Earnings Call Transcript - CRWD Q3 2023

Operator, Operator

Hello, and thank you for waiting. Welcome to CrowdStrike's Fiscal Third Quarter 2023 Results Conference Call. All participants are currently in a listen-only mode. Following the speaker presentation, we will have a question-and-answer session. It is now my pleasure to introduce Vice President of Investor Relations, Maria Riley.

Maria Riley, Vice President of Investor Relations

Good afternoon, and thank you for your participation today. With me on the call are George Kurtz, President and Chief Executive Officer and Co-Founder of CrowdStrike; and Burt Podbere, Chief Financial Officer. Before we get started, I would like to note that certain statements made during this conference call that are not historical facts, including those regarding our future plans, objectives, growth and expected performance, including our outlook for the fourth quarter and fiscal year 2023 as well as any assumptions for fiscal periods beyond that, are forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements represent our outlook only as of the date of this call. While we believe any forward-looking statements we make are reasonable, actual results could differ materially because the statements are based on current expectations and are subject to risks and uncertainties. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements whether as a result of new information, future events or otherwise. Further information on these and other factors that could affect the company's financial results is included in the filings we make with the SEC from time to time, including the section titled Risk Factors in the company's quarterly and annual reports. Additionally, unless otherwise stated, excluding revenue, all financial measures disclosed on this call will be non-GAAP. A discussion of why we use non-GAAP financial measures and a reconciliation schedule showing GAAP versus non-GAAP results is currently available in our earnings press release, which may be found on our Investor Relations website at ir.crowdstrike.com or on our Form 8-K filed with the SEC today. With that, I will now turn the call over to George to begin.

George Kurtz, President and Chief Executive Officer

Thank you, Maria, and thank you all for joining us. Let me start with a summary of our results. In Q3, we achieved 53% revenue growth year-over-year, a 15% non-GAAP operating margin, and record non-GAAP net income, all of which exceeded our guidance. Additionally, we reported record free cash flow of $174 million, or about 30% of revenue. We observe many positive trends in our business, such as strong competitive win rates, consistent average selling prices, exceptional retention rates, and the critical importance of cybersecurity. However, I would like to first address the increased macroeconomic challenges we faced during the quarter, which caused Q3 net new annual recurring revenue to fall short of our expectations. As mentioned in our last earnings call, organizations began responding to macroeconomic conditions by implementing additional required approvals and extending the time needed to close some deals. As Q3 progressed and recession fears intensified, this trend became more pronounced. In our smaller, more transactional accounts, we noticed customers increasingly delaying purchasing decisions, with the average days to close increasing by approximately 11% and net new ARR decreasing by $15 million from the previous quarter. This also affected our net new logo additions for the quarter, despite a significant increase in our quarter-over-quarter win rates against more complex vendors that require additional resources to manage. While our sales cycles lengthen, we believe that most of these deals are not lost, just postponed. In the enterprise sector, sales cycles remain consistent with last quarter's slightly higher levels. In Q3, our larger customers continued to prioritize their CrowdStrike investments, although some had to navigate timing issues related to operating expense budgets and cash flow amid the rapidly changing macro environment. To manage this, some customers signed contracts with multi-phase subscription start dates, delaying their expenses and our ARR recognition into future quarters. While we often have some deals with multi-phase start dates, in Q3, we observed approximately $10 million more in ARR deferred to future quarters in comparison to last quarter. We expect these macro challenges to continue into Q4. Additionally, given the heightened scrutiny on budgets, we do not anticipate a typical budget flush in Q4, which leads us to adjust our net new ARR expectations for that quarter, as Burt will explain in more detail. However, this caution does not diminish our confidence in CrowdStrike's long-term market position or the resilience of the cybersecurity market. We see strong underlying demand for our products, and we entered Q4 with a record pipeline. Expanding our pipeline is even more critical during times of evolving macro circumstances and extended sales cycles. We are actively working to lead in pipeline creation, especially with our recently appointed CMO, Jennifer Johnson, who is realigning our marketing initiatives to enhance our focus on top-of-funnel activities and brand awareness to drive pipeline growth. Our partner ecosystem has also provided significant leverage, with partner-sourced ARR growing 55% year-over-year. This quarter featured many positives, including a record number of customers contributing at least $1 million in net new ARR. Moreover, our ending ARR for the $1 million-plus cohort surpassed the $1 billion milestone in Q3, with a growth rate of 67% year-over-year. These larger customers are standardizing on Falcon, consolidating vendors, and prioritizing expansion projects that represent substantial cross-sell and up-sell opportunities, even amid uncertain macro conditions. New marquee brands entering our $1 million-plus cohort included a Global 500 manufacturer adopting 10 modules for unprecedented visibility and protection across their environment, allowing consolidation of four agents and vendors in their initial deployment of Falcon. Two Global 500 financial institutions chose Falcon to replace multiple outdated security products and strengthen their security posture with a single agent. Additionally, a Global 500 consumer goods manufacturer is leveraging Falcon Complete for a fully managed approach to protect its critical infrastructure, and a Fortune 500 luxury brand is using Falcon to safeguard both its traditional endpoints and cloud workloads. In the third quarter, we also saw strong results in the public sector, with a Falcon Complete LAN implementation at one of the largest US federal agencies now standardizing on the Falcon platform. Our SLED business also performed well, with several wins and expansions across US state and local government agencies and educational institutions. Currently, 40 US state governments are CrowdStrike customers, with 21 in the District of Columbia standardizing on Falcon. Furthermore, we secured a win with one of the largest federal systems integrators who will be using Falcon to protect its internal operations and integrate it into its managed security service provider offering. Looking at our expansion and retention performance, our dollar-based net retention rate exceeded last year's Q3 results and remained consistent with our Q2 performance, which was the highest in seven quarters. Our best-in-class gross retention rates stayed above 98%. We also noticed an increasing number of customers standardizing on the Falcon platform and adopting more modules. Q3 subscription customers utilizing five or more, six or more, and seven or more modules were 60%, 36%, and 21%, respectively, representing increases of 55%, 66%, and 81% year-over-year in these cohorts. This quarter also marked a record for our emerging product category, which includes our Discover, Spotlight, Identity Protection, and LogScale modules. Our Identity Protection solutions are the largest contributors to ARR within this emerging category, and Q3 set another record in growth. Net new ARR for the Identity Protection solution reached an all-time high, with a rapidly growing attach rate on new logos. As many cyberattacks employ identity-based tactics, our Identity Protection offerings play a critical role in preventing breaches. A recent significant expansion with a global brand underscores the value of our Identity Protection capabilities. This customer, despite already having a capable security team and a dedicated identity and access management team, discovered several misconfigurations after initiating Falcon's Identity Protection in the point of view phase. This included numerous unmanaged domain administrator accounts and potential security vulnerabilities. With Falcon Identity, they are effectively closing off paths to unauthorized access and significantly strengthening their defenses. Q3 also saw another record for LogScale, securing wins across various sectors including financial services, insurance, technology, retail, energy, and telecommunications. Prominent victories included a statewide insurance provider in the US, where Falcon LogScale enabled them to log and retain more data while reducing existing log solution costs, enhancing security and visibility across their environments. During the quarter, we acquired Reposify, an external attack surface management vendor, to assist customers in identifying and mitigating risks from their vulnerable assets. The acquisition was completed in early October, and we plan to launch our external attack surface management module this quarter, increasing our total module offerings across the Falcon platform to 23. In the public cloud arena, we continue to see growth, with ending ARR for modules deployed in public cloud settings doubling year-over-year. Our Cloud Native Application Protection Platform solution is gaining industry recognition, including an award for Best Cloud Security from CRN's 2022 Tech Innovators Awards. Falcon Complete is also performing well, with net new ARR rising nearly 20% quarter-over-quarter as customers appreciate our comprehensive service lineup, including Identity Complete and Cloud Complete. Additionally, we launched Falcon Complete LogScale in Q3 and have already secured several wins. In a challenging economic climate, Falcon Complete appeals to companies looking to stabilize or reduce headcount. The significant advantages of CrowdStrike's Falcon Complete offering were highlighted in the first MITRE ATT&CK evaluation for security service providers, where our platform's integration of leading technology and human expertise resulted in the highest coverage. This evaluation was MITRE's first closed-door test, meaning participants had no prior knowledge of the adversary, and retesting was prohibited. We believe this assessment underscores why CrowdStrike is the leading provider in EDR and XDR, whether delivered through managed services or used independently by our clients. The Falcon platform also excelled in SE Labs' EDR ransomware detection and protection test, achieving 100% ransomware prevention with zero false positives. This exceptional performance reflects our superior AI and machine learning models and the data advantage from our unique Threat Graph technology. Falcon's remarkably low false positive rate translates into significant operational efficiency for our customers, allowing them to respond to verified alerts more swiftly. Based on our business value assessment and realized analysis, we estimate that enterprise customers experienced an average 68% increase in operational efficiencies with the Falcon platform, equating to the equivalent of about 3.5 full-time employees. We believe that current macro pressures on businesses, combined with the increasing threat landscape, enhance the value proposition of Falcon as a consolidator more than ever before in CrowdStrike's history. To address challenges with agent bloating within security and IT frameworks, while also safeguarding businesses against cyber threats and lowering operating costs, companies need to consolidate onto a truly integrated platform rather than pieced-together technologies. CrowdStrike Falcon continues to set the standard as the security platform of record. While the cybersecurity market is not impervious to macro pressures, it remains a critical technology since cyber adversaries do not relent. Our latest threat-hunting report highlighted a nearly 50% year-over-year increase in interactive intrusion campaigns. We believe that investments in cybersecurity remain resilient and prioritized, especially among the largest organizations, as indicated by our $1 million-plus customer cohort and best-in-class retention and module adoption rates. With the rising threat landscape, expanding attack surfaces, and the accessibility of the Falcon platform, we believe we are still in the early stages of CrowdStrike's growth journey. The rapid success of our identity protection solution exemplifies our ability to leverage our extensive threat intelligence to create and lead in both new and existing markets. We plan to continue our disruptive innovation, expand our technological leadership, and introduce new modules. Despite these investments, we are adapting to prevailing macro conditions and aim to balance growth with profitability and free cash flow, as Burt will elaborate further. We remain committed to our goal of reaching $5 billion in ending ARR by fiscal year 2026 and achieving our target operating model by fiscal year 2025. Now, I will turn it over to Burt for a deeper look at our financial results.

Burt Podbere, Chief Financial Officer

Thank you, George, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue mentioned during my remarks today are non-GAAP. Before we get started, I will note that the results we are reporting today include the acquisition of Reposify, which was de minimis to revenue and ARR, contributing less than $1 million to Q3 ARR. In the quarter, ending ARR grew 54% year-over-year. Net new ARR grew 17% year-over-year to $198.1 million. Given the elongated sales cycles due to macro pressures in smaller non-enterprise accounts that George discussed, the composition of net new ARR in Q3 was weighted more heavily toward our $1 million-plus customer cohort with no outsized contribution from any one deal. Our dollar-based net retention rate was above our benchmark and consistent with Q2, maintaining the highest level since Q3 in fiscal 2021. Gross retention also maintained its record level, demonstrating our strong commitment to stopping the breach, delivering value to customers and restoring trust to the security posture of companies worldwide. As George mentioned, we are also seeing more customers standardize on the Falcon platform and adopt more modules. We believe these trends will create an enduring business opportunity for the years to come. Moving to the P&L. Total revenue grew 53% over Q3 of last year to reach $580.9 million. Subscription revenue grew 53% over Q3 of last year to reach $547.4 million. Professional services revenue was $33.5 million, setting a new record for the ninth consecutive quarter and representing 46% year-over-year growth. In terms of our geographic performance in Q3, we continue to see strong growth in the US at 46% and international revenue growth at 72% year-over-year. Third quarter total and subscription non-GAAP gross margins remained relatively consistent at 75% and 78%, respectively. Total non-GAAP operating expenses in the third quarter were approximately $348.6 million or 60% of revenue versus $239.0 million last year or 63% of revenue. In Q3, our Magic Number was 1.2, reflecting the continued efficiency of our go-to-market engine. We believe a Magic Number in excess of 1.0 indicates very favorable go-to-market efficiency and supports our current investment plan. As George mentioned, we are focusing marketing investments on specific initiatives with the goal to drive an even bigger pipeline in response to the macroeconomic environment, while at the same time maintaining our disciplined approach to unit economics. Third quarter non-GAAP operating income grew 77% year-over-year to reach a record $89.7 million, and operating margin improved by 2 percentage points year-over-year to reach 15%. Looking at the first nine months of fiscal year 2023. Non-GAAP operating income grew 125% year-over-year to reach $260.1 million and 16% of revenue. Non-GAAP net income attributable to CrowdStrike in Q3 also more than doubled over the prior year, growing to a record $96.1 million or $0.40 on a diluted per share basis. Our weighted average common shares used to calculate third quarter non-GAAP EPS attributed to CrowdStrike was on a diluted basis and totaled approximately 240 million shares. We ended the third quarter with a strong balance sheet. Cash and cash equivalents increased to approximately $2.47 billion and reflects the approximately $19 million payment net of cash acquired for the acquisition of Reposify. Cash flow from operations grew 53% year-over-year to a record $242.9 million. Free cash flow grew 41% year-over-year to a record $174.1 million or approximately 30% of revenue. Before I move to our guidance, I’d like to provide a few comments about how we view the ongoing impact of the current macro climate on our business. We are maintaining our revenue guidance for fiscal year 2023 while raising our bottom line guidance. As George mentioned, even though we entered Q3 with a record pipeline, we are expecting the elongated sales cycles due to macro concerns to continue, and we are not expecting to see the typical Q4 budget flush given the increased scrutiny on budgets. While we do not provide net new ARR guidance given the current macro uncertainty, we believe it is prudent to assume that Q4 net new ARR will be below Q3 by up to 10%. Looking into FY 2024, assuming an approximately 10% year-over-year headwind in the first half of the year on net new ARR, and for the full year, net new ARR would be roughly flat, to modestly up year-over-year. This would imply a low 30s ending ARR growth rate and a subscription revenue growth rate in the low to mid-30s for FY 2024. Similar to how we partnered with customers during the height of the COVID-19 pandemic, we are exercising more flexibility with new contract payment terms as organizations navigate macroeconomic conditions. We also expect more multiyear deals converting to one year renewals than in previous quarters. As a result, we expect free cash flow as a percent of revenue to be in the range of 28% and 30% for FY 2023. Throughout fiscal year 2023 to date, we have taken advantage of market dynamics and brought on superb talent in key functions at an accelerated pace. At the same time, employee retention rates have increased. As of the end of Q3, we have grown our team by 40% in FY 2023, putting us in a really good position to execute on our plan for next year. This allows us to shift our near-term focus to enablement and productivity, while significantly slowing the pace of new hires needed to execute our plans. Assuming the macro environment does not materially weaken from current levels, we see a path to free cash flow margin of 30% of revenue in FY 2024, and we plan to generate modest incremental non-GAAP operating margin leverage in FY 2024 as we continue to march toward our target operating model. For the fourth quarter of FY 2023, we expect total revenue to be in the range of $619.1 million to $628.2 million, reflecting a year-over-year growth rate of 44% to 46%, with subscription revenue being the dominant driver of growth. We expect non-GAAP income from operations to be in the range of $87.2 million to $93.7 million and non-GAAP net income attributable to CrowdStrike to be in the range of $109 million to $107.5 million. We expect diluted non-GAAP net income per share attributable to CrowdStrike to be in the range of $0.42 to $0.45, utilizing a weighted average share count of 241 million shares on a diluted basis. For the full fiscal year 2023, we currently expect total revenue to be in the range of $2,223.0 million to $2,232.0 million, reflecting a growth rate of 53% to 54% over the prior fiscal year. Non-GAAP income from operations is expected to be between $347.2 million and $353.8 million. We expect fiscal 2023 non-GAAP net income attributable to CrowdStrike to be between $357.6 million and $364.4 million. Utilizing 240 million weighted average shares on a diluted basis, we expect non-GAAP net income per share attributable to CrowdStrike to be in the range of $1.49 to $1.52. George and I will now take your questions.

Operator, Operator

Thank you. Our first question comes from Saket Kalia with Barclays.

Saket Kalia, Analyst

Okay. Great. Hey, guys. Thanks for taking my questions here. A lot to unpack. George, maybe for you, I was wondering if you could dig just one level deeper into any competitive data that you've reviewed kind of looking back in the quarter. Do you feel like any big competitors here like Microsoft or perhaps even smaller next-gen competitors are having an impact? Burt, if I could squeeze a housekeeping question in as well. Clearly, ARR is the metric that you manage to. But maybe for everybody's benefit, can you also talk to how RPO and ARR growth might have different drivers?

George Kurtz, President and Chief Executive Officer

Yes. Thanks, Saket. So again, if you look at what we've seen and what we've commented on, the inherent demand for our products remains strong. Obviously, there's an increase in the macro headwinds. We talked about some of the smaller customers having elongated sales cycles. We saw an 11% increase in days to close. And those are delayed deals, not lost deals. And on the enterprise, again, we're seeing consistent win rates. They remain high. And in fact, in the smaller customers, we've actually seen them significantly improved quarter-over-quarter. So from our standpoint, and we look at this very closely, as you might imagine, the landscape remains favorable to us. I really don't see another true consolidator like Falcon. And customers are looking for technologies that reduce costs, reduce complexities, actually work and stop breaches, and that's what we're delivering. So again, when we look at the competitive landscape, it remains favorable to us. And as we pointed out, we saw increased macro headwinds, and that's what we talked about. So I'll turn it over to Burt.

Burt Podbere, Chief Financial Officer

Thanks, Saket. To provide some perspective on CRPO, it’s a metric we consider to be somewhat noisy. It doesn't necessarily align with ARR, which is normalized on an annual basis. By "noisy metric," I mean that there are several positive developments in our business that may affect the duration compared to previous periods, and these aren't entirely reflected in CRPO. For instance, we have more one-year deals than in prior periods. In the software industry, it's often challenging for multi-year contracts to renew as one-year deals. As renewals become a larger part of our business, which is happening for us, this creates a challenge for CRPO. Given our high gross retention rates, one-year deals allow us to expand within customers, enabling larger bundles. Additionally, our expansion and cross-sell efforts lead to contracts that are often shorter than one year. Our growing expansion business, as seen in our net new retention rate, puts pressure on CRPO. We also have some usage-based deals, particularly with MSSPs, which are mostly monthly billing, and as they grow rapidly, they'll impact CRPO along with noncommitted consumption billings in the cloud. Regarding ARR, as you noted, we focus on that metric for running our business. ARR serves as a detailed look into the contracts, and we consider it the most important and transparent gauge for our business outlook. I hope this clarifies our perspective on CRPO and ARR.

Operator, Operator

Thank you. And our next question comes from the line of Rob Owens with Piper Sandler.

Rob Owens, Analyst

Good afternoon. Thanks for taking my question. Wondering if you guys could compare and contrast what you saw domestically versus internationally. And a little surprising to see international actually strengthen based on growth rates and the US fall off. So if you could provide a little clarity there, that'd be great. Thanks.

Burt Podbere, Chief Financial Officer

Hey, Rob, this is Burt. Thanks for the question. So, in general, we saw the macro hit all the geos. But as we think about our split between United States and internationally, obviously, the United States is the biggest portion overall of our business. So any impact to ARR will generally be driven from that sector.

Operator, Operator

Thank you. One moment, please. And our next question comes from the line of Sterling Auty with MoffettNathanson.

Sterling Auty, Analyst

Yes. Hi, guys. And thank you for the extra commentary on macro and next year, in particular. My question is really, how do you think about those macro headwinds manifesting themselves in terms of net dollar retention or expansion rates versus the growth rate in new customers? Is one side going to be more particularly hit versus the other as it unfolds over the next several quarters?

Burt Podbere, Chief Financial Officer

Thank you, Sterling. The positive aspect for us is that we have a strong installed base, and we see excellent opportunities within the traditional land-and-expand model. This is reflected in the ratios we've observed. However, we also recognize a significant opportunity in gaining new customers. We believe our ability to acquire these new customers aligns with the model we've discussed from the beginning. Currently, we view substantial potential in the land-and-expand model, as indicated by our dollar-based net retention rates, as well as opportunities to capture net new customers. We continue to see an increasing total addressable market from IDC and have successfully added new modules at a steady pace. We believe there is a great opportunity to pursue those new customers as well.

Operator, Operator

Thank you. And our next question comes from the line of Joel Fishbein with Truist.

Joel Fishbein, Analyst

Hi. Thanks for taking my question. George, you acquired Reposify, which focuses on external tax service management. Many customers spoke favorably about it at the Analyst Day and the user conference. I would love to hear your thoughts on its upcoming launch this year. Are there any early signs of interest, and how do you anticipate it will drive demand?

George Kurtz, President and Chief Executive Officer

Yes. We've seen tremendous interest since the acquisition. We announced that at Fal.Con. Customers are looking to understand their exposures externally. And as they move more and more to the cloud, a lot of their exposures are really configuration and policy-driven. So it's a fantastic add for us. It fits very nicely within our platform. It ties into what we're doing on the vulnerability management and risk side. And overall, we're really excited about it. And customers are not only looking at it for themselves, but also looking at it from a third-party risk perspective and leveraging it across their supply chain in terms of making sure that their suppliers are secure and not putting customers at risk. So, so far, very positive feedback and we're excited to get the product launched and bring it to market.

Operator, Operator

Thank you. And our next question comes from the line of Hamza Fodderwala with Morgan Stanley.

Hamza Fodderwala, Analyst

Hi. Good evening. Thanks for taking my question. George, a question for you. I think it's pretty clear that, the macro is going to impact pretty much every company, security not excluded from that. I'm curious how you're thinking about balancing sort of growth and profitability from here because on the one hand, clearly, growth has been slow for CrowdStrike and for everybody else. But on the other hand you've got this big market opportunity in front of you as an emerging consolidator in cybersecurity. Do you feel like this is a time to maybe continue to invest as maybe others are going to struggle more, they don't have that free cash flow generation that you do, or do you feel like this is a time to maybe show a little bit more leverage? Just curious, how you're thinking about that?

George Kurtz, President and Chief Executive Officer

Well, great question, Hamza. And it's always been a balanced growth approach, and it's never been a growth at all costs. And I think we've shown that with our performance and track record. And we continue to play the long game. But if you put things into perspective, we're a Rule of 83 last quarter. I mean, you think about the growth and the cash flow generation at scale at $2 billion plus ARR is pretty remarkable. We actually see this as a great opportunity for CrowdStrike as we go forward as smaller competitors fall by the wayside, as private companies look for exits we think it's a very attractive opportunity for us with our balance sheet, almost $2.5 billion in cash. And at the end of the day, as these macro trends evolve, we see a great opportunity for us now into the future to continue to consolidate customers as well as other technologies that might fit within our platform. So that's the way we look at it, balanced investment and, again, a focus on making sure that we're delivering cash flow for our shareholders.

Operator, Operator

Thank you. And our next question comes from the line of Andrew Nowinski with Wells Fargo.

Andrew Nowinski, Analyst

Great. Thank you for taking the question this afternoon. So total ARR of $2.3 billion, growing 54% is still absolutely amazing, I was – and it's at scale. But I was wondering, were you surprised that the net new logos that you added were down 9% this quarter?

Burt Podbere, Chief Financial Officer

Thanks, Andy. So when we think of the net new logos, it really corresponds to what we talked about in terms of what we saw in that SMB space. The SMB space is the one that drives the velocity of our net new logos. And as we talked about, we saw an 11% increase in our sales cycle in the SMB space. And that actually equated into $15 million in terms of deals in that space that could push out. And so when you think about 15 million in that space and what it means in terms of logos, where you can do the math, it's a pretty big number. So that's how we think about net new logos corresponding to what we saw in net new ARR from the SMB space. So from that perspective, we weren't surprised at the end of the day when we saw that what happened with respect to the increased sales cycles and the amount of money that got pushed out in the SMB space.

Operator, Operator

Thank you. And our next question comes from the line of Jonathan Ho with William Blair.

Maria Riley, Vice President of Investor Relations

Jonathan, are you there? Operator, maybe we can move to the next question.

Operator, Operator

Certainly. And our next question comes from the line of Matt Hedberg with RBC Capital Markets.

Matt Hedberg, Analyst

Thanks for taking my question. George, you've been in the security industry for quite some time. When you encounter macro headwinds like this, are there strategies from a sales standpoint that you can implement to accelerate cycles, such as engaging with customers earlier than usual? Are there any specific tactics you utilize during challenging times? Additionally, has there been any shift in the competitive landscape regarding the smaller segment of the business you operate in?

George Kurtz, President and Chief Executive Officer

Sure. Let me address the latter question first. We have seen our win rates increase in the down-market SMB space, indicating our continued success there. As Burt mentioned, deals from that segment have been delayed, which has affected us. However, we focus on what we can control, particularly execution. It’s important for us to stay ahead of the lengthy sales cycles typical in the enterprise sector, with all the necessary approvals and compliance checks. We ensure that all requirements are met to align deals with the normal sales cycle. This requires more effort and attention, and we continue to conduct thorough reviews of our pipeline, collaborating with both our internal sales teams and our extensive partner network. This has been our focus. As I mentioned earlier, I have experienced multiple sales and economic cycles in security, and I believe this presents a great long-term opportunity as we navigate through macro challenges.

Operator, Operator

Thank you. And our next question comes from the line of Tal Liani with Bank of America.

Tal Liani, Analyst

Hi. I hope for better news today after the win in soccer, but it's okay. We'll take what you have. I want to ask about budgets. So we're working off 2022 budgets now, and we see lengthening sales cycle in the low end of the market. The question is as we go into 2023 and the new budgets are set, which is around January, what's the risk that we're going to see similar behavior or larger companies work off budgets and are less sensitive to kind of quarterly fluctuations? And if you don't mind, just to touch on, no one asked about pricing and about quarter linearity, which are two important trends? Thanks.

George Kurtz, President and Chief Executive Officer

Yes. Sure. I'll take the first part of that. When we think about budgets, again, all the feedback that we've seen is that budgets are not in the enterprise getting cut. There's so many mandates around security. And just as customers move to the cloud, what they are looking to do, though, is optimize that spend and consolidate. So they may not be spending as much money with a whole bunch of vendors, and they're looking to consolidate with companies like CrowdStrike. We spent a lot of time on selling the value. And when we think about this, and we talked about this in the past, Tal, is the consolidation of agents. It's a huge pain point for customers, the complexity of the cost. So all the conversations that I'm having with CEO, all the way down, has been around how do we help consolidate the cost, because they're going to spend the money, they'd rather spend it with fewer vendors, and how do they get a better outcome. And that's, I think, where CrowdStrike shines. And in some cases, that may take a little extra work, because we're upsizing some deals, and we've got to go through more approvals and go through more of the value selling. But again, that's what we're focused on. So, obviously, we'll monitor the environment and see if there's any changes. But in all the conversations that I've had, security remains still top of mind and top of budget for enterprise customers.

Burt Podbere, Chief Financial Officer

I'll take the second part, Tal. First, regarding pricing, I can say a few things. We observed that discounting remained consistent with Q2, with no noticeable changes or excessive discounting on deals. Secondly, our average selling prices have stayed stable, which reinforces our overall strategy and value proposition. Additionally, enterprise sales cycles have lengthened slightly in Q2, with Q3 maintaining that trend. In terms of linearity, that’s how I approach your question. As for new annual recurring revenue, I discussed earlier how we anticipate facing headwinds of up to 10% as we move into Q4, reflecting some of the challenges we saw accelerate at the end of this quarter. That's our perspective on the matter.

Operator, Operator

Thank you. And our next question comes from the line of John DiFucci with Guggenheim.

John DiFucci, Analyst

Thanks for taking my question. You mentioned in the prepared remarks that large customers are pursuing multiphase subscriptions. Could you elaborate on that? How long do you anticipate the ramp-up period will be? Additionally, do you have commitments for the ramp phases of the deal or just verbal intentions?

Burt Podbere, Chief Financial Officer

Thanks, John. I'll address the second part of your question first. We do have signed commitments from those deals. When it comes to structure, we consider the phase start date in relation to the subscriptions, which informs our view on those multiphase deals. Based on patterns we've observed, we expect to see a consistency similar to what we experienced in Q3. Larger enterprise customers are likely to finalize these deals as they review their budgets and operating expenses. They may decide that activating the deal at a later date, possibly after the quarter ends, makes sense. The key takeaway from your question is that these deals are secured, as we observed in Q3, and we expect this to continue into Q4.

Operator, Operator

Thank you. And our next question comes from the line of Brad Zelnick with Deutsche Bank.

Brad Zelnick, Analyst

Well, great. Thank you so much for fitting me in, guys. Burt, your comment saying that you expect no budget flush this Q4 is like telling a kid Santa Claus isn't coming for Christmas. And I think you guys are the only ones explicitly saying this, and I'm guessing it's because you're being more prudent and maybe more transparent than others. But I'm also wondering how much of it is pipeline versus conversion rate assumptions that inform your perspective. And I guess, maybe asked a little bit differently, how is your forecast methodology adapting to the environment and the assumptions that you're inputting into it in Q4? Thanks.

Burt Podbere, Chief Financial Officer

Yeah. So really, I want to attack that question from the standpoint of – it starts from the fact that, we did see record pipeline again going into the quarter. So I think it goes back to what we've seen this quarter both on the SMB and in the enterprise space. I think we're going to see the consistent themes that the macro is driving. I think we're going to see the SMB space. We're going to see deals continue to be pushed out. And on the enterprise, we're going to see more multiphase deals. So that's how I think about the quarter. And I guess the one thing that I want to add is that it is important that we are continuing to drive top of the funnel. And we've got a lot of programs that are focused in on that, and it's just going to be one of those things that we have to just overcome the macro.

Operator, Operator

Thank you. And our next question comes from the line of Fatima Boolani with Citi.

Fatima Boolani, Analyst

Good afternoon. Thank you for taking my questions. Burt, to your prepared commentary around some of the flexibility that you're introducing with respect to contract negotiations, particularly on the invoicing front, wondering if you can share a little bit more detail with respect to how some of those engagements are becoming more flexible and sort of the implications on collections activity. I can appreciate you shared preliminary fiscal 2024 guidance with us on a number of those fronts, but just to get a little bit more detail as to how some of these changes in business activity behavior from customers is influencing how you're doing negotiations? And on a related matter, as the business does become more and more renewal, does some of the leverage in the model start coming from maybe changed incentives to your sales team around renewal business maybe getting a lower threshold of quota payment versus net new business, which is clearly becoming a little bit more challenging to do in this environment? Thank you.

Burt Podbere, Chief Financial Officer

Fatima, those are great questions. I'll address both. First, regarding structure, there are two key points. One is related to the enterprise deals and the staggered subscription start dates that will affect billings and cash flow. The second point is about the flexibility concerning payment due dates. We're collaborating with our customers to accommodate their budgets and timelines, and we've been adaptable in that regard, which will also impact cash flow. Nevertheless, I remain confident in our strong business model, and I see a promising opportunity based on what I mentioned earlier. From a cash flow perspective, we anticipate achieving a 30% free cash flow margin next year, highlighting the resilience of our business model. In the broader context, the structural changes we're implementing emphasize our partnership with customers, which was recognized during the initial onset of the pandemic and continues to be valued amid current macro challenges. We're enthusiastic about the prospects of working closely with our customers. Additionally, as our renewal business continues to grow, it's beneficial to note that the cost of generating net new ARR from existing clients is significantly lower than acquiring new clients. This provides us with leverage, indicating that we're in a strong position as I discuss our leverage potential for the coming year. Thank you for your questions.

Operator, Operator

Thank you. And our next question comes from the line of Alex Henderson with Needham & Company.

Alex Henderson, Analyst

Great. Thanks. I was hoping we could discuss the cloud segment of the market, focusing not just on your growth rate but on how companies are adjusting their transition to cloud workloads. In this context, what share do you believe you are gaining in the workloads that are migrating? Thanks.

George Kurtz, President and Chief Executive Officer

Yes. Thanks. Obviously, customers are going to flex what they put in the cloud, and sort of the cloud growth is what it is in terms of the macro cloud growth. In terms of what we see in our cloud workload protection, we continue to win in those areas. We win because we've got a combination of both workload protection as well as cloud security posture management and a full suite of protection capabilities. And we have more and more customers that continue to leverage our technologies as they migrate to the cloud. So they're still migrating to the cloud. They're leveraging our technologies as it's all integrated. And in terms of our cloud workload protection across the board, it's certainly been very, very strong. So that's what we've seen in our business. And obviously, there's a broader cloud theme in the environment, and customers are going to choose when and how they migrate. But we are there for them, and we continue to win in those environments.

Operator, Operator

Thank you. And our next question comes from the line of Roger Boyd with UBS.

Roger Boyd, Analyst

Great. Thanks for taking my questions. Burt, just to follow-up on multi-phase subscription start dates. I just want to unpack the behavior there a little bit. It sounds like it's mostly a cash flow consideration by customers, but are there any other factors driving this behavior, whether it's resource constraints, timing of road maps or just practice more care on aligning the end and start dates of third-party solutions being consolidated on the Falcon platform? And just a follow-up. I think you mentioned that these are confirmed deals. So I just want to make sure that that is showing up. Those deals are showing up in RPO. Thanks.

Burt Podbere, Chief Financial Officer

Yes, thanks, Roger. To address the first part of your question, the main factor is the operating expenses. They are planning to start their subscription dates at staggered intervals that make sense for them. They need to coordinate their resources accordingly and ensure they have the right people involved. The positive update for us is that these deals are confirmed and locked in. We have signed the agreements. Some may be deployed now, while others might follow later, and they will be included in the RPO calculations. Thank you for the question.

Operator, Operator

Thank you. And our next question comes from the line of Joe Gallo with Jefferies.

Joe Gallo, Analyst

Hey, guys. Really appreciate the question. George, appreciate your comments on F 3Q and 4Q macro. Based on your conversations with customers, what is their view on 2023 cyber budgets as they start to think about them? Are they expecting near-term alleviation with a quick Band-Aid rip-off, or is this more of a long-term new normal that we might see for the next year or so?

George Kurtz, President and Chief Executive Officer

We haven't had any customers indicate that their budgets will be cut next year. Instead, they're looking to consolidate and use their resources more effectively by working with fewer vendors to achieve better results. From my discussions with many customers and prospects worldwide, there hasn't been any feedback suggesting reduced spending on security for the coming year. They are moving to the cloud and adding new capabilities, and there are numerous compliance requirements emerging globally that will lead to increased spending. They want to maximize their investments in a consolidated manner, and so far, we haven't seen any signs that this trend will change.

Operator, Operator

Thank you. And that concludes our question-and-answer session. I would now like to turn the call back over to George Kurtz for any closing remarks.

George Kurtz, President and Chief Executive Officer

I wanted to thank all of you today for your time, and we certainly appreciate your interest and look forward to seeing you at our upcoming investor events. Thank you, and have a great day.

Operator, Operator

Ladies and gentlemen, this concludes today's conference call. Thank you for participating, and you may now disconnect.