Palo Alto Networks, Inc.

Good afternoon, and thank you for joining us for today's conference call to discuss Palo Alto Network's fiscal third quarter 2021 financial results. I'm Walter Pritchard, Senior Vice President of Investor Relations and Corporate Development. This call is being broadcast live over the web and can be accessed on the Investors section of our website at investors.paloaltonetworks.com. With me on today's call are Nikesh Arora, our Chairman and Chief Executive Officer, Deepak Golecha, our Chief Financial Officer, and Lee Klarich, our Chief Product Officer. This afternoon, we issued a press release announcing our results for the fiscal third quarter ended April 30, 2021. If you'd like a copy of the release, you can access it online on our website. We would like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding the impact of COVID-19, the SolarWinds attack on our business, our customers, the enterprise and cybersecurity industry in global economic conditions, our belief that cyber attacks will continue to escalate, our expectations regarding a single equity structure, our expectations related to financial guidance, operating metrics, and modeling points for the fiscal fourth quarter and fiscal year 2021, our expectations regarding our business strategy, our competitive position, and the demand and market opportunity for our products and subscriptions, benefits and timing of new products, features, subscription offerings, as well as other financial and operating trends. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today. You should not rely on them as representing our views in the future. and we undertake no obligation to update these statements after this call for a more detailed description of these factors that could cause actual results to differ please refer to our quarterly report on form 10 q filed with the sec on february 23rd 2021 and our earnings release posted a few minutes ago on our website and filed with the sec on form 8k also please note that certain financial measures we use on this call are expressed on a non-gap basis and have been adjusted to exclude certain charges for historical periods we have provided reconciliations of these non-gap financial measures to our gap financial measures in the supplementary financial information that can be found in the investors section of our website located at investors.paloaltonetworks.com and finally once we have completed our formal remarks we'll be posting them to our investor relations website under the quarterly results section We'd also like to inform you that we'll be virtually participating in the JP Morgan 49th Annual Global Technology, Media, and Telecommunications Conference on May 24th and the B of A Securities 2021 Global Technology Conference on June 8th. Please also see the Investors section of our website for additional information about conferences that we may be participating in. And with that, I'd like to turn the call over to Nikesh.

Thank you, Walter. Good afternoon, and thank you for joining us today for our earnings call. Let me begin with the current cybersecurity landscape. After the December solar storm attack, we saw an acceleration in attacks throughout our third quarter and after the quarter closed. These range from software supply chain attacks like SolarWinds and Codeco to ransomware attacks like Colonial Pipeline. Ransomware especially has been in the spotlight recently, and data from our own Unit 42 shows that the average ransom paid in 2020 tripled from 2019, and in 2021, it's more than doubled again. The highest demand we've seen is $50 million, up from $30 million in 2022, with organized groups with near nation-state discipline perpetrating coordinated attacks. The targets are not only corporations where healthcare and pharma is a focus with the pandemic, but also government organizations and shared infrastructure. The reason for this vulnerability is deep-seated. Organizations run their operations on technology that is decades old, sometimes predating the internet. They continually bolt on new technologies to automate facilities and make them compatible with the modern Internet, but those platforms are inherently insecure. At the same time, cyber defenses are fragmented, making it very challenging to block sophisticated attacks and lengthening mean time to discovery and repair. Lastly, more and more businesses and consumers are coming online without a baseline of protection. In such a scenario, it is imperative that customers focus on securing their most critical assets while also focusing on reducing the fragmentation and leveraging newer technologies like artificial intelligence and machine learning and using those approaches. With that backdrop, let's focus on our results. Overall, we saw continued strong demand environment and our own continued execution drove Q3 Billings revenue and EPS ahead of guidance. We saw Billings growth accelerate to 27% in Q3 ahead of our 24% revenue growth forecast with growing radical revenue contribution. I want to highlight one dynamic regarding our Billings to help you better understand the drivers. During COVID, some customers are asking for annual billing plans to meet their needs. We noted to you that we saw success with larger, more strategic transactions in Q3. Along with these deals, we saw an uptick in annual billings plans. Normalizing for this, our billings would have grown greater than 28%, nearly two points higher than we reported, which is the highest billing growth we've seen in the third quarter since Q3 of fiscal year 2018. Last year, we saw a billings plan have an approximate one point impact. Along with billings, we also saw 38% growth in our remaining performance obligations. This metric is growing faster than both revenue and deferred revenue and will be a source of consistent revenue growth in the future. Within the strong performance, we also saw 71% growth in ARR, or analyzed recurring revenue, from our next generation security offerings, where we finished our third quarter at $970 million, up from $840 million in Q2. These ARR, billing, and RPO trends drove 24% a year of growth in our reported revenue. It's worth noting, given your attention to NGS ARR that in the very first week and the first day of Q4, we transacted one of our largest next-generation security deals in the history of Palo Alto Networks with a Fortune 30 manufacturer, which brought in 7 million in NGS ARR. So we're already at 980 million on the first day of this quarter. With the acceleration and incremental NGS ARR in Q3 and trends we see in the business, we continue to have confidence in our Q4 target of 1.15 billion in ending NGS ARR. As part of this strong Q3 performance, we saw notable momentum in large transactions, with 901 customers having spent $1 million of power to networks in the last four quarters. This cohort of customers was up 29% year-over-year, growing ahead of our overall revenue and billing scope. This growth in active millionaire customers has accelerated in recent quarters. As part of this large deal performance, our business is benefiting from growing adoption of multiple Palo Alto network security platforms across Strata, Prisma and Cordrix. In Q3, 70% of our global 2000 customers had purchased products from more than one of these platforms and 41% have purchased all three platforms. This is up from 58% and 25% two years ago. Turning to our product areas. Earlier this year, we started the dialogue around network security and cloud and AI and shared additional financial metrics to give you more transparency. Having these two product areas under the common umbrella of our world-class R&D and go-to-market organization is key to our strategy of being the largest cybersecurity company in the world. Starting with the network security side of our business, we are the leader in this business. Our strategy of selling customers the leading firewall platform delivered through a hardware, software, or as a service form factor underpins our success in this market. This has resulted in a business that is 28% larger than our next peer on a revenue basis in Q3. Also, if you look at leading indicators that include deferred revenue and RPO, our scale comes through even further, where we are 40 to 50% larger. On these leading balance sheet metrics, we're going faster than our next peer. Three years ago, when I joined Pilot Networks, we were a hardware-based firewall company. We had a vision of a hybrid world where the enterprise and data centers would remain predominantly hardware oriented, with growing adoption of software form factors like our VM series firewalls. Meanwhile, in the remote access and remote office world, this opportunity has been transformed by cloud adoption and work-promote trends to fuel secure access service edge, or SASE adoption. The reception to our strategy of delivering a firewall in multiple form factors has enabled the accelerating firewall of the platform growth rates we just showed you. Within our firewalls of platform buildings, we're seeing a distinct mix shift towards software. This software mix, which includes our VMs and SASE business, now makes up 40% of firewalls of platform, up 21 percentage points from a year ago. We saw seven-figure transactions for our software firewall capability, including VM&C and cities with the U.S. government agency, a Fortune 30 manufacturer, and a diversified financial services company. While we've seen the significant transition and form factors, one driver of growth and value in our business are attached subscriptions and support have grown at a steady rate over the last several quarters on a revenue basis. We expect the software mix to continue to increase in the medium term, although along with this, we expect to continue to see attached subscriptions as a key growth driver. We're showing you for the first time here, the NETSEC analyzed recurring revenue, which was 2.66 billion the end of Q3 and grew 25%. As a reminder, This does not include our hardware business, which continues to be significant. This recurring revenue business is a key driver to strong cash generation, which we have guided to 42% for NETSEC and FY21. We believe this high degree of recurring revenue and strong cash flow generated by NETSEC is something that should be more clear now, given this incremental disclosure over the last two quarters. Now turning to innovation and focusing first on Prisma SaaS. Back at the beginning of the pandemic, we saw customers look to significantly expand remote access capability while not compromising security or user experience. We've met that demand with free remote access trials and broad proof of concepts, enabling customers to see that value in Prisma Access, as well as supporting the network transformation as they move to the cloud. We're seeing these efforts, as well as momentum generated from the 2.0 launch, driving strong initial purchases and footprint expansions. This quarter, we saw a number of large Prisma Access transactions, including a global technology company, a large manufacturer, and a Fortune 10 healthcare company, all eight figures or greater. Additionally, over 25% of our Prisma Access new customers in Q3 were net due to Palo Alto Networks. Lastly, we're seeing early traction in our service provider partners for Prisma Access, including Comcast, Verizon, and Orange Business Services. These relationships are part of broader initiatives with service providers that we see as a significant growth opportunity. Just yesterday, we announced a significant release in network security focused around a comprehensive approach to zero trust. This is timed well with last week's executive order out of the White House that defines zero trust in a way that is very consistent with the Palo Alto network strategy. There has been a lot of noise in the industry around zero trust network access, but solutions continue to be fragmented around either remote users. Access control or enterprise Apps our approach covers all users and devices all locations all Apps and the Internet applying consistent consistent access control and security. Our new panel s 10.1 release brings cloud based identity controls integrated CASB and enhancements to our URL and DNS security services. Power Network's position across appliance, software, and SaaS is unique, and these new innovations are applicable to all our customers across all form factors. This is one of the most significant innovation releases for our next-generation firewall franchise and gives us confidence in continued net-tech growth as we look forward. Now moving on to cloud and AI. On the Prisma Cloud front, we continue to build on our early leadership position in cloud security posture management, cloud workload protection capability, and marketplace delivered virtual firewalls, where we are the largest player across this opportunity set. Our strategy is to stay ahead of customer demand as they adopt cloud-native security services across hyperscalers. We believe we have staked out a leadership position in cloud-native security with this business. We've achieved over $250 million in ARR across Prisma Cloud in our marketplace VMs and CN series. Fueling this growth is 39% growth in total customers and 38% growth in global 2000 customers across Prisma Cloud. Our unique consumption model in Prisma Cloud based on credits enables customers to use any of our modules across their cloud-deployed workloads, including using multiple capabilities for workload. We're seeing strong growth in credit consumption with over 100% growth year-over-year in Q3. Despite our strong position with Prisma Cloud targeting an early opportunity, we see the next big challenge in security at the developer level, or shift left security. We recently addressed this with our acquisition of BridgeCrew, completed in Q3. Traditionally, security issues in code pose a challenge for the CISO organization. And we're seeing leading companies drive a collaborative approach between the CISO organization and the development organization to address this. shift left integrates security into the devops process to catch these issues up front where they're easy and quick to fix it's a win for developers and a win for security bridge q has an open source product check off This product delivers significant value developers through a free download post the acquisition close on the release of $2 check off, we saw bridge crew downloads accelerate. Which was also seeing strong momentum and it's paid customers, including a six figure customer in Q3 we're only in the very early stages of cross selling between bridge crew software and Prisma cloud. Within our Cortex product area, we continue to focus on delivering significant volumes of innovation to XTR, XSOAR, and our recently acquired Xpans product. In Q3, we delivered a new release of XTR, which expands endpoint query capability and improves visibility into network activity. With XSOAR, we significantly expanded our marketplace partner integrations to increase the set of automation and security playbooks that customers can deploy. We're seeing this result in steady Cortex customer additions to XTR and XSOAR customers, We have over 2,400 customers starting from essentially scratch two years ago. Our focus on innovation has been validated by the market as well. We were particularly proud of this validation for Cortex-X DR in Q3, where we garnered the best overall result in round three testing for MITRE. Also in the recently released Forrester Wave covering endpoint security software as a service market, we were named a leader. Cortex-X source surpassed 100 partner contributed content packs and now has over 650 content packs in the marketplace. Our expanse offering was featured in Tim Junior's keynote this week at RSA, where our research uncovered that one-third of leading organizations' attack surface is susceptible to exposure that are the main avenue for ransomware. No other leading security company has the degree of visibility to identify and prevent today's most pernicious attack vector. Within Cortex, we are starting to see an uptick in large customer signings, such as a seven-figure transaction with a financial services firm, which included STR Pro and XSort. Lastly, during Q3, we formed the new Unit 42 under the leadership of Wendy Whitmore, who comes to Palo Alto Networks after building successful security services businesses. Our new team is a combination of two of the most capable teams in cybersecurity. The CRIPSIS team is laser-focused on the mission of conducting world-class data breach investigations, while the Unit 42 team has focused on rapidly building threat intelligence into Palo Alto Networks products. This new Unit 42 has completed over 1,300 engagements in calendar year 2020, bringing to bear the power of 140 consultants. In response to SolarWinds and ransomware attacks, Microsoft-related breaches and other attacks, we've mobilized our consultants in rapid response engagements, which help customers through these difficult times. As we look forward, we're focused on using services to become an even more strategic partner to our customers. As I reviewed with you here and should be evident in our Q3 results, we're seeing broad strength in our business across geographies and product areas. We see strength in our pipeline and continued demand tailwinds that remain strong, leading us to raise our FY21 guidance. I also want to update you on our plans we discussed in Q2 around exploring an equity structure for ClaySec. We continue to focus on providing transparency for each part of our business. You'll notice the error for NETSEC, which we highlighted this quarter. We believe this has helped investors gain better insight into our overall financial profile and especially understanding both sides of the business with the different growth and free cash flow characteristics. We have finished all the work required to file any form of equity on ClaySec. However, given the state of the market and offering extensive conversation with shareholders, we have decided at this point it's best to continue with a single equity structure and an integrated P&L and postpone any decision to list place like equity. Lastly, we're excited to welcome Aparna Bawa, Chief Operating Officer of Zoom to Palo Alto Network's Board of Directors. She brings deep operational, financial, and legal expertise, having served in diverse roles at rapidly growing tech companies such as Zoom, Magento, and Nimble. Her addition comes after the February appointment of Dr. Helene Gale to our board. We continue to have a strong commitment to diversity at Palo Alto Networks, including at the most senior levels of governance in our company. With that, I will turn the call over to Deepak Galecha, our CFO. We're excited to have Deepak step into the CFO role and enable a smooth transition within our organization. He brings world-class experience. We're already seeing him bring someone's experience to bear in driving improvements. Over to you, Deepak.

Thanks, Sankesh. I'm excited and humbled to be part of this world-class leadership team and look forward to driving total shareholder return. As Nikesh indicated, we had a strong third quarter as we continue to deliver winning innovation while simultaneously adding new customers at pace. This strength gives us confidence to raise guidance for the year. We delivered billings of $1.3 billion, up 27% year over year, with strong growth across the board and ahead of our guidance of 20% to 22% growth. We've continued to see some customers ask for billing plans, many involving larger transactions as we become a more strategic partner to our customers. We've also used our Palo Alto Network's financial services financing capability here. The dollar-weighted contract duration for new subscription and support billings in the quarter were consistent year over year and remained at approximately three years. We added approximately 2,400 new customers in the quarter. Total deferred revenue at the end of Q3 was $4.4 billion, an increase of 30% year-over-year. Remaining performance obligation, or RPO, was $4.9 billion, an increase of 38% year-over-year. We continue to see these metrics as becoming more meaningful as we drive growth from our radical business. Our revenue of $1.07 billion who 24% year over year ahead of our guidance of 21 to 22% growth, driven by our buildings and board business strength and amidst an increase in our radical subscription revenue. We remain focused focused on driving this higher quality revenue with all new product offerings being pure or substantially all subscription in nature. Looking at growth by geography, the Americas grew 24%, EMEA grew 23%, and APAC grew 25%, showing broad executional excellence across the world. Q3 product revenue of $289 million increased 3% compared to prior year. Q3 subscription revenue of $474 million increased 34%. Support revenue of $311 million increased 33%. In total, subscription and support revenue of $785 million increased 33% and accounted for 73% of total revenue. Our Q3 non-GAAP gross margin was 74.6%, which was down 60 basis points compared to last year, driven by product mix, which are less mature. Q3 non-GAAP operating margin was 17%, an increase of 60 basis points year over year. There are several factors driving our operating margins. We have revenue upside, lower travel and event expenses due to COVID, and some shift in spending out of Q3. At the same time, we continue to aggressively invest for growth, largely in the areas of sale capacity and R&D investments. With health conditions improving in geographies of many of our facilities, including our Santa Clara headquarters, we're seeing more employees look to return to the office. We expect this trend will continue to gain steam in Q4, reversing some of the savings we had seen in the last few quarters in our OPEX. Non-GAAP net income for the third quarter increased 22% to $140 million or $1.38 per diluted share. On non-GAAP effective tax rate, the Q3 was 22%. The EPS expansion was driven by revenue growth and operating expense leverage with an undertone of strong investments of growth. On a gap basis for the third quarter, net loss increased to $140 million or $1.50 per basic and diluted share. We ended the third quarter with 9,715 employees, including 39 from the bridge crew at the close of acquisition. Turning to the balance sheet and cash flow statement. We finished April with cash, cash equivalents and investments of $3.8 billion. Q3 cash flow from operations of $278 million increased by 64% year over year. Free cash flow was $251 million, up 200% at a margin of 23.4%. Our DSO was 60 days, a decrease from three days from the prior year period and flat with the second quarter. Our firewall as a platform, or FWAP, had another strong quarter as we continue to grow faster than the market. FWAP billings grew 26% in Q3, and we continue our transition from hardware to software and SaaS form factors, as Nikesh highlighted. Our next generation security, or NGS, continues to expand and now represents 27% of our total billings at $346 million, growing at 70% year over year. In the third quarter, we added $133 million in new NGS ARR, reaching $973 million. The acquisition of Bridge Crew added an immaterial amount to this number, and we remain confident in our plan to achieving $1.15 billion in NGS ARR exiting fiscal year 21.