42,000 that they actually spent because we upsold them to Falcon Complete.
Again, a very differentiated, service offering, and they could never replicate what we're doing for $40,000 if they try to hire the people to do it.
Yeah. Last question from me, just on federal. I think you mentioned CrowdStrike has 40 U.S. government agencies, or four, excuse me, 40 of the U.S. state governments are customers. Federal activity has been picking up quite a bit over the last year. There's been a lot of initiatives from the Biden administration. Just talk a little bit about your pipeline there and what the opportunity you see?
Yeah. In fact, I was just there probably a month ago. It's a robust business for us. We've got the big CISA win. We've got, you know, a handful of agencies out of 100 that are there, and that gives us obviously a license to hunt. I think the validation that CISA brings to us is really important because I mean, they looked at everything that was out there and chose us as being the best technology. That's an ongoing effort. You know, you've got to fight everything from just kind of, you know, inertia within some of these organizations to continuing budget resolutions, and that takes time, but over time, we have the ability to continue to replace the incumbents that are out there, and that really has been the focus.
All right, great. With that, I have about three seconds left, so I'll give you some time back. Thank you so much, George and Burt.
Great.
Thank you everyone for coming.
Thank you so much.
All right. Thank you. Thanks so much.