CrowdStrike: Quality & Valuation
How attractive is CrowdStrike at this price?
Hi Multis
It’s important to keep assessing stocks you own. That’s why I developed the PMQS (Potential Multibaggers Quality Score) years ago. It looks at the quality of a business. The QPI (Quality-Price Index) decides, based on the quality and the valuation how attractive the stock is right now.
If you are a free subscriber, you will get the PMQS, but the valuation and attractiveness of the stock right now is reserved for paying Multis. If you want to upgrade, read about the valuation of CrowdStrike and become a part of our community (where you can discuss stocks with others like you!), you can always give yourself an early Christmas gift that should pay back itself over time. :-)
Personal conviction 9/10
Since September 2024
Since the very first Overall Quality Score, my personal conviction for CrowdStrike was 10/10. That again shows that my personal conviction has nothing to do with the stock price but everything with the fundamentals, also when the stock was down 67% in 2023 from its all-time high set in 2021. Just two years ago, this stock traded under $100 and because I knew this company so well, I backed up the truck and made it my biggest position at the time.
The outage showed a weakness, and that's why I took off a point from my conviction. The company will have to earn that back and it's too early, although the first results look quite good.
Profitability 8/10
Since December 2024
I mostly look at Free Cash Flow because it best shows a company's real earnings power. But at the same time, it's not the one metric to rule them all. This graph shows free cash flow and the second one free cash flow margin.
Both charts are from Finchat
The numbers show the influence of the outage. It's not disastrous because CrowdStrike was very profitable, but it's still something to pay attention to in the upcoming quarters. A free cash flow margin of 24% is still very strong, so CrowdStrike does well here.
If you look at the last few quarters, CrowdStrike was also profitable on a GAAP basis. That's also why it's allowed into the S&P 500 index. But in the most recent quarter, it was not profitable on a GAAP basis. That's the impact of the outage.
Sales efficiency 4.5/10
Since December 2024
The sales efficiency score first looks at the marketing efficiency by looking at what percentage of revenue goes to SG&A (selling, general, and administrative), how much revenue growth that brings in the trailing twelve months, and what is expected next year. I divide the average of those two by the SG&A number as a % of revenue, and that is marketing efficiency. I then multiply that by the gross margin to look at sales efficiency. I give a score out of 10 by dividing the percentage by 10.
Of course, this formula is far from perfect, but it gives you some idea of how well the company sells its product. There are plenty of nuances to add here, but the numbers are what they are.
These are the sales efficiency scores for CrowdStrike.
All the numbers deteriorated: there was more spending on sales and marketing, which is understandable after the outage. Revenue growth was down a bit, but especially the forward revenue growth expectations are down considerably. The same is true for the gross margins.
That results in a score of 4.5/10. That's the first time CrowdStrike scores so poorly on efficiency.
Innovation 4/5
Since December 2024
This is part subjective, part measurable. Subjective as in: how many new products does the company issue versus its competitors? You can partly measure that too if you want, but the magnitude of the innovations is much more important than the sheer number of innovations.
As for measuring, you can look at the % of the revenue that goes to R&D. At the same time, I want some efficiency there too, so I look at R&D efficiency by dividing R&D expenses in the previous year by revenue growth in the trailing twelve months. Let's look at how CrowdStrike does there.
CrowdStrike spent 25% of its revenue on R&D last year.
With revenue growth of 28.5%, the R&D efficiency is 1.14, which is good but not in the top quartile.
Now, this is based on numbers from 2015 to 2018, when the environment was not as challenging as now. So, while CrowdStrike is not in the top quartile, I'm convinced that if these were updated, it would be in the best quartile.
With the continuous roll-out of new modules on its Falcon platform, CrowdStrike is also a fast innovator. Customers take more and more modules and so the R&D definitely pays off over time.
I update my 4.5/5 score to 4/5, as there is some impact of the outage and that had some impact on the R&D efficiency score.
Must-have? 5/5
Unchanged since June 2022
I introduced it because of what Matthew Prince, the founder and CEO of Cloudflare (NET) said, as I reported in the Overview Of The Week #125:
I think that the world is about to get sorted into must-haves and nice to haves.
For CrowdStrike, I think there is no doubt that this is a must-have. Cybersecurity is extremely important nowadays and saving money there could cost you a lot more if you are hacked.
And because CrowdStrike is cloud-native and has worked with AI for years, the new paradigm, with much more Generative AI, fits CrowdStrike like a glove.
The outage showed that only a tiny minority of customers left; the retention was over 97%. I think that shows that CrowdStrike is a must-have, not a nice-to-have.
So, I'm keeping the 5/5 score.
Revenue growth 5/5
Unchanged since June 2022
CrowdStrike's revenue was up 28.5% in the most recent quarter, which also deserves 5/5, especially in this context.
With such a high revenue already, expected to be almost $4B this year, we shouldn't expect this high revenue growth to continue, but, amazingly, CrowdStrike can do it at this level. Only the very big ones can do that, and that means that it could become a much bigger megacap than most people think. Of course, I'm talking about the next 10 to 20 years here, as that's my investment horizon.
Revenue growth durability 10/10
Since January 2024
At least as important as revenue growth, is the durability of revenue growth. I look at industry trends and the company's strengths.
Some look too much to QoQ numbers there, but it depends on the industry. I prefer YoY, and even then, it can be lumpy.
For CrowdStrike: it's very likely that it will continue to grow very fast. But with technology, things can change fast sometimes. Until now, CrowdStrike has fended off the competition with its innovation and fantastic sales team. That's why I'm keeping the perfect 10/10 score.
I know that is very generous, but these are the growth expectations for the next 10 years.
Source: Seeking Alpha
These numbers are based on at least 3 analysts until 2032, dropping to 2 for the last two years. That always increases the quality of the estimates. While many SaaS companies have struggled in the past years, CrowdStrike keeps posting impressive numbers.
Of course, you should take these with a big grain of salt. But I think CrowdStrike has at least the potential for high revenue growth for a long time. Morningstar, which is generally very conservative with moat ratings, gives CrowdStrike a narrow moat label.
In Morningstar's terminology, that means the company is seen as having a competitive advantage that could last at least for the next decade.
I want to honor all the elements with the maximum score.
Management Quality Score 10/10
Since January 2024
Great management is often one of the most important keys to long-term success. I look at the track record, execution, and vision here.
George Kurtz, the founder and CEO of CrowdStrike, is charismatic on conference calls and a great and very knowledgeable leader. After all, he was one of the authors of a milestone book in cybersecurity: "Hacking Exposed: Network Security Secrets and Solutions." He's sometimes a bit aggressive towards competitors on conference calls, especially Microsoft, which was the only thing I knocked off half a point in the past. I'm forgiving him because of how he continues to execute at such a high level.
On top of that, I think the incident was handled very well. There are always many people who want to bring you down in such a situation, but CrowdStrike kept the course and conducted a transparent and honest post-mortem. That's why I kept the maximum score, even when I was considering lowering it.
10/10.
Insiders' Ownership 5/5
Since June 2022
Does management have skin in the game? This is out of 5, as it is not always a make-or-break question, but it is often a useful indication.
For CrowdStrike, George Kurtz owns more than 11 million shares.
That's 4.6%, representing a current value of more than $4 billion. That warrants a 5/5.
Multibagger Potential 4/5
Since September 2024
This score looks at whether the multibagger potential over the next 10 years is still there or not.
CrowdStrike now has a market cap of $90B. For 10x, we would have to see a company of $900B, which is a huge company.
Remember to factor in inflation. If you assume 3% inflation for the next 10 years, $900 billion is equivalent to $670 billion right now, which is still gigantic, of course. But I think CrowdStrike has that potential.
If you look at the growth expectations, you see 23.6% on average over the next ten years. Of course, the further out, the more speculative. But also, I think that Crowdstrike will grow faster than expected in the first few years.
All in all, I rate CrowdStrike a 4/5 here. The long-term multibagger potential is still there. But of course, it would be easier if the stock was a little less expensive. That's why I don't give it 5/5.
TAM/SAM: 5/5
Since June 2024
TAM stands for total addressable market and SAM for serviceable addressable market, the market you serve because of your specific product and geographical limitations.
Both the TAM and the SAM are big for Crowdstrike. The total addressable market is expected to grow to $1.5 trillion to $2 trillion, according to McKinsey.
As you see, CrowdStrike's core market alone, end-point security, already shows a TAM of $100 billion to $200 billion. Management expects that to grow to $225 billion in 2028. And that's just the core market that Crowdstrike serves.
What you see is that it expands into SIEM (security information and event management, in security and operations management), ASPM (Application Security Posture Management, see application security), and DSPM (data security posture management, see data protection). That will probably add another $75 billion in TAM for Crowdstrike in 2028. So, a total TAM of $300 billion, not too shabby, right? Don't forget that this is yearly and I'm only taking the core markets, not the future expansions that CrowdStrike might do. That means that the SAM will be more or less equivalent to the TAM of $300 billion.
Therefore, I think the score should be 5/5. This is also the reason why I think Crowdstrike could become much bigger than many think and I gave it a high multibagger potential score.
Financial Strength 9/10
Since June 2024
In this environment, financial stability is much more important too. That's why I rate it out of 10.
We have already seen that CrowdStrike has high free cash flow streams. $1 billion over the last 12 months.
That is always a great help in this environment, but even more from a company still growing this fast. Let's look at the balance sheet. With Finchat, this is much easier. You can get a 15% discount if you use this link.
That's why I give it 9/10. That's probably the highest grade I'm willing to give if there's still some debt.
The negatives
I also have negative scores, that can subtract extra points from that score. The scores are marked out of 5 because a lot is already captured implicitly in the other numbers. The lower the score on these negative categories, the better, of course.
Risk 2/5
Since September 2024
A lot is already baked in financial strength, but this is an overall risk score that shows more than just financial risk.
For CrowdStrike, I have raised the negative score to 2/5 because of the outage. The general risk is a bit higher now.
On top of that, technology is an industry of fast disruption and that's why CrowdStrike has to remain innovative, but there is no lack of innovation at the company. The main risk is disruption, so you have out-innovate disruption.
Competition 2.5/5
Since September 2024
How strong is the competition? Again, you can't objectively measure that but there are indications.
CrowdStrike is in a very competitive market. There are many players in cybersecurity. Microsoft, Sentinel One, and Palo Alto Networks just to name a few. At the same time, the pie gets bigger for everyone.
I still decided to raise this negative score a little bit because some competitors might benefit from the outage caused by CrowdStrike.
Dilution 1.5/5
Since September 2024
I used to call this SBC (stock-based compensation) but dilution is a better term, as it is broader. Dilution is negative over the long run but that doesn't mean that companies should not issue stock when they are still growing fast. Look at Apple's shares outstanding before 2012, when it started buying back shares:
At the same time, I don't want to ignore dilution completely and that's why I give a negative score.
We look at this over a 3-year period to exclude missing something.
This is CrowdStrike's evolution in shares outstanding since Q3 2021.
As you can see, over those years, the total number of shares outstanding grew by 7.42%, or 2.41% yearly growth. Over the last year, though, dilution has grown slightly to 2.57%.
I prefer dilution to be under 3% and that's still the case here. But the somewhat higher dilution made me raise my dilution score to 2/5 the last time and I'll keep it there.
Scale advantages shared -5/+5 => 5/5
When I looked back at some of the best investments, they did not only have substantial scale advantages, but also shared them with their customers in some way. For Amazon or Walmart (at the time), I think this criterion is obvious. Because they are bigger, they can give their customers better prices.
Google has always had a scale advantage: the more people used their products, the more they could give away for free. The data of people were leveraged to generate profits for Google, but the fact that Google could offer so much for free (Gmail, Fotos, Drive storage up to a certain limit, etc.) was because of this mechanism.
I have not come up with this concept myself. This is one that I borrowed from Nick Sleep from Nomad Capital. He uses this concept to guide all of his investments. That's why he started investing in Amazon in 2003 already. And he mostly held on to that position to now. He did the same thing with Costco, another company that shares the advantages of its scale with its customers, by only charging 15% on the purchase price, no matter what. This makes these companies almost impossible to compete with unless you start doing exactly the same thing.
The most prominent advocate of this? Jeff Bezos, who made this napkin sketch about it.
So, this competitive advantage can be significant. I'm going to withdraw or add points with this criterion. For some companies, extra scale only adds extra complexity. Those will get a negative score. I think of Uber (UBER) here. The normal scaling is the second level, which will be given some points. This means that if you grow, your scale gives you cost advantages. The third level is where all users also benefit from the scale. Here, you will see higher scores, 4/5, maybe 5/5.
For CrowdStrike, the platform gives protection to everyone. If one is hit, this is used to protect everyone else on the platform. Now, this is not just for CrowdStrike, but also for other cybersecurity companies. At the same time, I have the impression that CrowdStrike is more performant here than the average competitor.
I kept my score to 5/5, not just because of what I described above but also because Crowdstrike keeps adding module after module. Most are developed in-house, but CrowdStrike also does relatively small acquisitions to build these companies out into a module. Those upsale modules are the reason that Crowdstrike is getting very profitable, as margins are higher there. And 65% of customers already use 5 or more modules, 44% uses 6 or more and 28% uses 7 or more.
So, that's why I gave the maximum score. You may wonder how Crowdstrike's customers profit from this part of the scalability, but they do because it allows CrowdStrike to invest heavily into R&D, making more products that deliver top-notch security to its customers.
Conclusion
CrowdStrike's Potential Multibaggers Quality Score goes from 80 to 77, after it already decreased from 83 to 80 in the previous quarter. All in all, I still consider this a moderate decrease for such a huge outage. Of course, it could be that we don't see the full impact yet. But up to now, it seems like CrowdStrike remains a high-quality business.
Let’s go on to the current valuation.
The Quality-Price Index
Let's look at the valuation, so we can decide how attractive the stock is right now with the QPI (Quality-Price Index).