Weekly Dashboard 6/18/2021: Crowdstrike Q1 FY22 Earnings Teardown & Squarespace S-1

Aneesh Tekulapally

Jun 18, 2021 • 16 min read

Crowdstrike ($CRWD) Q1FY22 Earnings

Historical Financials | Press Release | Earnings Transcript | Earnings Presentation

Financial Highlights:

$302.8M revenue (+70% YoY)
$143.8M net new ARR
$1.19B ending ARR (+74% YoY)
39% FCF margin
11,420 subscription clients (+82% YoY & +15% QoQ)
Magic Number 1.4
RPO billings growth of 79% (greater than any quarter in FY21)

Summary:

Crowdstrike is $1.19B ARR growing 70% YoY and 14% QoQ, which makes it one of the fastest growing SaaS companies among all B2B SaaS companies. The company reports 39% FCF margins in the most recent quarter with $1.6B+ cash on its balance sheet. Crowdstike has great net retention with 120%+ NDR and 98% Gross Retention making it one of the stickiest products in the B2B SaaS landscape. CRWD currently trades at 39.1x ARR and what we estimate to be roughly 26-28 NTM ARR. Crowdstrike’s business has massively benefited from COVID-19 as ongoing digital transformations have left companies scrambling to secure endpoints for various business operations. Additionally, legacy providers continue to be disrupted by CRWD’s superior and industry-defining product offerings. Crowdstrike has capitalized substantially during this period of increased focus on IT security services and is clearly becoming the go-to provider in this space through rapid product development, strategic partnerships, and acquisitions.

Company Overview: Crowdstrike's platform protects customers from breaches.

Their Falcon Platform is a SaaS based security offering for next-generation endpoint protection that detects, prevents, and responds to attacks. The company's cloud & AI approach is in contrast to on-prem endpoint security solutions or primarily rules-based and signature-based anti-virus companies like Symantec and McAfee.

Falcon, Crowdstrike's platform, is a single lightweight agent that installs on the customer's endpoint that feeds data into Crowdstrike's cloud-based database called Threat Graph. By leveraging the cloud, Falcon is able to continually collect, process, and analyze threats across all customer endpoints in real-time. As there's more data that's fed into Falcon, there is more data to train Crowdstrike's AI models with, increasing the overall efficacy of Falcon and ensuring protection for all Crowdstrike customers.

Why CRWD wins:

1. Best-in-class and category-defining product. CRWD’s product is light-weight, scalable, and cloud-first.

Customers can easily and remotely deploy, manage, and protect workloads at scale. Speed of deployment and time to value were critical factors for customers' purchasing decisions as having to reboot their complex network of systems have kept organizations from moving to a modern architecture sooner. Crowdstrike's threat graph creates a data moat, if malware is detected on any endpoint, then all endpoints are protected in real-time because the Falcon platform improves and trains on each event. Endpoint security also generally has high switching costs and the improved product helps increase barriers to entry.

Once again Crowdstrike’s platform takes the leader position in the 2021 Magic Quadrant for Endpoint Protection platforms and also leads the pack in the completeness of vision. Crowdstrike is definitely the category-defining product and it will continue to grow market share as it increases its security stack.
Customer testimonials highlight that they chose the Falcon platform because of their digital transformation initiative to increase efficiency, enhance visibility, improve performance at scale, and consolidate agents across their environment.
As a pioneer in EDR, Crowdstrike has spent the last decade building upon rich endpoint data by adding more network visibility and telemetry from all workloads, regardless if they are on-premise, in the cloud, or deployed in containers. All the data they collect is stored in one place, the Threat Graph, where it's analyzed across the entire customer base, providing network effects that promote real-time protection and community immunity.
By streaming the telemetry to the cloud with their proprietary smart filtering, Crowdstrike has a fundamental time and performance advantage over most vendors. Today, Threat Graph processes approximately 6 trillion security-related events per week.

“In summary, the fundamental reasons why we have earned our leadership position and are winning customers at a rapid pace over both legacy and next-gen vendors are the Falcon platform's ability to fully utilize the power of the cloud and AI to stop breaches and provide community immunity; our ability to easily and rapidly deploy our lightweight agent at scale across both endpoints and workloads without requiring a reboot, while other next-gen vendors fail to scale and require reboots; our platform is easy to use and easy to manage all from a single user interface; and our ability to leverage the power of the cloud to collect data once and solve many real-world business problems that deliver better outcomes and immediate ROI for customers. Customers recognize that Threat Graph and our ability to stream data to the cloud in real time are unique to CrowdStrike. This is very different from other vendors, including upstarts that silo their data and upload data in delayed batches. Any vendor with an on-prem solution is currently unable to fully utilize the power of the cloud.” - CEO George Kurtz

2. Frictionless GTM strategy

In addition to CRWD’s best-in-class sales team, a key pillar of their strategy to efficiently grow market share and leadership is to expand routes to market through their partner ecosystem, trial-to-pay platform, and CRWD store.

Crowdstrike has gained significant leverage from partners, growing partnership count by 85% worldwide and doubling their partner-sourced transactions. The partnership with AWS is a standout with both partner-influenced deals and transactions fulfilled through the AWS Marketplace growing significantly throughout the year. In fiscal 2021, ending ARR transacted through the AWS Marketplace grew 650% over the last year, and transaction volume grew over 300%.
Management noted that Crowdstrike is probably one of the most transaction-ed ISVs on the marketplace. Kurtz cited that they're seeing good pull for the new cloud modules.
Management believes they still have a “greenfield opportunity” with respect to protecting cloud workloads. And that Crowdstrike is "really, really ahead of anybody else that's out there in the marketplace".
Crowdstrike’s strategic partnership with Zscaler and increasing partner network will continue to drive customer lands and sales efficiency. Management notes “one of our marquee wins in the quarter was brought to us through our tech alliance with Zscaler. This Fortune 100 global insurer chose CrowdStrike to help further its digital transformation initiatives and fortify its security, replacing a patchwork of four legacy and next-gen vendors. Falcon was selected over Microsoft to replace these incumbents for its ability to consolidate multiple agents, improve performance and protect their endpoints in cloud environments with one single agent. The voice that matters most is the customers', and they are increasingly turning to CrowdStrike as their trusted security platform of record and validating our leadership.” - CEO George Kurtz

Crowdstrike's dominance of the marketplace is a key reason they boast one of the most sales-efficient growth strategies among all B2B SaaS. Management further cites that “the platform is designed to sell itself and to get new customers. And we spend a lot of time on digital to trial to pay and then conversions. And whether it's a small customer or whether it's a large one in enterprise, once we get them in the door, we certainly can't convert them with a credit card, but obviously, the bigger customers will engage on the sales team and a partner and close deals. And now with things like AWS and GCP and EY, we have expanded our partner network. So we feel really good about the flywheel we've built and the sales scalability built into their platform.” - CEO Geroge Kurtz

3. Consolidating the market to become the "Gorilla" in security:

Crowdstrike aims to become a category-defining cloud company, joining the likes of Salesforce, ServiceNow, Workday as one of the dominant end-to-end SaaS vendors. They've done this by focusing and planting a ubiquitous presence with endpoint security and then moving further up the stack from there.
The Preempt and Humio acquisitions demonstrate Crowdstrike's opportunism and aggressiveness with offering a complete vertically integrated solution. With the Preempt acquisition, CRWD now delivers a modern approach to securing identity. With the Humio acquisition, Crowdstrike has a log management tool focused on SIEM. CRWD can now dump all the data they collect into Humio and no longer rely on Splunk for log management services.
Crowdstrike has shown the ability to standalone against the major cloud providers and they've shown incredible ability to both build organically and buy growth inorganically. This allows their already incredible unit economics to expand as they continue to run up the score on other security vendors. Crowdstrike’s cloud first platform improves unit economics relative to competitors like SentinelOne that offer hybrid and on-prem solutions that eat into margins.

Market Opportunity: Crowdstrike has shown amazing ability to increase their TAM over time as they expanded into other verticals of security.

CRWD’s current market alone is forecasted to be $4.9 billion in 2023 based upon IDC estimates. And that does not include any potential adjacencies, such as the massive observability market. Looking forward, management cited greater plans for new CrowdStrike business units. While it will take some time and investment to deliver this powerful combination to the market, we believe it has the potential to open up massive new TAM for CrowdStrike, provide a runway for growth well into the future, and ultimately create another line of business on par with the security business.

Q1FY22 Earnings Takeaways

1. Continued execution in upselling/cross-selling new modules driven by rapid product development and platform completeness

CRWD’s platform continues to rapidly expand vertically tackling multiple facets of the security and DevOps space. As more and more modules are added to the platform, Crowdstrike is able to further drive down costs and increase cross-selling opportunities. Management particularly notes that more and more customers are purchasing a multitude of modules from the get-go with total cost of ownership less than key competitors.
Crowdstrike notes that subscription customers that have adopted 4 or more modules, 5 or more modules, and 6 or more modules have increased to 64%, 50%, and 27% respectively. As the number of modules adopted increase, CRWD continues to expand its moat from a product and pricing perspective.

“And so what we're really seeing across the board is companies coming in and buying more modules out of the gate because they see the value not only of the platform and where they can go with the platform but the total cost of ownership. We're able to drive down those costs overall by taking out some other competitors that offer other type of technologies where we come in with better efficacy and lower cost. So it's really all about the opportunity for customers to purchase more of our modules, And they're doing so more and more out of the get-go.” - CFO Burt Podbere

CRWD remains the industry disruptor and on the right side of change through its technology focused on zero-trust solutions for endpoints and workloads. Management indicates how early in the disruption phase the industry is in citing specifically the long runaway ahead for customer adoption from legacy providers like Symantec and McAfee.
Crowdstrike’s offering is holistic across multiple cloud providers making it the most feasible and cost-effective solution for enterprises. There are not a lot of competitors in the industry with a comparable platform offering, making CRWD poised to become the “gorilla” in the endpoint security market for corporate enterprises.
Customers have seen the long-term value proposition in Crowdstrike’s platform with management indicating an uptick in multi-year deals with RPO billings growth of 79% which is higher than any quarter in FY21. The company will continue to boast impressive billings growth as it consolidates its market share in the security space.

“And I think we're still in the early innings, maybe second inning in terms of our ability to continue to take share. And actually, just today, IDC released an updated worldwide market share stat from modern endpoint security, and CrowdStrike was ranked No.1, ahead of Microsoft and other legacy vendors. So we feel really good about where we are. But as we talked about earlier on the call, 11,000-plus customers, fantastic. But there's a lot of companies out there, big and small, and we still think we've got a lot of runway and still continue the migration of share from Symantec and McAfee to CrowdStrike.” - CEO George Kurtz

“Customers are very willing to use our technology. As we've talked about many times, they're looking for a holistic solution across multiple clouds, not just one cloud provider. They're looking for a single agent that not only can give visibility and protection in their corporate enterprise but also in their cloud environment. And in terms of the willingness to use it, it's an extremely competitive product. We continue to add more and more capabilities including drift detection now if these workloads drift and containers drift, which is a real boom for the DevOps team. So we've spent a lot of time selling into that group. We've got a lot of traction there and as I mentioned before, a lot of our cloud technology, not necessarily new product, particularly things like Horizon because we built it for internal use before we actually delivered it to the market. So in general, it's a greenfield opportunity in cloud. There's not a lot of competitors and existing technologies we have to displace. And we're really excited about the momentum we've seen in that particular category.” - CEO George Kurtz

3. Humio acquisition provides Crowdstrike with a massive growth opportunity that makes Crowdstrike the only platform with comprehensive endpoint security and log management capabilities

Humio’s index-free data ingestion and analysis capabilities will bolster Crowdstrike’s existing data analytics and AI algorithms further extending the efficiency and speed of Crowdstrike’s platform.
Humio acquisition creates flywheel-like effects for Crowdstrike as the aggregation of millions of new data points tied in with existing data from the Threat Graph will bolster Crowdstrike’s capabilities and provide increased value for customers. Management is confident in their ability to aggregate more and more data sources into Crowdstrike’s data platform which should bolster protection for all Crowdstrike users.
Management has shown its expertise in capital allocation and will continue to make strategic acquisitions that increase TAM and solidify Crowdstrike as a complete security and DevOps platform.

“Sure. I mean, you can -- any company have lots of data. It's the value in what you do with it. And I think CrowdStrike has proven our ability to utilize the data. And whether that's in training our AI algorithms or whether that's creating a product that can actually be quickly searched and insights be gained, with our Threat Graph, I mean, we've pioneered cloud delivery endpoint and graph technology specific to security. So I think that continues. With Humio, you've got fantastic technology, extremely fast, extremely efficient, in-memory, index-free, driving down the cost compared to legacy technologies that are out there on the log side. And that will be a key part of our XDR extension in our strategy. And we've seen fantastic feedback from customers. I called out some big wins that we had with Humio. And as that gets integrated, which we're working on, we feel really good about having the ability to pull other information besides CrowdStrike data into our data platform and our Threat Graph and make that available to customers. So I think it comes down to, again, there's a lot of marketing noise in the marketplace. But when you actually look at the technology which we have and why we bought Humio, we feel really good about it as a next-gen technology that's going to be a good fit for our platform.” - CEO George Kurtz

Future Outlook

Crowstrike started off in endpoint security but has shown its ability to enter ancillary markets and grow market share through organic and inorganic growth. I still strongly believe in Crowdstrike’s ability to increase market share from incumbent legacy on-prem providers through its best-in-class product offering that now tackles both endpoint security and DevOps. Microsoft poses the largest threat to Crowdstrike with its massive distribution channel and over $1B security spend, but with such a massive addressable market Crowdstrike will still enjoy a massive growth runaway. With an estimated 2025 ARR of $4B+ and a 40% free cash flow margin, Crowdstrike will surpass a $100B market cap in the next few years. Interesting enough, Crowstrike’s management is one of the only management teams that really emphasizes non-GAAP metrics like magic numbers in their earnings calls. Goes to show management’s extreme confidence in their GTM strategies and ability to upsell/cross-sell more and more modules.

Squarespace S-1 ($SQSP)

Squarespace is an all-encompassing platform “for businesses and independent creators to build a beautiful online presence, grow their brands and manage their businesses across the internet.” The company provides web-hosting services including domain registration and website building services coupled with e-commerce solutions that enable “people with creative ideas stand out and succeed.” Additionally, the company offers supplementary tools for managing social media, marketing, and scheduling.

Squarespace started out of founder and CEO Anthony Casalena’s dorm room at the University of Maryland with its first version built for Casalena to create a better personal website for himself. At the time in 2004, there were very limited no-code options for individuals to build websites and out of existing services Casalena was deeply bothered that none of the products “took style or design into account — which doesn’t work when you’re trying to build your personal identity online.” Initially conceived as a blogging Content Managing System, Squarespace rapidly evolved into an all-in-one SaaS platform.

The company currently cites 3 pillars of main functionality: presence, commerce, marketing. Presence is Squarepsace’s no-code web development offering that allows users to create mobile and desktop-friendly websites with complete personalization or via curated templates. Commerce is the company’s e-commerce solution with scheduling and member area features. Scheduling allows businesses to share availability and take bookings for appointments and classes while member areas allow customers to create exclusive monetizable member-only content. Marketing comprises Squarespace's marketing solutions including email campaigns, CRM functionality, and SEO tools.

Squarespace competes in a highly competitive industry with firms offering almost substitutable products in the web development segment. The company cites online presence solutions like Automattic, Wix, and Weebly as well as e-commerce solution providers like Shopify and BigCommerce as competitors. Furthermore, the company states domain registration and website hosting services such as GoDaddy as a competitor. In the online presence vertical, Squarespace’s offering is touted as the closest to a professional website amongst competitors Wix and Weebly. However, it is not as beginner friendly as Wix and Weebly with it’s platform being tailored more for design conscious customers. In the commerce space, Squarespace’s offering is more flexible than Wix and Weebly as it accepts offline payments as well. Squarespace’s offering differs from Wix and Weebly through its all-in-one nature that does not require installing add-ons for additional services like marketing and commerce. In the pure commerce space, the company’s offering is not as feature rich as Shopify or BigCommerce but Squarespace’s commerce solution is more targeted for SMBs with less demanding needs.

Squarespace, unlike competitors, does not offer a free version of its products and prices in 4 tiers: personal, business, basic commerce, advanced commerce. The personal plan costs $12 per month while the most expensive plan, the advanced commerce comes in at $40 per month. Overall, 94% of revenue is subscription-based and 70% originates from US subscribers.

Financial Metrics:

Revenue growth in Q1’ 21 is 31% YoY with revenue coming in at $179.6M. Revenue grew 28% in 2020 to $621M. Revenue in 2020 is comparable to Wix revenue in 2018, but Wix posted faster revenue growth without the revenue boost induced from the pandemic. Total subscribers grew to 3.79M a 3.5% QoQ growth rate. ARPU increased 4% YoY to $190 in Q1’ 21.
Squarespace reported a net income of $30.6M for FY20 but reported a net income loss in Q1’ 21 of $10.1M a dramatic increase from $1.1M a year prior. FCF came in at $51.7M for Q1’ 21 with FCF margin being 29%. For FY20, FCF came in at $152.4M with 25% FCF margin. Adjusted EBITDA for Q1’ 21 was $11M and for FY20 was $116M with 6% and 19% margin respectively.
NDR is not reported however cash retention rate is reported. Cash retention rate is measured by the “percentage of revenue share and subscription bookings received in the current period from website and domain subscriptions in existence during the same period in the prior year.” Cash retention rate was 86% and 84% for FY20 and FY19.
Squarespace’s current market cap is $7.54B with an enterprise value of $7.9B. Currently, trades at 10.5 EV/implied ARR.
Median payback period and magic number over the months disclosed in S-1 was 22 months and 0.65.

Market Update

U.S. Treasury yields fall boosting growth stocks and pushing the S&P 500 index to record highs with health care stocks leading the way. The NASDAQ Composite Index outperformed for the fourth consecutive week as more investors transitioned out of cyclicals into growth stocks. Annual inflation headline hit a 13-year high at 5% as consumer prices rose 0.7% in May above consensus estimates of 0.4%. Long-term inflation expectations fell as Federal Reserve policymakers signaled a raise in interest rates by late 2023 and that the recent spike in inflation is temporary. Eurozone government bond yields fell for most of the week with eurozone inflation estimated to be 1.5% for 2021.