Q4 revenue guidance missed by 2.8% while $2.50 Q4 EPS guidance missed by $0.14. It lowered annual growth forecasts from 10% Y/Y to 9% Y/Y. It raised its annual EPS guidance by a penny due to the Q3 beat.

EPS is expected to compound at a 16% clip over the next two years.

EPS is expected to compound at a 19% clip for the next two years.

CrowdStrike is a next-gen, cloud-native endpoint cybersecurity company. It competes directly with SentinelOne, Microsoft Defender and Palo Alto. Its bread-and-butter is called endpoint detection and response (EDR), which replaces legacy anti-virus (AV). Beyond EDR, it offers applications in cloud security, log management, forensics, identity, data protection etc. to round out its “Falcon Platform.” Falcon’s edge is in its ability to digest near-endless amounts of data to automate and uplift breach protection. CrowdStrike uses its large and diverse dataset to constantly improve Falcon’s efficacy and use cases… all with a single console and single agent to ensure superior interoperability. It can recycle this same data over and over again to efficiently develop new products for a single interface. More utility without adding complexity or cost.

Important Endpoint Security Acronyms:

Important Log Management Ideas & Acronyms:

CrowdStrike’s security data lake is a vital complement to every single product it offers. It uses log scale to ingest, logarithmically organize and store data. Broader data ingestion means better breach protection, as Falcon’s products are more properly trained on larger sets of relevant insight. CrowdStrike also says customers get lower cost and faster querying speeds with it. This allows for ingestion with more scale and faster time to value.

Important Cloud Security Acronyms (alphabet soup, I know):

In the realm of GenAI, Charlotte AI is CrowdStrike’s security copilot. It levels up the capabilities of security analysts by actively detecting anomalies, orchestrating remediation and fixing issues in an automated fashion. It’s a force multiplier for efficiency gains in a world where most companies are starved for more security resources and talent. All of this pushes beginner-level security analysts to much higher levels of capability.

CrowdStrike crossed $4 billion in annual recurring revenue (ARR) in record speed for pure-play cybersecurity companies during the quarter.

It’s great to see gross revenue retention (GRR) stay resilient following the July outage. That goes to show how sticky, beloved and valuable this platform truly is. Customers stayed with them. While it did fall a bit Q/Q and Y/Y, that’s as expected and 97.5% remains great.

Q4 Guidance:

CFO Burt Podbere offered extremely rare commentary on sell-side analyst forecasts for Q4. He never does this. He hinted at these estimates being too high, and needing to bake in more prudence. While that’s never great to hear, I think this is solely a matter of CRWD leaning overly cautious in the wake of uncertainty. It always guides conservatively and this summer’s event makes doing so a lot more appealing. Customer commitment packages (CCP) (more later) are creating up-selling and revenue retention headwinds and overall revenue visibility remains limited. While it’s very encouraged by how customers are reacting to CCP (going with more product over free trials), CrowdStrike did not want to assume this would continue in Q4. It’s essentially baking in a sharp negative divergence in customer behavior with no data-driven reason for doing so. Meaning? I think it’s just setting itself up for another quarter of large outperformance.

EPS is expected to compound at an 18% clip for the next two years. This is one of the most expensive names in markets, but that’s largely related to the July 2024 outage greatly holding back results through most of next year. EPS growth is expected to accelerate back towards 25%-30% Y/Y thereafter (so still expensive).

So far, the Flex and CCP responses to the July 19th outage are working exactly as planned. Again, customers are choosing more product over extended free trials. This is so immensely important. Why? It means CrowdStrike is becoming an even stickier, more leaned-on vendor for these companies, which will be great for retention, lifetime value and every piece of its financial statements. Its post-July approach is accelerating vendor consolidation and its overarching platform push by incentivizing customers with more favorable per-product terms. Over the long haul, these favorable terms will fade away, while we’re left with an even more mission-critical cybersecurity platform doing more revenue per client.

It’s hard to overstate how well leadership handled the large blunder from this past summer. CrowdStrike shaped its concessions in a way that turned this into the most positive thing it could possibly be. The accountable response is night and day compared to how others like MSFT and Okta handled issues in the past. CrowdStrike’s c-suite is full of stars who made customers feel supported and taken care of. It’s no coincidence that these customers now feel inspired to take care of CrowdStrike and do even more with them.

“We saw incredible success with our customer commitment packages as customers embraced the program and chose to deepen their relationship with CrowdStrike.”

CFO Burt Podbere

Quantitatively speaking, the CCP hit to net new ARR was $25 million as expected, while 50%+ of the deals that were delayed from the July blunder have now been closed. Total deal value (TDV) from Flex rose from $700 million to over $1.3 billion Q/Q as CCP accelerated deal velocity.

And we have more evidence of CCP and Flex working as planned to create more reliant CRWD customers and a larger long-term opportunity. An average Flex customer uses 9 modules, which is over 2x the rate of an average customer. Relatedly, the flexible bundle solutions across endpoint, cloud, identity etc. are materially expanding wallet share. Favorable customer terms are pushing enterprises to race to adopt more CRWD products while these terms remain in place. And again, discounts will eventually disappear… the clients won’t.

All in all, Flex customers are delivering a couple million in ARR, which is roughly 10x larger than its overall customer base. Management is confident in Flex growth accelerating, which supports its optimism in a back half of calendar 2025 ARR re-acceleration.

Still, there are negative impacts from the outage to discuss. GRR fell from roughly 98% to 97.5% while net revenue retention (NRR) continues to be below its 120% target, with a 115% result this quarter. Both are directly impacted by discounting, free trials and a 15% Y/Y sales cycle elongation stemming from the July event.

CrowdStrike bought Adaptive Shield to expand its identity security suite. Falcon is comprehensive in on-premise identity-based security and active directory, but perhaps a bit less advanced in SaaS-level identity security. This gives them that SaaS muscle to provide what it calls the “only platform to unify Cloud & ID security with integrated SaaS protection. Specifically, Adaptive Shield provides SaaS Security Posture Management (SSPM) to identify improper hygiene and misconfigurations for cloud-based software. CrowdStrike’s willingness to spend $300 million indicates more confidence that the residual liability of the July outage is manageable.

Adaptive Shield’s SSPM “leadership” is also expected to augment endpoint protection, and its CNAPP suite. Specifically, leadership thinks this gives them the “broadest cloud security coverage” in the market. From cloud-native code to data and apps, CrowdStrike now offers a holistic cloud suite that doesn’t just help with hygiene and configuration (like many do), but actual runtime protection (a lot more rare today). Many of the needed integrations from this purchase have already taken place.

CFS is CrowdStrike’s internal financing division. It closed $49 million in deal value and contributed multiple 8 figure deals as well. One of these deals was for SIEM and carried a seven-year term as a direct result of CFS. This product is helping CrowdStrike “align with CFOs” more tightly than ever before. CFOs love minimizing cash outlays, like financing helps to accomplish.

While CrowdStrike isn’t using the “Agentic AI” term like every other peer is, it thinks it set the trend and innovation curve here. Charlotte AI is “not just a chat bot.” It’s fully able to take complex, multi-step remediation action on behalf of security analysts. It’s equipped to do this in an autonomous, goal-oriented way that requires virtually no customer coding or concrete instruction. This capability is guided by CrowdStrike’s gigantic threat graph and the trillions of security events in that system of record to train Charlotte AI and drive genuine model inference. Just tell it what you want… and it will deliver. As a needed caveat, these use cases are still somewhat limited but continue to rapidly proliferate.

For one customer, Charlotte AI cut time to create security reports from 48 hours to 1 hour. That helps explain why Charlotte AI continues to enjoy 100%+ Y/Y growth (still probably a small revenue base).

As announced at Fal.Con, CrowdStrike debuted AI-generated parsers for data log management. AI parsers pull from GenAI models to automate data extraction and pattern creation from raw logs as data is ingested. Insights lead to new parser creation and parser enrichment from previous findings. This all means the process of data ingestion, processing and analysis is constantly improving and allows companies to find extremely subtle issues missed by analysts. In turn, that lowers false positive rates and helps mightily in threat detection, software performance optimization etc. This up-levels a customer’s ability to seamlessly use their data in the Falcon environment, or, as Kurtz puts it, just makes ingestion “easier and better.”

“We do AI for security and security for AI… Much like peer companies such as ServiceNow and Salesforce, we're using advanced AI models to deliver proactive and autonomous outcomes.”

Founder/CEO George Kurtz

70% of all net new ARR this quarter was partner-sourced. Its work with global system integrators (GSIs) and cloud titans like AWS is working quite well. Specifically, AWS deal value rose by over 100% Y/Y. It has done $1 billion in total deal value through AWS since inception of this partnership, so the revenue base here is not that small.

It also announced a new partnership with Fortinet to combine that firm’s firewall-based network security approach with CrowdStrike’s endpoint suite. Fortinet is likely feeling the need to match product expansion from other firewall vendors like Palo Alto. This is an easy way to do that for them, and has already yielded more deal inclusion for both new partners. While software and zero trust are replacing a firewall hardware-based approach for network security, there is still revenue to be enjoyed from this aging technology. Finally, its managed security service provider (MSSP) program enjoyed 100%+ Y/Y growth. SHI (IT service provider) became its 4th MSSP to cross $1 billion in deal volume.

All things considered, I thought this quarter was admirable. Despite CrowdStrike’s elite technology (the outage wasn’t a security breach) and go-to-market engine, July could have turned into something far worse. It could have been a massive balance sheet drain… it could have permanently diminished company trust… it could have durably impacted CrowdStrike’s world-class financial engine. But none of that is happening. Why? George Kurtz and Burt Podbere (and the whole team) are fantastic at their jobs. As I said earlier, they took a terrible situation and made the absolute best of it. They took spoiled lemons and made decent-tasting lemonade.

As I said in the portfolio earnings preview, I was quite cautious heading into this quarter. The outage does hurt visibility and near term results, yet the multiple had already raced back to multi-year highs. I am eager to add back more shares that I sold near $400 in June (lucky timing and a reaction to multiple expansion) and near $300 in July. This remains one of my biggest winners since inception; I’d love to again own a lot more of this special company at more reasonable multiples. It isn’t there today.