As a reminder, I write these “brief” earnings snapshots on names that aren’t part of the core coverage network based on reader interest. The “detailed” earnings reviews offer much more thorough looks into quarters.

GitLab traded for 57x EPS heading into the earnings report.  Pre-analyst estimate revisions, EPS is expected to fall by 15% this year and then grow by 27% next year. Estimates will rise following this upbeat report.

IOT trades for 48x EPS. EPS is expected to grow by 38% this year and by 20% next year.

CrowdStrike announced the Cyber Superintelligence Lab as a research entity dedicated to blending AI adoption with sound security. It’s led by Dr. Bartley Richardson (who they just hired from Nvidia to run CrowdStrike’s AI programs) and will have some of CRWD’s $1B annual R&D budget. Kurtz thinks a lot of the work and investment thus far has been focused on product and general performance improvements. To him, more work is needed on developing security systems to guard assets going forward, and CRWD is all in.

Next, CrowdStrike introduced its very first family of models called SafeMind. They’re built using Nvidia’s Nemotron models (Jensen made an appearance) and trained on a boatload of sensor and outcome data flowing through the Falcon Platform. It’s that information, built on decades of effective scaling across a wide array of security use cases, that improves model quality for security use cases. That’s especially true because these models don’t need to be good at anything else, allowing CRWD to focus all efforts to maximize security talents.

Within this new family are two models. First is Red Tempest, which is an agentic threat hunter perpetually sifting for vulnerabilities to be exploited. This matches machine-speed attacks with machine-speed vulnerability management, helping customers keep up with and prioritize patch work backlogs. While Red Tempest is described as CRWD’s agent-based proactive offense, Blue Solano is the response-based defense. It’s responsible for stopping breaches as they pop up. Both models constantly improve from the ever-increasing access to data on CRWD’s massive platform, and as the two scale, the experience each builds will directly support the efficacy of each other. Yet another way for CrowdStrike to turn data scale into defensible product edges that sub-scale incumbents can’t match.

CrowdStrike is not interested in forcing model lock. Instead, they’re eager to offer these tools to customers, allowing easy ways to mix and match models for different tasks. This will help optimize for cost and performance right on CRWD’s platform, making them a more valuable partner. And they still get paid when other models like OpenAI’s are consumed through their platform, making them a more compelling partner for the emerging giants. Importantly, alongside these models, world-class data loss prevention (DLP) and posture management modules offered by Falcon ensure data flowing to and from them is done so safely and compliantly. So? Customers get to freely use whichever tools they want without worrying about data leakage issues.

With these models, CrowdStrike is delivering a sharp 70% improvement in output accuracy compared to off-the-shelf options while cutting cost per detection and remediation from $10 to $0.03. And to build on that dramatic cost improvement, the two models materially lower the false positive rates (as high as 80% per Sentonas) that off-the-shelf models and harnesses can produce, further reducing costs and focusing companies on the right issues more quickly. SafeMind will be offered later this year only via Falcon Flex and used by CrowdStrike in two ways. First, natively in the Falcon platform, where red and blue will power existing modules like exposure management. Second, as standalone models and harnesses for customers that want direct access. 

CrowdStrike upgraded AI Detection & Response (AIDR) under the module name Guardian and established it as a formal product category. It became available during the week and is compellingly seamless to add thanks to native inclusion in Falcon Flex. Like Palo Alto’s AI Runtime Security (AIRS), this provides an end-to-end service for protecting all AI-related assets and their interactions, with detection and response capabilities to uncover threats quickly enough to remediate before disaster.

AIDR secures agents across the endpoint (where Claude, Codex and Electron apps are consumed), cloud workloads, and SaaS agents. It also extends to the browser. Capabilities in this release include AI agent discovery and inventory to create that overarching view of operations, find impermissible (shadow) AI and know what is deployed at all times. CrowdStrike uses all of these capabilities to actively set agent permissions and facilitate them too. With CrowdStrike, companies not only know what agents are doing, but they can trace it back to the exact prompt that initiated that action, the user who wrote the prompt and all affected parts of a company. More capabilities include:

CrowdStrike thinks they can win here against Palo Alto and Zscaler in what sound like network-based tasks. To them, the dominant position in endpoint is a better base to build off of than their network counterparts. It sees the traffic before it enters a network and pre-encryption, giving it a better shot to respond quickly. It also offers a wide array of modules that produce a broad range of useful data from a massive customer base. This also helps fortify their solution and create a product that’s harder for network-centric players to beat.

Identity got a new product called Agentic Identity Provider (IdP). Traditional identity providers were built for humans with logins and passwords. Agents have none of that, so organizations have been giving these agents passwords like they would human identities and hoping for the best. Conversely, CrowdStrike’s Agentic IdP is purpose-built only for agent and machine-based systems. It uses Falcon Guardian to register all agents with cryptographically verifiable identities. Rather than getting permanent passwords they’re offered exactly what’s needed for a specific request over a short period of time. This eliminates the possibility of threat actors abusing these logins. For years, essentially every major breach has been via a username and password pulled out of a vault with standing privileges attached. These systems have not worked, and yet some wonder what will happen if we try to still make them work with exponentially more traffic. CrowdStrike offers a different way to alleviate this concern that I think will build quick traction.

The agent registration arm pairs perfectly with CrowdStrike’s Continuous Identity module that actually enforces permissions and grants real-time entry based on the information that Agentic IdP provides.

CrowdStrike added a slew of new SOC tools to position it as the most complete centralized security admin in a crowded field. New products include multi-agent investigations that simultaneously release agents and let them perform root cause analysis and remediation mapping until the agents converge on a best plan. Importantly, all of this agent-based work comes with persistent memory, meaning learning and improving from one permanently helps all of these machine-based tools improve.

Next, CrowdStrike combined AgentWorks, Charlotte AI and Falcon Foundry to create a bundled solution that should make the SOC even better. Now, customers can conversationally build their own, enterprise-specific agents with whatever model they want and defend against hacks more quickly. They can also plug seamlessly into 3rd-party tools to unlock more work, while granularly tweaking levels of autonomy for these agents. While lower costs are always welcomed, with sensitive use cases across cybersecurity, sometimes a human-in-the-loop is preferable to catch model hallucinations before they turn into big issues.

CrowdStrike moved its long-term ARR targets up by 1 year. It now expects to reach $10B by fiscal year 2030 and $20B by fiscal year 2035. Interestingly, the 2035 guide assumes CrowdStrike takes 3.5% of the addressable business available to them each year. This compares to consistently registering 4%, meaning there’s probably more upside to these forecasts. CFO Burt Podbere reminded us of CrowdStrike’s consistent beat and raise track record as a wink towards more outperformance being likely.  In the meantime, it also told investors to expect 20% net new ARR growth for fiscal year 2028, pointing to about 24% ending ARR growth for next year as this world-class growth engine keeps marching on at massive scale.

I think it’s clear that this company is thriving by any measure right now. They are the highest quality security platform in public markets. They are the innovation trailblazer and the organization most capable of expanding beyond their original security category without relying on large M&A to do so. The products announced at this event simply continue a pattern of rapidly setting the product road map curve. Their positioning is dominant and their new modules all seem to build immediate traction while forming an even stickier, more valuable platform. Despite their massive scale, they could easily have several more years of 20%+ compounding with a boatload of operating leverage left to enjoy as well.

Read my recent CrowdStrike earnings review here.

Meta is rapidly making sizable progress and climbing up AI leaderboards with its new models. I don’t get excited about this because I suddenly think Meta is going to build a permanent and defensible lead in the category. I think there’s going to be a lot more leapfrogging. Instead, I get excited because having one of the models in the conversation will (in my opinion) pay handsomely via core business improvements, agent-based software monetization and token consumption. Not needing to pay a direct competitor massive fees just to keep driving product innovation would be ideal, while improvements in model intelligence should keep unlocking more actionable experiences to offer consumers. Through the end of the year, Meta is expected to debut several of these experiences, which I think will make it clear how it aims to monetize hefty AI infrastructure costs at lofty returns outside of boosting core business trends.

I also know Meta is willing to sharply undercut competition on model costs, so having one around the leaders should be more than enough to win some market share. Especially with its world-class distribution networks providing strong appeal for developers.

We’re just a few months removed from Meta being mocked for falling behind in the race. They caught up at lightning speed, which is obviously good news for the company and a sign that their spend and talent are working. At the same time, I don’t think that is a good sign for durable model differentiation. It points to a bunch of money being the main hurdle to building the best general purpose model out there. And while few companies have that cash, all of the companies that can afford it are choosing to do so. I think that leads to a future where there’s a pack of leading frontier models all constantly undercutting each other on token costs as efficiency gains flow in (much like we’ve seen in public cloud computing). Returns can be fine in that scenario, but the real margin opportunity will come from layering on more services with this compute in place.

I think the future batch of model leaders will be complemented by a slew of open-source options and even cheaper alternatives for low-stakes tasks. And? I think the theme of customers wanting to use many different models to cut costs will merely grow in popularity.

To me, all of this means that differentiation will come from data, distribution, and great applications sharpened by years of trial and error. In other words, differentiation will come from the same enterprise software and consumer internet platforms that have thrived for years and years. I think the winners will keep winning.

Ongoing Flock backlash about their cameras being used by officers to break privacy laws and stalk people is heating up. This has led to 50 cities and counties canceling contracts with the company. Axon was very volatile all week and I think it’s getting swept up in all of these ugly events due solely to offering a competing product.

I continue to think Flock’s failure is good news for Axon. The public complaints are not predominantly based on wanting to ban automated license plate reading (ALPR) like both Flock and Axon offer. That’s not a likely outcome in the least. It’s more so a push to improve transparency, cut the illegal creepiness and get companies like Flock to act the right way. Axon leadership explicitly mentioned last quarter how much business they’re winning from Flock because of what’s happening. That’s because Axon is the company that does things the right way. They’re the company with the pristine reputation that customers work with if they don’t want to worry about legal issues popping up.

I think all of this will continue to incrementally feed Axon’s growth engine on top of the remarkable momentum it’s already enjoying. If the stock keeps correcting, I’d likely add.