CrowdStrike Holdings, Inc. (CRWD) Earnings Call Transcript & Summary

All right. We are live, and I see Burt on. Burt, if you could -- if you're still on and could turn on your camera. There you are. All right. There we go. We're all here. Okay. A little bit of a -- skipped a couple of heartbeats there, but I think we're good to go. So I'm Walter Pritchard, software analyst here at Citi. Happy to continue the afternoon session with Burt Podbere, who's the CFO of CrowdStrike. And I think we have somebody coming through with some noise on the line. If we could just mute if you're not speaking. So Burt, thanks for joining us here. Appreciate you very much spending the time.

Great to be here, Walter. Absolutely.

All right. So I guess, wanted to start out with a common theme that we've been exploring through this conference, has just been the environment we're in, sort of how it's impacted businesses. And I think more importantly, sort of how we think -- how companies see things progressing going forward. I think you've reported a couple of quarters now within this COVID landscape, including a pretty strong Q2 that you reported last week. So maybe just give us a little bit of a recap in terms of what you've seen in the environment relative to COVID, and then we can spend some time talking about how you think it will play out from here.

Sure, absolutely. Good question, Walter. So COVID, for sure, has changed the threat landscape, obviously, with folks needing to work from everywhere and not going into the office. That's allowed the adversaries to kind of zoom in on areas which are not as well protected as the old traditional office situation. So for us, the way we see things and what does that all mean for us, it means that companies can no longer keep their digital transformation plans on the sidelines. And in order to safely enable digital transformation in a distributed environment like we're in today, they need to transform their security. So it's almost like -- it is the fact that security transformation becomes that prerequisite to digital transformation in this distributed environment. And as the adversaries, they're continuing to get more effective. They don't sleep. They don't eat. They're coming at you with more sophisticated techniques. You need security that's going to be able to block those and to identify those even in a distributed environment where people are using different machines than they used to and different devices and working from different [indiscernible]. And in order to do that, it's -- you're going to need something that can be fully [indiscernible] [Audio Gap] so I think the landscape, the threat, the attack surface area has increased, and you're going to need technology that's going to be able to enable this security transformation that I just talked about.

Got it. And so how do we -- I think the performance so far and the impact so far have been pretty clear. How do you see this playing out over the next 6, 12 months? I mean, you've given guidance through the end of the year, so there's a set of scenarios that are embedded in that forecast. But I think you have a couple of things. You have the changes that it's accelerated in the security landscape. And then obviously, the macro environment is more challenging than it was a year ago. And I think that's having some impact on IT spending overall. But would love to get your perspective on sort of how you thought about the rest of the year and sort of into next year qualitatively with that backdrop?

Yes. No, for sure. So first, I think that with COVID, there's been some puts and takes, right? So on the one hand, you're seeing this acceleration towards security transformation, digital transformation, for sure. On the other hand, you've seen impacted industries which have cut back on budgets for obvious reasons. To the extent for us personally, and we baked this into our guidance, is that we've got a very small percentage of our business is related to those impacted industries [Audio Gap] we're making [indiscernible] we talked about one on our earnings call with an airline. They still need to have security. And the beauty for us is even as potential budgets are shrinking, the amount of dollars that are going towards security, specifically, they're actually increasing. And then when you throw in the fact that CrowdStrike is able to consolidate a variety of different tools and technologies, at the end of the day, we're able to offer customers an ability to save money. So it's one of those situations where you've got a company that can come out and protect you wherever you are, a company that can deploy immediately with time to value immediately. And ultimately, you can spend less overall with respect to a company like us, that acts as a consolidator for all of these different technologies. When we think about this year, we've talked about the guidance, and I'll talk about it in a minute where I think the opportunities are and where the growth is, not only for this year but the years to come, but I think that you've seen the history, which we've been able to, in our minds, have a phenomenal quarter in Q2 with strong momentum going into Q3. And there are a few things that I think about in terms of the growth engines that are out there for us and will be out there for us for quite some time. We've talked about the digital transformation and the prerequisite being security transformation in a distributed environment. The second one is the expansion of TAMs, right, as we come out with new modules, we've had a pretty good pace, 1 or 2 a year, that allows us for further consolidation with respect to how a customer sees their overall spend. Three, I think, and I'm sure we'll get to it as well the competitive environment. It's -- we're in a really good spot with respect to where we sit with our competitors. Whether you take the 3 big incumbents in the security space, whether it's Symantecs, Trends and McAfees, you see this huge opportunity for us in terms of there's been some consolidation already in the space with Broadcom buying Symantec and the ability to start to continue to take share for years to come with respect to how they're going to market and what they said they're going to do and what we're actually seeing in the field. So really opportunistic in terms of a competitive environment today. And then finally, it's the durability of the business model. We're mission critical, strong leverage from our platform. It's that single agent. It's that data-driven platform. It's that ease of use [indiscernible] that allows us to scale rapidly. All those things that we've placed bets on years ago are coming to fruition right now. And so that's how we think about the environment for not only the rest of the year but for next year as well.

Got it. And maybe we could use the first couple of quarters here that we've seen in COVID as sort of a test case. But you've mentioned a number of factors that have driven the results that you've seen, competition, the mission criticality and TAM expansion and so forth. When you look back at the last couple of quarters and what's been upside in both quarters to your forecast, which of those factors would you attribute as having delivered most of the surprise relative to what you were thinking?

Yes. So I think this acceleration of the deterioration of the perimeter and companies recognizing that, that has been [indiscernible] [Audio Gap] CIOs and CISOs kind of leaning in and saying, "Hey, we need to think differently about our refresh. So as companies think about the traditional refresh, whether it was 3 years or 5 years, they're no longer thinking of a faster, stronger box. They're thinking about digital transformation and, of course then, security transformation and thinking about the renewal very, very differently. And so for us, I think that's been a really big contributor to what we've seen not only in the past couple of quarters, but certainly in -- as we think about our momentum in the pipeline that I indicated even on our earnings call, which is really, really strong going into Q3.

Great. Burt, just one thing here on our end. We're having a little bit of, at times, with your audio. I know you look great there. Maybe we could have you turn off the video for a second and just for a little bit here, see if that improves things and then -- because the audio, which is more critical is -- yes, there we go. Okay. So let's keep going. And so on that end, I guess, as you think about the competitive landscape. You brought that one up and let's address that one now. I think some of the conditions in the market around these competitors not performing as well as they have been were in place pre-COVID, and then you have this environment change. How do you look at the combination of those 2 factors? Or has the just sort of stand-alone competitive landscape just become much more favorable on its own in the last, say, 3 or 6 months?

Yes. So clearly, we're getting a lot of tailwinds from the competitive environment stand-alone, Walter. I think that we've seen not only the incumbents be bought or have that inability to innovate. But also the next-gen players, right? So a few of those have been picked off as well and been consolidated into other groups, and they're finding it to be a tough time. And so for us, we see that whole group, whether it's the next-gen players or the incumbents, really struggling, right? And for us, we think it's a really opportunistic time to take advantage of that. And we have. And you've seen it in the numbers in the first quarter and second quarter with the over-performance. And I think that, that's not a onetime effect, I think, Walter. That's for years to come, right? I think that the -- if you take a look at just our customer base, so we reported that we had just over 7,000 customers. That's great. We're really happy with the 7,000 customers. But when you think about the number of customers just on Symantec alone, pick a number, 100,000 that are B2B, 150,000 B2B. Great. They said they're going to protect 1,500 of those. And so that gives us this whole bolus of opportunity, I call it greenfield even though it's not technically greenfield. But it's greenfield for us because those companies are now up for grabs, right? And those customers are up for grabs and we're going to go after them, and we've seen some of the impact on our numbers to date. And that's something that's going to go on for years. So we're really excited about that. Our competitors, who have been coming up through the ranks, we're seeing them having traditional earlier-stage challenges, and especially since they weren't born out of the cloud. They had different technologies that they've tried to slam together. That's really, really hard when you are looking at a customer who is looking for simplicity. Simplicity, efficacy, cost, all those things really come into our wheelhouse. And so unless you were born in the cloud, you have that 1 single agent and you have that dynamic technology at the endpoint, then you're already behind the eight ball. And so for us, I think that's a huge part of why you're seeing us put the numbers on the board that you're seeing.

Got it. And how universal would you describe the success competitively? Is it disproportionate with certain competitors? Or would you say it's pretty broad?

It's definitely pretty broad. Like obviously, we've seen more of the Symantec trends and McAfees because their installation base was so much bigger. And then -- so it really comes down to how big they are going in, in terms of how many customers they have, in terms of how many we're taking away and displacing. But we're seeing it even in the next-gen, as I said. Like we're seeing that some of the next-gen folks that got gobbled up, it's tough, right? When you're a company and you acquire a security company, this is not a commodity. It's not easy. I defer to you, Walter, you've been in the space as long or longer than me. I haven't really seen a successful security company been acquired and really smash it out of gates. It's really tough to do that. And so for us, we've been taking advantage of that, right? The integrations that aren't working for some of our competitors, the multi agents that they have that they're trying to slam together, and their go-to-market, right? All those things are not just going to happen out of the gate. And so for us, we've stayed true to how we've been successful, and so far, it's worked.

Got it. Makes sense. And then when we start thinking about, I guess, just the dollars involved, there's, to some degree, a replacement sale that you're doing for some of these competitors. And then you're bringing -- you're obviously bringing more to the table. Otherwise, the customer wouldn't be choosing you. They'd be sticking with what they have. Can you talk about sort of the typical sort of dollars to CrowdStrike on a deal that was primarily replacement with you bringing these additional technologies? And just trying to baseline sort of how we might think about the endpoint TAM for CrowdStrike versus what has traditionally been an endpoint TAM that some of these players have been a part of?

So first, I'd like how you phrased it with endpoint TAM. So that's #1 in the message we're trying to get across, is that we're not just -- it's an endpoint security TAM. We are an endpoint TAM. And we've talked about it with -- even last quarter when we talked about our IT hygiene module that's in the SecOps world and how we're playing in that market as well. So for us, when we think about the rip and replace kind of that old type of phrase, the good news is that we're going into one of those customers and we're showing them the breadth of our lineup, right, the 11 modules that we have to offer. So it's not just out of the gate, we're just replacing the prevention, for example, with a Symantec. I mean, it's going to be a lot more than that. And that's what we're seeing across the board when we think about our module adoptions. We've reported the numbers, and you've seen how strong they are in 4- and 5-plus modules that are being adopted by our customers. A lot of those are new customers to us, right? A lot of those are coming out of the gate, buying 3, 4 or 5 modules, all at once, right? That's their first purchase. So we're definitely seeing larger lands come into play. We're excited about that because we feel that we're offering more value to the customers. But the beauty is that we've still got a whole bunch of customers within our customer base that only have 4 and maybe only have 5, and we have that opportunity to sell in the fifth, sixth, up to 11th today. And so what we're seeing out of the gate is larger, bigger deals just on -- across the board. And that's because of this whole ability for us to show the consolidation of spend.

Got it. Makes sense. And then how do we think about, on the cloud side, I think you've talked about 50% of your customers are using that product. That market is pretty early. Lots of small players there. How should we think about -- I think TAM is tougher to discuss there, but sort of what those customers could mean for you from a dollar perspective, especially relative to what they're paying you for, say, the endpoint suite of products?

Yes. No, that's a great question. And also, I think that, that is true greenfield, right, the cloud workload opportunity. And I think Crowd's in it is -- has been underappreciated, right? I mean, we talked about the fact that we protect over 1 billion unique container instances on a daily basis and that business is growing. And you think about our earnings call when we talked about Zoom, there's the quintessential cloud workloads that we're protecting. I see that as a huge opportunity. I think -- if you think about the traditional types of endpoints, whether it be a laptop, server, desktop, that represents X, whatever X is of an opportunity in dollars. Well this could be 10x? I mean, it's hard to say where -- what that number is ultimately going to be. But the beauty is, we're right there and we're able to protect both. And how we price is also I get excited about because we're offering customers metered billing. So if they know they're going to use an instance and it's only going to be up for a very short period of time, great. Or we can offer packages where there's a baseline and you pay for that. So I think that the good news for us across the board is the fact that there's this massive opportunity beyond just new modules, but it covers all of our customers. We've got a customer in play today, for example, in terms of how -- trying to give you a sense of how big that market is. We got a customer that we're dealing with today, where we came in -- it was a decent-sized customer, about 150,000 traditional endpoints. And our sales rep went in there and they actually saw that they had 1 million workload opportunities. And he came back and said, "Well, okay, well it's almost 10x what we thought it was going to be when we went in." And yes, it was a technology company that we were dealing with. But you can see the power of what that multiplier effect could be with respect to how many workloads we end up -- we can end up protecting. So that should give you an idea of the size and the scale that could be in front of us.

And how much can you leverage the -- you have these sort of suites that you go to market with in the endpoint space that are just kind of very logical progressions of additional functionality that you layer into the endpoint. The cloud sometimes can be a different buying center. Developers are involved. How much have you been able to leverage your existing sort of go-to-market channel and your relationships on the endpoint side versus how much of that is some element of a new sales cycle that new buyers and so forth?

It's actually less so about new buyers as opposed to new workloads to protect. The folks that are in charge of protecting, from a security perspective, protecting the environment are the same, whether it's in the cloud, whether it's a cloud workload or whether it's a traditional endpoint. And it goes back to the company -- what are companies looking at? What's the outcome you're trying to solve? You're trying to solve to stop the breach, right? So the same people that are saying, "Hey, I'm out there protecting the breach from your traditional endpoints," are the same folks that need to protect the breach against wherever your workloads are. And so the good news is it's generally -- it's not in all cases, but for the most part, it's generally the same buyer. Where we see buyers being a little different is the traditional security buyer versus the SecOps buyer. Those could be 2 different groups, IT ops versus security ops. But the good news is, likely, in many cases, they roll up to a CIO, for example. And the beauty is, when the CIO takes a look at the opportunity to save money with respect to consolidation, they get excited about buying more of those modules upfront, which is what we've been seeing. And so I think that's how to think about it more than the cloud workloads versus the traditional laptop, desktop server.

Got it. And how are you thinking about the sort of mid-market commercial customer opportunity versus the enterprise? And in the mid-markets channels are more important and so forth, how developed is your mid-market strategy? And how far down market do you think you can go with your product line as it relates to almost SMB and so forth?

One of my favorite questions, because we sell to companies of all sizes. Last quarter, we had our second largest deal in company history with a low 8-figure deal. And in total, we landed 969 net new customers, which was a record for the company. And a lot of that volume comes from the mid-market and SMB space. So we're successful with companies of all sizes. What enables that is a true SaaS model that is easy to deploy and simple to manage. As a concrete example of that, our solution can be deployed 100% remotely and our agent doesn't even require a reboot. And I think that when we can do that, we start to show the separation between us and others. I think that when you see -- competitively, you see a company like Symantec purposely abandoning customers in the mid-market, and that will continue for years to come, I think that we have that even more opportunities to seize the day in terms of that mid-market space. And to be fair, even when I got here, which was about 5 years ago, we quickly embarked on the opportunity to go after the mid-market. When I got here, the vast majority, almost all of our deals were enterprise. And so we went into mid-market. We hired effectively. We hired a leader who knew how to get the mechanics and the muscle memory and the motion of how to sell to the market. And then we flighted our internal operations to take out friction in terms of how to go after mid-market, right? And that comes into the trial to pays or the in-app trials, where you've taken the friction out of the sales market -- the sales motion to enable us to go after that mid-market in a really, really effective way. Kind of like the sales wins model -- the sale win model, except that we're continuously attached to the user, so we know what they're doing, when they're doing it, when they deploy, how they're deploying, what the percentage of the deployment is. We have all this additional information that allows us to follow up with our customer in a meaningful way. How can we help you? We see you having been fully deployed. Is there something that you want to use our help with? So all those bits and pieces of information help us to strengthen our relationship with our customers.

Got it. And related to channels and go-to-market on the cloud side, the hyperscalers obviously see all the workloads because that's where the workloads live. And they have marketplaces and so forth. How is the go-to-market side, especially as it relates to the channel, different on the cloud side? And how successful have you been in terms of leveraging some of those potential partner relationships?

Yes. So to date, we've been really successful with our channel group, right? We're a channel-first company, as you know, Walter. Most of our deals, the vast majority of our deals go through the channel. The only time that we don't is on the customer's request, that they want to come direct. But most of our deals are through the channel. We're channel-friendly, and we've seen, obviously, success, and we've talked about our success with companies like AWS. But there are many others. We've got a very large VAR network, and we've got great alignment with our team -- feet on the street as well as our executive involvement in the VARs, to be able to help them, to be available to them. And we nourish them and we pay for their performance. So I think that the ability for us to leverage the channel has been one of our competitive advantages. And because we're friendly to the channel, meaning that we're going to pay for the opportunities that they bring to us and we're going to pay for teaming efforts, and we're going to pay for even if we -- even if they simply just help in the deployment, that's all good for us. And as we continue to nourish and bring on more partners, we think about the fact that we've got this huge opportunity now with the SIs, right? So to date, we haven't had any of those big 5 SIs and we've been able to accomplish what we accomplished without that. But now that we're of a meaningful size, SIs of the world, whether it's the big 4 or others in the accounting world, now, they're starting to have more -- the deeper and more relevant conversations with us. And now it's just all about finding the way that we can both win when we go to market. So I see a great potential for us in the future to strengthen those relationships and become strong partners with those traditional large SIs.

Got it. And I guess I just -- one of the reads I had from your answer is you spent more time talking about the traditional partner channel as it related to cloud than necessarily the cloud service providers themselves. It sounds like the marketplace -- is the marketplace kind of a place you have to kind of advertise and drive some awareness, but it really does come down to that channel that knows your product best that has a relationship with the customers in security that is important in cloud still?