CrowdStrike Holdings, Inc. (CRWD) Q4 2022 Earnings Call Transcript

CrowdStrike Holdings, Inc. (NASDAQ: CRWD) Q4 2022 earnings call dated Mar. 09, 2022

Corporate Participants:

Maria Riley — Vice President of Investor Relations

George Kurtz — President and Chief Executive Officer and Co-Founder

Burt Podbere — Chief Financial Officer

Analysts:

Saket Kalia — Barclays — Analyst

Sterling Auty — J.P. Morgan — Analyst

Andrew Nowinski — Wells Fargo — Analyst

Joel Fishbein — Truist Securities — Analyst

Unidentified Participant — — Analyst

Matthew Hedberg — RBC Capital Markets — Analyst

Tal Liani — BofA Securities — Analyst

Alex Henderson — Needham & Company — Analyst

Fatima Boolani — Citi — Analyst

Joshua Tilton — Wolfe Research — Analyst

Rob Owens — Piper Sandler — Analyst

Jonathan Ruykhaver — Baird — Analyst

Ittai Kidron — Oppenheimer & Co. — Analyst

Gregg Moskowitz — Mizuho Securities — Analyst

Presentation:

Operator

Thank you for standing by and welcome to the CrowdStrike fourth Quarter and Fiscal Year 2022 Results Conference Call. At this time, all participants are in a listen-only mode. After the speakers’ presentation, there will be a question-and-answer session. [Operator Instructions] I will now turn the conference to your host, Ms. Maria Riley, Vice President, Investor Relations. Please go ahead ma’am.

Maria Riley — Vice President of Investor Relations

Good afternoon and thank you for your participation today. With me on the call are George Kurtz, President and Chief Executive Officer and co-founder of CrowdStrike; and Burt Podbere, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth, and expected performance, including our outlook for the first quarter and fiscal year 2023 are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call.

While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events, or otherwise. Further information on these and other factors that could affect the company’s financial results is included in filings we make with the SEC from time to time, including the section titled risk factors in the company’s quarterly and annual reports that we file with the SEC. Additionally, unless otherwise stated, excluding revenue, all financial measures included on this call will be non-GAAP.

A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our press release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today. With that, I will turn the call over to George to begin.

George Kurtz — President and Chief Executive Officer and Co-Founder

Thank you, Maria, and thank you all for joining us. Before we get started, I would like to acknowledge the war in Ukraine. Our deepest thoughts and support are with all those impacted by this tragedy as we are reminded of the terrible human toll that military conflict brings. We are hoping for peace in Ukraine and the broader region.

Turning to our financial results. I will start today’s call by summarizing four key points. First, CrowdStrike delivered an exceptional fourth quarter that far exceeded our expectations. This quarter’s results are headlined by an acceleration in net new ARR growth for the second consecutive quarter to reach $217 million. Record 19% non-GAAP operating margin and record free cash flow of $127 million or approximately $197 million when excluding the IP transfer tax payment related to the acquisition of Humio. Second, our success outside of traditional endpoint security is now punctuated by both scale and hyper growth as we surpassed the $150 million ARR milestones, while growing in excess of 100% year-over-year for our IT hygiene, vulnerability management, identity protection, and log management modules collectively.

Third, we exit the year with tremendous momentum for ARR derived from Falcon deployments in the public cloud were eclipsed the $100 million milestone and grew 20% quarter-on-quarter, as we lead the effort to transform security for the public cloud. And fourth, as you can see from our outstanding results, our growth engine is executing on all cylinders which includes our thriving partner ecosystem one partner. One partner I like to highlight is AWS. In fiscal 2022, ending ARR transacted through the AWS marketplace grew more than 100% year-over-year. Furthermore CrowdStrike ended the year as one of the top ISV Partners by transaction volume on the AWS marketplace. With partner sourced deals growing strongly throughout the year, we believe this speaks to the success of our partnership with the world’s largest public cloud provider and highlights the value we can provide to both partners and customers alike.

Now, let us discuss our results in more detail. Net new ARR growth accelerated for the second quarter in a row to reach $217 million and for the first time in company history, surpassed the $200 million milestone. Demand was driven by expansion in the core endpoint market, as well as a record quarter for cloud, identity protection, and Humio. Growth was also fueled by rapid customer expansion among companies of all sizes. From large enterprises to small businesses. We added over 1600 subscription customers for the third consecutive quarter bringing the total number of customers that rely on CrowdStrike to protect their business to 16,325, a 65% increase year-over-year.

Demand in the quarter was broad based and new wins included. Sizable deals with multiple top global financial services organizations. A record number of new Falcon Complete customers including Fortune 500s and multinational companies across the technology, media, telecommunication, education, and government sectors among many others. Record lands for our Cloud Workload Protection module and Horizon, our agentless cloud security posture management module, including wins at a large US insurance provider, a Fortune 250 software company, and a Fortune 50 energy company. We achieved another record quarter for our Identity Protection modules, which significantly differentiate Falcon in the field and continue to lead to higher win rates. Key wins included a global leader in customer experience management, a global financial services company, public sector agencies, and multiple wins in the Fortune 500.

Q4 was also another record quarter for Humio. With wins across multiple verticals such as retail, financial services, manufacturing, technology, and transportation. Our success with Humio this quarter included, securing a seven-figure deal with a financial services customer whose existing log management solutions had become budget prohibited given the exponential growth of data being capture by their DevOps team. And lastly, we are thrilled to announce that Cloudflare, a trusted CrowdStrike technology partner on a mission to build a better Internet became a new customer in the quarter, adopting both Falcon Complete and Horizon. We look forward to deepening our natural partnership and identifying even more opportunities to work together.

Among these many fantastic recent wins, let me take a moment to share some additional details about the expansion with a Fortune 50 financial institution that I think exemplifies our technology advantage in action and why scalability and trust matter. Midyear, this particular customer has chosen CrowdStrike to protect its traditional endpoints and displace the legacy incumbent. At approximately the same time for relationship reasons, this organization had chosen a NextGen competitor to protect a server environment but after six months they were still struggling to deploy the other vendors product in a server environment. They were plagued by forced reboot, significant memory usage, an unmet product roadmap promises. While they struggled to get their service protected, Falcon was fully deployed across their hundreds of thousands of endpoints in a matter of weeks, without requiring a reboot.

Side by side, we showcased our differentiation on a broad scale in a real production environment. This customer was able to see the rich telemetry Falcon provided in real time and the power of our security cloud, all resulting in better efficacy. This customer terminated the other vendors contract and is now deploying Falcon to protect their service globally. This is just one of many customer stories that demonstrates the fundamental reason why we have earned our leadership with increased win rates and record displacements, efficacy, scalability, manageability, real time versus batch mode, and importantly, our ability to consolidate agents while solving a growing number of real world business problems.

Q4 was also a record quarter for our partner ecosystem. In total for fiscal year 2022, we gained significant leverage from our partner ecosystem. During the year partner stores ending ARR grew 83% year-over-year with our MSP business growing more than 200%. Our architecture is fundamentally different from any other vendor we see in the market. While our technology advantages are vast, it all starts with how we designed the platform from the beginning with smart filtering capabilities on the agent, which gives us the ability to dynamically adjust our aperture to stream rich telemetry to the cloud in real time. We believe these foundational architectural elements that created high beverage entry while competitors operating batch mode struggled with storing data on the endpoint.

We continue to extend our technology leadership across the entire platform. As we announced yesterday, Humio sets the standards for streaming index with data ingestion and reached a new benchmark of over 1 petabyte of data ingestion per day. CrowdStrike will continue to leverage the speed and scale of the Humio engine to extend our position in the XDR space. You have heard me say like CrowdStrike is more than just an endpoint provider. The success of our platform strategy is reflected in the hyper growth we are deriving from many of our modules, as well as our strong module adoption metrics, which have consistently increased quarter-after-quarter.

In Q4, subscription customers with four or more, five or more, and six or more modules increased to 69%, 57% and 34% respectively. As both new and existing customers increasingly Falcon to solve security challenges outside of core end point, we have multiple product areas contributing significantly to ARR growth. We are seeing tremendous growth from our emerging products that solve use cases outside of traditional endpoint protection. This includes our Discover, Spotlight and Identity Protection module, as well as Humio. ARR for this group grew more than 100% over last year, contributing $157 million to FY 2022 ending ARR.

These modules are significant growth drivers for our overall business with ending ARR these modules growing 30% quarter-over-quarter and representing approximately 17% of our Q4 net new ARR collectively. Our success to date in these adjacent areas speaks to the extensibility of our platform outside of core Next-Gen AV and EDR. The data we collect and our ability to make meaningful inroads in accessing new TAMs. Changing from a module perspective to a deployment environment view, our public cloud business surpassed the $100 million milestone in Q4 to reach $106 million in ending ARR. This milestone encompasses our modules deployed in the public cloud, including our cloud runtime protection and CSP modules. We seen tremendous momentum in this business as we exit the year. Ending ARR growth for our business when viewed through a cloud deployment has outpaced the growth of our overall business, growing 20% quarter-over-quarter and represented approximately 80% of our Q4 net new ARR. Cloud Workloads are increasingly targeted by adversaries and are largely under-protected representing a significant growth opportunity in FY ’23 and beyond.

Moving to the market dynamics. There are powerful tailwinds driving our market and we do not currently see any indication that these trends will abate anytime soon. The adversaries are certainly not slowing down, actually, quite the opposite. As we published in our most recent Global Threat Report 2021 provided no rest for the weary with an 82% increase in ransomware related data links. As a nation state events of the past few weeks have demonstrated cyberspace is center stage joining land, air, sea, and space as the fifth dimension of warfare. There are no borders in cyberspace and the cyber blast radius has no bound, putting every organization and government at risk as attacks can extend far beyond their intended targets as we saw with NotPetya.

Last year, 62% of attacks we observed where malware list, with most of these involving compromise identities. We expect that both e-criminals and nation state adversaries alike will continue to exploit vulnerabilities across endpoints in cloud environments and ramp up tradecraft around the use of identities and stolen credentials to bypass legacy defensive. In addition to advancing adversary tactics and a heightened threat environment, organizations must contend with the ongoing security skills gap which we have seen drive increased demand for our Falcon Complete offering. To help companies combat the increasing threat of compromised identity, last week we launched Falcon Identity Threat Protection Complete, the industry’s first managed identity solution and a new way to help customers scale their security teams to protect against sophisticated attacks and stop breaches

Additionally, the attack surface is expanding rapidly and a digital supply chain is ever-growing as organizations embrace digital transformation and move more workloads to the cloud. We believe our TAM continues to expand and all of these factors will lead to sustained market growth for the foreseeable future. We also continue to see a very favorable competitive environment and multi-year runway to displacing legacy endpoint vendors which is bolstering our growth as companies look to transform their security stack. Before I hand it over to Burt, I will provide some final thoughts on the big picture of what we see unfolding.

As I shared with you in my opening comments, in addition to our growing leadership in the EPP market, we now have multiple vectors driving our growth and scale that are outside what some might consider our core. We have been very deliberate and purposeful in choosing to enter markets. Enterprise risk is coalescing around three critical areas: endpoints or workloads, identity, and data all three areas we have been investing, innovating, and see as core to CrowdStrike’s mission. These areas represent the biggest risk for organizations and customers are increasingly looking to the Falcon platform to solve their most pressing security needs as legacy products in these markets are brittle, complicated and struggle to deliver value to the customer. Given our footprint on the endpoint or workload, the data we collect and the advantages our architecture and security cloud afford, we see great alignment and great opportunity in our approach to solving a multitude of problems for customers as we innovate and disrupt these emergence categories such as log management, SIM, and observability which is reflected in our growing strength in these newer markets, as well as endpoint protection.

In closing, I would like to thank every CrowdStriker around the world for their tireless dedication to protecting our customers which ultimately translates to the financial success of our company. I am humbled and inspired by the commitment, level of execution, and hard work CrowdStrikers exemplify on a daily basis. They are the everyday champions that make results like the fourth quarter possible. Thank you. With that I will turn the call over to Burt to discuss our financial results in more detail.

Burt Podbere — Chief Financial Officer

Thank you, George, and good afternoon everyone. As a quick reminder, unless otherwise noted, all numbers except revenue mentioned during my remarks today are non-GAAP. Before we get started, I will note that the results we are reporting today include the acquisition of SecureCircle, which was de-minimis to both revenue and ARR, contributing less than $1 million in Q4 ARR. The acquisition of SecureCircle resulted in the addition of 26 net new customers in the quarter.

We once again delivered exceptional results to top off a phenomenal year. We finished the year with over $1.73 billion in ending ARR and in fiscal year 2022, we delivered 65% ARR growth, 66% total revenue growth, 215% operating income growth, 157% net income growth, and record free cash flow of $442 million or 30% of revenue. This is the second year in a row CrowdStrike delivered 30% or better free cash flow margin, which is in line with our target model. Importantly, we accomplished these results while also aggressively investing in the business and expanding our remarkable team by 46%. We believe our strong performance highlights that in addition to our clear and defined mission and our cloud native architecture, our business fundamentals possess the hallmark characteristic of SaaS leaders that have transformed and come to dominate their respective markets, including rapid growth at an ever-increasing scale, best-in-class gross retention rates, enduring market dynamics and a growing leadership position, as well as a highly leverageable model with the ability to deliver phenomenal free cash flow as we continue to capitalize on our unique market position, I firmly believe CrowdStrike’s best days are ahead.

Now, moving to the fourth quarter. Net new ARR our growth accelerated for the second consecutive quarter. Demand in the quarter was broad based fueled by strength in multiple areas of the business, and reflects continued strong customer adoption of our core products, growing success with our newer product initiatives, including Identity Protection, log management and cloud, record expansion business and continued rapid new customer acquisition. Net new air ARR grew 52% to reach a new all-time high of $216.9 million. The composition of net new ARR was very well balanced across deal size even though two large accounts contributed approximately eight-figures each to net new ARR this quarter. We believe this represents our continued leadership in the enterprise segment, expanding deal sizes and the pricing leverage attributable to our distinct product differentiation.

Our dollar based net retention rate was once again above our benchmark. We continue to be very pleased with the success of our land and expand strategy. Our gross retention rate remains high and best-in-class at 98.1% at year-end. Our dollar based net retention rate was above the 120% benchmark throughout the year. Net retention was 123.9% as of the end of FY 22, which is essentially a similar level to last year, but on a much bigger base. For the interim FY 22 quarters, net retention was 121.8% in Q3, 120.4% in Q2 and 123.4% in Q1. Our professional services organization is a strong lead generation engine for the Falcon platform. Among organizations who first become a customer after February 1, 2020 for each $1 spent by those customers on their initial engagement for our incident response or proactive services as of January 31, 2022, we derive an average of $50.71 in ARR for those subscription contracts, up from $5.51 reported last year.

Moving to the P&L, total revenue grew 63% over Q4 of last year to reach $431 million. Subscription revenue grew 66% over Q4 of last year to reach $405.4 million. Professional services revenue was $25.6 million setting a new record for the sixth consecutive quarter and representing 26% year-over-year growth. Fourth quarter total and subscription non-GAAP gross margins remained relatively consistent at 77% and 79% respectively. We continue to be pleased with our strong subscription gross margin performance as we continue to invest for growing demand. Total non-GAAP operating expenses in the fourth quarter were approximately $250.8 million or 58% of revenue versus $170.3 million last year or 64% of revenue.

In Q4, we ended with a Magic Number of 1.3 as we continue to ramp investments to capture more of the market opportunity at hand and expand globally. Our continued exceptional unit economics speaks to the efficiency of our go-to-market engine and our ability to rapidly onboard and support customers of all sizes. We also believe that a Magic Number of 1.3 continues to indicate that we should increase investments even more given the massive market opportunity. The leverage we generated this year demonstrates the efficiency in our model and enables us to step up investments in new technologies, new international geographies and other marketing programs, as well as continue to hire aggressively. We believe the investments we are making today will lead to sustained growth over the long-term and maintain our pole position as the trusted security partner of choice.

Fourth quarter non-GAAP operating income more than doubled, growing 134% year-over-year to reach a record $80.4 million and operating margin improved approximately 6 percentage points over Q4 of last year to reach 19%. Non-GAAP net income attributable to CrowdStrike in Q4 also more than doubled, growing to a record $70.4 million or $0.30 on a diluted per share basis. Our weighted average common shares used to calculate fourth quarter non-GAAP EPS attributable to CrowdStrike was on a diluted basis and totaled approximately 238 million shares.

We ended the fourth quarter with a strong balance sheet, cash and cash equivalents increased to approximately $2 billion and reflects the $61 million cash payment, net of cash acquired for the acquisition of SecureCircle and the approximately $70 million cash payment for IP transfer tax related to the acquisition of Humio. Cash flow from operations in the fourth quarter was a record $159.7 million and free cash flow grew to a new record of $127.3 million or 30% of revenue. Excluding the approximately $70 million IP transfer tax payment related to the acquisition Humio, free cash flow would have been approximately $197 million or 46% of revenue for Q4 and $512 million or 35% of revenue for this fiscal year.

Before we move to guidance, I would like to cover a few modeling notes. First, I would like to note that we have entered the quarter with the strongest pipeline ever for a Q1. While we do not specifically guide to ending our net new ARR, given the incredible performance of Q4, which included two accounts that contributed approximately eight-figures each to net new ARR, I would like to provide a framework for how to think about net new ARR for Q1. As you may recall, last year, we significantly overperformed in Q1 and it was not indicative of typical seasonality. Consistent with years prior to that, 11% to 13% sequential seasonality was more typical for net new RR, which we would expect this Q1 after adjusting for the two large contributors in Q4 and this is implied in our revenue guidance.

Second, as we continue to invest for future growth and scale and invest to remain ahead of any potential supply chain delays, we expect capital expenditures as a percent of revenue to be between 10% and 12% in fiscal year 2023. We anticipate these investments will be more weighted to the first half of the year than the second. At the same time, we are planning to maintain free cash flow margin at 30% of revenue for the year, weighted more towards the second half. Moving to our guidance, we are starting the new year, with a robust pipeline and we remain optimistic about the demand for our offerings and the powerful secular trends fueling our growth.

For the first quarter of FY 23, we expect total revenue to be in the range of $458.9million to $465.4 million, reflecting a year-over-year growth rate of 52% to 54% with subscription revenue being the dominant driver of growth. We expect non-GAAP income from operations to be in the range of $61.7 million to $66.4 million and non-GAAP net income attributable to CrowdStrike to be in the range of $52 million to $56.7 million. We expect diluted non-GAAP net income per share, attributable to CrowdStrike to be in the range of $0.22 to $0.24 utilizing our weighted average share count of 240 million shares on a diluted basis. For the full fiscal year 2023, we currently expect total revenue to be in the range of $2,133.1 million to $2,163.2 million, reflecting a growth rate of 47% to 49% over the prior fiscal year.

Non-GAAP income from operations is expected to be between $289.2 million and $311.8 million. We expect fiscal 2023 non-GAAP net income attributable to CrowdStrike to be between $251.1 million and $273.6 million. Utilizing $243 million weighted average shares on a diluted basis. We expect non-GAAP net income per share, attributable to CrowdStrike to be in the range of $1.03 to $1.13. We look forward to sharing additional details about our business on our next investor webinar scheduled for April 7, George, and I will now take your questions.

Questions and Answers:

Operator

Thank you. [Operator Instructions] Our first question comes from Saket Kalia of Barclays. Your line is open.

Saket Kalia — Barclays — Analyst

Okay, great. Hey guys, thanks for taking my question here. Maybe for you, George. First of all, a lot of nice helpful disclosure on some of the non-endpoint products maybe if could just re-run on one. I was wondering if you could talk a little bit more about Preempt. It feels like it’s been a module that’s been gaining traction over the last couple of quarters. Can you just talk a little bit about how you feel like it differentiates from your competition and also how it might contribute to deal sizes?

George Kurtz — President and Chief Executive Officer and Co-Founder

Sure, thanks, Saket. When you look at, at our identity Zero Trust module, which came from the Preempt acquisition has now been integrated into the platform, which makes it seamless. It’s obviously been a standout for us, because when we think about the threat environment we are seeing many of these breaches abuse identity, abuse directory services and there is a massive compliance issue and just understanding all of these accounts where they live and who has access to Preempt accounts. So this is a highly differentiated module, our competitors really don’t have anything that’s close to this. The way it works, the AI algorithms that we have built around it that we got from the Preempt team and the expertise that we have in this area. So it certainly is a big way for us to help differentiate the platform among many others, and it has been an absolute standout for us and I think we have taken the time and effort to do the integration right, which is an important part of the way CrowdStrike looks at its platform. Thank you.

Operator

Thank you. Our next question comes from Sterling Auty of J.P. Morgan. Your line is open.

Sterling Auty — J.P. Morgan — Analyst

Yeah, thanks. Hi guys. I wonder, zero in on the cloud security opportunity that you talked about. And what I am curious about is, when you go in and sell what does that security stack look like in the cloud and what percentage of the wallet do you think you can capture versus the kind of capture rate that you get on Preempt with endpoint?

George Kurtz — President and Chief Executive Officer and Co-Founder

Sure. Thanks, Sterling. When we look at the cloud business and I think we have put some good disclosures around our penetration there. To us, it’s still a greenfield opportunity and the beauty of our platform is that we cover two very important areas, one is runtime protection. And the second one is cloud security posture management. There are companies that have one or the other. We actually have both and they are integrated across our Falcon control plane, which makes it very effective. We also have the ability to identify indicators of attack, which is much different than just miss configuration. So when you combine those together and you think about containers and Kubernetes clusters, the configuration whether they have vulnerabilities, whether it’s traditional virtualization and everything in between, we are covering a big part of the overall security stack of what people are looking for in that runtime protection visibility. So we still feel it’s in the early innings. We have got great technology in both the agent side, if you will, and some of it is agentless with cloud security posture management but we make it very easy and effective for the DevOps teams who — that’s who we are selling to in these areas and gotten pretty good at it. To be able to implement this as part of the CI/CD pipeline.

Sterling Auty — J.P. Morgan — Analyst

Understood. Thank you.

Operator

Thank you. Our next question comes from Andrew Nowinski of Wells Fargo. Your line is open.

Andrew Nowinski — Wells Fargo — Analyst

Thank you. Congrats on another amazing quarter guys. So in our last reseller survey, CrowdStrike had the top results. I am wondering if you’re seeing any sort of inflection with resellers and channel partners. And similarly, I am wondering if that CISA deal last quarter has maybe created an inflection within the US Federal market?

George Kurtz — President and Chief Executive Officer and Co-Founder

Sure. So, thanks. When you think about our partner opportunities and CrowdStrike, first are the partners for this company, that’s the way I built it. We haven’t wavered from that. And there’s many areas of partnering, everything from traditional resellers to managed service providers to cloud providers and hyperscalers like AWS that I talked about earlier. So why have we been successful there where we have taken the right approach to not compete with partners, to augment what they are trying to do and what we have seen in the managed service world is that the managed service providers are looking for the best endpoint platform that they can plug in and offer other services. And I think we have figured out a way to complement the services that they have in those areas and it’s been very effective and of course customers want our technology so their claim rate to these partners to work with us, so we will continue to do that and I think we have put some great proof points out, and our success in managed service in the cloud providers, as well as traditional resellers. And when we think about CISA, it’s a fantastic validation for us in the federal government. I have spent time in Washington, I was just there recently and there’s a lot of excitement about our technology. Finally, being able to be deployed there as you know, you have to go through a lot of different compliance and accreditations to get to sell in the federal government and we worked through those. We continue to work through those at different levels and it opens up a massive opportunity for us that we have seen a big pull from customers interest in that particular vertical because of the agent technology that they have been saddled with in the past. So more to come on that, but very excited about the opportunity today and in the future.

Operator

Thank you. Our next question comes from Joel Fishbein of Truist. Your line is open

Joel Fishbein — Truist Securities — Analyst

Hey, thank you and congrats on a fantastic execution. I have a quick question for George and a follow-up for Burt, if I could. George, you just talking Falcon XDR module. I think there’s a lot of noise in this space. Can you talk about Falcon XDR and how it’s different than the other products that are out there and why it’s important going forward?

George Kurtz — President and Chief Executive Officer and Co-Founder

Sure. What we think about XDR, it’s more than just the marketing acronym and what we have seen in the past is that organizations of all shapes and sizes, security companies have tried to just slap XDR on what they have, that’s legacy and we don’t think that’s the right approach. We have to start with the best EDR in the market and then you extend that. We believe our EDR is the best, it’s been validated many times over in different places. And what we have been able to do is to leverage the very powerful, fast and efficient streaming engine of Humio, we just talked about the petabyte benchmarks to be able to combine that with our threat graph, apply AI on top of it to get the best threat detection output and response leveraging our fusion technology. So we are still in the early days, obviously we just launched it, we work with a lot of customers, we are adding more integrations around that, but we are really excited about that and we believe this really a technology that will subsume the SIM market and we think we are in a perfect pole position to be able to capture it.

Operator

Thank you. Our next question comes from Brent Thill of Jefferies, your line is open.

Unidentified Participant — — Analyst

Hey, guys. You have John for Brent. Thanks for the question. And really appreciate the additional disclosures. Burt, unreal results and fantastic opening guide for revenue for fiscal ’23, maybe just walk us through the methodology and has anything changed with how you would typically gave an opening guidance and then maybe to what extent do we expect the mix shift of revenue outside of core end point and what were the inflationary impacts to revenue and opex for fiscal ’23? Thanks.

Burt Podbere — Chief Financial Officer

Hey, John. Thanks for that. So in terms of a methodology, nothing has really changed. We guide to what we see. We do not guide to running the tables. So absolutely no change there. I think that the question about going and capturing some of the additional markets outside of our core end point, I think we have given us some good disclosures about some of our momentum. We don’t see any of that momentum fading. And we are excited about both core and some of our emerging for emerging products. And so when we think about it and when we look at our pipeline and we look at the opportunities in front of us, we get really excited about both opportunities and then you drill down even a little further and we get excited about being able to sell both those opportunities to both the largest enterprise companies in the world, all the way down to some of the smallest. So that’s how we think about it.

Operator

Thank you. Our next question comes from Matt Hedberg RBC Capital Markets. Your line is open.

Matthew Hedberg — RBC Capital Markets — Analyst

Great, thanks for taking my question guys. Congrats. Lots of things to talk about here. I guess Burt for you, one of the things that really stood out to me was, when we look at ending ARR per subscription customer that had declined sequentially for many quarters in Q3, it was kind of flattish, maybe up a little bit but Q4, according to my math, it was up about 3% sequentially. Really, really strong. I think to me that speaks to your cross sell ability. I am wondering when you think about the guide for next year, what are some of the assumptions around ending ARR per subscription customer, should that continue this kind of upward sequential trajectory at this point?

Burt Podbere — Chief Financial Officer

Hey, Matt. So we really don’t look at it that way. To be fair with you, because when you think about net new ARR, it could come from anywhere. It could come from new logos, it could come from our existing base. Our focus, as you know has been and always will be net new ARR, wherever it comes from. So when we think about looking out into this year, we are doing the same thing from a compensation perspective with our sales team, as we have done last year, meaning we are going to pay our sales team the same whether they bring it from net new logo or whether they bring it from an existing customer. So we pay on net new ARR. We don’t care where it comes from. The great news is of course is that, we have tremendous amount of headroom in both. Our expanding base really helps in terms of cross sell for sure, but we still have a tremendous amount of headroom in terms of being able to go after new logos and that’s kind of a great position to be in, and it really talks to the fact that we think about CrowdStrike in the early innings of our journey with a lot of headroom to go. So hopefully, that makes sense to you.

Operator

Thank you. Our next question comes from Tal Liani of Bank of America. Your line is open.

Tal Liani — BofA Securities — Analyst

Hi guys, great quarter. I wanted to ask about competition and you have now the last count I have is 24 modules, how is the landscape of competitors, how is it changing with the additional modules. And can you talk about the acceptance rate. Normally you give out kind of how many or what percentage of customers have — subscription customers have more than four, five and six modules and I didn’t hear this quarter, maybe I just didn’t hear it. So can you give an update on the acceptance rates of your modules and speak a little bit about the take rate of the new modules and where do you see kind of how do you see it ramping versus historical trends, etc.? Thanks.

George Kurtz — President and Chief Executive Officer and Co-Founder

Yes, thanks. So, George here. When we look at the competition, I think this quarter we put a punctuation mark on the competitive point when you see the growth, you see the cross sell, you see some of the modules out sort of — outside of just the core, we have never seen a better competitive environment for us. We are entering the quarter with the largest pipeline, we have got lots of replacements in the legacy world, lots of replacements in the Next-Gen world and truly differentiated platform with our modules, we have 22, just to be clear. And when you look at what we put together in the endpoint and workload protection visibility space combined with identity, which is very unique to us that others don’t have, combine that with data now with SecureCircle. It’s a true platform that customers are looking to buy and understand that they can consolidate agents, reduce cost and get much better outcomes and you combine our world-class offerings like Falcon Complete, an overarching on top of it and it certainly is a winning combination. So full steam ahead from us on the competitive side and we continue to out-innovate and build what we believe is the best platform in the industry. Burt, I will let you take the module take rates.

Burt Podbere — Chief Financial Officer

Sure, I will give them out again because we are very proud of them. So the percentage of customers with four or more modules is 69%, five or more modules is 57%, six or more modules of 30% — 34%. All of which are increases over last quarter.

Operator

Thank you. Our next question comes from Alex Henderson of Needham. Your line is open.

Alex Henderson — Needham & Company — Analyst

Thank you very much. I have actually got a clarification and the question. The first one is a clarification, I mean you talked about a record pipeline that’s kind of a throw away considering your growth rate, I mean you are growing so fast. You have to have a record pipeline to keep the growth going, so I was wondering if you were to look at your pipeline relative to forward expected net new ARR, whether the ratio of your pipeline to the forward ARR is in fact a record as well. And then the question I have for you is really actually on a smaller piece of your business. But I think, a very important one, which is the services business, which obviously did very well with the increase in revenue upsell, Mandiant haven’t been bought out here or announced to be bought out. They had been obviously one of the more successful companies in targeting and coping with them, does that open up a runway for you. It’s my understanding that Google is planning on using that predominantly for internal products as opposed to what Mandiant has done in the past. So does that open up a new opportunity for you to expand that further and become the preeminent not that you are not already, but even more of a preeminent player in those security. So you can get that upsell.

Burt Podbere — Chief Financial Officer

Hey, Alex. It’s Burt. Thanks for your questions. I will take the first clarification point and then I will pass it to George to talk about the Mandiant acquisition. So what we came out and said is that obviously that our pipe going into the year is the greatest pipe we have ever seen in company history. I think I will leave it to everybody else and you on the call to kind of figure out what that means in terms of net new ARR but generally, I think that combine that with the momentum that we have talked about in the business, we feel really good about starting starting the year and then I will turn it over to George for your second part of question.

George Kurtz — President and Chief Executive Officer and Co-Founder

Yeah. So, thank you, Burt. And first, I wanted to congratulate Kevin and the entire team. I have known and worked with Kevin many years at Foundstone and they are a fantastic organization, one of the best in the business and we have a lot of respect for them. So we continue to work with them on partnering opportunities. We think it’s a great opportunity being part of Google, who is also another big partner of CrowdStrike. So I think both organizations make a lot of sense. You have got world-class capabilities across the board. And we think our technology can be additive to the overall Mandiant solution and we look forward to seeing how that progresses and continuing to partner with them. So overall, I think it’s a positive net-net for all parties.

Operator

Thank you. Our next question comes from Fatima Boolani of Citi. Your line is open.

Fatima Boolani — Citi — Analyst

Good afternoon and thank you for taking my questions. Burt, I have just one for you. I look at your operating income guidance for fiscal ’23 and it implies close to 60% growth in operating income and I look at that in comparison to kind of the 49% you have guided to the high end from a revenue standpoint. So what I wanted to ask you was, what are some of the contributing factors to your operating income growth outstripping your revenue growth and what sort of considerations you have in place, vis-a-vis travel and expense levels reverting to sort of pre-COVID levels and frankly some of the talent retention and talent acquisition costs and wage inflation that has maybe bedeviled some of your peers, any thoughts around there and how you have been able to buck that trend as contemplated in your guidance would be very helpful. And that’s it from me. Thank you.

Burt Podbere — Chief Financial Officer

Sure, Fatima. Thank you for your question. So first let me just start off by saying when we take a look at the guide, we take a look at of course what we see, not necessarily what we don’t see somewhere on the revenue side and then we think about the power of our model. We have got a lot of leverage in our model, unit economics is really strong and it’s pointing to one thing which is, continue to invest aggressively which we plan to do and it’s reflected in the guide. I think there are a few things that really shape that guide. One is, I think that we have seen a lot of tailwinds for us, we see momentum in the business. So scale and how we think about the revenue guide really plays a big role in terms of how we think about our margin guide. But we do take into consideration things like inflation, we take into consideration what we are seeing out there in terms of talent. It is talent war that we are seeing on a day-to-day basis, not only for us, but for others in the space and we have got to differentiate — differentiate ourselves from others to attract folks to come and join us and we have done a really good job so far but pedal to the metal in terms of hiring and then your last piece of the question with respect to travel, I think that it’s going to be more than it was last year, knock wood obviously it result on how the pandemic plays out this year. But the idea is that we do plan on more travel, we want people to get together, we want people to collaborate, we want to go and visit customers on the one hand, on the other hand, I think every CFO out there is taking a look at what was done in the past and then how they think about the future and is looking for highest and best use of travel and I am no exception. So I am going to take the opportunity to make sure that we have got all the controls in place to make sure that we are doing just that. Making sure that we are looking at the highest and best use of our dollars for travel, and I think everybody will be appreciative of that, and I think that as a company, it just goes to continue our story about being a really, really, really well flighted company in all aspects of the business from tech to go to market to finance. I hope that answers your question.

Operator

Thank you. Our next question comes from Joshua Tilton of Wolfe Research. Your line is open.

Joshua Tilton — Wolfe Research — Analyst

Hey guys. Thanks for taking my question. You spoke a lot in the prepared remarks about the success of the non-endpoint modules. Can you just comment on the demand environment as we enter the year but more specifically compare and contrast the demand for endpoint modules versus the demand for the cloud security and identity modules, where are you seeing the highest demand of those three categories and how does that maybe compare to this time a year ago?

George Kurtz — President and Chief Executive Officer and Co-Founder

When you look at the endpoint security modules and identity there — they go together. So we see broad-based demand on all that, people are buying the endpoint security modules primarily for two reasons, one protection to visibility, which will get both in order to an extra protection, they have had the identity module, which makes sense given that many of the breaches don’t necessarily we use in our in today’s environment. So we see them going together and we see great opportunity for many customers who have been with us for a long time, who don’t have identity, because that’s a newer module to be able to add Identity to their existing platform. But again, there’s not much that they have to do other than activate it given the architecture that we have built. So, and then when you look at some of the other modules, just in general, vulnerability management has done exceptionally well. We have seen lots of vulnerabilities in the environment, understanding the assets and their configurations and the hygiene is very important to protecting them. And then in a distributed world, which we have today, there is no perimeter. It’s all systems wherever they may reside. They are going to need this level of protection, visibility and ability to even understand their vulnerability. Overall, we are pleased with the module growth outside of what we call the score endpoint protection and we look forward to continued growth in those areas.

Operator

Thank you. Our next question comes from Rob Owens with Piper Sandler. Your line is open.

Rob Owens — Piper Sandler — Analyst

Great, thanks for taking my question. I was wondering if you could touch on the critical infrastructure defense project that you recently announced. Just, I guess how it came about with these vendors and more broadly, how under-protected are we in these verticals relative to Next Generation Technologies? Thanks.

George Kurtz — President and Chief Executive Officer and Co-Founder

Yes. Sure, Rob, we thought it was appropriate with some of our parts in the industry to to see where we can help them. When you look at critical infrastructure and the government is really concerned about hospitals, pipelines things that nature, it’s super important that they are protected and there aren’t a whole bunch of in-force standards in some of these areas. And a lot of times they are under-protected for a variety of reasons. So we thought it was the right thing to do in terms of offering our technology out there for some period of time and we think we are going to be able to hopefully move the needle at protection in places where it maybe have not been as good. And then obviously we will look to see how that pans out from a business perspective, but first and foremost, we are just trying to do the right thing.

Operator

Thank you. Our next question comes from Jonathan Ruykhaver of Baird. Your line is open.

Jonathan Ruykhaver — Baird — Analyst

Yeah, hey guys, congrats. I am wondering if you could just provide some color on the free-tier whether, it would be the Humio community certainly, I think you introduced that some software capabilities as well. Just curious how you are thinking about that sales motion. I mean, is there an opportunity to introduce those free tears more broadly going forward?

George Kurtz — President and Chief Executive Officer and Co-Founder

Well, yes. So let us talk about Falcon infusion for a bit, which is our software capabilities. The beauty is, it’s built into the platform. You just get it if you are Falcon customer, which has been extremely well — by our customers and the amount of automation that we have been able to achieve, we think far outstrips our competitors can do and it ties into our XDR response strategy and its seamlessly built in, it wasn’t an acquisition that we have to bolt-on. So we are really happy with that. But other than make sure everybody knows we have it. There is not a lot of motion that we have to go into there, and it has been a differentiator for us. When we think about the Humio community addition, I think it goes to the heart of where we have been able to make some really good inroads in the DevOps world both in cloud protection, but as well as observability. We talked about some of the big wins with Humio, some of them are not even security-related, they are simple — it’s simply observability. The beauty of that technology is the ability to get data from just about any source and answer any question at scale. The community addition is very well received. We have people that are using it and then obviously, saying it has great technology, we want to learn more, we want to think about licensing it, so we are still in early innings on that, but it goes to the heart of our e-commerce efforts in a platform that we have built out, which I think is candidly under-appreciated in what we are able to do from a business perspective and the sales efficiency that it actually brings to CrowdStrike.

Operator

Thank you. Our next question comes from Ittai Kidron of Oppenheimer. Your line is open.

Ittai Kidron — Oppenheimer & Co. — Analyst

Thanks. Hey guys, great quarter. And thanks for all the disclosures. I have a couple. George, first for you on the new modules, clearly you are making very good progress here. But can you tell us how much of the progress here is more up selectivity or do you have customers that actually land first review in these solutions and for you Burt, great job on the operating margin side I guess you are pretty much at your target operating margin range. So is it time to raise it finally?

George Kurtz — President and Chief Executive Officer and Co-Founder

All right. So, I will take the first part. When we think about how customers land, let us take a couple of examples. So Cloud Workload Protectio0,n cloud security posture management horizon. Absolutely, they can land there first before they they put Falcon on any of their, what we would call traditional endpoints and we see that all the time, same with Humio. When you think about something like identity that becomes a driver for why they are calling us. They are looking at their existing solutions saying, hey, we need a solution in the endpoint identity space, you guys are the only folks that have it, come in and talk to us and then traditionally, we will land with that and amongst something else probably the endpoint detection or EDR and the beauty again of our model is, single agent collect data one time, all the modules become available. So once we get the agent on that system, everything else opens up to us from a module perspective. So there’s different demand drivers and then there’s specific technologies, which are just natural for us to lead with and sell and then be able to cross sell in other places in the organization like Cloud Workload Protection and cloud security posture management. Burt?

Burt Podbere — Chief Financial Officer

Thanks, George. Thank you Ittai for the question. So number one, really happy with our performance on the top and the bottom. I think that the guide really reflects what we really want to do this year, which is aggressively invest in the business. We have got this opportunity in front of us. We think there’s a tremendous amount of demand, there is a tremendous big opportunity for us and we are going for it. So I think that when we guided, we took all that into consideration and so I feel really, really good about where we are. And of course, our unit economics the metrics that we look at are all driving that decision in terms of how we guided it and that’s the great thing about our business. It’s well flighted, the model itself is open to leverage and right now we are going to use some of that leverage to go invest aggressively into the business.

Operator

Thank you. And our last question comes from Gregg Moskowitz of Mizuho. Your line is open.

Gregg Moskowitz — Mizuho Securities — Analyst

Alright. Thank you very much. Thanks for taking the question. I will keep it to one. Just in the interest of time, so you now have more than half of the Fortune 500 in total and based on our numbers you have added 77 of the Fortune 500 over the past 12-months. I mean, both of these are just remarkable statistic. So I guess two things relating to this first, as you look ahead to fiscal ’23, how would you characterize your new customer pipeline specifically at the larger enterprise level and then how much runway is there for your current fortunate 500 customers to continue to expand with CrowdStrike? Thank you.

George Kurtz — President and Chief Executive Officer and Co-Founder

Great. Well, we still see a big runway of customers or potential customers in the Fortune 500 that aren’t on CrowdStrike and we have seen obviously a lot of interest there and I think Enterprise customers understand that they are looking for the best protection at scale with the manageability, CrowdStrike is the technology of choice and we have built our gold standard reputation in that in that arena. So that’s what I would say there. Burt, anything else to add? I know we are short on time.

Burt Podbere — Chief Financial Officer

Yes, it’s a great question. I think right now, Greg look, we are really happy that we have over 50% of those Fortune 500. We have got a whole bunch more to go and when George thinks about — and George and I think about the rest of our potential business looking forward again, tremendous success in enterprise, that’s where George flighted the business and that’s where we started. And we are going to continue to I think see lots of opportunities come our way. And then on going down, I think we have had a lot of success in being able to build the technology, the same agent for both the company that has a 1 million endpoints versus one that has 5, that’s really hard to do, and so we have got — the beauty of where we are right now is, we have over 16,000 subscription customers, those are all open to cross-sell and up-sell and then we have got this tremendous amount of new logos to be able to go after, whether it’s an enterprise, mid-market or SMB. And that’s the beauty of where we are and that’s why we are — you are hearing the excitement in our voices. And now, I will turn it back over to the moderator.

Operator

Thank you. I am showing no further questions, I would like to turn the call back over to Mr. Kurtz for any closing remarks.

George Kurtz — President and Chief Executive Officer and Co-Founder

Okay. Well, thank you so much. We appreciate everyone’s time and attention and we wish the best to everyone. Stay healthy, and we look forward to seeing you next quarter. Thanks so much.

Operator

[Operator Closing Remarks]