Palo Alto Networks, Inc.

Good day, everyone, and welcome to Palo Alto Network's Fiscal Third Quarter 2024 Earnings Conference Call. I'm Walter Prichard, Senior Vice President of Investor Relations and Corporate Development. Please note that this call is being recorded today, Monday, May 20th, 2024, at 1.30 p.m. Pacific Time. With me on today's call to discuss second quarter results are Nikesh Arora, our Chairman and Chief Executive Officer, and Deepak Galecha, our Chief Financial Officer. Following our prepared remarks, Lee Klarich, our chief product officer, will join us for the question and answer portion. You can find the press release and other information to supplement today's discussion on our website at investors.paloaltonetworks.com. While there, please click on the link for quarterly results to find the Q3 24 supplemental information and Q3 24 earnings presentation. During the course of today's call, we may make forward-looking statements and projections regarding the company's business operations and financial performance. These statements are made today are subject to a number of risks and uncertainties that could cause our actual results to differ from those forward-looking statements. Please review our press release and recent SEC filings for a description of these risks and uncertainties. We assume no obligation to update any forward-looking statements made in the presentations today. We will also refer to non gap financial measures these measures should not be considered as a substitute for financial measures prepared in accordance with gap. The most directly comparable gap financial metrics and reconciliations are in the press release and the appendix to the investor presentation unless otherwise noted specifically all results and comparisons are on a fiscal year over year basis. We also note that management is scheduled to participate in the Bank of America Global Technology Conference in June. I will now turn the call over to Nikesh.

Thank you, Walter. Good afternoon, everyone, and thank you for joining us today for our earnings call. I hope everybody enjoyed our new marketing campaign teaser featuring Keanu Reeves that goes live on national media. Let's start at the beginning. I'll update you on what we have experienced in Q3. First and foremost, cyber attacks continue unabated. We're seeing a consistent stream of nation-state activity that is systematically looking for software supply chain and hardware zero-day vulnerabilities and attempting to exploit them at scale. Additionally, there continues to be a robust stream of attack activity targeted at large enterprises and pieces of critical infrastructure. We continue to see high-profile breaches, some of which were widely reported in the press again this quarter. Most organizations face the challenge of an ever-shrinking time window for a bad actor to enter their environments, find valuable data, and exfiltrate it. The window is now measured in hours. In comparison, the time it takes for an organization to discover a breach and stop the malicious activity continues to be measured in days and weeks. While not a new phenomena, with new disclosure mandates, this challenge is now clearly out in the open. With AI, we expect the attacks to come at an even faster pace. I don't need to elaborate on the current enthusiasm around AI. Almost every one of our customers is either experimenting with AI or plans to deploy some use cases in the near future. As usual, their employees are way ahead. Almost 50% of the employees of most companies are using some sort of AI application, LLM, or co-pilot to explore, learn, and make themselves more productive. Whilst this is great for the evolution and adoption of AI, this is introducing a whole new set of threats. As some of you are aware, we have recently announced a suite of products which are aimed to secure this AI usage by design. More about this later, but I expect this to continue to provide a tailwind to the cybersecurity industry. On spending for cybersecurity, we see no change of space or trajectory. Most customers have a series of projects they want to get done, and the only limiting factor seems to be their execution capability. Customers continue to focus on zero-trust transformations, coupled with the need for new network architectures to adapt to a more hybrid infrastructure. The resurgence of cloud migrations is being driven by the need to get their data in the cloud to be AI-ready, causing discussions around the cloud security platform. And as you may all have noticed with all the M&A activity, the security operations space is getting rejuvenated, which is something we've been preparing for with XIM. With the accelerated pace of change in cyber, even with healthy increases in cybersecurity funding, many organizations aim to simply keep pace with the volume of threat activity they see. Most cannot do this and are increasingly receptive to a better way of tracking their security challenges, tackling their security challenges, when there's sprawl and architectural complexity. We firmly believe that answer is platformization of cybersecurity over time. I'm delighted to report, despite the concerns around our platformization approach after our last quarter, the customer feedback has been nothing but encouraging. We have initiated way more conversations in our platformization than we expected. If meetings were a measure of outcome, they have gone up 30%, and a majority of them have been centered on platform opportunities. In short, demand is robust, and my expectation is that we will continue to see it be that way for the next many quarters. With this backdrop, we are pleased with our strong Q3 results. As you can see, we deliver top-line growth ahead of the market and continue to drive growth while improving profitability. Our performance was highlighted by 47% growth in our next-generation security RR. As we continue to transform our business to a security software business, we saw 23% growth in RPO, an uptick from last quarter. This translated into 15% revenue growth and 3% growth in our billings. As we have articulated earlier, we don't see the billing metric as a true indicator of business strength. It continues to be impacted by payment terms where more and more customers prefer annual billing plans. However, if you implied bookings, you will note that we saw an uptick over that over the last two quarters. We actually ended up billing backlog this quarter. We continue to operate our business efficiently. Our operating margins expanded by 200 basis points year over year, driving 25% growth in operating income and 20% in our EPS to $1.32. Our cash generation was strong, and again, our gap net income grew substantially year over year. Before I continue, With highlights from Q3, I'm aware that our accelerated consolidation and platformization strategy created significant conversation last quarter. We also had questions from analysts and investors on this topic since we reported our Q3 results in February. I thought I'd share more background on how we got here to provide context and also offer a platformization framework for you to help understand why we're convinced that we can build a much larger business over the next several years, and platformization is key to achieving that. When we embarked on our journey to transform our company, we were keen to create interest and convince our customers that we could solve their problems, not just with our next generation firewalls and the associated subscriptions, but also with a set of best-of-breed products across 20 plus categories, organized across three platforms. That strategy was hugely successful and saw us achieving nearly $4 billion in NGS ARR. The majority of focus of our teams was landing multiple products across our three platforms and our customers. Whether we were able to land at a brand new customer for Palo Alto Networks, or we added products from new platforms to our existing customers, we were happy. Landing could range from a single product used in part of the organization to broader usage across the organization. From that lens, if you look at our top 5,000 customers, we have landed two or more of our platforms at about half these customers, and these customers contribute just over 80% of our NGSARR. If you look at it by platform, we have landed 97% of these top 5,000 network security, over 20% of them in Prisma Cloud, and over 40% with Cortex. By all means, our land the platform strategy was extremely successful. In landing with multiple platforms, many of our customers have leveraged our capabilities across key cybersecurity buying centers such as network security, cloud security, and security ops. Most of this cross-platform adoption has happened more organically, with customers adopting incremental products from Palo Alto Networks at their own pace. Governed by the complexity of the environment and the friction of dealing with contracts from multiple vendors, not many of our landed customers are fully platformized. In the ones that are fully platformized, we saw encouraging results. We realized that for fully platformized customers, while they saw better security outcomes, our ARR profile was also very different. While our average next-generation security ARR for our landed customers ranges from $200,000 to $800,000, for our land strategy, we discovered that our ARR for fully platformized customers ranges from $2 million to $14 million, depending on how many platforms the customers are standardizing on. This drove us to accelerate the rollout of our platformization strategy at the end of the last quarter, following successful pilots earlier in the year. We've created interest in the market, started conversations with customers looking to begin their platformization journey, and spurring existing sales cycles toward a more strategic outcome. Having personally reviewed over 500 of our top customers in detail this past quarter, and having had a few hundred conversations with CISOs, CIOs, and CEOs, I continue to be convinced of our opportunity to deliver full platformization to our top customers. We're still early in the results from full platformization. Across these top 5,000 customers, we have completed about 900 through Q3 2024. Our Q3 efforts resulted in approximately 65 incremental platformization sales in Q3, which is up 40% since Q2. It was this framework that was the foundation for our goal of $15 billion in next-generation security RR by fiscal year 2030 that we first discussed last quarter. With our incremental momentum and platformization, we see a runway to delivering approximately 2,500 plus platformization sales, up from the current 900, while continuing to land our multiple platforms in our customer base and adding new customers. I showed you the benefits we see in our ARR from our success driving platformization. Our customers also see significant benefits as they adopt our full platforms. We have talked to you in the past about reduction in median time resolution with XIM, which takes less than 1 tenth of the time it took before XIM was deployed, as customers platformize on Cortex. IDC recently validated the benefits platform customers see in a study published earlier this year, independently proving much of what we have talked about. Customers saw productivity benefits as much as 30 to 40% efficiency improvements and significant improvements in security outcomes. I could talk further about the benefits, but what really brings this to the forefront is some examples of our significant transactions in Q3. A U.S. county agency signed a seven-figure transaction, landing our firewall subscriptions as well as Cortex XDR, and becoming a Plattel Alto customer for the first time. We displaced a competitor that had sold both of these capabilities to the customer and competed against us on an appliance vendor that could not offer best-of-breed capabilities across these two categories. A large U.S. financial services company that was an existing platform customer faced significant challenges in their SOC. Despite a staff of 40 in the SOC, they were not achieving their goals and sought a transformation plan. We signed an eight-figure deal, including XIM, our ITDR, or Identity Threat Detection and Response Offering, and our Management Detection and Response Service. The global data services provider was unhappy with its incumbent SASE provider, facing outages that created lost productivity. It was also never able to integrate its VPN and URL filtering capabilities fully. The customer selected our SASE capability for approximately 65,000 mobile and branch office users, including CASB, DLP, enterprise browser, and ADEM capabilities for many of them. This was a highly competitive situation, but our ability to deliver consolidated capabilities through a platform across a half a dozen areas, as well as our superior security versus incumbent, one of the business. Finally, a large healthcare company experienced a breach and engaged our Unit 42 incident response services. After we helped the customer remediate and get back online, we were able to educate the customer on the benefits of platformization. The customer fully platformized with us, standardizing on network security, Prisma Cloud, and Cortex. This transaction was the largest in the history of Palo Alto Networks at nearly $150 million of TCD. Beyond these showcase deals, our overall large deal activity was healthy in Q3, as shown by significant increases in our accounts with transactions over $1, $5, and $10 million in the quarter. We also recently announced our partnership with IBM. IBM and Palo Alto Networks have done what, in my mind, is a one-of-a-kind partnership. This partnership involves migrating the QR customers of IBM to XIM, where IBM will be able to deliver industry-specific capabilities on XIM using Watson X. Given the leadership position of the Gartner Magic Quadrant, now we can collectively deliver an even better solution to both their existing and new customers. Enabling over 1,000 IBM security consultants on the entire Palo Alto Network's portfolio will allow us to drive platformization in an accelerated fashion. We will be IBM's preferred cybersecurity partner across network, cloud, and SOC, while driving a significant book of business for IBM. Additionally, IBM will platformize on Palo Alto products. We will extensively leverage Watson X across both our operations and products. And lastly, but not the least, we will work on co-developing solutions for cloud security. Last quarter, when we rolled out our accelerated consolidation platformization strategy, we also activated our AI leadership strategy. Leading up to this, over the last year, we've oriented an increasing portion of our R&D investments towards AI. We have seen growth in customer interest and adopting AI to drive business value and bad actors using AI, as I discussed earlier. In early May, we announced our comprehensive suite of AI security offerings and believe we will be first to market with capabilities to protect the range of our customers' AI security needs. We rolled out three products to safely enable the use of AI, from employees using AI to enterprises building AI into their applications. AI access security, AI SPM, and AI runtime security put us at the forefront of securing AI adoption. We also believe our co-pilots across our three platforms, which are context aware, can perform and automate user action, surface alerts, and best practices, and provide in-product support, all with near perfect accuracy. Furthermore, we announced our precision AI security bundle to leverage inline AI to counter AI attacks with AI defense. We have had strong early customer engagement with these offerings, which we expect to be made generally available beginning of July. As you heard from our teaser trailer with Keanu, this isn't sci-fi, this is precision AI. More broadly than AI, it has been a busy last three months from an innovation perspective. On SaaS, our SASE tiered launch, which we rolled out early this month, debuted with several unique industry-defining capabilities. We announced the industry's only secure enterprise browser integrated into SASE, and as end user engagement with AI applications grow, the browser becomes an important defense layer against AI threats. Additionally, it is becoming clear that the browser offers a better way to secure contractors' mobile devices and managed devices, with SASE integration providing a simpler and more secure approach to adoption. We launched AI-powered data security integrated into SASE, leveraging industry's first LLM-powered data classification. This new classification engine combines the strength of context-aware machine learning models with the power of LLMs, understanding how to increase classification accuracy. Lastly, as part of our SASE 3.0, we launched application acceleration, which understands each user's journey within enterprise SaaS and cloud applications and optimizes performance for these applications. Customers see performance up to five times faster than the user experience on the general internet. This rapid cadence of innovation in SASE has enabled us to maintain SASE ARR growth above 50% for the sixth quarter in a row. In Prisma Cloud, we have completed the first phase rollout of data security posture management, which came from the big security acquisition. We also added support for more than 100 new APIs across the major hyperscalers to stay ahead of our customers by securing the cloud services they adopt. Based on our Cortex Xpans technology, we did launch cloud discovery and exposure management, leveraging our Xpans data natively in FISMA Cloud. Over 100 customers now use this capability to evaluate internet exposure risks and discover unknown internet exposed cloud assets. Also during Q3, we launched CDR, Cloud Detection Response, which extends our XDR capability into the cloud and give customers a unified view of their entire environment from cloud to endpoint to network. CDEM and CDR show the power of having both Cortex and Plisma cloud platforms, as we can leverage these sophisticated capabilities to benefit cloud customers. Last but not least, on Cortex, we launched XIAM about 18 months ago, and this offering has already elevated the profile of Cortex in the market. We see steady demand for XDR as the foundation of Cortex, where we are landing many new customers, and now we have north of 5,800 customers on XDR. With $400 million in cumulative XIAM bookings coming out of Q3, This offering is really going mainstream with customers understanding the value proposition versus a traditional SIEM. Ex-SIEM has accelerated our Cortex ARR growth, and we continue to see a strong pipeline of opportunities. We are converting our innovation into recognized leadership, adding two new positions this quarter. One was in managed detection response, the other in data security posture management, leveraging our DIG acquisition and demonstrating our ability to acquire technology and rapidly integrate into our platforms. As many of you have undoubtedly seen, our rollout of platformization has stoked a long-standing debate within the cybersecurity industry about whether customers desire a platform or best-of-breed cybersecurity. From the Palo Alto Network's perspective, we've proven it is possible to deliver best-of-platform. This is why we have invested in building leading products, and we have now recognition for product leadership in 23 categories, while also delivering on the benefits of integration across all three platforms. To summarize, before I pass off to Deepak, please take away a few conclusions from my prepared remarks. One, we put out strong cues to results in a positive spending environment where cybersecurity priorities are well funded. Beyond the continuation of a challenging threat environment, new threat vectors from AI are starting to surface as the usage of AI grows. We've been pleased with the initial traction of our accelerated consolidation platform strategy. This drove an increase in bookings with deferred payments and impacted our billings, something we expect will continue. We had a big quarter of innovation, especially as it relates to AI, where we strive to lead the industry in securing this powerful productivity medium while also doing so comprehensively. As we look forward, we have significant pipeline heading into our largest quarter of the year. We're just beginning to see the benefits of platformization accrue to our business. We will continue to make further investments here while balancing delivering profitable growth and have charted a path with conviction towards being a $15 billion NGSAR company. With that, let me pass you on to Deepak.

Thank you, Nikesh, and good afternoon, everyone. To maximize our time spent on Q&A, I will provide highlights and you can review results available in our press release and supplemental financial information on our website. Within our revenue of $1.98 billion, product revenue grew 1% while total service revenue grew 20%. Within services revenue, subscription revenue grew 25% and support revenue grew 11%. Moving on to geographies, we saw revenue growth across all theaters, with the Americas growing 15%, EMEA up 20%, and JPAC growing 8%. This quarter, our lower JPAC revenue growth was driven by lower product bookings in the region, offset by higher subscription bookings, which benefit revenue over time. We reported Q3 billings within the range we guided, although as Nikesh and I have noted several times in the past few quarters, we continue to focus less on this metric. We saw an increase quarter over quarter in business transacted with deferred billings, which was also higher than we forecasted. The impact on our financials from platformization this quarter was in line with what we expected 90 days ago, and our expectations around the impact in Q4 and beyond is unchanged from what we talked about in February. First, we saw a greater volume of large deals with some of these customers opting for deferred payments over the term of their purchase instead of paying upfront as they grapple with the higher cost of money. This drove the quarter-to-quarter increase in periodic billing plans that I noted. Also, this level of periodic billings was higher than we forecasted 90 days ago. We also saw an uptake in the array of our platformization programs we launched early in the quarter. These programs continue to ramp up as we roll them out broadly. Within our RPO of $11.3 billion, our current RPO was $5.4 billion. Our average duration of new contracts increased slightly year over year, but remained at approximately three years. On our balance sheet, you will see that our debt balance came down by $659 million. The driver for this was early conversion, which occurred at the option of the debt holders and was settled by us in cash. Our remaining debt matures in June 2025, although we may continue to see early conversions. During Q3, we spent $500 million to repurchase 1.7 million shares of our common stock. Our buyback strategy remains opportunistic. I know that billings has been a significant focus for investors. As you're all aware, remaining performance obligation, or RPO, captures the full value of our contracts, independent of customer billing terms. As we've explained to you over the last year, with an increase in factors impacting payment terms on a quarterly basis, there's been significant volatility in our billings. With this volatility in mind, we've been increasingly focused on driving high-quality bookings, which add to RPO and maximize our NGS ARR in contracts. Focuses on these metrics provides a more relevant view of the business. If we look at the history of these metrics for our company, you see that NGS ARR has consistently grown ahead of our other metrics, and as it continues to contribute a higher proportion of our revenue. You also see the correlation between RPO and total services revenue growth is high. Our RPO is mainly comprised of contracts for offerings that carry ratable revenue, which are recognized through our total services revenue. Billings, on the other hand, is significantly influenced by the invoicing terms on contract signed, which adds significant volatility. In Q3, we saw RPO growth tick up, along with strength in NGS ARR, including us raising our guidance here. This is in contrast to billing trends, which went the other direction, thereby showing the divergent trends in action in Q3 results. Nikesh talked briefly about our first of a kind IBM partnership that has multiple facets that touch each of our platforms and includes significant devotion of resources from both companies. I'd like to provide more details on the financial impact we expect to see. As part of the partnership, we've agreed to acquire IBM's QRadar SaaS assets, certain QRadar intellectual property, and IBM's on-premise QRadar customer list. The total consideration is $500 million plus earn-out consideration based on successfully migrating QRadar on-premise customers to our XAM offering over the next several years. We anticipate closing the transaction by the end of September 2024, subject to regulatory approvals and other customary closing conditions. The calendar year 2023 QRadar SaaS revenue was on the order of $100 million. However, as we work through details of the customer contracts we are acquiring and the deferred revenue associated with this business, we expect our recognized revenue could be much lower than this in our fiscal year 2025. We will provide more information on the financial impact closer to the close of the transaction. We will invest to fuel this partnership and ensure a seamless experience for QRadar customers purchasing and migrating to XIM. As part of the partnership, we have entered into an agreement with IBM whereby they will operate parts of the business on our behalf on a medium-term basis. We expect we can make these investments within the profitability framework we spoke of previously. Specifically, we continue to expect 28 to 29% non-GAAP operating margin in fiscal year 2026 and 37% or greater free cash flow margin through fiscal year 2026. Before I provide Q4 guidance, I wanted to remind you of what we talked last quarter when we introduced platformization and discussed the top-line headwinds we expected it would have. We continue to expect platformization-related drivers, both larger deals with associated cost of money impacts and acceleration in platformization programs, will impact our billings over a total of a 12- to 18-month period. Consistent with what we noted in February, we expect that this will persist through fiscal year 25 as we anniversary the rollout of these programs and resulting in lower billings and, to a lesser degree, revenue. Beyond this period, we expect to grow faster than we discussed in August and sustain this growth for longer. Now moving on to our guidance for Q4 of the year. For the fourth quarter of 2024, we expect billings to be in the range of $3.43 to $3.48 billion, an increase of 9 to 10 percent. We expect revenue to be in the range of $2.15 to $2.17 billion, an increase of 10 to 11 percent. We expect non-GAAP EPS to be in the range of $1.40 to $1.42 a share, a decrease of 1 to 3 percent. For the fiscal year 24, we expect billings to be in the range of $10.13 to $10.18 billion, an increase of 10% to 11%. We expect NGS ARR to be in the range of $4.05 to $4.10 billion, an increase of 37% to 39%. We expect revenue to be in the range of $7.99 to $8.01 billion, an increase of 16%. For fiscal 24, we expect operating margins to be in the range of 26.8 to 27.0%, an increase of 270 to 290 basis points year over year. We expect our non-GAAP EPS to be in the range of $556 to $558 per share, an increase of 25 to 26%. And we expect adjusted free cash flow margin to be 38.5 to 39%. In the interest of time and to get as many of your questions as possible, we've included the modeling points in the appendix of our earnings presentation. With that, I will turn the call back over to Walter for the Q&A portion.