Hacker News new | past | comments | ask | show | jobs | submit login
CrowdStrike S-1 (sec.gov)
64 points by itsovermyhead 7 days ago | hide | past | web | favorite | 47 comments

For the uninitiated: Crowdstrike Falcon is basically the highest quality Endpoint Defense and Response product in the market.

They are not fool proof but I would be extremely surprised if any untargeted malware infected a Crowdstrike enabled device.

They are extremely popular in the market,it's pretty awesome the level of protection they give traditional businesses that don't have large security teams who can't readily adopt to attacker techniques.

They've been spreading themselves a bit thin lately trying to to do things a bit outside of their domain. But as someone that finds it very easy to find fault and criticize, I find almost no bad things to say about their offering (aside from the price tag).

Hope going public won't ruin them. Their threat intel is always a page turner too!

"We have incurred net losses in all periods since our inception, and we may not achieve or maintain profitability in the future. We experienced net losses of $91.3 million, $135.5 million, $140.1 million for fiscal 2017, fiscal 2018, and fiscal 2019, respectively. As of January 31, 2019, we had an accumulated deficit of $519.1 million."

Wow, I knew that they had great revenues and growth but this nugget is now becoming a common theme for all tech companies going IPO these days.

Yes, and usually for a pretty straightforward reason: these companies are investing substantial sums of money into buying market share, and, when they (a) win themselves a defensible position in the market and (b) generate enough revenue to prove the market to investors, they can cut back on those expenses and take profits. Meanwhile, investors are looking for growth and, more generally, future profits; nobody's all that interested in taking a Crowdstrike dividend this year.

If a dollar in profits taken today is multiple dollars in future profits left on the table, you can see why a business would engineer its finances to plow every cent back into the business.

Obviously, this plan can always go spectacularly wrong, but you can't just point to the strategy itself as evidence that will happen. You need an actual argument to back it up.

It's always possible to make a semi-plausible argument that money will be made someday. Perhaps that's enough for an angel investor, maybe a VC, but by the time you IPO, you really ought to have demonstrated it. But, not lately.

Isn't this essentially an argument that companies should deliberately slow their growth before an IPO just to demonstrate to skittish investors (all of whom either shouldn't be picking stocks of any sort, or are themselves professional money managers who can read an S1 and a 10K) that they can be profitable without collapsing?

Profits are good, but inability to switch from growth mode to profit-taking mode is probably not the risk that should keep you from investing in Crowdstrike; the volatility of the market they're in and their exposure to technological changes is a much bigger concern.

Crowdstrike isn't like Uber, where the dial from profitable to unprofitable is essentially the question about the business. They're an enterprise software company and the majority of their money goes to sales. We have something like 30 years of experience in how these kinds of companies operate and what's going to happen with their financial engineering.

I'm not saying Crowdstrike isn't risky. They're crazy risky and I wouldn't invest personally! I'm just saying, it's easy to get companies like this confused with consumer-facing unicorn companies whose valuations are derived in part by subsidizing their customers. Crowdstrike is, if anything, infamous for the opposite thing (they're expensive).

Why? Why should public markets be the red line?

If you’re not profitable yet then that means there’s lots of room for growth. If companies are going public when there’s still all that room for growth then it means the public gets to share more in the growth.

I assume the subtext is: because reliable, growing profits are hard to fake, and there's a broad suspicion that a lot of big tech companies are essentially "fake it 'til you make it" counterfeit businesses.

I think it's a critique that makes sense for some kinds of tech companies and not for others.

"If you’re not profitable yet then that means there’s lots of room for growth..." Well, it _could_ mean that, or it could simply mean your business will never be profitable. In fact, of all the companies which are not profitable, easily the majority are ones that never will be (although, sure, some will).

Crowdstrike seems very well-connected politically. The DNC chose to have them forensically examine their hacked servers to the exclusion of the FBI.

George Kurtz is not a Democrat. Crowdstrike is also a giant in this field. I assume the connection is, the DNC wanted to go with a safe, big name.

Political connectedness exists on many spectrums other than the usual Red vs Blue. An interesting one you can see from the outside (that might not have anything to do here, it's just an example) is CIA vs NSA. You can see Nancy Pelosi's statements back that look like "we've always been at war with East Asia" and "we've never been at war with East Asia" wrt to the intelligence apparatus depending on which agency screwed up.

And Dmitri Alperovitch seems to see the shadows of the Russian political establishment everywhere he looks, though, which makes Crowdstrike an... interesting choice for that work.

Edit: added the top paragraph.

All available evidence from credible sources seems to back up Crowdstrike's attribution. I'm sure you can find a countervailing argument or two from some credible source, but, to say the least, it does not look like Crowdstrike took a flyer on this.

I don't think the Russia investigation has thing #1 to do with Crowdstrike's IPO or what their business is like, though. That's much simpler: EDR is the new antivirus, antivirus has historically been one of the most lucrative enterprise technology products (to say nothing of security products), and Crowdstrike has a commanding share of the EDR market.

You also have a former UK ambassador saying "the DNC wasn't hacked. I was part of the process of exfiltrating the files from the DNC".

And I think a general willingness to parrot establishment rhetoric is part of why they're as big as they are.

Well, if the "former UK ambassador to Uzbekistan" says so, who am I to tell you to stop reading Infowars?

I mean, yeah, the former ambassador who lost his job for having too much integrity to play the established game says "hey, the public record here isn't right, and I know because I was one of the players. Here's the timeline that lines up exactly with what happened and my previously published schedule", and the reaction is either not mentioning him at all, or saying the equivalent of "lol, idk, fuck that guy I guess", then yeah I'm going to give some respect to what he says.

Crowdstrike's analysis of the DNC servers arguably started national discussion of the "Russiagate" controversy. A tin-foil-hat wearer could interpret their actions as serving whoever has a vested interest in Russiagate.

It’s hard not to draw that conclusion.

So, just to see if I can follow this: the claim here is that Crowdstrike attributed the DNC hack to Russia --- as did the US IC and DHS --- to curry favor with the Democrats, who were not in power at the time the attribution occurred, presumably so that when they re-took power sometime in the future they'd pay Crowdstrike back? As a reminder: the current administration is deeply invested in a narrative that every aspect of the 2016 election was essentially on the up-and-up, and that the DNC leaks were fair game, as they had to be, since the President enthusiastically exploited them on the campaign trail, at one notorious point even publicly begging for additional leaks. The GOP, which controlled both houses of Congress when the attribution occurred, is also famously indentured to that President, who, again, would like nothing in the universe more than to shift accusations to Russia back at the DNC itself.

The conspiracy theory here doesn't even make surface-level sense.

I think a more plausible theory is that the 'cybersecurity industrial complex' has a vested interest in general increases in cybersecurity spending. DNC had an interest in distracting from the previous HRC email leak.

Guccifer2.0 didn't really leak anything damning - so perhap this 'leak' was a red herring. DNC insiders could have performed the 'hack' and fabricated the evidence of attribution, then perform the 'leaking' themselves. DNC gets a distraction and makes opponent look friendly w/ foreign power, Crowdstrike gets more revenue from increased paranoia.

Probably incorrect... but more plausible.

Your theory is that, in the middle of an election, after there already being an email scandal, the DNC faked another one, and then got Crowdstrike and the United States intelligence community to go along with it? That's more plausible than... what?

The US IC and DHS clearly have strategic reasons for wanting to crack down on Russia, as evidenced by the strong level of centrist support for doing so.

Crowdstrike decided to make a series of announcements expressing confidence that there had been Russian state sponsored attacks on the DNC server, and did not offer any evidence of it.

When the US IC released its report, the report referred to the Crowdstrike findings, but also excluded evidence. The report appears to have been copied and pasted from previous releases, and contained virtually no useful information.

Yes, you can trust the US IC that the attack was a state actor quality, Russian sponsored triumph, but these are the same experts who helped sell the Iraq war. We learned very importantly during the Iraq war that we should simply not trust their claims without hard evidence.

They are now trying to sell a war against Iran, and will ilkely use many of the same techniques and tactics to do so.

I despise Donald Trump at least as much as anyone, but I think the Russia narrative was mostly unsubstantiated and largely overblown. Why? Not due to a conspiracy, but for the same simple reason that anything Iran does at present will be framed as highly aggressive and a reason for war -- the centrist view wants it.

It's important not to involve Trump in the reasoning about any of this. Trump liking or encouraging something, or disliking it, etc., has no impact on whether or not it is true. Trump is a clown who should be ignored.

Crowdstrike most likely enjoyed getting a lot of PR for "finding" the Russian attack. But I have yet to see evidence that the attack was actually Russian state actors and was not either someone else spoofing them or a sloppy third tier amateur funded by some pro-Russian oligarch (or similar).

To those promoting the "get tough on Russia" narrative, it doesn't matter, Russia is Russia and it is threatening. But I think we should all take a step back and realize that most parties involved in this have some skin in the game and are apt to use the factual uncertainty to make claims that support their agenda. I'd argue that even the specific attribution of the attack as Russian, and the implication that the server was only attacked by one government/group is agenda-driven, IMHO.

So is FireEye (and FireEye is inqtel/cia funded). Crowdstrike are the best in the game.

They were also on retainer for many republicans. They are an American cybersecurity company.

That's because Crowdstrike hires plenty of ex-NSA/CIA, who are usually the people FBI would love to hire. Doesn't mean they're the best in the industry but definitely in that mega-corp/gov tier they seem to be #1.

Is it unusual that on $313M ARR, the CEO’s yearly compensation, including options, is… $44.9M? CEO pay is 15% of total revenue?

Fun additional detail:

As part of our sales and marketing activities, we sponsor a CrowdStrike-branded professional racing car, which our President and Chief Executive Officer drives in some races at no incremental cost to us and in lieu of us hiring a professional driver. As we do not pay any amounts to our President and Chief Executive Officer under these arrangements, it is not reflected in the above table.

If I was an investor, I would say this is reckless.

Lots of companies sponsor race cars, and Crowdstrike seems to have gotten a co-branding thing out of it (they're now the EDR product for some Formula One teams or something). It's about as reckless or not reckless as any other marketing expense.

Unless you mean the potential for George to meet his fiery doom in an F1 car, in which case, yes, I agree.

F1 Teams hacking each other to gain advantage would make a great movie, I wonder if it has ever happened in real life.

Are you sure that's his annual compensation, or is that just a one-time options amount?

As a former Crowdstrike engineering employee, congratulations to everyone that helped get the company get to where it is today. Super proud of you and our work together.

Anyone know why this is so popular and getting upvoted?

It's a filing for CrowdStrike to go public. They open their books for the public to view.

HN is a very entrepreneurial board and we applaud any Silicon Valley company going public.

What might be more interesting is that CrowdStrike is not really a Silcon Valley company, but has Silicon Valley investors, including Google Capital.

Crowdstrike is headquartered in Irvine, California (Orange County), and a large number of its engineering teams are actually remote/distributed.

Because they are the ones who blamed Russia for the DNC hack:


Thank you. Makes much more sense now.

...because they are a billion dollar tech startup, whose end product/widget is security. Why shouldn't it be here? ...Because it's not about Uber-for-X? Or chat? or food Delivery? ... But everything they do is every HN buzzword: ML/AI/BigData/ES/JSON/CLOUD.

They are extreme users of tech and ingesting/processing more data in real-time than most of us can fathom.

The only thing most HN'ers know about Crowdstrike is that they were involved in the Russia hacking attribution in 2016-2017. But this is a major tech company S-1 --- Crowdstrike is one of the more important security product companies of the last few years --- and tech company S-1's generally get warm coverage on HN.

Just to add, the relative lack of comments here is related to the density of information presented here relative to the age of the submission (so people haven't gotten through it yet).

Because it's yet another very unprofitable company's IPO... with a potential "profit window" in 10 centuries, when flying cars are a reality, robots take over the earth etc.

And all of this doesn't matter because the US has injected so much money with QE and so on the economy that even an American kid's 10 year old lemonade shop is worth a few billions.

Are such IPOs any indicator of economic downturn to come?

If that was the case, then the parent would have already been on their way to open a $10bil valued lemonade stand, instead of posting about it.

A whole vat of them in one year? Yeah, probably. Means they likely foresee difficulties securing public investment beyond the near term if they don't IPO ASAP.

Also means I'm not buying into any of them until the market slams, which I think is a common theme among many buyers considering the ever-intensifying downtrend in IPO day-1 closing price dips.

HN has quite a few infosec professionals who have obtained a fair bit of swag and gotten reasonably drunk on CrowdStrike investors' dime at various security conference booths/events/parties.

The SG&A line item in their financials is relevant to their interests. Specifically, their sales/swag/booze operation cost over twice as much as their R&D operations ( $172MM vs $84MM in 2018 ). Or, to put it another way, getting CISOs sauced outside the Moscone is twice as important to them as actually producing the software for their blinky boxes.

If they can pull another $300MM from retail in an IPO, our blood alcohol content will be secured at cons for another two years, assuming they continue to burn $140MM annually.

It is extraordinarily silly to suggest that "swag" and "booze" are serious contributors to Crowdstrike's SG&A expenses, considering that SG&A covers their entire sales and marketing teams. SG&A exceeding R&D is not exactly an anomaly among enterprise tech companies.

Oh, also? Crowdstrike sells endpoint software subscriptions, not "blinky boxes".

So, is someone who invested in a lot of may-never-be-profitable companies, suddenly needing their money back, whether it's the right time for an IPO or not?

Anyone have experience using the product?

Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact