News of the Week (October 11-15)

CrowdStrike; The Trade Desk; Upstart; GoodRx; Ayr Wellness; Progyny; American Cannabis News; Personal Stock Picking Update; My Activity

1. CrowdStrike (CRWD) — Fal.Con Highlights

a. New Falcon XDR Module

CrowdStrike announced its new Falcon Extended Detection and Response (XDR) Module. This module serves as an enhancement to its existing endpoint detection and response (EDR) capabilities to extend threat detection and remediation beyond the endpoint. EDR is the core base of this formula, and XDR is the upgrading of EDR.

The XDR module will now be able to stream and ingest data from 3rd parties in real-time, with unmatched scale and for a fraction of the cost of substitutes. Whether its SaaS providers, email data bases or networks, XDR will filter through all of it and select for all relevant pieces of information to ensure the data being used is both complete and appropriate.

This is in large part thanks to Humio’s index-less logging capabilities. That feature solves the structural issue of scaling big data within the XDR environment without jeopardizing efficacy or inundating tech teams with false positives. CrowdStrike thrives on seamless ability to scale its prevention, detection and remediation offerings — Humio deeply adds to that seamless scalability. This increased data ingesting ability will bolster CrowdStrike’s EDR capabilities via a more holistic view of threats and will shorten time to response and remediation as well.

As a reminder, CrowdStrike bought Humio earlier in the year.

As part of the new XDR module, CrowdStrike also announced a new “XDR alliance” for the purpose of collaborating within the world of security to improve efficacy and safety for all stakeholders. ServiceNow, Zscaler and Okta are just a few of the partners in this new alliance which will offer integrated solutions to enhance value propositions for shared customers.

• Example of XDR in action: Suppose we have a suspicious AWS login coinciding with a related, subsequent email login. XDR’s 3rd party integrations enable it to connect these dots across ALL partner ecosystems to flag potentially harmful behavior more expediently — and all within the cloud.

Again, XDR is about extending threat detection to every single part of the security stack. By partnering with world-class entities existing within different niches of that stack, CrowdStrike is able to onboard a bevy of new and usable data to broaden its reach of threat detection and to deliver more actionable insights wherever a threat may be uncovered.

While CEO George Kurtz did not name any security vendors by name in his keynote, he did ferociously rip into other next-generation XDR solutions. According to Kurtz, other XDR offerings are simply re-branded EDR to use as a marketing ploy. I’m assuming (pretty safe assumption) that he’s referring to SentinelOne.

It’s not enough to simply add more data intake sources to an existing EDR platform like substitutes have done. False positives are already common enough within EDR and redundantly or irrelevantly adding more information to already cluttered applications does not work. The new data sources need to be the right data sources as well as easily contextualized, sorted and fed into an effective algorithm. This is what CrowdStrike’s XDR product and alliance will bring to the table.

“What many XDR vendors are doing is simply making the security problem worse by flooding teams with even more data and complexity. Taking the same failed approach of yesterday will not help customers against today’s adversary.” — CrowdStrike CEO George Kurtz

“Some in the industry are simply glomming on to the acronym for marketing purposes... We are actually building upon our XDR with enrichment from other data sources for cybersecurity use cases and perhaps down the road use cases beyond cybersecurity.” — CrowdStrike VP of Intelligence Adam Meyers

With Humio’s log management capabilities at CrowdStrike’s side and Meyer’s acclimation of potentially moving “beyond cybersecurity”, I can’t help but think CrowdStrike plans to move further into Datadog’s observability niche. We shall see.

Interestingly, CrowdStrike also announced Falcon Fusion which will be integrated into this module and all other Falcon modules at no added cost. The upgrade allows for each customer to customize their own remediation and prevention plans in a low-code manner that’s accessible to anyone. The customer can then take these plans and create automated, scalable work flows. It also uses these crafted plans to granularly build alert systems for each client based on which events are most relevant to their operations.

The less mundane tasks a workforce is having to manually conduct, the more productive they will generally be.

“One of the pain points from customers is the rigidity of security stacks. 71% of CrowdStrike clients report difficulty integrating various pieces of their security stacks. 80% claim alert fatigue (false positives) as a real issue. Fusion simplifies workflows at scale and quickens time to remediation. Fusion works for you, not the other way around.” — CrowdStrike Chief Product Officer Amol Kulkarni

b. “ExPRT.AI” Feature Added to Falcon Spotlight

ExPRT.AI leverages the power of CrowdStrike’s centralized, AI-powered threat graph to automate the ranking and sorting of threats most relevant to each specific client. Alerts are customized and prioritized based on this ranking system to further combat the common issue of too many false positives.

c. George Kurtz on CrowdStrike’s “Think Week”

Each year, CrowdStrike dedicates a week to allowing its employees to present new ideas and innovations to CrowdStrike’s executives. The ideas are ranked with the best receiving prizes. Interestingly, several of CrowdStrike’s modules from the Falcon platform have actually come from Think Week pitches.

This functions somewhat similarly to the venture capital-style incubators within blue-chip companies like Goldman Sachs, Boeing and many more. The practice keeps trends and potential new innovations in-house rather than CrowdStrike finding itself competing with them down the road.

Think week follows a theme of Kurtz being fixated of optimizing workplace culture. To give an idea of his dedication, he flies every new employee in to California for a week of training that he himself participates in.

d. Quote from Angelo Comazetto — Principal at the AWS Office of CISO (Chief Information Security Office)

“AWS is a CrowdStrike partner and customer because it allows our people to do their jobs without having to worry about permissions and vulnerabilities. CrowdStrike solves all of the problems we have with the issues coming from employees not always working in an office. I’m excited for continued momentum between Amazon and CrowdStrike.”

e. Quotes from Jim Alkove — Chief Trust Officer at Salesforce.com — on Why it Picked CrowdStrike

“It all comes down to trust. We’re picking technology to help us protect endpoints on-premise and everywhere [those endpoints] may be. We need a solution that meets those needs today and scales over time. Ability to continue to scale is super important to us.”

“I was very happy with our ability to rapidly deploy CrowdStrike. It was a much smoother process than I anticipated it being.”

f. Humio insight from Hewlett-Packard Enterprise’s (HPE) VP of Cloud Operations Allwyn (Olly) Lobo

“Our log management solutions (they had been using ELK) would not scale for us. We had frequent gaps in log availability and retainment. We did a comparison of providers and that’s how we found Humio. We looked at your competitors like Datadog and the value we got from Humio like live observability and logging made it a fabulous decision. At that point we were barely managing 30 terabytes per day. Now we are running 74 terabytes per day. Humio gave us the ability to do complete, 360 degree live logging across all of our applications.”

Humio fostered a 20% increase in HPE’s data compression ratio (key efficiency indicator) and CrowdStrike’s VP of Sales-Emerging Technology — Joseph Mattioli — further quantified the benefits companies gain from Humio:

“Humio allows companies to deploy 10%-25% of the log management and observability infrastructure vs. alternative solutions.”

This is how it allowed HPE to more than double its terabyte throughput without a ridiculous number of new servers. Humio has a customer now clearing 1.5 petabytes per day according to Joseph.

Finally, CrowdStrike and Humio launched a new “Humio Community edition” as a free tier of Humio’s log management and observability platform for prospective clients to test. This free tier integrates data from the Falcon Threat Graph to give these new prospects a real sense of the product’s utility. The free tier will allow the users to clear 16 gigabytes of data per day with 7 days of data retention.

Bottom line:  CrowdStrike continues to build on its technology lead and distance itself from all competitors. The market share that it’s rapidly taking from legacy vendors and the customers it continues to win from next-generation competition both serve as the effect of this.

2. The Trade Desk (TTD) — Walmart VP of Strategy Stephen Howard-Sarin Interview with The Trade Desk

a. On What’s Important to Walmart within Advertising

“When we look at shopping data, we want to uncover persistent changes in behavior and turn them into insights, then audiences and then activations on a brand by brand basis. Having a platform that can do that wherever the consumer is, is really important to us and is what led us to The Trade Desk.”

b. On Why Walmart Chose The Trade Desk as its Demand-side Platform Partner

“We bring a lot of data to the table and we know that can turn into remarkable marketing activations. That leads us to who has the best tool set to do this. The Trade Desk has the best tool set. When we talked to our suppliers about how to get the biggest step-up we were led to you.”

Click here for my deep dive into The Trade Desk’s business.

3. Upstart (UPST) — New Partner and An Investment

Upstart announced Abound Credit Union as its newest loan partner. This is the largest credit union in the state of Kentucky with 116,000 members and $1.8 billion in total assets. While it’s smaller than other credit union wins like Patelco (and most others on the roster), it’s still yet another piece of evidence of Upstart’s rapidly growing adoption.

Upstart also led a $145 million Series E fundraise for a company called Tala. Tala was founded to create “the world’s most accessible financial services” so it’s a natural complement to Upstart’s access-raising loan algorithm.

6 million people have used 680,000 Tala access points to borrow $2.7 billion throughout Kenya, the Philippines, Mexico and India. Flexible payment options allow users to borrow and payback “how they prefer.” Tala’s app seems to be well-received with it boasting 1 million 5-star reviews and ranking among the top finance apps in their core markets.

The cash will be used by Tala to fund its product roadmap while specifically “developing one of the first mass-market crypto products for emerging markets to help make crypto solutions more affordable and equitable.”

Three things I found interesting about this move:

1. Upstart has global long term ambitions. This could be seen as one of its first moves in that pursuit.

2. Just last week in an interview, Dave Girouard (CEO of Upstart) told listeners that he viewed Upstart’s absence from the crypto world as a potential “liability” and that he was a “crypto believer.” This marks Upstart’s entrance into that space.

3. PayPal Ventures was also part of the fundraising.

Click here for my overview of Upstart’s business.

Click here for my overview of Upstart’s primary risks.

4. GoodRx (GDRX) — CFO Karsten Voermann and SVP of Strategy Justin Fengler Interview with Morgan Stanley

a. Voermann on marketing

“Given that we have so much free marketing through providers and users paired with our excellent retention means that our marketing spend goes to acquiring incremental new users.”

Still, the company has greatly raised external marketing efforts but according to Voermann the payback on marketing spend has remained below 8 months. This points to continued spend efficiency. Because 70% of consumers don’t know drug prices vary, GoodRx is able to identify new pockets of green field opportunity constantly to keep that payback period short. This gives the company flexibility to invest more and more aggressively in new market share and product innovations.

b. General notes

Justin Fengler updated us on GoodRx’s physician net promotor score (NPS) which now sits at a remarkable +90. It was previously in the 80s so this represents continued (and rapid) improvement.

GoodRx is working on building more pricing and interface tools directly into physician workflows. This will ideally deepen the relationship between the entity and care providers and juice that referral channel further.

75% of GoodRx’s monthly active consumers are insured in some capacity. This product is not just for the uninsured.

5. Ayr Wellness — Top Dog in Beverages

Ayr’s cannabis beverage brand — Levia Brands — is now the #1 selling THC seltzer in the nation. This product was launched just 7 months ago. Beverages still make up a tiny fraction of overall cannabis sales in the nation, but traction is expected to build over time and this is a great indicator of Ayr being a core part of that traction.

Click here for my overview of Ayr’s business.

6. Progyny (PGNY) — My Deep Dive

In case you missed it, click here for my new Progyny deep dive.

7. American Cannabis news

1. 2 Ohio Republic Representatives are working on a bill to recreationally legalize cannabis in the state.

2. South Dakota is now aggregating signatures to get recreational cannabis legalization on its ballot for 2022.

3. Nevada reported just over $1 billion in taxable cannabis sales vs. $685 million year over year for the period ending June 30, 2021. This 46% growth is more than 4 years into the state’s legalization.

New Jersey awarded 5 new cultivation licenses and 4 new vertical licenses on Friday. The New Jersey Cannabis Regulatory Commission recommended an additional 5 cultivation licenses be awarded (so 10 total) based on consistently growing demand and inconsistent access to the product in the state.

It also looks like they’ll eventually have to authorize even more stores than already permitted with 5,300 New Jersyans per dispensary vs. 3,200 in 2017. The state has added 62,500 new medical patients in the last year so this issue is not going away on its own.

Trulieve and Cresco Labs were the two most notable multi-state operators (MSOs) in the running for vertical licenses but neither got them. There will be opportunities to enter the state via M&A in the future and I expect both to do so based on the state’s large size (8.9 million people). I was hoping that Cresco Labs — a core holding of mine — would be awarded one of the licenses so this was somewhat disappointing to me.

Click here for my overview of the American Cannabis regulatory environment.

8. A Personal Stock Picking Update

I haven’t added a new name to my  portfolio since Duolingo went public earlier in the year, and that will likely continue for now. I generally read through a few new S-1 filings weekly and have not found anything all that compelling to be candid.

Organizations such as Allbirds, Freshworks, Remitly and Dutch Bros came close, but I am content adding to my existing positions at this point in time. If there is a new position that I plan on starting in the future, as always you will be the first to know.

With my cash position sitting just below 16%, I’m often asked why I don’t seek out new positions more frequently. I will not deploy cash for the sake of deploying cash, and a new position has to be especially compelling for me to buy any shares. The only things I see that are especially compelling at this point are already in my portfolio.

9. My Activity

Nothing to report.