Cybersecurity company CrowdStrike (CRWD) believes it still has significant room to expand share in the endpoint detection and response (EDR) market as enterprises phase out legacy security systems. BNP Paribas said after recently holding a conference call with CrowdStrike’s investor relations executives that the company’s long-term growth opportunity remains substantial and that CrowdStrike’s fiscal 2030 and fiscal 2035 annual recurring revenue (ARR) targets may even prove conservative. CrowdStrike did not adjust its existing financial guidance this time. In early trading on Monday, the stock rose about 1% at one point.
Nearly Half of the EDR Market Still Uses Legacy Products, and CrowdStrike Targets Replacement Demand. CrowdStrike estimates that about 48% of the EDR market still uses legacy security products, creating an opportunity for the company to further compete for market share. Relevant enterprise customer contracts typically have terms of about five years, so as existing contracts gradually expire and enterprises upgrade their cybersecurity systems, CrowdStrike is expected to win new customers and orders. EDR, or endpoint detection and response, is a cybersecurity solution that continuously monitors end-user devices, mainly to detect and respond to cyber threats such as ransomware and malware. BNP Paribas said CrowdStrike believes that after “Mythos,” the company still has significant opportunities to gain more market share through its EDR business. For CrowdStrike, the replacement of legacy EDR products not only means opportunities for new customers, but may also create room for the company to sell more security modules to customers, further driving annual recurring revenue growth. CrowdStrike currently proposes raising ARR to $10 billion by fiscal 2030 and further to $20 billion by fiscal 2035. At the same time, the company expects net new ARR growth of more than 20% in fiscal 2028.
Long-Term ARR Target May Be Conservative, and the AI Security Market Offers Greater Growth Space. BNP Paribas believes CrowdStrike’s above long-term growth targets may ultimately prove relatively conservative. Based on the company’s long-term targets, it assumes that CrowdStrike will capture about 3.5% of an AI-related security products market estimated at about $565 billion. By comparison, CrowdStrike currently has a share of about 4% in the relevant market. This means that if CrowdStrike can maintain its current market share rather than the 3.5% share implied by its long-term targets, the revenue scale the company ultimately achieves could exceed the level corresponding to its existing long-term targets. In addition to its traditional endpoint security business, the rapid adoption of AI applications is also creating new demand for the cybersecurity industry. As enterprises increasingly deploy AI agents, how to monitor the behavior of AI agents and prevent them from carrying out malicious or unauthorized operations is becoming a new security challenge. CrowdStrike is also actively developing security products for AI agents, hoping to extend its existing cybersecurity capabilities into the AI application field.
Overall, BNP Paribas believes CrowdStrike’s long-term targets of achieving $10 billion in ARR by fiscal 2030 and $20 billion in ARR by fiscal 2035 may be conservative, and whether the company can continue to expand its EDR market share and seize AI security demand will become key to achieving its long-term growth.
