The Tug of War Between Cybersecurity and Observability

In February 2021, CrowdStrike (CRWD) acquired Humio, a leader in cloud log management and observability services. At first glance, this didn’t seem to fit with Crowdstrike’s endpoint and cloud workload security platform. Then, just over a month later, Datadog (DDOG), a leading SaaS observability, monitoring, and analytics platform, acquired Sqreen, an application security management platform.

In other words, in the span of a month, we saw a leading cybersecurity company move into the observability space, and a leading observability company move further into the cybersecurity space.

More recently, Datadog announced an integration with Salesforce to provide Real User Monitoring (a core DDOG offering) and threat detection, a service strengthened by its Sqreen acquisition.

The respective acquisitions by CRWD and DDOG, along with Datadog’s recent announced integration with Salesforce, are evidence of an emerging trend in the SaaS landscape. We believe that observability and cybersecurity services will continue to merge into turnkey platforms, given the emergence of a distributed computing paradigm.

Turning to CRWD specifically, Humio’s ability to ingest and analyze both unstructured (e.g., text files, social media, satellite images) and semi-structured (i.e., tagged data not stored in a database) data broadens the scope of CrowdStrike’s value proposition to customers. It is estimated that 80%-90% of all data is unstructured, which is most effectively processed by artificial intelligence (AI) and machine learning (ML) models.

As a result, companies across industry verticals with leading AI/ML capabilities have an advantage in turning this data into actionable information for a better product and/or user experience. The quality of an AI algorithm is correlated to the amount of data used to train the program. All else being equal, the company with more data can develop better products through AI: exactly what CrowdStrike is executing on.

CrowdStrike’s leadership in endpoint and cloud workload protection is a direct result of its ability to process and analyze trillions of crowdsourced data points from across its customer base through its proprietary threat graph. Now, with the ability to process unstructured data alongside the structured data it was previously using for training, CrowdStrike continues to strengthen its core competitive advantage.

This is CrowdStrike pushing the flywheel so it spins faster: the more data it processes, the better its threat graph can detect and prevent attacks, the more customers will want to use the Falcon platform, the more data CrowdStrike collects. And so the cycle repeats.

In addition to the Humio acquisition adding to CrowdStrike’s data advantage, this move is another example of CrowdStrike finding ways to expand its TAM by expanding up and down the security stack.

CrowdStrike remains a core holding in the Titan Opportunities portfolio as the company continues to expand its runway for compounding capital at high rates of return. We are not making any changes to our CrowdStrike position at this time, as the company continues to demonstrate a superior ability to grow its top line and generate free cash flow. We believe CrowdStrike will continue to enhance its competitive advantage by investing in its superior product, developing new business lines, and expanding its addressable market: all resulting in, you guessed it, more data.