Palo Alto Networks, Inc.

When imagination ran away with me, it took me by the hand and led me away on an adventure adults wouldn't understand. It showed me glorious green forests and silvery snow-capped mountains, ancient ruins and relics, and exploding fantastical fountains. It took me to a magical world where dragons roam, cauldrons foam, and children save the world alone. It showed me what the world could be If no one put restraints on me.

Good morning and thank you for joining us on today's conference call to discuss Paula Walton Network's fiscal first quarter 2021 financial results. I am Karen Fung, Senior Director of Investor Relations. This call is being broadcast live over the web and can be accessed on the investor section of our website at investors.paulawalternetworks.com. With me on today's call are Nikesh Arora, our Chairman and Chief Executive Officer, Luis Visoso, our Chief Financial Officer, and Lee Klarich, our Chief Product Officer. This morning, we issued a press release announcing our results for our fiscal first quarter ended October 31, 2020. If you would like a copy of the release, you can access it online on our website. We would like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding the impact of COVID-19 on our business, our customers, the enterprise and cybersecurity industry and global economic conditions, our expectations related to financial guidance, operating metrics and modeling points for fiscal second quarter and full year, Expanse's contribution to our fiscal 2021 ARR, our expectations regarding the timing of completing our acquisition of Expanse, our competitive position and the demand and opportunity for our products and subscriptions, benefits and timing of new products, features and subscription offerings, including those from our proposed acquisition of Expanse, as well as other financial and operating trends. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today. You should not rely on them as representing our views in the future, and we undertake no obligation to update these statements after this call. For a more detailed description of factors that could cause actual results to differ, please refer to our annual report on Form 10-K filed with the SEC on September 4, 2020, and on our earnings release posted a few minutes ago on our website and filed with the SEC on Form 8K. Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges. For historical periods, we have provided reconciliations of these non-GAAP financial measures to GAAP financial measures and the supplemental financial information that can be found in the investor section of our website, located at investors.paulawaltonetworks.com. And finally, once we have completed our formal remarks, we will be posting them to our investor relations website under the quarterly results section. We'd also like to inform you that we will be virtually participating in the Wells Fargo TMT Summit on December 1st and the Barclays Global TMT Conference on December 10th. Please also see the investor section of our website for additional information about conferences we may be participating in. And with that, I will turn the call over to Nikesh.

User conference which starts tomorrow morning. This is my 10th quarterly call at Palo Alto Networks. The one thing in common between the first and the 10th is they were both 5 a.m. calls. I finally feel that we're turning the corner on all that we've been doing over the last few years. We have a lot of interesting stuff in store for you on this call. In addition to sharing our first quarter results, we will discuss the financial impact of our proposed acquisition of Xpans, Since Louise joined us last quarter, he and I have had the privilege and opportunity to talk to a lot of you. And based on the feedback, we've come up with a more transparent approach to understanding our business. And hopefully it gives you a better understanding of what we have been up to and a way to think about Palo Alto Networks 2.0. Over the last seven months, I've been cautious on the pandemic and our teams have continued to deliver and surprise me to the upside. I'm delighted to report this is no longer a coincidence. Our customers are investing, our teams are executing, and our strategy of innovating in our firewall business and focusing on the next generation of products around cloud and AI in the industry is working. As you can see, we had a great start to fiscal year 2021 as we exceeded guidance across all metrics in Q1. Here are some of the highlights. We delivered strong billings of $1.08 billion, up 21% year-over-year, with strong growth across the board, driven by continued strength in next-generation security, or NGS billings, growing at 53% year-over-year and NGS ARR of $719 million. Revenue was up 23% to $946 million, driven by strength in our cloud-based subscription and support revenue businesses. Non-GAAP EPS was $1.62 of 57 cents from last year. The EPS expansion was driven by revenue growth and operating expense leverage due to efficiencies as we have seen across the industry from lower spend associated with travel and events around COVID. Adjusted free cash flow margin was 53.4%. As mentioned last quarter, we expected a strong cash quarter following the record Q4 2020 billings. We think some of this will continue into the next quarter, but we expect this to normalize for the year around our full year guidance. This continued strength during the pandemic makes me cautiously optimistic about the future prospects of the business. While we expect the winter will try all of our collective resolve with COVID, the worst case scenarios are unlikely to unfold and we expect our customers to continue to invest in technology. I also feel that the strategic bets we made a few years ago are right for our customers in the current environment. Against that backdrop, I feel comfortable raising guidance for the full fiscal year, even before including the contribution of our proposed acquisition of expense, which we announced last week. Fiscal 2021 And at the midpoint guide, we expect total billings growth of 19%, up 300 basis points from our prior guidance. Total revenue growth of 20 to 21%, up 300 basis points from our prior guide. Next generation security ARR to be approximately $1.15 billion, up 77% year over year. We also expect non-GAAP operating margin adjusted free cashflow expansion up from our prior guidance of flat year over year. Subject to close, this includes a benefit from expense of approximately 100 basis points of billing growth, 50 basis points of revenue growth, and $70 million in ARR. We will absorb expenses, operating expenses, within the framework of our guide. Let me now highlight some of the key innovation launched in Q1 and the very positive customer traction, starting with our firewall business. We continue to drive innovation within our firewall business. We recently extended our new enterprise DLP solution to integrate with our complete firewall platform. Our DLP offerings is a cloud delivered service that is powerful, simple to deploy and protect sensitive data whether a customer keeps the data in the cloud on-prem or takes a flexible approach. This launch takes our number of potential attached subscriptions to eight from four just two years ago. We also introduced an innovative joint solution with our VM series virtual firewall and AWS gateway load balancer. Our engineering level partnership with AWS enabled us to launch this new capability that significantly simplifies deployment, improves the scale and performance, and reduces the total cost of ownership of our VM series customers. Going forward, we will continue to provide leading innovation to our customers. One example of this is the upcoming launch of our new 5G native security offering. It's our unique approach to 5G security. We're the first to introduce 5G network slice security, 5G context-driven security, and much more. All in a containerized solution matching the preferred architecture of 5G. Not only will this allow mobile operators to secure their 5G infrastructure, but it will also enable them to launch value-added security services to their growing enterprise customers who are leveraging 5G for many new use cases. As a result of our efforts to drive innovation, our firewall business continues to receive industry accolades. I'm excited to share that Palo Alto Networks was crowned again as a leader in Gartner's magic quadrant for network firewalls. This is the ninth consecutive time we are a leader in this magic quadrant. Once again, we've achieved the highest and furthest overall position in the magic quadrant for our ability to execute and our completeness of vision. Not only was our strength in extradition firewall product capability recognized, but our services like DLP and focus on cloud security was cited as trends as well. In Q1, we were also recognized as leader in the Forrester Wave Zero Trust extended ecosystem platform providers report, noting that we have assembled a robust portfolio that delivers zero trust everywhere, on premise, in the data center, and in the cloud. Our strategy in firewalls is working as firewall to the platform group buildings by 16% in Q1, 2021. And we added approximately 2000 more customers for a total of 71,000 next-generation firewall customers. Our software next-generation firewalls, VM series and CN series continue to gain momentum as well. And we now have over 10,000 customers using our software firewalls. Moving on to our SASE or Secure Access Service S solution, Prisma Access and CloudGenics. As SD-WAN has become the primary WAN architecture, organizations are demanding solutions with a better user experience while being simpler to deploy and manage. In the quarter, we introduced a number of new additions to our next generation SD-WAN solution, CloudGenics. This included new ML-based capabilities to enhance our AIOps approach and further simplify network operations. Two new SD-WAN appliances, a small form factor appliance designed for retail and small offices and home offices and a high performance application appliance suited for large campus and data center locations. We also delivered the first CloudGenics and Prisma Access integration, which seamlessly enables cloud delivered branch security in just a few clicks. In addition to the Gartner Magic Cordon network firewalls, Palo Alto Network's CloudGenics SD-WAN was recognized as a leader in the 2020 Gartner Magic Cordon for WAN infrastructure. For many of our customers, COVID accelerated the digital transformation timelines, and we continue to see conversion of remote access trials and very strong pipeline generation. We now have more than 1000 Prisma SASE customers, more than double from a year ago. to highlight a deal from the quarter. We want a seven-figure SD-WAN deal with a US retailer who had already been a Palo Alto Networks customer for a number of years and was an early adopter of Prisma Access. The success that we had with Prisma Access and the strong integration with CloudGenics was a winning combination and this customer is now a full SASE customer. Switching to Prisma Cloud. Prisma Cloud is very well positioned for sustainable growth as it is at the heart of the global shift to cloud computing. In Q1 2021, we launched Prisma Cloud 2.0, introducing four new modules to enable customers to easily and rapidly extend their cloud security coverage in a number of critical areas, all within a single cloud native security platform. These modules are data security, which discovers and protects cloud storage data at the scale and velocity common in public cloud environments, and addressing one of the most common data exposure issues in cloud transformation. includes web application and API security, which protects web applications from attacks. Our approach addresses the challenges of deployment complexity and scalability by leveraging the same agent as our container and host security, making it very easy and horizontally scalable. We launched identity-based micro-segmentation with the integration of Apparetto technology, enabling zero trust security for cloud applications and a cloud-native identity-based approach. And lastly, IAM security, which allows security teams to gain visibility into effective cloud identity permissions, user activity, implement governance, and respond to issues. While only recently introduced, we're excited by the strong customer interest we're seeing. Prisma Cloud now serves 20% of the global 2000 companies, 70% of the Fortune 100 companies and secures 1.8 billion cloud resources. This customer momentum is up from the 14% of global 2000 companies reported last quarter and up significantly from the 43% of Fortune 100 that we reported two quarters ago. We're also seeing substantial increase in Prisma Cloud customers are using both cloud security posture management and cloud workload protection for containers and serverless applications. Now at 45% up from a third we reported last quarter. To highlight the benefits of our consumption model, we want a high seven figure deal with a leading technology company to use Prisma Cloud for CSPM for AWS and cloud workload protection. This customer has quickly consumed the workloads purchased and we are working with them to support the expansion to new clouds and new workloads. Moving to Cortex. Cortex is on its way to being the industry's first proactive security platform, collecting data across the multiple security data sources, applying machine learning techniques to detect sophisticated threats before they have a chance to succeed, and fully automating response for known threats. We've seen some incredible benefits to customers who adopted Cortex, from customers seeing up to 50x reduction alerts to customers automating more than 1 million incidents per day. And based on our telemetry, we can see that we recently passed the mark of 400 million actions automated, up 100% in just four months. As a result, we're winning with customers who share our vision, including 34% of Global 2000 and 65% of Fortune 100. We continue to drive product innovation in Cortex XDR. Our recent XDR 2.5 release includes many new capabilities that have enabled us to catch up in a number of areas surpassing leading EDR products. For example, we introduced Host Insights, our first add-on module for XDR, which provides vulnerability assessment, application visibility, and our new search and destroy feature. And to our knowledge, we are the first EDR product to offer this search and destroy capability that will greatly speed up security response and eliminate the need for additional endpoint agents. This might be a good time to highlight a customer win we had recently. We won a seven-figure deal, and this is a story we hear every day. The customer has a small SecOps team managing multiple point products that were generating too many alerts with too few resources to investigate every alert, leaving them exposed to advanced threats. Being able to quickly investigate alerts and identify and remediate threats was a critical requirement. Their existing EDR product was disjointed from the rest of the security infrastructure, making it difficult and time consuming to correlate data. At the same time, their SIM was consuming a large chunk of the annual budget with little ROI. We challenged their way of thinking by demonstrating how the Cortex platform could automate and streamline security operations, allow them to consolidate multiple products, including the SIEM intercorp. We demonstrated how Cortex will help transform the SecOps team by automating routine processes and knocking down alert volume by more than 95%, allowing them to focus on the critical field. In Q1, we also launched the XSOAR Marketplace, which opened up the platform to both our partners and customers, and we now have over 500 content packs available to customers to enable automation for the security solutions. Additionally, we're seeing engagement and momentum within our partner ecosystem with contributions and use cases, ranging from insider threat to cloud security and threat intel management. The last deal I want to share with you is a Fortune 500 diversified financial service company. Prior to implementing Cortex XSOAR, this customer was receiving over 1 billion threat alerts per week, completely overwhelming their security operations team, leading to a state where alerts were disregarded, creating a significant security gap. By leveraging XSOAR and XSOAR threat intel management, they were able to take full control of threat information by aggregating disparate information sources, automatically customizing and scoring feeds, and matching indicators against their environment, as well as leveraging playbook automation to drive instant action. This combination of automation tactics reduced the number of threat alerts they received by more than 99%, creating a significantly more secure environment. Moving quickly to Xpans. Last week we announced our intent to acquire Xpans and told you about what they do and how they fit within our overall vision of Cortex. Xpans has dedicated themselves to developing an internet collection attribution platform that constantly monitors the global internet, mapping the exposed and untracked assets of an enterprise that comprise its attack surface. This data gives organizations a crucial picture from the outside in, that is to say, the same view that an attacker sees when hunting for potential weaknesses. is because of the insight that their technology is trusted by some of the world's largest and most complex organizations, from members of the Fortune 500 to the US military. With our user conference Ignite kicking off in a little over 24 hours, we're excited to share that outside-in view with our customers. We work with Expanse to offer all CIOs and CISOs attending an Expanse Exec Report, which provides a vulnerability map and immediate insights to a customer's complete tax surface, risks, and suspicious activity. This is a great lead generation tool for our sales teams to hit the ground running once we close the transaction. Expansive transaction multiples are very favorable compared to other companies of equivalent size and even more so when adjusting for growth. Now to the financials. As we said in our call last week, on a standalone basis, we expect Expansive to contribute $67 million of ARR to our current fiscal year ending July 2021, continuing its 100% growth momentum. With Palo Alto networks and subject to close, we expect Expans to contribute 73 million of ARR in FY21. Assuming a mid to late Q2 close, we expect Expans billings to contribute about 100 basis points of our growth to our overall billings for FY21. And adjusting for purchase accounting, we expect Expans revenue to contribute about 50 basis points to our overall revenue for FY21. I know that you get concerned about M&A strategy, perhaps because inorganic impact to our P&L is hard to forecast in your models. But if you look at the $2.7 billion of acquisitions we have done since 2019, they contribute approximately 15% of our forecasted FY21 billings. Very large enterprise companies have been built by successful M&A strategies. Good M&A strategies need to ensure that the products are easy to integrate, their products customers want, and that we at Palo Alto Networks can significantly change their trajectory. We believe that our ability to acquire, integrate, and leverage our go-to-market for acquisitions is a strategic competitor advantage, and we expect to continue to be opportunistic to increase our long-term growth strategy. As I mentioned, Louise and I have spent a lot of time with all of you, and you've all highlighted that you love our business. Some of you have questioned whether our firewall business is under pressure. Others have wanted more transparency around our gross margins, while some of you have wanted more visibility around ARR and eventually how to put it all together. Well, we heard you. It has taken a Herculean effort to share our quarterly results in the shortest period we've ever done, but also to deliver detailed reporting on two categories to show that our business is doing extremely well. Let's take a look. Over the last quarter, we have discussed our total pilot network's performance and provided details for next-generation security and firewall as a platform. We had hoped that the firewall as a platform metric shows you how we're continuing to create and share in the firewall space. The challenge has been that we did not provide anything below that number, but we've decided that perhaps the best way to allay your concerns is show you the proforma P&L around FVAP and show you how it enjoys great margins and is actually a higher quality business since we're transforming our hardware business to a software and subscription business. We like this shift as software revenues is of higher quality and increases revenue visibility. Our next-generation security business, which has been the thrust of our innovation over the last two years, has been highlighted to share with you how we're building a bigger and better business faster than anyone else in next-generation security. Next-generation security provides a perspective in our fast-growing SaaS business on a billings basis. NGS has nearly a quarter of total billings, up from 8% in FY18. NGS ARR closed Q1 at $719 million, up from $651 million in Q4 2020, and up from $568 million in Q3 2020. To provide a better understanding for our business, we juggled a few pieces around. For our firewall as a platform business, we added the related subscriptions, support, and professional services. We call it network security. We removed the software firewalls from NGS in order for the two areas to make a whole. We call this cloud and AI. With that context, we have prepared a recast of our fuller guidance, which I just raised across both categories. Let's double click into network security. Our network security business on a standalone basis is still the largest firewall business in the industry by revenue. It enjoys double-digit growth driven by transformation to software form factors, our success in VMs and Prisma SASE, and increased subscriptions to Attach. This has allowed us to have lesser and lesser reliance on hardware and provides better revenue visibility. We feel comfortable that these growth rates are robust and sustainable. Our gross margins and operating margins are extremely healthy. The gross margin is slightly less than where they could be because of our SASE gross margins, which, given the early stage of that product scale relative to firewalls, it has slightly lower margins. As we scale our SASE business and the new subscriptions we have launched, we expect these margins to improve over the next few years. Needless to say, these numbers speak for themselves, and on a standalone basis, this will be a very valuable network security business. As you noted, our firewall business is largest in industry. We have industry-leading financials, and we're going through a transformation. We will continue to invest in this transformation. Fallout Networks has already transformed into a highly ratable business, where ratable revenue, the percent of total revenue, is up from 59% two years ago to 71% in Q1 2021. Now on the cloud and AI, this story has just started. If you ask every CIO, the two trends that they're all excited about are the transition to the cloud and the impact of AI. Well, there is no transformation unless it is a secure transformation. I think we have put to rest any questions on the idea that customers would get their cloud security from the CSPs only, but 70% of Fortune 100 being served by us. I think this is our opportunity to build upon. We're singularly focused on continuing to improve our platform to meet the needs of our customers as highlighted earlier. On the AI front, we're in the second iteration of this trend. The first trend was around collection of data and attempted correlated for security. The next trend, which we are well poised to capture, is a trend to normalize data, reduce the signal to noise ratio, and to improve the security posture using data, AI-based proactive security using Cortex. We have organized our financials for our cloud AI security category. This business, which we started building two years ago, is gaining traction. We're ensuring that we build this as a SaaS and ARR business. We expect ARR for cloud and AI to grow 89% year-over-year in FY21. Even when excluding the expanse contribution, we expect the growth to be 71% year-over-year. While the gross margins look lower in FY21 compared to FY20, partially because of the integration of Krypsys, we expect that this business will continue to improve gross margins every year and improve significantly over the next three, four years. Operating margins will naturally improve as their addable revenue is recognized from the balance sheet to the P&L. We believe there's a larger opportunity in cloud AI, and this could be the next $100 billion in security. That said, we will continue to invest aggressively to grow this business. In summary, if you put it all together, we have two great businesses doing exactly what we would like them to do. In conclusion, we had a great fiscal quarter across the board, and as a result, we are raising our fiscal 2021 guidance. We've been building two businesses at Powered Networks. Our network security business is a larger firewall player with sustained gross margins and operating margins, and we have fast-growing cloud and AI business, where we expect F521 ARR of 89% every year. Lastly, I want to give you a quick update on what we call FlexWorks. I started this morning by calling out the continued resilience of our employees. Throughout COVID-19, we've been supporting each and every employee with our flex work approach. A series of initiatives to give employees far greater choice as they adapt to challenges this year in areas from work location, to benefits, to learning, All underpinned by the way we lead and communicate, with compassion and authenticity. We continued to advance this approach through Q1. We launched the first phase of Flex benefits, giving our employees an additional $1,000 allowance for the year to choose from a wide range of well-being and childcare options. We rolled out the first module of Flex Learn, an individualized learning path for our sales teams, leaders, managers, designed to support them as well as they work and lead remotely. We're delighted to see our FlexWork approach now gaining traction beyond pilot networks. Last month, we launched FlexWork at Zoomtopia and invited other companies to join our open source discussions and share case studies and learnings. Over 600 attendees showed interest in the work. Simultaneously, the CEOs of Uber, Box, Splunk, and Zoom all joined me in formally announcing the FlexWork coalition community of leaders coming together to develop and share best practices as we focus on the future of work. We all agree the pandemic has highlighted areas of opportunity where we can bring about enduring workplace change. I look forward to continued conversations with these leaders and about how we can accelerate new work practices that put our employees at the center. With that, I will turn the call over to Louise.