CrowdStrike (CRWD -3.90%) went public on June 12, 2019. The cloud-based cybersecurity company priced its IPO at $34 a share, and its stock started trading at $63.50. Today, shares trade at about $200.
That impressive three-year return was driven by its explosive growth rates. Between fiscal 2019 and fiscal 2022 (which ended in January), CrowdStrike's number of subscription customers jumped from 2,516 to 16,325, which boosted its annual revenue from $250 million to $1.45 billion. Its annual recurring revenue (ARR) rose from $313 million to $1.7 billion.
Image source: Getty Images.
Between calendar 2019 and the middle of calendar 2021, IDC estimates that CrowdStrike's share of the modern endpoint security and response (EDR) market rose from 7.9% to 14.2%.
CrowdStrike disrupted traditional cybersecurity companies with a cloud-native platform, Falcon, which didn't require any on-site appliances. That approach was simpler, more cost-efficient, and easier to scale. But can the company maintain that impressive momentum over the next three years?
CrowdStrike's long-term plans
During an investor briefing in early April, CrowdStrike claimed it could grow its ARR to over $5 billion by fiscal 2026. That would represent a compound annual growth rate (CAGR) of at least 31% over the next four years.
It expects to achieve that goal by increasing its market share and wallet share while expanding its total addressable market (TAM) with new services. It believes the TAM for its current portfolio will expand from $58 billion in calendar 2022 to $71 billion in calendar 2024 and for the rollout of new services to expand its TAM to $126 billion in calendar 2025.
CrowdStrike plans to expand beyond its core enterprise market with new services for smaller companies and organizations. It estimates its enterprise market (more than 7,500 employees) already has a penetration rate of 35% but that the corporate market (251-7,499 employees) only has a penetration rate of about 3%. It also has a penetration rate of less than 1% among small-to-medium-sized businesses and public sector customers.
Those penetration rates could rise as the global surge in cyberattacks drives more organizations to upgrade their aging cybersecurity defenses.
As that market expands, CrowdStrike plans to grow beyond the EDR market with more zero-trust and extended detection and response (XDR) modules. Zero-trust services treat all users, including trusted employees, as potential threats. XDR platforms offer more automated AI services than EDR platforms.
That statement indicates CrowdStrike will aggressively challenge cloud-native zero-trust companies like Zscaler, as well as XDR service providers like SentinelOne, which claims its hybrid Singularity XDR platform (which merges cloud services, virtual appliances, and AI services) is faster and more efficient than CrowdStrike's Falcon platform.
Investors should expect CrowdStrike to significantly expand Falcon's lineup of cloud-based modules -- which already rose from 10 at the time of its IPO to 22 at the end of fiscal 2022 -- over the next few years. Its customers have already been using more modules over the past several years, and that number could continue rising as it launches more modules:
Image source: CrowdStrike.
This strategy of "landing and expanding," which has kept its dollar-based net retention rates above 120% ever since its IPO, locks in customers and widens its moat against more diversified competitors like Microsoft and Palo Alto Networks.
A sustainable business with a clear outlook
Unlike many other high-growth tech companies, CrowdStrike has proven that its growth is sustainable. Its adjusted operating margin turned positive in fiscal 2021 and doubled to 14% in fiscal 2022, while its annual free cash flow (FCF) has remained positive over the past three fiscal years.
Past performance isn't a dependable indicator of future gains, and analysts should always take long-term estimates with a grain of salt. That said, I believe CrowdStrike's solid track record indicates it has a clear path toward generating $5 billion in ARR by fiscal 2026.
CrowdStrike's stock certainly isn't cheap at 22 times this year's sales. However, the market's willingness to pay a premium for its shares in this difficult environment for growth stocks indicates it's still a best-in-breed cybersecurity company. Therefore, if CrowdStrike triples its ARR by the end of fiscal 2026, I'd expect its stock to at least double by calendar 2025.
