June 10, 2024
Yesterday’s ransomware attack on a supplier to the UK’s National Health Service, impacting several major London hospitals, tragically underscores the escalating threat landscape for all organisations seeking to combat cybercrime. Indeed, the present moment perhaps echoes the famous opening of Dickens’ A Tale of Two Cities: “It was the best of times, it was the worst of times, it was the age of wisdom, it was the age of foolishness…”, with cybersecurity companies experiencing continued unprecedented demand for their services amidst a relentless surge in cyberattacks that seemingly no longer spares healthcare providers, once considered less likely targets compared to commercial entities.
CrowdStrike and Palo Alto Networks are two leaders in the cybersecurity space, each offering a unique approach to protecting organisations from evolving threats. In this company update, I’ll seek to compare both companies and provide a perspective on their relative financial strength and current valuation.
CrowdStrike (NASDAQ: CRWD) has made a name for itself with its cloud-native Falcon platform, designed to consolidate many cybersecurity functions into a single, unified solution. Falcon leverages artificial intelligence to detect and respond to threats in real time, offering comprehensive protection across endpoints, cloud environments, and identities. CrowdStrike’s emphasis on AI-driven innovation and its ability to scale effectively has made it a popular choice for organisations of all sizes seeking to streamline their security operations.
Palo Alto Networks (NASDAQ: PANW), on the other hand, has adopted a “platformisation” strategy, offering an extensive portfolio of products across network security, cloud security, and security operations. This approach allows customers to choose the specific solutions they need while benefiting from the integration and interoperability of a unified product suite. Palo Alto Networks’ focus on platformisation aims to address the growing complexity of cybersecurity environments and provide comprehensive protection across various attack surfaces.
Both companies have demonstrated impressive financial growth in recent years. In its most recent quarter (Q1 FY25), CrowdStrike delivered total quarterly revenue of $921 million (+33% YoY), vs $1.98 billion (+15% YoY) for Palo Alto. CrowdStrike is growing revenue faster from a smaller base, demonstrating the company’s effective capture of market demand for endpoint security solutions.
Beyond total revenue, a more important indicator for both companies is Annual Recurring Revenue (ARR). ARR provides a clearer insight into future recurring revenue, which is a key indicator of the health and growth potential of a subscription-based business model. In latest reporting, CrowdStrike delivered ARR of $3.6 billion (+33% YoY), driven by strong demand for its Falcon platform and the success of its ‘Falcon Flex’ flexible subscription model. Palo Alto also reported robust next-generation security ARR of $3.79 billion (+47% YoY). Although Palo Alto’s ARR would seem to be growing faster, this may be a somewhat deceptive medium-term picture influenced by customers’ upgrading from legacy platforms to the company’s “next-gen security” offering. Longer-term, it would be reasonable to expect Palo Alto’s ARR growth to trend towards the same level as revenue growth (currently 15% YoY).
Overall, CrowdStrike would seem to be positioned more strongly for long-term growth, as its total revenue is growing faster, and recurring revenue makes up 95% of total revenue. In contrast, just 51% of Palo Alto’s total revenue is next-gen security ARR (“subscription and support” revenue represents 80% of total revenue, but this is not strictly ARR).
Both companies have reaffirmed their commitment to long-term targets for ARR, with CrowdStrike seeking to deliver $10 billion “within 5-7 years”, and Palo Alto aiming for $15 billion in full-year 2030. McKinsey research suggests that future demand for commercial cybersecurity solutions could ultimately support a $1.5 trillion market. Given that the cybersecurity sector is unlikely to be constrained by demand, CrowdStrike and Palo Alto would both need to maintain ARR growth above 23% to achieve their targets. Considering our prior comments on ARR trend, this seems reasonably achievable for CrowdStrike, and perhaps more of a stretch goal for Palo Alto.
A final useful financial comparator might be Remaining Performance Obligations – the value of contracted future revenue that is not yet recognised. CrowdStrike reported RPO of $4.7 billion (+42% YoY), Palo Alto reported RPO of $11.3 billion (+23% YoY). The consistent growth in RPO for both companies suggests strong demand for their products and services, but once again, CrowdStrike seems to be growing more strongly from a smaller base.
A reverse discounted cash flow model using reasonable assumptions suggests that investors are expecting 26% free cash flow growth from CrowdStrike, and a more modest 13% from Palo Alto Networks. To establish whether those expectations are reasonable, we can look to the trajectory of free cash flow for both companies.
CrowdStrike is forecasting a free cash flow margin of 31-33% for the current full year, with a long-term objective of expanding this to 34-38%. Taken together with the company’s forecasts for ARR growth over the 5-7 year timeframe, the 26% free cash flow growth implied by the simple valuation model would seem to be a reasonably conservative estimate.
Palo Alto is forecasting a free cash flow margin of 38-39% for the current full year. Considering that the margin profile of this more mature company can be expected to remain stable, and our long-term expectations for ARR growth, the 13% free cash flow growth built into the current valuation would seem to be fairly accurate.
(this company update will be refreshed with the latest quarterly data from CrowdStrike once published in ycharts)
Both CrowdStrike and Palo Alto Networks represent solid investment opportunities in the cybersecurity space, albeit catering to slightly different investor appetites based on risk tolerance and growth perspectives. As cybersecurity threats evolve, both companies are well-positioned to capitalise on the expanding market (“a rising tide lifts all boats”), each leveraging their unique strengths to consolidate their presence further.
CrowdStrike’s strategy of delivering a single cloud-native solution, positions it well in a segment experiencing rapid growth, particularly as businesses accelerate their digital transformation. Palo Alto’s broader suite of products appeals to a wide range of customers, from small businesses to large enterprises, providing it with a diverse revenue stream that may offer more stability. However, the company’s platformisation strategy faces the challenge of convincing customers to adopt its full suite of products, and success will depend on the company’s ability to demonstrate the value of its integrated platform and drive cross-selling opportunities.
Based on this updated investment analysis and giving consideration to the expectations built into the current valuation, 7investing are updating our conviction and risk rating for both companies.
To see our latest stock rating on CrowdStrike, as well as full due diligence on 200+ other investment opportunities, sign up at 7investing.com/subscribe with coupon code “Cybersecurity” to get your first week free!
Already a 7investing member? Log in here.
© Copyright 2023 7Investing All Rights Reserved
