Palo Alto Networks, Inc.

Good day, everyone, and welcome to Palo Alto Network's Fiscal Second Quarter 2024 Earnings Conference Call. I'm Walter Pritchard, Senior Vice President of Investor Relations and Corporate Development. Please note that this call is being recorded today, Tuesday, February 20, 2024, at 1.30 p.m. Pacific Time. With me on today's call to discuss second quarter results are Nikesh Arora, our Chairman and Chief Executive Officer, and Deepak Golecha, our Chief Financial Officer. Following our prepared remarks, Lee Klarich, our Chief Product Officer, will join us for the question and answer portion. You can find the press release and other information to supplement today's discussion on our website at investors.paloeltonetworks.com. While there, please click on the link for quarterly results to find the Q2 24 supplemental information and the Q2 24 earnings presentation. During the course of today's call, we will make forward-looking statements and projections regarding the company's business operations and financial performance. These statements made today are subject to a number of risks and uncertainties that could cause our actual results to differ from those forward-looking statements. Please review our press release and recent SEC filings for a description of these risks and uncertainties. We assume no obligation to update any forward-looking statements made in the presentations today. We will also refer to non-GAAP financial measures. These measures should not be considered a substitute for financial measures prepared in accordance with GAAP. The most directly comparable GAAP financial metrics and reconciliations are in the press release and the appendix of the investor presentation. Unless specifically noted otherwise, all results and comparisons are on a fiscal year-over-year basis. We would also like to note that management is scheduled to participate in the Morgan Stanley TMT Conference in March. I will now turn the call over to Nikesh.

Thank you, Walter. Good afternoon, and thank you for joining us today for our earnings call. I'm pleased to report another quarter in which we successfully executed our profitable growth strategy, driving a combination of top-line growth, significant expansion and non-gap operating margin, and strong free cash flow generation. Revenues grew 19% a year and RPA grew 22%, capturing the full value of our future revenue. Billings grew 16% year over year. Just as important as we focus on profitable growth, we again delivered substantial operating margin leverage and strong growth in free cash flow. Non-GAAP operating margins of 28.6% expanded nearly 600 basis points year over year, and we generated $2.9 billion in adjusted free cash flow on a trailing 12-month basis. Our strong profitability drove non-GAAP EPS of $1.46 up 39% year-over-year, and our GAAP net income continued to grow meaningfully even without one-time items. Beyond our financial results, we achieved a number of notable milestones in Q2 worthy of spotlighting. We continued to drive large deals, including a steady stream of million-dollar-plus deals and success in our largest deals with 10 transactions over $20 million in the quarter. Our 10 highest spending customers in Q2 increased their spend with us by 36% in the period. I also wanted to update you on key achievements across our three platforms. In our network security business, we continue to see progress driving ARR growth in our SASE business. Q2 was our fifth consecutive quarter of 50% ARR growth. Additionally, more than 30% of our new SASE customers we signed in the second quarter were new to Palo Alto Networks, showing that we can win head-to-head in the market when leading with SASE. We continue to drive innovation in network security, refreshing our high-end 7500 series platform, and investing new OT security capabilities, which garnered a net new leadership position for us. In Prisma Cloud, we made significant investments in the first half of the year to drive new customers and saw this pay off in Q2 with our highest new ACV growth in five quarters. We continue to see strong trends in multi-modular adoption with approximately 30% growth in customers with two or more modules and approximately 60% growth in customers with three or more modules. Additionally, about a quarter of our customers are using five or more modules. Our external recognition in this market continued with Forrester Research positioning us as a leader in its cloud workload security wave report. In Cortex, XIM continues to be a significant catalyst for large transactions and growth across the business. This is evidenced by ARR for XIM customers being more than five times higher than that of Cortex customers who have not yet adopted XIM. We have seen significant progress in the milestone with XIM in Q2, including the most number of deals signed in a single quarter and bookings of over $90 million again this quarter. We've already displaced 19 different SIM vendors to date, and with the confidence under our belt, we're now looking systematically on how we can accelerate this legacy SIM displacement. From a regional perspective, demand overall is healthy. We did see softness in the U.S. federal government's market. We were positioned well for several large projects where we had requisite certifications and one technical selection, but these deals did not close. The situation started off towards the end of Q1, but worsened in Q2, and as a result, we had a significant shortfall in our U.S. federal government business. We expect this trend will continue into our Q3 and Q4. Offsetting the billing weakness in Fed was some non-product backlog that we shipped this quarter. With several leadership positions awarded in the second quarter, including our addition as a leader of the Gartner Endpoint Protection Magic Quadrant, we're now a recognized leader in 21 different categories across our three platforms. Five years ago when we began our strategy, the industry believed building leadership across multiple categories wasn't possible. No one was talking about security platform. Instead, the word was best of breed. Our success over the last five years has been driven by the shift to platformization. We're committed to investing in innovation to extend our industry leadership position and platform. This unique leadership across our three markets is driving strong adoption of our platforms in our target Global 2000 markets. As of Q2, 79% of Global 2000 have transacted with us on at least two of our platforms and 57% in all three. This is up from 73% and 47% two years ago. In most of these accounts, while they have adopted products from multiple platforms, we are early in driving each of our platforms wall to wall. This is a major area of focus for us as we move forward, driving consolidation within our three platforms. We know this is the right strategy as we see compelling economics with multi-platform wins. Our two platform customers have an average customer lifetime value that is more than five times that of our single platform customer. For our three platform customers, that is more than 40 times larger. While we are driving platformization, I personally think we should be doing this faster. Not only is this showing up in our deal statistics, but as we have established the portion of our platforms, position of our platforms, we are now seeing significant progress in consolidating vendors in our customer environments. We built our Zero Trust platforms through consistent architecture across our appliance, software, and SASE form factors. Customers can now consistently manage security policy across these form factors and then leverage a consistent set of security subscriptions to consolidate network security capabilities. These capabilities provided by point vendors can include intrusion prevention, web proxies, URL filtering, SD-WAN, and DLP, just to name a few. In Q2, we saw zero trust consolidation wins that included a large U.S. manufacturing company standardizing our network security platform in a $40 million transaction, replacing end-of-life competitive hardware, leveraging our security subscription, then removing a point competitor in SSE. We were the only company with the right certifications across all these offerings that could support their broad geographic footprint. This deal was part of a consolidation and modernization effort across IT with positive ROI for the customer. We also had a seven figure deal with a large law firm, expanding our firewall footprint in the new data center and expanding their hybrid workforce initiatives with Prisma Access. As part of this, we won versus other firewall and SSE competitors and also consolidated their URL filtering and VPN capabilities. In Prisma Cloud, we have built a core to cloud platform combining key best of breed capabilities that we have acquired or developed organically. Our common architecture and user experience spreads across 12 modules. As our customers adopt multiple modules, they can consolidate a wide variety of vendors, including those in cloud security posture management, cloud workload protection, API security, SCA or software composition analysis, and infrastructure security, amongst others. In Q2, we closed a seven-figure Prisma Cloud new logo deal with a financial services company, displacing multiple incumbent vendors. The customer was looking for a CNAP solution to support their multi-cloud journey. The Prisma Cloud CNAP streamlined several previously deployed point solutions and tools. They also closed a seven-figure renew and expand deal with a leading North American technology company where the customer intends to expand the use of Prisma Cloud to seven modules and also value the consolidation and standardization delivered through Prisma Cloud. Finally, in our Cortex platform with our autonomous security operations platform, XIM, we were able to establish our offering, which has enabled us to accelerate our platform value proposition with Cortex. Our platform approach in the SOC is becoming a customer imperative as point products, each with their own data stores, cannot have full context nor drive appropriate action without overly complex integrations and high people costs. In Q2, we saw consolidation wins that include a large insurance company that renewed their subscriptions, support, and firewalls, and at the same time added Ex-SIM and Expanse capability for a $25 million transaction. The Ex-SIM choice displays the two leading EDR and SIM competitors in the market, enabling the customer to avoid the cost of adding other point products in their SOC. Additionally, in Q2, we saw follow-on consolidation success for the Japanese manufacturing company that previously consolidated their network security across our SASE capabilities, leveraging Prisma Access in our DLP and Gatsby capabilities. The customer then added XO into their SOC and expressed an interest in consolidating further. In Q2, they added XIME in a mid-seven-figure deal. I know if you've had a chance to look at our guidance, our guidance is not a consequence of a change in the demand outlook out there. Our guidance is a consequence of us driving a shift in our strategy in wanting to accelerate both our platformization and consolidation and activating our AI leadership. We believe this is the time for us to invest given our leadership position in the market and our leadership position across platformization and consolidation. But before I talk about that more as to how we intend to accelerate our growth prospects in the future and drive towards a much higher aspiration of $15 billion in ARR by 2030, I want to give you a candid view of where we see the cybersecurity market and the demand function out there. The demand story is no different from prior quarters and on the margin continues to get stronger. There are multiple drivers fueling this. The threat landscape continues to challenge our customers with increasing scale and sophistication of attacks. I'm personally getting calls from CEOs and members of boards that have had bad incidents, as well as those that have seen their peers adversely impacted. We're increasingly focusing on working with companies impacted by breaches, an important commitment as we continue to be the leader in this space. Last quarter, we offered 1,500 of our top customers an opportunity to get our free support during a breach. Surprisingly, 400 customers have signed up in the last 90 days out of 1,500 to get our help on this topic. Clearly, there is awareness and concern around cybersecurity as has never been before. Heightened geopolitical tensions are driving significant nation-state activity with national infrastructure being targeted. Successful breaches and ransomware attacks are being perpetrated across many industries with few repercussions for the bad actors, although we did see various law enforcement agencies this morning, over the weekend, shut down Lockpit, which is a promising sign. The new SEC mandate requires prompt disclosure of material incidents, which often result in companies reporting those incidents before a full assessment can be done, or incidents to mediate it. We see some companies making several disclosures in succession as they grapple with understanding the full extent of what they are facing. We see the results of these disclosure mandates recognizing the need for expedited action and security, visibility, and remediation in the early stage. The part that is new, despite the many demand drivers we're seeing, We're beginning to notice customers are facing spending fatigue in cybersecurity. This is new, as adding incremental point products is not necessarily driving a better security outcome for them. This is driving a greater focus on ROI and total cost of ownership amongst most customers. There are also some key trends within the industry that I think are worth highlighting. Palo Alto Networks is unique in seeing gains in market share in hardware firewalls or in the product space. This market is changing rapidly with us seeing some of our competitors who had introduced price increases begin to roll them back. From our vantage point, We see this share shift happening in our favor because we see customers consolidating into our zero trust platforms. Customers, as I mentioned, 30% net new network security customers for SASE were new to Palo Alto. Those are the customers who over time go ahead and consolidate their footprint and require our firewalls to be deployed, give them a consistent zero trust architecture. We see this as a promising trend. We intend to accelerate that opportunity. Along with the incremental focus on ROI and TCO, the single product vendors having challenges in articulating compelling value, they're also forced to have platformization narrative. When they're not able to convince the customers that their strategy is competitive, they're many times resorting to uneconomic pricing and putting pressure on transactions in this manner. We're beginning to see rogue behavior by some vendors in the space who are keen to retain their customers, primarily in the legacy vendor space and the startup space. We intend to combat that with investing in this space and trying to accelerate platformization and consolidation for our customers. We're also seeing increased demand for AI. Along with deploying AI in our products, we're beginning to see our customers asking us to help them protect for a successful and responsible deployment of AI in their infrastructure. Putting this all together, these trends in the market bolster our conviction that adopting platforms is the only viable strategy for customers and leveraging AI is imperative. We want to march faster to our aspiration to become the sales force, to become the service now, or the workday of cybersecurity. Customers have adopted platforms in other markets across technology, and this will inevitably happen in cybersecurity. These industry trends set up conditions that favor leaders that can drive consolidation. We intend to answer this challenge. With all the promise that platformization holds, adoption is not always easy for many of our customers. Until now, we have primarily assumed that our customers adopt our platforms at their own pace. The crux of the challenge is around execution. Customers face risk in executing or making significant changes to their environments, as well economic exposure from these changes. Key friction points you've noticed include the challenge of replacing multiple products simultaneously, as well as the issues around double-playing while working through complex contract terms. Over the last six months, we have been quietly working to develop programs that enable us to help minimize and even share in the risk of our customers' face. You will see us tomorrow launching a significant number of platform offers to our customers to help drive this consolidation and platformization strategy. We believe we can build customer confidence in our platforms by approaching them well before their point product contracts expire. After we gain their contractual commitment, we have offered an extended rollout period where we can demonstrate our ability to deliver these platform benefits. Customers can then start paying us after the obligation of legacy vendors ends. With the experience we've gained over the last six months, we believe now is the right time to accelerate programs across our portfolio to drive this platformization. All these programs will have mechanisms to reduce customer friction, accelerate product deployment, help customers realize the value of our platforms, and consume new innovation sooner. While this is not an exhaustive list, I wanted to give you some examples. We have begun to launch programs already that include legacy trade-ins, no-cost introductory offers, and product add-ons and incentives to accelerate estate standardization. Each of these programs has elements of reducing execution risk and dealing with the economic exposure that concern our customers. In that sense, we must bear the cost of the transition through lower upfront financial outcomes, but we are convinced these will yield amazing outcomes for us in the mid to long term. We have developed these programs across all three platforms and as I mentioned, we intend, we have announced a few and we intend to announce more starting tomorrow in addition to expanding some of the programs that we already have. Given this is an investor call and you're all focused on these numbers, I want to provide you a high level understanding of the aggregate impact we expect this will have in the medium term and long term. I will then have Deepak talk more about this in his section and explain this much more eloquently and elaborately. We expect a typical customer entering into a platformization transaction will not pay us for our technology for a period of time. As these programs ramp over the next year, we expect a change to our billings and revenue growth for the next 12 to 18 months. As customers move into the period where contracts have a full billing and revenue contribution, we expect to see an acceleration in our top-line metrics. Beyond this dip and acceleration of our top-line metrics, we believe we can sustain higher growth rates for longer, driven by sticky and broad platform relationships with incremental customers, allowing us to aspire to a goal of $15 billion in next-generation security in 2030. We also expect to achieve our transformation to a business with greater than 90% recurring revenue and industry-leading non-gap operating margins in the low to mid-30s. As Deepak will explain, we believe we can do this in a financially prudent and strong manner. Talking about bigger platforms and ARR aspirations cannot be done today without talking about AI. We have been working on AI for a long time as a company. However, we did accelerate our efforts with the arrival of generative AI. I personally believe AI is going to be one of the biggest inflection points in technology in over a decade and likely, more importantly, to significantly increase the total addressable market in cybersecurity. Carter predicts by 2027, $300 billion will be spent on AI software. This AI juggernaut continues to bring several challenges along with it from a security perspective. Multiple vectors of attacks ranging from phishing to malware to nation state activity and inflected negatively due to AI. Furthermore, customers are evaluating dozens of co-pilots type offerings within end users where security is not necessarily front and center. We see three discrete opportunities to drive additional growth in cybersecurity through AI. And we have internally put pen to paper to understand this opportunity and we're in alpha or beta stages of many of these across our product capabilities. First, organizations are concerned about their employees' access to AI in an insecure manner. Whether the consequences are unintended leakage of open source, other data models tampering, or AI-driven phishing, we see an opportunity to add value across the growing volume of users we secure. We currently secure north of 100 million users and their access to applications, both in the public cloud and in the data center. We expect each of these users is an opportunity for us to deliver an AI security sub for them. It's a $3 to $5 billion opportunity over the next five years. Secondly, organizations are increasingly deploying AI-related workloads in the cloud, just like they need to understand the overall security posture of their cloud estates and expeditiously identify and remediate issues. They must do this for AI-related workloads. We believe this in itself is a $5 to $6 billion opportunity in the next five years. Lastly, network traffic will increasingly have an AI context with interactions and transactions between applications and AI models are more than Half a million installed firewalls is the perfect place to inspect this traffic. We believe this is a five to six billion opportunity in the next five years. Overall, this combined 13 to $17 billion opportunity drives our conviction that investing in AI and maintaining our leadership can help us accelerate our growth towards $15 billion by 2030. Beyond the larger opportunity, we also believe we are uniquely positioned to garner our fair share of the stamp. Our proprietary data and large technology footprint is a significant advantage in driving AI outcomes. We've already seen the early benefits of this AI in our newly developed product offerings. In Q2, our AI offerings, which include Exime, Autonomous Digital Experience Management, or ADEM, and AIOps, crossed the $100 million in ARR milestone. We are possibly the first security companies to cross $100 million ARR in AI security. This is above and beyond the AI capabilities we have embedded across all of our platforms, including our advanced subscriptions and our core-to-cloud platforms. Our co-pilots are in alpha, are in the hands of leading customers who are giving us feedback before we move to general availability. Looking forward, we have aggressive plans to roll out additional AI-based offerings by the end of this fiscal year. We have plans to offer three new product offerings, one to address each of the stamps I talked about. Before I wrap up and pass it on to Deepak, I'd like to summarize. We have established our platformization motion, our clear industry leadership position with our best-to-be platforms, and the industry trends convince us we're in the best position to capitalize on this early trend and now focus on the next phase of cybersecurity, which is going to be all about consolidation. One of the hardest things to do is to change the strategy that is working. We have spent time understanding how to accelerate our strategy further. We firmly believe as a management team that the changes we are making today are going to give us better prospects in the mid to long term and allow us to drive this consolidation much faster whilst giving our customers better ROI and total cost of ownership. AI is an opportunity in the early stages. However, we are seeing the signs that there is significant demand there. It will prove to be an inflection point for cybersecurity, and today will be marked as a day where we will see that inflection begin to take hold as we start to deliver more AI security products over the course of the rest of the year. We have confidence we can drive our top-line growth trajectory higher for longer ahead of the growth trajectory we talked about back in August, despite absorbing some short-term impacts. We have shown we run the business in a financially prudent manner, which we will continue to do as we drive this acceleration, hitting our original operating profitably and cash flow margin targets. With that, I will pass on to Deepak.

Thank you, Nikesh, and good afternoon, everyone. Given all that we have to talk about this quarter, I will do an abbreviated review of our Q2 results. You can refer to the press release and supplemental financial information on our website for our key numbers. For Q2, revenue of $1.98 billion grew 19%. Product revenue grew 11%, while total service revenue grew 22%, with subscription revenue growing 26% and support revenue growing 14%. Moving on to geographies, we saw consistent revenue growth across all of our theaters, with the Americas growing 19%, EMEA up 19%, and JPAC also growing 19%. We had some puts and takes during the quarter related to billings. As Nikesh mentioned, we saw weakness in the US federal vertical related to some specific programs. This US federal weakness was a meaningful headwind to our billings in Q2 after we saw a slow start in the year to Fed. The impact of these federal deals on our revenue is significant, as they are relatively shorter than our average contract term. At the same time, we saw a decrease in our non-product backlog, which offset this Fed weakness in our billings. We continued to see customers closely watching cash outlays around deals, which we discussed last quarter, although this trend played out largely as we expected 90 days ago. Remaining performance obligation, or RPO, was $10.8 billion, and current RPO was $5.2 billion. You likely noticed that our GAAP EPS was $4.89 and GAAP net income was $1.75 billion. These benefited from a $1.5 billion release of a tax-related valuation allowance. This was a one-time item in fiscal year 24, which has been adjusted out of our non-GAAP results. This amount also does not impact our cash taxes. Our average duration on new contracts was relatively flat year over year, with average duration for new contracts remaining at approximately three years, while total contract duration was down slightly year over year. I did want to spend more time talking about our accelerated platformization and consolidation strategy and give you more of my perspective with some additional framing and detail with a financial lens. Nikesh talked about our programs to alleviate friction with customers. We believe that by moving from a deal by deal approach to a program based and systematic approach, we can accelerate platformization with our customer base and drive vendor consolidation faster by mitigating platformization friction. This results in a number of business benefits for us ranging from a faster capture of the customer estate and larger platform commitment to higher renewal and expansion rates and faster adoption of our new innovations. For the customer, they are able to execute on the platform deployment with lower risk and consolidate vendors while benefiting from a lower total cost of ownership and a better security posture. As Nikesh gave you the high-level trajectory in our pipeline, I wanted to help you understand how we think about the medium term. Our platformization offers to drive consolidation effectively provide customers a period of the contract for free as part of their commitment. We expect we may see a period of 12 to 18 months of pressure on our top line growth rates, notably billings. Some of our platformization programs embed deferred payments into deal structures, which we have spoken about in the past. We expect this will persist through fiscal year 25 as we anniversary the rollout of these programs and result in billings below the target we provided in August of 2023. Beyond this period, we expect we can sustain higher growth than we provided in these targets in August. From an NGS ARR perspective, we expect less impact on our year-end metrics, and we expect we can continue to meet or exceed our target, which called for 30% growth rate through fiscal year 26. As Nikesh noted, we are establishing a long-term target of $15 billion of NGS ARR in fiscal year 30. Underlying this trend, we expect customers deploying our full set of platforms to have a higher makeup of NGS products. These offerings tend to be deeply installed in our customer infrastructure, and once a customer deploys the platform, it's easier to continue to consolidate vendors and adopt new innovations. We expect this to drive a significant increase in our overall revenue mix that is recurring. From a revenue perspective, we expect to see less pressure on revenue as compared to billings. Generally, we see a lag in changes in our revenue growth versus our billings growth, and we expect that this will happen here as well. As Nikesh mentioned, part of what gives us confidence to execute on the strategy and especially to do so now is our success in driving profitable growth. As we embark on a strategy that we expect will negatively impact the top line in the short term, we have significant confidence that our business scales well, and we can continue to see operating leverage from a number of drivers. As I have mentioned multiple times before, we scale well across every line item of our P&L, ranging from customer support to cloud hosting to sales and marketing to G&A. And we've seen significant payoff from focusing on internal efficiency across all areas of the business. Let me give you some specific examples for Q2. First, in cloud hosting, we signed a significant extension with our primary cloud provider. This contract is constructed to enable us to drive further margin benefits as we scale. Second, within G&A, we're progressing well on a significant employee experience program. This started by analyzing all of our service desk tickets across all channels and identifying all the manual responses needed to address requests. The combination of process re-engineering, automation, and AI is still in progress, but we have already seen positive savings and have a target of automating 90% of the more than 300,000 manual interventions. By the end of Q2, we have roughly halved the cost of our T&E servicing. We are now leveraging this program as a template across other business areas. In short, whilst we made a lot of progress, we still have significant opportunities on the profitability front. That gives us confidence that we can maintain our median term operating margin and free cash margin targets beyond this year. Specifically, we believe that we can expand our operating margins by 100 basis points beyond this year, in line with the operating margin guidance we gave in August of 28% to 29%. And this can continue to support our medium term free cash flow margin target of 37% plus. We expect that this will come despite us absorbing some billings impact as we have both the benefit of some prior arrangements with deferred payments contributing, as well as efforts we have placed on optimizing the cash dynamics of our vendor spending. In short, I wanted to reiterate what Nikesh said, that it is important for us to be able to manage through this platformization acceleration in a financially prudent manner. And we have set ourselves up well to do this over the next 12 to 18 months. Now, moving on to the guidance for Q3 in the year. For the third quarter of 2024, we expect billings to be in the range of 2.30 to 2.35 billion dollars, an increase of two to four percent. We expect revenue to be in the range of 1.95 to 1.98 billion dollars, an increase of 13 to 15 percent. We expect non-GAAP EPS to be in the range of 1.24 to 1.26 dollars, an increase of 13 to 15 percent. For the fiscal year, we expect billings to be in the range of $10.10 to $10.20 billion, an increase of 10 to 11%. We expect NGS ARR to be in the range of $3.95 to $4 billion, an increase of 34 to 35%. We expect revenue to be in the range of $7.95 to $8 billion, an increase of 15 to 16%. We expect operating margins to be in the range of 26.5 to 27%, an increase of 240 to 290 basis points year over year. And we expect non-gap EPS to be in the range of 5.45 to 5.55, an increase of 23 to 25%. We expect adjusted pre-cash flow margin to be 38 to 39%. In the interest of time, and to get as many of your questions as possible, we've included the modeling points in the appendix of our earnings presentation. With that, I will turn the call back over to Walter for the Q&A portion of the call.