Ping Identity Holding Corp.

or news conference call. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session, and if you would like to ask a question during that time, simply press the star 1 on your telephone keypad. If anyone should require assistance during the conference, please press the star 0. I would now like to turn the conference over to David Banks, Vice President of Investor Relations. Please go ahead.

Thanks, everyone, for joining us today, and welcome to the Paying Identity Conference Call, where we'll discuss results for the third quarter, provide outlook for the fourth quarter, and update our outlook for the full year 2021. Shortly after the market closed today, we issued a press release announcing our third quarter 2021 financial results. In addition to the financial results, we'll be presenting a live supplemental set of slides through the webcast portal. These will be published to our website following the call. You may access the press release and presentation on the investor relations section of pingidentity.com. With me today is our CEO, Andre Durand, and our CFO, Raj Dhani. Today's discussion may include forward-looking statements. Please refer to our annual report on Form 10-K for 2020 and our quarterly report on Form 10-Q for the quarter ended September 30, 2021, filed with the Securities and Exchange Commission. There, you will see a discussion of factors that could cause the company's actual results to differ materially from these statements. I would also like to remind you that during the call, we will discuss certain non-GAAP measures related to Ping Identity's performance. You can find the reconciliation of those measures to the most closely comparable GAAP measures in our third quarter press release and the slides we're posting to our website. To assure we can address as many analyst questions as possible during the call, We ask that you please limit your questions to one plus a follow-up. We will end the call after 60 minutes. With that, I'll turn the call over to Andre. Thank you, David. Q3 was another strong quarter of solid growth against all our key performance metrics. Annual recurring revenue again grew by 19%. Revenue of $76.2 million grew 27% year over year, once again reflecting solid sales results and contract durations. SAS revenue of $15.3 million grew 56% compared with Q3 of 2020. And our dollar-based net retention rate again increased up a percentage point from last quarter to 112% and also up year over year for the first time in several quarters. Laj will cover the financials in more detail and update our guidance in a moment. I wanted to focus today on the first of four core themes we focus on each quarter, delivering our entire platform in the cloud to help companies secure their hybrid IT environments. For starters, I'd like to thank and congratulate our Ping One Advanced Services team as we continue to exceed all expectations with this new offering. In just the past year, we brought 25 of the most sophisticated and complex global enterprises to Ping One Advanced Services, five of which were in our top 10 largest deals so far in 2021. Nearly 70% of these 25 customers are leveraging Ping for their customer use case, a trend not dissimilar to the one we are experiencing more broadly across our base. Speaking of the Ping One Cloud Platform, Much of our investment over the past two years has been behind the scenes, but these investments are now becoming a major driver of future growth. During our 12th Annual Users Conference, which took place last month, we announced several new PingOne Cloud Platform enhancements and services related to recent acquisitions. This includes the immediate availability of PingOne Verify to validate the real identity of users Penguin API Intelligence to bring security to all API transactions, Penguin Fraud to detect malicious behavior in our customer solutions, and Penguin Authorize to centralize authorization of any transaction coming in Q1 of next year. Together with our existing Penguin offerings, these new services enable a comprehensive platform from which to secure customer and workforce identities. ensuring access to any resource or application by verifying authenticating authorizing and monitoring any identity from a single intelligent cloud delivered identity platform but it gets better through our recent acquisition of singular key we can now not only integrate and orchestrate ping's technologies without the need for custom coding but we can integrate and orchestrate identity technology into an extraordinary end user experience that spans the entire lifecycle of identity use cases. And we can do all of this without the need for an army of developers. As our cloud offering matures, so too have the request to operate in different regions around the world with mission critical resiliency. To meet these growing demands, We've invested to expand our geographic coverage while improving resiliency through investments aimed at providing active, active redundancy across multiple regions around the globe. Lastly, with regards to our cloud platform, I'm pleased to announce that we have officially received our FedRAMP sponsorship from the Department of Energy, and as such, expect to make Ping One for Government broadly available in 2022. Focusing on another one of our core themes, embracing partners, we continue to make significant investments in our channel ecosystem. Our investments in channel marketing and enablement resources supporting our partners is up nearly 50% this year, helping support more than 125 customer and prospect-facing programs through and with our partners. Our investment enabled increased sales, technical, and implementation training. including the sales certification of 125 partner representatives. This training, along with an important shift in our professional services team to support partner-led implementations, has helped to grow our delivery-approved program, now with more than 20 such delivery partners. We continue to refine our framework for working with the Global System Integrators, or GSIs, These partners are eager to lead with Ping in their key business portfolios, especially as we have increased the pace of our acquisition activity. And now I'd like to highlight a few of our recent customer stories. Internationally, we landed a new logo with Caixa Econômica Federal, or Caixa. This government-owned company is one of Brazil's largest banks and the largest publicly held bank in Latin America. serving more than 30 million customers. They signed a contract to start their Brazilian open banking journey with Ping using our authentication and authorization capabilities. Their plan is to extend the Ping footprint in 2022, and this new sale was a great example of how we are going to market with partners internationally, in this case, NetBR. Also in the quarter, one of the leading East Coast warehouse clubs The company, which operates 215 warehouses in 16 states, serving more than 600,000 members, sought to protect their digital assets tied to their website and mobile applications. They looked to Ping to enhance their existing authentication capabilities by layering risk and evoking step-up authentication to identify suspicious and fraudulent activity. In a third story, we both expanded and extended our relationship with a Canadian-based multinational media conglomerate to secure 25,000 employees leveraging Ping One advanced services. We are currently nearing completion of a second agreement to extend the relationship to the customer use case. In another expansion story, the state of Colorado, which leverages Ping for both their state employees and for Colorado citizens, has expanded the relationship based upon the success of their ping deployment. More than 350,000 Coloradoans now leverage ping for their digital driver's licenses, proofs of vaccination, and other state issue IDs. With regard to successful deployments, we went live with Flinks to provide open banking to Canada. Based in Montreal, Flinks provides financial institutions a complete open banking-ready environment to empower those organizations to drive new business. Joining us in this implementation was Simeo, a longtime partner who is managing the Ping solution for Flinks in Canada to adhere to Canada's strict residency standards. We were also pleased to celebrate a go-live with SEL Health, a nonprofit healthcare organization serving several Western states. Our solutions streamline authentication and workflows for hospital staff and physicians while adhering to strict patient data confidentiality. SEL Health was also recognized as our 2021 Identity Innovation Champion, along with other award winners, Eurofins, TIAA, Old Mutual, and Banco Itao. We also recognized notable partners, including Altron Security, ProofID, and NetVR, and other significant finalists, Schneider Electric, TransUnion, and Acor Hotels. Thank you to all of our customers and partners for another great quarter expanding the boundaries of identity security. In closing, Q3 was a solid quarter for growth across all key metrics, and we're pleased to see a healthy return of larger deals. We're also excited to see years of hard work and our recent acquisitions start to reach a critical mass on our ping one cloud platform. We believe the singular key acquisition is a game changer and that no code orchestration will drastically simplify identity integration and the developer experience. I'd like to take this opportunity to thank the ping team for their dedication and hard work helping our customers succeed in identity. and welcome Jason Keyes as our new Chief Information Security Officer. Jason has a long track record of enhancing cybersecurity strategies for large enterprises and managing security teams, most recently as CISO at Groupon, but also with McAfee, Siebel, Oracle, and CBS Interactive. Finally, I'd like to invite you all to our upcoming Virtual Investor Day on December 1st. We will go into greater depth on our strategy and vision, our product roadmap, and provide key metrics while hearing from a number of our senior leaders. Please look for an official invite from our investor relations team. And with that, I'll now turn the call over to Raj to walk through the Q3 results in more detail and provide an outlook for Q4 and the full year. Raj? Thanks, Andre. We're pleased to have delivered above our guided ranges for all key metrics. We ended Q3 with ARR of $289.6 million, up 19% year-over-year. Q3 net ARR of $10 million was up 36% compared with the $7.4 million of net ARR added in Q3 of 2020. This quarter's performance reflects a continued return to a more normalized activity, with some solid large deals and average durations that are more consistent with historic averages. Third quarter total revenue grew by 27% to $76.2 million, of which 94% was subscription-based. Growth was driven by SAS and multi-year term license revenue. SAS revenue grew 56% in the quarter, an acceleration from Q2 as we generated $15.3 million in SAS revenue, primarily from increased adoption of our PingOne cloud platform. We now have more than 780 customers using at least one SAS solution, up more than 20% year-over-year. Subscription term-based license revenue grew by 25% year-over-year in Q3. Given the impact that deployment mix and contract duration have on GAAP revenue, we continue to believe that AR is the key growth metric of a subscription business. Our Q3 dollar-based net retention rate was 112%, calculated on a trailing 12-month basis and, again, tracking consistently with accelerating ARR growth. We ended the quarter with 288 customers with more than $250,000 in ARR of 14% year-over-year. Unless otherwise stated, for the remainder of the P&L, I will refer to non-GAAP metrics. You can find a reconciliation of non-GAAP to GAAP numbers in the accompanying press release. Gross profit margin for the third quarter was 78%, and comparatively, our GAAP subscription gross margin was 84%. Total operating expenses in the third quarter were $55.1 million. Year-to-date operating cash flow is $38.1 million due to the usage of $6 million of cash in Q3, reversing last quarter's strong cash generation as expected due to the timing of collections. This led to unlevered free cash flow of negative $11.1 million for the quarter, with $23.4 million of positive unlevered free cash flow year-to-date. We ended Q3 with $51 million of cash on hand. The $53 million quarter-over-quarter cash reduction was driven partially by working capital changes, but chiefly by the acquisition of Singular Key. The $73.2 million price tag for Singular Key at acquisition included $40.3 million of cash consideration and 1.26 million shares of Pink stock valued at $32.9 million. Even with our continued investments to drive innovation and growth, we remain in a strong cash position as we enter the fourth quarter. Moving now to guidance for the full year, we are raising our ARR projection to $306 million to $308 million, growth of 18.5% at the midpoint compared with 2020. We expect Q4 revenue growth of 11% at the midpoint of a $67 to $73 million range, with full-year revenue expectation of $291 to $297 million, or 21% growth at the midpoint. We expect to end the year with unlevered free cash flow of $10 to $12 million, slightly lower than prior levels, with negative $13.4 to negative $11.4 million expected for Q4. This includes the impact of both secure touch and singular key acquisitions. In closing, we feel great about our year-to-day performance and are optimistic about the continued growth trajectory for the balance of this year and longer term. We're looking forward to sharing more with you at our December 1st investor day. With that, I'll turn it over to the operator for your questions.

Thank you. At this time, I would like to remind everyone, in order to ask a question, We have your first question from Andrew Nowinski with Wells Fargo. Your line is open.

Great. Thank you. Congrats on a great quarter. I just want to start off with, you know, you're clearly seeing an inflection in subscription growth. This is the second consecutive quarter you've had over 30% growth on a year-over-year basis. So can you just talk about how your products have evolved and what might be driving that inflection in growth?

Andy, this is Andre. Thanks for the question. Our product platform, the Ping One Cloud platform, is reaching a level of maturity now. It's a combination of our advanced services coming online, Q4 of last year, combined with several new services, some acquired, some built organically, like risk, fraud, verification, and those services coming online as well. The story here really is the maturation of the PAME Cloud platform being offered to existing customers as well as new customers.

Okay, great. And then I wanted to ask about some of the recent acquisitions, including SecureTouch in June and then now Singular Key here in September. You know, how do you think those acquisitions fit into this product evolution, you know, where your platform's headed then? How should we think about the inorganic contribution from those acquisitions in 2022?

We've always had a vision that identity needs to be intelligent, informed by risk and fraud signals to make better authentication and authorization decisions. So SecureTouch is consistent with that. We had introduced Ping One Risk, which was a risk service for our workforce use case earlier in the year. SecureTouch completes that by offering risk and fraud signals now for the customer and consumer use case. So the entire notion that we're building a virtuous cycle where risk and fraud signals inform the identity control plane how to behave is It's also instrumental towards our passwordless vision. There's no way to achieve a passwordless experience without leveraging the implicit signals that are available to us, such that if risk is low and trust is high, we just let the user in, so to speak. So that acquisition was part of our strategy around an intelligent identity control plane. singular or this yeah the singular key acquisition is a little bit different if you step back identity is an integration game we're trying to connect everyone to everything speed of integration time to value and the flexibility with which companies can actually integrate not just the basic but the more advanced identity technologies is critical to all of these large enterprises SingularKey allows us to achieve a 10x on the time to value and the speed to integration. And it does so because much of the historical coding, as we say, the point-to-point hard coding, has all been done in now SingularKey. So it allows the business to design user experiences without coding. So identity is an integration game. Time to value, speed to integrate really matters. Singular key allows us to orchestrate all of these identity experiences without coding.

That's great. Any color on how we should think about their contribution in 2022, or is it still too early?

Yeah, hey, Andy, this is Raj. It is a little early. We're just... a couple weeks and a couple months into these integrations. So our first order of business right now is to integrate them with our own SaaS platform and continue to build pipe. What I will tell you is that there's a ton of excitement from our customers, from our sales force, and just generally in the marketplace around these solutions. So just watch this space. Sounds good. Thank you very much. Thanks, Andy. Thanks.

We have your next question from Adam Pindell with Raymond James. Your line is open.

Okay. Thanks. Good afternoon. I wanted to start on ARR. Last year you had just over $250 million, and based on guidance this year it's going to be just over $300 million. So if I look at the new ARR that you're adding, about $50 million, which I think would mark the highest level ever. Just wondering if you could maybe break down some of the composition of new ARR and as we think on a forward basis to put some takes to adding this sort of level of ARR on a go-forward basis. Thanks.

Sure. Hey, Adam. So no surprise, right, based on what we've been talking about, SaaS ARR has been growing at multiples of the overall rate of growth of the business. We've introduced several new SaaS services over the past three or four quarters, including Ping One Advanced Services, which has a tremendous amount of pipe building and interest and adoption, frankly, within our customer base. So when I think about sort of this year, it's really kind of that inflection point in our SaaS delivery. As Andre mentioned, You know, that feature function parity along with these independent services on our platform are really sort of changing the game for us in terms of SaaS competitiveness. And we're seeing that, you know, translate into wins in the market. So that's driving a lot of our success there and overall growth. In fact, in Q3, we actually – We saw the majority of our overall bookings for the quarter come from SaaS services, so we're really excited to see that.

Okay. Yep. Sounds sustainable. Okay. I did want to ask maybe a follow-up on cloud. Andre, you talked about the active-active coverage expansion and different geographies. I'm wondering kind of a two-parter, you know, the benefits from this, any way to kind of comment on the size and scale of incremental opportunity with maybe the U.S. as a potential precedent? And then secondly, the cost. I wanted to clarify, are investments already in place for this, or are there going to be incremental investments needed as you do this? And maybe Raj can help with sizing any of that.

Thank you.

All of our customers, well, many of them, most of them, treat authentication as a tier zero or mission-critical service. If their own users or customers cannot authenticate, you know, transactions basically don't occur. People don't access the network. They can't work. So resiliency is a very big part of what we need to do when we deliver identity services. This is more than application. It really is mission-critical infrastructure. Active-active in the cloud is one of the ways in which we achieve our four nines of availability in our SLAs. And so the investments there obviously are critical to the credibility and really acceptance of our cloud offering to our large enterprises. A lot of the investments now are behind us, to be clear. We do run our services in AWS, so these are not large capital outlays, but really just bringing a new region within AWS online. There is work that we have to do, obviously, to bring a second region in a territory online. There is data residency, as we know, that's driving a lot of decisions about where companies are able to put customer data or even their employee data in the cloud. So in order to offer four nines of availability and the level of resiliency customers are demanding, you really want to get to an active, active state in country or in territory as best you can. Most of the investments in our geographic expansion are, let me just say, many of them now are behind us. So I don't expect there will be continued investment going forward, but all the major regions that Ping now operates in, the U.S., Crimea, Australia, and now Canada, are now covered under really our cloud active-active program.

Very helpful. Thanks, and congrats on the results. Thank you.

We have your next question from Gray Powell with BTIG. Your line is open.

Great. Thanks for taking the questions, and congratulations on the good numbers. Thank you, Greg. So yeah, I just want to follow up on Adam's question. I was just kind of in some back of the envelope math. I mean, roughly speaking, it looks like your SAS product drove about two-thirds of the net new ARR in Q3 versus more like 50% or 55% the first half of the year. Does that seem about right to you?

And then do you see a point where more like, I don't know, 90% plus of new business is coming from SaaS? Or is there sort of like a natural point where the on-prem to SaaS mix stabilizes?

As Raj noted, This was an important quarter in the inflection of our business and really the validation, if you will, of the investments we've made over several years in our cloud platform, in our SaaS platform, Ping One. This was the first quarter where SaaS outstripped the bookings, outstripped the software bookings. We do expect that to continue. Now that the product is reaching a level of maturity, obviously, we continue to invest in it. We are a cloud your way company, to be clear. Many of our largest customers continue to maintain or run ping either on premise or some of the newer deployments in the public cloud, but leveraging our DevOps program. So they're running our software in our DevOps program, but they are managing it in their public cloud, one or more of their public clouds. We don't do anything to, say, tip the table one direction or another. It is advantageous for us that we give these customers the choice of how they want to consume identity, whether it's on-prem in their public cloud or as SaaS from Ping. And I would expect that that would continue. You made a statement about 90% at some future point. I do think that there is a resting point in the future where there is a healthy balance, SaaS-dominated ARR, It is a faster-growing part of our business. We expect that to continue into the future. I don't know if the balance point ends up at 90-10, 80-20, 25-75, for example, but I think you are directionally correct in assuming that the transition to SaaS for Ping is now well underway.

Okay, that's really helpful.

And then just my follow-up business would be that, so I mean, the SaaS is just clearly seeing good traction. How should we think about the product set and its potential to drive better headline customer growth metrics? Is that something we should be looking for over the next six to 12 months? It hasn't been the primary focus. We've been very focused on bringing our entire platform to the cloud, number one, introducing the new services that are building into the future. These are the risk and fraud services, the API security, focused on the customer use case. So product differentiation has been very important. And now focusing on how companies will integrate our platform into everything through no-code orchestration. That's been the primary focus. And a lot of the ARR growth has been customers expanding into Ping as a strategic platform for both the workforce and the customer use case. I do believe that going forward, as the platform can be consumed all from the cloud, and as orchestration reaches some level of maturity over the course of the next year, I do think that more focus and attention will come back to the customer account, but much of the focus has been on making sure we have the right platform that is differentiated, that is focused in the right places, and that we acquire through these technology tuck-ins the acquisitions which complete our story.

That makes sense. Okay. Thank you very much.

Thanks, Greg. We have your next question from Adam Berg with Stiefel. Your line is open.

Hi, this is for Adam Borg. And thank you for taking the question. Maybe for Andre, just on SaaS, obviously, your sweet spot has been in the upper end of the market. Let's hope we could talk more about, one, the receptivity by your largest customers and prospects to adopt SaaS at Andy, and, two, the opportunity for SaaS to help move down market more below the global 3,000. Thanks.

I think some of the success of advanced services among some of the larger enterprises speaks well to some of the large enterprises' willingness to adopt cloud in the solution that we're giving them in Ping One Advanced Services. So I think that begins to speak for itself. We expect a lot more of that. I think down market, the down market tends to focus on different things than the larger enterprise market. There's a lot of hybrid integration. There's a lot of legacy integration, not just cloud or SaaS app integration for large enterprises. That's an area where Ping tends to be very, very strong. So everything related to a large enterprise that wants to put identity in the cloud, consume it as SaaS, but reach back into the hybrid enterprise for all of those legacy and on-prem use cases, I think we're very differentiated there and foresee we will continue to be very differentiated there for some time. That use case or that level of sophistication, hybrid sophistication, is not paralleled by the down market, the S&B market. So they do tend to focus on some different things. Our intention is not necessarily to go down market, say, below the global 5,000. So I'll extend it a little bit beyond the 3,000 there. I will say, however, as the maturity of Ping 1 continues and as we introduce new services like orchestration, that are new to the market and help, as I said, 10X the speed and simplification with which identity services, multiple identity services and platforms can be integrated, that I would not preclude the opportunity that some of our new services have down market appeal. So we're always open to it, but from a go-to-market point of view, it's not our primary focus.

Great. Thank you.

We have your next question from Catherine Rudnick with Collier Securities. Your line's open.

Thank you for taking my question. I'm not sure if you can quantify this, but in speaking with many of the CIOs, the first piece that they're looking at when they're looking at a zero trust architecture is identity. And can you explain to me, or all of us, how soon you fit into that process when they start that architecture decision, and then how long it takes to really drive your use cases? Thank you.

Good question, Catherine. So zero trust is an awfully big word. It's been commandeered by the marketers of the last six, seven months to stretch to mean a lot of different things. But at its foundation, we're moving from essentially perimeter security, where there was high trust, meaning if you were inside the perimeter, you were very trusted, to a world where we neither want to trust the user the network they're on, or the device they're on. So zero trust is an embodiment of what do we do when the network, the users, and the applications don't reside within our control, and we need to presume that we cannot trust them. However, we need to somehow let them in. So the reason why identity is foundational to zero trust is or really the cornerstone of zero trust is we move from perimeter-based security to identity being the perimeter. We only want to let the right users in who are appropriately authorized and on a device that we either trust or we are managing. Think an endpoint, a laptop or a cell phone, for example, neither of which are necessarily in the building on the network. They could be anywhere vis-a-vis at home. So Zero Trust is fairly synonymous at its most foundational level with the notion of identity-based security or identity as being the new perimeter that we're creating. There are two major pieces of identity, both of which are central to our platform in Zero Trust. One is authentication, making sure you're talking to the right user. We need to strongly authenticate every user. And the second is authorization. What can the user do? What can they see? What are we going to allow them access to? So the cornerstones of the Ping platform really are both authentication and authorization, which is why the second a company begins a zero-trust journey, the focus and attention begins to move from firewalls and VPNs and all of the traditional layers of perimeter security, and it begins to move towards how are we going to authenticate everybody? How are we going to do that frictionlessly, aka passwordless if possible? And then what are we going to allow them into? so that that connection tends to happen within the first day as you said and uh to support that one of our well our largest deal in the history of the company the advanced services deal i announced this a quarter or two ago the initiative that they are looking to achieve is both a cloud transformation one and number two a zero trust transformation now for them it's going to be a five-year journey i want to be clear This is a very, very large global enterprise, tens of thousands of users, hundreds of thousands of customers, and they are moving from a perimeter-based security to a zero trust. This is a company that makes significant weaponry and other big machinery that you would want to make sure that you need to maintain security on. So this move is happening. It's a secular shift. It's not going to happen overnight. Identity is central.

All right. Thank you very much.

We have your next question from Matt Hedberg with RBC Capital Markets. Your line is open.

Okay, great. Thanks, guys. Andre, you know, as we kind of, you know, maybe are in a period of a bit more reopening here from a COVID scenario, how do you think about the large or the opportunity to replace legacy solutions? I mean, do you think some of those things could come up a bit more frequently now. And I guess to what extent can partners help with either the timing of understanding when some of these renewals come up or ultimately helping to replace some of these with PING? I'll start with the last part. Partners are instrumental in helping us understand when the terms are essentially up on that infrastructure. So you're right in honing in on the importance of the channel and partners to identify that. it is um it is a bit of a waiting game right they this is critical infrastructure they don't necessarily rush to replace it until a term is up and then they look to modernize we are seeing a return of legacy modernization um some of many of those projects were put on hold for the first year of covid now we are seeing those projects begin to return we do anticipate We've been asked for years whether or not there is an accelerated tipping point where everyone just rushes to get rid of that legacy. We have not seen that. We see this as a large, almost steady state replacement of legacy. Now, the truth is, every year it becomes a little bit more brittle. We are really the go-to company that has migrated hundreds of large, very large, very complex enterprises wholesale from legacy to a modern identity stack or modern identity platform. So we're in a very, very good position to sit and essentially wait until these modernizations occur. We are working with partners to identify them as they happen.

Got it. That's helpful.

Super helpful. And then I know you guys have, you know, you have had a little bit of hybrid work activity, whether it's corporate office or sales and marketing folks out in the field. As we think forward to 2022, I guess it's somewhat a related question, but do you anticipate salespeople getting out and seeing clients more face-to-face meetings next year? And if that's the case, do you think that could have a positive impact on pipeline generation as well? We do. I'm pleased with the pipeline generation we've been able to create through COVID without traveling. But the truth is, in large enterprises, relationships do matter. Seeing people eye-to-eye does matter. So while we've been able to operate effectively through it, I think the team and our customers are looking forward to getting back together, whether it's whiteboarding sessions, whether it's kickoff of implementations where the first two or three days you want to get the team together. So I do anticipate that there is going to be more face-to-face. I do believe it will have a positive impact on type 1. Great. Thanks a lot. Congrats on the results, guys. Thank you, Matt.

We have your next question from Brian Coley with Stevens. Your line's open.

Hey, guys. Thanks for taking the questions. So I'm curious, can you just talk about the competitive environment and kind of how it trended during 3Q? And also, you know, are you seeing any change in win rates against kind of some, you know, pure play SaaS vendors like Okta and Auth0?

We are seeing improved win rates as a result of really the maturity and differentiation of some of our cloud capabilities as of recent. We have not noticed an overall, you know, there's been no rapid necessarily change in the competitive environment. We watched whether or not the Okta or Auth0 would have any material impact on where they showed up or how they showed up. I would say that our own cloud maturity has made us more aware, if you will, of those deals. I think we're included where we might not have been included before. But generally speaking, where we were historically strong, we continue to be historically strong. This is in large enterprise, hybrid deployments, cloud your way, and in the areas where we might not have been considered in prior years because of the maturity of our own SaaS platform, Ping One, that is absolutely improving in our world.

Got it. So, I mean, just thinking about the channel and the investments you've made there, I'm curious if you're seeing – channel partners start to, you know, have more meaningful impact on the pipeline now? It's been, you know, a year or two since you've been investing there.

Yeah, Brian, this is Raj. I can take that. So, you know, we are deeply committed to our channel partners and are working with channel partners now in almost all our deals or at least, you know, really pushing to do that. And that's just a manifestation of just going all in with the channel. And I think they're feeling that. We've always been a good channel partner to folks, but I think this year we've really sort of amped up that commitment, as we've talked about in previous quarters. And engaging in the channel is not something that is a flip. You just sort of switch, and now you're a 100% channel company overnight. But we're seeing the kind of steady improvements that we expected to see at the beginning of the year, And it's all starting to come together. So we're really pleased with our team and how they're doing and how channel partners are reacting, you know, to those investments. We have, you know, over 125, you know, channel partners out there. We're investing in them in terms of certifications around sales and enablement and all sorts of other training and marketing activities. So we would expect that trend to continue.

Great. I appreciate the time.

Thanks, Brian. We have your next question from Michael Romanelli with Mizzou Security. Your line is open.

Yes, thanks. Hi, guys. Just one from me, actually. You touched on this a bit earlier, but was there any shift this quarter in the customer identity business vis-à-vis workforce identity?

Customer has been trending at an accelerated pace relative to workforce for several quarters now. This quarter was no different. So the majority of our new ARR now is being generated from the customer use case. That is by design. We've been leaning heavily into the customer use case. Many of our acquisitions have been focused on our platform solution capabilities around the customer use case. So we're very committed to be clear. Our vision of the platform is one platform, both use cases. 25% of our customers use us for both use cases. That is increasing. I've signaled that before. We do see a desire from large enterprises to consolidate where they can to gain leverage from both the partner that they have for identity, but as well as the platform that they're using for both customer and workforce identity. All of that said, The customer use case we believe to be ultimately a larger, it is today and we expect in the future, a faster growing use case. And our platform has been differentiated for some time now on scale and performance. Some of the largest systems in the world run off of ping. But in the future we believe will be differentiated in the speed with which we can generate incredible user experiences without coding. vis-a-vis this singular key acquisition that is focused on the user journey, enabling a user journey through identity that's both frictionless and do so with the minimal amount of coding. Perfect. Thanks.

Thank you, Mike. We have your next question from Mike Sikos with Needham and Company. Your line is open.

Hi, thanks for taking the question, guys. Just a real quick one for Raj to kick things off, but can you talk to the return of these large deals that you're seeing? And maybe if we're trying to quantify what that impact was to Q3, and in addition to that, anything you can talk to regarding the decline in gross margins we saw this year? There was a slight decline in subscriptions, but I'm more looking at the compression we saw on the professional services side as we're looking at the future of the business.

Yeah, let me take that one at a time. So in terms of deal activity, we are seeing a return to what I would call more normalized buying behavior, which is in contrast to the COVID quarters, I'll call them, where we saw deals not go away, budgets not go away, but really get sort of phased and chunked up into smaller deals that sort of culminated into, you know, the original deal size over a period of time. That's largely now behind us. We're seeing that on a onesie-twosie basis, but for the most part, that has – you know, that has largely sort of come back to more normal levels where what we were seeing pre-COVID, which is a bunch of transactional or run rate activity coupled with, you know, a couple of large sort of high six-figure or seven-figure deals. And we're starting to see that come back. We saw that in Q2 as we talked about last quarter. That was probably an anomaly the other way. if I'm recalling correctly. But in Q3, we saw a more normalized quarter, similar to what we saw in pre-COVID quarters. From a margin standpoint, You know, we have a, you know, we're investing in our cloud, right, and we've been talking about that for several quarters now. We've introduced several new services, including Ping One Advanced Services, and we're seeing a lot of traction there, but we are building our our kind of entire infrastructure in advance of that. So, you know, we'll see operating leverage on that once we hit more scale. But we're certainly sort of, you know, building out our support and cloud infrastructure and hosting infrastructure in advance of that. On the ProServe side, it's largely a function of timing of hiring. It's also a function of enablement for our channel partners versus us directly maybe billing. We think that's healthier in the long run for our business. I'd say those are probably some of the factors that come to mind.

Thanks for that. And then just one real quick one for Andre. I'm curious because we did talk to Global 3000 or maybe I'm answering my own question here with the commentary that you had earlier about the Global 5000. But my sense is that with this maturing and growing number of SaaS services that you have, it is in a sense expanding Ping's market opportunity. And what I mean by that is do you see these services as making Ping more consumable as we think about potential to expand down market. Is that a fair characterization and can you extrapolate on that?

That's 100% accurate. The skills to maintain infrastructure down market are not present. Those companies essentially are required to consume identity capabilities however they can get them, but they don't have the skill sets to deploy and maintain mission-critical infrastructure the same way that the large enterprises do. So as our capabilities now are consumable as SaaS, you can go in, create an account, and all of the services which were historically only available in software for companies to run are now available as a SaaS or a cloud offering in addition to all of the new things that we've either built and or acquired, which are very SaaS-focused. that is going to inherently increase the acceptance and the opportunity for companies without the same level of sophistication to consume them. Now, many of the services that we provide probably do cater to a down market, meaning the down market has those problems like single sign-on, for example, and MFA. Almost every company has those needs. But some of the more advanced capabilities that we offer, like data governance and authorization and API security, it might be that those services are, you know, address problems or issues that only large enterprises have. So we're cognizant that our product portfolio has been optimized. The complete portfolio, let's just say that, is optimized to tackle the sorts of challenges that large enterprises tend to have. But you are right that offering it all in the cloud is going to improve our ability to move down market, should we choose.

Thanks again, guys. Appreciate the call.

We have your next question from Patrick Colville with Deutsche Bank. Your line is open.

Thank you so much for squeezing me in. Can I just ask about the guidance? The fiscal 21 ARR guidance includes the inorganic contribution from Singular Key. And I guess if so, is there any framework you can kind of give us to help quantify it or any kind of metrics you can share in terms of how big Singular Key was, you know, like as a kind of private company, was it employees or something? anything to kind of help us understand that acquisition.

Yeah, Patrick, this is Raj. I can take that. So Singularity is a relatively small company, probably just over a dozen folks between employees and contractors. You know, they didn't have much in the way of ARR acquired, so it's really insignificant. And we're spending the time now, rather than just simply, you know, rush to roll it out there, we're taking our time to integrate it into our Ping One cloud platform. And so the fiscal 21 guidance really doesn't have much of anything on, you know, coming from that.

That's very clear and very helpful. Can I just give over to the margins? Looking at the model now, I'd say that one of the kind of most impressive things of fiscal 21 has been the increase in profitability on the free cash flow line. If I'm calculating this correctly, pre-cash flow margin year to date, up from five last year, up from negative two, two years ago. So just having to understand, I guess, that dynamic, where that's coming from, as to how we should, I guess, think about the northern profile from here. Thank you.

Absolutely, Patrick. I'll take that, too. So we are, as you know, our financial ethos is to be a profitable growth company. As you mentioned, we were close to breakeven a couple of years ago and cash flow positive last year and, again, expect to be this year. So that's not by accident. We're very efficient and very disciplined in everything that we undertake. And the business model has a lot of operating leverage in it. i'd say that you know we've been in investment mode last year and this year um again not sort of looking too far ahead but you know we'll continue to lean into investments where they're paying off but we're not um we don't sort of peanut butter spread our investments around and hope for the best we're pretty surgical in what we invest in how we invest and in measuring those things and pivoting quickly from initiatives that maybe aren't delivering the highest ROI to doubling down in those that are.

Thank you so much.

We have your next question from Jonathan Ho with William Blair. Your line is open.

hi good afternoon uh i just wanted to maybe start out with uh i guess the improvement in terms of the ping cloud capabilities you've you've had this for a little bit of time now and i'm just wondering you know has this uh affected at all your relationship with microsoft which has you know oftentimes been a large partner uh on that side there's been no change in relationship as a result of the maturation of our cloud uh platformer capabilities jonathan we've

We've enjoyed a good relationship with Microsoft. As you'd imagine, nearly every, if not all, of our large enterprises have strong Microsoft relationships. They're looking to provide identity services that integrate not just with their own Microsoft-consumed technologies, but their on-prem, their legacy, and their other cloud capabilities or other cloud deployments. So ping is pretty instrumental. in providing a neutral identity set of services that allow those large enterprises to integrate identity across all of their clouds, their legacy, and their on-prem. That's always been the case. I do believe that there will be an emerging set of opportunities between Ping and Microsoft relative to some of our new orchestration capabilities of SingularKey. We haven't explored those yet. We do anticipate exploring those in the years to come.

Got it. And then just in terms of, I guess, the US government opportunity, can you talk a little bit about how big of an opportunity Penguin for government could be in 2022 and maybe some of the rationale for why now to try to push into that vertical? Thank you.

We've had a number of government customers for some time that have run us on-prem. We've had growing demand from those and new customers for a FedRAMP certified offering, but I would suggest that the FedRAMP certified offering isn't limited to simply federal government new or existing opportunities. There's a good swath of our private sector enterprises that do business with the government, and it is a requirement that their solutions that interface with the government also be FedRAMP certified. The FedRAMP opportunity, FedRAMP certification is larger than simply an opportunity to sell the federal government. It's to allow the large private enterprises who are running Ping to also interface with the federal government. So we're very bullish on where this goes. We have been wanting a FedRAMP solution for some time. Getting a sponsor for FedRAMP certification is non-trivial. We've got a very, very strong sponsor in the Department of Energy who's been a PIN customer for some time, and they have agreed to sponsor us for multiple levels of FedRAMP certification, some of the higher levels of which will allow us to move into some highly secure environments with our existing customers who do business with the federal government.

Great. Thank you. We have your next question from Andrew Nowinski with Wells Fargo. Your line's open.

Oh, great. Thank you for squeezing me in for one more. I know you talked about Ping 1 and the maturity of your cloud solution bringing you into more deals, but I was wondering if the recent cyber attacks, like the one that Microsoft detected, are creating new demand, or do you think the impact from those attacks will be felt more in 2022 when companies reset their priorities and their budgets?

I think all of these cyber attacks are putting essentially more focus on what is already a secular shift from traditional security methods and paradigms to an identity-based security paradigm. So I don't see that there is any one attack necessarily pointing to you must do this, so to speak. But what I am seeing is the nature and the persistence of attacks and the nature of the attacks themselves are essentially exposing identity weaknesses and or identity immaturity. And all of that combined with, you know, the notions of zero trust, which is basically moving from the notion of perimeter-based security, firewalls and VPNs and trusted users on company-issued computers in the building, to a world where everybody is distributed, yet we still need to secure it, and we're going to need to secure it through the identity capability. So I don't see it as an immediate and impending change from any one cyber attack, but every one of these attacks adds to the argument that they need to invest in identity.

Great. Thank you.

So that concludes today's earnings call. I want to thank everyone for joining us. We look forward to providing you with additional updates at our December 1st Investor Day. Thank you and good evening.

Ladies and gentlemen, this concludes today's conference call. Thank you for your participation. You may now disconnect.