Short CRWD

*Ask: If you know a fund looking for a L/S TMT analyst, please consider forwarding! Also if you’re long, please share your thesis. Email: [email protected]

MODEL LINK: https://www.dropbox.com/scl/fi/fn7k0r92xk1b1l9g0qeqs/CRWD-MODEL.xlsx?rlkey=j1o5tkhhaffbsjyvh3f4pw18z&st=hy8xjeo3&dl=0

Summary:

CrowdStrike (CRWD) is a compelling short over the next 12 months, as we believe ARR and revenue estimates will fall below consensus due to slowing growth in both emerging and core products. This makes it unlikely that CRWD can reaccelerate NNARR growth to +20%, which is required by street estimates in the outer years. As a result, CRWD may no longer warrant trading at a +50% revenue multiple premium (18.3x FY’27e revenue vs. 12.2x for comps) and a +30% FCF multiple premium (60.1x FY’27e FCF vs. 45.7x for comps). Our base case implies -16% downside, with an upside case of 28% downside and a downside case of +16% upside, as we expect CRWD will trade at a 25% premium revenue multiple to peer comps. From a timing perspective, we believe entering the short ahead of the Q2 print makes sense, as CRWD’s financials have continued to show signs of strain post-outage. Q1 revenue results landed exactly in line with guidance — a notable deceleration given the company beat revenue guidance by $28 million in Q3’25 and $27 million in Q4’25, even post-outage — supporting our theory that the beat-and-raise story will likely be challenged going forward.

Variant View:

Consensus views CrowdStrike as a 20%+ topline compounder with strong long-term growth potential, supported by a 30-product module platform, including 7 modules generating over $300m in ARR. Management is targeting $10bn in revenue and FCF margins in the mid-to-high 30s by FY’31. Despite the widely publicized July 2024 outage, customer retention remained strong in the high 90s, and DBNRR held at 112% in Q4’25, highlighting the company’s resilience and customer stickiness. Management expects a reacceleration in NNARR in 2H’26 (2025) as outage-related customer discounts roll off and 1-year product free trials that were given away as part of the outage compensation come up for renewal. Recent initiatives like Falcon Flex, an ELA-like funding model that simplifies module adoption, and the expansion of CrowdStrike Financial Services, which helps customers finance product purchases, should further accelerate platform-wide adoption.

Our variant view is that CRWD will likely fail to achieve consensus revenue and ARR estimates, as customers appear to be slowing their adoption of both emerging products and core endpoint/other offerings. Notably, NNARR YoY growth has been negative for the past three quarters, even when adjusting for the one-time CCP impact (see exhibit below), suggesting that customer spending weakness persists despite removing the impact of the discounts/free product. We believe management will achieve their $10bn target, which implies CRWD is more of a 15% CAGR through their FY’31 target, versus the street estimates, which imply closer to a 20% CAGR.

NNARR Growth (Adjusted for One-Time CCP Impact)

We believe this trend is likely to persist, as reflected in the recent deceleration of new module adoption. Notably, the percentage of customers adopting 6+ and 7+ modules did not grow sequentially (QoQ) for the first time in two years. Over the past six months, growth in these key metrics was just 1%, a meaningful slowdown compared to the 2–3% increases consistently observed over the prior two-year period (see Exhibit below). Additionally, we believe the recent adoption strength observed in Q3/Q4’25 was temporarily inflated by CRWD offering one-year free product trials as part of the Customer Care Package (CCP), which ended in Q1’26, aligning with the slowdown. Interestingly, this slowdown also coincides with recent product adoption initiatives such as Falcon Flex and CrowdStrike Financial Services, suggesting these initiatives are more likely defensive than offensive tactics.

Percentage of Customers that have Adopted 6+ and 7+ Modules

Going a layer deeper, CRWD discloses ARR on a per-module basis for 3 of the 7 $300m+ product modules, which include Cloud, Identity, and Next-Gen SIEM—collectively referred to as the Emerging Products segment. This allows us to back into the remaining ARR from the other 27 modules, which we refer to as Core Endpoint and Other Products. Notably, this segment makes up 70% of ARR and experienced a significant drop-off in NNARR in 2H’25, down 39.1% (or 32.4% ex. CCP impact, our estimate). The Emerging Products segment, which is the growth engine and accounts for the other 30% of ARR, also experienced a notable slowdown in 2H’25—particularly Identity, down 81.5% (or 58.5% ex. CCP impact, our estimate), and Cloud, down 27.8% (or 6.6% ex. CCP impact, our estimate)—which we highlight in the exhibit below.

NNARR BY PRODUCT (CCP Impact est. based on mgmt. $80m ARR total impact)

Management has attempted to explain this slowdown by stating that Identity and Cloud were largely impacted by giving away licenses for those modules as part of the CCP, which they claim will normalize at renewal, as customers will have to begin paying for those new modules.

However, even after adjusting for the CCP’s impact on the Emerging Products segment, NNARR for both Identity and Cloud still appears to have slowed meaningfully. While it’s reasonable to expect this one-time impact will fade and for growth to resume across Endpoint, Cloud, and Identity—which we incorporate into our ARR projections—our estimates still remain well below consensus for the next three years. For context, the street is forecasting NNARR to grow at a 20% CAGR from FY’27 to FY’29, a view that seems overly optimistic given NNARR grew just 5.7% in FY’24—a year unaffected by the outage. Moreover, the Street is modeling only 10% YoY NNARR growth in FY’26, a year that should actually benefit from the $80m CCP uplift coming up for renewal in 2H’26. This dynamic sets up tougher comps heading into FY’27 and raises the question of where the acceleration to +20% growth for FY’27–FY’29 will come from. Additionally, consensus ARR growth expectations appear misaligned with the 15% CAGR implied by management’s long-term $10bn ARR target by the end of FY’31, which suggests LSD–MSD NNARR growth—well below the 20%+ growth implied by Street estimates between FY’27 and FY’29. Our estimates imply NNARR growth will be in the L–MSD; as such, we estimate ARR will come in below consensus as follows: -1.3% in FY’27, -5.7% in FY’28, and -11.8% in FY’29. See the exhibit below.

Street NNAAR Est. Vs. Our NNARR Est.

Our estimates fall short of consensus primarily due to the Identity and Cloud segments, where management has provided long-term guidance, implying a 5-year ARR growth CAGR of 28.9% (midpoint) for Cloud and 22.5% (midpoint) for Identity. We model CAGRs of 22.5% for Cloud and 16.2% for Identity, falling significantly below consensus. Offsetting this downside, we model upside to Next-Gen SIEM and Endpoint & Other Products, which we discuss in depth at the product level forecast below.

Mgmt. LT Targets by Product vs. Our Estimates:

Below, we provide our forecast on a per-product basis to provide more granularity behind our assumptions.

• For Cloud, we model ARR growing at a 22.5% CAGR through FY’31, compared to management’s guidance, which implies a CAGR of 28.9% at the midpoint. We estimate CRWD will generate approximately $2 billion of Cloud ARR in FY’31—about 26% below management’s midpoint guidance of $2.75 billion. We believe their guidance is unrealistic, as we estimate Cloud NNARR only grew 7.8% in FY’25 after adding back our estimated $25 million impact from CCP free trials and discounts. Achieving their target would require Cloud NNARR to accelerate to a high-teens CAGR despite the product entering the later stages of its maturity curve, as Cloud now has 10k customers. We model NNARR continuing to grow at a MSD CAGR over the forecast period through FY’31, which we view as more realistic, especially considering FY’25’s MSD growth benefited from an unaffected first half and adding back the CCP impact. That said, we believe it is appropriate to assume MSD NNARR growth CAGR going forward, as CRWD should benefit from Wiz likely becoming a less formidable competitor in the cloud segment following its acquisition by Google.

• For Identity, we model ARR growing at a 16.2% CAGR through FY’31, compared to management’s guidance, which implies a CAGR of 22.5% at the midpoint. We estimate the company will generate approximately $910 million in Identity ARR by FY’31—about 27% below management’s midpoint guidance of $1.25 billion. Identity’s growth appeared to deteriorate significantly in 2H’25, declining by 81.5% (or 58.5% excluding the CCP impact, based on our rough estimate). Identity YoY NNARR growth also declined slightly in 1H’25, which was not significantly affected by the CCP, suggesting the slowdown in Identity is not entirely attributable to the outage. We believe it is highly unlikely that management will achieve their guidance, as this would require Identity NNARR to accelerate to a mid-to-high teens CAGR despite the recent drop-off in growth. Furthermore, we believe CRWD lacks the same strong competitive & product positioning in Identity as it has in Cloud and Endpoint, which reduces our confidence in a reacceleration—let alone one sufficient to meet management’s guidance. As such, we model NNARR remaining flat for Identity over the forecast period.

• For Endpoint and Other, we model ARR growing at an 8.5% CAGR through FY’31, compared to management’s midpoint guidance, which implies a 6.3% CAGR. While we model NNARR growth continuing to decline YoY, we expect the rate of decline to slow to the LSD by FY’31. We believe management will prioritize ramping new product module offerings to help offset weakness in Cloud and Identity, which should partially counterbalance the ongoing deceleration in the core endpoint module, as it moves further along its maturity curve.

• For LogScale/NG SIEM, we model ARR growing at a 39% CAGR through FY’31, compared to management’s midpoint guidance, which implies a 32.1% CAGR. Our estimates are ahead of management’s, as we see a meaningful opportunity to displace legacy SIEM providers. LogScale offers a more cost-effective alternative to what has traditionally been a major expense, reducing customer TCO by consolidating SIEM tools on CRWD.

ARR BY PRODUCT MODULE:

VALUATION/COMPS/ESTIMATES

As of 08/07/25, CRWD traded at 18.3x TEV/FY’27e consensus sales (18.7x our estimate) and 60.1x TEV/FY’27e consensus FCF (59.6x our estimate), while comps (NOW, ZS, SNOW, DDOG) with similar growth and profitability outlooks have an average 12.2x TEV/FY’27e sales multiple and 45.7x consensus FCF multiple. This implies CRWD is trading at a 50% premium on a sales multiple basis and a 30% premium on an FCF multiple basis relative to the comp set. This is virtually the highest relative premium CRWD has traded at over the past three years, excluding a brief period pre-outage, and historically, it has traded in line with the comp set. If our forecast proves more directionally accurate than street estimates, we anticipate there will be a de-rating in CRWD’s multiple, as the premium multiple would no longer be justified. We believe bulls have assigned the premium multiple based on the expectation that growth will accelerate above 20%. However, it is our view that 20% growth is not sustainable. Our base case implies ~16% downside, which is a blended average of our revenue multiple valuation of 15.3x FY’27e sales (a 25% premium to the comp set) and 50x FY’27e FCF (a slight premium to the comp set, but a 47% premium to NOW’s FCF multiple, which has comparable margins and growth, unlike the other comps that are earlier in their margin curve). Our downside case implies ~16% upside, based on a blended average of a 21.4x FY’27e sales multiple (a 75% premium to the comp set) and 70x FY’28e FCF (an approximate 100% premium to NOW’s FCF multiple). Our upside case implies ~28% downside, based on a blended average of a 12.2x FY’27e sales multiple (in line with the comp set average) and 45x FY’27e FCF (a 30% premium to NOW’s FCF multiple). We believe CRWD’s FCF multiple is relatively fragile, as investors were recently burned by a significant drawdown due to the outage and remain vulnerable to shifting competitive narratives, particularly with MSFT. As such, we believe our base case of CRWD trading at a 25% premium to the comps is reasonable, and if investors lose further confidence in the sustainability of 20% growth, there will be little reason for CRWD not to trade in line with the comps.

Risks

M&A to Fill Shortfall: CRWD has $4 billion in net cash, giving it the flexibility to temporarily mask minor earnings shortfalls with M&A. However, we don’t believe the company can rely on acquisitions alone to bridge the widening gap between our estimates and street estimates in FY’27 and FY’28—at least not without disclosing the revenue or ARR contribution from M&A. Significant acquisitions also appear unlikely, as CRWD generates a mid-teens percentage of its FCF from interest income. To meet or exceed its FCF margin targets, the company would likely need to maintain a large cash balance and avoid incurring substantial interest expense.

NET Multiple Possible?: NET has a larger proportion of retail investors who are less valuation-sensitive, a more defined AI beneficiary narrative, and a “fourth cloud” story. As such, we believe it’s far more likely that CRWD’s multiple will mean revert toward the broader comp set rather than converge with NET, which remains an outlier.