ZeroFox Holdings, Inc.

Thank you for standing by and welcome to the XeroFOX fiscal second quarter 2024 results conference call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question and answer session. As a reminder, today's call is being recorded. I would like to turn the conference call over to Todd Weller, Vice President of Investor Relations for XeroFOX.

Thanks, operator. Good morning, and thank you for joining us today to review XeroFox's fiscal second quarter 2024 financial results. With me on the call today are Foster, our founder, chief executive officer and chairman, and Tim Bender, our CFO. By now, everyone should have access to our earnings press release. This press release, as well as supplemental financial information, can be found on our investor relations website. During this call, we may make forward-looking statements including statements related to our anticipated financial results, growth opportunities in external cybersecurity, our progress to achieving profitability, and expected benefits from our acquisitions of IDX and Looking Glass. These statements are not guarantees of future performance, but rather are subject to a variety of risks and uncertainties. Actual results could differ materially from expectations reflected in any forward-looking statements. Please review our earnings press release and recent SEC filings, description of these material risks and uncertainties. Forward-looking statements made today speak only to our expectations as of today, and we undertake no obligation to publicly update or revise them. Additionally, non-GAAP financial measures will be discussed on this conference call. Please refer to the tables in our earnings release and the investor relations portion of our website for reconciliation of these measures to their most directly comparable GAAP financial measure. With that, I'd like to turn the call over to our CEO, Foster.

Thanks, Todd. Good morning, everyone. Last month marked our one-year anniversary as a public company, and Q2 was another record quarter for XeroFox, where we achieved several major milestones. we delivered strong revenue growth, record ARR, recognized an acceleration on our large customer adoption, and generated positive free cash flow for the first time. Furthermore, we announced that we beat our guidance and will raise expectations for the second half of the year. Our ability to consistently deliver results is a direct reflection of our team's discipline, our relentless focus on the customer, and our platform's ability to scale with the ever-growing External Cybersecurity Challenge. I'm going to provide summaries on a few key areas of our performance and continuing progress on our vision. First, I will review highlights from our Q2 results and the continued demand we see for our external cybersecurity platform. Then I'll spend a few minutes walking you through our growth model. And finally, I'll share key areas of focus for the second half of the year. In Q2, we reported solid results across both top and bottom line metrics. We reported core revenue of $42 million, an increase of 78% year over year. We ended the quarter with ARR of $182 million, an increase of 22% year over year. And we saw continued momentum and large enterprise wins with a 35% year over year growth and subscription customers with ARR greater than $100,000. The Q2 demand environment for both new and existing customers was consistent with prior quarters except for one exception. We experienced stronger than forecasted demand for our new on-demand response capabilities, which was reflected in our services revenue outperformance. We believe this was driven in part by recent surge and move-it attacks. which have impacted hundreds of organizations to date, and that number is still growing. Customers recognize us as an authoritative organization to help with external cyber attacks, and these adversary campaigns are providing us with opportunities to highlight our platform's strengths. We helped one of our customers manage to an incident where over 10 million records were stolen in a brazen ransomware attack. We are operating on a scale that is far beyond most organizations in the cybersecurity industry. According to Mandiant's website, they conduct over 900 incident response engagements each year on behalf of their customers. Today, we have over 1,100 active response engagements with customers. Our brand recognition, customer trust, and proven execution, including our ability to deliver large, on-demand, complex programs were factors in why enterprise customer deal size is accelerating. Additionally, demand for a platform-based approach remains strong as more organizations look for continuous visibility into their external attack surface, intelligence on external threats, and the ability to protect, disrupt, and respond to those threats. The modern security triple crown includes endpoint security platforms like CrowdStrike, SentinelOne, or Trellix, combined with a robust perimeter provider like Palo Alto Networks, Zscaler, or even Akamai, and an external platform like ZeroFox. Nearly all of our customers have some sort of internal perimeter and external security combination protecting their organizations. Simply said, our platform and positioning is increasingly resonating with our customers as they look to consolidate their security stacks with a few proven leaders. Now I'd like to spend a few minutes taking a closer look at an area within our go-to-market model on how we land and expand within customer organizations. Typically, when customers engage with Xerofox, they are looking to solve specific external cybersecurity problems or use cases. And this is especially true for reactive customers where there have been incidents in the recent past. Examples of common use cases for XeroFOX include protecting an organization's digital footprint with phishing, impersonation, or account takeovers, monitoring the dark web for compromised credentials, data leakage, or early warning signs of an attack, or leveraging threat intelligence data and experts to improve threat prevention, detection, and response efforts. XeroFOX addresses these use cases and more through a single, unified platform. Our platform capabilities span four strategic pillars, including protection, intelligence, disruption, and response. And each of these pillars include multiple modulars that are available for purchase. Examples of our modules include brand protection and domain protection, intelligence search, takedowns and PII removal, digital populace protection, and on-demand notifications. When customers purchase our platform, there are two primary factors that drive deal scope and size. The first is the number of digital assets they protect, and the second is the number of modules they can purchase to protect those assets. In new deals, it is increasingly common for customers to protect multiple assets and purchase multiple modules. For example, in Q2, the average number of modules purchased in new deals was just over three. And while new deals frequently include multiple assets, the assets being protected typically only represent a small portion of their total digital assets. This white space provides us with future expansion opportunities. In addition to increasing asset volumes, we also have the ability to cross-sell and up-sell our customers additional modules. For customers that have found ZeroFox reactively or because they have experienced a security incident, We typically land with one or two modules within our response pillar first as they become introduced to the organization. To put this in perspective, let's walk through a couple of our Q2 deals. The first is a six-figure new customer win with a Fortune 500 company that included several operating lines of business. This customer chose Xerofox for tech 40 brands 10,000-plus domains, and hundreds of additional digital assets. The customer initially purchased nine modules, including brand, domain, intelligent search, data feeds, takedowns, and more. This is a big win for Xerofox. We also had another six-figure new customer win with a Fortune 500 software company. This customer is also protecting their global footprint, and they purchased eight modules out of the gate. This customer selected ZeroFox to consolidate several of their other external threat intelligence and digital risk protection services point solutions, validating our platform approach. Due in part to the proliferation of ransomware campaigns, Q2, we saw a record number of large deals for our on-demand response services. This included two multi-seven-figure deals with Fortune 1000 companies and a seven-figure deal with a new public sector customer. Shifting gears, I'd like to focus on our goals for the second half of the year. We will continue to execute on our strategic plan to expand our platform capabilities, grow our customer base, and increase adoption. And we will accomplish this while also further progressing on our path to profitability. From a platform perspective, while we continuously innovate, there are two specific areas I'm going to highlight. Over the last quarter, we made significant progress completing the integration of Looking Glass and finalizing our plans for combining the perspective platform capabilities. We also launched a new free threat intelligence service that we call our Daily Intelligence Brief that has seen some very nice pickup this summer. The second area, and I'm sure you guessed it, is artificial intelligence. As I mentioned last quarter, we have nearly a decade of experience implementing various AI capabilities into our platform. As a reminder, we have over 54 patents issued in our name today, and our innovation program is mature. As adversaries increasingly leverage AI to automate the development of sophisticated attacks, we will continue to evolve the use of our AI to ensure that we can protect our customers. For Xerofox, this is table safe. For example, spear phishing attacks via external platforms like social media and chat platforms are becoming exponentially better and the success rates are rapidly increasing. Attackers that have English as a second language, for example, can now use chat GPT to perfect a targeted attack against an individual. The days of receiving a poorly worded email from a prince asking you to hold a million dollars for them are long gone. Now, recent advancements in generative AI and large language models are creating new opportunities for us to increase value by more broadly infusing AI in different manner across our platform. And we're going to leverage these large language models to provide more contextualized intelligence for our customers, making it easier for them to better assess and understand risk and threats. Our customers will continue to receive the benefit of our innovation program in the quarters like they have in the past several years. While we continue to see a significant growth opportunity in front of us, we also understand the importance of balancing growth with profitability. We were very pleased with our Q2 cash flow performance and will continue to drive additional efficiency and leverage into the business in the coming quarters. As Tim will discuss in more detail, we continue to expect that we'll be at or near break-even the second half of this year. With that, I want to thank all of our FOXs for their energy, passion, and commitment as we continue to protect our customers around the world. Q2 is a record quarter for XeroFOX, and we are moving as fast as we ever have. I'd like to turn the call over to our CFO, Tim Bender.

Thanks, Foster. As Foster mentioned, XeroFOX generated strong Q2 results across both top and bottom line metrics. With the exception of revenue and unless otherwise stated, All financial results we will discuss today are non-GAAP financial measures. Reconciliations between our GAAP and non-GAAP results can be found in our earnings release. For Q2, Xerofox reported revenue of $62.2 million, an increase of 42% year-over-year. Subscription revenue was $23.2 million, including $4.8 million from Looking Glass. Services revenue was $39 million consisting of $20.7 million of recurring revenue from our strategic government customer and $18.3 million from our on-demand response services. While we expected an improved revenue performance in our services revenue for Q2, our success in capturing large deals with Fortune 500 customers was even stronger than anticipated. Given our Q2 bookings performance, we expect continued strength in services revenue in Q3. Our services business continues to be less predictable when compared to our subscription business. As we look beyond Q3, we would expect services revenue to return to a more normalized historical level. Given the potential for short-term volatility, we would encourage investors to look at the performance of our services business on an annualized basis to assess our performance and growth potential. As of July 31st, annual recurring revenue was $182 million. ARR consists of platform subscriptions, a small amount of recurring on-demand services, and $83 million from our strategic government contract. We ended the quarter with a record high 1,304 subscription customers. As Foster mentioned, in Q2, we saw continued success winning larger deals. We ended Q2 with 175 customers with ARR greater than 100,000. which represented an increase of 35% year over year. Turning to gross margin. For the second quarter, subscription gross margin was 72%, consistent with Q1. For Q3, we expect subscription gross margin to be consistent with Q2 levels. Services gross margin was 18% compared to 24% in Q1. As we indicated on last quarter's call, we expected this margin to decline from Q1 due to a higher mix of notification services attributable to our Fortune 500 response engagements. The Q2 sequential decline was driven by an even higher than expected mix of large deals. Given the continued impact on large deals in Q3, we would expect services gross margin to be relatively consistent with Q2 levels before returning to more normalized levels. Total gross margin was 38% compared to 43% last quarter. The declining gross margin was driven by the decrease in services gross margin and the higher mix of services revenue. As we look to Q3, we would expect gross margin to be consistent with Q2 levels, with margin improving in subsequent quarters. We continue to see opportunities to improve our overall gross margin as we scale our business and our higher margin subscription revenue becomes a greater portion of our overall revenue mix. Turning to operating expenses, total operating expenses were $28.6 million in the quarter. The increase in expenses versus last quarter was driven by continued investments in research and development, including expenses from our acquisition of Looking Glass. G&A expense declined sequentially as we did not incur professional fees for the annual audit, residual DSPAC filing requirements, and transaction costs in Q2. Our loss from operations was $4.8 million. Looking at the balance sheet and cash flow, we ended the quarter with $29 million in cash, $36 million in accounts receivable, $67 million in total deferred revenue, and $191 million in total outstanding debt. In Q2, we generated cash flow from operations of $600,000 and free cash flow of approximately $400,000. As expected, our Q2 cash flow performance was positively impacted by the timing of collections from our larger customers and lower professional fees and transaction costs. Now to our outlook. Our outlook assumes no material changes in the macro environment, demand for our external cybersecurity platform remains consistent, and anticipates continued near-term strength within our on-demand services business. For Q3 fiscal year 24, we currently expect revenue to be in the range of $55 million to $57 million. and non-GAAP loss from operations to be in the range of $6.2 million to $5.4 million. For fiscal year 24, we currently expect revenue to be in the range of $214 million to $217 million and non-GAAP loss from operations to be in the range of $27 million to $25 million. We continue to focus on profitability. Consistent with what we said last quarter, we expect free cash flow for the remainder of the fiscal year to be at or near breakeven. On a quarterly basis, our cash flow will be impacted by the timing of collections from our large customers. And therefore, we expect cash flow to be negative in Q3 followed by an offsetting positive amount in Q4. We continue to expect that we will achieve quarterly free cash flow on a sustained basis in the second half of fiscal year 25. With that, we'd like to take your questions. Operator?

Thank you. If you'd like to ask a question, please press star 1-1. If your question has been answered and you'd like to remove yourself in the queue, please press star 1-1 again. Our first question comes from Joseph Gallo with Jeffries. Your line is open.

Hey, guys. Thanks for the question, and congrats on the strong results. Guidance for the year looks like it flows through a little bit more revenue than your 2QB. What are you seeing in the market or macro-wise that kind of lends confidence towards doing that? Thanks.

Hey, good morning, Joe. Thanks for the question. I think we had a stronger than forecasted result in Q2, which we acknowledged and which we announced this morning. And I think what we're seeing here is maybe a slight easing of some of the macro pressures we saw in the beginning part of the year and continued demand for our platform.

Awesome. And Tim, congrats on the free cash flow profitability report. How should we think about profitability versus investments for growth or even acquisitions? And then ultimately kind of combine that with how investors should think about your debt, the maturity or timeline of that debt, and how those repayments eventually play out. Thanks.

That's a good question. Well, we acquired Looking Glass just a little over a quarter ago. I think we've got plenty. of opportunity to continue to sell into our customer base and realize some upside there in the coming quarters from the expanded platform. So I don't think about our current cash position or balance sheet strength as being leveraged for acquisitions in the very near term. Although I would say in general, we have proven to be an acquisitive company acquiring four companies in the last four years. I think maybe to go back to your other point on profitability, I think we said that we would be at or near break-even for the rest of the year. So, yeah, we hit cash flow positive in Q2, and we see the opportunity to remain kind of right around cash flow positive for the next two quarters. And then we've also put that we'd be cash flow positive on a sustained basis next summer as well. So I think, all in all, we were doing all the things we said we were going to do on the cash flow front. And I think that balanced approach to growth and getting leverage back into our model is – is the right thing for the business.

Yeah, and Joe, Tim, just to kind of clarify on the one question, we don't have to do anything different in our business model as far as our investments for growth. That's built into our cash flow assumptions. So, you know, we're going to continue to invest in sales and marketing and our go-to-market efforts to drive growth, and we think we can do that and manage our operating expenses to deliver the cash flow Foster just mentioned.

Yeah, that's right.

As it relates to the debt, the large convertible note is out about two years from today. August 2025 is the due date on that. We'll likely continue the same path that we're doing right now as far as the way we're treating the interest via the PIC. And listen, we're looking, you know, as our performance continues to strengthen, we'll have conversations around, you know, how we want to deal with that as we get further down the road. But right now, 2025 August is when that matures.

Awesome. Thanks for the call and congrats.

Thank you. Our next question comes from Brad Reback with Stiefel. Your line is open.

Great. Thanks very much. A couple of quick ones. The on-demand response business, can you give us a sense of what the profitability on a gross margin perspective looks like there?

Sure.

Thanks, Brad. This is Tim.

Historically, we've seen the margins in kind of the mid-20s. This quarter was a little bit lower as we saw some very large deals. We had a couple of deals that were materially or substantially larger than what we'd seen in the past. So what we used to define as a large deal, we had two deals that were much larger and those compressed margins. So I think as we get back into what would be what we call more normalized deal sizes, we would see those margins start working their way back up. But, you know, as we said in Q2 with the beat in the revenue and the large deals, that had compression.

I will double click on one thing for you, Brad. I mean, we saw some really interesting growth in our six-figure ARR customers that were north of $100,000, which was actually an accelerant over Q1, right? And so I think when large customers call you to help out in their time of need, we're finding that as, you know, kind of a an early indicator of trust. And that trust, we think, will continue to lead to larger ongoing relationships with those customers as well. So we like that business and we like the fact that we are one of the few trusted providers to get those calls in their time of need.

That's great. And going back to the debt position, it'd be accurate to say that you have to address that before August of 24, right? Before the convert becomes current?

I think that's a fair assessment. I mean, you don't have to, but I think it's in the best interest of all parties that we do that, and that's something we're actively looking at.

I think we'll have plenty of options there, too.

You do think you'll have plenty of options?

I think this is a really tough debt market, Brad, in general. I mean, if you look at the macro, I think anybody would be foolish to say anything but that we've seen some of the highest interest rates that are out there. But I think as long as we continue to perform We'll have options prior to next August, yes.

That's great. Thanks very much.

Thank you. And our next question comes from Yi-Fu Lee with Cantor Fitzgerald. Your line is open.

Good morning, Foster. Good morning, Tim. Congrats on another strong, consistent execution quarter and great upside on the free cash flow project about one year ahead of schedule. Two quick ones for Foster and one quick one for Tim. So, Foster, you talked about the Fox principle at the beginning of this fiscal year, you know, standing for focus, optimization on the platform, and expected in cross-selling. And obviously, we've seen that at play this quarter. I was wondering, like, because we hit the half-year mark already, if you were to judge on the execution of Joe Fox so far this year, What are some of the things that you think is beyond your expectation and things that Zilfox needs to focus on going forward?

I think the willpower and fortitude of our employees has just been unbelievable year to date. This is not an easy time to be an employee, particularly in a tech company, going through changes and back to offices and the types of things that are happening in kind of the overall economic situation that we're in around the world. And so I'm really proud of what our Foxes have been able to do here. I mean, when I think about the O in Foxy, I mean, that O in optimization is really just making everything that we do here at ZeroFox better on behalf of our customers. I mean, that's our North Star. That's what we talk about as a company. And I think Q2's results show that we are getting better and stronger as a company, and it's because of the effort of our employees.

Okay. To follow up on that, thanks for the comment on that, on the growth opportunities, right? Obviously, you guys have done a lot of stuff, right? You know, you announced Gen AI deployments, enhancements to the breach response platform to monitor the dark web. the Google Cloud partnership about two quarters ago, looking glass integration, it sounds like it's looking good. How would you rank these opportunities, like the most impactful upside in the near term versus in the long term? What do you think is the most bullish for you in the near term versus long term of all these opportunities or other opportunities I might have missed?

I appreciate the contextual question. Thanks for continuing to follow us along with detail. Maybe I'll answer it slightly differently. I mean, one of the things you heard in our earnings call today is kind of maybe a renewed focus or a first-time disclosed focus around our modules, right? And we said that in general, new customers that signed up with Xerofox and Q2 averaged about three modules. And then we spent a little bit of time talking about a couple of customer purchases that had eight or nine modules. So I think there's a really interesting opportunity for us Continue to make sure that our customers adopt the full breadth and capability set of our platform. And we'll spend time there the second half of this year, really making sure that customers adopt the platform because ultimately we fundamentally believe, and we've got the metrics to back it up, that when you adopt more of our platform, you are better protected and the results are improved.

Okay. Okay. And then the last one is for Tim. On the financial side, obviously, you guys reached free cash flow positive about a year ahead of my schedule. In terms of like, you know, the puts and takes to make this sustainable, what are they like, Tim? Like, can you give us, you know, is it better cash collection? What's driving this upside we're seeing? about a year, you know, earlier than expected. And for fiscal 25, did you mean to that, like, fiscal second half, you are pretty cash flow positive, but first half, it's more on the negative side? And that's it for us. Thank you from the county.

Yeah, listen, I think the basic answer is not so maybe sexy. It's just really the model is working as we scale. Certainly, the acquisition of Looking Glass has helped as we picked up some solid revenue with that. But I think it's really a scale factor. As you start to see, our ARR is right about 100 million and we'll cross that in Q3. So it's model scale in that regard. And then I think as far as 25, you're spot on. We do think, and you see in our script, that there is maybe a little bit of volatility in our working capital throughout the rest of this year. But once we get into the second half of the year, I think some of the timing of working capital between our AR collections mitigates, and we're into a steady free cash flow position.

Makes sense. Thanks very much, Tim and Foster. We'll catch up soon. Thanks.

Thanks, Keith.

Thank you. Our next question comes from Jonathan Ruckhaver with Cantor Fitzgerald. Your line is open.

Yeah, thank you. Good morning. So Foster, those those deals that you decided with eight to nine modules out of the gate, were those deals that had been in the pipe for, you know, six to nine months or so? Or were they more reactive responses to, you know, a breach of an external nature? And maybe, you know, broadly, you can just talk about How do you think these external issues could impact sales cycles looking out through the fiscal year?

Yeah, I heard a couple of things. So, Jonathan, a couple of examples I gave, what I call broad adoption of the platform, multiple pillars, multiple modules per pillar, and what I call long-term relationship, right? Not a near-term reactive response only for those eight or nine modules. In general, we've got about a few modules per pillar of our platform. So when I look at customers that are adopting six, seven, eight, nine modules, that tells me right off the bat that they've adopted the platform. They've adopted multiple pillars. They understand the consolidated vision and approach that we have, and they've gone all in on ZeroFox. When I see a customer in general that's bought one or two modules, That means one or two things quickly. It means that they've got a particular use case that's causing them some pain and they want to alleviate that pain as fast as possible. That could be because they've had an incident. That's because they've maybe had an issue inside. Maybe they wanted to replace a niche provider. But there's opportunity for us to then sell the platform vision and maybe earn our seat at the table when someone starts off with just a couple modules before they move into a full platform. So that's Maybe that answers part of the question. I heard kind of how we're thinking about the growth in the second half of the year. I think it's what I said to Yi. We're seeing an adoption acceleration for large six-figure ARR customers. And I think that just proves that the problems that we're working on continues to grow. I'm a firm believer in cyber. If your ASP is going up and your adoption and your large customers is going up, you're working on a problem that matters. And I'll tell you, external cyber matters. Every CISO... continues to be worried about getting attacked halfway around the world by nation state actors, by cyber criminal groups, they're less worried about an insider threat issue. I remember 15 years ago, that was kind of top worry. That's not the number one worry anymore. An external attack is what's keeping these guys up at night, and I think we're in the right place at the right time.

Yeah, it sounds like what you're saying is the demand trends are pretty strong across the entire platform. And so I guess along those lines, how do you see the sales organization equipped to sell across protection, intelligence, disruption? Are they fully up to speed on handling each one of those pillars? Or is there work that you need to do there to kind of drive that execution of a more platform sale?

I don't think we're ever done, Jonathan. I mean, I'm a believer in consistent training and consistent enablement. I mean, the analogy here we use is some of the best athletes or the best performers of all time still train daily. And so even if you reach the peak of what you do, you're the best quarterback to ever play, you're the best to ever play your sport in tennis, you still practice daily to get better. And I think Our team on our go-to-market side of the house we think is best in class for our space, but that's because we're really focused on continuing to improve them. I would say, though, our efforts in the channel always lag our internal sales team. So there is certainly more we can do there. We're still the baby on the block. We're still the smallest cyber company out there. We're still the last one to go public. And so we don't have the footprint of some of the other peers that we have out there that's envious to us right now. So we've got to continue to build brand awareness in our channel, continue to enable the channel, and make sure they understand our differentiated platform and approach.

Yep. Makes a ton of sense. Thank you.

Thank you.

Thank you. There are no further questions at this time. I'd like to turn the call back over to Foster for any closing remarks.

Thank you, operator. And as you can tell, we had a record Q2. We remain excited about the opportunities in front of us for the second half of the year. So, again, thank you for joining us to call this morning, and have a wonderful Wednesday. Cheers.

Thank you for your participation. This does include the program, and you may now disconnect. Everyone, have a great day.