Nice article on Antivirus comp_老虎社区_美港股上老虎

2021-09-11

Nice article on Antivirus company

Why SentinelOne Is Better Than CrowdStrike<blockquote>为什么SentinelOne比CrowdStrike更好</blockquote>

免责声明：上述内容仅代表发帖人个人观点，不构成本平台的任何投资建议。

精彩评论

我们需要你的真知灼见来填补这片空白

发表看法

{"i18n":{"language":"zh_CN"},"detailType":1,"isChannel":false,"data":{"magic":2,"id":881368624,"tweetId":"881368624","gmtCreate":1631294936168,"gmtModify":1631888855044,"author":{"id":3577602781065384,"idStr":"3577602781065384","authorId":3577602781065384,"authorIdStr":"3577602781065384","name":"nameless927","avatar":"https://static.tigerbbs.com/ff218b44b2e07b129c0d4b2f98a1fcbb","vip":1,"userType":1,"introduction":"","boolIsFan":false,"boolIsHead":false,"crmLevel":12,"crmLevelSwitch":0,"individualDisplayBadges":[],"wearingBadges":[],"fanSize":1,"starInvestorFlag":false},"themes":[],"images":[],"coverImages":[],"title":"","extraTitle":"","html":"<html><head></head><body>Nice article on Antivirus company</body></html>","htmlText":"<html><head></head><body>Nice article on Antivirus company</body></html>","text":"Nice article on Antivirus company","highlighted":1,"essential":1,"paper":1,"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"link":"https://laohu8.com/post/881368624","repostId":1111681724,"repostType":2,"repost":{"id":"1111681724","kind":"news","pubTimestamp":1631244064,"share":"https://www.laohunote.com/m/news/1111681724?lang=zh_CN&edition=full","pubTime":"2021-09-10 11:21","market":"us","language":"en","title":"Why SentinelOne Is Better Than CrowdStrike<blockquote>为什么SentinelOne比CrowdStrike更好</blockquote>","url":"https://stock-news.laohu8.com/highlight/detail?id=1111681724","media":"Seeking Alpha","summary":"Summary\n\nSentinelOne is technically better than CrowdStrike according to the performance results of ","content":"Summary<blockquote>总结</blockquote> <ul> <li>SentinelOne is technically better than CrowdStrike according to the performance results of the MITRE ATT&amp;CK Evaluation.</li> <li>SentinelOne leverages a highly autonomous, out-the-box solution that's proving to deliver a more scalable business model than CrowdStrike’s – evident in 2Q22 results.</li> <li>SentinelOne has a significant last-mover advantage and is using it to target CrowdStrike's weak spots.</li> </ul> <img src=\"https://static.tigerbbs.com/e6e594ecb7b47299440e7129e25e25e1\" tg-width=\"1536\" tg-height=\"864\" referrerpolicy=\"no-referrer\">Sundry Photography/iStock Editorial via Getty Images<blockquote><ul><li>根据MITRE ATT&amp;CK评估的性能结果，SentinelOne在技术上优于CrowdStrike。</li><li>SentinelOne 利用了一种高度自主、开箱即用的解决方案，事实证明，这种解决方案比 CrowdStrike 的商业模式更具可扩展性--这一点在2022年第二季度的业绩中显而易见。</li><li>SentinelOne具有显着的后发优势，并正在利用它来瞄准CrowdStrike的弱点。</li></ul>杂项摄影/iStock 社论来自 Getty Images</blockquote> About this Report<blockquote>关于本报告</blockquote> Since its June 19 IPO, CrowdStrike's(NASDAQ:CRWD)market cap has soared sixfold as the company has experienced near triple-digit revenue growth thanks to its aggressive marketing of its highly effective and differentiated endpoint protection solution. Sentinel(NYSE:S)is the new kid on the block with even faster growth – more than doubling annual revenues YoY in 2Q22 [released after market close yesterday]. S also claims NGAV (Next-Gen Antivirus) superiority and goes head-to-head with CRWD in ultra-aggressive marketing.<blockquote>自 6 月 19 日 IPO 以来，CrowdStrike（纳斯达克股票代码：CRWD）的市值已飙升六倍，该公司凭借其高效且差异化的端点保护解决方案的积极营销，实现了近三位数的收入增长。Sentinel（纽约证券交易所股票代码：S）是该领域的新成员，增长速度更快——在2022年第二季度的年收入同比增长了一倍多（昨天收盘后发布）。S 还声称拥有 NGAV（下一代防病毒软件）优势，并在超激进的营销中与 CRWD 正面交锋。</blockquote> Given S’s sky-high valuation of 92x NTM EV/S at the time of writing, it's difficult to rationalize an investment - by pretty much all measures the stock is insanely overvalued. Therefore, this report is largely about outlining why we believe S is technically superior to CRWD, and if you as investors are convinced, then you can speculate on your own growth and stock price trajectories using CRWD’s recent history as an anchor. We provide some financials and multiples projections in the Valuation Considerations section toward the end of the report.<blockquote>在撰写本文时，S 的估值高达 92 倍 NTM EV/S，因此很难合理化投资--从几乎所有指标来看，该股的估值都被高估了。因此，本报告主要是概述为什么我们认为 S 在技术上优于 CRWD，如果您作为投资者对此深信不疑，那么您就可以以 CRWD 的近期历史为锚来推测自己的增长和股价轨迹。我们在报告末尾的估值注意事项部分提供了一些财务和倍数预测。</blockquote> We should make clear that any criticism of CRWD is in direct comparison to S. CRWD are still way better than legacy AV vendors – there's no denying that. And hopefully, this report may serve as somewhat of a framework for evaluating other EPP/EDR vendors that may catch your attention.<blockquote>我们应该明确一点，对CRWD的任何批评都是与s直接比较的。CRWD仍然比传统的AV供应商好得多——这是不可否认的。希望这份报告可以作为评估其他可能引起您注意的EPP/EDR供应商的框架。</blockquote> The Evolution of AV Industry<blockquote>影音产业的演变</blockquote> There are quite a few acronyms connected to the antivirus [AV] software industry to become familiar with before delving into what CRWD and S actually. The AV industry began life using signature databases followed by two decades of using signature databases with various tweaks. Then around 2011, EPP [Endpoint Protection] and EDR [Endpoint Detection &amp; Response] became popular, ushering in the era of NGAV [Next-Gen Antivirus]. XDR [Extended Detection and Response] is often referred to as the second wave of NGAV that correlates broader and disparate data sources to enhance the detection of threats, and improve investigation and responses. The following diagram - from SentinelOne with additional annotation by ourselves – provides a useful high-level view of where the AV industry has been and where it is today. We’ll elaborate on this diagram in the following sections.<blockquote>在深入研究CRWD和S到底是什么之前，有相当多的缩写与防病毒[AV]软件行业相关，需要熟悉。AV行业开始使用签名数据库，随后二十年来使用签名数据库进行了各种调整。然后在2011年左右，EPP【端点保护】和EDR【端点检测与响应】开始流行，迎来了NGAV【下一代杀毒软件】时代。XDR【扩展检测和响应】通常被称为NGAV的第二波，它关联了更广泛和不同的数据源，以增强威胁检测，并改善调查和响应。下图来自SentinelOne，我们自己做了额外的注释，提供了一个有用的高级视图，展示了AV行业的过去和现在。我们将在以下章节中详细阐述这一图表。</blockquote> Figure 1 - Evolution of the AV Industry<blockquote>图1-AV行业的演变</blockquote> <img src=\"https://static.tigerbbs.com/cbbf1db00601920823977504a2369bd4\" tg-width=\"640\" tg-height=\"387\" referrerpolicy=\"no-referrer\">Source: SentinelOne presentation, Convequity modification<blockquote>资料来源：SentinelOne演示文稿，对称性修改</blockquote> Signature-Based AV<blockquote>基于签名的AV</blockquote> In 1987, the late John McAfee released the first commercial AV [antivirus] software to be installed on desktops. It was a signature-based AV, which means it would check the signature of all inbound files to see if they matched a known malicious signature in the database. If there was a match then the AV would block and delete the file.<blockquote>1987年，已故的约翰·迈克菲发布了第一个安装在桌面上的商业AV【防病毒】软件。这是一个基于签名的AV，这意味着它会检查所有入站文件的签名，看看它们是否与数据库中已知的恶意签名相匹配。如果有匹配，AV将阻止并删除文件。</blockquote> Most cyber-attacks involve the hacker attempting to land a malicious file on a user’s device. The file contains a virus that, when triggered with a click by the user, installs itself onto the device. From there the virus can do various things, though usually, the main objective is to ascertain the device’s network connections and send itself to critical systems of an organization.<blockquote>大多数网络攻击都涉及黑客试图在用户设备上植入恶意文件。该文件包含一种病毒，当用户单击触发时，它会将自己安装到设备上。从那里，病毒可以做各种事情，但通常情况下，主要目标是确定设备的网络连接，并将自己发送到组织的关键系统。</blockquote> Every file has a unique signature that looks like a random combination of letters and numbers. The combination of letters and numbers is produced by a hashing algorithm. For example, a file containing only the text of “We built this city!” and the hashing was based on the SHA256 hash algorithm (one of the most secure and efficient hashes), the signature will be the following:<blockquote>每个文件都有一个独特的签名，看起来像是字母和数字的随机组合。字母和数字的组合是由散列算法产生的。例如，一个文件只包含“我们建造了这座城市!”的文字。并且哈希是基于SHA256哈希算法（最安全和最有效的哈希之一），签名将如下：</blockquote> c0fed07bbfcd9ea317d495d0c9b43021ac839f699cff44f3d3bf60993df66467<blockquote>c0fed07bbfcd9ea317d495d0c9b43021ac839f699cff44f3d3bf60993df66467</blockquote> The hashing algorithm converts a file with any amount of content to a fixed-length signature – in the case of the SHA256 hashing algorithm, it is 64 characters long, also known as 64 bytes because 1 character equals 1 byte.<blockquote>散列算法将包含任意数量内容的文件转换为固定长度的签名——在SHA256散列算法的情况下，它有64个字符长，也称为64字节，因为1个字符等于1字节。</blockquote> It’s also worth noting that changing 1 character or even flipping 1 bit [8 bits in 1 byte] from 0 to 1 or vice versa, will completely change the signature. Removing the exclamation mark so the text reads “We built this city” produces this 64-byte signature:<blockquote>还值得注意的是，更改 1 个字符，甚至将 1 位（1 字节中的 8 位）从 0 翻转到 1，反之亦然，都会彻底改变签名。去掉感叹号，使文本变成 “我们建造了这座城市”，就会产生这个 64 字节的签名：</blockquote> 1b12cb77bb08ac8c826795eab8389346b1f36c9f20b7841f7552d12c7fbf4c27<blockquote>1b12cb77bb08ac8c826795eab8389346b1f36c9f20b7841f7552d12c7fbf4c27</blockquote> Visit this website&nbsp;to hash your own input or alternatively you can get the hash for any file you upload.<blockquote>访问此网站来散列您自己的输入，或者您可以获得您上传的任何文件的散列。</blockquote> Throughout the 1990s it became apparent that signature-based AV had some fundamental shortcomings. Here are some of them:<blockquote>在整个20世纪90年代，基于签名的AV显然有一些根本性的缺点。以下是其中一些：</blockquote> <ul> <li>Cybercriminals can change one line of code to completely change the signature of the virus, and as a result, evade detection. This puts the hacker vs AV battle economics firmly in the favor of the former, because it takes a lot of time and computing resources to detect and confirm a new virus variant.</li> <li>As the number of malicious files grows, so does the signature database. The database resides on the endpoint so as it grows it consumes more disk space, more CPU, and more memory.</li> <li>Immediately after the AV is installed it becomes out of date because there's a continual creation of new viruses and variants of existing viruses. In essence, even the best signature-based AV provides &lt; 100% protection.</li> </ul> To compensate for the &lt; 100% protection, existing and new AV vendors came to the market with tweaks and variations of the signature-based model.<blockquote><ul><li>网络犯罪分子可以更改一行代码来彻底改变病毒的签名，从而逃避检测。这使得黑客与AV的战斗经济学坚定地有利于前者，因为检测和确认一种新的病毒变种需要大量的时间和计算资源。</li><li>随着恶意文件数量的增长，签名数据库也在增长。数据库驻留在端点上，因此随着它的增长，它会消耗更多的磁盘空间、更多的CPU和更多的内存。</li><li>AV安装后，它立即过时，因为新病毒和现有病毒的变种不断产生。本质上，即使是最好的基于签名的AV也提供&lt;100%的保护。</li></ul>为了弥补&lt;100%的保护，现有和新的AV供应商带着基于签名的模型的调整和变化进入市场。</blockquote> During the 1990s and 2000s, the early attempts to make up for the weaknesses of signature-based AV included:<blockquote>在20世纪90年代和21世纪初，弥补基于签名的AV弱点的早期尝试包括：</blockquote> <ul> <li>Firewall vendors such as Check Point Software(NASDAQ:CHKP), F5 Networks(NASDAQ:FFIV), and Fortinet(NASDAQ:FTNT)leveraged their dominant status within the corporate network to improve signature-based AV solutions. They used their deep packet inspection capabilities at the gateway of the network to inspect inbound data packets transmitting the malicious files as well as outbound connections triggered by the virus. This added more context to help sniff out the malicious inbound files and attempts to exfiltrate data.</li> <li>Bit9, founded in 2003, (later renamed Carbon Black and now acquired by VMware) introduced app whitelisting, whereby only authorized apps are allowed to run. This turned out to be highly restrictive and unproductive as apps change and upgrade rapidly.</li> <li>FireEye(NASDAQ:FEYE), founded in 2004, introduced sandboxing, whereby an unknown suspicious app or file would be executed in an isolated environment and monitored closely for any malicious activity. Although game-changing at the time, its effectiveness didn’t last long because hackers found ways to detect the sandbox environment to then trigger the virus into stealth mode and continue the attack at a later point in time.</li> </ul> Collectively, these attempts, while lacking sustainability, did an alright job at filling in the gaps, and generally speaking, provided adequate protection during the 1990s and 2000s.<blockquote><ul><li>Check Point Software（纳斯达克股票代码：CHKP）、F5 Networks（纳斯达克股票代码：FFIV）和 Fortinet（纳斯达克股票代码：FTNT）等防火墙供应商利用其在企业网络中的主导地位来改进基于签名的 AV 解决方案。他们使用网络网关的深度数据包检查功能来检查传输恶意文件的入站数据包以及病毒触发的出站连接。这增加了更多的上下文来帮助嗅出恶意入站文件和泄露数据的企图。</li><li>Bit9成立于2003年（后更名为Carbon Black，现已被VMware收购）引入了应用白名单，只允许授权应用运行。随着应用程序的快速变化和升级，这被证明是高度限制性和低效的。</li><li>FireEye（纳斯达克股票代码：FEYE）成立于2004年，推出了沙盒技术，通过沙盒技术，未知的可疑应用程序或文件将在隔离环境中执行，并密切监控任何恶意活动。虽然在当时改变了游戏规则，但它的有效性并没有持续多久，因为黑客找到了检测沙盒环境的方法，然后触发病毒进入隐形模式，并在以后的时间点继续攻击。</li></ul>总的来说，这些尝试虽然缺乏可持续性，但在填补空白方面做得很好，总的来说，在20世纪90年代和21世纪初提供了足够的保护。</blockquote> Things changed, however, at the dawn of the iPhone in 2007. As the attack surface expanded so did the attack cadence, and computing experienced an exponential rise in the variety of viruses and the signatures connected to those viruses. The number of forms in which a virus would reside pre-execution also proliferated – scripts (code)began appearing in website photos, PDF add-ons, Excel VBA, and many other forms, waiting to be triggered.<blockquote>然而，在2007年iPhone问世时，情况发生了变化。随着攻击面的扩大，攻击的节奏也随之扩大，计算经历了病毒种类和与这些病毒相关的特征的指数级上升。病毒在执行前驻留的形式数量也激增——脚本（代码）开始出现在网站照片、PDF附加组件、Excel VBA和许多其他形式中，等待被触发。</blockquote> On the whole, signature-based AV has proven not to scale very well and in the modern computing landscape does not provide adequate protection.<blockquote>总的来说，基于签名的AV已被证明不能很好地扩展，并且在现代计算环境中不能提供足够的保护。</blockquote> Next-Gen AV<blockquote>下一代AV</blockquote> From 2007 to 2013, a new wave of AV startups emerged with a novel approach to AV. Some Next-Gen AV [NGAV] startups focused on the EPP [Endpoint Protection] – still aiming to perform the prevention, detection, and response on the end-user device itself, but by using static AI techniques to obviate the need for a signature database. Other NGAV startups focused on the EDR [Endpoint Detection and Response] side - whereby most of the protection was delivered via the cloud and therefore the EPP software component could be lightweight and serve merely as a sensor rather than an agent that can perform the full requirements of AV.<blockquote>从2007年到2013年，新一波AV创业公司以一种新颖的AV方法出现。一些下一代AV【NGAV】初创公司专注于EPP【端点保护】——仍然旨在在最终用户设备本身上执行预防、检测和响应，但通过使用静态人工智能技术来避免对签名数据库的需求。其他NGAV初创公司专注于EDR【端点检测和响应】方面，其中大部分保护是通过云提供的，因此EPP软件组件可以是轻量级的，并且仅充当传感器，而不是可以执行AV全部要求的代理。</blockquote> There are pros and cons to singularly focusing on either EPP or EDR. EPP avoids the shortcomings of signature databases, however, by running static AI on the endpoint without the big picture from the cloud, it's less flexible and less effective over the long term. EDR maintains the complete global threat picture because it’s powered by the cloud, but the downside is the deluge of data is overwhelming for security analysts and leads to many false alerts.<blockquote>单独关注EPP或EDR有利有弊。EPP避免了签名数据库的缺点，然而，通过在端点上运行静态人工智能，而没有来自云的大局，从长远来看，它不太灵活，也不太有效。EDR 能提供完整的全球威胁情况，因为它是由云驱动的，但缺点是，大量数据让安全分析师不堪重负，并导致许多误报。</blockquote> As the shortcomings of EPP and EDR became increasingly apparent, NGAV vendors began to shift along the EPP/EDR spectrum to improve their products. The screenshot taken from S’s demo presentation summarizes the direction the vendors and the market moved from 2014 through to 2019.<blockquote>随着EPP和EDR的缺点变得越来越明显，NGAV供应商开始沿着EPP/EDR频谱转移以改进他们的产品。S 的演示演示截图总结了供应商和市场从 2014 年到 2019 年的发展方向。</blockquote> Figure2- Market Shifts: EPP vs EDR<blockquote>图 2- 市场变化：EPP 与 EDR</blockquote> <img src=\"https://static.tigerbbs.com/dd7cfc885dd56210dffb2212159d7ac3\" tg-width=\"505\" tg-height=\"280\" referrerpolicy=\"no-referrer\">Source: youtube.com<blockquote>来源：youtube.com</blockquote> XDR [Extended Detection &amp; Response], first coined by Nir Zuk of Palo Alto Networks(NYSE:PANW)in 2018, is now the latest technology that leading vendors are striving toward. It blends EPP and EDR together whilst also adding SOAR [Security Orchestration, Automation &amp; Response], SIEM [Security Information &amp; Event Management], and NTA [Network Traffic Analysis]. The objective of XDR is to collect and correlate data from endpoints, network points, servers, cloud workloads, and emails to enhance detection capabilities and improve protection whilst also increasing productivity and lowering the overall cost of security software ownership.<blockquote>XDR [扩展检测和响应] 由 Palo Alto Networks（纽约证券交易所股票代码：PANW）的 Nir Zuk 于 2018 年首次发明，现在是领先供应商正在努力发展的最新技术。它将EPP和EDR融合在一起，同时还添加了SOAR【安全编排、自动化和响应】、SIEM【安全信息和事件管理】和NTA【网络流量分析】。XDR的目标是收集和关联来自端点、网络点、服务器、云工作负载和电子邮件的数据，以增强检测能力和改善保护，同时提高生产力并降低安全软件拥有的总体成本。</blockquote> CrowdStrike Intro<blockquote>CrowdStrike 简介</blockquote> CRWD, founded in 2011, came to the market with EDR, which at the time was a radical approach to AV. Instead of destroying malicious files with AV software residing on the device, CRWD destroyed them from the cloud.<blockquote>CRWD成立于2011年，带着EDR进入市场，这在当时是AV的一种激进方法。CRWD没有用驻留在设备上的AV软件销毁恶意文件，而是从云中销毁了它们。</blockquote> They achieved this by having a super lightweight sensor with no database [consuming only 35 MB of storage space whereas signature-based AV can consume 4GB] installed on the endpoint. This sensor continually collects the logs (activities) related to the files on the device (i.e., what files are downloaded, open, from where, how, what time, what recent patches have been made?) and sends this telemetry data to the CRWD cloud. CRWD analysts collect this data from all CRWD devices and check it against a giant signature database in the cloud looking for matches in techniques. For example, the CRWD database contains a previous technique whereby opening a file from IP address 1.1.1.1 executed XXX.exe which was a piece of malware. As CRWD analysts recognize this technique being used again, they will block it, gather more intel, delete the file from the cloud, and share the insight across all endpoints.<blockquote>他们通过在端点上安装一个没有数据库的超轻传感器【仅消耗35 MB的存储空间，而基于签名的AV可以消耗4GB】来实现这一目标。该传感器不断收集与设备上文件相关的日志（活动）（即下载、打开了哪些文件，从哪里、如何、什么时候、最近制作了哪些补丁？）并将这些遥测数据发送到CRWD云。CRWD分析师从所有CRWD设备收集这些数据，并对照云中的巨大签名数据库进行检查，以寻找技术上的匹配。例如，CRWD数据库包含以前的技术，其中从IP地址1.1.1.1打开文件执行XXX.exe，这是一个恶意软件。当CRWD分析师意识到这种技术再次被使用时，他们将阻止它，收集更多情报，从云中删除文件，并在所有端点上共享洞察。</blockquote> However, it should be noted that while CRWD can detect a potential virus within seconds, it doesn’t complete its response and eliminate the threat until hours later. The complex nature of EDR delivers a high number of false alerts that need to be investigated by a client organization's analysts and CRWD's analysts alike. Therefore, CRWD does take considerably longer to completely eliminate the threat. However, they're able to contain the spread of the threat until a full investigation is complete. S, on the other hand, can detectandrespond within seconds thanks to its greater degree of automation and hybrid EPP/EDR approach.<blockquote>不过，需要注意的是，虽然 CRWD 可以在几秒钟内检测到潜在病毒，但它要到几个小时后才能完成响应并消除威胁。EDR的复杂性导致大量错误警报需要由客户组织的分析师和CRWD的分析师进行调查。因此，CRWD确实需要更长的时间来完全消除威胁。然而，他们能够控制威胁的传播，直到全面调查完成。另一方面，S可以检测和由于其更高程度的自动化和混合EPP/EDR方法，可在几秒钟内做出响应。</blockquote> The key benefit of this approach is that there are no constraints on the size of the database, as it’s located in a centralized cloud. Moreover, this EDR approach obviates the need to periodically push out software updates to the endpoints to include the latest signature database, again because the database is located in the cloud. The other benefit is that the aggregated threat hunting ensures new viruses and variants and attack methods are identified faster. In essence, this AV model makes the front-end software simple and light [collecting evidence] and makes the back-end operations complex, detailed, and shared across all devices - generating insights for all. The essence of EDR is to restrain from doing early prevention, and instead wait, observe, and collect more intel regarding the threats, and respond accordingly. And this approach inspired the name of CRWD’s flagship platform Falcon.<blockquote>这种方法的主要好处是，由于数据库位于集中式云中，因此对数据库的大小没有限制。此外，这种EDR方法避免了定期向端点推送软件更新以包括最新签名数据库的需要，这也是因为数据库位于云中。另一个好处是，聚合威胁搜索可以确保更快地识别新的病毒和变种以及攻击方法。从本质上讲，这种AV模型使前端软件变得简单轻便【收集证据】，并使后端操作变得复杂、详细，并在所有设备上共享——为所有人生成见解。EDR的本质是抑制早期预防，而是等待、观察和收集更多关于威胁的情报，并做出相应的反应。这种方法启发了 CRWD 旗舰平台 Falcon 的名字。</blockquote> SentinelOne Intro<blockquote>哨兵龙简介</blockquote> S, founded in 2013, is the youngest among established NGAV vendors, and this gives it a great last-mover advantage. Instead of heavily focusing on EDR or EPP, S has utilized them both to cover all major aspects of the endpoint security to deliver the so-called XDR. Similar to CRWD, S deploys a lightweight software agent with no database on the endpoint [200 MB of disk space]. It does more than CRWD’s sensor, however. It runs static AI to establish baseline file and device behavior in which to identify anomalous activity, relating to when the file was received and how long the file was open, for example. If the file passes the rigors of static AI analysis, the user is allowed to use the file but the agent will continue to monitor closely. The agent will apply a more dynamic AI to detect any suspicious lateral movement emanating from the file – e.g., when Word opened it triggered PowerShell to open, or a command is triggered to reach out to the Internet. At any point the agent determines there's malicious activity, it will kill the virus and clean up the environment. It's this level of autonomous capability in the EPP that differentiates S from other NGAV vendors.<blockquote>S 成立于 2013 年，是老牌 NGAV 供应商中最年轻的一家，这使其具有巨大的后发优势。S没有过分关注EDR或EPP，而是利用它们来涵盖端点安全的所有主要方面，以交付所谓的XDR。与CRWD类似，S在端点【200 MB磁盘空间】上部署了一个没有数据库的轻量级软件代理。不过，它的作用不仅仅是 CRWD 的传感器。它运行静态人工智能来建立基线文件和设备行为，其中识别异常活动，例如，与接收文件的时间和打开文件的时间有关。如果文件通过了严格的静态人工智能分析，用户可以使用该文件，但代理将继续密切监控。代理将应用更动态的人工智能来检测文件发出的任何可疑的横向移动——例如，当Word打开时，它会触发PowerShell打开，或者触发命令以访问互联网。在任何时候，代理确定有恶意活动，它将杀死病毒并清理环境。正是EPP中这种程度的自主能力使S区别于其他NGAV供应商。</blockquote> Despite the sophistication of such AI-powered detection methods, some types of malwares can still evade detection. Polymorphic malware variants change their own features, such as file names and hashes, to bypass detection methods. Techniques such as code obfuscation make malicious code hard to find and/or understand. Therefore, some threats manage to bypass the front-end, or EPP, defenses, necessitating the need for EDR.<blockquote>尽管这种人工智能驱动的检测方法很复杂，但某些类型的恶意软件仍然可以逃避检测。多态恶意软件变体改变它们自己的特征，如文件名和散列，以绕过检测方法。代码混淆等技术使得恶意代码难以找到和/或理解。因此，一些威胁设法绕过前端或EPP防御，需要EDR。</blockquote> Similar to CRWD, S utilizes back-end, or EDR, for deeper visibility threat hunting. The data collected is used by both S’s own analysts for global threat hunting,andits clients’ analysts working in Security Operation Centers [SOC]. On the EDR side, compared to CRWD the key differentiator is that S uses a \"story\" technique to add more context relevancy which leads to fewer alerts for analysts to handle. S have named this ‘story’ technique TrueContext ID.<blockquote>与CRWD类似，S利用后端或EDR来进行更深入的可见性威胁搜索。收集到的数据由两家公司自己的分析师用于全球威胁搜寻、和其客户在安全运营中心 [SOC] 工作的分析师。在EDR方面，与CRWD相比，关键的区别在于S使用“故事”技术来增加更多的上下文相关性，这导致分析师需要处理的警报更少。S将这种“故事”技术命名为TrueContext ID。</blockquote> Taken from an S demo presentation, the screenshot below compares TrueContext ID to previous context-building techniques - Indicators of Compromise [IOC] and Indicators of Attack [IOA] – and the more typical existing EDR solutions – Tactics, Techniques &amp; Procedures [TTP]. The slide uses the analogy of piecing together the description of a person to illustrate piecing together the description of a malicious action.<blockquote>下面的屏幕截图取自S演示，将TrueContext ID与以前的上下文构建技术（妥协指示器[IOC]和攻击指示器[IOA]）以及更典型的现有EDR解决方案（策略、技术和程序[TTP]）进行了比较。该幻灯片使用拼凑一个人的描述的类比来说明拼凑恶意行为的描述。</blockquote> Figure 3 - Comparing TrueContext ID to Typical EDR Methods<blockquote>图3-将TrueContext ID与典型的EDR方法进行比较</blockquote> <img src=\"https://static.tigerbbs.com/e1fe08039bb960fee41b415e31c6d06e\" tg-width=\"544\" tg-height=\"293\" referrerpolicy=\"no-referrer\">Source: youtube.com<blockquote>来源：youtube.com</blockquote> IOCs look like random descriptors that would need substantial effort to comprehend. IOAs are slightly more organized but still require effort to form the full picture. TTPs actually describe the bad action and offer useful context but don’t explain what happened before that led to the bad action. TrueContext ID takes it a whole level further by not just describing the traits of the bad action but also puts together a story of the events that led to the bad action – the DNA strand implies it knows everything about a given action.<blockquote>IOC看起来像随机描述符，需要付出巨大的努力才能理解。IOA稍微有条理，但仍然需要努力来形成全貌。TTP 实际上描述了不良行为，并提供了有用的背景资料，但没有解释导致不良行为发生之前发生的事情。TrueContext ID不仅描述了不良行为的特征，还整理了一个导致不良行为的事件故事——DNA链意味着它知道给定行为的一切。</blockquote> For example, there has been a connection made to an external FTP server [a server for transferring files] &gt;&gt;&gt; this links back to some registry files that were archived in a new hard drive location &gt;&gt;&gt; this links back to an unusual command-line execution in PowerShell &gt;&gt;&gt; it transpires that the opening of PowerShell was triggered by the opening of an Office document &gt;&gt;&gt; deeper analysis indicates the document contained a brand-new unknown virus &gt;&gt;&gt; did the user single or double click it or did it download automatically? &gt;&gt;&gt; where did it come from? &gt;&gt;&gt; did it come from an email or a USB drive? &gt;&gt;&gt; is the email address and source IP address associated with previous malicious activity? &gt;&gt;&gt; or, when was the USB drive inserted on the device?<blockquote>例如，已连接到外部FTP服务器[用于传输文件的服务器]&gt;&gt;&gt;这链接到存档在新硬盘位置的一些注册表文件&gt;&gt;&gt;这链接到PowerShell中不寻常的命令行执行&gt;&gt;&gt;原来PowerShell的打开是由Office文档的打开触发的&gt;&gt;&gt;更深入的分析表明该文档包含全新的未知病毒&gt;&gt;&gt;用户是单击还是双击，还是自动下载？&gt;&gt;&gt;它从哪里来？&gt;&gt;&gt;是来自电子邮件还是U盘？&gt;&gt;&gt;电子邮件地址和源IP地址是否与以前的恶意活动相关联？&gt;&gt;&gt;或者，USB驱动器是什么时候插入设备的？</blockquote> The above example shows a bad actor attempting to transfer a copy of the critical OS files [registry files], perhaps to learn more about the target organization in order to plan a devastating future attack, or something more imminent. TrueContext ID connects all the data points from the static and dynamic AI detection methods and synthesizes them with its own globally collated intelligence to string together a timeline of sequential events. And this is presented to SOC analysts either in tabular or graphical form. Putting together a chain of events like this ensures only relevant context is presented, which radically reduces the number of alerts and enables swift investigation and remediation.<blockquote>上面的例子显示了一个坏人试图传输关键操作系统文件【注册表文件】的副本，也许是为了更多地了解目标组织，以便计划毁灭性的未来攻击，或者更迫在眉睫的攻击。TrueContext ID连接来自静态和动态人工智能检测方法的所有数据点，并将它们与自己的全局整理的智能进行合成，以将顺序事件的时间线串在一起。并以表格或图形的形式呈现给SOC分析师。将这样的事件链放在一起可以确保只呈现相关的上下文，这从根本上减少了警报的数量，并支持快速调查和补救。</blockquote> CRWD investors and advocates may be somewhat confused as to why S’s storing techniques are a technical competitive advantage. Indeed, CRWD has an event timelining feature that is core to their EDR solution – they refer to it as \"maps.\" However, generally, a client organization’s SOC analysts need to be tier 2 or 3 certified for using CRWD’s Falcon EDR solution – one reason for this being the high number of false alerts that an analyst needs to navigate, which is far easier for the more experienced.<blockquote>CRWD 的投资者和倡导者可能有些困惑，为什么 S 的存储技术是一种技术竞争优势。事实上，CRWD 有一个事件时间表功能，这是他们 EDR 解决方案的核心——他们称之为“地图”。不过，一般来说，客户组织的 SOC 分析师需要通过 2 级或 3 级认证才能使用 CRWD 的 Falcon EDR 解决方案--其中一个原因是分析师需要处理大量的错误警报，而这对于更有经验的人来说要容易得多。</blockquote> If a client organization doesn’t have a SOC team and hence cannot conduct the threat investigation on CRWD and leverage its EDR component, then they can just run it and let it handle things by the default settings or use the MDR [Managed Detection &amp; Response] option whereupon CRWD experts will do the legwork. But when it comes to SOC operations, S’s storing technique appears to have an edge over CRWD because it radically reduces the alerts and false positives and, on the whole, makes life easier for SOC analysts.<blockquote>如果客户组织没有 SOC 团队，因此无法对 CRWD 进行威胁调查并利用其 EDR 组件，那么他们可以运行它，让它通过默认设置处理事情，或者使用 MDR [托管检测与响应] 选项，CRWD 专家将在此基础上进行跑腿工作。但在 SOC 操作方面，S 的存储技术似乎比 CRWD 更有优势，因为它从根本上减少了警报和误报，总体而言，让 SOC 分析师的工作更轻松。</blockquote> To summarize, S can deliver fully automated detection, response, and system recovery all within the EPP software itself, but also has the EDR-based TrueContext ID technology that can catch more sophisticated attacks and help SOC analysts triage with far fewer false positive alerts. With this in mind, it appears that S has the edge over CRWD on both the EPP and EDR sides of the market. Moreover, as we’ll show in the presentation of MITRE ATT&amp;CK performance results, S’s out-of-the-box solution that leverages greater automation is likely to offer greater scalability than CRWD’s. We think this greater scalability is shining through in the recent 2Q22 results whereby S generated 127% YoY growth.<blockquote>总而言之，S可以在EPP软件本身中提供全自动的检测、响应和系统恢复，但还具有基于EDR的TrueContext ID技术，可以捕捉更复杂的攻击，并帮助SOC分析师以更少的误报进行分类。考虑到这一点，S 似乎在 EPP 和 EDR 市场方面都比 CRWD 更有优势。此外，正如我们将在 MITRE ATT&amp;CK 绩效结果演示中展示的那样，S 的开箱即用的解决方案利用了更高的自动化程度，很可能比 CRWD 的解决方案具有更强的可扩展性。我们认为这种更大的可扩展性在最近的2022年第二季度业绩中得到了体现，S 实现了 127% 的同比增长。</blockquote> Key Differences Between S and CRWD<blockquote>S和CRWD之间的主要区别</blockquote> We’ve listed 11 aspects of endpoint protection whereupon S and CRWD differ by substantial margins. And it may seem overly biased [though we don’t have a position in S yet], but all 11 aspects are in favor of S outcompeting CRWD. We’ll elaborate on a few of these in the following sections.<blockquote>我们列出了端点保护的 11 个方面，S 和 CRWD 在这些方面存在很大差异。这可能看起来过于偏颇（尽管我们还没有在 S 中占据一席之地），但所有 11 个方面都有利于 S 超越 CRWD。我们将在以下章节中详细阐述其中的一些内容。</blockquote> <img src=\"https://static.tigerbbs.com/8e23001654d05cb1774d7adce7ed7e1c\" tg-width=\"573\" tg-height=\"253\" referrerpolicy=\"no-referrer\">Source: Convequity<blockquote>来源：Convequity</blockquote> Brains of Software<blockquote>软件大脑</blockquote> CRWD: As already alluded, the brain of CRWD is in the cloud only and utilizes EDR to understand the global landscape of threats. The very nature of this cloud-based EDR approach requires the computation of petabytes of data that quickly detects potential threats but also generates large numbers of false alerts. The notion of the false alert volumes necessitates the need for thorough investigation which is why the response time takes hours instead of seconds. Ultimately, CRWD’s approach is rather labour-intensive but is still more autonomous than legacy signature-based AV.<blockquote>CRWD：正如已经提到的，CRWD的大脑只在云中，并利用EDR来了解全球威胁格局。这种基于云的EDR方法的本质要求计算PB的数据，这些数据可以快速检测潜在的威胁，但也会产生大量的错误警报。错误警报量的概念需要进行彻底的调查，这就是为什么响应时间需要几个小时而不是几秒钟。归根结底，CRWD 的方法是劳动密集型的，但仍然比传统的基于签名的 AV 更加自主。</blockquote> S: The brain of S is in a hybrid form that utilizes both automation and AI in the front-end EPP and cloud-powered global intel in the back-end EDR, and blends the two harmoniously together. The storying technique applied in TrueContext ID radically reduces the number of alerts and the manual investigation for the EDR side of operations. So, as aforementioned, for the high majority of threats, this results in full automated response and recovery [system cleanup] within seconds, and results in relatively less manpower requirements [versus CRWD] for the more sophisticated attacks. Moreover, S can work offline and catch the majority of threats whereas CRWD must be connected online to work.<blockquote>S：S的大脑是一种混合形式，在前端EPP中利用自动化和AI，在后端EDR中利用云驱动的全球英特尔，并将两者和谐地融合在一起。TrueContext ID中应用的故事技术从根本上减少了EDR操作方面的警报和手动调查的数量。因此，如前所述，对于绝大多数威胁，这会在几秒钟内实现全自动响应和恢复【系统清理】，并且对于更复杂的攻击，所需的人力相对较少【与CRWD相比】。此外，S可以离线工作并捕捉大多数威胁，而CRWD必须在线连接才能工作。</blockquote> Operation of AV<blockquote>AV操作</blockquote> We’ve already touched on S’s software being highly autonomous while CRWD’s software requires human experts to be effective. This contrast offers an apt segue into taking a look at which approach is ultimately more effective. So, we’ll use this section to review the MITRE ATT&amp;CK endpoint protection test results.<blockquote>我们已经谈到了 S 的软件具有高度自主性，而 CRWD 的软件则需要人类专家才能发挥作用。这种对比为看看哪种方法最终更有效提供了一个恰当的切入点。因此，我们将使用本节来回顾 MITRE ATT&amp;CK 端点保护测试结果。</blockquote> MITRE is an independent, federally funded, not-for-profit R&amp;D organization that periodically performs attacks against leading security vendors’ software solutions. MITRE has long been the authority in cybersecurity testing, and in 2018, they launched the MITRE ATT&amp;CK Evaluations, where MITRE evaluates the efficacy of cybersecurity products. S, CRWD, and PANW participated in the series of tests (2019, 2020, and 2021) and we’ll present the two most recent.<blockquote>MITRE 是一家独立的、由联邦政府资助的非营利性研发机构，定期对领先的安全供应商的软件解决方案进行攻击。MITRE长期以来一直是网络安全测试的权威，2018年，他们推出了MITRE ATT&amp;CK评估，MITRE评估网络安全产品的功效。S、CRWD 和 PANW 参加了这一系列测试（2019 年、2020 年和 2021 年），我们将介绍最近的两项测试。</blockquote> In the MITRE ATT&amp;CK tests, vendors are assessed on how effective they are in stopping tactics and techniques. A Tactic is a bad actor’s objective – for example, to acquire a username and password, acquire remote control of the system, or exfiltrate data. A Technique is a method deployed to achieve the objective – for example, cross-site scripting [taking advantage of website vulnerabilities to lure victims into submitting their login details]. There are usually several techniques included in each tactic.<blockquote>在MITRE ATT&amp;CK测试中，评估供应商在阻止策略和技术方面的有效性。策略是不良行为者的目标--例如，获取用户名和密码、获取系统远程控制权或泄露数据。技术是为实现目标而部署的方法——例如，跨站点脚本【利用网站漏洞引诱受害者提交他们的登录信息】。每种战术通常都包含几种技术。</blockquote> Figure 4 - Tactics &amp; Techniques<blockquote>图4-战术和技术</blockquote> <img src=\"https://static.tigerbbs.com/22780f1dd68425ed1bd3bf6ea164e17d\" tg-width=\"640\" tg-height=\"251\" referrerpolicy=\"no-referrer\">Source: medium.com<blockquote>资料来源：medium.com</blockquote> Rather confusingly to the layman, MITRE presents the performance results in references to Steps and Substeps instead of Tactics and Techniques. So, for high-level knowledge purposes, Steps are closely associated with Tactics and Substeps are closely associated with Techniques. The following diagram from SentinelOne is useful to solidify the levels of detections.<blockquote>对于外行人来说，相当令人困惑的是，MITRE通过引用步骤和子步骤而不是战术和技术来呈现性能结果。因此，出于高级知识的目的，步骤与战术密切相关，子步骤与技术密切相关。SentinelOne的下图有助于巩固检测水平。</blockquote> Figure 5 - Analytic Detections: Tactics/Steps and Techniques/Substeps<blockquote>图5-分析检测：策略/步骤和技术/子步骤</blockquote> <img src=\"https://static.tigerbbs.com/1c271214a738c15e65d44d3a2fcf7800\" tg-width=\"640\" tg-height=\"272\" referrerpolicy=\"no-referrer\">Source: SentinelOne on YouTube, Convequity modification<blockquote>资料来源：YouTube 上的 SentinelOne，对流性修改</blockquote> The 2020 test results [based on techniques from APT29, a hacker group linked to Russian intelligence agencies] are shown below. The first chart shown shows that S led the pack in regards to overall detections, aka Substeps. The chart shows the number of detections out of the 135 Substeps for each vendor.<blockquote>2020年的测试结果【基于与俄罗斯情报机构有关联的黑客组织APT29的技术】如下所示。显示的第一张图表显示，S在整体检测（又称子步骤）方面处于领先地位。该图显示了每个供应商的135个子步骤中的检测数量。</blockquote> Figure 6 – MITRE ATT&amp;CK 2020 Performance Result: Total Detections<blockquote>图 6 – MITRE ATT&amp;CK 2020 性能结果：总检测量</blockquote> <img src=\"https://static.tigerbbs.com/f2e9e22cd5dadfe733a41b4d89f36776\" tg-width=\"541\" tg-height=\"384\" referrerpolicy=\"no-referrer\">Source: elastic.co/blog/<blockquote>来源：elastic.co/blog/</blockquote> The next two charts show the Tactic and Technique detections for the MITRE AV test. As a gentle reminder, Tactics are closely associated with Steps and Techniques are associated with Substeps.<blockquote>接下来的两个图表显示了MITRE AV测试的战术和技术检测。温和地提醒一下，战术与步骤密切相关，技术与子步骤相关联。</blockquote> Figure 7 - MITRE ATT&amp;CK 2020 Performance Result: Tactic and Technique Detections<blockquote>图 7 - MITRE ATT&amp;CK 2020 性能结果：战术和技术检测</blockquote> <img src=\"https://static.tigerbbs.com/d3c4d692af2713c6fe0b234c68a23cec\" tg-width=\"640\" tg-height=\"284\" referrerpolicy=\"no-referrer\">Source: elastic.co/blog/<blockquote>来源：elastic.co/blog/</blockquote> Observing that S had the best performance in Tactic detections and the second-best performance in Technique detections, aligns with the storing capability of TrueContext ID. A Tactic is a Step or objective, such as data exfiltration. A Technique is a Substep or method which is one of the Substeps required to achieve the Tactic, such as connecting to an external server in the exfiltration example. TrueContext ID has been designed to provide both high-level and granular detail of each attack, and therefore, it’s understandable as to why S has performed the best across Tactics and Techniques.<blockquote>观察到S在战术检测中具有最佳性能，在技术检测中具有第二好性能，这与TrueContext ID的存储能力一致。战术是一个步骤或目标，如数据泄露。技术是实现策略所需的子步骤之一的子步骤或方法，例如在渗透示例中连接到外部服务器。TrueContext ID 旨在提供每次攻击的高级细节，因此，S 在战术和技术方面表现最佳也就不足为奇了。</blockquote> Interestingly, the performance rankings in the following year [2021] are very similar. In the 2020 test, it looks like CRWD detected a total of c. 115 Substeps versus S’s c. 130. And in 2021 it looks like CRWD detected c. 150 versus S detecting c. 175. So, the ratio is very similar between the two rivals in both years.<blockquote>有趣的是，第二年【2021年】的业绩排名非常相似。在2020年的测试中，看起来CRWD总共检测到c。115个子步骤与S的c。130. 2021年，CRWD似乎检测到了c。150与S检测c。175. 因此，这两个竞争对手在这两年的比率非常相似。</blockquote> Figure 8 - MITRE ATT&amp;CK 2021 Performance Result: Total Detections<blockquote>图 8 - MITRE ATT&amp;CK 2021 性能结果：总检测量</blockquote> <img src=\"https://static.tigerbbs.com/9f3bfc1ecc4575acfb81df5fa624348e\" tg-width=\"640\" tg-height=\"320\" referrerpolicy=\"no-referrer\">Source: elastic.co/blog/<blockquote>来源：elastic.co/blog/</blockquote> It would be hard to dispute that S has a better performing AV than CRWD based on the results presented in the previous charts. Though what creates further distance between S and CRWD are the configuration changes made by the vendors before MITRE conducted its test – which we’ll cover next.<blockquote>根据前面图表中呈现的结果，很难否认S比CRWD具有更好的性能。不过，在 MITRE 进行测试之前，供应商对配置进行了更改，这一点我们将在下文中介绍。</blockquote> Deployment<blockquote>部署</blockquote> Much of S’s marketing outlines how their software works straight out-of-the-box. This is a common claim in competitive software markets, though in S’s case, it does appear to be largely true.<blockquote>S 的大部分营销内容都直接概述了他们的软件是如何开箱即用的。这是竞争激烈的软件市场中常见的说法，不过在 S 的案例中，这似乎在很大程度上是正确的。</blockquote> The next chart shows how many configurations changes each vendor made in preparation for the 2020 test. S didn’t change anything – their AV software was applied out-of-the-box. CRWD, on the other hand, made 25 tweaks to optimize their AV for the test. This fits in very well with the earlier discussion that CRWD is designed for enterprises with more experienced security analysts [SOC 2 and 3 analysts] – more on this later. These configuration changes also underscore what we’ve outlined in regards to S being way more automated than CRWD. CRWD’s lack of automation means it can’t work out-of-the-box with high effectiveness – the AV has been designed for heavy human involvement.<blockquote>下图显示了每个供应商为准备2020年测试所做的配置更改。S 并没有改变任何东西--他们的 AV 软件是开箱即用的。另一方面，CRWD进行了25次调整，以优化他们的AV进行测试。这与前面的讨论非常吻合，即CRWD是为拥有更有经验的安全分析师【SOC 2和3分析师】的企业设计的——稍后会详细介绍。这些配置变化也凸显了我们所概述的 S 比 CRWD 更加自动化。CRWD 缺乏自动化意味着它无法高效地开箱即用--AV 的设计需要大量人工参与。</blockquote> Figure 9 - MITRE ATT&amp;CK Configuration Changes for 2020 Test<blockquote>图 9 - 2020 年测试的 MITRE ATT&amp;CK 配置变化</blockquote> <img src=\"https://static.tigerbbs.com/f75663784c5d8c76b727e0d5c6fe33a2\" tg-width=\"640\" tg-height=\"336\" referrerpolicy=\"no-referrer\">Source: youtube.com<blockquote>来源：youtube.com</blockquote> So, despite CRWD making 25 tweaks to its AV software versus S’s zero tweaks, the market-leading endpoint protection provider still underperformed S by considerable margins in the MITRE test. And it’s worth reminding ourselves that S will have performed using AI and automation, whilst CRWD will have performed with heavy involvement from its own cloud-based SOC 2/3 analysts. Moreover, to add further context, this is the first test CRWD has participated in wherein it has performed acceptably well – previous tests by MITRE and NSS Labs yielded very poor results for CRWD. When you add these factors together, it really does open up a significant gap in the software capability between S and CRWD.<blockquote>因此，尽管 CRWD 对其 AV 软件进行了 25 次调整，而 S 只进行了 0 次调整，但这家市场领先的终端保护提供商在 MITRE 测试中的表现仍然远远逊于 S。值得提醒的是，S 将使用人工智能和自动化来执行任务，而 CRWD 将在其基于云的 SOC 2/3 分析师的大力参与下执行任务。此外，为了增加更多的背景，这是CRWD参与的第一次测试，它的表现可以接受——MITRE和NSS实验室之前的测试对CRWD产生了非常糟糕的结果。当你把这些因素加在一起时，它确实在S和CRWD之间的软件能力上打开了一个显著的差距。</blockquote> It’s also refreshing to note that PANW also chose not to make any changes, and they achieved a top four overall total detection performance and finished in the top half in the Tactic and Technique components of the test. We’ve reiterated for a long time now that Palo Alto Networks is simply the best at cybersecurity, and considering that endpoint protection isn’t even their core/original expertise, this is a huge testament to that.<blockquote>同样令人耳目一新的是，PANW 也选择不做任何改变，他们在测试的战术和技术部分取得了前四名的整体检测性能，并在测试的战术和技术部分进入了前半部分。我们早就重申，Palo Alto Networks 是网络安全领域的佼佼者，考虑到端点保护甚至不是他们的核心/原创专长，这充分证明了这一点。</blockquote> Expertise Requirements<blockquote>专业知识要求</blockquote> For SMBs that don’t have a SOC [Security Operations Centre], have relatively simpler security needs, and for some reason may be less of a hacker target, then deploying CRWD in its default settings shouldn’t be much of an issue and is way better than opting for legacy AV. Indeed, a simple deployment across an all-Windows organization is very simple. Alternatively, if an all-Windows SMB has more nuanced security needs but doesn’t have a SOC, then CRWD’s MDR [Managed Detection &amp; Response] service will be deployed and work smoothly with negligible issues. Expertise becomes a consideration in the case where an enterprise with its own SOC [and more complex requirements] and/or non-Windows operating systems (i.e., Linux and/or Mac) wants to install CRWD.<blockquote>对于没有 SOC（安全运营中心）、安全需求相对简单，而且由于某种原因可能不太可能成为黑客目标的中小型企业来说，在其默认设置下部署 CRWD 应该不会有太大问题，而且比选择传统 AV 要好得多。事实上，跨全Windows组织的简单部署非常简单。或者，如果全 Windows 中小型企业有更细致的安全需求，但没有 SOC，那么 CRWD 的 MDR [托管检测与响应] 服务将被部署并顺利运行，问题可以忽略不计。在拥有自己的SOC【和更复杂的要求】和/或非Windows操作系统（即Linux和/或Mac）的企业想要安装CRWD的情况下，专业知识成为一个考虑因素。</blockquote> As highlighted in the previous section, to maximize CRWD and protect against a full range of sophisticated attack techniques, substantial configuration tweaks are required. SOC 2 and 3 analysts will comfortably be able to handle this, however, SOC 1 and/or IT generalists will find it difficult and are likely to require assistance or make a mistake. Additionally, a higher-level of expertise is necessary to swiftly navigate through the barrage of alerts received with CRWD. Analysts need to coordinate Falcon with Splunk’s legacy SIEM to correlate data and gain the fullest threat landscape picture [this will eventually change, however, once they fully integrate the Humio acquisition]. Again, this requires a higher-level of expertise – SOC 2 or 3.<blockquote>正如上一节所强调的，为了最大限度地提高CRWD并抵御各种复杂的攻击技术，需要进行大量的配置调整。SOC 2和3分析师将能够轻松地处理这一点，但是，SOC 1和/或IT通才将发现这很困难，并可能需要帮助或犯错误。此外，需要更高水平的专业知识来快速浏览CRWD收到的大量警报。分析师需要将 Falcon 与 Splunk 的 legacy SIEM 进行协调，以关联数据并获得最全面的威胁景观[不过，一旦他们完全整合了对 Humio 的收购，这种情况最终会改变]。同样，这需要更高水平的专业知识——SOC 2或3。</blockquote> Then if you add in non-Windows OS, deployment complicates further. Yes, in the past 12 or so months CRWD has better adapted Falcon to Linux and Mac, though a high-level of expertise is required to ensure a smooth deployment following many years of incompatibility issues.<blockquote>然后，如果添加非Windows操作系统，部署会变得更加复杂。是的，在过去的12个月左右的时间里，CRWD已经使Falcon更好地适应了Linux和Mac，尽管在多年的不兼容问题之后，需要高水平的专业知识来确保顺利部署。</blockquote> So, because of the config changes and the multi-OS environments, typically SOC 2 or 3 analysts are required for the CRWD enterprise use case.<blockquote>因此，由于配置变化和多操作系统环境，CRWD企业用例通常需要SOC 2或3名分析师。</blockquote> In contrast, as evident in the MITRE test, S works right out of the box and hence IT generalists can get on fine with it. TrueContext ID - the storing feature - radically reduces the volume of alerts to enable more efficient threat hunting and remediation and hence making for a more user-friendly interface for SOC 1 and IT generalists to get along with. And, S has built its Singularity Platform with Windows, Linux, and Mac in mind right from the outset [a by-product of S’s last-mover advantage and taking more time in R&amp;D before pumping the GTM strategy], delivering feature parity across all platforms – which again, means lower expertise is required to complete a successful multi-OS environment.<blockquote>相比之下，正如在MITRE测试中显而易见的那样，S开箱即用，因此IT通才可以使用它。TrueContext ID——存储功能——从根本上减少了警报的数量，以实现更有效的威胁搜索和修复，从而为SOC 1和IT通才提供了一个更用户友好的界面。此外，S 从一开始就在 Windows、Linux 和 Mac 的基础上构建了奇点平台（这是 S 后发优势的副产品，也是在推行 GTM 战略之前花费更多时间进行研发的副产品），在所有平台上提供功能对等--这也意味着要完成一个成功的多操作系统环境，需要较低的专业知识。</blockquote> Target Market and Pricing<blockquote>目标市场和定价</blockquote> As previously mentioned, CRWD and S can be easily deployed for simple use cases associated with certain SMBs. Where we view S as having a notable larger target market is in the more complicated use cases associated with certain SMBs and enterprises. Taking into account the aforementioned expertise requirements, for complex use cases, S appears as the more attractive solution – by a wide margin. In using S over CRWD, SOC two and three analysts can work with more productivity, and SOC 1 and IT generalists can deploy and manage the software with little hassle. This opens up a wider TAM for S vs. CRWD.<blockquote>如前所述，CRWD和S可以很容易地部署到与某些SMB相关联的简单用例中。我们认为S具有明显更大的目标市场是在与某些中小型企业和企业相关的更复杂的用例中。考虑到前面提到的专业知识要求，对于复杂的用例，S似乎是更有吸引力的解决方案——优势很大。在使用 S over CRWD 时，SOC 2 和 3 位分析师可以更高效地工作，而 SOC 1 和 IT 通才可以轻松部署和管理软件。这为S与CRWD打开了更广阔的TAM。</blockquote> So, at the low-end of the market, comparing S and CRWD is trivial, because for simple use cases CRWD’s default settings are adequate. But CRWD is expensive. Our research on Reddit forums indicates that CRWD is 2x to 3x more expensive than S, and from this, we infer that CRWD is or will eventually price themselves out of the market segment in which they are most technically competitive.<blockquote>因此，在低端市场，比较 S 和 CRWD 是微不足道的，因为对于简单的使用情况，CRWD 的默认设置就足够了。但是CRWD很贵。我们在 Reddit 论坛上的研究表明，CRWD 比 S 贵 2 到 3 倍，由此我们推断 CRWD 正在或最终将把自己定价超出其技术竞争力最强的细分市场。</blockquote> CRWD maximizes the land-and-expand sales model as aggressively as any other software vendor. They sell the Falcon platform in modules; implementing a bare minimum number of modules in the beginning and then aggressively upselling/cross-selling other modules. Though many of the other modules are a necessity for full protection. Usually, most clients need to bundle together NGAV which is the Falcon Prevent module, EDR which is the Falcon Insight module, and device control which is the Falcon Device Control module. However, in pursuit of greater DBNR [Dollar-based Net Retention], CRWD separated device control into an independent module.<blockquote>CRWD像任何其他软件供应商一样积极地最大限度地利用土地和扩张销售模式。他们以模块形式销售猎鹰平台；在开始时实施最少数量的模块，然后积极追加销售/交叉销售其他模块。尽管许多其他模块是全面保护的必要条件。通常，大多数客户端需要捆绑NGAV（Falcon Prevent模块）、EDR（Falcon Insight模块）和Device Control（Falcon Device Control模块）。然而，为了追求更大的DBNR【基于美元的净保留率】，CRWD将设备控制分离成一个独立的模块。</blockquote> Figure 10 - CRWD's Falcon Platform Modules<blockquote>图 10 - CRWD 的猎鹰平台模块</blockquote> <img src=\"https://static.tigerbbs.com/c475e910dc1a094d382a08896b76d275\" tg-width=\"633\" tg-height=\"318\" referrerpolicy=\"no-referrer\">Source: CrowdStrike<blockquote>资料来源：CrowdStrike</blockquote> The combined pricing is well beyond the price quote from legacy AV vendors – which is absolutely fine given CRWD is better. Though, according to Reddit forum discussions, those clients that mentioned \"SentinelOne\" to CRWD salespeople immediately received a ~50% discount.<blockquote>综合定价远远超过了传统AV供应商的报价——考虑到CRWD更好，这绝对没问题。不过，根据Reddit论坛的讨论，那些向CRWD销售人员提到“SentinelOne”的客户立即获得了约50%的折扣。</blockquote> CRWD’s module-based land-and-expand ploys are most evident in the immediate quarters post-IPO. A cynical view, but reading between the lines it looks like a nice stock-based compensation booster was at play for the year-end of FY19.<blockquote>CRWD 基于模块的土地和扩张策略在 IPO 后的几个季度最为明显。这是一个愤世嫉俗的观点，但从字里行间来看，2019 财年年底似乎有一个不错的基于股票的薪酬助推器正在发挥作用。</blockquote> Figure 11 - CRWD's DBNR<blockquote>图11-CRWD的DBNR</blockquote> <img src=\"https://static.tigerbbs.com/6cc506dae651f32b97fc0affb3ce4111\" tg-width=\"598\" tg-height=\"240\" referrerpolicy=\"no-referrer\">Source: CrowdStrike<blockquote>资料来源：CrowdStrike</blockquote> In a clear attempt to differentiate and do things better than CRWD, S doesn’t sell individual modules. Instead, it sells its full Singularity Platform as bundles across three tiers – Core, Control, and Complete. It appears that on a like-for-like, S’s bundles are ~30% even after CRWD’s discounts.<blockquote>为了与 CRWD 区分开来，做得更好，S 不销售单个模块。相反，它将其完整的奇点平台作为三个层次的捆绑包出售——核心、控制和完整。即使在 CRWD 的折扣之后，S 的套餐似乎也有 30% 左右的折扣。</blockquote> Figure 12 - S's Singularity Platform Tiered Bundles<blockquote>图12-S的奇点平台分层包</blockquote> <img src=\"https://static.tigerbbs.com/5c77f334f8f81a839d3022612b73ead9\" tg-width=\"639\" tg-height=\"307\" referrerpolicy=\"no-referrer\">Source: SentinelOne<blockquote>来源：SentinelOne</blockquote> Insincere sales ploys like what CRWD has been doing only last for so long. Eventually, customers catch onto what is happening – evident by discussion on Reddit. And it feels like that day has already come, probably brought to the fore by S’s differentiated bundle pricing.<blockquote>像CRWD一直在做的不真诚的销售策略只会持续这么久。最终，客户明白了正在发生的事情——从Reddit上的讨论中可以明显看出。感觉这一天已经到来，可能是因为 S 的差异化捆绑定价。</blockquote> To summarize, CRWD effectively competes with S on a technical basis at the lower-end of the market involving simple use cases but they are risking pricing themselves out of the market. At the higher-end of the market involving complex use cases, it looks like S is both technically better and more affordable than CRWD. Additionally, S will store logs for a maximum of 365 days whilst CRWD’s max is 90 days. All of this strongly aligns itself with S’s founder and CEO Tomer Weingarten claiming that S wins 70% of head-to-heads with CRWD.<blockquote>总而言之，CRWD在涉及简单用例的市场低端技术基础上有效地与S竞争，但他们冒着将自己定价出市场的风险。在涉及复杂用例的高端市场中，S 似乎在技术上比 CRWD 更好，而且更实惠。此外，S 将最长存储日志 365 天，而 CRWD 的最长存储日志为 90 天。所有这些都与 S 的创始人兼首席执行官托默-温加滕（Tomer Weingarten）声称 S 在与 CRWD 的正面交锋中赢得了 70% 的胜利。</blockquote> In comparison to CRWD, not only will S’s technical superiority and competitiveness help it penetrate more of the TAM whilst also widening the TAM, being able to deploy in the cloud and on-prem further expands their customer reach vis-à-vis CRWD.<blockquote>与 CRWD 相比，will S 的技术优势和竞争力不仅有助于其在拓宽 TAM 的同时渗透到更多的 TAM，而且能够在云端和本地部署进一步扩大了他们相对于 CRWD 的客户覆盖范围。</blockquote> On the whole, S can target a broader market and based on its technical/performance superiority plus aggressive but transparent pricing, can outcompete CRWD in its own TAM.<blockquote>总体而言，S 可以瞄准更广阔的市场，并且基于其技术/性能优势加上积极但透明的定价，可以在自己的 TAM 中击败 CRWD。</blockquote> Architecture<blockquote>建筑</blockquote> Before we move onto valuation considerations, we’ll briefly share our views and CRWD’s and S’s software architecture. In all honesty, we can’t find much information related to who has the more modern architecture, but you’ve probably guessed already that we think S has the edge here. The cadence in which both vendors release new features and modules is testament that both operate within advanced microservice architectures. However, we assume, that as CRWD partners with a legacy vendor like Splunk for SIEM and log management, its architecture is probably semi-dated and that there has been an absence of major revamp in recent years. This line of thinking could be kind of validated by the number of years it’s taken for CRWD to overhaul its Mac and Linux sensors.<blockquote>在讨论估值问题之前，我们将简要分享我们的观点以及 CRWD 和 S 的软件架构。老实说，我们找不到太多关于谁拥有更现代的架构的信息，但你可能已经猜到了，我们认为 S 在这方面更有优势。两家供应商发布新功能和模块的节奏证明了两家供应商都在先进的微服务架构中运行。然而，我们假设，由于CRWD与Splunk这样的传统供应商合作进行SIEM和日志管理，其架构可能已经过时，并且近年来没有进行重大改造。CRWD 大修其 Mac 和 Linux 传感器所用的年数可以在某种程度上验证这种思路。</blockquote> It’s interesting how in March 2021 CRWD bought Humio for $392m in cash and equity just one month after S bought Scalyr for $155m in cash and equity. This may be reading into things too much, but some may view it as a sign of desperation to shore up an aging architecture and move away from legacy SPLK.<blockquote>有趣的是，2021 年 3 月，CRWD 以 3.92 亿美元的现金和股权收购了 Humio，而就在一个月前，S 以 1.55 亿美元的现金和股权收购了 Scalyr。这可能读得太多了，但有些人可能会认为这是支撑老化架构和摆脱传统SPLK的绝望迹象。</blockquote> Any differences in the modernity of the two NGAV architectures will very likely widen in the coming quarters and years. CRWD is only 14 months older than S, but because it grew early and superfast, it will have accumulated way more technical debt. And issues that come with technical debt will only be amplified as a $60bn company like CRWD needs to continue aggressively expanding its TAM via acquisitions in order to keep the mega growth story alive.<blockquote>两个NGAV架构的现代性差异很可能会在未来几个季度和几年内扩大。CRWD 只比 S 大 14 个月，但由于它成长得早且速度超快，它将积累更多的技术债务。随着像 CRWD 这样价值 600 亿美元的公司需要继续通过收购积极扩大其 TAM，以保持巨大的增长故事，技术债务带来的问题只会被放大。</blockquote> As all software firms grow, they lose their nimbleness but it will happen a lot sooner to CRWD than it will to S - and this gives another upper hand to S in years to come.<blockquote>随着所有软件公司的发展，它们都会失去灵活性，但这种情况发生在CRWD身上的速度会比S身上的速度快得多——这使得S在未来几年又占据了上风。</blockquote> S’s Edge Summary<blockquote>S’s Edge总结</blockquote> At a high level, the key competitive advantages S has over CRWD can be summarized into four fundamental drivers:<blockquote>在高层次上，S相对于CRWD的主要竞争优势可以概括为四个基本驱动因素：</blockquote> <ul> <li>Better product effectiveness.</li> <li>Better user experience.</li> <li>Better pricing.</li> <li>A more scalable business model afforded by a highly automated out-the-box solution.</li> </ul> Valuation Considerations<blockquote><ul><li>更好的产品效果。</li><li>更好的用户体验。</li><li>更优惠的价格。</li><li>高度自动化的开箱即用解决方案提供的更具可扩展性的商业模式。</li></ul>估值考虑因素</blockquote> S’s IPO, on June 30, was the highest-valued cybersecurity IPO ever. The stock finished its IPO day 21% up, closing at $42.50/share with a LTM EV/S of 100x. At the time of writing the stock is trading at $68/share with a LTM EV/S of 163x and a NTM EV/S of 92x.<blockquote>S 于 6 月 30 日进行的首次公开募股是有史以来估值最高的网络安全首次公开募股。该股在 IPO 当天上涨 21%，收于每股 42.50 美元，LTM EV/S 为 100 倍。截至撰写本文时，该股交易价格为每股 68 美元，LTM EV/S 为 163 倍，NTM EV/S 为 92 倍。</blockquote> Below are some projections going out to FY26. FY22 revenue is anchored to management’s guidance. In the 2Q22 earnings presentation released yesterday, management also gave long-term targets that included a mature gross margin of 75%-80%, hence why we’ve made it so gross margin is 78% in FY26. We’ve used CRWD’s current TTM FCF margin as a rough long-term estimate of S’s in FY26.<blockquote>以下是对 26 财年的一些预测。22 财年的收入以管理层的指导为基础。在昨天发布的2022年第二季度财报中，管理层还给出了长期目标，其中包括 75%-80% 的成熟毛利率，这也是我们将 26 财年毛利率定为 78% 的原因。我们使用 CRWD 目前的 TTM FCF 利润率作为 26 财年 S 的粗略长期估计。</blockquote> Guessing the multiple declines is kind of an unchartered territory because of the unprecedented level and sustainability of multiples we’re witnessing in the COVID-era market. Some may argue a decline to a 53x EV/S by FY26 is not steep enough, and that might be right. Though in FY26 we expect revenue to be at similar levels to CRWD’s today and CRWD is currently trading at 56x EV/S. Of course, no macro assessment is being taken into account so please take this exercise with a pinch of salt.<blockquote>猜测倍数的下降是一个未知领域，因为我们在 COVID 时代的市场上看到了前所未有的倍数水平和可持续性。有些人可能会认为，到 26 财年电动汽车/秒降至 53 倍还不够，这可能是正确的。不过，我们预计 26 财年的收入将与 CRWD 目前的收入水平相似，而 CRWD 目前的交易价格为 56 倍 EV/s。当然，没有宏观评估被考虑在内，所以请对这个练习持保留态度。</blockquote> Figure 13 - Financials &amp; Multiples Projections<blockquote>图 13 - 财务数据和多重预测</blockquote> <img src=\"https://static.tigerbbs.com/b47610548d3c3dd40fbf6fc5d8c66a60\" tg-width=\"640\" tg-height=\"281\" referrerpolicy=\"no-referrer\">Source: Convequity<blockquote>来源：Convequity</blockquote> In the 4.5 years from today to the end of FY26 [fiscal year end 31stJan], if the EV reaches $68bn then S’s stock will deliver a 36% annualized return. So, yes the multiples are insanely high but because of the extreme growth that will presumably remain high for a few years, even a sharp decline in multiples can still deliver sufficient investor returns.<blockquote>从今天起到 26 财年结束（1 月 31 日财年结束）的 4.5 年里，如果电动汽车达到 680 亿美元，那么 S 的股票年化回报率将达到 36%。因此，是的，市盈率高得惊人，但由于极端增长可能会在几年内保持高位，即使市盈率急剧下降，仍然可以为投资者带来足够的回报。</blockquote> CRWD’s LTM EV/S at the close of its IPO day [6thJune 2019] was 47x and it has peaked at c. 70x in Aug-19 and Feb-21. This highlights the richness in S’s current valuation. However, is S still worth an investment at the present time? Well, investors need to be aware of the melt-up and melt-down that has often occurred with high-growth tech IPOs, especially during the past 12-18 months. S could very well follow a similar path and climb much higher before falling down once the lockup period ends [27thDecember, 2021] and early investors can cash in some of their profits. Investors should also note that S employees are allowed to sell 15% of their shares as of 6thOctober 2021. For readers’ information, S’s number of shares in float to number of shares outstanding is just 17% - in contrast, a post lockup stock like CRWD has 86% in float.<blockquote>CRWD 在 IPO 当天（2019 年 6 月 6 日）结束时的 LTM EV/S 为 47 倍，并在 c.8月19日和2月21日70倍。这凸显了 S 目前估值的丰富性。然而，目前S还值得投资吗？好吧，投资者需要意识到高增长科技IPO经常发生的融化和融化，尤其是在过去12-18个月。一旦锁定期结束[2021年12月27日]，S很可能会遵循类似的路径，在下跌之前攀升得更高，早期投资者可以兑现部分利润。投资者还应注意，自 2021 年 10 月 6 日起，S 员工可以出售 15% 的股份。供读者参考，S 的流通股数量与流通股数量之比仅为 17%，相比之下，像 CRWD 这样的解禁后股票的流通股数量为 86%。</blockquote> Therefore, high-risk tolerant and/or short-term investors may want to consider a long position right now. Longer-term investors may prefer to let the liquidation unravel post Oct-21 and then post Dec-21 before buying shares. A compromise may be to buy a fourth of a position today and opportunistically add to it in the future. Personally, we’re waiting for a correction before opening a position. If the stock corrects c. 25% we’ll probably add half of the total planned allocation and then wait to see what happens after the lockup.<blockquote>因此，高风险承受能力和/或短期投资者现在可能需要考虑多头头寸。长期投资者可能更愿意让清算在 10 月 21 日之后解除，然后在 12 月 21 日之后解除，然后再购买股票。妥协可能是今天买入四分之一的头寸，并在未来机会主义地增加头寸。就我个人而言，我们正在等待回调后再开仓。如果股票修正c。25% 我们可能会增加计划拨款总额的一半，然后拭目以待，看看锁定后会发生什么。</blockquote> At first glance S’s extremely negative operating and FCF margins are alarming, but what investors should bear in mind is that S has the edge in technical and performance superiority and therefore they need to capitalize on this edge in the fastest way possible. CRWD is just 14 months older than S but has over 7x more ARR [Annual Recurring Revenue], which illuminates the differences in market approach. CRWD hit the market early and aggressively whilst S spent many years with their primary focus in R&amp;D before focusing on sales and marketing [S&amp;M]. Now S has a refined and market-leading product they need to maximize the GTM strategy as much as they can and catch up the market leader.<blockquote>乍一看，S 公司极其负面的营业利润率和自由现金流利润率令人担忧，但投资者应该记住的是，S 公司在技术和性能优势方面拥有优势，因此他们需要以最快的速度利用这一优势。CRWD 仅比 S 大 14 个月，但 ARR（年度经常性收入）却是 7 倍多，这说明了市场方法的差异。CRWD很早就积极地进入市场，而S在专注于销售和营销【S&amp;M】之前，花了很多年的时间主要关注R&amp;D。现在，S 拥有精致且市场领先的产品，他们需要尽可能最大限度地发挥 GTM 战略，并赶上市场领导者。</blockquote> Figure 14 - 1Q22 Margins<blockquote>图 14 - 2022年第一季度边际</blockquote> <img src=\"https://static.tigerbbs.com/f13e4a5a906b763afaa3476b59045597\" tg-width=\"187\" tg-height=\"81\" referrerpolicy=\"no-referrer\"><blockquote></blockquote> The current gross margin doesn’t exactly indicate a profitable long-term business model. However, investors should bear in mind that S’s competitiveness, especially in offering 365-day log storage, is a big suppressant at the moment. When S captures a larger share of the market, builds a solid reputation, and fully integrates Scalyr’s novel way of ingesting and storing log data, S can command a greater premium and simultaneously lower cost of revenue, and hence gross margin will rise accordingly. Interestingly, 2Q22 gross margin has already jumped c. 800 basis points since 1Q22, and no doubt the integration of Scalyr will have contributed to this. Throw into the mix that S will more than likely follow CRWD in shifting from cloud to colocation infrastructure once they reach a certain scale, the mature end-state gross margin for S will be close to 80%, in our opinion.<blockquote>目前的毛利率并不能完全表明长期商业模式是盈利的。不过，投资者应该记住，S 的竞争力，尤其是在提供 365 天日志存储方面，目前是一个很大的抑制因素。当 S 占据更大的市场份额，建立稳固的声誉，并完全整合 Scalyr 摄取和存储日志数据的新颖方式时，S 就能获得更高的溢价，同时降低收入成本，因此毛利率也会相应上升。有趣的是，2022年第二季度的毛利率已经跃升了c。自2022年第一季度以来 800 个基点，毫无疑问，Scalyr 的整合将对此做出贡献。我们认为，一旦达到一定规模，S 很可能会跟随 CRWD 从云转向主机托管基础设施，S 的成熟最终状态毛利率将接近 80%。</blockquote> Irrespective of the trading tactics, we think S has a strong chance to prove to be a good investment, even at the current multiple levels. We’ll list the pros to consider:<blockquote>无论交易策略如何，我们认为 S 有很大的机会被证明是一项良好的投资，即使在当前的多个水平上也是如此。我们将列出值得考虑的优点：</blockquote> <ul> <li>Currently, S has very low penetration - FY21 [fiscal year ending 31stJan] generated $93m of revenue and $161m of ARR [Apr-21] - in a market estimated to be worth between $20bn and $30bn by 2025.</li> <li>Similar to what CRWD has done, S will acquire more talent, expand its product’s capabilities, and expand into new markets - the IPO proceeds will go toward these objectives. This will expand an already large TAM for S.</li> <li>As we’ve presented in this report, S is the technical leader in the endpoint protection market. Technical leadership combined with mega aggressive S&amp;M expenditure [110% of revenue vs CRWD’s IPO year of 69% of revenue] will very likely be highly effective.</li> <li>Given the relatively low revenue base ($93m for FY21) and the autonomous, out-the-box nature of S’s AV, we would not be surprised if they regularly exceeded analyst consensus growth expectations (91% for FY22). From c. $100m in FY18, CRWD has grown c. 100% and this is with an AV solution that needs to be customized for many customers. Therefore, NTM growth of 100% is more probable than not, in our opinion – especially, with the S&amp;M aggressiveness.</li> </ul> Of course, stocks such as S pose substantial risks for investors, so we’ll outline some of the cons to consider:<blockquote><ul><li>目前，S 的渗透率非常低 - 2021 财年（截至 1 月 31 日的财年）产生了 9300 万美元的收入和 1.61 亿美元的 ARR [4 月 21 日] - 预计到 2025 年市场价值将在 200 亿至 300 亿美元之间。</li><li>与 CRWD 所做的类似，S 将获得更多的人才，扩大其产品功能，并拓展新市场--首次公开募股的收益将用于这些目标。这将扩展S已经很大的TAM。</li><li>正如我们在本报告中所介绍的，S 是终端保护市场的技术领导者。技术领先地位加上巨额的科技支出（占收入的 110%，而 CRWD 在 IPO 当年占收入的 69%）很可能会非常有效。</li><li>鉴于 S's AV 的收入基础相对较低（21 财年为 9300 万美元），以及其自主、开箱即用的特性，如果它们经常超过分析师一致的增长预期（22 财年为 91%），我们也不会感到惊讶。从c。2018 财年 1 亿美元，CRWD 增长了 c。100%，这是一个需要为许多客户定制的AV解决方案。因此，在我们看来，NTM 100% 的增长更有可能——尤其是在 S&amp;M 的进攻性下。</li></ul>当然，像 S 这样的股票会给投资者带来很大的风险，因此我们将概述一些需要考虑的缺点：</blockquote> <ul> <li>S is a company with fast-growing revenue but also growing losses. EBIT margin for FY20 and FY21 was -161% and -124%. FCF margin for FY20 and FY21 was -102% and -78%. So, it’s clear that cash flows in any DCF valuation are far into the future which makes the stock very vulnerable to changes in inflation and interest rate expectations – which is happening with frequency at present.</li> <li>Given the large losses, all of the stock’s future trajectory is dependent on the company beating revenue growth expectations. Consequently, any quarterly revenue misses will have a severe impact on the share price and it could take the stock a long time to recover.</li> <li>S’s technical superiority might not be insurmountable – we believe it's the best but groundbreaking is a stretch too far. Endpoint protection is a highly competitive market abundant with innovation, so it’s a possibility S could eventually lose a degree of its product leadership.</li> <li>CRWD may up the ante with ‘smoke and mirrors’ tactics and even more aggressive S&amp;M that specifically aims tolegallydefame S.</li> </ul> There are certainly a few pros and cons to consider. In our opinion, the optimal approach to gaining exposure to S is to1) wait for a correction,2) open a ¼, a 1/3, or a ½ of the total eventual position subject to the magnitude of the correction,3) add during risk-off episodes during the next several months, and4) leave some capital spare to buy some more after the effects of the lockup expiry have been fully reflected.<blockquote><ul><li>S是一家收入快速增长但亏损也在不断增长的公司。2020财年和2021财年的息税前利润率分别为-161%和-124%。2020财年和2021财年的自由现金流利润率分别为-102%和-78%。因此，很明显，任何 DCF 估值中的现金流都是未来很长一段时间的，这使得股票非常容易受到通胀和利率预期变化的影响--而这种情况目前经常发生。</li><li>鉴于巨额亏损，该股未来的所有发展轨迹都取决于公司能否超出收入增长预期。因此，任何季度收入未达预期都会对股价产生严重影响，并且该股可能需要很长时间才能恢复。</li><li>S 的技术优势可能并非不可逾越--我们相信它是最好的，但开创性还远远不够。终端保护是一个竞争激烈的市场，充满了创新，因此 S 最终有可能失去一定程度的产品领先地位。</li><li>CRWD 可能会加大赌注，采取 “烟雾和镜子 ”战术，甚至采取更激进的 S&amp;M，专门针对合法地诽谤S。</li></ul>当然有一些利弊需要考虑。我们认为，获得S风险敞口的最佳方法是1)等待修正，2)根据校正的大小，打开总最终头寸的1/4、1/3或1/2，3）在未来几个月的风险释放期间添加，以及4) 留出一些闲置资金，待禁售期到期的影响充分体现后再买入一些。</blockquote> The conundrum, as is with all pioneering software stocks, is that investors are usually forced to pay a hefty premium in order to participate in future price appreciation. This is because these types of stocks have a tendency to remain elevated for a long time. However, on the flip-side, S has not yet made it in the Global MSCI indices, therefore, bouts of risk-off sentiment have the potential to knock down the share price considerably more than stocks such as Cloudflare(NYSE:NET), Okta(NASDAQ:OKTA), Twilio(NYSE:TWLO), and Palantir(NYSE:PLTR). With this in mind, opportunities to buy big dips are likely but sustained elevated multiples and/or multiple expansion is also a strong possibility. Hence, the optimal approach, in our opinion, is to add a fraction after a correction [or even now for the highly risk-tolerant] and complete the position in the months ahead.<blockquote>与所有先锋软件股票一样，难题在于投资者通常被迫支付高额溢价才能参与未来的价格上涨。这是因为这些类型的股票往往会长期保持高位。然而，另一方面，S 尚未进入全球 MSCI 指数，因此，与 Cloudflare（纽约证券交易所股票代码：NET）、Okta（纳斯达克股票代码：OKTA）、Twilio（纽约证券交易所股票代码：TWLO）和 Palantir（纽约证券交易所股票代码：PLTR）。考虑到这一点，买入大幅下跌的机会是可能的，但持续升高的倍数和/或倍数扩张也是一个很大的可能性。因此，我们认为，最佳方法是在修正后增加一部分（甚至现在对于高度风险承受能力的人来说），并在未来几个月内完成头寸。</blockquote> Conclusion<blockquote>结论</blockquote> This report was not intended to bash CRWD’s technology because obviously it's extremely sophisticated and great at stopping threats. However, comparing to CRWD does highlight a degree of superiority in S’s approach to AV. And most importantly, from an investment perspective, S’s out-of-the-box solution certainly makes its business appear more scalable than CRWD. And this is exciting when considering CRWD’s super growth in spite of each deployment requiring a good dose of configuration tweaking and training.<blockquote>本报告无意抨击 CRWD 的技术，因为显然它极其复杂，在阻止威胁方面非常出色。不过，与 CRWD 相比，S 的 AV 方法确实具有一定程度的优越性。最重要的是，从投资的角度来看，S 的开箱即用的解决方案无疑使其业务显得比 CRWD 更具可扩展性。考虑到 CRWD 的超级增长，这令人兴奋，尽管每次部署都需要大量的配置调整和培训。</blockquote> The valuation is mega rich but investors need to accept that the premium is for a game-changing technical leader in a high-growth and very large market. Upside growth surprises could very well materialize given the scalability of S’s out-the-box solution.<blockquote>估值非常高，但投资者需要接受这样一个事实：溢价是对于一个高增长和非常大的市场中改变游戏规则的技术领导者来说。鉴于 S 开箱即用的解决方案的可扩展性，上行增长的惊喜很可能会实现。</blockquote>","collect":0,"html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Why SentinelOne Is Better Than CrowdStrike<blockquote>为什么SentinelOne比CrowdStrike更好</blockquote></title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 12.5px; color: #7E829C; margin: 0;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nWhy SentinelOne Is Better Than CrowdStrike<blockquote>为什么SentinelOne比CrowdStrike更好</blockquote>\n</h2>\n<h4 class=\"meta\">\n\nSeeking Alpha2021-09-10 11:21\n\n</h4>\n</header>\n<article>\nSummary<blockquote>总结</blockquote> <ul> <li>SentinelOne is technically better than CrowdStrike according to the performance results of the MITRE ATT&amp;CK Evaluation.</li> <li>SentinelOne leverages a highly autonomous, out-the-box solution that's proving to deliver a more scalable business model than CrowdStrike’s – evident in 2Q22 results.</li> <li>SentinelOne has a significant last-mover advantage and is using it to target CrowdStrike's weak spots.</li> </ul> <img src=\"https://static.tigerbbs.com/e6e594ecb7b47299440e7129e25e25e1\" tg-width=\"1536\" tg-height=\"864\" referrerpolicy=\"no-referrer\">Sundry Photography/iStock Editorial via Getty Images<blockquote><ul><li>根据MITRE ATT&amp;CK评估的性能结果，SentinelOne在技术上优于CrowdStrike。</li><li>SentinelOne 利用了一种高度自主、开箱即用的解决方案，事实证明，这种解决方案比 CrowdStrike 的商业模式更具可扩展性--这一点在2022年第二季度的业绩中显而易见。</li><li>SentinelOne具有显着的后发优势，并正在利用它来瞄准CrowdStrike的弱点。</li></ul>杂项摄影/iStock 社论来自 Getty Images</blockquote> About this Report<blockquote>关于本报告</blockquote> Since its June 19 IPO, CrowdStrike's(NASDAQ:CRWD)market cap has soared sixfold as the company has experienced near triple-digit revenue growth thanks to its aggressive marketing of its highly effective and differentiated endpoint protection solution. Sentinel(NYSE:S)is the new kid on the block with even faster growth – more than doubling annual revenues YoY in 2Q22 [released after market close yesterday]. S also claims NGAV (Next-Gen Antivirus) superiority and goes head-to-head with CRWD in ultra-aggressive marketing.<blockquote>自 6 月 19 日 IPO 以来，CrowdStrike（纳斯达克股票代码：CRWD）的市值已飙升六倍，该公司凭借其高效且差异化的端点保护解决方案的积极营销，实现了近三位数的收入增长。Sentinel（纽约证券交易所股票代码：S）是该领域的新成员，增长速度更快——在2022年第二季度的年收入同比增长了一倍多（昨天收盘后发布）。S 还声称拥有 NGAV（下一代防病毒软件）优势，并在超激进的营销中与 CRWD 正面交锋。</blockquote> Given S’s sky-high valuation of 92x NTM EV/S at the time of writing, it's difficult to rationalize an investment - by pretty much all measures the stock is insanely overvalued. Therefore, this report is largely about outlining why we believe S is technically superior to CRWD, and if you as investors are convinced, then you can speculate on your own growth and stock price trajectories using CRWD’s recent history as an anchor. We provide some financials and multiples projections in the Valuation Considerations section toward the end of the report.<blockquote>在撰写本文时，S 的估值高达 92 倍 NTM EV/S，因此很难合理化投资--从几乎所有指标来看，该股的估值都被高估了。因此，本报告主要是概述为什么我们认为 S 在技术上优于 CRWD，如果您作为投资者对此深信不疑，那么您就可以以 CRWD 的近期历史为锚来推测自己的增长和股价轨迹。我们在报告末尾的估值注意事项部分提供了一些财务和倍数预测。</blockquote> We should make clear that any criticism of CRWD is in direct comparison to S. CRWD are still way better than legacy AV vendors – there's no denying that. And hopefully, this report may serve as somewhat of a framework for evaluating other EPP/EDR vendors that may catch your attention.<blockquote>我们应该明确一点，对CRWD的任何批评都是与s直接比较的。CRWD仍然比传统的AV供应商好得多——这是不可否认的。希望这份报告可以作为评估其他可能引起您注意的EPP/EDR供应商的框架。</blockquote> The Evolution of AV Industry<blockquote>影音产业的演变</blockquote> There are quite a few acronyms connected to the antivirus [AV] software industry to become familiar with before delving into what CRWD and S actually. The AV industry began life using signature databases followed by two decades of using signature databases with various tweaks. Then around 2011, EPP [Endpoint Protection] and EDR [Endpoint Detection &amp; Response] became popular, ushering in the era of NGAV [Next-Gen Antivirus]. XDR [Extended Detection and Response] is often referred to as the second wave of NGAV that correlates broader and disparate data sources to enhance the detection of threats, and improve investigation and responses. The following diagram - from SentinelOne with additional annotation by ourselves – provides a useful high-level view of where the AV industry has been and where it is today. We’ll elaborate on this diagram in the following sections.<blockquote>在深入研究CRWD和S到底是什么之前，有相当多的缩写与防病毒[AV]软件行业相关，需要熟悉。AV行业开始使用签名数据库，随后二十年来使用签名数据库进行了各种调整。然后在2011年左右，EPP【端点保护】和EDR【端点检测与响应】开始流行，迎来了NGAV【下一代杀毒软件】时代。XDR【扩展检测和响应】通常被称为NGAV的第二波，它关联了更广泛和不同的数据源，以增强威胁检测，并改善调查和响应。下图来自SentinelOne，我们自己做了额外的注释，提供了一个有用的高级视图，展示了AV行业的过去和现在。我们将在以下章节中详细阐述这一图表。</blockquote> Figure 1 - Evolution of the AV Industry<blockquote>图1-AV行业的演变</blockquote> <img src=\"https://static.tigerbbs.com/cbbf1db00601920823977504a2369bd4\" tg-width=\"640\" tg-height=\"387\" referrerpolicy=\"no-referrer\">Source: SentinelOne presentation, Convequity modification<blockquote>资料来源：SentinelOne演示文稿，对称性修改</blockquote> Signature-Based AV<blockquote>基于签名的AV</blockquote> In 1987, the late John McAfee released the first commercial AV [antivirus] software to be installed on desktops. It was a signature-based AV, which means it would check the signature of all inbound files to see if they matched a known malicious signature in the database. If there was a match then the AV would block and delete the file.<blockquote>1987年，已故的约翰·迈克菲发布了第一个安装在桌面上的商业AV【防病毒】软件。这是一个基于签名的AV，这意味着它会检查所有入站文件的签名，看看它们是否与数据库中已知的恶意签名相匹配。如果有匹配，AV将阻止并删除文件。</blockquote> Most cyber-attacks involve the hacker attempting to land a malicious file on a user’s device. The file contains a virus that, when triggered with a click by the user, installs itself onto the device. From there the virus can do various things, though usually, the main objective is to ascertain the device’s network connections and send itself to critical systems of an organization.<blockquote>大多数网络攻击都涉及黑客试图在用户设备上植入恶意文件。该文件包含一种病毒，当用户单击触发时，它会将自己安装到设备上。从那里，病毒可以做各种事情，但通常情况下，主要目标是确定设备的网络连接，并将自己发送到组织的关键系统。</blockquote> Every file has a unique signature that looks like a random combination of letters and numbers. The combination of letters and numbers is produced by a hashing algorithm. For example, a file containing only the text of “We built this city!” and the hashing was based on the SHA256 hash algorithm (one of the most secure and efficient hashes), the signature will be the following:<blockquote>每个文件都有一个独特的签名，看起来像是字母和数字的随机组合。字母和数字的组合是由散列算法产生的。例如，一个文件只包含“我们建造了这座城市!”的文字。并且哈希是基于SHA256哈希算法（最安全和最有效的哈希之一），签名将如下：</blockquote> c0fed07bbfcd9ea317d495d0c9b43021ac839f699cff44f3d3bf60993df66467<blockquote>c0fed07bbfcd9ea317d495d0c9b43021ac839f699cff44f3d3bf60993df66467</blockquote> The hashing algorithm converts a file with any amount of content to a fixed-length signature – in the case of the SHA256 hashing algorithm, it is 64 characters long, also known as 64 bytes because 1 character equals 1 byte.<blockquote>散列算法将包含任意数量内容的文件转换为固定长度的签名——在SHA256散列算法的情况下，它有64个字符长，也称为64字节，因为1个字符等于1字节。</blockquote> It’s also worth noting that changing 1 character or even flipping 1 bit [8 bits in 1 byte] from 0 to 1 or vice versa, will completely change the signature. Removing the exclamation mark so the text reads “We built this city” produces this 64-byte signature:<blockquote>还值得注意的是，更改 1 个字符，甚至将 1 位（1 字节中的 8 位）从 0 翻转到 1，反之亦然，都会彻底改变签名。去掉感叹号，使文本变成 “我们建造了这座城市”，就会产生这个 64 字节的签名：</blockquote> 1b12cb77bb08ac8c826795eab8389346b1f36c9f20b7841f7552d12c7fbf4c27<blockquote>1b12cb77bb08ac8c826795eab8389346b1f36c9f20b7841f7552d12c7fbf4c27</blockquote> Visit this website&nbsp;to hash your own input or alternatively you can get the hash for any file you upload.<blockquote>访问此网站来散列您自己的输入，或者您可以获得您上传的任何文件的散列。</blockquote> Throughout the 1990s it became apparent that signature-based AV had some fundamental shortcomings. Here are some of them:<blockquote>在整个20世纪90年代，基于签名的AV显然有一些根本性的缺点。以下是其中一些：</blockquote> <ul> <li>Cybercriminals can change one line of code to completely change the signature of the virus, and as a result, evade detection. This puts the hacker vs AV battle economics firmly in the favor of the former, because it takes a lot of time and computing resources to detect and confirm a new virus variant.</li> <li>As the number of malicious files grows, so does the signature database. The database resides on the endpoint so as it grows it consumes more disk space, more CPU, and more memory.</li> <li>Immediately after the AV is installed it becomes out of date because there's a continual creation of new viruses and variants of existing viruses. In essence, even the best signature-based AV provides &lt; 100% protection.</li> </ul> To compensate for the &lt; 100% protection, existing and new AV vendors came to the market with tweaks and variations of the signature-based model.<blockquote><ul><li>网络犯罪分子可以更改一行代码来彻底改变病毒的签名，从而逃避检测。这使得黑客与AV的战斗经济学坚定地有利于前者，因为检测和确认一种新的病毒变种需要大量的时间和计算资源。</li><li>随着恶意文件数量的增长，签名数据库也在增长。数据库驻留在端点上，因此随着它的增长，它会消耗更多的磁盘空间、更多的CPU和更多的内存。</li><li>AV安装后，它立即过时，因为新病毒和现有病毒的变种不断产生。本质上，即使是最好的基于签名的AV也提供&lt;100%的保护。</li></ul>为了弥补&lt;100%的保护，现有和新的AV供应商带着基于签名的模型的调整和变化进入市场。</blockquote> During the 1990s and 2000s, the early attempts to make up for the weaknesses of signature-based AV included:<blockquote>在20世纪90年代和21世纪初，弥补基于签名的AV弱点的早期尝试包括：</blockquote> <ul> <li>Firewall vendors such as Check Point Software(NASDAQ:CHKP), F5 Networks(NASDAQ:FFIV), and Fortinet(NASDAQ:FTNT)leveraged their dominant status within the corporate network to improve signature-based AV solutions. They used their deep packet inspection capabilities at the gateway of the network to inspect inbound data packets transmitting the malicious files as well as outbound connections triggered by the virus. This added more context to help sniff out the malicious inbound files and attempts to exfiltrate data.</li> <li>Bit9, founded in 2003, (later renamed Carbon Black and now acquired by VMware) introduced app whitelisting, whereby only authorized apps are allowed to run. This turned out to be highly restrictive and unproductive as apps change and upgrade rapidly.</li> <li>FireEye(NASDAQ:FEYE), founded in 2004, introduced sandboxing, whereby an unknown suspicious app or file would be executed in an isolated environment and monitored closely for any malicious activity. Although game-changing at the time, its effectiveness didn’t last long because hackers found ways to detect the sandbox environment to then trigger the virus into stealth mode and continue the attack at a later point in time.</li> </ul> Collectively, these attempts, while lacking sustainability, did an alright job at filling in the gaps, and generally speaking, provided adequate protection during the 1990s and 2000s.<blockquote><ul><li>Check Point Software（纳斯达克股票代码：CHKP）、F5 Networks（纳斯达克股票代码：FFIV）和 Fortinet（纳斯达克股票代码：FTNT）等防火墙供应商利用其在企业网络中的主导地位来改进基于签名的 AV 解决方案。他们使用网络网关的深度数据包检查功能来检查传输恶意文件的入站数据包以及病毒触发的出站连接。这增加了更多的上下文来帮助嗅出恶意入站文件和泄露数据的企图。</li><li>Bit9成立于2003年（后更名为Carbon Black，现已被VMware收购）引入了应用白名单，只允许授权应用运行。随着应用程序的快速变化和升级，这被证明是高度限制性和低效的。</li><li>FireEye（纳斯达克股票代码：FEYE）成立于2004年，推出了沙盒技术，通过沙盒技术，未知的可疑应用程序或文件将在隔离环境中执行，并密切监控任何恶意活动。虽然在当时改变了游戏规则，但它的有效性并没有持续多久，因为黑客找到了检测沙盒环境的方法，然后触发病毒进入隐形模式，并在以后的时间点继续攻击。</li></ul>总的来说，这些尝试虽然缺乏可持续性，但在填补空白方面做得很好，总的来说，在20世纪90年代和21世纪初提供了足够的保护。</blockquote> Things changed, however, at the dawn of the iPhone in 2007. As the attack surface expanded so did the attack cadence, and computing experienced an exponential rise in the variety of viruses and the signatures connected to those viruses. The number of forms in which a virus would reside pre-execution also proliferated – scripts (code)began appearing in website photos, PDF add-ons, Excel VBA, and many other forms, waiting to be triggered.<blockquote>然而，在2007年iPhone问世时，情况发生了变化。随着攻击面的扩大，攻击的节奏也随之扩大，计算经历了病毒种类和与这些病毒相关的特征的指数级上升。病毒在执行前驻留的形式数量也激增——脚本（代码）开始出现在网站照片、PDF附加组件、Excel VBA和许多其他形式中，等待被触发。</blockquote> On the whole, signature-based AV has proven not to scale very well and in the modern computing landscape does not provide adequate protection.<blockquote>总的来说，基于签名的AV已被证明不能很好地扩展，并且在现代计算环境中不能提供足够的保护。</blockquote> Next-Gen AV<blockquote>下一代AV</blockquote> From 2007 to 2013, a new wave of AV startups emerged with a novel approach to AV. Some Next-Gen AV [NGAV] startups focused on the EPP [Endpoint Protection] – still aiming to perform the prevention, detection, and response on the end-user device itself, but by using static AI techniques to obviate the need for a signature database. Other NGAV startups focused on the EDR [Endpoint Detection and Response] side - whereby most of the protection was delivered via the cloud and therefore the EPP software component could be lightweight and serve merely as a sensor rather than an agent that can perform the full requirements of AV.<blockquote>从2007年到2013年，新一波AV创业公司以一种新颖的AV方法出现。一些下一代AV【NGAV】初创公司专注于EPP【端点保护】——仍然旨在在最终用户设备本身上执行预防、检测和响应，但通过使用静态人工智能技术来避免对签名数据库的需求。其他NGAV初创公司专注于EDR【端点检测和响应】方面，其中大部分保护是通过云提供的，因此EPP软件组件可以是轻量级的，并且仅充当传感器，而不是可以执行AV全部要求的代理。</blockquote> There are pros and cons to singularly focusing on either EPP or EDR. EPP avoids the shortcomings of signature databases, however, by running static AI on the endpoint without the big picture from the cloud, it's less flexible and less effective over the long term. EDR maintains the complete global threat picture because it’s powered by the cloud, but the downside is the deluge of data is overwhelming for security analysts and leads to many false alerts.<blockquote>单独关注EPP或EDR有利有弊。EPP避免了签名数据库的缺点，然而，通过在端点上运行静态人工智能，而没有来自云的大局，从长远来看，它不太灵活，也不太有效。EDR 能提供完整的全球威胁情况，因为它是由云驱动的，但缺点是，大量数据让安全分析师不堪重负，并导致许多误报。</blockquote> As the shortcomings of EPP and EDR became increasingly apparent, NGAV vendors began to shift along the EPP/EDR spectrum to improve their products. The screenshot taken from S’s demo presentation summarizes the direction the vendors and the market moved from 2014 through to 2019.<blockquote>随着EPP和EDR的缺点变得越来越明显，NGAV供应商开始沿着EPP/EDR频谱转移以改进他们的产品。S 的演示演示截图总结了供应商和市场从 2014 年到 2019 年的发展方向。</blockquote> Figure2- Market Shifts: EPP vs EDR<blockquote>图 2- 市场变化：EPP 与 EDR</blockquote> <img src=\"https://static.tigerbbs.com/dd7cfc885dd56210dffb2212159d7ac3\" tg-width=\"505\" tg-height=\"280\" referrerpolicy=\"no-referrer\">Source: youtube.com<blockquote>来源：youtube.com</blockquote> XDR [Extended Detection &amp; Response], first coined by Nir Zuk of Palo Alto Networks(NYSE:PANW)in 2018, is now the latest technology that leading vendors are striving toward. It blends EPP and EDR together whilst also adding SOAR [Security Orchestration, Automation &amp; Response], SIEM [Security Information &amp; Event Management], and NTA [Network Traffic Analysis]. The objective of XDR is to collect and correlate data from endpoints, network points, servers, cloud workloads, and emails to enhance detection capabilities and improve protection whilst also increasing productivity and lowering the overall cost of security software ownership.<blockquote>XDR [扩展检测和响应] 由 Palo Alto Networks（纽约证券交易所股票代码：PANW）的 Nir Zuk 于 2018 年首次发明，现在是领先供应商正在努力发展的最新技术。它将EPP和EDR融合在一起，同时还添加了SOAR【安全编排、自动化和响应】、SIEM【安全信息和事件管理】和NTA【网络流量分析】。XDR的目标是收集和关联来自端点、网络点、服务器、云工作负载和电子邮件的数据，以增强检测能力和改善保护，同时提高生产力并降低安全软件拥有的总体成本。</blockquote> CrowdStrike Intro<blockquote>CrowdStrike 简介</blockquote> CRWD, founded in 2011, came to the market with EDR, which at the time was a radical approach to AV. Instead of destroying malicious files with AV software residing on the device, CRWD destroyed them from the cloud.<blockquote>CRWD成立于2011年，带着EDR进入市场，这在当时是AV的一种激进方法。CRWD没有用驻留在设备上的AV软件销毁恶意文件，而是从云中销毁了它们。</blockquote> They achieved this by having a super lightweight sensor with no database [consuming only 35 MB of storage space whereas signature-based AV can consume 4GB] installed on the endpoint. This sensor continually collects the logs (activities) related to the files on the device (i.e., what files are downloaded, open, from where, how, what time, what recent patches have been made?) and sends this telemetry data to the CRWD cloud. CRWD analysts collect this data from all CRWD devices and check it against a giant signature database in the cloud looking for matches in techniques. For example, the CRWD database contains a previous technique whereby opening a file from IP address 1.1.1.1 executed XXX.exe which was a piece of malware. As CRWD analysts recognize this technique being used again, they will block it, gather more intel, delete the file from the cloud, and share the insight across all endpoints.<blockquote>他们通过在端点上安装一个没有数据库的超轻传感器【仅消耗35 MB的存储空间，而基于签名的AV可以消耗4GB】来实现这一目标。该传感器不断收集与设备上文件相关的日志（活动）（即下载、打开了哪些文件，从哪里、如何、什么时候、最近制作了哪些补丁？）并将这些遥测数据发送到CRWD云。CRWD分析师从所有CRWD设备收集这些数据，并对照云中的巨大签名数据库进行检查，以寻找技术上的匹配。例如，CRWD数据库包含以前的技术，其中从IP地址1.1.1.1打开文件执行XXX.exe，这是一个恶意软件。当CRWD分析师意识到这种技术再次被使用时，他们将阻止它，收集更多情报，从云中删除文件，并在所有端点上共享洞察。</blockquote> However, it should be noted that while CRWD can detect a potential virus within seconds, it doesn’t complete its response and eliminate the threat until hours later. The complex nature of EDR delivers a high number of false alerts that need to be investigated by a client organization's analysts and CRWD's analysts alike. Therefore, CRWD does take considerably longer to completely eliminate the threat. However, they're able to contain the spread of the threat until a full investigation is complete. S, on the other hand, can detectandrespond within seconds thanks to its greater degree of automation and hybrid EPP/EDR approach.<blockquote>不过，需要注意的是，虽然 CRWD 可以在几秒钟内检测到潜在病毒，但它要到几个小时后才能完成响应并消除威胁。EDR的复杂性导致大量错误警报需要由客户组织的分析师和CRWD的分析师进行调查。因此，CRWD确实需要更长的时间来完全消除威胁。然而，他们能够控制威胁的传播，直到全面调查完成。另一方面，S可以检测和由于其更高程度的自动化和混合EPP/EDR方法，可在几秒钟内做出响应。</blockquote> The key benefit of this approach is that there are no constraints on the size of the database, as it’s located in a centralized cloud. Moreover, this EDR approach obviates the need to periodically push out software updates to the endpoints to include the latest signature database, again because the database is located in the cloud. The other benefit is that the aggregated threat hunting ensures new viruses and variants and attack methods are identified faster. In essence, this AV model makes the front-end software simple and light [collecting evidence] and makes the back-end operations complex, detailed, and shared across all devices - generating insights for all. The essence of EDR is to restrain from doing early prevention, and instead wait, observe, and collect more intel regarding the threats, and respond accordingly. And this approach inspired the name of CRWD’s flagship platform Falcon.<blockquote>这种方法的主要好处是，由于数据库位于集中式云中，因此对数据库的大小没有限制。此外，这种EDR方法避免了定期向端点推送软件更新以包括最新签名数据库的需要，这也是因为数据库位于云中。另一个好处是，聚合威胁搜索可以确保更快地识别新的病毒和变种以及攻击方法。从本质上讲，这种AV模型使前端软件变得简单轻便【收集证据】，并使后端操作变得复杂、详细，并在所有设备上共享——为所有人生成见解。EDR的本质是抑制早期预防，而是等待、观察和收集更多关于威胁的情报，并做出相应的反应。这种方法启发了 CRWD 旗舰平台 Falcon 的名字。</blockquote> SentinelOne Intro<blockquote>哨兵龙简介</blockquote> S, founded in 2013, is the youngest among established NGAV vendors, and this gives it a great last-mover advantage. Instead of heavily focusing on EDR or EPP, S has utilized them both to cover all major aspects of the endpoint security to deliver the so-called XDR. Similar to CRWD, S deploys a lightweight software agent with no database on the endpoint [200 MB of disk space]. It does more than CRWD’s sensor, however. It runs static AI to establish baseline file and device behavior in which to identify anomalous activity, relating to when the file was received and how long the file was open, for example. If the file passes the rigors of static AI analysis, the user is allowed to use the file but the agent will continue to monitor closely. The agent will apply a more dynamic AI to detect any suspicious lateral movement emanating from the file – e.g., when Word opened it triggered PowerShell to open, or a command is triggered to reach out to the Internet. At any point the agent determines there's malicious activity, it will kill the virus and clean up the environment. It's this level of autonomous capability in the EPP that differentiates S from other NGAV vendors.<blockquote>S 成立于 2013 年，是老牌 NGAV 供应商中最年轻的一家，这使其具有巨大的后发优势。S没有过分关注EDR或EPP，而是利用它们来涵盖端点安全的所有主要方面，以交付所谓的XDR。与CRWD类似，S在端点【200 MB磁盘空间】上部署了一个没有数据库的轻量级软件代理。不过，它的作用不仅仅是 CRWD 的传感器。它运行静态人工智能来建立基线文件和设备行为，其中识别异常活动，例如，与接收文件的时间和打开文件的时间有关。如果文件通过了严格的静态人工智能分析，用户可以使用该文件，但代理将继续密切监控。代理将应用更动态的人工智能来检测文件发出的任何可疑的横向移动——例如，当Word打开时，它会触发PowerShell打开，或者触发命令以访问互联网。在任何时候，代理确定有恶意活动，它将杀死病毒并清理环境。正是EPP中这种程度的自主能力使S区别于其他NGAV供应商。</blockquote> Despite the sophistication of such AI-powered detection methods, some types of malwares can still evade detection. Polymorphic malware variants change their own features, such as file names and hashes, to bypass detection methods. Techniques such as code obfuscation make malicious code hard to find and/or understand. Therefore, some threats manage to bypass the front-end, or EPP, defenses, necessitating the need for EDR.<blockquote>尽管这种人工智能驱动的检测方法很复杂，但某些类型的恶意软件仍然可以逃避检测。多态恶意软件变体改变它们自己的特征，如文件名和散列，以绕过检测方法。代码混淆等技术使得恶意代码难以找到和/或理解。因此，一些威胁设法绕过前端或EPP防御，需要EDR。</blockquote> Similar to CRWD, S utilizes back-end, or EDR, for deeper visibility threat hunting. The data collected is used by both S’s own analysts for global threat hunting,andits clients’ analysts working in Security Operation Centers [SOC]. On the EDR side, compared to CRWD the key differentiator is that S uses a \"story\" technique to add more context relevancy which leads to fewer alerts for analysts to handle. S have named this ‘story’ technique TrueContext ID.<blockquote>与CRWD类似，S利用后端或EDR来进行更深入的可见性威胁搜索。收集到的数据由两家公司自己的分析师用于全球威胁搜寻、和其客户在安全运营中心 [SOC] 工作的分析师。在EDR方面，与CRWD相比，关键的区别在于S使用“故事”技术来增加更多的上下文相关性，这导致分析师需要处理的警报更少。S将这种“故事”技术命名为TrueContext ID。</blockquote> Taken from an S demo presentation, the screenshot below compares TrueContext ID to previous context-building techniques - Indicators of Compromise [IOC] and Indicators of Attack [IOA] – and the more typical existing EDR solutions – Tactics, Techniques &amp; Procedures [TTP]. The slide uses the analogy of piecing together the description of a person to illustrate piecing together the description of a malicious action.<blockquote>下面的屏幕截图取自S演示，将TrueContext ID与以前的上下文构建技术（妥协指示器[IOC]和攻击指示器[IOA]）以及更典型的现有EDR解决方案（策略、技术和程序[TTP]）进行了比较。该幻灯片使用拼凑一个人的描述的类比来说明拼凑恶意行为的描述。</blockquote> Figure 3 - Comparing TrueContext ID to Typical EDR Methods<blockquote>图3-将TrueContext ID与典型的EDR方法进行比较</blockquote> <img src=\"https://static.tigerbbs.com/e1fe08039bb960fee41b415e31c6d06e\" tg-width=\"544\" tg-height=\"293\" referrerpolicy=\"no-referrer\">Source: youtube.com<blockquote>来源：youtube.com</blockquote> IOCs look like random descriptors that would need substantial effort to comprehend. IOAs are slightly more organized but still require effort to form the full picture. TTPs actually describe the bad action and offer useful context but don’t explain what happened before that led to the bad action. TrueContext ID takes it a whole level further by not just describing the traits of the bad action but also puts together a story of the events that led to the bad action – the DNA strand implies it knows everything about a given action.<blockquote>IOC看起来像随机描述符，需要付出巨大的努力才能理解。IOA稍微有条理，但仍然需要努力来形成全貌。TTP 实际上描述了不良行为，并提供了有用的背景资料，但没有解释导致不良行为发生之前发生的事情。TrueContext ID不仅描述了不良行为的特征，还整理了一个导致不良行为的事件故事——DNA链意味着它知道给定行为的一切。</blockquote> For example, there has been a connection made to an external FTP server [a server for transferring files] &gt;&gt;&gt; this links back to some registry files that were archived in a new hard drive location &gt;&gt;&gt; this links back to an unusual command-line execution in PowerShell &gt;&gt;&gt; it transpires that the opening of PowerShell was triggered by the opening of an Office document &gt;&gt;&gt; deeper analysis indicates the document contained a brand-new unknown virus &gt;&gt;&gt; did the user single or double click it or did it download automatically? &gt;&gt;&gt; where did it come from? &gt;&gt;&gt; did it come from an email or a USB drive? &gt;&gt;&gt; is the email address and source IP address associated with previous malicious activity? &gt;&gt;&gt; or, when was the USB drive inserted on the device?<blockquote>例如，已连接到外部FTP服务器[用于传输文件的服务器]&gt;&gt;&gt;这链接到存档在新硬盘位置的一些注册表文件&gt;&gt;&gt;这链接到PowerShell中不寻常的命令行执行&gt;&gt;&gt;原来PowerShell的打开是由Office文档的打开触发的&gt;&gt;&gt;更深入的分析表明该文档包含全新的未知病毒&gt;&gt;&gt;用户是单击还是双击，还是自动下载？&gt;&gt;&gt;它从哪里来？&gt;&gt;&gt;是来自电子邮件还是U盘？&gt;&gt;&gt;电子邮件地址和源IP地址是否与以前的恶意活动相关联？&gt;&gt;&gt;或者，USB驱动器是什么时候插入设备的？</blockquote> The above example shows a bad actor attempting to transfer a copy of the critical OS files [registry files], perhaps to learn more about the target organization in order to plan a devastating future attack, or something more imminent. TrueContext ID connects all the data points from the static and dynamic AI detection methods and synthesizes them with its own globally collated intelligence to string together a timeline of sequential events. And this is presented to SOC analysts either in tabular or graphical form. Putting together a chain of events like this ensures only relevant context is presented, which radically reduces the number of alerts and enables swift investigation and remediation.<blockquote>上面的例子显示了一个坏人试图传输关键操作系统文件【注册表文件】的副本，也许是为了更多地了解目标组织，以便计划毁灭性的未来攻击，或者更迫在眉睫的攻击。TrueContext ID连接来自静态和动态人工智能检测方法的所有数据点，并将它们与自己的全局整理的智能进行合成，以将顺序事件的时间线串在一起。并以表格或图形的形式呈现给SOC分析师。将这样的事件链放在一起可以确保只呈现相关的上下文，这从根本上减少了警报的数量，并支持快速调查和补救。</blockquote> CRWD investors and advocates may be somewhat confused as to why S’s storing techniques are a technical competitive advantage. Indeed, CRWD has an event timelining feature that is core to their EDR solution – they refer to it as \"maps.\" However, generally, a client organization’s SOC analysts need to be tier 2 or 3 certified for using CRWD’s Falcon EDR solution – one reason for this being the high number of false alerts that an analyst needs to navigate, which is far easier for the more experienced.<blockquote>CRWD 的投资者和倡导者可能有些困惑，为什么 S 的存储技术是一种技术竞争优势。事实上，CRWD 有一个事件时间表功能，这是他们 EDR 解决方案的核心——他们称之为“地图”。不过，一般来说，客户组织的 SOC 分析师需要通过 2 级或 3 级认证才能使用 CRWD 的 Falcon EDR 解决方案--其中一个原因是分析师需要处理大量的错误警报，而这对于更有经验的人来说要容易得多。</blockquote> If a client organization doesn’t have a SOC team and hence cannot conduct the threat investigation on CRWD and leverage its EDR component, then they can just run it and let it handle things by the default settings or use the MDR [Managed Detection &amp; Response] option whereupon CRWD experts will do the legwork. But when it comes to SOC operations, S’s storing technique appears to have an edge over CRWD because it radically reduces the alerts and false positives and, on the whole, makes life easier for SOC analysts.<blockquote>如果客户组织没有 SOC 团队，因此无法对 CRWD 进行威胁调查并利用其 EDR 组件，那么他们可以运行它，让它通过默认设置处理事情，或者使用 MDR [托管检测与响应] 选项，CRWD 专家将在此基础上进行跑腿工作。但在 SOC 操作方面，S 的存储技术似乎比 CRWD 更有优势，因为它从根本上减少了警报和误报，总体而言，让 SOC 分析师的工作更轻松。</blockquote> To summarize, S can deliver fully automated detection, response, and system recovery all within the EPP software itself, but also has the EDR-based TrueContext ID technology that can catch more sophisticated attacks and help SOC analysts triage with far fewer false positive alerts. With this in mind, it appears that S has the edge over CRWD on both the EPP and EDR sides of the market. Moreover, as we’ll show in the presentation of MITRE ATT&amp;CK performance results, S’s out-of-the-box solution that leverages greater automation is likely to offer greater scalability than CRWD’s. We think this greater scalability is shining through in the recent 2Q22 results whereby S generated 127% YoY growth.<blockquote>总而言之，S可以在EPP软件本身中提供全自动的检测、响应和系统恢复，但还具有基于EDR的TrueContext ID技术，可以捕捉更复杂的攻击，并帮助SOC分析师以更少的误报进行分类。考虑到这一点，S 似乎在 EPP 和 EDR 市场方面都比 CRWD 更有优势。此外，正如我们将在 MITRE ATT&amp;CK 绩效结果演示中展示的那样，S 的开箱即用的解决方案利用了更高的自动化程度，很可能比 CRWD 的解决方案具有更强的可扩展性。我们认为这种更大的可扩展性在最近的2022年第二季度业绩中得到了体现，S 实现了 127% 的同比增长。</blockquote> Key Differences Between S and CRWD<blockquote>S和CRWD之间的主要区别</blockquote> We’ve listed 11 aspects of endpoint protection whereupon S and CRWD differ by substantial margins. And it may seem overly biased [though we don’t have a position in S yet], but all 11 aspects are in favor of S outcompeting CRWD. We’ll elaborate on a few of these in the following sections.<blockquote>我们列出了端点保护的 11 个方面，S 和 CRWD 在这些方面存在很大差异。这可能看起来过于偏颇（尽管我们还没有在 S 中占据一席之地），但所有 11 个方面都有利于 S 超越 CRWD。我们将在以下章节中详细阐述其中的一些内容。</blockquote> <img src=\"https://static.tigerbbs.com/8e23001654d05cb1774d7adce7ed7e1c\" tg-width=\"573\" tg-height=\"253\" referrerpolicy=\"no-referrer\">Source: Convequity<blockquote>来源：Convequity</blockquote> Brains of Software<blockquote>软件大脑</blockquote> CRWD: As already alluded, the brain of CRWD is in the cloud only and utilizes EDR to understand the global landscape of threats. The very nature of this cloud-based EDR approach requires the computation of petabytes of data that quickly detects potential threats but also generates large numbers of false alerts. The notion of the false alert volumes necessitates the need for thorough investigation which is why the response time takes hours instead of seconds. Ultimately, CRWD’s approach is rather labour-intensive but is still more autonomous than legacy signature-based AV.<blockquote>CRWD：正如已经提到的，CRWD的大脑只在云中，并利用EDR来了解全球威胁格局。这种基于云的EDR方法的本质要求计算PB的数据，这些数据可以快速检测潜在的威胁，但也会产生大量的错误警报。错误警报量的概念需要进行彻底的调查，这就是为什么响应时间需要几个小时而不是几秒钟。归根结底，CRWD 的方法是劳动密集型的，但仍然比传统的基于签名的 AV 更加自主。</blockquote> S: The brain of S is in a hybrid form that utilizes both automation and AI in the front-end EPP and cloud-powered global intel in the back-end EDR, and blends the two harmoniously together. The storying technique applied in TrueContext ID radically reduces the number of alerts and the manual investigation for the EDR side of operations. So, as aforementioned, for the high majority of threats, this results in full automated response and recovery [system cleanup] within seconds, and results in relatively less manpower requirements [versus CRWD] for the more sophisticated attacks. Moreover, S can work offline and catch the majority of threats whereas CRWD must be connected online to work.<blockquote>S：S的大脑是一种混合形式，在前端EPP中利用自动化和AI，在后端EDR中利用云驱动的全球英特尔，并将两者和谐地融合在一起。TrueContext ID中应用的故事技术从根本上减少了EDR操作方面的警报和手动调查的数量。因此，如前所述，对于绝大多数威胁，这会在几秒钟内实现全自动响应和恢复【系统清理】，并且对于更复杂的攻击，所需的人力相对较少【与CRWD相比】。此外，S可以离线工作并捕捉大多数威胁，而CRWD必须在线连接才能工作。</blockquote> Operation of AV<blockquote>AV操作</blockquote> We’ve already touched on S’s software being highly autonomous while CRWD’s software requires human experts to be effective. This contrast offers an apt segue into taking a look at which approach is ultimately more effective. So, we’ll use this section to review the MITRE ATT&amp;CK endpoint protection test results.<blockquote>我们已经谈到了 S 的软件具有高度自主性，而 CRWD 的软件则需要人类专家才能发挥作用。这种对比为看看哪种方法最终更有效提供了一个恰当的切入点。因此，我们将使用本节来回顾 MITRE ATT&amp;CK 端点保护测试结果。</blockquote> MITRE is an independent, federally funded, not-for-profit R&amp;D organization that periodically performs attacks against leading security vendors’ software solutions. MITRE has long been the authority in cybersecurity testing, and in 2018, they launched the MITRE ATT&amp;CK Evaluations, where MITRE evaluates the efficacy of cybersecurity products. S, CRWD, and PANW participated in the series of tests (2019, 2020, and 2021) and we’ll present the two most recent.<blockquote>MITRE 是一家独立的、由联邦政府资助的非营利性研发机构，定期对领先的安全供应商的软件解决方案进行攻击。MITRE长期以来一直是网络安全测试的权威，2018年，他们推出了MITRE ATT&amp;CK评估，MITRE评估网络安全产品的功效。S、CRWD 和 PANW 参加了这一系列测试（2019 年、2020 年和 2021 年），我们将介绍最近的两项测试。</blockquote> In the MITRE ATT&amp;CK tests, vendors are assessed on how effective they are in stopping tactics and techniques. A Tactic is a bad actor’s objective – for example, to acquire a username and password, acquire remote control of the system, or exfiltrate data. A Technique is a method deployed to achieve the objective – for example, cross-site scripting [taking advantage of website vulnerabilities to lure victims into submitting their login details]. There are usually several techniques included in each tactic.<blockquote>在MITRE ATT&amp;CK测试中，评估供应商在阻止策略和技术方面的有效性。策略是不良行为者的目标--例如，获取用户名和密码、获取系统远程控制权或泄露数据。技术是为实现目标而部署的方法——例如，跨站点脚本【利用网站漏洞引诱受害者提交他们的登录信息】。每种战术通常都包含几种技术。</blockquote> Figure 4 - Tactics &amp; Techniques<blockquote>图4-战术和技术</blockquote> <img src=\"https://static.tigerbbs.com/22780f1dd68425ed1bd3bf6ea164e17d\" tg-width=\"640\" tg-height=\"251\" referrerpolicy=\"no-referrer\">Source: medium.com<blockquote>资料来源：medium.com</blockquote> Rather confusingly to the layman, MITRE presents the performance results in references to Steps and Substeps instead of Tactics and Techniques. So, for high-level knowledge purposes, Steps are closely associated with Tactics and Substeps are closely associated with Techniques. The following diagram from SentinelOne is useful to solidify the levels of detections.<blockquote>对于外行人来说，相当令人困惑的是，MITRE通过引用步骤和子步骤而不是战术和技术来呈现性能结果。因此，出于高级知识的目的，步骤与战术密切相关，子步骤与技术密切相关。SentinelOne的下图有助于巩固检测水平。</blockquote> Figure 5 - Analytic Detections: Tactics/Steps and Techniques/Substeps<blockquote>图5-分析检测：策略/步骤和技术/子步骤</blockquote> <img src=\"https://static.tigerbbs.com/1c271214a738c15e65d44d3a2fcf7800\" tg-width=\"640\" tg-height=\"272\" referrerpolicy=\"no-referrer\">Source: SentinelOne on YouTube, Convequity modification<blockquote>资料来源：YouTube 上的 SentinelOne，对流性修改</blockquote> The 2020 test results [based on techniques from APT29, a hacker group linked to Russian intelligence agencies] are shown below. The first chart shown shows that S led the pack in regards to overall detections, aka Substeps. The chart shows the number of detections out of the 135 Substeps for each vendor.<blockquote>2020年的测试结果【基于与俄罗斯情报机构有关联的黑客组织APT29的技术】如下所示。显示的第一张图表显示，S在整体检测（又称子步骤）方面处于领先地位。该图显示了每个供应商的135个子步骤中的检测数量。</blockquote> Figure 6 – MITRE ATT&amp;CK 2020 Performance Result: Total Detections<blockquote>图 6 – MITRE ATT&amp;CK 2020 性能结果：总检测量</blockquote> <img src=\"https://static.tigerbbs.com/f2e9e22cd5dadfe733a41b4d89f36776\" tg-width=\"541\" tg-height=\"384\" referrerpolicy=\"no-referrer\">Source: elastic.co/blog/<blockquote>来源：elastic.co/blog/</blockquote> The next two charts show the Tactic and Technique detections for the MITRE AV test. As a gentle reminder, Tactics are closely associated with Steps and Techniques are associated with Substeps.<blockquote>接下来的两个图表显示了MITRE AV测试的战术和技术检测。温和地提醒一下，战术与步骤密切相关，技术与子步骤相关联。</blockquote> Figure 7 - MITRE ATT&amp;CK 2020 Performance Result: Tactic and Technique Detections<blockquote>图 7 - MITRE ATT&amp;CK 2020 性能结果：战术和技术检测</blockquote> <img src=\"https://static.tigerbbs.com/d3c4d692af2713c6fe0b234c68a23cec\" tg-width=\"640\" tg-height=\"284\" referrerpolicy=\"no-referrer\">Source: elastic.co/blog/<blockquote>来源：elastic.co/blog/</blockquote> Observing that S had the best performance in Tactic detections and the second-best performance in Technique detections, aligns with the storing capability of TrueContext ID. A Tactic is a Step or objective, such as data exfiltration. A Technique is a Substep or method which is one of the Substeps required to achieve the Tactic, such as connecting to an external server in the exfiltration example. TrueContext ID has been designed to provide both high-level and granular detail of each attack, and therefore, it’s understandable as to why S has performed the best across Tactics and Techniques.<blockquote>观察到S在战术检测中具有最佳性能，在技术检测中具有第二好性能，这与TrueContext ID的存储能力一致。战术是一个步骤或目标，如数据泄露。技术是实现策略所需的子步骤之一的子步骤或方法，例如在渗透示例中连接到外部服务器。TrueContext ID 旨在提供每次攻击的高级细节，因此，S 在战术和技术方面表现最佳也就不足为奇了。</blockquote> Interestingly, the performance rankings in the following year [2021] are very similar. In the 2020 test, it looks like CRWD detected a total of c. 115 Substeps versus S’s c. 130. And in 2021 it looks like CRWD detected c. 150 versus S detecting c. 175. So, the ratio is very similar between the two rivals in both years.<blockquote>有趣的是，第二年【2021年】的业绩排名非常相似。在2020年的测试中，看起来CRWD总共检测到c。115个子步骤与S的c。130. 2021年，CRWD似乎检测到了c。150与S检测c。175. 因此，这两个竞争对手在这两年的比率非常相似。</blockquote> Figure 8 - MITRE ATT&amp;CK 2021 Performance Result: Total Detections<blockquote>图 8 - MITRE ATT&amp;CK 2021 性能结果：总检测量</blockquote> <img src=\"https://static.tigerbbs.com/9f3bfc1ecc4575acfb81df5fa624348e\" tg-width=\"640\" tg-height=\"320\" referrerpolicy=\"no-referrer\">Source: elastic.co/blog/<blockquote>来源：elastic.co/blog/</blockquote> It would be hard to dispute that S has a better performing AV than CRWD based on the results presented in the previous charts. Though what creates further distance between S and CRWD are the configuration changes made by the vendors before MITRE conducted its test – which we’ll cover next.<blockquote>根据前面图表中呈现的结果，很难否认S比CRWD具有更好的性能。不过，在 MITRE 进行测试之前，供应商对配置进行了更改，这一点我们将在下文中介绍。</blockquote> Deployment<blockquote>部署</blockquote> Much of S’s marketing outlines how their software works straight out-of-the-box. This is a common claim in competitive software markets, though in S’s case, it does appear to be largely true.<blockquote>S 的大部分营销内容都直接概述了他们的软件是如何开箱即用的。这是竞争激烈的软件市场中常见的说法，不过在 S 的案例中，这似乎在很大程度上是正确的。</blockquote> The next chart shows how many configurations changes each vendor made in preparation for the 2020 test. S didn’t change anything – their AV software was applied out-of-the-box. CRWD, on the other hand, made 25 tweaks to optimize their AV for the test. This fits in very well with the earlier discussion that CRWD is designed for enterprises with more experienced security analysts [SOC 2 and 3 analysts] – more on this later. These configuration changes also underscore what we’ve outlined in regards to S being way more automated than CRWD. CRWD’s lack of automation means it can’t work out-of-the-box with high effectiveness – the AV has been designed for heavy human involvement.<blockquote>下图显示了每个供应商为准备2020年测试所做的配置更改。S 并没有改变任何东西--他们的 AV 软件是开箱即用的。另一方面，CRWD进行了25次调整，以优化他们的AV进行测试。这与前面的讨论非常吻合，即CRWD是为拥有更有经验的安全分析师【SOC 2和3分析师】的企业设计的——稍后会详细介绍。这些配置变化也凸显了我们所概述的 S 比 CRWD 更加自动化。CRWD 缺乏自动化意味着它无法高效地开箱即用--AV 的设计需要大量人工参与。</blockquote> Figure 9 - MITRE ATT&amp;CK Configuration Changes for 2020 Test<blockquote>图 9 - 2020 年测试的 MITRE ATT&amp;CK 配置变化</blockquote> <img src=\"https://static.tigerbbs.com/f75663784c5d8c76b727e0d5c6fe33a2\" tg-width=\"640\" tg-height=\"336\" referrerpolicy=\"no-referrer\">Source: youtube.com<blockquote>来源：youtube.com</blockquote> So, despite CRWD making 25 tweaks to its AV software versus S’s zero tweaks, the market-leading endpoint protection provider still underperformed S by considerable margins in the MITRE test. And it’s worth reminding ourselves that S will have performed using AI and automation, whilst CRWD will have performed with heavy involvement from its own cloud-based SOC 2/3 analysts. Moreover, to add further context, this is the first test CRWD has participated in wherein it has performed acceptably well – previous tests by MITRE and NSS Labs yielded very poor results for CRWD. When you add these factors together, it really does open up a significant gap in the software capability between S and CRWD.<blockquote>因此，尽管 CRWD 对其 AV 软件进行了 25 次调整，而 S 只进行了 0 次调整，但这家市场领先的终端保护提供商在 MITRE 测试中的表现仍然远远逊于 S。值得提醒的是，S 将使用人工智能和自动化来执行任务，而 CRWD 将在其基于云的 SOC 2/3 分析师的大力参与下执行任务。此外，为了增加更多的背景，这是CRWD参与的第一次测试，它的表现可以接受——MITRE和NSS实验室之前的测试对CRWD产生了非常糟糕的结果。当你把这些因素加在一起时，它确实在S和CRWD之间的软件能力上打开了一个显著的差距。</blockquote> It’s also refreshing to note that PANW also chose not to make any changes, and they achieved a top four overall total detection performance and finished in the top half in the Tactic and Technique components of the test. We’ve reiterated for a long time now that Palo Alto Networks is simply the best at cybersecurity, and considering that endpoint protection isn’t even their core/original expertise, this is a huge testament to that.<blockquote>同样令人耳目一新的是，PANW 也选择不做任何改变，他们在测试的战术和技术部分取得了前四名的整体检测性能，并在测试的战术和技术部分进入了前半部分。我们早就重申，Palo Alto Networks 是网络安全领域的佼佼者，考虑到端点保护甚至不是他们的核心/原创专长，这充分证明了这一点。</blockquote> Expertise Requirements<blockquote>专业知识要求</blockquote> For SMBs that don’t have a SOC [Security Operations Centre], have relatively simpler security needs, and for some reason may be less of a hacker target, then deploying CRWD in its default settings shouldn’t be much of an issue and is way better than opting for legacy AV. Indeed, a simple deployment across an all-Windows organization is very simple. Alternatively, if an all-Windows SMB has more nuanced security needs but doesn’t have a SOC, then CRWD’s MDR [Managed Detection &amp; Response] service will be deployed and work smoothly with negligible issues. Expertise becomes a consideration in the case where an enterprise with its own SOC [and more complex requirements] and/or non-Windows operating systems (i.e., Linux and/or Mac) wants to install CRWD.<blockquote>对于没有 SOC（安全运营中心）、安全需求相对简单，而且由于某种原因可能不太可能成为黑客目标的中小型企业来说，在其默认设置下部署 CRWD 应该不会有太大问题，而且比选择传统 AV 要好得多。事实上，跨全Windows组织的简单部署非常简单。或者，如果全 Windows 中小型企业有更细致的安全需求，但没有 SOC，那么 CRWD 的 MDR [托管检测与响应] 服务将被部署并顺利运行，问题可以忽略不计。在拥有自己的SOC【和更复杂的要求】和/或非Windows操作系统（即Linux和/或Mac）的企业想要安装CRWD的情况下，专业知识成为一个考虑因素。</blockquote> As highlighted in the previous section, to maximize CRWD and protect against a full range of sophisticated attack techniques, substantial configuration tweaks are required. SOC 2 and 3 analysts will comfortably be able to handle this, however, SOC 1 and/or IT generalists will find it difficult and are likely to require assistance or make a mistake. Additionally, a higher-level of expertise is necessary to swiftly navigate through the barrage of alerts received with CRWD. Analysts need to coordinate Falcon with Splunk’s legacy SIEM to correlate data and gain the fullest threat landscape picture [this will eventually change, however, once they fully integrate the Humio acquisition]. Again, this requires a higher-level of expertise – SOC 2 or 3.<blockquote>正如上一节所强调的，为了最大限度地提高CRWD并抵御各种复杂的攻击技术，需要进行大量的配置调整。SOC 2和3分析师将能够轻松地处理这一点，但是，SOC 1和/或IT通才将发现这很困难，并可能需要帮助或犯错误。此外，需要更高水平的专业知识来快速浏览CRWD收到的大量警报。分析师需要将 Falcon 与 Splunk 的 legacy SIEM 进行协调，以关联数据并获得最全面的威胁景观[不过，一旦他们完全整合了对 Humio 的收购，这种情况最终会改变]。同样，这需要更高水平的专业知识——SOC 2或3。</blockquote> Then if you add in non-Windows OS, deployment complicates further. Yes, in the past 12 or so months CRWD has better adapted Falcon to Linux and Mac, though a high-level of expertise is required to ensure a smooth deployment following many years of incompatibility issues.<blockquote>然后，如果添加非Windows操作系统，部署会变得更加复杂。是的，在过去的12个月左右的时间里，CRWD已经使Falcon更好地适应了Linux和Mac，尽管在多年的不兼容问题之后，需要高水平的专业知识来确保顺利部署。</blockquote> So, because of the config changes and the multi-OS environments, typically SOC 2 or 3 analysts are required for the CRWD enterprise use case.<blockquote>因此，由于配置变化和多操作系统环境，CRWD企业用例通常需要SOC 2或3名分析师。</blockquote> In contrast, as evident in the MITRE test, S works right out of the box and hence IT generalists can get on fine with it. TrueContext ID - the storing feature - radically reduces the volume of alerts to enable more efficient threat hunting and remediation and hence making for a more user-friendly interface for SOC 1 and IT generalists to get along with. And, S has built its Singularity Platform with Windows, Linux, and Mac in mind right from the outset [a by-product of S’s last-mover advantage and taking more time in R&amp;D before pumping the GTM strategy], delivering feature parity across all platforms – which again, means lower expertise is required to complete a successful multi-OS environment.<blockquote>相比之下，正如在MITRE测试中显而易见的那样，S开箱即用，因此IT通才可以使用它。TrueContext ID——存储功能——从根本上减少了警报的数量，以实现更有效的威胁搜索和修复，从而为SOC 1和IT通才提供了一个更用户友好的界面。此外，S 从一开始就在 Windows、Linux 和 Mac 的基础上构建了奇点平台（这是 S 后发优势的副产品，也是在推行 GTM 战略之前花费更多时间进行研发的副产品），在所有平台上提供功能对等--这也意味着要完成一个成功的多操作系统环境，需要较低的专业知识。</blockquote> Target Market and Pricing<blockquote>目标市场和定价</blockquote> As previously mentioned, CRWD and S can be easily deployed for simple use cases associated with certain SMBs. Where we view S as having a notable larger target market is in the more complicated use cases associated with certain SMBs and enterprises. Taking into account the aforementioned expertise requirements, for complex use cases, S appears as the more attractive solution – by a wide margin. In using S over CRWD, SOC two and three analysts can work with more productivity, and SOC 1 and IT generalists can deploy and manage the software with little hassle. This opens up a wider TAM for S vs. CRWD.<blockquote>如前所述，CRWD和S可以很容易地部署到与某些SMB相关联的简单用例中。我们认为S具有明显更大的目标市场是在与某些中小型企业和企业相关的更复杂的用例中。考虑到前面提到的专业知识要求，对于复杂的用例，S似乎是更有吸引力的解决方案——优势很大。在使用 S over CRWD 时，SOC 2 和 3 位分析师可以更高效地工作，而 SOC 1 和 IT 通才可以轻松部署和管理软件。这为S与CRWD打开了更广阔的TAM。</blockquote> So, at the low-end of the market, comparing S and CRWD is trivial, because for simple use cases CRWD’s default settings are adequate. But CRWD is expensive. Our research on Reddit forums indicates that CRWD is 2x to 3x more expensive than S, and from this, we infer that CRWD is or will eventually price themselves out of the market segment in which they are most technically competitive.<blockquote>因此，在低端市场，比较 S 和 CRWD 是微不足道的，因为对于简单的使用情况，CRWD 的默认设置就足够了。但是CRWD很贵。我们在 Reddit 论坛上的研究表明，CRWD 比 S 贵 2 到 3 倍，由此我们推断 CRWD 正在或最终将把自己定价超出其技术竞争力最强的细分市场。</blockquote> CRWD maximizes the land-and-expand sales model as aggressively as any other software vendor. They sell the Falcon platform in modules; implementing a bare minimum number of modules in the beginning and then aggressively upselling/cross-selling other modules. Though many of the other modules are a necessity for full protection. Usually, most clients need to bundle together NGAV which is the Falcon Prevent module, EDR which is the Falcon Insight module, and device control which is the Falcon Device Control module. However, in pursuit of greater DBNR [Dollar-based Net Retention], CRWD separated device control into an independent module.<blockquote>CRWD像任何其他软件供应商一样积极地最大限度地利用土地和扩张销售模式。他们以模块形式销售猎鹰平台；在开始时实施最少数量的模块，然后积极追加销售/交叉销售其他模块。尽管许多其他模块是全面保护的必要条件。通常，大多数客户端需要捆绑NGAV（Falcon Prevent模块）、EDR（Falcon Insight模块）和Device Control（Falcon Device Control模块）。然而，为了追求更大的DBNR【基于美元的净保留率】，CRWD将设备控制分离成一个独立的模块。</blockquote> Figure 10 - CRWD's Falcon Platform Modules<blockquote>图 10 - CRWD 的猎鹰平台模块</blockquote> <img src=\"https://static.tigerbbs.com/c475e910dc1a094d382a08896b76d275\" tg-width=\"633\" tg-height=\"318\" referrerpolicy=\"no-referrer\">Source: CrowdStrike<blockquote>资料来源：CrowdStrike</blockquote> The combined pricing is well beyond the price quote from legacy AV vendors – which is absolutely fine given CRWD is better. Though, according to Reddit forum discussions, those clients that mentioned \"SentinelOne\" to CRWD salespeople immediately received a ~50% discount.<blockquote>综合定价远远超过了传统AV供应商的报价——考虑到CRWD更好，这绝对没问题。不过，根据Reddit论坛的讨论，那些向CRWD销售人员提到“SentinelOne”的客户立即获得了约50%的折扣。</blockquote> CRWD’s module-based land-and-expand ploys are most evident in the immediate quarters post-IPO. A cynical view, but reading between the lines it looks like a nice stock-based compensation booster was at play for the year-end of FY19.<blockquote>CRWD 基于模块的土地和扩张策略在 IPO 后的几个季度最为明显。这是一个愤世嫉俗的观点，但从字里行间来看，2019 财年年底似乎有一个不错的基于股票的薪酬助推器正在发挥作用。</blockquote> Figure 11 - CRWD's DBNR<blockquote>图11-CRWD的DBNR</blockquote> <img src=\"https://static.tigerbbs.com/6cc506dae651f32b97fc0affb3ce4111\" tg-width=\"598\" tg-height=\"240\" referrerpolicy=\"no-referrer\">Source: CrowdStrike<blockquote>资料来源：CrowdStrike</blockquote> In a clear attempt to differentiate and do things better than CRWD, S doesn’t sell individual modules. Instead, it sells its full Singularity Platform as bundles across three tiers – Core, Control, and Complete. It appears that on a like-for-like, S’s bundles are ~30% even after CRWD’s discounts.<blockquote>为了与 CRWD 区分开来，做得更好，S 不销售单个模块。相反，它将其完整的奇点平台作为三个层次的捆绑包出售——核心、控制和完整。即使在 CRWD 的折扣之后，S 的套餐似乎也有 30% 左右的折扣。</blockquote> Figure 12 - S's Singularity Platform Tiered Bundles<blockquote>图12-S的奇点平台分层包</blockquote> <img src=\"https://static.tigerbbs.com/5c77f334f8f81a839d3022612b73ead9\" tg-width=\"639\" tg-height=\"307\" referrerpolicy=\"no-referrer\">Source: SentinelOne<blockquote>来源：SentinelOne</blockquote> Insincere sales ploys like what CRWD has been doing only last for so long. Eventually, customers catch onto what is happening – evident by discussion on Reddit. And it feels like that day has already come, probably brought to the fore by S’s differentiated bundle pricing.<blockquote>像CRWD一直在做的不真诚的销售策略只会持续这么久。最终，客户明白了正在发生的事情——从Reddit上的讨论中可以明显看出。感觉这一天已经到来，可能是因为 S 的差异化捆绑定价。</blockquote> To summarize, CRWD effectively competes with S on a technical basis at the lower-end of the market involving simple use cases but they are risking pricing themselves out of the market. At the higher-end of the market involving complex use cases, it looks like S is both technically better and more affordable than CRWD. Additionally, S will store logs for a maximum of 365 days whilst CRWD’s max is 90 days. All of this strongly aligns itself with S’s founder and CEO Tomer Weingarten claiming that S wins 70% of head-to-heads with CRWD.<blockquote>总而言之，CRWD在涉及简单用例的市场低端技术基础上有效地与S竞争，但他们冒着将自己定价出市场的风险。在涉及复杂用例的高端市场中，S 似乎在技术上比 CRWD 更好，而且更实惠。此外，S 将最长存储日志 365 天，而 CRWD 的最长存储日志为 90 天。所有这些都与 S 的创始人兼首席执行官托默-温加滕（Tomer Weingarten）声称 S 在与 CRWD 的正面交锋中赢得了 70% 的胜利。</blockquote> In comparison to CRWD, not only will S’s technical superiority and competitiveness help it penetrate more of the TAM whilst also widening the TAM, being able to deploy in the cloud and on-prem further expands their customer reach vis-à-vis CRWD.<blockquote>与 CRWD 相比，will S 的技术优势和竞争力不仅有助于其在拓宽 TAM 的同时渗透到更多的 TAM，而且能够在云端和本地部署进一步扩大了他们相对于 CRWD 的客户覆盖范围。</blockquote> On the whole, S can target a broader market and based on its technical/performance superiority plus aggressive but transparent pricing, can outcompete CRWD in its own TAM.<blockquote>总体而言，S 可以瞄准更广阔的市场，并且基于其技术/性能优势加上积极但透明的定价，可以在自己的 TAM 中击败 CRWD。</blockquote> Architecture<blockquote>建筑</blockquote> Before we move onto valuation considerations, we’ll briefly share our views and CRWD’s and S’s software architecture. In all honesty, we can’t find much information related to who has the more modern architecture, but you’ve probably guessed already that we think S has the edge here. The cadence in which both vendors release new features and modules is testament that both operate within advanced microservice architectures. However, we assume, that as CRWD partners with a legacy vendor like Splunk for SIEM and log management, its architecture is probably semi-dated and that there has been an absence of major revamp in recent years. This line of thinking could be kind of validated by the number of years it’s taken for CRWD to overhaul its Mac and Linux sensors.<blockquote>在讨论估值问题之前，我们将简要分享我们的观点以及 CRWD 和 S 的软件架构。老实说，我们找不到太多关于谁拥有更现代的架构的信息，但你可能已经猜到了，我们认为 S 在这方面更有优势。两家供应商发布新功能和模块的节奏证明了两家供应商都在先进的微服务架构中运行。然而，我们假设，由于CRWD与Splunk这样的传统供应商合作进行SIEM和日志管理，其架构可能已经过时，并且近年来没有进行重大改造。CRWD 大修其 Mac 和 Linux 传感器所用的年数可以在某种程度上验证这种思路。</blockquote> It’s interesting how in March 2021 CRWD bought Humio for $392m in cash and equity just one month after S bought Scalyr for $155m in cash and equity. This may be reading into things too much, but some may view it as a sign of desperation to shore up an aging architecture and move away from legacy SPLK.<blockquote>有趣的是，2021 年 3 月，CRWD 以 3.92 亿美元的现金和股权收购了 Humio，而就在一个月前，S 以 1.55 亿美元的现金和股权收购了 Scalyr。这可能读得太多了，但有些人可能会认为这是支撑老化架构和摆脱传统SPLK的绝望迹象。</blockquote> Any differences in the modernity of the two NGAV architectures will very likely widen in the coming quarters and years. CRWD is only 14 months older than S, but because it grew early and superfast, it will have accumulated way more technical debt. And issues that come with technical debt will only be amplified as a $60bn company like CRWD needs to continue aggressively expanding its TAM via acquisitions in order to keep the mega growth story alive.<blockquote>两个NGAV架构的现代性差异很可能会在未来几个季度和几年内扩大。CRWD 只比 S 大 14 个月，但由于它成长得早且速度超快，它将积累更多的技术债务。随着像 CRWD 这样价值 600 亿美元的公司需要继续通过收购积极扩大其 TAM，以保持巨大的增长故事，技术债务带来的问题只会被放大。</blockquote> As all software firms grow, they lose their nimbleness but it will happen a lot sooner to CRWD than it will to S - and this gives another upper hand to S in years to come.<blockquote>随着所有软件公司的发展，它们都会失去灵活性，但这种情况发生在CRWD身上的速度会比S身上的速度快得多——这使得S在未来几年又占据了上风。</blockquote> S’s Edge Summary<blockquote>S’s Edge总结</blockquote> At a high level, the key competitive advantages S has over CRWD can be summarized into four fundamental drivers:<blockquote>在高层次上，S相对于CRWD的主要竞争优势可以概括为四个基本驱动因素：</blockquote> <ul> <li>Better product effectiveness.</li> <li>Better user experience.</li> <li>Better pricing.</li> <li>A more scalable business model afforded by a highly automated out-the-box solution.</li> </ul> Valuation Considerations<blockquote><ul><li>更好的产品效果。</li><li>更好的用户体验。</li><li>更优惠的价格。</li><li>高度自动化的开箱即用解决方案提供的更具可扩展性的商业模式。</li></ul>估值考虑因素</blockquote> S’s IPO, on June 30, was the highest-valued cybersecurity IPO ever. The stock finished its IPO day 21% up, closing at $42.50/share with a LTM EV/S of 100x. At the time of writing the stock is trading at $68/share with a LTM EV/S of 163x and a NTM EV/S of 92x.<blockquote>S 于 6 月 30 日进行的首次公开募股是有史以来估值最高的网络安全首次公开募股。该股在 IPO 当天上涨 21%，收于每股 42.50 美元，LTM EV/S 为 100 倍。截至撰写本文时，该股交易价格为每股 68 美元，LTM EV/S 为 163 倍，NTM EV/S 为 92 倍。</blockquote> Below are some projections going out to FY26. FY22 revenue is anchored to management’s guidance. In the 2Q22 earnings presentation released yesterday, management also gave long-term targets that included a mature gross margin of 75%-80%, hence why we’ve made it so gross margin is 78% in FY26. We’ve used CRWD’s current TTM FCF margin as a rough long-term estimate of S’s in FY26.<blockquote>以下是对 26 财年的一些预测。22 财年的收入以管理层的指导为基础。在昨天发布的2022年第二季度财报中，管理层还给出了长期目标，其中包括 75%-80% 的成熟毛利率，这也是我们将 26 财年毛利率定为 78% 的原因。我们使用 CRWD 目前的 TTM FCF 利润率作为 26 财年 S 的粗略长期估计。</blockquote> Guessing the multiple declines is kind of an unchartered territory because of the unprecedented level and sustainability of multiples we’re witnessing in the COVID-era market. Some may argue a decline to a 53x EV/S by FY26 is not steep enough, and that might be right. Though in FY26 we expect revenue to be at similar levels to CRWD’s today and CRWD is currently trading at 56x EV/S. Of course, no macro assessment is being taken into account so please take this exercise with a pinch of salt.<blockquote>猜测倍数的下降是一个未知领域，因为我们在 COVID 时代的市场上看到了前所未有的倍数水平和可持续性。有些人可能会认为，到 26 财年电动汽车/秒降至 53 倍还不够，这可能是正确的。不过，我们预计 26 财年的收入将与 CRWD 目前的收入水平相似，而 CRWD 目前的交易价格为 56 倍 EV/s。当然，没有宏观评估被考虑在内，所以请对这个练习持保留态度。</blockquote> Figure 13 - Financials &amp; Multiples Projections<blockquote>图 13 - 财务数据和多重预测</blockquote> <img src=\"https://static.tigerbbs.com/b47610548d3c3dd40fbf6fc5d8c66a60\" tg-width=\"640\" tg-height=\"281\" referrerpolicy=\"no-referrer\">Source: Convequity<blockquote>来源：Convequity</blockquote> In the 4.5 years from today to the end of FY26 [fiscal year end 31stJan], if the EV reaches $68bn then S’s stock will deliver a 36% annualized return. So, yes the multiples are insanely high but because of the extreme growth that will presumably remain high for a few years, even a sharp decline in multiples can still deliver sufficient investor returns.<blockquote>从今天起到 26 财年结束（1 月 31 日财年结束）的 4.5 年里，如果电动汽车达到 680 亿美元，那么 S 的股票年化回报率将达到 36%。因此，是的，市盈率高得惊人，但由于极端增长可能会在几年内保持高位，即使市盈率急剧下降，仍然可以为投资者带来足够的回报。</blockquote> CRWD’s LTM EV/S at the close of its IPO day [6thJune 2019] was 47x and it has peaked at c. 70x in Aug-19 and Feb-21. This highlights the richness in S’s current valuation. However, is S still worth an investment at the present time? Well, investors need to be aware of the melt-up and melt-down that has often occurred with high-growth tech IPOs, especially during the past 12-18 months. S could very well follow a similar path and climb much higher before falling down once the lockup period ends [27thDecember, 2021] and early investors can cash in some of their profits. Investors should also note that S employees are allowed to sell 15% of their shares as of 6thOctober 2021. For readers’ information, S’s number of shares in float to number of shares outstanding is just 17% - in contrast, a post lockup stock like CRWD has 86% in float.<blockquote>CRWD 在 IPO 当天（2019 年 6 月 6 日）结束时的 LTM EV/S 为 47 倍，并在 c.8月19日和2月21日70倍。这凸显了 S 目前估值的丰富性。然而，目前S还值得投资吗？好吧，投资者需要意识到高增长科技IPO经常发生的融化和融化，尤其是在过去12-18个月。一旦锁定期结束[2021年12月27日]，S很可能会遵循类似的路径，在下跌之前攀升得更高，早期投资者可以兑现部分利润。投资者还应注意，自 2021 年 10 月 6 日起，S 员工可以出售 15% 的股份。供读者参考，S 的流通股数量与流通股数量之比仅为 17%，相比之下，像 CRWD 这样的解禁后股票的流通股数量为 86%。</blockquote> Therefore, high-risk tolerant and/or short-term investors may want to consider a long position right now. Longer-term investors may prefer to let the liquidation unravel post Oct-21 and then post Dec-21 before buying shares. A compromise may be to buy a fourth of a position today and opportunistically add to it in the future. Personally, we’re waiting for a correction before opening a position. If the stock corrects c. 25% we’ll probably add half of the total planned allocation and then wait to see what happens after the lockup.<blockquote>因此，高风险承受能力和/或短期投资者现在可能需要考虑多头头寸。长期投资者可能更愿意让清算在 10 月 21 日之后解除，然后在 12 月 21 日之后解除，然后再购买股票。妥协可能是今天买入四分之一的头寸，并在未来机会主义地增加头寸。就我个人而言，我们正在等待回调后再开仓。如果股票修正c。25% 我们可能会增加计划拨款总额的一半，然后拭目以待，看看锁定后会发生什么。</blockquote> At first glance S’s extremely negative operating and FCF margins are alarming, but what investors should bear in mind is that S has the edge in technical and performance superiority and therefore they need to capitalize on this edge in the fastest way possible. CRWD is just 14 months older than S but has over 7x more ARR [Annual Recurring Revenue], which illuminates the differences in market approach. CRWD hit the market early and aggressively whilst S spent many years with their primary focus in R&amp;D before focusing on sales and marketing [S&amp;M]. Now S has a refined and market-leading product they need to maximize the GTM strategy as much as they can and catch up the market leader.<blockquote>乍一看，S 公司极其负面的营业利润率和自由现金流利润率令人担忧，但投资者应该记住的是，S 公司在技术和性能优势方面拥有优势，因此他们需要以最快的速度利用这一优势。CRWD 仅比 S 大 14 个月，但 ARR（年度经常性收入）却是 7 倍多，这说明了市场方法的差异。CRWD很早就积极地进入市场，而S在专注于销售和营销【S&amp;M】之前，花了很多年的时间主要关注R&amp;D。现在，S 拥有精致且市场领先的产品，他们需要尽可能最大限度地发挥 GTM 战略，并赶上市场领导者。</blockquote> Figure 14 - 1Q22 Margins<blockquote>图 14 - 2022年第一季度边际</blockquote> <img src=\"https://static.tigerbbs.com/f13e4a5a906b763afaa3476b59045597\" tg-width=\"187\" tg-height=\"81\" referrerpolicy=\"no-referrer\"><blockquote></blockquote> The current gross margin doesn’t exactly indicate a profitable long-term business model. However, investors should bear in mind that S’s competitiveness, especially in offering 365-day log storage, is a big suppressant at the moment. When S captures a larger share of the market, builds a solid reputation, and fully integrates Scalyr’s novel way of ingesting and storing log data, S can command a greater premium and simultaneously lower cost of revenue, and hence gross margin will rise accordingly. Interestingly, 2Q22 gross margin has already jumped c. 800 basis points since 1Q22, and no doubt the integration of Scalyr will have contributed to this. Throw into the mix that S will more than likely follow CRWD in shifting from cloud to colocation infrastructure once they reach a certain scale, the mature end-state gross margin for S will be close to 80%, in our opinion.<blockquote>目前的毛利率并不能完全表明长期商业模式是盈利的。不过，投资者应该记住，S 的竞争力，尤其是在提供 365 天日志存储方面，目前是一个很大的抑制因素。当 S 占据更大的市场份额，建立稳固的声誉，并完全整合 Scalyr 摄取和存储日志数据的新颖方式时，S 就能获得更高的溢价，同时降低收入成本，因此毛利率也会相应上升。有趣的是，2022年第二季度的毛利率已经跃升了c。自2022年第一季度以来 800 个基点，毫无疑问，Scalyr 的整合将对此做出贡献。我们认为，一旦达到一定规模，S 很可能会跟随 CRWD 从云转向主机托管基础设施，S 的成熟最终状态毛利率将接近 80%。</blockquote> Irrespective of the trading tactics, we think S has a strong chance to prove to be a good investment, even at the current multiple levels. We’ll list the pros to consider:<blockquote>无论交易策略如何，我们认为 S 有很大的机会被证明是一项良好的投资，即使在当前的多个水平上也是如此。我们将列出值得考虑的优点：</blockquote> <ul> <li>Currently, S has very low penetration - FY21 [fiscal year ending 31stJan] generated $93m of revenue and $161m of ARR [Apr-21] - in a market estimated to be worth between $20bn and $30bn by 2025.</li> <li>Similar to what CRWD has done, S will acquire more talent, expand its product’s capabilities, and expand into new markets - the IPO proceeds will go toward these objectives. This will expand an already large TAM for S.</li> <li>As we’ve presented in this report, S is the technical leader in the endpoint protection market. Technical leadership combined with mega aggressive S&amp;M expenditure [110% of revenue vs CRWD’s IPO year of 69% of revenue] will very likely be highly effective.</li> <li>Given the relatively low revenue base ($93m for FY21) and the autonomous, out-the-box nature of S’s AV, we would not be surprised if they regularly exceeded analyst consensus growth expectations (91% for FY22). From c. $100m in FY18, CRWD has grown c. 100% and this is with an AV solution that needs to be customized for many customers. Therefore, NTM growth of 100% is more probable than not, in our opinion – especially, with the S&amp;M aggressiveness.</li> </ul> Of course, stocks such as S pose substantial risks for investors, so we’ll outline some of the cons to consider:<blockquote><ul><li>目前，S 的渗透率非常低 - 2021 财年（截至 1 月 31 日的财年）产生了 9300 万美元的收入和 1.61 亿美元的 ARR [4 月 21 日] - 预计到 2025 年市场价值将在 200 亿至 300 亿美元之间。</li><li>与 CRWD 所做的类似，S 将获得更多的人才，扩大其产品功能，并拓展新市场--首次公开募股的收益将用于这些目标。这将扩展S已经很大的TAM。</li><li>正如我们在本报告中所介绍的，S 是终端保护市场的技术领导者。技术领先地位加上巨额的科技支出（占收入的 110%，而 CRWD 在 IPO 当年占收入的 69%）很可能会非常有效。</li><li>鉴于 S's AV 的收入基础相对较低（21 财年为 9300 万美元），以及其自主、开箱即用的特性，如果它们经常超过分析师一致的增长预期（22 财年为 91%），我们也不会感到惊讶。从c。2018 财年 1 亿美元，CRWD 增长了 c。100%，这是一个需要为许多客户定制的AV解决方案。因此，在我们看来，NTM 100% 的增长更有可能——尤其是在 S&amp;M 的进攻性下。</li></ul>当然，像 S 这样的股票会给投资者带来很大的风险，因此我们将概述一些需要考虑的缺点：</blockquote> <ul> <li>S is a company with fast-growing revenue but also growing losses. EBIT margin for FY20 and FY21 was -161% and -124%. FCF margin for FY20 and FY21 was -102% and -78%. So, it’s clear that cash flows in any DCF valuation are far into the future which makes the stock very vulnerable to changes in inflation and interest rate expectations – which is happening with frequency at present.</li> <li>Given the large losses, all of the stock’s future trajectory is dependent on the company beating revenue growth expectations. Consequently, any quarterly revenue misses will have a severe impact on the share price and it could take the stock a long time to recover.</li> <li>S’s technical superiority might not be insurmountable – we believe it's the best but groundbreaking is a stretch too far. Endpoint protection is a highly competitive market abundant with innovation, so it’s a possibility S could eventually lose a degree of its product leadership.</li> <li>CRWD may up the ante with ‘smoke and mirrors’ tactics and even more aggressive S&amp;M that specifically aims tolegallydefame S.</li> </ul> There are certainly a few pros and cons to consider. In our opinion, the optimal approach to gaining exposure to S is to1) wait for a correction,2) open a ¼, a 1/3, or a ½ of the total eventual position subject to the magnitude of the correction,3) add during risk-off episodes during the next several months, and4) leave some capital spare to buy some more after the effects of the lockup expiry have been fully reflected.<blockquote><ul><li>S是一家收入快速增长但亏损也在不断增长的公司。2020财年和2021财年的息税前利润率分别为-161%和-124%。2020财年和2021财年的自由现金流利润率分别为-102%和-78%。因此，很明显，任何 DCF 估值中的现金流都是未来很长一段时间的，这使得股票非常容易受到通胀和利率预期变化的影响--而这种情况目前经常发生。</li><li>鉴于巨额亏损，该股未来的所有发展轨迹都取决于公司能否超出收入增长预期。因此，任何季度收入未达预期都会对股价产生严重影响，并且该股可能需要很长时间才能恢复。</li><li>S 的技术优势可能并非不可逾越--我们相信它是最好的，但开创性还远远不够。终端保护是一个竞争激烈的市场，充满了创新，因此 S 最终有可能失去一定程度的产品领先地位。</li><li>CRWD 可能会加大赌注，采取 “烟雾和镜子 ”战术，甚至采取更激进的 S&amp;M，专门针对合法地诽谤S。</li></ul>当然有一些利弊需要考虑。我们认为，获得S风险敞口的最佳方法是1)等待修正，2)根据校正的大小，打开总最终头寸的1/4、1/3或1/2，3）在未来几个月的风险释放期间添加，以及4) 留出一些闲置资金，待禁售期到期的影响充分体现后再买入一些。</blockquote> The conundrum, as is with all pioneering software stocks, is that investors are usually forced to pay a hefty premium in order to participate in future price appreciation. This is because these types of stocks have a tendency to remain elevated for a long time. However, on the flip-side, S has not yet made it in the Global MSCI indices, therefore, bouts of risk-off sentiment have the potential to knock down the share price considerably more than stocks such as Cloudflare(NYSE:NET), Okta(NASDAQ:OKTA), Twilio(NYSE:TWLO), and Palantir(NYSE:PLTR). With this in mind, opportunities to buy big dips are likely but sustained elevated multiples and/or multiple expansion is also a strong possibility. Hence, the optimal approach, in our opinion, is to add a fraction after a correction [or even now for the highly risk-tolerant] and complete the position in the months ahead.<blockquote>与所有先锋软件股票一样，难题在于投资者通常被迫支付高额溢价才能参与未来的价格上涨。这是因为这些类型的股票往往会长期保持高位。然而，另一方面，S 尚未进入全球 MSCI 指数，因此，与 Cloudflare（纽约证券交易所股票代码：NET）、Okta（纳斯达克股票代码：OKTA）、Twilio（纽约证券交易所股票代码：TWLO）和 Palantir（纽约证券交易所股票代码：PLTR）。考虑到这一点，买入大幅下跌的机会是可能的，但持续升高的倍数和/或倍数扩张也是一个很大的可能性。因此，我们认为，最佳方法是在修正后增加一部分（甚至现在对于高度风险承受能力的人来说），并在未来几个月内完成头寸。</blockquote> Conclusion<blockquote>结论</blockquote> This report was not intended to bash CRWD’s technology because obviously it's extremely sophisticated and great at stopping threats. However, comparing to CRWD does highlight a degree of superiority in S’s approach to AV. And most importantly, from an investment perspective, S’s out-of-the-box solution certainly makes its business appear more scalable than CRWD. And this is exciting when considering CRWD’s super growth in spite of each deployment requiring a good dose of configuration tweaking and training.<blockquote>本报告无意抨击 CRWD 的技术，因为显然它极其复杂，在阻止威胁方面非常出色。不过，与 CRWD 相比，S 的 AV 方法确实具有一定程度的优越性。最重要的是，从投资的角度来看，S 的开箱即用的解决方案无疑使其业务显得比 CRWD 更具可扩展性。考虑到 CRWD 的超级增长，这令人兴奋，尽管每次部署都需要大量的配置调整和培训。</blockquote> The valuation is mega rich but investors need to accept that the premium is for a game-changing technical leader in a high-growth and very large market. Upside growth surprises could very well materialize given the scalability of S’s out-the-box solution.<blockquote>估值非常高，但投资者需要接受这样一个事实：溢价是对于一个高增长和非常大的市场中改变游戏规则的技术领导者来说。鉴于 S 开箱即用的解决方案的可扩展性，上行增长的惊喜很可能会实现。</blockquote>\n<div class=\"bt-text\">\n\n\n 来源：<a href=\"https://seekingalpha.com/article/4454383-why-sentinelone-is-better-than-crowdstrike\">Seeking Alpha</a>\n为提升您的阅读体验，我们对本页面进行了排版优化\n\n\n</div>\n</article>\n</div>\n</body>\n</html>\n","type":0,"thumbnail":"","relate_stocks":{"S":"SentinelOne, Inc","CRWD":"CrowdStrike Holdings, Inc."},"source_url":"https://seekingalpha.com/article/4454383-why-sentinelone-is-better-than-crowdstrike","is_english":true,"share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","article_id":"1111681724","content_text":"Summary\n\nSentinelOne is technically better than CrowdStrike according to the performance results of the MITRE ATT&CK Evaluation.\nSentinelOne leverages a highly autonomous, out-the-box solution that's proving to deliver a more scalable business model than CrowdStrike’s – evident in 2Q22 results.\nSentinelOne has a significant last-mover advantage and is using it to target CrowdStrike's weak spots.\n\nSundry Photography/iStock Editorial via Getty Images\nAbout this Report\nSince its June 19 IPO, CrowdStrike's(NASDAQ:CRWD)market cap has soared sixfold as the company has experienced near triple-digit revenue growth thanks to its aggressive marketing of its highly effective and differentiated endpoint protection solution. Sentinel(NYSE:S)is the new kid on the block with even faster growth – more than doubling annual revenues YoY in 2Q22 [released after market close yesterday]. S also claims NGAV (Next-Gen Antivirus) superiority and goes head-to-head with CRWD in ultra-aggressive marketing.\nGiven S’s sky-high valuation of 92x NTM EV/S at the time of writing, it's difficult to rationalize an investment - by pretty much all measures the stock is insanely overvalued. Therefore, this report is largely about outlining why we believe S is technically superior to CRWD, and if you as investors are convinced, then you can speculate on your own growth and stock price trajectories using CRWD’s recent history as an anchor. We provide some financials and multiples projections in the Valuation Considerations section toward the end of the report.\nWe should make clear that any criticism of CRWD is in direct comparison to S. CRWD are still way better than legacy AV vendors – there's no denying that. And hopefully, this report may serve as somewhat of a framework for evaluating other EPP/EDR vendors that may catch your attention.\nThe Evolution of AV Industry\nThere are quite a few acronyms connected to the antivirus [AV] software industry to become familiar with before delving into what CRWD and S actually. The AV industry began life using signature databases followed by two decades of using signature databases with various tweaks. Then around 2011, EPP [Endpoint Protection] and EDR [Endpoint Detection & Response] became popular, ushering in the era of NGAV [Next-Gen Antivirus]. XDR [Extended Detection and Response] is often referred to as the second wave of NGAV that correlates broader and disparate data sources to enhance the detection of threats, and improve investigation and responses. The following diagram - from SentinelOne with additional annotation by ourselves – provides a useful high-level view of where the AV industry has been and where it is today. We’ll elaborate on this diagram in the following sections.\nFigure 1 - Evolution of the AV Industry\nSource: SentinelOne presentation, Convequity modification\nSignature-Based AV\nIn 1987, the late John McAfee released the first commercial AV [antivirus] software to be installed on desktops. It was a signature-based AV, which means it would check the signature of all inbound files to see if they matched a known malicious signature in the database. If there was a match then the AV would block and delete the file.\nMost cyber-attacks involve the hacker attempting to land a malicious file on a user’s device. The file contains a virus that, when triggered with a click by the user, installs itself onto the device. From there the virus can do various things, though usually, the main objective is to ascertain the device’s network connections and send itself to critical systems of an organization.\nEvery file has a unique signature that looks like a random combination of letters and numbers. The combination of letters and numbers is produced by a hashing algorithm. For example, a file containing only the text of “We built this city!” and the hashing was based on the SHA256 hash algorithm (one of the most secure and efficient hashes), the signature will be the following:\nc0fed07bbfcd9ea317d495d0c9b43021ac839f699cff44f3d3bf60993df66467\nThe hashing algorithm converts a file with any amount of content to a fixed-length signature – in the case of the SHA256 hashing algorithm, it is 64 characters long, also known as 64 bytes because 1 character equals 1 byte.\nIt’s also worth noting that changing 1 character or even flipping 1 bit [8 bits in 1 byte] from 0 to 1 or vice versa, will completely change the signature. Removing the exclamation mark so the text reads “We built this city” produces this 64-byte signature:\n1b12cb77bb08ac8c826795eab8389346b1f36c9f20b7841f7552d12c7fbf4c27\nVisit this website to hash your own input or alternatively you can get the hash for any file you upload.\nThroughout the 1990s it became apparent that signature-based AV had some fundamental shortcomings. Here are some of them:\n\nCybercriminals can change one line of code to completely change the signature of the virus, and as a result, evade detection. This puts the hacker vs AV battle economics firmly in the favor of the former, because it takes a lot of time and computing resources to detect and confirm a new virus variant.\nAs the number of malicious files grows, so does the signature database. The database resides on the endpoint so as it grows it consumes more disk space, more CPU, and more memory.\nImmediately after the AV is installed it becomes out of date because there's a continual creation of new viruses and variants of existing viruses. In essence, even the best signature-based AV provides < 100% protection.\n\nTo compensate for the < 100% protection, existing and new AV vendors came to the market with tweaks and variations of the signature-based model.\nDuring the 1990s and 2000s, the early attempts to make up for the weaknesses of signature-based AV included:\n\nFirewall vendors such as Check Point Software(NASDAQ:CHKP), F5 Networks(NASDAQ:FFIV), and Fortinet(NASDAQ:FTNT)leveraged their dominant status within the corporate network to improve signature-based AV solutions. They used their deep packet inspection capabilities at the gateway of the network to inspect inbound data packets transmitting the malicious files as well as outbound connections triggered by the virus. This added more context to help sniff out the malicious inbound files and attempts to exfiltrate data.\nBit9, founded in 2003, (later renamed Carbon Black and now acquired by VMware) introduced app whitelisting, whereby only authorized apps are allowed to run. This turned out to be highly restrictive and unproductive as apps change and upgrade rapidly.\nFireEye(NASDAQ:FEYE), founded in 2004, introduced sandboxing, whereby an unknown suspicious app or file would be executed in an isolated environment and monitored closely for any malicious activity. Although game-changing at the time, its effectiveness didn’t last long because hackers found ways to detect the sandbox environment to then trigger the virus into stealth mode and continue the attack at a later point in time.\n\nCollectively, these attempts, while lacking sustainability, did an alright job at filling in the gaps, and generally speaking, provided adequate protection during the 1990s and 2000s.\nThings changed, however, at the dawn of the iPhone in 2007. As the attack surface expanded so did the attack cadence, and computing experienced an exponential rise in the variety of viruses and the signatures connected to those viruses. The number of forms in which a virus would reside pre-execution also proliferated – scripts (code)began appearing in website photos, PDF add-ons, Excel VBA, and many other forms, waiting to be triggered.\nOn the whole, signature-based AV has proven not to scale very well and in the modern computing landscape does not provide adequate protection.\nNext-Gen AV\nFrom 2007 to 2013, a new wave of AV startups emerged with a novel approach to AV. Some Next-Gen AV [NGAV] startups focused on the EPP [Endpoint Protection] – still aiming to perform the prevention, detection, and response on the end-user device itself, but by using static AI techniques to obviate the need for a signature database. Other NGAV startups focused on the EDR [Endpoint Detection and Response] side - whereby most of the protection was delivered via the cloud and therefore the EPP software component could be lightweight and serve merely as a sensor rather than an agent that can perform the full requirements of AV.\nThere are pros and cons to singularly focusing on either EPP or EDR. EPP avoids the shortcomings of signature databases, however, by running static AI on the endpoint without the big picture from the cloud, it's less flexible and less effective over the long term. EDR maintains the complete global threat picture because it’s powered by the cloud, but the downside is the deluge of data is overwhelming for security analysts and leads to many false alerts.\nAs the shortcomings of EPP and EDR became increasingly apparent, NGAV vendors began to shift along the EPP/EDR spectrum to improve their products. The screenshot taken from S’s demo presentation summarizes the direction the vendors and the market moved from 2014 through to 2019.\nFigure2- Market Shifts: EPP vs EDR\nSource: youtube.com\nXDR [Extended Detection & Response], first coined by Nir Zuk of Palo Alto Networks(NYSE:PANW)in 2018, is now the latest technology that leading vendors are striving toward. It blends EPP and EDR together whilst also adding SOAR [Security Orchestration, Automation & Response], SIEM [Security Information & Event Management], and NTA [Network Traffic Analysis]. The objective of XDR is to collect and correlate data from endpoints, network points, servers, cloud workloads, and emails to enhance detection capabilities and improve protection whilst also increasing productivity and lowering the overall cost of security software ownership.\nCrowdStrike Intro\nCRWD, founded in 2011, came to the market with EDR, which at the time was a radical approach to AV. Instead of destroying malicious files with AV software residing on the device, CRWD destroyed them from the cloud.\nThey achieved this by having a super lightweight sensor with no database [consuming only 35 MB of storage space whereas signature-based AV can consume 4GB] installed on the endpoint. This sensor continually collects the logs (activities) related to the files on the device (i.e., what files are downloaded, open, from where, how, what time, what recent patches have been made?) and sends this telemetry data to the CRWD cloud. CRWD analysts collect this data from all CRWD devices and check it against a giant signature database in the cloud looking for matches in techniques. For example, the CRWD database contains a previous technique whereby opening a file from IP address 1.1.1.1 executed XXX.exe which was a piece of malware. As CRWD analysts recognize this technique being used again, they will block it, gather more intel, delete the file from the cloud, and share the insight across all endpoints.\nHowever, it should be noted that while CRWD can detect a potential virus within seconds, it doesn’t complete its response and eliminate the threat until hours later. The complex nature of EDR delivers a high number of false alerts that need to be investigated by a client organization's analysts and CRWD's analysts alike. Therefore, CRWD does take considerably longer to completely eliminate the threat. However, they're able to contain the spread of the threat until a full investigation is complete. S, on the other hand, can detectandrespond within seconds thanks to its greater degree of automation and hybrid EPP/EDR approach.\nThe key benefit of this approach is that there are no constraints on the size of the database, as it’s located in a centralized cloud. Moreover, this EDR approach obviates the need to periodically push out software updates to the endpoints to include the latest signature database, again because the database is located in the cloud. The other benefit is that the aggregated threat hunting ensures new viruses and variants and attack methods are identified faster. In essence, this AV model makes the front-end software simple and light [collecting evidence] and makes the back-end operations complex, detailed, and shared across all devices - generating insights for all. The essence of EDR is to restrain from doing early prevention, and instead wait, observe, and collect more intel regarding the threats, and respond accordingly. And this approach inspired the name of CRWD’s flagship platform Falcon.\nSentinelOne Intro\nS, founded in 2013, is the youngest among established NGAV vendors, and this gives it a great last-mover advantage. Instead of heavily focusing on EDR or EPP, S has utilized them both to cover all major aspects of the endpoint security to deliver the so-called XDR. Similar to CRWD, S deploys a lightweight software agent with no database on the endpoint [200 MB of disk space]. It does more than CRWD’s sensor, however. It runs static AI to establish baseline file and device behavior in which to identify anomalous activity, relating to when the file was received and how long the file was open, for example. If the file passes the rigors of static AI analysis, the user is allowed to use the file but the agent will continue to monitor closely. The agent will apply a more dynamic AI to detect any suspicious lateral movement emanating from the file – e.g., when Word opened it triggered PowerShell to open, or a command is triggered to reach out to the Internet. At any point the agent determines there's malicious activity, it will kill the virus and clean up the environment. It's this level of autonomous capability in the EPP that differentiates S from other NGAV vendors.\nDespite the sophistication of such AI-powered detection methods, some types of malwares can still evade detection. Polymorphic malware variants change their own features, such as file names and hashes, to bypass detection methods. Techniques such as code obfuscation make malicious code hard to find and/or understand. Therefore, some threats manage to bypass the front-end, or EPP, defenses, necessitating the need for EDR.\nSimilar to CRWD, S utilizes back-end, or EDR, for deeper visibility threat hunting. The data collected is used by both S’s own analysts for global threat hunting,andits clients’ analysts working in Security Operation Centers [SOC]. On the EDR side, compared to CRWD the key differentiator is that S uses a \"story\" technique to add more context relevancy which leads to fewer alerts for analysts to handle. S have named this ‘story’ technique TrueContext ID.\nTaken from an S demo presentation, the screenshot below compares TrueContext ID to previous context-building techniques - Indicators of Compromise [IOC] and Indicators of Attack [IOA] – and the more typical existing EDR solutions – Tactics, Techniques & Procedures [TTP]. The slide uses the analogy of piecing together the description of a person to illustrate piecing together the description of a malicious action.\nFigure 3 - Comparing TrueContext ID to Typical EDR Methods\nSource: youtube.com\nIOCs look like random descriptors that would need substantial effort to comprehend. IOAs are slightly more organized but still require effort to form the full picture. TTPs actually describe the bad action and offer useful context but don’t explain what happened before that led to the bad action. TrueContext ID takes it a whole level further by not just describing the traits of the bad action but also puts together a story of the events that led to the bad action – the DNA strand implies it knows everything about a given action.\nFor example, there has been a connection made to an external FTP server [a server for transferring files] >>> this links back to some registry files that were archived in a new hard drive location >>> this links back to an unusual command-line execution in PowerShell >>> it transpires that the opening of PowerShell was triggered by the opening of an Office document >>> deeper analysis indicates the document contained a brand-new unknown virus >>> did the user single or double click it or did it download automatically? >>> where did it come from? >>> did it come from an email or a USB drive? >>> is the email address and source IP address associated with previous malicious activity? >>> or, when was the USB drive inserted on the device?\nThe above example shows a bad actor attempting to transfer a copy of the critical OS files [registry files], perhaps to learn more about the target organization in order to plan a devastating future attack, or something more imminent. TrueContext ID connects all the data points from the static and dynamic AI detection methods and synthesizes them with its own globally collated intelligence to string together a timeline of sequential events. And this is presented to SOC analysts either in tabular or graphical form. Putting together a chain of events like this ensures only relevant context is presented, which radically reduces the number of alerts and enables swift investigation and remediation.\nCRWD investors and advocates may be somewhat confused as to why S’s storing techniques are a technical competitive advantage. Indeed, CRWD has an event timelining feature that is core to their EDR solution – they refer to it as \"maps.\" However, generally, a client organization’s SOC analysts need to be tier 2 or 3 certified for using CRWD’s Falcon EDR solution – one reason for this being the high number of false alerts that an analyst needs to navigate, which is far easier for the more experienced.\nIf a client organization doesn’t have a SOC team and hence cannot conduct the threat investigation on CRWD and leverage its EDR component, then they can just run it and let it handle things by the default settings or use the MDR [Managed Detection & Response] option whereupon CRWD experts will do the legwork. But when it comes to SOC operations, S’s storing technique appears to have an edge over CRWD because it radically reduces the alerts and false positives and, on the whole, makes life easier for SOC analysts.\nTo summarize, S can deliver fully automated detection, response, and system recovery all within the EPP software itself, but also has the EDR-based TrueContext ID technology that can catch more sophisticated attacks and help SOC analysts triage with far fewer false positive alerts. With this in mind, it appears that S has the edge over CRWD on both the EPP and EDR sides of the market. Moreover, as we’ll show in the presentation of MITRE ATT&CK performance results, S’s out-of-the-box solution that leverages greater automation is likely to offer greater scalability than CRWD’s. We think this greater scalability is shining through in the recent 2Q22 results whereby S generated 127% YoY growth.\nKey Differences Between S and CRWD\nWe’ve listed 11 aspects of endpoint protection whereupon S and CRWD differ by substantial margins. And it may seem overly biased [though we don’t have a position in S yet], but all 11 aspects are in favor of S outcompeting CRWD. We’ll elaborate on a few of these in the following sections.\nSource: Convequity\nBrains of Software\nCRWD: As already alluded, the brain of CRWD is in the cloud only and utilizes EDR to understand the global landscape of threats. The very nature of this cloud-based EDR approach requires the computation of petabytes of data that quickly detects potential threats but also generates large numbers of false alerts. The notion of the false alert volumes necessitates the need for thorough investigation which is why the response time takes hours instead of seconds. Ultimately, CRWD’s approach is rather labour-intensive but is still more autonomous than legacy signature-based AV.\nS: The brain of S is in a hybrid form that utilizes both automation and AI in the front-end EPP and cloud-powered global intel in the back-end EDR, and blends the two harmoniously together. The storying technique applied in TrueContext ID radically reduces the number of alerts and the manual investigation for the EDR side of operations. So, as aforementioned, for the high majority of threats, this results in full automated response and recovery [system cleanup] within seconds, and results in relatively less manpower requirements [versus CRWD] for the more sophisticated attacks. Moreover, S can work offline and catch the majority of threats whereas CRWD must be connected online to work.\nOperation of AV\nWe’ve already touched on S’s software being highly autonomous while CRWD’s software requires human experts to be effective. This contrast offers an apt segue into taking a look at which approach is ultimately more effective. So, we’ll use this section to review the MITRE ATT&CK endpoint protection test results.\nMITRE is an independent, federally funded, not-for-profit R&D organization that periodically performs attacks against leading security vendors’ software solutions. MITRE has long been the authority in cybersecurity testing, and in 2018, they launched the MITRE ATT&CK Evaluations, where MITRE evaluates the efficacy of cybersecurity products. S, CRWD, and PANW participated in the series of tests (2019, 2020, and 2021) and we’ll present the two most recent.\nIn the MITRE ATT&CK tests, vendors are assessed on how effective they are in stopping tactics and techniques. A Tactic is a bad actor’s objective – for example, to acquire a username and password, acquire remote control of the system, or exfiltrate data. A Technique is a method deployed to achieve the objective – for example, cross-site scripting [taking advantage of website vulnerabilities to lure victims into submitting their login details]. There are usually several techniques included in each tactic.\nFigure 4 - Tactics & Techniques\nSource: medium.com\nRather confusingly to the layman, MITRE presents the performance results in references to Steps and Substeps instead of Tactics and Techniques. So, for high-level knowledge purposes, Steps are closely associated with Tactics and Substeps are closely associated with Techniques. The following diagram from SentinelOne is useful to solidify the levels of detections.\nFigure 5 - Analytic Detections: Tactics/Steps and Techniques/Substeps\nSource: SentinelOne on YouTube, Convequity modification\nThe 2020 test results [based on techniques from APT29, a hacker group linked to Russian intelligence agencies] are shown below. The first chart shown shows that S led the pack in regards to overall detections, aka Substeps. The chart shows the number of detections out of the 135 Substeps for each vendor.\nFigure 6 – MITRE ATT&CK 2020 Performance Result: Total Detections\nSource: elastic.co/blog/\nThe next two charts show the Tactic and Technique detections for the MITRE AV test. As a gentle reminder, Tactics are closely associated with Steps and Techniques are associated with Substeps.\nFigure 7 - MITRE ATT&CK 2020 Performance Result: Tactic and Technique Detections\nSource: elastic.co/blog/\nObserving that S had the best performance in Tactic detections and the second-best performance in Technique detections, aligns with the storing capability of TrueContext ID. A Tactic is a Step or objective, such as data exfiltration. A Technique is a Substep or method which is one of the Substeps required to achieve the Tactic, such as connecting to an external server in the exfiltration example. TrueContext ID has been designed to provide both high-level and granular detail of each attack, and therefore, it’s understandable as to why S has performed the best across Tactics and Techniques.\nInterestingly, the performance rankings in the following year [2021] are very similar. In the 2020 test, it looks like CRWD detected a total of c. 115 Substeps versus S’s c. 130. And in 2021 it looks like CRWD detected c. 150 versus S detecting c. 175. So, the ratio is very similar between the two rivals in both years.\nFigure 8 - MITRE ATT&CK 2021 Performance Result: Total Detections\nSource: elastic.co/blog/\nIt would be hard to dispute that S has a better performing AV than CRWD based on the results presented in the previous charts. Though what creates further distance between S and CRWD are the configuration changes made by the vendors before MITRE conducted its test – which we’ll cover next.\nDeployment\nMuch of S’s marketing outlines how their software works straight out-of-the-box. This is a common claim in competitive software markets, though in S’s case, it does appear to be largely true.\nThe next chart shows how many configurations changes each vendor made in preparation for the 2020 test. S didn’t change anything – their AV software was applied out-of-the-box. CRWD, on the other hand, made 25 tweaks to optimize their AV for the test. This fits in very well with the earlier discussion that CRWD is designed for enterprises with more experienced security analysts [SOC 2 and 3 analysts] – more on this later. These configuration changes also underscore what we’ve outlined in regards to S being way more automated than CRWD. CRWD’s lack of automation means it can’t work out-of-the-box with high effectiveness – the AV has been designed for heavy human involvement.\nFigure 9 - MITRE ATT&CK Configuration Changes for 2020 Test\nSource: youtube.com\nSo, despite CRWD making 25 tweaks to its AV software versus S’s zero tweaks, the market-leading endpoint protection provider still underperformed S by considerable margins in the MITRE test. And it’s worth reminding ourselves that S will have performed using AI and automation, whilst CRWD will have performed with heavy involvement from its own cloud-based SOC 2/3 analysts. Moreover, to add further context, this is the first test CRWD has participated in wherein it has performed acceptably well – previous tests by MITRE and NSS Labs yielded very poor results for CRWD. When you add these factors together, it really does open up a significant gap in the software capability between S and CRWD.\nIt’s also refreshing to note that PANW also chose not to make any changes, and they achieved a top four overall total detection performance and finished in the top half in the Tactic and Technique components of the test. We’ve reiterated for a long time now that Palo Alto Networks is simply the best at cybersecurity, and considering that endpoint protection isn’t even their core/original expertise, this is a huge testament to that.\nExpertise Requirements\nFor SMBs that don’t have a SOC [Security Operations Centre], have relatively simpler security needs, and for some reason may be less of a hacker target, then deploying CRWD in its default settings shouldn’t be much of an issue and is way better than opting for legacy AV. Indeed, a simple deployment across an all-Windows organization is very simple. Alternatively, if an all-Windows SMB has more nuanced security needs but doesn’t have a SOC, then CRWD’s MDR [Managed Detection & Response] service will be deployed and work smoothly with negligible issues. Expertise becomes a consideration in the case where an enterprise with its own SOC [and more complex requirements] and/or non-Windows operating systems (i.e., Linux and/or Mac) wants to install CRWD.\nAs highlighted in the previous section, to maximize CRWD and protect against a full range of sophisticated attack techniques, substantial configuration tweaks are required. SOC 2 and 3 analysts will comfortably be able to handle this, however, SOC 1 and/or IT generalists will find it difficult and are likely to require assistance or make a mistake. Additionally, a higher-level of expertise is necessary to swiftly navigate through the barrage of alerts received with CRWD. Analysts need to coordinate Falcon with Splunk’s legacy SIEM to correlate data and gain the fullest threat landscape picture [this will eventually change, however, once they fully integrate the Humio acquisition]. Again, this requires a higher-level of expertise – SOC 2 or 3.\nThen if you add in non-Windows OS, deployment complicates further. Yes, in the past 12 or so months CRWD has better adapted Falcon to Linux and Mac, though a high-level of expertise is required to ensure a smooth deployment following many years of incompatibility issues.\nSo, because of the config changes and the multi-OS environments, typically SOC 2 or 3 analysts are required for the CRWD enterprise use case.\nIn contrast, as evident in the MITRE test, S works right out of the box and hence IT generalists can get on fine with it. TrueContext ID - the storing feature - radically reduces the volume of alerts to enable more efficient threat hunting and remediation and hence making for a more user-friendly interface for SOC 1 and IT generalists to get along with. And, S has built its Singularity Platform with Windows, Linux, and Mac in mind right from the outset [a by-product of S’s last-mover advantage and taking more time in R&D before pumping the GTM strategy], delivering feature parity across all platforms – which again, means lower expertise is required to complete a successful multi-OS environment.\nTarget Market and Pricing\nAs previously mentioned, CRWD and S can be easily deployed for simple use cases associated with certain SMBs. Where we view S as having a notable larger target market is in the more complicated use cases associated with certain SMBs and enterprises. Taking into account the aforementioned expertise requirements, for complex use cases, S appears as the more attractive solution – by a wide margin. In using S over CRWD, SOC two and three analysts can work with more productivity, and SOC 1 and IT generalists can deploy and manage the software with little hassle. This opens up a wider TAM for S vs. CRWD.\nSo, at the low-end of the market, comparing S and CRWD is trivial, because for simple use cases CRWD’s default settings are adequate. But CRWD is expensive. Our research on Reddit forums indicates that CRWD is 2x to 3x more expensive than S, and from this, we infer that CRWD is or will eventually price themselves out of the market segment in which they are most technically competitive.\nCRWD maximizes the land-and-expand sales model as aggressively as any other software vendor. They sell the Falcon platform in modules; implementing a bare minimum number of modules in the beginning and then aggressively upselling/cross-selling other modules. Though many of the other modules are a necessity for full protection. Usually, most clients need to bundle together NGAV which is the Falcon Prevent module, EDR which is the Falcon Insight module, and device control which is the Falcon Device Control module. However, in pursuit of greater DBNR [Dollar-based Net Retention], CRWD separated device control into an independent module.\nFigure 10 - CRWD's Falcon Platform Modules\nSource: CrowdStrike\nThe combined pricing is well beyond the price quote from legacy AV vendors – which is absolutely fine given CRWD is better. Though, according to Reddit forum discussions, those clients that mentioned \"SentinelOne\" to CRWD salespeople immediately received a ~50% discount.\nCRWD’s module-based land-and-expand ploys are most evident in the immediate quarters post-IPO. A cynical view, but reading between the lines it looks like a nice stock-based compensation booster was at play for the year-end of FY19.\nFigure 11 - CRWD's DBNR\nSource: CrowdStrike\nIn a clear attempt to differentiate and do things better than CRWD, S doesn’t sell individual modules. Instead, it sells its full Singularity Platform as bundles across three tiers – Core, Control, and Complete. It appears that on a like-for-like, S’s bundles are ~30% even after CRWD’s discounts.\nFigure 12 - S's Singularity Platform Tiered Bundles\nSource: SentinelOne\nInsincere sales ploys like what CRWD has been doing only last for so long. Eventually, customers catch onto what is happening – evident by discussion on Reddit. And it feels like that day has already come, probably brought to the fore by S’s differentiated bundle pricing.\nTo summarize, CRWD effectively competes with S on a technical basis at the lower-end of the market involving simple use cases but they are risking pricing themselves out of the market. At the higher-end of the market involving complex use cases, it looks like S is both technically better and more affordable than CRWD. Additionally, S will store logs for a maximum of 365 days whilst CRWD’s max is 90 days. All of this strongly aligns itself with S’s founder and CEO Tomer Weingarten claiming that S wins 70% of head-to-heads with CRWD.\nIn comparison to CRWD, not only will S’s technical superiority and competitiveness help it penetrate more of the TAM whilst also widening the TAM, being able to deploy in the cloud and on-prem further expands their customer reach vis-à-vis CRWD.\nOn the whole, S can target a broader market and based on its technical/performance superiority plus aggressive but transparent pricing, can outcompete CRWD in its own TAM.\nArchitecture\nBefore we move onto valuation considerations, we’ll briefly share our views and CRWD’s and S’s software architecture. In all honesty, we can’t find much information related to who has the more modern architecture, but you’ve probably guessed already that we think S has the edge here. The cadence in which both vendors release new features and modules is testament that both operate within advanced microservice architectures. However, we assume, that as CRWD partners with a legacy vendor like Splunk for SIEM and log management, its architecture is probably semi-dated and that there has been an absence of major revamp in recent years. This line of thinking could be kind of validated by the number of years it’s taken for CRWD to overhaul its Mac and Linux sensors.\nIt’s interesting how in March 2021 CRWD bought Humio for $392m in cash and equity just one month after S bought Scalyr for $155m in cash and equity. This may be reading into things too much, but some may view it as a sign of desperation to shore up an aging architecture and move away from legacy SPLK.\nAny differences in the modernity of the two NGAV architectures will very likely widen in the coming quarters and years. CRWD is only 14 months older than S, but because it grew early and superfast, it will have accumulated way more technical debt. And issues that come with technical debt will only be amplified as a $60bn company like CRWD needs to continue aggressively expanding its TAM via acquisitions in order to keep the mega growth story alive.\nAs all software firms grow, they lose their nimbleness but it will happen a lot sooner to CRWD than it will to S - and this gives another upper hand to S in years to come.\nS’s Edge Summary\nAt a high level, the key competitive advantages S has over CRWD can be summarized into four fundamental drivers:\n\nBetter product effectiveness.\nBetter user experience.\nBetter pricing.\nA more scalable business model afforded by a highly automated out-the-box solution.\n\nValuation Considerations\nS’s IPO, on June 30, was the highest-valued cybersecurity IPO ever. The stock finished its IPO day 21% up, closing at $42.50/share with a LTM EV/S of 100x. At the time of writing the stock is trading at $68/share with a LTM EV/S of 163x and a NTM EV/S of 92x.\nBelow are some projections going out to FY26. FY22 revenue is anchored to management’s guidance. In the 2Q22 earnings presentation released yesterday, management also gave long-term targets that included a mature gross margin of 75%-80%, hence why we’ve made it so gross margin is 78% in FY26. We’ve used CRWD’s current TTM FCF margin as a rough long-term estimate of S’s in FY26.\nGuessing the multiple declines is kind of an unchartered territory because of the unprecedented level and sustainability of multiples we’re witnessing in the COVID-era market. Some may argue a decline to a 53x EV/S by FY26 is not steep enough, and that might be right. Though in FY26 we expect revenue to be at similar levels to CRWD’s today and CRWD is currently trading at 56x EV/S. Of course, no macro assessment is being taken into account so please take this exercise with a pinch of salt.\nFigure 13 - Financials & Multiples Projections\nSource: Convequity\nIn the 4.5 years from today to the end of FY26 [fiscal year end 31stJan], if the EV reaches $68bn then S’s stock will deliver a 36% annualized return. So, yes the multiples are insanely high but because of the extreme growth that will presumably remain high for a few years, even a sharp decline in multiples can still deliver sufficient investor returns.\nCRWD’s LTM EV/S at the close of its IPO day [6thJune 2019] was 47x and it has peaked at c. 70x in Aug-19 and Feb-21. This highlights the richness in S’s current valuation. However, is S still worth an investment at the present time? Well, investors need to be aware of the melt-up and melt-down that has often occurred with high-growth tech IPOs, especially during the past 12-18 months. S could very well follow a similar path and climb much higher before falling down once the lockup period ends [27thDecember, 2021] and early investors can cash in some of their profits. Investors should also note that S employees are allowed to sell 15% of their shares as of 6thOctober 2021. For readers’ information, S’s number of shares in float to number of shares outstanding is just 17% - in contrast, a post lockup stock like CRWD has 86% in float.\nTherefore, high-risk tolerant and/or short-term investors may want to consider a long position right now. Longer-term investors may prefer to let the liquidation unravel post Oct-21 and then post Dec-21 before buying shares. A compromise may be to buy a fourth of a position today and opportunistically add to it in the future. Personally, we’re waiting for a correction before opening a position. If the stock corrects c. 25% we’ll probably add half of the total planned allocation and then wait to see what happens after the lockup.\nAt first glance S’s extremely negative operating and FCF margins are alarming, but what investors should bear in mind is that S has the edge in technical and performance superiority and therefore they need to capitalize on this edge in the fastest way possible. CRWD is just 14 months older than S but has over 7x more ARR [Annual Recurring Revenue], which illuminates the differences in market approach. CRWD hit the market early and aggressively whilst S spent many years with their primary focus in R&D before focusing on sales and marketing [S&M]. Now S has a refined and market-leading product they need to maximize the GTM strategy as much as they can and catch up the market leader.\nFigure 14 - 1Q22 Margins\n\nThe current gross margin doesn’t exactly indicate a profitable long-term business model. However, investors should bear in mind that S’s competitiveness, especially in offering 365-day log storage, is a big suppressant at the moment. When S captures a larger share of the market, builds a solid reputation, and fully integrates Scalyr’s novel way of ingesting and storing log data, S can command a greater premium and simultaneously lower cost of revenue, and hence gross margin will rise accordingly. Interestingly, 2Q22 gross margin has already jumped c. 800 basis points since 1Q22, and no doubt the integration of Scalyr will have contributed to this. Throw into the mix that S will more than likely follow CRWD in shifting from cloud to colocation infrastructure once they reach a certain scale, the mature end-state gross margin for S will be close to 80%, in our opinion.\nIrrespective of the trading tactics, we think S has a strong chance to prove to be a good investment, even at the current multiple levels. We’ll list the pros to consider:\n\nCurrently, S has very low penetration - FY21 [fiscal year ending 31stJan] generated $93m of revenue and $161m of ARR [Apr-21] - in a market estimated to be worth between $20bn and $30bn by 2025.\nSimilar to what CRWD has done, S will acquire more talent, expand its product’s capabilities, and expand into new markets - the IPO proceeds will go toward these objectives. This will expand an already large TAM for S.\nAs we’ve presented in this report, S is the technical leader in the endpoint protection market. Technical leadership combined with mega aggressive S&M expenditure [110% of revenue vs CRWD’s IPO year of 69% of revenue] will very likely be highly effective.\nGiven the relatively low revenue base ($93m for FY21) and the autonomous, out-the-box nature of S’s AV, we would not be surprised if they regularly exceeded analyst consensus growth expectations (91% for FY22). From c. $100m in FY18, CRWD has grown c. 100% and this is with an AV solution that needs to be customized for many customers. Therefore, NTM growth of 100% is more probable than not, in our opinion – especially, with the S&M aggressiveness.\n\nOf course, stocks such as S pose substantial risks for investors, so we’ll outline some of the cons to consider:\n\nS is a company with fast-growing revenue but also growing losses. EBIT margin for FY20 and FY21 was -161% and -124%. FCF margin for FY20 and FY21 was -102% and -78%. So, it’s clear that cash flows in any DCF valuation are far into the future which makes the stock very vulnerable to changes in inflation and interest rate expectations – which is happening with frequency at present.\nGiven the large losses, all of the stock’s future trajectory is dependent on the company beating revenue growth expectations. Consequently, any quarterly revenue misses will have a severe impact on the share price and it could take the stock a long time to recover.\nS’s technical superiority might not be insurmountable – we believe it's the best but groundbreaking is a stretch too far. Endpoint protection is a highly competitive market abundant with innovation, so it’s a possibility S could eventually lose a degree of its product leadership.\nCRWD may up the ante with ‘smoke and mirrors’ tactics and even more aggressive S&M that specifically aims tolegallydefame S.\n\nThere are certainly a few pros and cons to consider. In our opinion, the optimal approach to gaining exposure to S is to1) wait for a correction,2) open a ¼, a 1/3, or a ½ of the total eventual position subject to the magnitude of the correction,3) add during risk-off episodes during the next several months, and4) leave some capital spare to buy some more after the effects of the lockup expiry have been fully reflected.\nThe conundrum, as is with all pioneering software stocks, is that investors are usually forced to pay a hefty premium in order to participate in future price appreciation. This is because these types of stocks have a tendency to remain elevated for a long time. However, on the flip-side, S has not yet made it in the Global MSCI indices, therefore, bouts of risk-off sentiment have the potential to knock down the share price considerably more than stocks such as Cloudflare(NYSE:NET), Okta(NASDAQ:OKTA), Twilio(NYSE:TWLO), and Palantir(NYSE:PLTR). With this in mind, opportunities to buy big dips are likely but sustained elevated multiples and/or multiple expansion is also a strong possibility. Hence, the optimal approach, in our opinion, is to add a fraction after a correction [or even now for the highly risk-tolerant] and complete the position in the months ahead.\nConclusion\nThis report was not intended to bash CRWD’s technology because obviously it's extremely sophisticated and great at stopping threats. However, comparing to CRWD does highlight a degree of superiority in S’s approach to AV. And most importantly, from an investment perspective, S’s out-of-the-box solution certainly makes its business appear more scalable than CRWD. And this is exciting when considering CRWD’s super growth in spite of each deployment requiring a good dose of configuration tweaking and training.\nThe valuation is mega rich but investors need to accept that the premium is for a game-changing technical leader in a high-growth and very large market. Upside growth surprises could very well materialize given the scalability of S’s out-the-box solution.","news_type":1,"symbols_score_info":{"S":0.9,"CRWD":0.9}},"isVote":1,"tweetType":1,"viewCount":2793,"commentLimit":10,"likeStatus":false,"favoriteStatus":false,"reportStatus":false,"symbols":[],"verified":2,"subType":0,"readableState":1,"langContent":"EN","currentLanguage":"EN","warmUpFlag":false,"orderFlag":false,"shareable":true,"causeOfNotShareable":"","featuresForAnalytics":[],"commentAndTweetFlag":false,"andRepostAutoSelectedFlag":false,"upFlag":false,"length":29,"subscribersOnly":false,"subscribersOnlyAccessible":false,"xxTargetLangEnum":"ORIG"},"commentList":[],"isCommentEnd":true,"isTiger":false,"isWeiXinMini":false,"url":"/m/post/881368624"}