In case you missed it:

As a reminder, earnings “snapshots” are very brief 30,000 ft. views of quarterly results. Earnings “reviews” are the detailed summaries. I am working on finding time for three catch-up reviews this season (CRM; XYZ; SE). I hope to have a full review of the On Running quarter included in Saturday’s article. The other three will be published in the coming weeks as things slow back down.

Demand:

Profits & Margins:

Balance Sheet:

Guidance & Valuation:

Gitlab trades for 83x forward EPS guidance. EPS is expected to fall this year due to large tax rate change headwinds before rising by 54% the year after.

Demand:

Profits & Margins:

Balance Sheet:

Annual Guidance & Valuation:

Okta trades for 32x its forward EPS guidance. Guidance implies 13% Y/Y EPS growth for this year. Analysts expect 6% EPS growth the following year.

Demand:

On Running beat revenue estimates by 2% & beat guidance by 5%. Direct to consumer (DTC) revenue beat by 2%. Wholesale revenue beat by 2.5%.

Profits:

Balance Sheet:

Guidance & Valuation:

On trades for 48x 2025 earnings estimates, which should be stable following this report. EPS is expected to grow by 26% this year and by 36% next year.

Demand:

Profits & Margins:

Balance Sheet:

Valuation:

The company trades for 38× 2025 EPS. EPS is expected to grow by 82% this year and by 29% next year.

CrowdStrike is a cloud-native endpoint cybersecurity company. It competes directly with SentinelOne, Microsoft Defender and Palo Alto. Its bread-and-butter is called endpoint detection and response (EDR), which replaces legacy anti-virus (AV). Beyond EDR, it offers applications in cloud security, log management, forensics, identity, data protection etc. to round out its “Falcon Platform.” Falcon’s edge is in its ability to digest near-endless amounts of data to automate and uplift breach protection. CrowdStrike uses its large and diverse dataset to constantly improve Falcon’s efficacy and use cases… all with a single console and single agent to ensure superior interoperability. It can recycle this same data over and over again to efficiently develop new products for a single interface. More utility without adding complexity or cost. More margin-accretive cross-selling too.

Important Endpoint Security Acronyms:

Important Log Management Ideas & Acronyms:

CrowdStrike’s security data lake is a vital complement to every single product it offers. It uses log scale to ingest, logarithmically organize and store data. Broader data ingestion means better breach protection, as Falcon’s products are more properly trained on larger sets of relevant insight. CrowdStrike also says customers get lower cost and faster querying speeds with it. This allows for ingestion with more scale and faster time to value.

Important Cloud Security Acronyms (alphabet soup, I know):

In the realm of GenAI, Charlotte AI is CrowdStrike’s security copilot. It levels up the capabilities of security analysts by actively detecting anomalies, orchestrating remediation and fixing issues in an automated fashion. It’s a force multiplier for efficiency gains in a world where most companies are starved for more security resources and talent. All of this pushes beginner-level security analysts to much higher levels of capability.

Falcon Flex:

Falcon Flex is CrowdStrike’s selling program to bolster customer “flex”ibility over product purchases. It allows clients to pay for only the modules they need as they need them. There are no pre-set commitments and no mandated usage; they can run through credits at their leisure. This will be the firm’s main go-to-market strategy going forward, as it has shown to lower cross-selling friction, raise deal size and create stickier customers.

CrowdStrike incurs virtually all client costs when it onboards its first module with a new customer. Subsequent model purchases are essentially pure margin for it. As the trends above remain positive, the margin trends below will too. That’s not currently happening because of contractual concessions related to the July 2024 outage, but this is temporary (as laid out in the guidance section).

GAAP operating expenses included $50M in Adaptive Shield M&A charges and $21M from the July 2024 outage. Excluding these temporary expenses, GAAP EBIT margin would have been -1.3%. FCF margin would have been 24.7% without the $21M outage cost.

Note that CrowdStrike changed its effective tax rate assumption to 22.5% for the new year as it continues to ramp profitability. That lowered annual EPS guidance by $0.98. At the same time, it removed stock comp-related payroll tax from its non-GAAP EPS figure. This raised EPS guidance by $0.16. Excluding both of these items, EPS guidance would have missed $4.43 estimates by $0.22.

For FY 2026, CrowdStrike has incrementally more visibility in NNARR acceleration during the 2nd half of the year. It told us this would happen last quarter and it’s now more confident. This is related to strong Falcon Flex uptake described later in the piece. The faster growth is expected to lay the foundation for even more acceleration in FY 2027. It also sees FCF and EBIT margin recovering towards pre-outage levels during the 2nd half of this year. Specifically for FCF, it thinks it will exit FY 2026 at a 27% margin and re-surpass 30% in FY 2027. This is related to $73M in non-recurring expenses from customer commitment packages (CCPs) (more later) that will go away by Q3 of this year.

It reiterated reaching an 83.5% subscription GPM, a 30% EBIT margin and a 36% FCF margin by FY 2029. It also reiterated surpassing $10B in ARR by FY 2031. Based on the multi-year contract nature of its operations, I take its longer term forecasts more seriously than I would for other business models.

“We entered the new fiscal year with a healthy pipeline as we continued to see robust demand for both prospective and existing customers.”

CFO Burt Podbere

As a reminder, last July, a software update error led to a global outage caused by the company. That fostered considerable blowback against CRWD and the creation of its “Customer Commitment Packages” (CCPs). CCPs offer temporary contractual concessions to customers, such as discounting, extended free trials, comped modules and free professional services help. It’s their apology. CrowdStrike hoped customers would choose more products over extended free trials. Why? Their best-in-class customer service scores and product efficacy (as measured by 3rd parties) made them exceedingly confident in free modules turning into more paid adoption when CCPs expire later this year.

A few quarters into the CCP program and it is working exactly as planned. Clients are predominantly opting into Falcon modules and positioning the company for easy up-selling as we move towards Q3 & Q4. This is when the company will finish working through existing CCPs; it ended new CCP issuance this quarter. 

The initiative is “accelerating the overall opportunity” CrowdStrike has with each client. It’s making this past quarter the beginning of a “comeback story” in the eyes of Founder/CEO George Kurtz.

A lot of the CCP success can be seen within Falcon Flex, which is the mechanism CrowdStrike offered CCPs through. This quarter, Flex deal value rose 80% Q/Q and 10X Y/Y to reach $2.5 billion overall. Importantly, a lot of this growth is cannibalistic rather than incremental, as existing customers opt into this newer, easier means of consuming modules. So then why does this matter so much? Falcon Flex customers use an average of 9 modules. This compares to just 21% of its overall customer base using 8+ modules. Flex customers land bigger, consume more of Falcon and accelerate CrowdStrike’s push for platform consolidation. It minimizes friction associated with purchasing new modules by allowing customers to simply say they want to add something. CrowdStrike can seamlessly provide it, rather than requiring a formal procurement period. 

Customers seem to be loving this means of buying, as most of them are comfortably ahead of consumption plans in their given contracts. That should mean more usage-based revenue and larger deals in the future. It’s this outperforming engagement and the stickier deals Flex generates that increase leadership’s confidence in the aforementioned NNARR acceleration.

For the year, CrowdStrike did about $80 million in CCP deal value. This was larger than expected, which it views positively based on the demand being for more company products. More CCP deal value than expected means a larger gap between actual ARR and what ARR would have been in normal times. But it still also means more revenue overall for a given period. This is why the $30 million expected revenue headwind from the program was smaller than expected and immaterial. This led to the revenue beat.

It’s important to separate near-term headwinds via CCPs from recovery signals as we distance ourselves from the program. 41% Y/Y RPO growth and increasing confidence in accelerating NNARR are great examples. Another is CrowdStrike closing $6B in total contract value in FY 2025. It is the first pure-play software cybersecurity company to ever reach that number. These are the metrics that tell me it will be business as usual as we move into the later parts of this year.

Platform Adoption:

CrowdStrike’s cloud security business grew ARR by over 45% Y/Y to cross $600 million. While many vendors are great at configuration analysis and hygiene, most struggle with cloud runtime protection. CrowdStrike’s Cloud Workload Protection (CWP) product is the tool that actually stops breaches in the cloud. That’s true across models, data centers, apps etc. This quarter, cloud landed an 8-figure deal with a financial services holding company to supplant a “network security vendor’s multi-platform offering.” They wanted simpler operations, lower costs and better outcomes. Enter Falcon. Notably, CrowdStrike Financial Services (CFS) (its financing division) was used here to expand the overall deal size. And as a relevant aside, CFS had an immaterial impact on FCF margin this quarter, as expected, as the initiative crossed $140M in financing.

Next, the Identity business reached $370 million in ARR and grew by over 20% Y/Y. It integrated its Adaptive Shield M&A (now called Falcon Shield), which had a de minimis impact on ARR. For review, CrowdStrike bought Adaptive Shield to expand its identity security suite. Falcon is comprehensive in on-premise identity-based security and active directory, but has been a bit less advanced in SaaS-level identity security. This gives them that SaaS muscle to provide what it calls the “only platform to unify Cloud & ID security with integrated SaaS protection. Specifically, Adaptive Shield provides SaaS Security Posture Management (SSPM) to identify improper hygiene and misconfigurations for cloud-based software. This asset will also be used to augment its endpoint offerings and help give CrowdStrike the “broadest” CNAPP suite in the market. It helps everywhere.

CrowdStrike allocated more time to its exposure management business than it has in any previous earnings call. When this happened with cloud, identity and SIEM, it marked the impending explosion in demand for each segment. Perhaps exposure management is next up. The company sees a clear “line of sight” to $300M in ARR for this product, and thinks its vulnerability management tools are second to none. These tools help hunt, flag, prioritize and resolve misconfigurations, improper permissions and poor hygiene throughout a company’s tech stack. 

The unsung hero of the overall platform and its various pillars is SIEM (already defined). This is what makes scalable data ingestion usable for all of its products. It is the only way CrowdStrike can collect and utilize all needed context in one place to stay ahead of adversaries. It is the oil to the company’s breach protection engine across endpoints, cloud workloads and more. Without SIEM, XDR doesn’t exist, CrowdStrike’s ability to recycle data for seamless cross-selling doesn’t exist and its best-in-class platform consolidation prowess doesn’t either. This is why SIEM grew 115% Y/Y to reach $330M in ARR. Falcon SIEM landed a major U.S. airline this quarter in a QRadar displacement (the vendor Palo Alto bought from IBM).

Cloud, identity and endpoint suites protect all company surfaces and assets. Its Charlotte AI assistant ensures more tedious work is automated than would be with the competition. Its SIEM product guarantees all of these other products are trained and seasoned on massive amounts of organized and relevant data. This has created a powerful recipe for vendor consolidation as Falcon realizes its vision of offering an end-to-end security operations center (SOC). Flex is merely accelerating this momentum. 

Here are some fun stats:

“The data tells me that customers trust CrowdStrike, partners trust CrowdStrike, and the market trusts CrowdStrike. I opened by saying everyone loves a good comeback story. Ours was forged by the trust of our customers, the dedication of our team, and the loyalty of our partners.”

Founder/CEO George Kurtz

Partner Momentum & Industry Recognition:

CrowdStrike became the first security vendor to cross $1 billion in sales on the AWS marketplace in a single year. This is just a little over 12 months after crossing $1 billion in cumulative sales there. Momentum is clearly strong, as growth for the quarter was over 40% Y/Y on a large base. Its first year in the Google Cloud marketplace netted over $150 million in deal value as it continues to focus on hyperscaler partnerships to grow deal size and shrink sales cycles. But it’s not just hyperscalers – CrowdStrike is nearing $1B in cumulative sales with global system integrators (GSIs) like Accenture and Deloitte, as nearly all of the major players work to build larger Falcon selling programs. Next, on the managed security service provider (MSSP) front, momentum remains palpable. As a reminder, this is how CrowdStrike accesses large chunks of small and medium business (SMB) clients without needing to pursue them one by one. For FY 2025, MSSPs delivered 15% of its new business.

All in all, partners procured 60% of the total business CrowdStrike added in FY 2025. Just a few years ago, it was thought of as a company that doesn’t work well with others. My, how that reputation has changed.

More than half of the press release was dedicated to listing all of the awards and recognition CrowdStrike secured this past year. Whether it’s perfect scores from SE Labs, leadership status from Forrester, Gartner, Frost & Sullivan and KuppingerCole or federal authorization in the USA and Germany, it’s clear that this firm’s reputation remains pristine following the July 2024 outage. That has a lot to do with how well the team handled a bad situation. Props to them.

AI:

Charlotte AI is becoming a “SOC analyst’s best friend.” Its detection triaging (prioritizing) is “accelerating response times” and helping it gain inclusion in over 100 Q4 deals. 

Detection triaging builds on a successful launch of its AI-generated parsers product last quarter. This pulls from GenAI models to automate data extraction and pattern creation from raw logs as data is ingested. Insights lead to new parser creation and parser enrichment from previous findings. This all means the process of data ingestion, processing and analysis is constantly improving and allows companies to find extremely subtle issues missed by analysts. That lowers false positive rates and helps in threat detection. As Kurtz puts it, Charlotte’s momentum is because CrowdStrike is delivering actual value through multi-step, agentic capabilities from Charlotte. For a European financial services company, it’s cutting 25-minute tasks down to 10-15 seconds.

Another relevant AI topic for CRWD is the technological boom accelerating the frequency of hacks. Simply put, GenAI lowers the bar for conducting sophisticated attacks. Per the CrowdStrike global threat report, state-sponsored adversaries in China are ramping activity by 150% Y/Y, with attacks across a wide range of industries. DeepSeek is simply expediting cost deflation, which means easier access for adversaries and makes demand for Falcon’s breach protection that much more needed. A more active threat environment is bad news for everyone except companies like CrowdStrike. Falcon Threat Graph and massive sums of data mean its own Agentic AI models are constantly trained on more data than the other guy to make sure the company is staying ahead. This is supporting demand for its incident response business, which enjoyed a banner quarter for brownfield wins. 

“A new wave of nationalism and threat actors is creating adversary stockpiling akin to the Cold War era.”

Founder/CEO George Kurtz

Lastly, like everyone else, CrowdStrike is using AI internally to make its teams more productive. This is already saving the company the equivalent of 24,000 annualized work weeks in time. Early days here.

All things considered, this was a very good quarter for the company. As I said in the earnings season preview, forward expectations got ahead of themselves as analyst forecasts raced higher. I think some forgot how material the outage reparations remain. That, paired with a raise in tax rate estimates, paved the way for the annual guidance disappointment. At its sky-high valuation multiple, it makes sense to see that modestly punished by Mr. Market.

This was never going to be a v-shaped financial recovery despite the stock price momentarily acting as if it would be. We need to get through contract concessions, which will happen towards the end of this year. Based on how well leadership handled things, how resilient retention metrics have been and how strong Flex momentum is, I think financial results will begin to resemble the CrowdStrike of old by Q4.

I was selfishly rooting for more multiple contraction, as I’ve kept aggressively trimming shares of this name as the valuation has expanded. I’m not ready to resume adding, but it is getting closer.

I continue to view this as the highest-quality name in cybersecurity and a generational company with a world-class CEO. It being a smaller piece of my portfolio than it has been since the IPO is not comfortable for me. I want more shares, but I am forcing myself to be patient.

On Autonomous Vehicles (AV):

A large chunk of time was spent reviewing the various obstacles to commercial AV ubiquity and how Uber can help with each of them. Whether it’s scaled manufacturing as hardware evolves, fleet operations and storage hubs, regulatory navigation, reliability and maximum utilization rates, it will help everywhere. To avoid redundancy, that commentary can be found here (section F). 

We did get a bit more color on how CEO Dara Khosrowshahi’s view towards Uber’s AV positioning is evolving. He is growing increasingly confident in there being a highly fragmented market with dozens of AV vendors and thousands of fleet operators. While massive sums of data and money were required for the first wave (as he put it) of AV proliferation, that’s changing. Through consistent cost deflation driven by DeepSeek, Meta and Blackwell’s vast performance gains, as well as the rise of synthetic data generation, the 2nd wave of AV players is much larger, moving faster and doing so more cheaply. As a reminder, synthetic data generation (which Nvidia specializes in) allows companies to take one scenario and automatically spawn thousands upon thousands more scenarios. This vastly accelerates model training at much lower cost, as physical data generation is quite expensive.

Lower barrier to entry is the exact recipe required for fragmentation. Without it, needed resource allocation will only be possible for the richest of participants. This is evolving and that’s largely thanks to Nvidia (an Uber AV partner). Remember, Uber’s best-in-class network effect relies on fragmentation and avoiding a monopoly-like market structure. In that world, all vendors will need to opt into Uber to raise utilization rates and be competitive. That wasn’t necessarily true if Waymo or Tesla owned the entire sector. Great news here.

Using its Balance Sheet to Jump-Start AV Supply:

Uber was asked about its plans to own some cars at the beginning of this revolution to make sure there’s a critical mass of supply while it builds its partner roster and supports broad-scale deployments. Notably, it expects many of these deployments to happen in the USA and abroad this year. As I’ve said many, many times, there are far more players in this market than Waymo and Tesla. Those are simply the two that get all of the attention. Several more are coming soon.

As that happens, Uber does plan to hold some AV cars on its own balance sheet. I’m fine with this – especially considering the investment will represent a “small percentage” if its (rapidly growing) free cash flow. They will not drain the existing cash pile for this initiative. Aside from owning cars, it also plans to take some of the utilization risk within its fleet operator partnerships. This will look very similar to the utilization guarantees it offers manned fleet operators today, and it’s exceedingly confident in delivering on these promises for its stakeholders. Between owning some cars and lowering the financial risk of 3rd party vendors to grow their own fleets, that should expedite access. And notably, Uber sees that expediting as very positive for its business; it continues to envision AV as a clear opportunity to grow its overall market and extend its dominance.

Expectations vs. Analyst Day Targets:

Dara was asked which pieces of the business are outperforming the company investor day targets offered last year. His response? “The whole thing.” Works for me. In terms of sources of this outperformance, there are a few. First, the thriving membership program that we cover in detail is growing ahead of internal assumptions. Next, it’s finding more user growth than expected in non-tier 1 cities, as well as in Uber for Teens. It’s also taking advantage of relative under-penetration in markets like Germany and Spain, where the opportunity remains extremely early. Finally, its high-end products like Reserve and low-end products like Share are both proving to be more incremental to overall usage than expected. All of this is supporting core business growth in the mid-to-high teens on a massive base and with increasingly strong margins. They remain fully confident in meeting their multi-year targets. As a reminder, these targets include a nearly 40% FCF CAGR from 2024-2026, with the company trading at 20x 2025 FCF expectations.

At the same time, Dara wants the company to do a better job on controlling cost inflation. Some natural tailwinds like slowing insurance premium inflation will help (especially in California), but it also wants to keep focusing on building out its Uber Share product too. This is currently losing money and is a large logistical headache. If done well, Uber thinks it will be the only company and option besides a public bus to solve this problem at scale. It’s making great progress on its demand forecasting algorithms for this product.

Final Notes: