CrowdStrike Vs Zscaler: Which Stock is Better?
Table of contents
Investors usually compare two stocks because they’re holding one or thinking about it. Usually, the stocks in question have some obvious relationship. You wouldn’t try to compare Protolabs to Procter & Gamble (P&G) because the two firms have nothing in common. However, you might compare P&G to IBM because they’re both dividend-growth stocks. You might compare Xometry to Protolabs because the two firms are competitors. So, if we’re going to compare CrowdStrike (CRWD) to Zscaler (ZS), we first want to know how these two firms are related.
Both CrowdStrike and Zscaler are cybersecurity companies that share the same industry and sector Global Industry Classification Standard (GICS) which means they will have performance profiles that are positively correlated – that is, they will rise and fall in unison. But to truly compare these firms, we need to know what exactly they do.
CrowdStrike vs Zscaler
The cybersecurity domain is riddled with buzzwords and terminology that changes constantly as Big Four consultants try to make themselves look smarter. Let’s start with what’s advertised on the tin:
- Zscaler: The zero trust leader
- CrowdStrike: Cloud-native platform for protecting endpoints
Let’s deal with the terminology first. The phrase “zero trust” rings a bell because we spoke very favorably about the concept when we looked at Okta (OKTA), a cybersecurity firm that also could be the subject of a future comparison article. The term “endpoint” refers to any device that connects to a corporate network. CrowdStrike ensures that no corporate devices get spear-phished or infected with a virus that acts maliciously. The artificial intelligence component ensures zero-day capabilities where software sensors can detect new forms of attacks without having prior knowledge of them. Back in the day, antivirus software programs used to be updated with “signatures” that would be created once new threats were identified. With CrowdStrike, that happens in real time, thanks to artificial intelligence. It’s why we first started covering the firm back in our 2017 piece on Cybersecurity Startup CrowdStrike Joins Unicorn Club.
To paraphrase what these companies do:
- Zscaler: Controls access to things
- CrowdStrike: Protects devices from being attacked by malicious software or actors
If these two companies operate in entirely different domains, then companies might adopt both solutions and run them concurrently. Indeed they do, and a 2020 blog post by CrowdStrike talks about how they further deepened their working relationship with Zscaler by providing “a holistic cybersecurity approach for organizations.” Both companies talk about nearly the same total addressable market (TAM) of around $70 billion which means neither has managed to capture more than 4% of their respective markets. Of course, they’ll have to compete with larger firms that won’t roll over easy. CrowdStrike competes directly with Microsoft (69X their size), while Zscaler competes against big names like Palo Alto Networks and Cisco.
The Gartner Magic Quadrant seen above describes a domain called “Security Service Edge” which is a new term their MBAs came up with late last year. From the horse’s mouth:
With SSE, Gartner extracts the security portion of its SASE architecture into its own taxonomy and research area, creating a separate market segment. SSE is a cloud-centric security platform, most often offered by a single vendor, that consolidates multiple security capabilities including SWG, ZTNA, cloud access security broker (CASB), data protection, remote browser isolation (RBI), and firewall as a service (FWaaS)
Credit: Zscaler
Sounds like a bad case of TMA. If you want to go down that rabbit hole, here’s a blog piece by the creator of the term. For the average retail investor, we can avoid the jargon and conclude that these firms are very similar, yet don’t compete directly. Both companies:
- Have leadership positions in their respective fields
- Offer a cybersecurity solution with about the same sized opportunity ~$70 billion
- Realize juicy gross margins around 80%
- Have net retention rates in the low-to-mid 120s
- Sell to at least 25% of the Global 2000 and 40% of the Fortune 500
- Sell internationally – ZS (49% USA) / CRWD (69% USA)
- Are found in three of the four largest cybersecurity ETFs
They’re also valued relatively the same.
Valuations and Growth
Our recent piece on CrowdStrike Stock – What’s a Fair Valuation? talked about how the company was more likely to let down investors than excite them come earnings time. Sure enough, shares dumped nearly 20% because of weak guidance for Q4-2023. This quarter they beat guidance which wasn’t good enough for Wall Street’s lofty expectations. As one analyst remarked, “a 1% beat is pretty low.” (Rolls eyes.) This is all short-term noise and an opportunity to add some CRWD shares at a valuation lower than we’ve seen historically. As for Zscaler, they’re trading at the same simple valuation ratio CrowdStrike was trading at before the drop.
- Zscaler
19.25 / (4 X .318) = 15 - CrowdStrike
27.46 / (4 X 581) = 12
These companies shared the same valuation ratio prior to CrowdStrike’s recent correction, so this comparison isn’t of much use. Similarly, the market caps aren’t that far off, so investing in CrowdStrike because it’s a “bigger company” isn’t a very compelling argument. Sure, CrowdStrike is one of the three biggest cybersecurity companies out there, but Zscaler isn’t that far behind, and they could even surpass CrowdStrike if they’re growing fast enough. Looking at 18 quarterly revenues numbers we see CrowdStrike growing just a small bit faster than Zscaler.
Above you can see where they started out neck and neck until CrowdStrike emerged as a leader. Over time, CrowdStrike’s revenues have only enjoyed a marginally higher compound annual growth rate (CAGR) as Zscaler.
CrowdStrike or Zscaler?
We weren’t expecting these two cybersecurity companies to have so many similarities. Deciding the “best” firm to invest in will come down to personal preference. We were initially attracted to Cybersecurity’s use of artificial intelligence, but that’s becoming less of a competitive advantage. Nowadays, companies need to be using AI-enabled solutions or they won’t be able to keep up with competitors.
CrowdStrike’s modular approach to selling cybersecurity solutions stands out from Zscaler along with their investment deck which provides a much cleaner picture of what they’re up to along with key SaaS metrics like gross retention plotted over time. If we had to choose between the two, we’d go with CrowdStrike, and we actually did. When shares corrected after their recent earnings letdown, we added a second cybersecurity stock to our tech stock portfolio.
Conclusion
When comparing two stocks, we always start by looking at their competitive positioning. CrowdStrike and Zscaler don’t appear to be competing with one another, but a single M&A event can change that. Private equity firms have been scooping up cybersecurity companies like KnowBe4 and ForgeRock which implies this niche is reasonably valued and will prove resilient in the face of today’s bear market. Either stock seems to offer quality exposure to the cybersecurity theme at valuations that are historically low, but that’s not to say they won’t go even lower. Accumulating slowly using dollar-cost-averaging helps investors avoid market timing risk.
Share
A quick check on Darktrace (DARK.L). Share price: 365.80p, market cap: £2.63B.
2022 (ending 30 June) revenue: $415.48M with tiny positive net profit, versus 2021 revenue $285.10M.
Darktrace forecast 30 – 33% revenue growth for 2023, adding that it would continue to monitor foreign exchange rates and their potential impact.
Nov 14th news: Darktrace said that it had seen “strong demand” for its new PREVENT product family as more and more organisations sought to prevent cyber-attacks. Darktrace said its PREVENT offering, which became generally available in August, had seen “the longest list of customer opt-ins” of any product launch in its history.
—
Now the question is: how would Darktrace compare to CrowdStrike ? CrowdStrike has market cap: $29.1B and it is still loss making. Darktrace is slightly profitabe. Darktrace P/S ratio = 6.3. CrowdStrike P/S ratio = 20.
In 2022 CrowdStrike had revenue growth 66%, Darktrace 45%. So CrowdStrike has a bit higher revenue growth, but to me Darktrace seems to be a better value: P/S ratio 3 times lower and it is slighly profitable.
Have you been following the Darktrace acquisition drama? Thomas Bravo backing out is a red flag in our opinion.
Digging deeper I found some question marks about Darktrace.
Interesting article in The Guardian from January 2022: “‘Snake oil’: doubts loom over tech firm Darktrace’s high-octane sales strategy”:
“There is something of a disconnect between the marketing material and the real value you get from it,” says Oyvind Bjerke, the analyst who wrote the Reality Check note. “There is no doubt that they are extremely good at marketing, their presence is very well known. However, it is harder to realise how good the technology is.”
There is quite a bit of controversy around Darktrace and it’s just not something we’re going to spend time focusing on. The PE firm backing out was a red flag as well.
CrowdStrike reached 52 week low this month (10th Jan) at $92.25. Now it is over $104, so not far from that low, but on the upside.
They have cash $2.5B which is growing from quarter to quarter. Analysts expect CrowdStrike will grow revenue 50% this year.
It will experience lots of volatility alongside all other tech firms.