Crowdstrike S1 (will grow — but is it overvalued?)

S1s · Investing

Source URL:

Keywords: Crowdstrike, Cybersecurity

Summary

💡 AI-enabled cybersecurity — hard to check how effective this is, but seems to have excellent reviews from customers

Believe we are defining a new category called the Security Cloud, with the power to transform the security industry much the same way the cloud has transformed the CRM, HR, and service management industries.

With our Falcon platform, we created the first multi-tenant, cloud native, intelligent security solution capable of protecting workloads across on-premise, virtualized, and cloud-based environments running on a variety of endpoints such as laptops, desktops, servers, virtual machines, and Internet of Things, or IoT, devices.

Our Falcon platform is composed of two tightly integrated proprietary technologies: our easily deployed intelligent lightweight agent and our cloud-based, dynamic graph database called Threat Graph. Our solution benefits from crowdsourcing and economies of scale, which we believe enables our AI algorithms to be uniquely effective.

Products

Lightweight Agent

Approach starts with single intelligent lightweight agent that enables deployment of platform. Customers can adopt Crowdstrike across any type of workload running on a variety of endpoints. This offloads computationally intensive tasks to the cloud, while retaining local detection and prevention capabilities that are necessary on the endpoint.

The agent is nonintrusive to the end user and continues to protect the endpoint and track activity even when offline. By utilizing a single agent, customers are able to leverage all the capabilities of our platform without burdening the endpoint with multiple agents.

Lightweight agent intelligently streams high fidelity endpoint data to the cloud, where Threat Graph provides a simple, flexible, and scalable way to model highly interconnected data sets.

Threat Graph

Threat Graph processes, correlates, and analyzes over one trillion endpoint-related events per week in real time and maintains an index of these events for future use. It continuously looks for malicious activity by applying graph analytics and AI algorithms to the data streamed from the endpoints.

Modules

Integrate set of cloud-delivered modules includes:

  • next-generation antivirus
  • endpoint detection and response, or EDR
  • device control
  • managed threat hunting
  • IT hygiene
  • vulnerability management
  • threat intelligence

Founding principles and Network Effects

  1. The future of security would be driven by AI
  2. A cloud-native architecture would enable the collection of high fidelity data and scalability necessary for an effective solution

Strategy was focused on collecting data at scale, centrally storing such data in a singular model, and training our algorithms on these vast amounts of high fidelity data.

Cloud-scale AI means that the more data that is fed into our Falcon platform, the more intelligent Threat Graph becomes and the more our customers benefit, creating a powerful network effect that increases the overall value we provide.

Claim to be uniquely effective because they have more high fidelity data to train AI models and more security expertise to guide our feature selection—all resulting in industry-leading efficacy and low false positives.

If Threat Graph discovers something in one customer environment, all customers benefit automatically and in real time.

Sales and GTM

Customer Acquisition

Primarily sell platform and cloud modules through a direct sales team.

Sales uses a network of channel partners to generate leads. Amplify sales presence by leveraging technology alliance partners that can deliver, embed, or build applications with data and analytics from our Falcon platform.

Example: strategic technology and go-to-market partnership with Dell Inc. that will enable Dell's business customers to seamlessly add the Falcon platform to their purchase of Dell hardware. In addition, Dell and SecureWorks Corp. have agreed to take our Falcon platform to market as their preferred endpoint security offering through their global sales organizations.

Enhancing go-to-market strategy using a low-touch, trial-to-pay approach. In May 2018, launched a free trial of Falcon Prevent available from our website or the AWS Marketplace. Beginning to see a number of these trial users convert to paying customers. Believe this approach will enable a higher velocity of new customer acquisition and expansion, and will extend our reach to customers of all sizes.

đź’ˇ Have a low friction land-and-expand sales strategy. When customers deploy Falcon platform, they can start with any number of cloud modules and Crowdstrike can activate additional cloud modules in real time on the same agent already deployed on the endpoint.

Upselling

Once customers experience the benefits of Falcon platform, they often expand their adoption over time by adding more endpoints or purchasing additional modules. Dollar-based net retention rate, which measures expansion in existing customers' subscriptions over a 12 month period, was 147% as of January 31, 2019

Industry Trends

Cybersecurity Threats are Greater than Ever

Today's cybersecurity threat landscape is more dangerous than ever. Breaches are complex and often executed over multiple steps known in the industry as the threat lifecycle.

The typical threat lifecycle starts with an initial exploit to enter a system, historically using malware, but increasingly using malware-free or fileless methods, to penetrate endpoints and establish a beachhead inside the corporate perimeter. Once inside, adversaries move laterally across the corporate environment where they collect credentials and escalate privileges enabling the typical adversary to download a larger, more destructive malware program or connect with an external control source. At this stage in the threat lifecycle, the adversary is able to encrypt, destroy, or silently exfiltrate sensitive data.

Increasingly, adversaries are well-trained, possess significant technological and human resources, and are highly deliberate and targeted in their attacks. Adversaries today range from militaries and intelligence services of well-funded nation-states to sophisticated criminal organizations who are motivated by financial gains to hackers leveraging readily available advanced techniques. These groups and individuals are responsible for many breaches that involve theft or holding hostage financial data, intellectual property, and trade secrets. On a number of occasions, adversaries have launched devastating, destructive attacks that have caused significant business disruption and billions of dollars in cumulative losses.

Proliferation of Workloads Expanding the Attack Surface

The rise of cloud computing, workforce mobility, and growth in connected devices has created a rapid expansion of workloads across endpoints and industries. Devices, applications, and data are highly distributed and diverse, challenging organizations to monitor and protect all of their workloads running on various endpoints

The adoption of many of these technologies and the resulting disappearance of the corporate perimeter have expanded the attack surface and left many organizations increasingly vulnerable to breach

Today, workloads running on endpoints, such as laptops and servers, are the primary targets in a security attack since they are vulnerable and frequently are repositories of valuable and sensitive data, including intellectual property, authentication credentials, personally identifiable information, financial information, and other digital assets. As new workloads are provisioned on emerging mobile and IoT devices, oftentimes residing outside of the corporate perimeter, increasingly more sensitive and mission critical data will be generated and stored on these endpoints as well.

On-Premise Security Architectures are Constrained

On-premise products are siloed, lack integration, and have limited ability to collect, process, and analyze vast amounts of data—attributes that are required to be effective in today's increasingly dynamic threat landscape. Legacy vendors often deploy more agents to the endpoint as they layer on a patchwork of additional point product capabilities. This approach burdens endpoints by consuming additional storage space, memory, and processor capacity, degrading end user experience without providing effective security. In addition, integrating and maintaining numerous products, data repositories, and infrastructures across highly distributed enterprise environments is a costly and resource-intensive process for already thinly-staffed security teams.

Other Existing Security Products have Limitations

Legacy Signature-based Products

Signature-based products are designed to detect attacks that are already catalogued in a repository of previously identified threats, but are not capable of preventing unknown threats or stopping associated breaches. Many significant breaches seen in the last two decades have involved a failure of the legacy signature-based antivirus product to detect a previously unknown or modified version of a previously known attack.

Malware-focused Machine Learning Products

Traditionally, organizations have focused on protecting their networks and endpoints against malware-based attacks. These attacks involve malware built for the specific purpose of performing malicious activities, stealing data, or destroying systems. A malware-centric defensive approach will leave the organization vulnerable to attacks that do not leverage malware. According to data from our customer base indexed by Threat Graph, 40% of detections in the second quarter of fiscal 2018 were not malware-based, but instead leveraged legitimate tools built into modern operating systems, enabling attackers to accomplish their objectives without writing files to the endpoint, making them more difficult for a traditional antivirus product to detect.

Application Whitelisting Products

Application whitelisting products resort to an "always allow" or "always block" policy on an endpoint in order to allow or prevent processes from executing. Whitelisting relies in part on manually creating and maintaining a complex list of rules, burdening end users and IT organizations. In order to avoid these management challenges, IT organizations often create special exceptions to the whitelist that attackers leverage to compromise endpoints. Furthermore, fileless attacks can exploit legitimate whitelisted applications, compromising the integrity of the whitelisting product.

Network-centric Security Products

Traditional network security vendors have focused their products on perimeter-based protection. However, these approaches have decreased in relevance and effectiveness as employees and workplace devices have expanded beyond the firewall and the use of encrypted traffic has increased, creating blind spots and vulnerabilities that attackers are able to exploit. As the number of endpoints proliferates, this layer of defense cannot adequately protect information-rich endpoints and workloads that are outside the corporate perimeter.

Bolt-on Cloud Products

Many on-premise vendors have introduced cloud offerings by putting their on-premise products in the cloud. Such single-tenant products were not designed to run in the cloud and therefore continue to be siloed, lack integration, and possess limited scalability to identify threats across their customer base in real time. In addition, such products are complex to deploy, difficult to scale, brittle to maintain, costly to own, and can be ineffective in stopping breaches. Any product that was originally designed for on-premise deployments and migrated to the cloud cannot, by definition, be a cloud native solution.

Crowdstrike Solution

Key benefits:

Power of the Crowd

Enables all customers to benefit from contributing to Threat Graph. As more high fidelity data is fed into the Falcon platform, there is more data to train AI models with, increasing the overall efficacy of the platform. This benefits our customers and supports our efforts to gain more customers, creating a powerful network effect.

High Efficacy with Low False Positives

Platform collects, processes, correlates, and analyzes high fidelity data on both real-world attacks and benign behavioral patterns to continually train and enhance algorithms, resulting in industry-leading threat detection and low false positive rates

Consolidation of Siloed Products

Platform enables customers to reduce or streamline their siloed and layered security products, simplifying operations while providing a comprehensive solution

Consolidation of Agents

All of our cloud modules are powered by a single intelligent agent, allowing customers to consolidate and remove numerous agents from their infrastructure and restore endpoint performance

Rapid Time to Value

Streamline the deployment process by providing cloud-delivered security with protection policies that work from day one, eliminating lengthy implementation periods and professional services engagements

Constant Protection Anywhere

Secure any type of workload across a variety of customer endpoints such as laptops, desktops, servers, virtual machines, and IoT devices. In addition, once our agent is deployed on an endpoint it continues to protect the endpoint and track activity even when offline.

Opportunity

Total addressable market initially began as a replacement opportunity in the corporate endpoint security market, but has significantly expanded due to rapid innovation and adoption of cloud modules across additional security and non-security markets

Increasing market opportunity is driven by the proliferation of enterprise mobility, adoption of cloud computing, the benefits of big data, and an increasingly dynamic and intensifying threat landscape.

Today, have five markets:

Corporate Endpoint Security

In 2013, launched what is now Falcon OverWatch and Falcon Insight cloud module, and in 2017 launched Falcon Prevent, to disrupt the EDR and next-generation antivirus markets, respectively. IDC estimates that the global market for these segments will be $7.6 billion in 2019, and is expected to reach $8.7 billion in 2021.

Threat Intelligence

In 2012, released what is now the Falcon X cloud module to address the threat intelligence market. IDC estimates that the global market for this segment will be $1.6 billion in 2019, and is expected to reach $2.0 billion in 2021.

Security and Vulnerability Management

In 2017, released the Falcon Spotlight cloud module to address the vulnerability management market. IDC estimates that the global market for this segment will be $8.4 billion in 2019, and is expected to reach $10.4 billion in 2021.

IT Service Management Software

In 2017, released Falcon Discover cloud module to address first non-security market of IT Asset Management. IDC estimates that the global market for this segment will be $2.6 billion in 2019, and is expected to reach $3.1 billion in 2021.

Managed Security Services

In 2018, released Falcon Complete cloud module to address the managed security services market. IDC estimates the global market for this segment will be $24.8 billion in 2019, and is expected to reach $29.6 billion in 2021. Estimate that directly addressable opportunity in this segment is approximately $4.4 billion in 2019 and will reach $5.1 billion in 2021. In assessing the size of our addressable opportunity in this segment, we compared estimates from third party reports of the size of the corporate endpoint security market in which we operate to the size of the total IT security products market in the relevant year to infer the portion of the managed security services market in such year that would be addressable by our offerings.

Combining these segments, global opportunity is estimated to be $24.6 billion in 2019, and reach $29.2 billion in 2021

Growth Strategy

Grow Customer Base by Replacing Legacy and Other Endpoint Security Products

Grew our subscription customer base from 1,242 at January 31, 2018 to 2,516 at January 31, 2019, representing a 103% increase. Will continue to invest in customer acquisition programs, including channel partnerships, and new programs like our recently launched free trial program of Falcon Prevent that is easily downloaded from our website and AWS Marketplace.

Further Penetrate Existing Customers

When customers deploy the lightweight agent, they can easily add additional cloud modules. While some new customers initially deploy the Falcon platform broadly across the organization, others elect to deploy only in selected business units and later deploy on additional endpoints and subscribe to additional modules. The power of the land-and-expand strategy is evidenced by a 147% dollar-based net retention rate as of January 31, 2019.

Leverage Falcon Platform to Enter New Markets

Launched 7 new cloud modules on the platform since 2016. Because the lightweight agent collects diverse endpoint data once for repeated use, can expand our addressable market by rapidly adding new cloud modules that leverage this data. Intend to continue developing new cloud modules for broader endpoint use cases such as IT configuration management, performance monitoring, and IT operations that leverage this data as well as new classes of endpoints such as those created by IoT.

Broaden Reach into New Customer Segments

Initially targeted large sophisticated enterprises, but have expanded go-to-market efforts to include customers of all sizes with a dedicated inside sales team focused on smaller organizations

Broaden Reach into the U.S. Federal Government Vertical

Investing in the acquisition of customers in the U.S. federal government vertical. Platform recently received Federal Risk and Authorization Management Program (FedRAMP) compliance certification and has been added to the Department of Homeland Security's Continuous Diagnostics and Mitigation Approved Products List to provide federal agencies with innovative security tools. In addition, platform is deployed in the AWS GovCloud.

Expand International Footprint

Intend to grow our international customer base by increasing investments in overseas operations – including adding headcount in Europe, the Middle East, Asia-Pacific, and Japan, and establishing overseas data centers.

Extend Falcon Platform and Ecosystem

We designed architecture to be open, interoperable, and highly extensible. Intend to invest in our ecosystem and partner relationships to extend the functionality of our platform and support new use cases that take advantage of the high fidelity data in Threat Graph. Launched the CrowdStrike Store, the first open cloud-based application PaaS for cybersecurity and the industry's first unified security cloud ecosystem of trusted third-party applications.

Risks

  • If organizations do not adopt cloud-based SaaS-delivered endpoint security solutions, ability to grow the business and results of operations may be adversely affected
  • If solutions fail or are perceived to fail to detect or prevent incidents or have or are perceived to have defects, errors, or vulnerabilities, the brand and reputation would be harmed, which would adversely affect business
  • If solutions fail or are perceived to fail to detect or prevent incidents or have or are perceived to have defects, errors, or vulnerabilities, the brand and reputation would be harmed – which would adversely affect the business
  • Business is focused on cloud-based data analytics. Cybersecurity, privacy, and other regulations may affect how data is collected and processed
  • Claims by others that Crowdstrike infringes its proprietary technology or other intellectual property rights could result in significant costs and substantially harm our business, financial condition, results of operations, and prospects