CrowdStrike Holdings, Inc. (NASDAQ:CRWD) Q3 2023 Earnings Call Transcript

CrowdStrike Holdings, Inc. (NASDAQ:CRWD) Q3 2023 Earnings Call Transcript November 29, 2022

CrowdStrike Holdings, Inc. beats earnings expectations. Reported EPS is $0.4, expectations were $0.31.

Operator: Hello, and thank you for standing by. Welcome to CrowdStrike’s Fiscal Third Quarter 2023 Results Conference Call. At this time, all participants are in a listen-only mode. After the speaker presentation, there will be a question-and-answer session. It is now my pleasure to introduce Vice President of Investor Relations, Maria Riley.

Maria Riley: Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, President and Chief Executive Officer and Co-Founder of CrowdStrike; and Burt Podbere, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth and expected performance, including our outlook for the fourth quarter and fiscal year 2023 as well as any assumptions for fiscal periods beyond that, are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call.

While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements whether as a result of new information, future events or otherwise. Further information on these and other factors that could affect the company’s financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the company’s quarterly and annual reports. Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP.

A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings press release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today. With that, I will now turn the call over to George to begin.

George Kurtz: Thank you, Maria, and thank you all for joining us. Let me start with a summary of our results. In Q3, we delivered 53% revenue growth year-over-year, 15% non-GAAP operating margin and record non-GAAP net income, all of which were ahead of our guidance. Additionally, we achieved record free cash flow of $174 million, or approximately 30% of revenue. There are many positive trends we see in our business, including strong competitive win rates, consistent ASPs, exceptional retention rates and the mission-critical nature of cybersecurity. However, I would first like to address the increased macroeconomic headwinds we saw in the quarter, which caused Q3 net new ARR to come in below our expectations. As we discussed on our last earnings call, organizations were starting to respond to macroeconomic conditions by adding extra layers of required approvals and extending the time it took to close some deals.

As Q3 progressed and fears of a recession grew, this dynamic became more pronounced. In our smaller, more transactional non-enterprise accounts, we saw customers increasingly delay purchasing decisions with average days to close lengthening by approximately 11% and net new ARR contribution decreasing $15 million from Q2. This also impacted our net new logo additions in the quarter, even though our quarter-over-quarter POV win rates increased meaningfully over more complex vendors that require more headcount to manage. While sales cycles lengthen, we believe the vast majority of these deals are not lost, just delayed. In the enterprise, sales cycles or average days to close remain consistent with last quarter’s modestly higher level. In Q3, these larger customers continue to prioritize their CrowdStrike investments, but some also had to manage timing issues related to OpEx budgets and cash flow amidst the rapidly evolving macro.

To achieve this, some customers signed contracts that have multi-phase subscription start dates, which pushes their expense and CrowdStrike’s ARR recognition into future quarters. While every quarter, we have some deals with multiphase subscription start dates, in comparison to last quarter, in Q3, we saw approximately $10 million more ARR deferred into future quarters. We expect these macro headwinds to persist through Q4. Additionally, given the increased scrutiny on budgets, we’re not going to expect a typical Q4 budget flush, leading us to adjust our Q4 net new ARR expectations, as Burt will discuss in more detail. But this caution does not deter our confidence in the long-term market position of CrowdStrike or the resiliency of the cybersecurity market.

We see strong inherent demand for our products, and we entered Q4 with a record pipeline. Pipeline expansion is even more important in times of an evolving macro and elongated sales cycles. We are working to stay out in front of pipeline creation. With Jennifer Johnson, our recently appointed CMO, now with the marketing helm, we are realigning our marketing initiatives and increasing our focus on ramping more top-of-funnel initiatives and brand awareness to drive pipeline to even greater heights. We also gained significant leverage from our partner ecosystem, with partner-sourced ARR growing 55% year-over-year. There were many positives in this quarter highlighted by the record number of customers contributing at least $1 million in net new ARR in the quarter.

Additionally, ending ARR for the $1 million-plus cohort surpassed the $1 billion milestone in Q3 with a 67% year-over-year growth rate. These larger customers are standardizing on Falcon, consolidating vendors and prioritizing expansion projects that represent sizable cross-sell and up-sell opportunity that are moving forward even under uncertain macro conditions. Marquee brands that are new to our $1 million-plus cohort included a Global 500 manufacturer that landed with 10 modules, providing unprecedented visibility and protection to all areas of their environment and allowing them to consolidate four agents and vendors with their initial deployment of Falcon. Two Global 500 financial institutions who chose Falcon for its ability to replace multiple legacy security products and bolster their security posture through a single agent, a Global 500 consumer goods manufacturer that is now leveraging Falcon Complete for a fully managed approach to protecting its critical infrastructure and a Fortune 500 luxury brand, leveraging Falcon to protect both its traditional end points and cloud workloads.

In the third quarter, we also delivered strong results in the public sector, driven by a Falcon Complete LAN with one of the largest US federal agencies now standardizing on the Falcon platform and a strong quarter for our SLED business with the US state government standardizing on CrowdStrike in the quarter, as well as wins and expansion across multiple US state and local government agencies and educational institutions. To date, 40 US state governments are CrowdStrike customers, of which 21 in the District of Columbia have standardized on Falcon. Additionally, we secured a win with one of the largest federal systems integrators that will be using Falcon to protect its internal estate, as well as integrate it into its MSSP offering. Moving to our expansion and retention performance.

Our dollar-based net retention rate was well above Q3 of last year and consistent with our Q2 performance, which was at the highest level in seven quarters. Our best-in-class gross retention rates remained at record levels above 98%. We are also seeing more customers standardizing the Falcon platform and adopt more modules. Q3 subscription customers with five or more — six or more and seven or more modules were 60%, 36% and 21%, respectively. This represents a 55%, 66% and 81% year-over-year increase in these respective module adoption cohorts. It was another record quarter for our emerging product category, which includes our Discover, Spotlight, Identity Protection and LogScale modules. Our Identity Protection solutions are the largest contributor to ARR within the emerging category, and Q3 was another record quarter.

Net new ARR for Identity Protection solution grew to a new all-time high, and the attach rate on net new logos continue to grow rapidly. With close to 80% of cyber attacks leveraging identity-based tactics to compromise legitimate credentials and use techniques like lateral movement to evade detection, Identity Protection is core to stopping breaches. Our Identity Protection capabilities are a game changer and shoring up active directory as well as stopping ransomware and lateral movement. To punctuate the value of our Identity Protection capabilities, I’d like to share a recent seven-figure expansion with a leading global brand. This customer has a very capable security team that spent years building a dedicated identity and access management team and implementing a Privileged Access Management solution, or PAM.

Even with these efforts, shortly after turning on Falcon’s Identity Protection in the POV, we identified several misconfigurations, including dozens of domain administrator accounts that were not being managed by their PAM solution, a multitude of accounts without password expirations, thousands of users with compromised passwords and a potential attack path from unprivileged accounts to privilege launch. With Falcon Identity, this customer is shutting down routes to illegitimate access and significantly hardening their defenses. Q3 also marked another record quarter for LogScale as we secured wins across multiple verticals, including financial services, insurance, technology, retail, energy and telecommunications. Notable wins included a statewide insurance provider in the US and previously mentioned new Global 500 financial institution, where Falcon LogScale has enabled both organizations to log more data, retain it longer and reduce the cost of their existing log solutions, resulting in better security and more visibility across their environments.

During the quarter, we acquired external attack surface management, EASM vendor, Reposify, to help our customers identify and eliminate risk from vulnerable and unknown assets before an attacker can exploit it. The acquisition closed in early October, and we expect to launch our external attack surface management module this quarter, which will bring us to 23 modules available across the Falcon platform. On the public cloud front, we continue to build momentum with ending ARR for modules deployed in a public cloud setting growing over 100% year-over-year. Our CNAPP solution continues to gain industry recognition, including winning Best Cloud Security and CRN’s 2022 Tech Innovators Awards. Falcon Complete continues to shine with net new ARR growing close to 20% quarter-over-quarter as customers embrace our extended lineup of complete services, including Identity Complete and Cloud Complete.

Additionally, we launched Falcon Complete LogScale during Q3 and already secured several wins. In a more challenging economic environment, there is appeal for a solution like Falcon Complete that allows companies to decrease headcount or hold headcount stable. The significant advantages of CrowdStrike’s Falcon Complete offering were showcased in the first MITRE ATT&CK evaluation for security service providers. Out of 16 participants evaluating, the Falcon platform’s integration of industry-leading technology and human expertise enable us to deliver the highest coverage. This was MITRE’s first closed door test, which means the participants did not have prior knowledge of the adversary, and retesting was not allowed. We believe this evaluation demonstrates why CrowdStrike is the clear leader in EDR and XDR, whether our capabilities are delivered as a fully managed service from CrowdStrike or through our network of MSSP partners or operated independently by our customers.

The Falcon platform also won SE Labs EDR ransomware detection and protection test. This well-regarded third-party testing firm involved 270 ransomware variations and deep attack tactics. Falcon achieved 100% ransomware prevention with zero false positives. Let me repeat, zero false positives, which we believe reflects our superior AI and machine learning models and the data mode advantage we derive from our unique graph technology in Threat Graph. Falcon’s exceptionally low false positive rate represents a tremendous operational win for our customers as it enables them to significantly increase their speed to triage, investigate and remediate a verified alert. Based upon our business value assessment and realized analysis, we estimate that, on average, enterprise customers observed a 68% increase in operational efficiencies with the Falcon platform, equating to an offset of approximately 3.5 full-time employees.

We believe today’s macro pressures on businesses and the escalating threat environment make Falcon’s value proposition as a consolidator more important today than at any other time in CrowdStrike’s history. In order to solve agent bloating complexity within the security and IT stack, while also protecting the business from cyber adversaries and reducing operating costs, companies need to consolidate on a truly integrated platform, not acquired technologies stitched together by an invoice. CrowdStrike Falcon continues to be the gold standard and the security platform of record. While the cybersecurity market is not immune to macro pressures, it is a mission-critical technology. The adversaries don’t stop. As detailed in our latest threat hunting report, OverWatch observed a nearly 50% year-over-year increase in interactive intrusion campaigns.

We believe cybersecurity investments is resilient and is prioritized, especially among the world’s largest organizations as represented in our $1 million-plus customer cohort and best-in-class retention rates and module adoption rates. With the escalating threat environment, expanding attack surface and accessibility of the Falcon platform, it is our belief that we are still in the early innings of CrowdStrike’s growth journey. We believe the early and rapid success of our identity protection solution best demonstrates our ability to leverage our unique and vast threat intelligence to create and dominate new and legacy markets. We intend to continue our disruptive innovation, expand our technology leadership and bring new modules to market.

Even with these investments, we are responding to current macro conditions and plan to balance growth with profitability and free cash flow, as Burt will discuss in more detail. We remain steadfast in our vision to grow ending ARR in $5 billion by the end of fiscal year 2026 and reach our target operating model in fiscal year 2025. With that, I will turn the call over to Burt to discuss our financial results in more detail.

See also 15 Biggest Bike Companies in the World and 16 Biggest Mining Companies in the World.

Burt Podbere : Thank you, George, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue mentioned during my remarks today are non-GAAP. Before we get started, I will note that the results we are reporting today include the acquisition of Reposify, which was de minimis to revenue and ARR, contributing less than $1 million to Q3 ARR. In the quarter, ending ARR grew 54% year-over-year. Net new ARR grew 17% year-over-year to $198.1 million. Given the elongated sales cycles due to macro pressures in smaller non-enterprise accounts that George discussed, the composition of net new ARR in Q3 was weighted more heavily toward our $1 million-plus customer cohort with no outsized contribution from any one deal.

Our dollar-based net retention rate was above our benchmark and consistent with Q2, maintaining the highest level since Q3 in fiscal 2021. Gross retention also maintained its record level, demonstrating our strong commitment to stopping the breach, delivering value to customers and restoring trust to the security posture of companies worldwide. As George mentioned, we are also seeing more customers standardize on the Falcon platform and adopt more modules. We believe these trends will create an enduring business opportunity for the years to come. Moving to the P&L. Total revenue grew 53% over Q3 of last year to reach $580.9 million. Subscription revenue grew 53% over Q3 of last year to reach $547.4 million. Professional services revenue was $33.5 million, setting a new record for the ninth consecutive quarter and representing 46% year-over-year growth.

In terms of our geographic performance in Q3, we continue to see strong growth in the US at 46% and international revenue growth at 72% year-over-year. Third quarter total and subscription non-GAAP gross margins remained relatively consistent at 75% and 78%, respectively. Total non-GAAP operating expenses in the third quarter were approximately $348.6 million or 60% of revenue versus $239.0 million last year or 63% of revenue. In Q3, our Magic Number was 1.2, reflecting the continued efficiency of our go-to-market engine. We believe a Magic Number in excess of 1.0 indicates very favorable go-to-market efficiency and supports our current investment plan. As George mentioned, we are focusing marketing investments on specific initiatives with the goal to drive an even bigger pipeline in response to the macroeconomic environment, while at the same time maintaining our disciplined approach to unit economics.

Third quarter non-GAAP operating income grew 77% year-over-year to reach a record $89.7 million, and operating margin improved by 2 percentage points year-over-year to reach 15%. Looking at the first nine months of fiscal year 2023. Non-GAAP operating income grew 125% year-over-year to reach $260.1 million and 16% of revenue. Non-GAAP net income attributable to CrowdStrike in Q3 also more than doubled over the prior year, growing to a record $96.1 million or $0.40 on a diluted per share basis. Our weighted average common shares used to calculate third quarter non-GAAP EPS attributed to CrowdStrike was on a diluted basis and totaled approximately 240 million shares. We ended the third quarter with a strong balance sheet. Cash and cash equivalents increased to approximately $2.47 billion and reflects the approximately $19 million payment net of cash acquired for the acquisition of Reposify.

Cash flow from operations grew 53% year-over-year to a record $242.9 million. Free cash flow grew 41% year-over-year to a record $174.1 million or approximately 30% of revenue. Before I move to our guidance, I’d like to provide a few comments about how we view the ongoing impact of the current macro climate on our business. We are maintaining our revenue guidance for fiscal year 2023 while raising our bottom line guidance. As George mentioned, even though we entered Q3 with a record pipeline, we are expecting the elongated sales cycles due to macro concerns to continue, and we are not expecting to see the typical Q4 budget flush given the increased scrutiny on budgets. While we do not provide net new ARR guidance given the current macro uncertainty, we believe it is prudent to assume that Q4 net new ARR will be below Q3 by up to 10%.

Looking into FY 2024, assuming an approximately 10% year-over-year headwind in the first half of the year on net new ARR, and for the full year, net new ARR would be roughly flat, to modestly up year-over-year. This would imply a low 30s ending ARR growth rate and a subscription revenue growth rate in the low to mid-30s for FY 2024. Similar to how we partnered with customers during the height of the COVID-19 pandemic, we are exercising more flexibility with new contract payment terms as organizations navigate macroeconomic conditions. We also expect more multiyear deals converting to one year renewals than in previous quarters. As a result, we expect free cash flow as a percent of revenue to be in the range of 28% and 30% for FY 2023. Throughout fiscal year 2023 to date, we have taken advantage of market dynamics and brought on superb talent in key functions at an accelerated pace.

At the same time, employee retention rates have increased. As of the end of Q3, we have grown our team by 40% in FY 2023, putting us in a really good position to execute on our plan for next year. This allows us to shift our near-term focus to enablement and productivity, while significantly slowing the pace of new hires needed to execute our plans. Assuming the macro environment does not materially weaken from current levels, we see a path to free cash flow margin of 30% of revenue in FY 2024, and we plan to generate modest incremental non-GAAP operating margin leverage in FY 2024 as we continue to march toward our target operating model. For the fourth quarter of FY 2023, we expect total revenue to be in the range of $619.1 million to $628.2 million, reflecting a year-over-year growth rate of 44% to 46%, with subscription revenue being the dominant driver of growth.

We expect non-GAAP income from operations to be in the range of $87.2 million to $93.7 million and non-GAAP net income attributable to CrowdStrike to be in the range of $109 million to $107.5 million. We expect diluted non-GAAP net income per share attributable to CrowdStrike to be in the range of $0.42 to $0.45, utilizing a weighted average share count of 241 million shares on a diluted basis. For the full fiscal year 2023, we currently expect total revenue to be in the range of $2,223.0 million to $2,232.0 million, reflecting a growth rate of 53% to 54% over the prior fiscal year. Non-GAAP income from operations is expected to be between $347.2 million and $353.8 million. We expect fiscal 2023 non-GAAP net income attributable to CrowdStrike to be between $357.6 million and $364.4 million.

Utilizing 240 million weighted average shares on a diluted basis, we expect non-GAAP net income per share attributable to CrowdStrike to be in the range of $1.49 to $1.52. George and I will now take your questions.

Operator: Thank you. And our first question comes from the line of Saket Kalia with Barclays.

Saket Kalia: Okay. Great. Hey, guys. Thanks for taking my questions here. A lot to unpack. George, maybe for you, I was wondering if you could dig just one level deeper into any competitive data that you’ve reviewed kind of looking back in the quarter. Do you feel like any big competitors here like Microsoft or perhaps even smaller next-gen competitors are having an impact? Burt, if I could squeeze a housekeeping question in as well. Clearly, ARR is the metric that you manage to. But maybe for everybody’s benefit, can you also talk to how RPO and ARR growth might have different drivers?

George Kurtz : Yes. Thanks, Saket. So again, if you look at what we’ve seen and what we’ve commented on, the inherent demand for our products remain strong. Obviously, there’s an increase in the macro headwinds. We talked about some of the smaller customers having elongated sales cycles. We saw 11% increase in days to close. And those are delayed deals, not lost deals. And on the enterprise, again, we’re seeing consistent win rates. They remain high. And in fact, in the smaller customers, we’ve actually seen them significantly improved quarter-over-quarter. So from our standpoint, and we look at this very closely, as you might imagine, the landscape remains favorable to us. I really don’t see another true consolidator like Falcon.

And customers are looking for technologies that reduce costs, reduce complexities, actually work and stop breaches, and that’s what we’re delivering. So again, when we look at the competitive landscape, it remains favorable to us. And as we pointed out, we saw increased macro headwinds, and that’s what we talked about. So I’ll turn it over to Burt.

Burt Podbere: Thanks, Saket. So first, big picture, when we think about CRPO, we think that as a noisy metric. And it’s really not designed to match or correlate with ARR given the fact that ARR is a normalized annual number. And what do I mean by a noisy metric? Well, what I mean by that is there are several positive trends in our business that can create headwinds on duration relative to prior periods and not necessarily fully captured in CRPO. Some examples would include, for us, more one year deals compared to prior periods. In software, it’s difficult for multiyear lands to renew as one year deals. And as renewals become a bigger portion of the business, which for us it is, this creates a headwind to CRPO. And given where we are with respect to our high gross retention rates, one year deals provide us the opportunity to expand within the customer to drive bigger bundles.

Two, with the expansion and cross-sell sold co-terminus to existing contracts, these are often less than one year in duration. So our expansion business has been — as our expansion business has been increasing, as evidenced by our net new retention rate, this would have pressure on our CRPO. And finally, on duration, we do have some usage-based deals. It could be MSSPs, the vast majority of MSSPs or uses based, and those are built monthly. And as MSSPs become a more rapidly growing part of our business, that’s going to impact cRPO as well as noncommitted consumption billings in cloud. And then finally, just to comment on ARR. You pointed out that’s how we run our business. ARR, though, is really an X-ray into the contracts themselves. And as we view that as the most important — or most transparent metric into the outlook for our business, that’s the one where we’re focused on.

So, hopefully, that gives some more clarity on how we think about cRPO and ARR.