Crowdstrike's recent crash is quite a shock.

Most sell side analysts and some buy side are buying the dip based on empiricism and betting on the momentum.

But I do think it can be very different this time.

TL;DR: multiple qtrs of headwind for $CrowdStrike (CRWD.US)$ , tailwind for standalone BoB like Wiz and $SentinelOne (S.US)$ , partially good for $Palo Alto Networks (PANW.US)$ .

Most of them they are betting on the empirical notion that previous events like this, e.g. $Okta (OKTA.US)$ 's breach, didn't result in very significant impact to their incoming statement and investor prospect.

IMO this is quite an oversimplified layman's view. Okta is still the only cloud standalone identity system, so you have the exclusivity there. And Okta doesn't do lots of cross-sell to things like IGA and PAM yet. For endpoint agent (sensor and NGAV) you do have some very comparable and credible alternatives that customers didn't try on simply because of CRWD's reputation, early mover advantage, and marketing. Additionally, Okta breach is more like a soft breach whereby customers' core data wasn't leaked out and it didn't cause a total break down of customers' normal business operation.

$CRWD's core EDR/XDR, or endpoint business is indeed touching or close to the ceiling, so high growth above 20% is very challenging for the company for the past few quarters. This can be cross-validated by the prevalence and high profile system breakdown reported by many household names.

Its ability to grow 30%+ and having very low decay projected by investors for the next few years is supported by its cross-selling motion or vis-à-vis platform bundle. $CRWD can simply sell good enough or okay cloud security, security data lake (SIEM), ITDR, and other products to its existing customers. And this debacle can change the thing dramatically.

Previously, $CRWD held a very prestigious position as a very trustworthy and reliable company not just in the endpoint world but the broader cybersecurity landscape. So when it comes to CIO/CISOs saying: "Look, you don't have a good cloud security product in place. Why don't you try our cloud sec and we will price it at 1/10 of competing solution from the likes of Wiz or $Palo Alto Networks (PANW.US)$ ?"

Most CIO/CISOs are pretty lazy, just like their way of buying $Zscaler (ZS.US)$ products. So they did very little due diligence but thought okay $CRWD Falcon agent has been working fabulously, so we will keep our eyes blind and buy other CRWD products too.

So, this event is not going to just hurt CRWD's core agent business but also its emerging businesses that are supporting its rapid growth albeit at a high revenue base. Investors need to be super cautious about catching this falling knife.

Will it totally reshape the ongoing consolidation trend and platformization trend? I think the answer is more nuanced. Maybe ST sentimental but LT it all comes down to ROI and does it work for your company's architecture & budget. Still net to net should be positive for platform guys like $PANW.