CrowdStrike (CRWD) Q3'25 - Retention Retention
Has CrowdStrike retained customers after the outage? We likely need a few more quarters to really tell. But at $388/share, market expects a lot.
Hi, I am Trung. I deep-dive into market leaders that passed my sleep-well checklist. I follow up on their performance with my Thesis Tracker updates, and when the right price comes, I buy them for the Sleep Well Portfolio, which I am building for my daughters to redeem in 2037. I disclose my reasoning for all BUY and SELL (ideally never). Access all content here.
Hi, sleep well friends,
This post is the Q3-24 thesis tracking for CrowdStrike—next, Veeva
Previously:
Fortinet (FTNT) - Core returned to growth, record profitability, up 70% since bought (Mar 2024)
Floor & Decor (FND) - Coping well with slow existing housing sales, up 28% since bought (Oct 2023)
WilScott MM (WSC) - Is the McGrath deal closing? Trimmed for Grab.
Dino Polska (DNP.WA) - Reaccelerating store opening, up 9% since bought (Apr 2024)
Sea Limited (SE) - SEA e-commerce leader, up 58% since bought (Jun 2024)
Mercado Libre (MELI) - LATAM e-commerce and banking leader, down 5% since bought (Oct 2024)
GRAB (GRAB) - SEA Super App leader, up 25% since bought (Oct 2024)
MIPS - helmet protection leader, up 61% since bought (May 2023)
Kinsale (KNSL) - E&S insurance leader, up 15% (May 2024)
WiseTech (WTC) - CEO shakes up, logistics SaaS leader, up 88% (Jan 2024)
FTNT + CRWD partnership of endpoint and network security leaders, up 70% and 75% (Mar & Jun 2024)
I compiled all thesis tracking here and linked it to the Sleep Well Portfolio spreadsheet (annual sub only). You can also access all buy-and-sell and deep dives.
As a reminder, I focus on the long-term story/execution of the business, not the quarterly Wall Street beat/miss quarterly records. So, my thesis tracker primarily checks how my picks build their value propositions, cope with adversity, and maintain/grow moats and market share.
Current Sleep Well Portfolio holdings:
For all sleep-well writeups, please visit this link.
Finchat.io, my personal Bloomberg terminal, sponsors this post; join Finchart.io using this link to get 20% off and support sleep-well investments.
CrowdStrike primer
CrowdStrike is a cybersecurity software company that provides cloud-based security solutions and services worldwide. The fundamental difference from its competitors is that CrowdStrike was built as a cloud-native platform driven by AI. The architecture allows data collection at scale, centrally storing it in the brain, which CrowdStrike calls the Threat Graph. The data then trains the algorithms on these vast amounts of high-fidelity data and develops into the legs and arms to do various services, which CrowdStrike calls the Falcon Platform.
The Falcon Platform has ten modules at IPO and has grown to 28 today. Starting on the left, the slide below contains functions such as detecting, preventing, and responding to all kinds of attacks for endpoints (desktops, laptops, servers, mobile, and IoT devices), the bread and butter of CrowdStrike. It’s what it started with and is known for. For the last few years, as more customers were onboarded, the Threat Graph has collected more data and become more intelligent. The data enabled the Falcon Platform to expand its functions to cloud security (protects cloud-based infrastructure, workload, applications, and data).
Today, CrowdStrike is an industry leader in endpoint and cloud workload protection, used by over 30,000 customers worldwide (up from 23,000 in 2023), boasting the fastest threat detection capability and 6x return on investment for customers thanks to its superior cloud-first, AI-native, and lightweight agent architecture. Financially, it has generated $4B+ Annual Recurring Revenue, grew revenue by 59% CAGR in the last 6 years, and free cash flow per share by 185% CAGR! As cybersecurity becomes more and more mission-critical in our digital world, the company has a long road ahead.
I link the S-1 document at IPO here if you want to know more about the technical side. It goes deeper into the architecture and the history of the business.
CRWD Q3’25 - Retention Retention
This is the first full quarter since the Global IT Outage that CrowdStrike caused. I reviewed the event extensively here and bought the sell-off at $205/share.
While it has worked out beautifully, our position has been up 90% since; is it justified at 80x FCF? To do that, we must evaluate CrowdStrike’s long-term retention rate and ability to keep winning customers (30K).
On first look at Q3’25 results, it is encouraging to see CrowdStrike’s win rate and deal size trending up despite the catastrophic event.
Our competitive win rates remain consistent to trending upwards and our total deal size for new business trended up over the last year, which we attribute to the continuous evolution of our platform solutions across cloud security, next-gen SIEM, identity protection, data security and AI.
Nevertheless, the dollar-based net retention rate (DBNRR) declined to 115% in Q3 '25 from 120%+ in the past.
Q3 dollar-based net retention was 115%, temporarily impacted by the incident and reflective of customers strengthening their commitment to CrowdStrike.
The retention rate could continue to fall in the next few quarters, as subscriptions are often 1-3 years long. However, CrowStrike is still delivering a gross retention rate of ~97% (down 0.5% from ~98%), which is excellent. For context, WiseTech [deep dive], the leader in logistic SaaS, has a 99-100% retention rate, and The Trade Desk [deep dive] has 95%+.
Q3 gross retention was over 97%, down less than 0.5 percentage point. Strength in retention was driven by the value that customers receive from the Falcon platform.
Read more on CrowdStrike here: deep dive (pre sleep-well structure), FTNT+CRWD partnership, Q2’25, Bought the fear, Q1’25, FY24, Falcon 2023
Q3’25 results at a glance with some highlights
The most important KPIs are in the table below.