Crowdstrike is Still a Rule of 40 Business — Just Not a 25x Sales One
Crowdstrike is priced for perfection, but is it delivering? Are shares a good buy for retail investors, or should you stay on the sidelines?
Once again, Crowdstrike shares suffered a sell-off post-earnings last Wednesday. Luckily, this time it wasn’t as bad as it was back in March, when shares lost 20% of their value, but Wednesday’s 6% sell-off is still considerable.
Were the results that bad? Honestly, while not ideal, they definitely weren’t bad, with the company delivering Q1 results roughly in line with consensus estimates, and guidance was slightly light.
However, ‘just okay’ just isn’t good enough when shares are trading at a 140x P/E and a 25x sales multiple. Crowdstrike shares are priced for perfection, and while I will happily argue Crowdstrike’s underlying growth dynamics and its execution remain strong, maybe even pristine, growth is slowing, and margins show some weakness.
Crowdstrike isn’t delivering perfection right now, and the sell-off was easily justified. In fact, a deeper correction might have been justified.
Now, don’t get me wrong here: I am a massive Crowdstrike bull. The company is undoubtedly the highest quality pick in the extremely promising cybersecurity industry. The company combines a highly scalable, cloud- and AI-native platform with strong execution and a compelling business model.
At the core of its success is the Falcon platform, which is built entirely in the cloud and utilizes a single, lightweight agent to deliver a range of security modules, including endpoint protection, identity security, threat intelligence, and more. This architecture enables rapid deployment, seamless updates, and minimal system resource usage, resulting in improved performance and a better user experience. This brilliant architecture, combined with its exceptional security performance driven by machine learning, is exactly why Crowdstrike barely saw a slowdown in growth or loss of users after the massive outage that occurred about a year ago. Clients simply value its product too highly.
On that note, CrowdStrike also benefits from a powerful data network effect. With each new customer, the platform gathers more telemetry data, strengthening its ability to detect threats using machine learning. This feeds back into the product, making it more effective over time and increasing its value to customers. As a result, customer retention is high, and the company enjoys strong net revenue retention rates, typically above 120%, indicating that existing customers consistently spend more over time, which is also driven by a well-executed go-to-market strategy.
Finally, financially, the company stands out in its own class. CrowdStrike has reached a point of scale where it combines high revenue growth with expanding margins and strong free cash flow. 90% of the company’s revenue is recurring, subscription-based, with gross margins typically over 75%. Retention consistently exceeds 120%, and its FCF margin generally ranges between 25-35%, all while it continues to grow revenue at a rate of 20% or more.
As a result, year after year, Crowdstrike qualifies as a “rule of 40” business, putting it in a pristine class. In other words, this company is, in my eyes, the rockstar of the cybersecurity arena and by far the most likely to see long-term success in a rapidly growing market, which is precisely why it’s valued this highly by investors.
For reference, the cybersecurity industry is estimated to grow at a 10-12% CAGR through the end of the decade, with faster-growing vectors, in which Crowdstrike operates (like cloud security and identity protection) growing at a CAGR closer to 20%. In fact, in its latest earnings presentation, Crowdstrike points to a 21% CAGR for its TAM, which is brilliant. Simply put, rapid growth in cyber attacks is leading to the rapidly growing demand for best-in-class protection.
Meanwhile, Crowdstrike isn’t just operating in this market, but annihilating the competition, rapidly gaining market share. For reference, in endpoint security, its market share has grown from 13.8% in 2021 to over 20% today.
As a result, the fair expectation is that Crowdstrike will continue to grow rapidly. Honestly, I believe assumptions for Crowdstrike to keep growing at a 20%+ rate well into the next decade are more than reasonable – that is how good this business is, how good it’s executing, and how well it’s positioned.
That Crowdstrike is one of the highest valued large caps shouldn’t come as any sort of surprise, right?
Fundamentally, Crowdstrike is pure brilliance still.
So, let’s make up the balance! Today, I will take a thorough look at the Q1 results, looking beyond the headline numbers and putting things into a bit of perspective to eventually make up the balance – are Crowdstrike shares worth buying despite its insane multiples? Should you buy this minor dip?
Let’s find out!
Crowdstrike delivers a good quarter, but not an impressive one (though still a Rule of 40)
Crowdstrike released its fiscal Q1 results last Tuesday and, like I said, managed to deliver results roughly in line with Wall Street’s expectations. The company continues to deliver strong growth and healthy margins, although neither is quite as impressive as investors have grown accustomed to. As I alluded to before, Crowdstrike isn’t quite delivering the perfect results its shares are priced for, at least as far as the headline results go, on which investors tend to base their judgment.
However, this is where you might go wrong. Crowdstrike’s headline results don’t tell the entire story at all. While these show some “weakness” and become less impressive (as widely expected), only very little of this is within management’s control, with external temporary factors also playing a role here. Meanwhile, operational numbers remain excellent, as Crowdstrike continues to execute really well, giving me confidence in its long-term success. Additionally, although headline numbers may be less impressive, they are still very strong and well above those of most of its peers – it’s all a matter of perspective.
Crowdstrike’s revenue growth has indeed continued to slow, dropping from the low-30s in fiscal 2025 to just 20% in the latest quarter, which is far from ideal, especially for a company trading at 25x sales. That is somewhat hard to justify, given the growth rate of “just” 20%.
This 20% is also a significant slowdown from Q4, when the company still managed to deliver 25% growth, and is far below the 33% it reported one year ago. The reason for the slowdown? A combination of macro pressures, market saturation in core offerings, and elevated comps from past years.
For starters, the June outage led to some slowing in new deals, even as retention has shown no weakness. As shown in the graph below, following the outage in Q2 last year, growth has slowed down more significantly. On top of this, Crowdstrike is dealing with the rule of large numbers as it approaches $5 billion in ARR, making it the largest pure-play in the industry. At some point, size starts to work against your growth numbers, and Crowdstrike is starting to feel this.
Additionally, the macro environment is far from ideal, due to tight IT budgets leading to longer deal cycles. CrowdStrike has acknowledged that customers are requiring more approvals and bundling products in fewer transactions, impacting new business velocity.
This combination of factors is leading to the slowdown in growth, as shown above. Unsurprisingly, this significant slowdown isn’t what the market likes to see, and neither do I.
At the same time, let’s not start acting like this is poor growth. The company is still outgrowing most of its peers and the industry in a somewhat more challenging operating environment, and continues to grow at a rate of over 20%.
Crowdstrike delivered 20% growth in Q1 to $1.1 billion in revenue.
SentinelOne delivered 32% growth in its latest quarter, but at 5x lower revenue.
Palo Alto delivered growth of only 14% (just below 2x the size of Crowdstrike)
Zscaler reported 26% growth, but is also only half the size of Crowdstrike.
Additionally, the short-term impacts plaguing it should ease now, which is why management anticipates a sequential acceleration in growth in the quarters ahead. Therefore, we should at least see stabilization at around or just above 20%, which is a positive development and should alleviate some concerns.
All things considered, I believe Crowdstrike’s 20% growth rate right now is still rather strong, especially if it doesn’t weaken any further. Yes, it shows weakness and isn’t what I hoped to see, but it doesn't come as a surprise. Considering things should improve in H2, I am not too concerned, especially given how well the company continues to perform under the hood.
In ARR (Annual Recurring Revenue), we are seeing a similar trend. Q1 net new ARR was $194 million, which was well ahead of management’s expectation amid deal strength.
As a result, Crowdstrike surpassed an ARR of $4.4 billion, up 22% YoY, driven by the success of Falcon Flex, record MSSP channel results, strength across most geographies, and strong module adoption by existing customers. Nevertheless, similar to revenue, ARR growth has been slowing considerably, but should bottom here and remain well above 20%, which I still consider very healthy.
This is supported by a good performance within the company’s MSSP business, now accounting for 15% of Q1 ARR. For reference, an MSSP is a company that monitors, manages, and responds to cybersecurity threats on behalf of other organizations. Businesses hire MSSPs to handle some or all of their security operations, especially if they lack the in-house expertise or resources to do it themselves.
In Q1, Nvidia announced Crowdstrike as its MSSP for certain operations to secure hardware and software. A big deal!
Looking a bit deeper into Crowdstrike’s Q1 numbers, one big highlight is its significant success in customer retention, deal expansion, and acquisition. For reference, Crowdstrike maintains a 97% gross retention rate, as it sees very little outflow due to the sheer quality and importance of its product. The Falcon platform remains best in class, offering ease of implementation, cost-effectiveness, and incredible efficiency. Its retention number didn’t even budge after the June outage last year, which is a testament to customer satisfaction.
Besides great retention, Crowdstrike’s ability to close massive new deals with both new and existing customers is excellent and almost entirely driven by the success of its Falcon Flex offering, which added a whopping $774 million in account value in Q1, bringing total Falcon Flex value to $3.2 billion, up 31% sequentially and up 6x YoY.
So, what is Falcon Flex? This is a subscription model offered by Crowdstrike, providing customers with greater flexibility within their subscription. In simple terms, Flex allows customers to commit to a pre-negotiated spend that can be allocated across various modules and services within the CrowdStrike portfolio as their needs evolve.
So, a customer closes a contract for $1 million annually with Crowdstrike and can allocate the credits across any modules it needs, and as demands evolve, they can quickly cut or add modules within the contract size.
It’s brilliant, honestly. Crowdstrike remains assured of the agreed-upon contract spend, while the customer gains greater flexibility to address its evolving security needs. It makes the entire process much simpler and straightforward. Customers can quickly deploy and scale security solutions without the need for renegotiating contracts or undergoing additional legal reviews. For instance, if a new security threat emerges or business requirements change, customers can swiftly access the necessary tools and services within their existing Falcon Flex agreement, ensuring timely and effective responses to cybersecurity challenges.
The result? Firstly, customers spend more, with an average deal size exceeding $1 million in ARR. Second, customers are committing to longer contracts due to the higher flexibility in addressing changing needs, with the average Flex contract signed for just under three years.
Falcon Flex is evolving the go-to-market strategy for Crowdstrike, making it easier for customers to adopt more products over time, without being locked into rigid contracts. It’s helped drive larger deals, stronger customer retention, and deeper partner engagement. Essentially, Falcon Flex aligns CrowdStrike’s sales model with how businesses now prefer to buy security—scalable, modular, and consumption-based.
It is working out tremendously well for Crowdstrike. For reference, 75% of Flex contracts are already deployed, meaning customers have already allocated 75% of their credits under their contracts. In fact, many are already fully allocated, leading to “re-flexes,” as Crowdstrike calls it. In simple terms, it means customers have already deployed their initial contract demand plan and have returned to grow their contract size, often within 5 months of signing the initial three-year contract.
Customers simply see the value of Crowdstrike’s offering and quickly realize they need more modules. The result for Crowdstrike is rapid scaling among existing customers, much faster than under traditional contracts. And while flexible contracts usually aren’t great, Crowdstrike is still ensured of an agreed contract value, which is brilliant.
So, we got longer contracts, higher contract value, much faster module adoption, and improved customer satisfaction. It’s attracting customers and increasing value for Crowdstrike, as well as its entire economics.
Again, it’s brilliant, and adoption has been rapid. This Falcon Flex and the added value are giving management confidence in a growth acceleration in the latter half of the year. This is likely to fuel healthy growth, especially as we should see many more Flex users re-flex their contract, considering the high deployment rate.
Like I said, Crowdstrike is executing strongly. This is expected to drive growth in the second half of the fiscal year and in the years to come.
On that note, let’s move to the bottom-line results, where Crowdstrike continues to see a pronounced impact from the June 2024 outage due to lingering expenses.
Starting at the top, Crowdstrike delivered a strong subscription gross margin of 80%, which remains best-in-class, helped by the efficiency of its AI-powered platform. This resulted in an overall gross margin of 78%.
Further down the line, Crowdstrike reported total operating expenses of $939 million, up 36% YoY and outpacing revenue growth, putting some pressure on margins. Growth in expenses was primarily driven by a 42% increase in R&D expenses, reflecting heightened upfront technology investments and AI innovation.
This translates into an operating income of 18.3%, representing a 270-basis-point decline year-over-year, reflecting top-line weakness and increased costs. Again, this also includes some incurred costs from the June outage, which weigh on Crowdstrike’s margins.
As a result, they aren’t entirely representative. Long-term management continues to target a 28% to 32% operating margin, so expect a solid improvement in the quarters and years ahead, as cost growth should slow down.
Ultimately, this resulted in a non-GAAP net income of $185 million or $0.73 per share, which beat consensus estimates by a solid $0.07.
At the same time, Crowdstrike reported a GAAP net loss of $110 million, which includes $39.7 million of outage expenses and $254 million in SBC. Especially the latter continues to be a huge issue for me. So far, I was willing to accept Crowdstrike’s unhealthy SBC levels as it was a high-growth business. However, since growth has fallen considerably and the company is unlikely to return to 30 %+ growth anytime soon, I have a hard time justifying its SBC spend, which isn’t trending in the right direction either.
Last quarter, SBC as a percentage of revenue was 24.2%, which was the highest Q1 level in over 4 years. Here are the Q1 SBC percentages by year:
Q1 2023 = 22.2%
Q1 2024 = 18.9%
Q1 2025 = 19.9%
Q1 2026 = 24.2%
By now, this is on the edge of unacceptable. I expect this is a no-go for plenty of you. If management doesn’t work in bringing this down as its operating environment normalizes over the next year, I might change my opinion on Crowdstrike.
SBC is a massive issue that needs to be considered. Realistically, this is simply a business expense.
On a more positive note, despite cost headwinds, Crowdstrike still reported strong FCF of $279 million in Q1, reflecting a FCF margin of 25%. This included a $61 million outage-related headwind, but still showed a solid improvement from previous quarters.
Similar to what I have discussed earlier, margins continue to suffer under slowing top-line growth, heightened expenses, and some one-offs. This is no different for FCF. However, once Crowdstrike reaccelerates growth and slows its spending in the years ahead, I anticipate its FCF margin will return to consistently over 30%.
Management targets a long-term FCF margin of 34% to 38%, which remains really strong.
Additionally, despite experiencing some depressed growth and margins, Crowdstrike maintains its Rule of 40 status.
Thanks to these healthy cash flows, Crowdstrike continued to strengthen its balance sheet, growing its cash pile to an all-time high of $4.61 billion, with no debt outstanding.
Additionally, thanks to its substantial cash reserves and management’s conviction, the board authorized a $1 billion share repurchase program, which at least attempts to offset some of this dilution, although 2025 SBC is likely to exceed $1 billion already.
On that note, let’s move to the outlook!
Before we move on, just a quick word…
Want more out of your subscription?
InvestInsights PRO - $7.50/month ($70/annually)
An additional 2-6x/month premium stock analysis.
Full insight into my own portfolio (15% return CAGR since 2022).
Monthly portfolio updates + Instant transaction alerts (Fully transparent)
A complete overview of all my target prices and ratings (Excel file).
2x/month The Watchlist Report
Instant access to earlier premium analysis on, for example, Adobe, Thermo Fisher, Spotify, and The Trade Desk.
Outlook & Valuation
Looking ahead to the remainder of the fiscal year, there is room for some positivity. For Q2 and H2, management expects a sequential acceleration in ARR. Falcon Flex is accelerating platform adoption, offsetting any other weaknesses, and as this ramps up, it should further accelerate growth in H2. Furthermore, this should also allow for some margin expansion.
At the same time, it is worth considering that revenue will likely not keep pace with ARR growth due to the CCP program, which included the one-time option for customers to choose more product, more time, or both, resulting in an impact on subscription revenue. This is why this will likely not see the same acceleration in growth as we will see in ARR.
This translates into an expectation for Q2 revenue between $ 1,144.7 million and $1,151.6 million, reflecting a year-over-year (YoY) growth of 19%, which indeed shows some further revenue weakness. This fell short of a $1.16 billion consensus.
Meanwhile, management expects an operating margin of approximately 20%, which would be down roughly 350 bps YoY. This should result in an EPS of approximately $0.82 to $0.84.
For the fiscal FY26, management now expects revenue ranging from $4.74B to $4.80B, suggesting YoY growth of between 20% and 22%, reflecting an acceleration in growth in the second half of the year. Nevertheless, this fell short of a consensus for $4.79 billion. At the same time, EPS guidance of $3.44 to $3.56 was comfortably above a $3.46 estimate and suggests some solid improvement in margin later in the year.
Overall, management remains fairly confident. I must say I share this optimism. While I was not impressed by CrowdStrike’s Q1 results, I appreciate the underlying developments and the significant impact of Falcon Flex. As a result, I don’t doubt management’s guidance and expect FY26 results to come in at the high end of the range.
Therefore, I have left my revenue projection for FY26 unchanged, while I have slightly lifted my EPS estimate to account for the stronger-than-expected Q1 result. Additionally, I have left my medium-term estimates largely unchanged, expecting growth to stabilize in the mid-twenties and a rapid margin recovery to drive EPS growth in the mid-thirties. For reference, management now targets an operating margin of 24% for fiscal year 27 and a free cash flow margin to return to over 30%.
I still expect Crowdstrike to remain a growth engine well into the next decade.
Despite my bullish medium-term outlook and Crowdstrike still executing at a very high level, we can’t deny Crowdstrike is showing some weakness and is no longer delivering perfection, which is why valuation starts to matter more – there is no hiding behind mind-blowing growth anymore.
And valuation is the massive issue here. Based on the projections above, Crowdstrike shares now trade at 130x this year’s earnings and 25x sales, which are insane multiples to pay for any business, let alone a large-cap. Whether we look at P/E, PEG, P/S, EV/FCF, or EV/EBITDA, Crowdstrike shares trade at a massive premium to peers or industry averages.
Yes, the company very much deserves a premium multiple, but this is just ridiculous. By now, Crowdstrike is one of those companies that trade at a massive premium 90% of the time, and what we as retail investors need to target is that 10%. Recent examples of this were the technology dump in early 2023 and the post-outage sell-off in July and August 2024. These were brilliant opportunities that allowed me to start a position at a cost base of $144.
Apart from these unique moments, Crowdstrike shares rarely offer a good risk-reward opportunity, and this time is no different, even after last week’s minor sell-off.
I am not surprised to see nothing but insider selling for Crowdstrike over the recent months. In April, director Johanna Flower sold a stake worth ~$1.1M. This also includes senior management, such as the CEO, CFO, and Chairman of the Board.
Anyway, with shares still near all-time highs, these are nowhere near worth buying in my book. Even as I am incredibly bullish on Crowdstrike and believe it to be a no-brainer for the next decade, this only works at the right price. Based on current projections, I believe shares are only worth considering below $350 per share, ideally below $300.
For now, while I’ll happily hold onto my shares, I am not considering buying.
Another great writeup!