Palo Alto Networks, Inc.

Good day, everyone, and welcome to Palo Alto Network's Fiscal Third Quarter 2024 Earnings Conference Call. I'm Walter Prichard, Senior Vice President of Investor Relations and Corporate Development. Please note that this call is being recorded today, Monday, May 20th, 2024, at 1.30 p.m. Pacific Time. With me on today's call to discuss second quarter results are Nikesh Arora, our Chairman and Chief Executive Officer, and Deepak Galecha, our Chief Financial Officer. Following our prepared remarks, Lee Klarich, our chief product officer, will join us for the question and answer portion. You can find the press release and other information to supplement today's discussion on our website at investors.paloaltonetworks.com. While there, please click on the link for quarterly results to find the Q3 24 supplemental information and Q3 24 earnings presentation. During the course of today's call, we may make forward-looking statements and projections regarding the company's business operations and financial performance. These statements are made today are subject to a number of risks and uncertainties that could cause our actual results to differ from those forward-looking statements. Please review our press release and recent SEC filings for a description of these risks and uncertainties. We assume no obligation to update any forward-looking statements made in the presentations today. We will also refer to non gap financial measures these measures should not be considered as a substitute for financial measures prepared in accordance with gap. The most directly comparable gap financial metrics and reconciliations are in the press release and the appendix to the investor presentation unless otherwise noted specifically all results and comparisons are on a fiscal year over year basis. We also note that management is scheduled to participate in the Bank of America Global Technology Conference in June. I will now turn the call over to Nikesh.

Thank you, Walter. Good afternoon, everyone, and thank you for joining us today for our earnings call. I hope everybody enjoyed our new marketing campaign teaser featuring Keanu Reeves that goes live on national media. Let's start at the beginning. I'll update you on what we have experienced in Q3. First and foremost, cyber attacks continue unabated. We're seeing a consistent stream of nation-state activity that is systematically looking for software supply chain and hardware zero-day vulnerabilities and attempting to exploit them at scale. Additionally, there continues to be a robust stream of attack activity targeted at large enterprises and pieces of critical infrastructure. We continue to see high-profile breaches, some of which were widely reported in the press again this quarter. Most organizations face the challenge of an ever-shrinking time window for a bad actor to enter their environments, find valuable data, and exfiltrate it. The window is now measured in hours. In comparison, the time it takes for an organization to discover a breach and stop the malicious activity continues to be measured in days and weeks. While not a new phenomena, with new disclosure mandates, this challenge is now clearly out in the open. With AI, we expect the attacks to come at an even faster pace. I don't need to elaborate on the current enthusiasm around AI. Almost every one of our customers is either experimenting with AI or plans to deploy some use cases in the near future. As usual, their employees are way ahead. Almost 50% of the employees of most companies are using some sort of AI application, LLM, or co-pilot to explore, learn, and make themselves more productive. Whilst this is great for the evolution and adoption of AI, this is introducing a whole new set of threats. As some of you are aware, we have recently announced a suite of products which are aimed to secure this AI usage by design. More about this later, but I expect this to continue to provide a tailwind to the cybersecurity industry. On spending for cybersecurity, we see no change of space or trajectory. Most customers have a series of projects they want to get done, and the only limiting factor seems to be their execution capability. Customers continue to focus on zero-trust transformations, coupled with the need for new network architectures to adapt to a more hybrid infrastructure. The resurgence of cloud migrations is being driven by the need to get their data in the cloud to be AI-ready, causing discussions around the cloud security platform. And as you may all have noticed with all the M&A activity, the security operations space is getting rejuvenated, which is something we've been preparing for with XIM. With the accelerated pace of change in cyber, even with healthy increases in cybersecurity funding, many organizations aim to simply keep pace with the volume of threat activity they see. Most cannot do this and are increasingly receptive to a better way of tracking their security challenges, tackling their security challenges, when there's sprawl and architectural complexity. We firmly believe that answer is platformization of cybersecurity over time. I'm delighted to report, despite the concerns around our platformization approach after our last quarter, the customer feedback has been nothing but encouraging. We have initiated way more conversations in our platformization than we expected. If meetings were a measure of outcome, they have gone up 30%, and a majority of them have been centered on platform opportunities. In short, demand is robust, and my expectation is that we will continue to see it be that way for the next many quarters. With this backdrop, we are pleased with our strong Q3 results. As you can see, we deliver top-line growth ahead of the market and continue to drive growth while improving profitability. Our performance was highlighted by 47% growth in our next-generation security RR. As we continue to transform our business to a security software business, we saw 23% growth in RPO, an uptick from last quarter. This translated into 15% revenue growth and 3% growth in our billings. As we have articulated earlier, we don't see the billing metric as a true indicator of business strength. It continues to be impacted by payment terms where more and more customers prefer annual billing plans. However, if you implied bookings, you will note that we saw an uptick over that over the last two quarters. We actually ended up billing backlog this quarter. We continue to operate our business efficiently. Our operating margins expanded by 200 basis points year over year, driving 25% growth in operating income and 20% in our EPS to $1.32. Our cash generation was strong, and again, our gap net income grew substantially year over year. Before I continue, With highlights from Q3, I'm aware that our accelerated consolidation and platformization strategy created significant conversation last quarter. We also had questions from analysts and investors on this topic since we reported our Q3 results in February. I thought I'd share more background on how we got here to provide context and also offer a platformization framework for you to help understand why we're convinced that we can build a much larger business over the next several years, and platformization is key to achieving that. When we embarked on our journey to transform our company, we were keen to create interest and convince our customers that we could solve their problems, not just with our next generation firewalls and the associated subscriptions, but also with a set of best-of-breed products across 20 plus categories, organized across three platforms. That strategy was hugely successful and saw us achieving nearly $4 billion in NGS ARR. The majority of focus of our teams was landing multiple products across our three platforms and our customers. Whether we were able to land at a brand new customer for Palo Alto Networks, or we added products from new platforms to our existing customers, we were happy. Landing could range from a single product used in part of the organization to broader usage across the organization. From that lens, if you look at our top 5,000 customers, we have landed two or more of our platforms at about half these customers, and these customers contribute just over 80% of our NGSARR. If you look at it by platform, we have landed 97% of these top 5,000 network security, over 20% of them in Prisma Cloud, and over 40% with Cortex. By all means, our land the platform strategy was extremely successful. In landing with multiple platforms, many of our customers have leveraged our capabilities across key cybersecurity buying centers such as network security, cloud security, and security ops. Most of this cross-platform adoption has happened more organically, with customers adopting incremental products from Palo Alto Networks at their own pace. Governed by the complexity of the environment and the friction of dealing with contracts from multiple vendors, not many of our landed customers are fully platformized. In the ones that are fully platformized, we saw encouraging results. We realized that for fully platformized customers, while they saw better security outcomes, our ARR profile was also very different. While our average next-generation security ARR for our landed customers ranges from $200,000 to $800,000, for our land strategy, we discovered that our ARR for fully platformized customers ranges from $2 million to $14 million, depending on how many platforms the customers are standardizing on. This drove us to accelerate the rollout of our platformization strategy at the end of the last quarter, following successful pilots earlier in the year. We've created interest in the market, started conversations with customers looking to begin their platformization journey, and spurring existing sales cycles toward a more strategic outcome. Having personally reviewed over 500 of our top customers in detail this past quarter, and having had a few hundred conversations with CISOs, CIOs, and CEOs, I continue to be convinced of our opportunity to deliver full platformization to our top customers. We're still early in the results from full platformization. Across these top 5,000 customers, we have completed about 900 through Q3 2024. Our Q3 efforts resulted in approximately 65 incremental platformization sales in Q3, which is up 40% since Q2. It was this framework that was the foundation for our goal of $15 billion in next-generation security RR by fiscal year 2030 that we first discussed last quarter. With our incremental momentum and platformization, we see a runway to delivering approximately 2,500 plus platformization sales, up from the current 900, while continuing to land our multiple platforms in our customer base and adding new customers. I showed you the benefits we see in our ARR from our success driving platformization. Our customers also see significant benefits as they adopt our full platforms. We have talked to you in the past about reduction in median time resolution with XIM, which takes less than 1 tenth of the time it took before XIM was deployed, as customers platformize on Cortex. IDC recently validated the benefits platform customers see in a study published earlier this year, independently proving much of what we have talked about. Customers saw productivity benefits as much as 30 to 40% efficiency improvements and significant improvements in security outcomes. I could talk further about the benefits, but what really brings this to the forefront is some examples of our significant transactions in Q3. A U.S. county agency signed a seven-figure transaction, landing our firewall subscriptions as well as Cortex XDR, and becoming a Plattel Alto customer for the first time. We displaced a competitor that had sold both of these capabilities to the customer and competed against us on an appliance vendor that could not offer best-of-breed capabilities across these two categories. A large U.S. financial services company that was an existing platform customer faced significant challenges in their SOC. Despite a staff of 40 in the SOC, they were not achieving their goals and sought a transformation plan. We signed an eight-figure deal, including XIM, our ITDR, or Identity Threat Detection and Response Offering, and our Management Detection and Response Service. The global data services provider was unhappy with its incumbent SASE provider, facing outages that created lost productivity. It was also never able to integrate its VPN and URL filtering capabilities fully. The customer selected our SASE capability for approximately 65,000 mobile and branch office users, including CASB, DLP, enterprise browser, and ADEM capabilities for many of them. This was a highly competitive situation, but our ability to deliver consolidated capabilities through a platform across a half a dozen areas, as well as our superior security versus incumbent, one of the business. Finally, a large healthcare company experienced a breach and engaged our Unit 42 incident response services. After we helped the customer remediate and get back online, we were able to educate the customer on the benefits of platformization. The customer fully platformized with us, standardizing on network security, Prisma Cloud, and Cortex. This transaction was the largest in the history of Palo Alto Networks at nearly $150 million of TCD. Beyond these showcase deals, our overall large deal activity was healthy in Q3, as shown by significant increases in our accounts with transactions over $1, $5, and $10 million in the quarter. We also recently announced our partnership with IBM. IBM and Palo Alto Networks have done what, in my mind, is a one-of-a-kind partnership. This partnership involves migrating the QR customers of IBM to XIM, where IBM will be able to deliver industry-specific capabilities on XIM using Watson X. Given the leadership position of the Gartner Magic Quadrant, now we can collectively deliver an even better solution to both their existing and new customers. Enabling over 1,000 IBM security consultants on the entire Palo Alto Network's portfolio will allow us to drive platformization in an accelerated fashion. We will be IBM's preferred cybersecurity partner across network, cloud, and SOC, while driving a significant book of business for IBM. Additionally, IBM will platformize on Palo Alto products. We will extensively leverage Watson X across both our operations and products. And lastly, but not the least, we will work on co-developing solutions for cloud security. Last quarter, when we rolled out our accelerated consolidation platformization strategy, we also activated our AI leadership strategy. Leading up to this, over the last year, we've oriented an increasing portion of our R&D investments towards AI. We have seen growth in customer interest and adopting AI to drive business value and bad actors using AI, as I discussed earlier. In early May, we announced our comprehensive suite of AI security offerings and believe we will be first to market with capabilities to protect the range of our customers' AI security needs. We rolled out three products to safely enable the use of AI, from employees using AI to enterprises building AI into their applications. AI access security, AI SPM, and AI runtime security put us at the forefront of securing AI adoption. We also believe our co-pilots across our three platforms, which are context aware, can perform and automate user action, surface alerts, and best practices, and provide in-product support, all with near perfect accuracy. Furthermore, we announced our precision AI security bundle to leverage inline AI to counter AI attacks with AI defense. We have had strong early customer engagement with these offerings, which we expect to be made generally available beginning of July. As you heard from our teaser trailer with Keanu, this isn't sci-fi, this is precision AI. More broadly than AI, it has been a busy last three months from an innovation perspective. On SaaS, our SASE tiered launch, which we rolled out early this month, debuted with several unique industry-defining capabilities. We announced the industry's only secure enterprise browser integrated into SASE, and as end user engagement with AI applications grow, the browser becomes an important defense layer against AI threats. Additionally, it is becoming clear that the browser offers a better way to secure contractors' mobile devices and managed devices, with SASE integration providing a simpler and more secure approach to adoption. We launched AI-powered data security integrated into SASE, leveraging industry's first LLM-powered data classification. This new classification engine combines the strength of context-aware machine learning models with the power of LLMs, understanding how to increase classification accuracy. Lastly, as part of our SASE 3.0, we launched application acceleration, which understands each user's journey within enterprise SaaS and cloud applications and optimizes performance for these applications. Customers see performance up to five times faster than the user experience on the general internet. This rapid cadence of innovation in SASE has enabled us to maintain SASE ARR growth above 50% for the sixth quarter in a row. In Prisma Cloud, we have completed the first phase rollout of data security posture management, which came from the big security acquisition. We also added support for more than 100 new APIs across the major hyperscalers to stay ahead of our customers by securing the cloud services they adopt. Based on our Cortex Xpans technology, we did launch cloud discovery and exposure management, leveraging our Xpans data natively in FISMA Cloud. Over 100 customers now use this capability to evaluate internet exposure risks and discover unknown internet exposed cloud assets. Also during Q3, we launched CDR, Cloud Detection Response, which extends our XDR capability into the cloud and give customers a unified view of their entire environment from cloud to endpoint to network. CDEM and CDR show the power of having both Cortex and Plisma cloud platforms, as we can leverage these sophisticated capabilities to benefit cloud customers. Last but not least, on Cortex, we launched XIAM about 18 months ago, and this offering has already elevated the profile of Cortex in the market. We see steady demand for XDR as the foundation of Cortex, where we are landing many new customers, and now we have north of 5,800 customers on XDR. With $400 million in cumulative XIAM bookings coming out of Q3, This offering is really going mainstream with customers understanding the value proposition versus a traditional SIEM. Ex-SIEM has accelerated our Cortex ARR growth, and we continue to see a strong pipeline of opportunities. We are converting our innovation into recognized leadership, adding two new positions this quarter. One was in managed detection response, the other in data security posture management, leveraging our DIG acquisition and demonstrating our ability to acquire technology and rapidly integrate into our platforms. As many of you have undoubtedly seen, our rollout of platformization has stoked a long-standing debate within the cybersecurity industry about whether customers desire a platform or best-of-breed cybersecurity. From the Palo Alto Network's perspective, we've proven it is possible to deliver best-of-platform. This is why we have invested in building leading products, and we have now recognition for product leadership in 23 categories, while also delivering on the benefits of integration across all three platforms. To summarize, before I pass off to Deepak, please take away a few conclusions from my prepared remarks. One, we put out strong cues to results in a positive spending environment where cybersecurity priorities are well funded. Beyond the continuation of a challenging threat environment, new threat vectors from AI are starting to surface as the usage of AI grows. We've been pleased with the initial traction of our accelerated consolidation platform strategy. This drove an increase in bookings with deferred payments and impacted our billings, something we expect will continue. We had a big quarter of innovation, especially as it relates to AI, where we strive to lead the industry in securing this powerful productivity medium while also doing so comprehensively. As we look forward, we have significant pipeline heading into our largest quarter of the year. We're just beginning to see the benefits of platformization accrue to our business. We will continue to make further investments here while balancing delivering profitable growth and have charted a path with conviction towards being a $15 billion NGSAR company. With that, let me pass you on to Deepak.

Thank you, Nikesh, and good afternoon, everyone. To maximize our time spent on Q&A, I will provide highlights and you can review results available in our press release and supplemental financial information on our website. Within our revenue of $1.98 billion, product revenue grew 1% while total service revenue grew 20%. Within services revenue, subscription revenue grew 25% and support revenue grew 11%. Moving on to geographies, we saw revenue growth across all theaters, with the Americas growing 15%, EMEA up 20%, and JPAC growing 8%. This quarter, our lower JPAC revenue growth was driven by lower product bookings in the region, offset by higher subscription bookings, which benefit revenue over time. We reported Q3 billings within the range we guided, although as Nikesh and I have noted several times in the past few quarters, we continue to focus less on this metric. We saw an increase quarter over quarter in business transacted with deferred billings, which was also higher than we forecasted. The impact on our financials from platformization this quarter was in line with what we expected 90 days ago, and our expectations around the impact in Q4 and beyond is unchanged from what we talked about in February. First, we saw a greater volume of large deals with some of these customers opting for deferred payments over the term of their purchase instead of paying upfront as they grapple with the higher cost of money. This drove the quarter-to-quarter increase in periodic billing plans that I noted. Also, this level of periodic billings was higher than we forecasted 90 days ago. We also saw an uptake in the array of our platformization programs we launched early in the quarter. These programs continue to ramp up as we roll them out broadly. Within our RPO of $11.3 billion, our current RPO was $5.4 billion. Our average duration of new contracts increased slightly year over year, but remained at approximately three years. On our balance sheet, you will see that our debt balance came down by $659 million. The driver for this was early conversion, which occurred at the option of the debt holders and was settled by us in cash. Our remaining debt matures in June 2025, although we may continue to see early conversions. During Q3, we spent $500 million to repurchase 1.7 million shares of our common stock. Our buyback strategy remains opportunistic. I know that billings has been a significant focus for investors. As you're all aware, remaining performance obligation, or RPO, captures the full value of our contracts, independent of customer billing terms. As we've explained to you over the last year, with an increase in factors impacting payment terms on a quarterly basis, there's been significant volatility in our billings. With this volatility in mind, we've been increasingly focused on driving high-quality bookings, which add to RPO and maximize our NGS ARR in contracts. Focuses on these metrics provides a more relevant view of the business. If we look at the history of these metrics for our company, you see that NGS ARR has consistently grown ahead of our other metrics, and as it continues to contribute a higher proportion of our revenue. You also see the correlation between RPO and total services revenue growth is high. Our RPO is mainly comprised of contracts for offerings that carry ratable revenue, which are recognized through our total services revenue. Billings, on the other hand, is significantly influenced by the invoicing terms on contract signed, which adds significant volatility. In Q3, we saw RPO growth tick up, along with strength in NGS ARR, including us raising our guidance here. This is in contrast to billing trends, which went the other direction, thereby showing the divergent trends in action in Q3 results. Nikesh talked briefly about our first of a kind IBM partnership that has multiple facets that touch each of our platforms and includes significant devotion of resources from both companies. I'd like to provide more details on the financial impact we expect to see. As part of the partnership, we've agreed to acquire IBM's QRadar SaaS assets, certain QRadar intellectual property, and IBM's on-premise QRadar customer list. The total consideration is $500 million plus earn-out consideration based on successfully migrating QRadar on-premise customers to our XAM offering over the next several years. We anticipate closing the transaction by the end of September 2024, subject to regulatory approvals and other customary closing conditions. The calendar year 2023 QRadar SaaS revenue was on the order of $100 million. However, as we work through details of the customer contracts we are acquiring and the deferred revenue associated with this business, we expect our recognized revenue could be much lower than this in our fiscal year 2025. We will provide more information on the financial impact closer to the close of the transaction. We will invest to fuel this partnership and ensure a seamless experience for QRadar customers purchasing and migrating to XIM. As part of the partnership, we have entered into an agreement with IBM whereby they will operate parts of the business on our behalf on a medium-term basis. We expect we can make these investments within the profitability framework we spoke of previously. Specifically, we continue to expect 28 to 29% non-GAAP operating margin in fiscal year 2026 and 37% or greater free cash flow margin through fiscal year 2026. Before I provide Q4 guidance, I wanted to remind you of what we talked last quarter when we introduced platformization and discussed the top-line headwinds we expected it would have. We continue to expect platformization-related drivers, both larger deals with associated cost of money impacts and acceleration in platformization programs, will impact our billings over a total of a 12- to 18-month period. Consistent with what we noted in February, we expect that this will persist through fiscal year 25 as we anniversary the rollout of these programs and resulting in lower billings and, to a lesser degree, revenue. Beyond this period, we expect to grow faster than we discussed in August and sustain this growth for longer. Now moving on to our guidance for Q4 of the year. For the fourth quarter of 2024, we expect billings to be in the range of $3.43 to $3.48 billion, an increase of 9 to 10 percent. We expect revenue to be in the range of $2.15 to $2.17 billion, an increase of 10 to 11 percent. We expect non-GAAP EPS to be in the range of $1.40 to $1.42 a share, a decrease of 1 to 3 percent. For the fiscal year 24, we expect billings to be in the range of $10.13 to $10.18 billion, an increase of 10% to 11%. We expect NGS ARR to be in the range of $4.05 to $4.10 billion, an increase of 37% to 39%. We expect revenue to be in the range of $7.99 to $8.01 billion, an increase of 16%. For fiscal 24, we expect operating margins to be in the range of 26.8 to 27.0%, an increase of 270 to 290 basis points year over year. We expect our non-GAAP EPS to be in the range of $556 to $558 per share, an increase of 25 to 26%. And we expect adjusted free cash flow margin to be 38.5 to 39%. In the interest of time and to get as many of your questions as possible, we've included the modeling points in the appendix of our earnings presentation. With that, I will turn the call back over to Walter for the Q&A portion.

Thank you, Deepak. To allow for broad participation, I'd ask that each person only ask one question. The first question will be from Brian Essex at J.P. Morgan, followed by Brad Zelnick at Deutsche Bank. Go ahead, Brian. Brian, you're muted. Brian, you're muted.

Brian, it looks like you're on mute. Oh, there we go. Yeah, I wasn't letting me unmute myself. So thank you. Thank you for letting me take the question. Yeah, I guess for Deepak, as we look at your efforts of incentivizing platform consolidation or platformization, I mean, obviously, you've talked about the pressure on the last two quarters of this year. Can you maybe help me understand the duration that you anticipate pursuing these efforts? Is this going to be a more temporary type of effort where it kind of just lasts through this fiscal year, or do you expect it to stretch into next year? Thank you.

Yeah, so thanks for the question, Brian. Look, I think we will, I mean, platformization is something that is now our strategy. So I think in that sense, it will continue for a while. But at some point, it just becomes a normal motion. And then we're lapping a period where we've been doing platformization already. So really, what you're seeing in the financial metrics is the difference when it wasn't the normal motion, and then it becomes the motion. And then in the future, it will just become lapping what is a consistent motion.

I think in that context, we said last quarter that this should persist till the end of Q2 next year. We can't start at Q2 this year.

That's helpful. Thank you for the clarification.

Thanks, Brian. Next question is from Brad Zelnick, followed by Hamza Farawalla from Morgan Stanley. Go ahead, Brad.

Thanks very much for taking the question. Nikesh, I was hoping you can give us an update on the state of the channel. There's a lot of noise from the traditional VAR channel. I wanted to get your sense on how they're acclimating acclimating to platformization, but you're also doubling down with the GSIs. You announced this super special deal with IBM. You also signed a deal with Accenture too. We'd just love to hear your latest thinking in a particular more on the GSI strategy. I mean, how many more can you add? that are up at that level of an Accenture and an IBM? Thanks.

Well, first of all, thanks for the question. Look, I don't think there is contention between the two channels. We still do IBM deals with a traditional VAR involved. Very often the VAR represents the customer, helps to clear the deals, helps them work through all the financing, et cetera. So there is a role for both. What we are discovering is in platformization deals, customers require a consulting effort to re-architect the entire security stack. And typically, they engage with the SI community or GSI community first to try and do that transformation. And partnering with them hand in glove allows us to be part of that story. I gave the example when we did the most recent let's just say re-architecture, which we had to do in a hurry in the case of the recent hack, we were working with SI partners as well as other incident response teams to make sure that we build an architecture that's consistent with what the end state needs to be. And that's where partnerships like Accenture and IBM become really and important because the customer is relying on them to do the heavy lift and doing the one-time transformation. So I think both these strategies will coexist. As you know, we still have a substantive hardware business, which we also work through the traditional channel. We also have, actually to be fair, many of the VARs have transferred or translated their businesses into a part consulting model where they also work with customers and transformations. I don't think they're contentious. it becomes harder for the analyst community to be able to track what the channel status of a company is because the si's are not as as sharing as the traditional bar channel is thanks very much for the color and i love the uh pullover that's a good one nikesh thank you i appreciate it i need some color in the day thank you you had a great quarter thanks brad uh next we'll go to uh hamza faderwala from morgan stanley followed by matt hedberg from rbc go ahead hamsa

Hey, good afternoon. Thanks for taking my question. Nikash, in the earnings presentation, you mentioned you see significant pipeline heading into your fiscal Q4. I was wondering if you could give us a little bit more color into that pipeline because the Q4 Billings Guide does suggest a big sequential uptick as is usual, but I think this year a little bit higher than normal, but any color you can give us would be helpful.

Yeah, Hamza, look, first, thanks for the question. As I mentioned in our prepared remarks, we have been reviewing all of our customers. We have been through 500 of them with the account teams. And every customer, there is an opportunity. There's an opportunity to deliver a platform there's an opportunity to consolidate and just that gives us you know hope and sort of some degree of conviction that there's a lot of business to be converted out there it's really limited by the customer's speed and desire to execute or the resources to execute so we have a robust pipeline across most of our platforms to see questions can we go out and convert as quickly as we need to and that's what we're guiding to thank you

Great. Thanks, Hamza. Next question is from Matt Hedberg, followed by Tal Liani from Bank of America. Go ahead, Matt.

Thanks, Walter. Yeah, and Nikesh, I think we are on the same wavelength here on the color. Good choice. You know, I wanted to ask about the federal side. You know, last quarter you mentioned Thunderdome. Any update on that transaction and just kind of how we're thinking about federal into 3Q? Or excuse me, your 4Q?

Yeah, that's a great question. Look, the Thunderdome A contract got activated last quarter because of the zero-day vulnerability we found in certain VPNs out of the market. So they wanted to quickly replace some of the VPNs because they were required to replace them in the classified agencies and non-classified agencies. We saw some activity around Thunderdome. That contract was activated where people used that contract that we have with DISA to be able to execute some transactions. But we still maintain these are going to get one at a time. Each of these missions are going to execute one at a time. So we haven't changed our expectations in terms of how Thunderdome will evolve vis-a-vis how we will see it in our financials. Thank you.

Great. Thanks, Matt. Next question from Tal Liani at Bank of America, followed by Saket Kalia at Barclays. Go ahead, Tal.

Hi, guys. I know we don't focus on billings, but I have a question. Just first to clarify... You do. Just to clarify, if you won, you said in the preparatory marks you won a $150 million deal. Does it include... Does it go through billing? And should we exclude it from billing on a normalized level? Just to understand the impact on billings this quarter. And then billing is... It's going to recover because I, or I'm going to ask it, not say it, but how, what's the path for recovery for billing? If investors are looking at it and you look out into the next year or two years, what's the path for recovery of billings growth?

Patel, I think if you listen carefully to what I said, we actually built backlog this quarter, which means we booked a lot more business than we build. which is the difference between contracts where you chose not to take their payment terms and just do annual billing. So we're signing big deals. We have a lot of business that we're signing, and the way it gets reflected is in RPO. It depends on what we choose to either take as annual billings or to take through PAN-FS, which shows up in billings. What we choose not to take ends up in future or deferred payment plans or deferred billing. I think if you look at the implied bookings, you'll see there's a double digit number in there in the quarter. I just think billing is an artificial metric. I think I understand you guys like it because it's been around for a long time. I think the cost of money has changed the quality of that metric. To me, a quality metric is implied bookings or RPO. And in both those, as I mentioned, we saw an uptick this quarter. So we actually believe we saw a recovery faster than we expected this quarter. That's why we're surprised at the reaction of the market.

Great. Thanks, Tal. Next up is Saqib Khalia for Barclays, followed by Gabriella Borges from Goldman Sachs. Go ahead, Saqib.

Okay, great. Thanks, guys, for taking my question. Nikesh, maybe the follow up is on that point. I like your color. That blue is very nice. Oh, thanks, buddy. Appreciate it. So just to that point, it was great to see RPO bookings, I think, actually accelerated year over year in this quarter, right? So, you know, last quarter, I think we talked about more flexibility for customers with platformization, right? Just consolidating and creating some of those ramp contracts. How much did that sort of play into the difference between bookings and billings?

Well, remember, the acceleration, the RAM contracts really impact us in the way that we have higher exit ARRs on many of our newer contracts. So the year one AR may be lower than the year three ARR for a contract. But that is not visible to you yet in the numbers, because there's no way to represent that. The only way you'll see it, you'll see a consolidated DCV deal, which is going to show up in RPO. So the RAM contracts show up as a total whole sum in the RPO number. And you're seeing an uptick in the RPO number, which tells you that business is stronger this quarter than we expected it to be. I think the only difference is we chose not to take, remember, when a customer says, I don't want to pay you upfront, you have two choices. You can take annual billings or you can get them financing through PanaFast, right? Where it takes away from revenue and becomes interest income. And then we decided we didn't want to take so many of these deals. So our quantum of deferred billing went up compared to last quarter.

Got it. Very helpful. Thank you.

Great. Thanks, Saket. Next question, Gabriela Borges from Goldman Sachs, followed by Gray Powell from BTIG. Go ahead, Gabriela.

Hi, good afternoon. Thank you. I want to ask on the 15 billion NGS target for fiscal year 30. I have a friend, Akesha Deepak, a little bit of color on how you arrived at that number. There's an interesting footnote here on assuming 5% annual growth for customers. And then within that target, how do you think about cyclicality? Any comments on the cyclicality of firewall or the cyclicality of platformization impacting the linearity of getting to that target? Thank you.

Yeah, two things. One, the firewall is not in there. That's hardware. That's not next generation security. The services that work on top of firewalls are obviously in there because they're all not AI enabled and next generation. Cyclicality is consistent with our cyclicality of our quarters. Right, we see more business in Q4. You should expect more platformization deals in Q4, hopefully higher growth in NGSRR, which you're used to. I think the cyclicality of that slide is no different than the cyclicality you've seen in the growth of NGSRR over the last three years they've been sharing that number with you. Yeah, sorry, was there another part to that?

Yeah, just on the footnote here on the 5% within- Yeah, so what we've discovered- Yeah, benchmark that for us.

Well, what we've discovered is as platformization grows for a customer, as renewals come up, we're able to upsell them more capability. For example, in SASE, now we can sell them ADEM and AIOps. For example, in our firewalls, we can send them 10 subscriptions. For example, in Cortex now with XDR, ITDR, we can sell them CDR. In access, we will be able to sell them AI access. So every time these deals will come up for renewals, we will have the opportunity to present more services and capability onto the platform with the customer driving NRR for us. So we've made a simplistic assumption that the combined effect of NRR is approximately a 5% increase in ARR over the course of those years.

Got it. Thank you. Thanks, Gabriella. Next question, Gray Powell from BTIG, followed by Greg Moskowitz from Mizuho. Go ahead, Gray.

Okay, great. Thanks for taking the question. And it was good to hear the 50% growth on Prisma SASE this quarter. So a question on Secure Service Edge. If I look at industry analyst estimates there, I think Secure Service Edge is probably about 25% of the network security market today. Give or take, that's rough. I'm just kind of curious, like where do you think that penetration goes in maybe three or four years? Or maybe said differently, how should we think about the growth profile of that market going forward and your ability to grow at or above that?

Yeah. Look, I think it's important to start with a view on this, that the market will be hybrid for a very long time, meaning customers will need a combination of hardware form factors, software form factors and SASE. And the reason for that is, you know, campuses still exist and hardware is still the fastest approach to this and public and private cloud software based approaches are the best. SASE comes in with all of the remote users and branch offices. And so That hybrid nature, from our perspective, means that customers will increasingly choose to go with a platform-based approach where they can shift traffic across those different form factors as is optimized for that form factor. And so some of the SASE growth that you've seen, and you've seen it with us where 50% growth with SASE over the last several quarters is showing that that portion of the architecture is going to grow faster for some time. And then ultimately we see this come into the total growth of the platform being what really matters. And then on top of that, we can deliver the security services, such as the newly announced AI access security across all of those form factors.

Okay, thank you. Thanks for the question, Greg. Next up, Greg Moskowitz from Azul followed by Fatima Bulani from Citi. Go ahead, Greg.

Okay, thanks, Walter. Thanks for taking the question. Nikesh, in order to reach your fiscal 30 goals, it looks like you'll need to sign an average, give or take, of around 75 new platformization deals per quarter, a little higher than what you did just in Q3. But if we're in the early days of this strategy, and if you're just now building your go-to-market muscle around this, why shouldn't new platformization customers be a lot higher than that on a multi-year basis? Thanks.

Look, we told you last quarter we're going to do a platformization. I have to say, I have to commend our team. We spent a lot of time over the last 90 days working hard on analyzing all this data to make sure we could give you a framework so you can look at it and measure us over the next few quarters as we show you the benefits of platformization. So that's one part. The other part is like it's positively surprised. A good thing that we've got 60 plus deals done in this quarter. We'll see what happens in Q4. We've just started going down this journey. And of course, if prospects get better, we'll be happy to update our targets in the future. But for now, that seems like a robust goal that would still make us the first company in the history of cybersecurity to ever get anywhere close to that kind of aspiration and number. Thank you.

Great, thanks Greg. Next up Fatima Balani from Citi followed by Shaul et al from Cowen. Go ahead Fatima.

Thank you, good afternoon. Thank you for taking my questions. Nikesh, you talked a lot about the multiplicative impact and the monetization acceleration you can get from platformization. I'm curious if we can put a profitability lens on this because you are driving between two and $14 million of the, I think ARR you mentioned from a platformized customer. But from a contribution margin perspective, can you share with us what that incremental profitability impact would be like? And why should we sitting here not think that structurally your business as it moves towards being increasingly consolidated can see 30, 35, maybe even 40% operating margins?

Yeah, look, Fatima, in concept, principally, I have no argument against what you're saying. Because remember, if you look at an average enterprise company's P&L, the largest cost is sales and marketing, right? Close margins are, give or take, 75% to 80% take your favorite enterprise company. That leaves you most of your costs are, the majority of the costs are sales and marketing. If you can consolidate and concentrate your sales and marketing costs, to very large deals and be able to generate large amounts of ARR or ACV slash DCV from those customers, the cost of sales, the proportion of your revenue goes down. As you are constantly upselling it to the same customer base, it also makes it a little easier. So I think our opportunity is to first create enough breadth in our coverage to make sure that we can actually go address all these landed customers. We've only done 900. We said we got to get north of 2500, which means we have to go address a lot more customers in our existing landed base. We don't have to go make new friends. We have to go work with our existing friends. But yes, in the long term, I have no argument against your thesis that this should allow us to continue to aspire to higher profitability, not counting the impact of AI, which should get us to be a much more productive organization over the medium term.

Great. Thank you, Fatima. Next question, Shaul Leal from Cowan, followed by Andy Nowinski from Wells Fargo. Go ahead, Shaul.

Thank you. Good afternoon, Guy. Question for Deepak or Nikesh on finance receivables. So finance receivables up 34% sequentially. I know you don't guide, cannot guide this metric. If we look into next quarter and take into account your commentary about the strong pipeline, will we be seeing the finance receivables still expanding? Or maybe ask differently, will there be a point Would you like to see this metric actually decelerating to a degree? What's the thinking along these lines?

Yeah, so I think, thanks for the question, Sean. I think as a business grows, you know, like having, you know, tools like PanFS can only help you. And if that's what the customer is looking for in terms of deferred payment plans, I think, you know, I, I don't have a problem if it, if it goes up because it, it just ends up giving you even more like knowledge of what your cash flow will be in the future. Like so all of that receivable will be collected eventually. Honestly, I think more of it is related to the cost of money. uh than than anything else so i think this becomes a larger issue in the current environment where interest rates are higher i think if we're in an environment where the interest rates would go down that's when i would expect this to potentially um ratchet down great thanks show next up is andy nowinski from wells fargo followed by joe gallo from jeffries go ahead andy

Okay. Good afternoon. Thank you for taking the question. So I wanted to ask you about the IBM deal. What was the impetus for acquiring those assets? Because it looks like their SAS revenue is pretty small at a hundred million and given how well XSIM is doing, couldn't you just capture those on-prem customers for free over time?

I think Andrew, there's more than that. Remember we explained to you that the, Part of platformization is going to be able to transition customers off their existing contracts. Now, the good news is we can transition these customers irrespective of term when they expire. That's great option value. I don't have to wait for three years to migrate them. I don't have to wait for an RFP. I can just walk up to them and say, listen, you're already my customer now because I've acquired the contract. Why don't you come? We work on transitioning to XIM. Not only that, it also allows the opportunity not just to go after the SaaS customer base, but also allows us to transition the on-prem customer base, which is a much larger prize where IBM has economics from us where they're able to transit, they'll get earn out based on how many of those customers transition to us. I mean, honestly, I think it's an amazing deal for us. I'm just delighted that IBM agreed to do this deal with us and partner with us. And also, it gives me access to, look, in the history of IBM, they have not sold anybody else's cybersecurity portfolio with the enthusiasm we hope we can generate together for their 1,000 cybersecurity sellers. Until now, they would sell one portfolio. That was IBM. And today, this deal allows us to train all of them, all 1,000 of them, work with them on XIM, and get it out to customers. I think it hopefully cements our place in the sim slash SOC category at a pace that nobody would have anticipated. Until yesterday, there were three players in the Magic Quadrant, which was not us. This allows us to participate with one of the biggest players in the space. you know, migrate as many of these customers based on merit and based on great proposition as quickly as we can. That makes sense. That's $500. And I didn't have to spend, what was the number? Never mind. I won't quote a large number. I didn't have to sell many, many, many billions of dollars and transition to the customers then. Got it. Thank you.

Great. Thanks, Andy. Next up, Joe Gallo from Jefferies, followed by Ben Bolin from Cleveland Research. Go ahead, Joe.

Hey guys, thanks for the question. I want to follow up on Fatima's question. I don't think many disagree with the strategic long-term potential of the platform or the ensuing financial strength. But when you look at fiscal 25 specifically and free cash flow being 37% plus margin there, how should we think about the visibility or durability of that free cash flow margin given what's impacting you now with deferred payment terms, discounting, fatigue?

hardware digestion should in theory impact you for a couple quarters next year thanks first first of all do not introduce the word fatigue in our conference call uh secondly uh yeah um as it relates to the free cash flow margins i'll let that jump in in a minute but like it's the fine balance of making sure that we can let our annual billings continue to grow as a proportion because we think this interest rate environment is here to stay and we can manage our free cash flow margins in the same time frame the good news is because of you know nicely increasing profitability that allows us to have the capability to let our annual billings continue to get bigger and bigger because eventually that's what gets you take the extreme example on the other side the other side extreme example is a sas company with animal billings which can go back to the same degree of free cash flow margins that they have so our opportunities to see if we can migrate our our customers to more and more analyze billings and continue to maintain the margins without creating a kink in there. And that's what Deepak is very focused on. I don't know if there was something you want to add to that, Deepak?

No, the only thing that I would add is, look, the more that you do deferred payments now, the more you actually understand your waterfall of what will come afterwards. So as long as the shift doesn't happen all at once and it's a gradual shift that you're managing, it actually gives you even more certainty than less certainty in your ability to deliver. So, you know, happy to talk offline about how we see that and why we believe that, but I think the data doesn't lie there.

Thank you.

Thanks, Joe. Next, Ben Bolin from Cleveland Research, followed by Jonathan Ho from Lee & Blair. Go ahead, Ben.

Thanks, Walter. Good afternoon, everyone. Thanks for taking the question. Nikash, one of the initial attributes around platform seems to be the potential for free use periods. And as companies displace other vendors, could you talk about what you've seen from the use, those free use periods in those first 60 plus deals? And then maybe Deepak, could you talk through a little bit about what it means for revenue, RPO, AR billings and like how that waterfalls over time? Thanks.

Yeah, so in the first 50 or 60 deals, I think we've got a little sort of portfolio of all kinds of stuff that's happened. There are some customers we've had to basically wait for six months be able to charge for our services because they have an existing contract and we start implementation so we wait that period out typically those deals where we end up waiting out end up with longer duration because we don't want to give away that period over a shorter period of time so you'll see that those deals are north of three years in the case we end up giving some sort of free use period in smaller situations sometimes we'll provide migration services which allows them to get off an existing solution and and move to Palo Alto as quickly as possible. And remember, because most of these implementations have some sort of ramp element, nobody goes and deploys 65,000 endpoints and turns them on in one day. Typically, it takes them three to four months internally to deploy those. So that actually doesn't impact us from a COGS perspective as much. It allows them to have that Execution flexibility which you've always talked about as part of optimization so I think we've seen. All variants and i'll say right now the the we're seeing more of an impact on our business from deferred payment than we are from the free periods, to be honest. In every case, we're trying to make sure the exit ARR is what we want from that customer. So our ARR, we expect it to ramp in some of these deals, which are three to five year duration where we provided free periods. But we're still, as I said, more impact is from the billings deferral and annual billings than it is from free periods right now. And we'll know better after Q4 because you'd expect the volume of Q4 business, given the expectations on numbers, should be substantially more than Q3.

Great. Thank you, Ben. Next question, Jonathan Ho from William Blair, followed by Joel Fishbein from Truist. Go ahead, Jonathan.

Good afternoon. As you add more AI capabilities to your platforms, what are customers looking to benefit from and how do we think about the monetization opportunity here? Thank you.

So I think if you look at some of our products, as we articulated, there are three specific products we announced at RSA. And then we said all of our co-pilots will be available and already are available to customers for beta reasons. And then we have underlying capabilities in our products which are AI enabled. Now, in most of our advanced services and firewalls, and I'm making a broad statement here. We have increased prices from 20% of the cost of firewalls as a sub to 30%. So we have had an uptick in AI-delivered services on the firewall. The customers see the value, and the majority of customers have opted into that capability, which we have had for the last two or three years. And today, we just launched the most recent one, which is Advanced DNS, which will also be upticked to a 30% instead of 20% subscription. AI access will be sold as an incremental capability and incremental subscription for all of our VPN and for our SASE customers. So you will have monetization capability there. AI firewall would be, again, an uptick on our virtual firewalls where you have AI capability. So you'll pay a premium to protect AI installations over a traditional VM. We're still debating whether we provide AISPM to the market which is effective security posture management capability as part of our firewall optionality or we charge for it separately. We will do that closer to when we launch the actual product towards July. Our co-pilots are for the most part available to our customers as a productivity tool, as an enhancement tool. In certain cases where we require them to ingest data to get advanced telemetry, they would have to buy the advanced telemetry module to make the copilot even more useful for them. So that's roughly the lay of the land. But one should expect that there should be three capabilities. better productivity for our customers so they don't have to understand more complex UI. Two, they will have to pay certain more, some amount more in certain use cases where they are getting incremental value and we're making incremental effort from them. And three, they might require to upgrade their underlying capabilities from base to advanced because we need the telemetry to make AI useful.

Great. Thanks, Jonathan. We'll take our last question from Joel Fishbein from Truist. Go ahead, Joel.

Thanks, Walter. I have an AI question too, Nikesh, just to follow up on that. In terms of, can you talk about the customer appetite for AI security and maybe a couple comments about the competitive landscape around companies that are delivering products around AI security as well?

Yeah, look, so we had an amazing reception to our AI, precision AI sort of preview at RSA. We have a lot of a few hundred customers who signed up to have discussions with us and engage in the beta of these products. That's very good. A. B, as you'll appreciate, AI access is an overlay product on all of our access customers. So it's it's It's a good thing because our customers say, I don't have to go somewhere else and get something add-on and go make that happen because I expect Palo Alto will have it in six weeks' time. So I'm just going to wait for Palo Alto. And those who are keen to deploy sooner, we are able to discuss with them, show them the beta, continue to have design discussions with them. So it sort of reduces any risk of competitive activity into our customer base where somebody else is providing AI access security in our cases. One. Two, in the case of AI firewalls, I think what is unique is we are possibly the only security vendor which has a native integration. I say native, not on top, but native integration with AWS, Azure, GCP, and Oracle. in their public clouds, which means our firewall sits in their cloud. You can activate it from their UI, not just from our UI. And you can launch it natively in all those cloud providers. AI firewalls will be built into that capability so that you get a native capability in most large cloud service providers or a VM that you're going to deploy in your data center. So again, for somebody to compete with us, they would have to have that native capability first. that build it. So do we expect that Google will have it? Possibly. Microsoft, possibly. AWS, possibly. So the cloud providers might have that capability because they have native firewalls. But again, if you had a multi-cloud infrastructure with an LLM running in one cloud, another one running the other cloud, and some running a data center, we hopefully are the only option that allows that capability to happen. So we're trying to make sure that we do the early innovation in this space so our customers don't have to, or we don't create more fragmentation with other people having to deploy point products and that. Great, thank you.

All right, thanks, Joel. With that, we'll conclude the Q&A portion of the call. I'd like to turn it back over to Nikesh for his closing remarks.

Well, I just want to thank all of you for joining our earnings call. I appreciate your attention. I also want to thank all of our employees for all the hard work that goes into delivering great quarters and all the innovation that they've delivered. And last but not the least, thank you for all of our customers for their trust in us. See you guys next quarter.