Cybersecurity Shares on a Roll

CYBP is an ETF, quoted in London, which specialises in cyber security shares.

This is a cool chart and a cool portfolio for this cybersecurity and data ETF. Crowdstrike and Zscaler are both in the Quentinvest Innovation portfolio and have been racing ahead in recent days.

Crowdstrike is a classic example of the kind of company I love.

I would like to begin my remarks today by expressing gratitude to our customers who proudly trust CrowdStrike as their cybersecurity platform consolidator for the AI era; gratitude to our partners who win with CrowdStrike, taking our joint customers on Falcon platform transformation journeys from device to cloud to identity to data and beyond; and to our team for their passionate dedication to our mission: stopping breaches, fighting adversaries, and delivering the very best cybersecurity outcomes. Moving on to Q3. Despite a challenging macro environment and geopolitical tensions, I am extremely proud of the resilience of our business and that we delivered a record Q3.

CrowdStrike surpassed the $3bn ARR milestone with an ending ARR of $3.15bn, growing 35pc year over year. CrowdStrike is the fastest and only pure-play cybersecurity software vendor in history to achieve this milestone. In Q3, we delivered double-digit net new ARR acceleration at scale, powered by customer demand for the depth and breadth of CrowdStrike’s AI-native XDR platform, terrific execution exemplified by rising win rates against our competitors, and acceleration in our Cloud Security and Identity businesses, as well as a record quarter in our LogScale next-gen SIEM business. Our standout top-line performance came in tandem with P&L discipline as our profitability soared to record heights.

Q3 was indeed a quarter of records. Let me share several of our financial highlights. Record net new ARR of $223m, representing 13pc year-over-year growth from acceleration in new and expansion business; record non-GAAP subscription gross margin; record GAAP and non-GAAP operating profitability; record free cash flow of $239m, representing 30pc free cash flow margin; and achieving free cash flow Rule of 66, up from 63 last quarter. Burt will share more color on our financials and platform adoption stats following my remarks.

This was a standout quarter and places us well on the path to $10bn in ARR that we outlined in our latest investor briefing. The market continues to validate CrowdStrike’s widening leadership position. While others scale back R&D, we are increasing our investments as innovation is the lifeblood of our company. We continue to make meaningful investments in go-to-market and profitable growth.

George Kurtz, CEO, Crowdstrike, Q3 2024, 29 November 2023

This is a company that was founded as recently as 2011 and they are talking realistically of a path to $10bn in annual recurring revenue. That is a staggering achievement and if they can do that what else can they do. The shares are extended and hitting resistance around $260 but the moving averages are just completing a golden cross. There is no reason why these shares should not go miles higher.

Companies must deal with security threats; not doing so is extremely costly.

The business disruption and financial losses from breaches are growing. Cutting corners on security is one of the most costly choices a business can make. The cost associated with cleaning up a breach can exceed $100 million. Our seminal cybersecurity platform innovation, as well as threat intelligence and service expertise, delivers the best security outcomes.

This is why we win. Stopping the breach is the security outcome that CrowdStrike delivers. This makes our business incredibly durable in diverse economic cycles. We are a business necessity.

George Kurtz, CEO, Crowdstrike, Q3 2024, 29 November 2023

Zscaler is another standout sector performer.

The increased frequency of high-profile breaches, coupled with impending SEC disclosure requirements, has propelled zero-trust security more into focus at the management and the board level. Against this backdrop, we achieved a Q1 record for number of new logo customers with over $1m in ARR. We also achieved a record for new pipeline generation in a quarter. More customers are adopting our broader platform to consolidate multiple-point products, increasing our average deal size.

As a result, we are actively working on more large, multiyear, multi-pillar opportunities than ever before. To meet this demand and to further scale our business, we are adding two key go-to-market leaders, one in sales and one in marketing. I will provide details about these new executives after reviewing our Q1 performance. Let me highlight three factors that drove our strong Q1 performance.

First, large new logo wins were strong this quarter, with a Q1 record of 14 new logos contributing over $1m ARR. We ended with 468 such customers, up 34pc year over year. These wins spanned across many verticals, proving that every vertical needs Zscaler. Second, customers are buying the broader Zscaler platform with multiple product pillars.

I have said before, over time, I believe every one of our customers will buy ZIA [Zscaler Internet Access], ZPA [Zscaler Private Access], and ZDX [Zscaler Digital Experience] for every user to deliver secure, fast, and reliable access to any application, anywhere. This quarter, nearly half of our new logo customers purchased all three user pillars, ZIA, ZPA, and ZDX. In addition, strong platform upsells drove our 120pc dollar-based net retention rate. Third, this was a record U.S. federal quarter, with new business up over 90pc year over year, including four deals that are greater than $1m in ACV. We are starting to see larger awards as multiple U.S. federal agencies are standardising on Zscaler to meet the president’s executive order to adopt zero-trust security.

Jay Chaudry, CEO, Zscaler, Q1 2024, 27 November 2023

Innovation is rocketing along at Zscaler.

As we are like a switchboard for all communications, we collect full transaction logs and trillions of signals daily. We are utilising those signals and logs to deliver AI-powered insights and automation for our customers. Let me discuss a few of the high-value products in our AI cloud family. We recently launched Risk360, which is the industry’s first holistic, AI-powered risk quantification and mitigation solution.

It delivers up-to-date risk posture and recommends corrective actions to mitigate risk in a timely fashion. We have already closed 10-plus Risk360 deals, and are in active evaluations with over 100 enterprises. For these deals, we are getting six-figure ACV on average, and we expect to grow this value over time. Risk360 provides critical insights to CISOs when reporting on cybersecurity risk, strategy, and governance, particularly in light of new SEC regulations.

Another exciting new product, Breach Predictor, currently under development, uses predictive and generative AI models to anticipate potential breach scenarios and eliminate those risks before they materialize. Early feedback from customers who have previewed Breach Predictor indicates the enormous potential value this solution can deliver. We are working with our technology partners to bring this world-class innovation to thousands of customers to proactively protect against potential breaches. While we have achieved tremendous success for user protection solutions, our platform’s potential in other categories is just beginning.

Our relentless innovations have paved the way for an ever-growing stream of opportunities. As our platform continues to scale and expand, our go-to-market efforts are continuing to evolve and scale as well. To enable that next stage of go-to-market scaling, I’m excited to share the appointments of two exceptional leaders, Mike Rich as CRO and president of global sales, and Joyce Kim as CMO. They bring a wealth of experience in driving revenue and pipeline growth.

Jay Chaudry, CEO, Zscaler, Q1 2024, 27 November 2023

The other standout in the table is Varonis Systems.

Varonis is an interesting company.

Today, I would like to review our Q3 results and discuss how AI can serve as a meaningful tailwind to our business in the years to come. But first, I would like to remind you why Varonis exists and the problems we solve. Data is the prime target for bad actors because of its importance to a business. Data is also out of control.

The explosion of the cloud and remote work has improved collaboration but has also made securing data more difficult. Varonis helps companies locate sensitive data, visualize who has access to it, and automatically lock it down. This allows companies to collaborate safely and get value from their data while managing risk, and AI will only make this an even greater priority. Our third quarter results reflect the continued healthy adoption of Varonis SaaS.

We saw further evidence that our transition to a SaaS business model is working, and SaaS ARR now represent approximately 15pc of total company ARR. Third quarter SaaS mix came in at 59pc, comfortably ahead of our guidance of 45pc. ARR grew 16pc year over year to $517.5m, and we have generated $46m of free cash flow year to date, up from 800,000 to the same period last year.

Yaki Faitelson, CEO, Varonis Systems, Q3 2023, 30 October 2023

Now, I would like to spend some time on how AI present a meaningful opportunity for Varonis. In my conversations with customers and prospects, AI comes up more and more, and my key takeaway for Varonis is that the growth of AI has the potential to generate significantly more data, significantly more risk, and significantly increase the need for data security. Stepping back, generative AI present both opportunity and risk for companies.

It has an opportunity to boost productivity and efficiency. But in order to safely realize these benefits, there are security risks that businesses must mitigate first. These risks present opportunities for companies like Varonis. The first risk is related to what I call self-inflicted risk, which happens when businesses start using AI to suggest content to employees.

Unless data is locked down, there is little to prevent AI from analyzing the company entire data estate and revealing critical business assets like customer lists, payroll files, or bank account information to the wrong people. Microsoft recommends mitigating this risk by securing sensitive data before deploying Copilot, which is the company’s AI assistant, and specifically recommends having the right information, access controls, and policies in place. This is precisely what Varonis does. Without Varonis, rightsizing access control is very challenging.

Managing access controls only gets harder over time if we data spoil, and AI will surely contribute further to this problem. Without the right controls in place, AI doesn’t know who should see what and surface everything for everyone. This becomes a huge risk for organisations and bad actors who won’t even need to search for content they want to steal. AI will help them to find it automatically.

AI will also increase the risk that companies face from external attackers. A few examples of this include helping bad actors create and translate phishing emails so they can use them in many languages, creating fake data sets in order to trick companies into paying ransoms, and creating malware. Unfortunately, the use of AI will continue to lower the barriers to entry for hacking. Varonis helps organisations mitigate this risk by ensuring that only the right people have access to the information that they need to do their job.

Varonis can help organisations ensure that employees only seek content suggestions that are relevant to their job function. If a bad actor bypass perimeter controls, Varonis can lock out the compromised users or machine, preventing damage from happening. Although it is early and we are still quantifying timing and sizing, we see AI becoming a growth tailwind to our business as it gains momentum and has detailed plan to execute it. Apart from demand opportunity that we see arising from security risk related to AI, we are also leveraging this technology in new ways to improve our customer experience.

Varonis has been using machine learning and AI for many years in our analysis engine and threat model, for example. And today, we are announcing two exciting generative AI capabilities in our SaaS data security platform: AI system security operations centre, or what we call SOC; and natural language search. Although we do not plan to sell AI as a separate SKU, our AI system SOC will provide security analysts with an intelligent AI assistant, specialised in performing investigations, remediating threats, and proactively hardening environments. Our SaaS platform can analyse alerts and provide context and next steps to help analysts more efficiently resolve security incidents.

With natural language search, AI makes every Varonis user a power user. Anyone from the help desk to CSO [chief security officer] can use natural language to get fast and accurate answers to questions such as do we have any files containing passwords that are exposed to everyone on the internet or what user has been accessing our payroll files. Today, newly introduced generative AI features build upon the Varonis SaaS benefits that we have discussed with you over the past year and will further reduce the time to value for our customers and improve their experience with Varonis. I would like to spend a moment to remind you of the three key benefits our SaaS platform provides our customers.

First, customers are much better protected with much less effort with the automated remediation and Proactive Incident Response. Second, SaaS is quicker to deploy and has significantly lower infrastructure costs. And third, SaaS is easier to maintain and upgrade. Three of the key benefits that we realise are, one, shorter sales cycle; two, larger initial lands; and three, margin benefits over time.

Yaki Faitelson, CEO, Varonis Systems, Q3 2023, 30 October 2023

Varonis has quite a high exposure to Israel.

Before I discuss results, I want to briefly comment on the impact of the war in Israel on our operations. From a top-line perspective, Israel has historically represented less than 1pc of our business. We have approximately a third of our employees located in Israel, which includes our principal research and development facility, as well as a portion of our support and general and administrative team. At this time, a low single-digit percentage of our global team members have been called up to active duty.

Guy Melamed, CFO and COO [chief operating officer], Varonis Systems, Q3 2023, 30 October 2023

Varonis is changing its business model from upfront payments for software licenses to a subscription model.

Our SaaS transition continues to gain momentum, and this quarter provided additional proof of the numerous benefits to our customers, as well as the tailwind to our ARR and cash flow performance. As a reminder, ARR, free cash flow, and ARR contribution margin are the leading indicators for our business during this transition. The shift from on-prem subscription licenses, where approximately 80pc of the deal’s value is recognized upfront, to a SaaS model with fully ratable revenue recognition will cause initial headwinds on the traditional income statement metrics as the SaaS mix and conversions of existing customers to SaaS increase. And this quarter’s impact was meaningful as the number of existing customers converting to SaaS again increased.

However, these headwinds are a function of accounting treatment and are not indicative of the health of our business. In fact, the greater these accounting-related headwinds are, the better it is for our business as it means the transition is progressing at a faster pace. Our third quarter SaaS mix represented 59pc of new business and net new upsell ARR versus our guidance of 45pc. And after only three quarters into the transition, SaaS now represents approximately 15pc of the company’s total ARR.

Guy Melamed, CFO and COO [chief operating officer], Varonis Systems, Q3 2023, 30 October 2023

The initial effect of this transition is to depress reported results and Q3 revenue fell by one per cent. But there is a huge improvement in income quality and examples of other companies like Microsoft and Adobe which have made this transition is that investors are enthusiastic.

It is all looking very positive.

In summary, we continue to see solid demand for both new and existing customers who wish to consume Varonis through our SaaS platform.

As a result, our transition continues to move quickly, and approximately 15pc of our total ARR is now coming from SaaS. This is benefiting our ARR performance and cash flow generation, which positions us for a strong fourth quarter.

Guy Melamed, CFO and COO [chief operating officer], Varonis Systems, Q3 2023, 30 October 2023

The effect of this transition is potentially dramatic as witness this answer to an analyst’s question by CEO, Yaki Faitelson.

For those customers that are moving to your SaaS tools, what are you seeing on there on usage of the different modules? Are you seeing any change in usage now that the tools are arguably easier to deploy and use?

Saket Kalia — Barclays — Analyst

So, we see this dramatic change. We see what we call the robotic value proposition. And it’s — the North Star was always what we call 10pc of the effort over the magnitude, more value.

And this works according to plan. We can measure everything, from installation to update to remediation, our ability to reduce threats. And the other thing, we also build the ability of our people, IR, professional services to support the customer with much more ease. We can provide a lot of the value of the platform with the customer almost doing nothing, you know, just very, very little in helping them in terms of configuration.

So, just completely different value proposition. We’re literally unleashing robots to solve the problem.

Yaki Faitelson, CEO, Varonis Systems, Q3 2023, 30 October 2023

Strategy – Cyber Security is Shaping up as a Red Hot Sector for the 21st Century

Cyber Security is critical for enterprises, governments and individuals and is going to become a massive business as we progress through the 21st century. Successful businesses in this area have the potential to become huge and it is still surprisingly wide open with relatively small companies jostling for leadership positions.

Crowdstrike and Zscaler are already in the innovation portfolio while Varonis Systems is a new addition.

Share Recommendations

Rize Cybersecurity ETF CYBR Buy @ $7.30

Crowdstrike CRWD. Buy @ $258

Zscaler ZS. Buy @ $222

Varonis Systems. VRNS. Buy @ $45.20