Ladies and gentlemen, thank you for standing by and welcome to the CrowdStrike Fourth Quarter and Fiscal Year 2021 Financial Results Conference Call. At this time, all participants are in a listen-only mode. After the speaker presentation, there will be a question-and-answer session. [Operator Instructions]. Please be advised that today’s conference is being recorded. [Operator Instructions]. I would now like to hand the conference over to your speaker today, Maria Riley, Investor Relations for CrowdStrike. Please go ahead.

Good afternoon and thank you for your participation today. With me on the call are George Kurtz, President and Chief Executive Officer and Co-Founder of CrowdStrike; and Burt Podbere, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, and expected performance, including our outlook for the first quarter and fiscal year 2022 are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we have made are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements whether as a result of new information, future events or otherwise. Further information on these and other factors that could affect the company’s financial results is included in filings we make with the SEC from time-to-time, including the section titled Risk Factors in the company’s quarterly and annual reports that we file with the SEC. Additionally, unless otherwise stated, excluding revenue, all financial measures discussed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our press release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today. Please also note that in light of our recent acquisition of Humio management will provide additional information into our guidance assumptions. We do not intend to provide this additional information on an ongoing basis. Now, I'll turn the call over to George to begin.

Thank you, Maria. And thank you all for joining us today. We have a lot of ground to cover. I will focus today's discussion on three key points. First, we delivered a phenomenal fourth quarter with results exceeding our expectations across the board, as customers of all sizes are increasingly choosing CrowdStrike as their security cloud platform of record. Second, as recent events such as the SUNBURST software supply chain attack highlight, stopping the breach is no longer just about protecting endpoints. It also encompasses cloud workload security and identity protection. We continue to enhance our capabilities and invest in all these areas, including our timely acquisition of Preempt, and as a result, we are driving strong momentum with customers. Third, our recent acquisition of Humio is a key element of our strategy to drive long-term growth. Together, we are building what we believe will be the fastest, most cost efficient, and extensible cloud data platform that will deliver best-in-class visibility for security as well as observability for IT operations. Now let's discuss our results and get into these topics in more detail. The fourth quarter tops off a banner year for CrowdStrike in which we delivered exceptional growth at scale, significantly improved our margins and generated meaningful positive free cash flow for the year. We reached a significant new milestone with ARR surpassing $1 billion, up 75% over last year. We believe this makes us the third fastest cloud-native SaaS company reported to reach $1 billion in ARR following fellow pioneers Salesforce and Zoom. We already talked about Zoom being a CrowdStrike customer, and we are pleased to also add Salesforce to the roster in Q4. The exceptional execution of the CrowdStrike team made reaching this significant milestone a reality. I could not be more proud of our dedication…

Thank you, George, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers except revenue mentioned during my remarks today are non-GAAP. We delivered another outstanding quarter and fiscal year. Our record performance highlights our continued exceptional execution and ability to rapidly scale our business, while at the same time maintaining best-in-class operations. In fiscal year 2021, we delivered 82% revenue growth, 7% operating margin, and $293 million in free cash flow or 33% of revenue. We are exiting the year with a record fourth quarter, which includes record subscription gross margin at the high end of our target model and record free cash flow of $97 million. In the fourth quarter, we saw broad-based demand and strength in multiple areas of the business with multiple large deals, none being outsized. Similar to last quarter, demand for our solutions was well balanced between new customers and expansion business and between large enterprises and mid-market and smaller accounts. We once again ended the quarter with a record pipeline, which we believe indicates a strong foundation for future growth. In the fourth quarter, we delivered 75% ARR growth year-over-year to reach $1.05 billion. Rapid new customer acquisition as well as expansion business within existing customers drove substantial growth in the quarter, once again resulting in another quarter of record net new ARR, which came in at $142.7 million. Excluding the acquired net new ARR reported in Q3, net new ARR grew approximately 30% quarter-over-quarter, which is an increase from the trend we saw last year. We continue to be very pleased with the success of our land-and-expand strategy. Our gross retention rate remains high and best in class at 98% at year-end. Our dollar-based net retention rate exceeded the 120% benchmark throughout the year. Net retention increased to 125%…

[Operator Instructions] Our first question comes from Saket Kalia with Barclays.

A lot to sort of run through, but George, maybe I'll zero in on the public cloud and Falcon Horizon. The question is, as customers take a look at Falcon Horizon and your other security tools for the public cloud, can you just talk about how much you're able to cross-sell those into your existing customer base, and maybe how your conversations, understanding it's early, with new customers are trending around Falcon Horizon and the other public cloud security tools.

Sure. Thanks, Saket. Yes, obviously if you look at our model, we've done a great job of being able to cross-sell our technologies. And when you look at Horizon, it's a perfect opportunity for us to cross-sell into those cloud workloads, which as we've pointed out, are increasingly becoming more and more important for all the companies as they digitally transform. We've gotten tremendous feedback so far. Obviously still early days on Horizon, but again that's something that we had built for ourselves over many years. So while it's new to the market, it's been a proven technology. And it's been very well received so far by our customers, and we've gotten some nice traction with it. So we also pointed out some additional updates in the Linux modules where we can run in a Fargate environment as an example. So overall, very strong offering in the cloud workload runtime protection and visibility space, and we continue to build that out and we'll continue to build that out over time.

Got it. That's really helpful. Burt, maybe for you for my follow-up, understanding we don't guide to ARR for next year, maybe one component of that, that I wanted to zero in on is that ARR per customer. Obviously, a tough metric to forecast because there are just so many different drivers inside of it. But as you look forward just broad brush, how do you think about that ARR per customer sort of trending in fiscal '22? And what are going to be some of the puts and takes to that?

Saket, great question, great to hear your voice. So when we think about ARR per customer, you can see that there's a mix shift that is happening. I mean that's evidenced by the accelerated growth we saw in net new logos, and that was really driven by the mid-market and SMB space. And as a reminder, when you think about our ARR per customer across the board, accounts are expanding, and that's evidenced by our 125% net retention rate. And then finally when you think about the overall success of our net new logos and the velocity that we're seeing with respect to our net new logos, you're seeing that we're able to sell to customers large and small. This is very hard to do. And getting great satisfaction from our customers we're -- across the board is something that we absolutely strive to. So there are a lot of different dynamics that go into that equation. You've got the velocity from the smaller mid-market folks in terms of the volume of new logos, but you're also seeing us still be able to land those bigger deals. So excited about the opportunity and certainly excited about our expansion opportunities.

Next question comes from Sterling Auty with JPMorgan.

Appreciate the disclosure on the sales through AWS, but I'm just wondering if you can, either quantitatively or qualitatively, give us a sense of what percent of the net new ARR in the quarter or even the year actually came from protecting cloud workloads? Just so we can get a sense of that use case for endpoint versus traditional ones.

Sterling, it's Burt, still -- very, very good question. So remember I think that first of all, we feel that it was a strong quarter through AWS marketplace. I think it's growing into a really meaningful number. I think that one of the things you want to really put into perspective is that we're probably one of the most transactioned ISVs on the marketplace. And I think the key is that we're seeing good pull for our new cloud modules. George talked about how many containers we secure, and it's a big number. And I think that when you combine that with almost more than 20% of our servers we protect are in the cloud, I think that you're starting to put the picture together. The better news is that we still have the greenfield opportunity with respect to protecting cloud workloads. And we're really, really ahead of anybody else that's out there in the marketplace. The marketplace is really a great vehicle for transacting business with both large and small customers. And George often talks about the speed in terms of how we close the process with AWS. I think that with respect to their governing contracts or their global contracts, I think that this has been a real advantage for us. If both the buyer and seller agree to this standard contract, that just speeds up the process by 80%. At the end of the day, companies want our tech, and they're buying it through the Marketplace as one avenue. So we see this as, again I want to highlight, we see this as a greenfield opportunity for us.

And then just the other question on Humio, George, when you think about XDR, how would you kind of characterize any differences between XDR and SIM? Is this kind of the first step or do you see those as the same opportunity? So in other words, are you going to become more of a full-blown SIM provider over time?

Well, I think you have to look at the outcome. The outcome is to find advanced threats. And you don't want to create just bigger needle stacks, right? You want to be able to find those nuggets that are out there. You want to leverage the vast artificial intelligence technologies that we've built. And we've been, even prior to Humio, I mean we've built a lot of technology, which would be XDR-like in terms of looking at different network flows and connectivities. So we feel really good about the technology. We've looked at just about everything else that's out there, and we were just blown away about how fast the technology works, index-free ingestion and what it's going to bring. And as I pointed out in the script, it's going to help in multiple areas across the board that I pointed out, even the CrowdStrike Store to pull additional integrations in. So I think it's a real foundational technology for us. You'll hear more about it as we solidify the integration plans, but very excited.

Our next question comes from Fatima Boolani with UBS.

George, maybe I'll start with you just with respect to Humio. You did talk a lot about the revenue opportunity associated with Humio. I'm wondering if you can expand upon the cost/benefit opportunities. And to the extent we can think about CrowdStrike re-platforming the back end on Humio, and if that's a path that you're thinking about as it relates to Capex, gross margin and just the way you're thinking about your own back end infrastructure? And then I have a follow-up for Burt, if I may.

Well certainly, it will be a technology that will be used throughout the CrowdStrike platform. You could see we're at the high end of our range for gross margins. So I think it could be a small impact, but I'll let Burt comment on anything further than that. But overall it's going to be foundational technology for us. Its ability to compress data is without actually having to rehydrate it. So I mean you can search all this information even in a very compressed format, which is very unique in the industry. I think it's certainly going to help across the board, and we'll know more when we get into it.

Yes, it's a good question, Fatima. I think that to George's point, I mean we're already in a good spot with respect to our subscription gross margin. There's going to be a little help with respect to Humio. And so we do anticipate an opportunity for increased margin expansion due to that, but also due to other things like more modules that we're going to add to our platform and more optimization.

Fair enough. And Burt, since I have you, just with respect to the remarks George made around ARR in the script where there might be some spillover into the first fiscal quarter. Can you just reconcile that and some of the large deal momentum you saw in this quarter, versus some of the seasonality expectations that you pointed us towards for fiscal '22? That would be really helpful.

Sure. First, let me comment on seasonality. So I think that we typically see seasonality in our business in ARR. And we saw last year, or similar to last year, we saw a dip from Q4 to Q1. And I think that's going to be the case again. The good news is again, there were no outsized deals in the quarter. We had a lot of large deals. And so that was beneficial for us when we think about our ability to continue to land many large deals. And some of the things, some of the remarks that George made with respect to ARR going into Q1, that really relates to some of the subscription start dates. So we would still land them in Q4, but the subscription start date would take place in the following quarter, and that happens in every quarter. And we have many, many, many deals that obviously land in the quarter and also start their subscription start date in the quarter as well. And I think that the other thing is it really is dependent on the customer's deployment schedule, right? We're ready to go anytime, right, but we want to make sure that the customer is ready. And so that's why we think about large deals or small deals landing in one quarter, but the subscription start date in another.

Our next question comes from Brian Essex with Goldman Sachs.

George, I was wondering maybe if you could touch on Humio again a little bit. I guess could they typically see competitively an environment, are they similar to scaler? And/or is this maybe taking their technology and repurposing in a completely different direction than what they were typically, or I guess, strategically aligned for?

Well, I think you've got the normal players in the SIM log management space that are out there that they would consider competitors. With respect to their technology, why it's differentiated, I really did talk about the index-free ingestion, the fact that there's a lot of things that they can do in memory, which is just it's amazingly how efficient the technology is. And when we put it through its paces and hooked it up to our back-end, it handled all the data that we threw at it. So when you look at its flexible architecture and data models, it's different than others where you can operate it from the cloud. You're going to have data in different places, data sovereignty. So i think IT gives us a lot of flexibility. And then when you combine it with our agent, our agent is more than just a forwarder of data. It's a very intelligent agent that does introspection, the system call analysis. Provides information, observability information that can be extremely valuable to IT departments, again outside of security. So when you combine our agent, our smart filtering with their ability at scale to ingest data in real time, we really think it's a winning combination.

Got it. That's super helpful. And maybe as a follow-up, you mentioned in your prepared remarks a crisis of trust within the Microsoft customer base. Could you provide a little bit of context around that? I mean is it strictly with regard to endpoint? Or do you see that across identity management, e-mail with the recent Exchange server? I mean how pervasive do you think it is? And how might that affect not just your business, but others across the ecosystem?

I think it's across the board. We're seeing it. We're hearing it from CISOs. We're hearing it from CIOs. Boards are concerned. When you look at the latest breaches around Sunburts and you look at the Exchange zero-day vulnerabilities, just about every incident response we do involves Microsoft technology. So obviously we're focused on being able to protect it, but there's a lot of customers that are looking at this and saying, "Hey, we need to derisk our environment, and we need another provider." The proverbial, "I don't want the fox guarding the henhouse." And I think just over the last couple of months has really highlighted the risk in using sort of a monoculture for both security and operating systems.

Our next question comes from Andrew Nowinski with D.A. Davidson.

Congrats on the consistently strong execution, which is not easy in this environment. So I wanted to start with a question on a win you mentioned in your prepared remarks at Salesforce. Was the incumbent vendor that you displaced a legacy or a next-gen provider? And why did they select CrowdStrike?

So thanks, Andy. It was a next-gen vendor. One has been making a lot of noise in the investment community. And they chose us because of the scalable platform, low impact, and efficacy. And I think that's across the board, that's what we're seeing, whether it's a next-gen vendor or whether it's an incumbent vendor, is the ease of use, time to value is incredible. We've done some massive financial services companies, and it's been the smoothest rollout that they've seen. It just works, and the amount of visibility that we have is it's unbelievable compared to our competitors. So a lot of things may sound and seem the same, but when you actually get into the technology and platform, this was built to scale. And we've pioneered a lot of these technologies over time. Others have tried to copy us, but a bad copy is still a copy.

Okay. And then maybe just a follow-up as it relates to the legacy vendors that you compete against, I'd imagine the sale of the McAfee enterprise business is a potential churn event for their customers. So just wondering if you could comment on that? And then what inning do you think you're in with regard to taking share from Symantec?

Well, yes, maybe I'll start with the later one -- the latter one. We still are taking share. Just how the sales tactics work and how the renewals work, it's really a great opportunity for us to continue to take share from Symantec. And I think that sort of play is again we'll continue with McAfee in the enterprise business. Whenever you see a disruption between owners, and particularly if it's a financial sponsor, we believe and I think that's been proven over time, you're not going to see a lot of innovation on the R&D side. And again, you're starting with an architecture that's just legacy. So there's a lot of work that would have to be done, and we think it's a great opportunity for us to continue to take share in that area.

[Operator Instructions] Our next question comes from Alex Henderson with Needham.

I wanted to talk a little bit about the metrics around the pipeline. You stated that you saw a record pipeline. I think you're clearly seeing record deal sizes. Can you talk a little bit about some of the metrics around time to close deals? Are you seeing any change in that time line? And what does the time to first upsell look like? And then in that context, as you are now at the end of the year and looking into the new year, can you give us some sense of what your expectations are around the sales staff build to drive that pipeline over the course of the new fiscal year?

Yes. It's George. Thanks for the question. So we don't normally give the stats out, and candidly it's difficult to give you something that's consistent. You look at an incident response engagement, it could be a week for a massive enterprise deal. You look at some of the other big financial services, it could be 6 months, and everything in between. So I think what's consistent is that when we get into a proof of value, we're winning it. People are seeing the ease of use. It's super easy to deploy. So we can get it out there very quickly, and that does accelerate the sales cycle. I talked about the threat environment being the worst that I've ever seen. And certainly the heightened awareness around that from Boards wanted to make sure they had things locked down. So overall, it's very variable, but I think we've done a good job of consistently proving value to our customers, consolidating agents, proving a real ROI. Sometimes, it's a 30 to 6-month payback on our technology as we rip out other technologies that are there. And in terms of module expansion, as we talked about in the past, we've got in-app trials. We've got a lot of customers trying new modules even if they didn't buy them and then self-selecting, saying, "Hey, I want that." And that obviously makes for very efficient sales model. Burt, anything to add?

Yes. On your comment about hiring enough salespeople to go after that record pipeline going into the year, so like I've been talking about for a while, Alex, we're constantly looking at our opportunities. And we're going to invest aggressively when we see them. We clearly see them now. Obviously, it's -- we're really happy with our Magic Number at 1.3. But I think we have some room there to continue to aggressively invest in the sales and marketing efforts because we clearly see the opportunity in front of us.

Our next question comes from Joel Fishbein with Truist.

Congrats again on a phenomenal execution in the quarter. George, for you, I mean I want to highlight on EY. You talked about it a little bit last quarter. System integrators seem to be playing a much bigger role in this digital transformation and security transformation, which you're obviously a large part of. I wanted to see if you would elaborate a little bit on what's happening with the E&Y partnership? And then if we should expect to see other system integrators like that develop go-to-market strategies around CrowdStrike?

Thanks, Joel. And I'll start with the latter one. Obviously, we continue to build out the system integrator partnerships. So you'll see more over time. When you look specifically at EY, they've been great partners for us. The P&G deal that I called out, great relationships there. And as you very well know, they're operating at the Board level. They've got deep and long relationships. And as they're helping companies digitally transform, as I've said many times, you need to go through a security transformation as well. And they're hand in glove. So we're very excited about that relationship. Obviously, it's a worldwide relationship. And I think we're only in the beginning of that. And as that begins to ramp across the globe, we're excited about the potential opportunities that brings.

Our next question comes from Rob Owens of Piper Sandler.

I wanted to touch a little bit on that last answer, George. I guess relative to the international opportunity, and maybe the GSIs could be a great accelerator. And while growth has paced I guess with overall growth, if you think about mix longer term, is there any governing factor or gating factor relative to getting to kind of a 50-50? I look historically at companies in this space, they had revenue half domestic, half international. Could you see that [mix] longer term? Or is there anything that might prevent that?

Well, I certainly could see that mix longer term. We continue quarter over quarter to expand rest of world outside of North America as an example. We continue to build the partnerships, and the partnerships are very important outside -- well, they're important everywhere. But in many geographic locales, that's really the only way to go to market is through partnerships. So we'll continue to expand that out when you look at the EYs, AWS of the world, [broad reach] across the globe. We've got many other worldwide partners. And they're certainly very strategic for us. And what we're seeing right now, Rob, is a strong customer pull to the partner community, right? So it's one thing to have a partner network. It's another thing when you have a customer -- their customers saying, "We want CrowdStrike. We want it as our system of record."

Our next question comes from Gray Powell with BTIG.

Congratulations on the quarter. So I think in the prepared remarks, you mentioned that you did not see SolarWinds as a material driver to ARR in Q4. But I do think that everyone probably agrees that there should be a tailwind of growth in the EDR space from the breach in 2021. So I guess how should we think about that this year? And then beyond just EDR, what modules do you see the SolarWinds breach driving the most incremental demand for?

Sure. So we certainly see it as a sustainable tailwind. When you look at what happened, I mean this particular event was probably the most significant I've seen in almost 30 years in my security career. So that's going to drive a long-term trend in terms of customers that want better technologies that want greater visibility that drive EDR and XDR. So that's all good, and we see that. When you look at the modules that we think could really benefit something like our zero trust and really our Preempt technology, we talked about identity being incredibly important. Obviously, you have EDR and there's a lot of technologies that find bad things. But identity is a big element of protecting organizations, both on-prem and in the cloud. And I couldn't think of a more well-timed acquisition than Preempt because of what's happening right now. So we've got -- there's in a conversation we're having with a large enterprise. It doesn't involve identity, specifically, again, where we operate on the endpoints and workloads, and zero trust again on the endpoints and the workloads.

Got it, okay. And then anything on the vulnerability management side or [IT]?

Well, yes, the vulnerability side, a lot of it is driven by the vulnerability of the week from the Microsoft perspective. So people are having a hard time just dealing with all the vulnerabilities, where they are, they patched. If it's patched, is it really the latest? Is it fixed? And our VM Spotlight product -- has really, really matured and is very well received by our customers. And that's actually been one that we've seen, I think, really good uptake on as well.

Thank you. And that concludes our Q&A session. I would now like to turn the call back over to George Kurtz for any closing remarks. Thank you. That concludes our Q&A session. I would now like to turn the call back over to George Kurtz for any further remarks.

Operator, let's go ahead and conclude the call. And I'd like to thank everybody for joining us today. And we look forward to seeing you virtually at our upcoming events. Thank you.

Thank you. Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect.