JPM on $CRWD - Beneficiaries $S $PANW

We expect reputational damage for CRWD, recovery could take time, but we expect the stock will recover. Overnight, we learned that CRWD users have been experiencing global Microsoft outage issues related to a software update that seems to be connected to CrowdStrike’s Falcon platform for Windows. The company will need to deal with a reputational black eye as a result, but it is important to note that this is not a security incident, a fix has been identified, and customers should be able to recover more efficiently than if this had been a security incident. Just as important as the lack of security impact to customer systems, the company’s ability to recover will be contingent on the response from CrowdStrike which, so far, has been quick and appropriate, in our view. The stock has been trading at elevated multiples and is understandably trading lower before market open and could take time to recover. But we view the incident as a long-term buying opportunity with the stock under pressure and recovery expected ahead.

How does CRWD recover? We continue to receive more details as the issue unfolds, and the problem appears to be related to a defect in a content update on Microsoft Windows operating systems. The company stated “the issue has been identified, isolated, and a fix has been deployed.” That the incident is not a security issue or a cyber attack is an important point to reiterate as we should not have to worry about remediation related to malware, customer data exfiltration, or other issues related to breach recovery. That said, the globally disruptive nature of this event will likely have an impact on CrowdStrike’s financial and operational performance as well as that of its customers. Time spent on damage control is time spent on not selling, and the event comes during the final weeks of the company’s quarter (July quarter end). For customers, we expect revenue could be lost and expense incurred with regard to recovery efforts. Outages happen, and the scale here is meaningful, but we think diligent handholding and efficient response from CrowdStrike will be helpful. We expect customers will initially be upset but we appreciate the response from the company so far as CRWD takes ownership of the issue.

Read across for others. We think the most obvious beneficiary will be SentinelOne (S) as the most direct next generation Endpoint competitor in CrowdStrike’s markets. Palo Alto Networks (PANW) could also benefit, primarily with overlap from Cortex and Prisma Cloud.