Investment Thesis
Best-in-class endpoint security with strong net retention, but ARR-to-billings divergence and post-incident trust erosion warrant caution at current multiples.
CrowdStrike has built the leading cloud-native endpoint security platform, with the Falcon platform now spanning 28 modules across identity, cloud, and data protection. Net revenue retention above 120% and module adoption rates (customers with 5+ modules at 64%) demonstrate strong platform stickiness.
However, the July 2024 outage incident has created lingering trust concerns that are beginning to show up in enterprise procurement cycles. Our analysis of channel checks indicates deal cycles have extended by 2-3 weeks for new logo acquisition, and several large enterprises have added competitive bake-offs to their renewal processes. The ARR-to-billings divergence in recent quarters also raises questions about the durability of the growth trajectory.
What You're Missing
Our pipeline identified the following contradictions and evidence gaps that most analyses overlook.
Reported net retention rate of 120%+ suggests minimal churn, but channel data indicates several Fortune 500 accounts are actively evaluating alternatives post-incident. The lag between evaluation and actual churn could mask emerging weakness.
Company highlights 64% of customers on 5+ modules, but revenue contribution from newer modules remains disproportionately small, suggesting low-dollar module bundling rather than genuine platform expansion.
No reliable data on how competitive win rates have changed since the July 2024 incident. Anecdotal channel evidence is mixed and insufficient for quantitative assessment.
Scenario Analysis
Post-incident churn materializes in FY26. ARR growth decelerates to 20%. Multiple compresses to 12x forward revenue.
Trust concerns fade gradually. ARR growth sustains at 28%. Platform consolidation thesis plays out. Multiple holds at 16x.
Full trust recovery. SIEM displacement accelerates via Charlotte AI. FCF margins expand to 35%. Multiple re-rates to 20x.
Key Risks
Post-outage trust erosion could drive enterprise accounts to competitive alternatives like SentinelOne or Microsoft Defender.
ARR-to-billings divergence may signal slowing deal momentum not yet visible in ARR metrics.
At 16x forward revenue, CrowdStrike trades at a significant premium to security peers, leaving limited margin of safety.
Run your own analysis
Free trial, no credit card required. Get the same depth of analysis for any stock in our 600+ universe.
Start Free Trial →