Nearly half of enterprise endpoint security systems still need upgrading! CrowdStrike (CRWD.US) aims for market share expansion; BNP Paribas says long-term growth target may be conservative.

Cybersecurity company CrowdStrike (CRWD.US) believes it still has significant room to expand share in the endpoint detection and response (EDR) market as enterprises phase out legacy security systems. After a recent conference call with CrowdStrike's investor relations executives, BNP Paribas said the company's long-term growth opportunity remains substantial and that CrowdStrike's fiscal 2030 and fiscal 2035 annual recurring revenue (ARR) targets may even prove conservative. CrowdStrike did not adjust its existing financial guidance. In early trading on Monday, the stock rose about 1% at one point. Nearly half of the EDR market still uses legacy products; CrowdStrike targets replacement demand CrowdStrike estimates that about 48% of the EDR market still uses legacy security products, giving the company an opportunity to further compete for market share. Enterprise customer contracts typically run about five years, so as existing contracts expire and enterprises upgrade their cybersecurity systems, CrowdStrike is expected to win new customers and orders. EDR, or endpoint detection and response, is a cybersecurity solution that continuously monitors end-user devices, primarily to detect and respond to cyber threats such as ransomware and malware. BNP Paribas said CrowdStrike believes that after "Mythos," the company still has significant opportunities to gain more market share through its EDR business. For CrowdStrike, the replacement cycle for legacy EDR products not only means opportunities for new customers, but may also create room to sell more security modules to customers, further driving annual recurring revenue growth. CrowdStrike currently aims to raise ARR to $10 billion by fiscal 2030 and further to $20 billion by fiscal 2035. At the same time, the company expects net new ARR growth of more than 20% in fiscal 2028. Long-term ARR targets may be conservative; AI security market offers greater growth space BNP Paribas believes CrowdStrike's long-term growth targets may ultimately prove conservative. Based on the company's long-term targets, it assumes CrowdStrike will capture about 3.5% of an AI-related security products market estimated at about $565 billion. By comparison, CrowdStrike's current share of the relevant market is about 4%. This means that if CrowdStrike can maintain its current market share rather than the 3.5% implied by its long-term targets, the company's eventual revenue scale could exceed the level corresponding to its existing long-term targets. In addition to its traditional endpoint security business, the rapid adoption of AI applications is also creating new demand for the cybersecurity industry. As enterprises deploy more AI agents, how to monitor the behavior of AI agents and prevent them from carrying out malicious or unauthorized actions is becoming a new security challenge. CrowdStrike is also actively developing security products for AI agents, hoping to extend its existing cybersecurity capabilities into the AI application space. Expanding into AI agent security; Guardian product now fully available BNP Paribas said CrowdStrike's Guardian product is now fully available, while another product, SafeMind, uses NVIDIA Corporation's (NVDA.US) Nemotron model to detect potentially malicious behavior by AI agents. This positioning means CrowdStrike is further extending its security platform from traditional endpoint devices to AI agents, providing security protection for enterprises adopting generative AI and autonomous AI systems. As AI agents are able to access enterprise data, call software tools and perform increasingly complex tasks, their potential security risks also increase. CrowdStrike hopes to identify anomalous or malicious behavior through related products, thereby competing in this emerging AI security market. It is worth noting that NVIDIA Corporation recently also released its own security product. However, CrowdStrike told BNP Paribas that SafeMind is not positioned to compete directly with NVIDIA Corporation's newly launched security product. Instead, SafeMind itself uses NVIDIA Corporation's Nemotron model, reflecting CrowdStrike's preference in the AI security field to leverage existing AI infrastructure and model capabilities to develop security solutions for enterprise customers. BNP Paribas believes CrowdStrike's long-term targets of achieving $10 billion in ARR by fiscal 2030 and $20 billion in ARR by fiscal 2035 may be conservative, and whether the company can continue to expand its EDR market share and capture AI security demand will be key to achieving long-term growth.