Akamai Technologies, Inc. (AKAM) Earnings Call Transcript & Summary

Good morning, and welcome to the Morgan Stanley Life After COVID Conference. Very pleased to have with us this morning from Akamai Technologies, Dr. Robert Blumofe, the EVP and General Manager of Platform and Enterprise business. My name is Keith Weiss. I lead the Morgan Stanley software research team here in the U.S. And before we get kicked off with Akamai, I do have to read a brief disclosure. Please note that this webcast is for Morgan Stanley's clients and appropriate Morgan Stanley employees only. The webcast is not for members of the press. If you are a member of the press, please disconnect and reach out separately. For more important disclosures, please see the Morgan Stanley research disclosure website at www.morganstanley.com\researchdisclosures. If you have any questions, please reach out to your Morgan Stanley sales representative. Excellent. Bobby, thank you for joining us this morning. Really pleased to have you to talk about Akamai.

And really, where I'd like to start out is maybe you could give a brief introduction of yourself and then your role within Akamai. You're a long-term Akamai veteran. And then we could go into maybe a post -- it's not -- we're not through it yet, but kind of a review of what you guys saw that are going on within Akamai over the course of the last 6 to 9 months as this crisis started to unfold. It's a really interesting perspective from Akamai because while you're all B2B, your customers have an angle that's more enterprise security focused. There's also an angle that's more consumer-focused with stuff like OTT and gaming. So maybe you could give us a brief overview of kind of what you guys saw in your core businesses over the last 6 to 9 months in response to this crisis.

Goodness. A lot there. Thanks, Keith. Let's see. Yes. So you're right. I have been with the company for a while since summer of '99. I can hardly believe that, so over 21 years. And my responsibilities are, one, is the Akamai platform. As I think many of you all know, all of Akamai's products are built on a common technology platform. And that gives us a lot of leverage because we can build multiple products in multiple segments, all with a common technology base. And that really helps accelerate things and makes us far more efficient. And then the other part of my responsibility is driving our enterprise product portfolio, which includes our Zero Trust offerings, what we call enterprise security offerings. And that's been an exciting journey as well. All of it really just wonderful. Yes. And then this last -- I guess, since March now, since the pandemic really began in earnest here, it's been quite an adventure. We've talked a lot about the traffic growth, almost over 90 years' worth of traffic shows up, and it continues to grow nicely. I mean the world really moved online in a -- well, it's already happening, but now in an even more accelerated fashion. And so we continue to see healthy traffic growth. We've recently seen a huge increase in the number of attacks, these ransomware attacks that we've been able to protect customers against and a number of other similar sort of dynamics. And then you mentioned enterprise where you have the need to adjust to a remote workforce. And I think at this point, many companies are operating in a remote-first or remote-only environment. When the pandemic ends, I don't think we just completely go back to everything the way it used to be. I think we can take the best of what we have learned in the pandemic, combine it with the best of what we had before the pandemic. And probably the result is a workforce that is more agile, more diverse, more inclusive and ultimately, can work from anywhere effectively, sometimes in the office, sometimes not. And the security implications are enormous. And so I think we're seeing an acceleration of what was already a trend in enterprise security toward the cloud, obviously, and we can talk more about that.

Got it. That's great intro. So on the back of the pandemic, on sort of the traffic on the platform, the core kind of CDN business saw massive spikes in usage as people are streaming more videos, downloading more games. Can you talk to us, one, just kind of the scale of that increase that you guys saw in the first half of this year? And as we sort of continued on through the summer into the fall, are those traffic levels sustaining?

Well, we are continuing to see growth in traffic. It wasn't just -- yes, there was one quick sort of early uptake in all this, but we continue to see a healthy forward march on traffic. Now we've talked a little bit about some of the complicated geopolitical things that have impacted traffic and some pretty big swings occur there. But I think organically, there is a continuing rise of the tide, if you will, that hasn't abated. That continues on.

Got it. Got it. But then with that traffic, it sounds like the bad guys also tried to take advantage of what was going on in the environment. You mentioned ransomware attacks. Did you see the same type of spike in activity on the DDoS side of the equation where people are trying to take advantage of that and overwhelm the networks?

Yes. In fact, the ransomware issues that we've talked about were actually mostly the threat was DDoS. The bad guy is asking for a ransom or they will launch a DDoS attack. And so we've been in a position where we can protect our customers. And as a result, the customers can basically deny the, effectively, the extortion request. They can basically say, "No. We're protected." And so that's been very effective. And in general, though, I do think that the cyber criminals are aware that in this environment, that there's a lot to be gained for them. They see this environment as creating more of an attack surface and more things they can go after because with everybody working remote, more and more people are mixing their business use with personal use. We actually recently collected some data that shows a rather dramatic increase in the amount to which people are using their work computers for personal use. And as a result of that, a dramatic increase in attempted access to phishing sites, malware sites and things like that. So if you're a bad guy who wants to be -- wants to phish, wow, this is a great environment for you to be going after that, and our customers need that protection more than ever.

Got it. Got it. Makes sense. So in 2020, you guys saw ramp-ups in kind of the OTT traffic, a lot of new OTT launches this year. Your security business has been growing really well. I think you're going to exceed $1 billion in security revenues this year, has been a big focal point of the company. As we turn our sights towards 2021 and as, hopefully, we start to come out of this crisis, how would you characterize some of the top objectives, maybe the top 3 objectives for Akamai, and sort of what you guys are looking to accomplish and sort of push forward with in 2021?

Great. Yes. I think we focus on 2, actually. I think I can be more focused in the answer with 2. The first one being what I would characterize as operational excellence to drive profitability and cash flow. We're very happy that we've achieved this 30% operating margin, and we believe that we can sustain that. We believe also that that's a good place to operate the business. That's a good operating margin for us to be at. And to stay at that, at that place, we need to continue to drive operational excellence. And that means managing our OpEx very efficiently. We're using our human capital in a very efficient manner. But also, we continue to engineer around COGS optimization, around CapEx optimization. And by doing all of those things -- and again, all that really is about operational excellence. By doing all those things, we can drive this incredible profitability, tremendous cash flow and have the resources available to invest in the areas where we can get growth. And I think we're unique in the industry in being able to really have that kind of profitable, massive cash flow environment and still be able to invest in growth areas. And that's where I now get to number two. So first was the operational excellence for profitability and cash flow. Number two is investing to drive revenue growth in the, really, in the many, many opportunities that we have ahead of us that range from the growth in 5G, 5G represents a wonderful opportunity for us; the proliferation of devices, IoT, new messaging protocols and the massive amounts of data in motion that, that creates; to security, where we've already got 4 products over $100 million each in annual revenue, new products that are still early but getting great early traction like Page Integrity Manager, our Secure Web Gateway; new launches that are coming, like our multifactor authentication and more. There'll be many, many other things where we want to place the bets, make the investments and drive revenue growth. So again, number one was the operational excellence for profitability and cash flow. Two is investing in the enormous opportunities that are ahead of us to drive revenue growth.

Well, if I could just add. I think, Keith, to your point, I think Bobby's enthusiasm reflects the companies around. We think we can give you both sides of the coin, which is revenue growth and profit. I do think that -- obviously, for the last 3 years, our main priority has been this 30% operating margin. I think we're very excited that we'll probably come in slightly over that for 2020. And I do think that we owe investors, and we'll probably do that in a more sophisticated fashion in terms of what's next in terms of, to Bobby's point, revenue drivers as well as operational efficiency drivers in the first quarter of next year after we provide sort of the annual results. We'll probably either do it through an analyst day or call with management or something of the force to let your investors and you as a sell-side analyst know how can you track Akamai's business as being successful. And I reflect Bobby's enthusiasm that we have a lot of irons in the fire, which I think we're all pretty good at. I don't think we've strayed very far from our core knowledge and our core DNA. And the enterprise business that Bobby is in charge of has great opportunity. And I think it's just still early days in that. I mean there's other companies like Zscaler who are also very successful. But when you look at the TAM to looking at the size of the revenue streams, we have both nothing but greenfields in front of us.

Yes.

Got it. That's actually a great segue, Tom. And I wanted to dive into some of those growth initiatives that, Bob, you were talking about in terms of areas of investment. And enterprise is, I think, front and center because it is the part of the business that's probably most dynamic, where you have the most new solutions going on and probably also the least well understood by investors. Correct me if I'm wrong, Tom, but most people look at Akamai as the sort of the pioneer and the leading vendor in the CDN space. You have a big web performance business as well. And you do security, and it gets a little bit shady after that in terms of people's understanding of what you actually do in security. So Bobby, maybe we could start out with an overview. When you're talking about the enterprise division, what are the sort of main areas of business within the enterprise division? And why does it make sense for Akamai to be there? How does that leverage your platform? How does that leverage your existing customer base? And why does it make sense for Akamai to be a player in those areas?

Yes. It's a great question. Thanks, Keith. Yes, we're enormously excited about the opportunity with enterprise security. Security overall, as you pointed out, is at around $1 billion. Now enterprise is still a relatively small part of that, but it's growing rapidly. And let me try to explain sort of the background of why we think it's such a great opportunity for us, which is exactly what you're asking. Yes, I think it's helpful to understand some trends because enterprise security is an area that is undergoing massive changes because the world is changing and the enterprise security approach needs to change with it. We're seeing that happen, and I think we're really kind of in the middle right now of a storm that is completely remaking enterprise security. And it's based on a number of trends that are clear and undeniable, one of which is the employees have left the building. Your employees are now -- well, certainly during the pandemic, they were all working remote. But even before the pandemic, increasingly, employees expected to be able to work from anywhere, oftentimes remote, oftentimes in the office. And I think when the pandemic ends, I don't think we just completely go back to the old way of doing things. As I said, we combine the best of both worlds. And we now are in a world where, again, employees increasingly can and do work from anywhere. So employees have left the building. The applications have left the building. Applications don't sit in the data center anymore. They now are off in public cloud in many, many locations. So employees left the building, applications left the building and we now live in this distributed world of applications and employees distributed. Now the threat actors also are increasingly distributed. They can come from anywhere. Geographically, from anywhere, they can employ bot armies that can be in any or many countries. And in that landscape, the old way of doing security, which is generally to deploy a number of appliances or virtual appliances in a handful of locations in a fairly centralized model and then you backhaul the traffic to that security stack, that model just doesn't make any sense in this distributed world. Instead of backhauling traffic to the security stack, what we're saying is let's move the security stack, too, where those users, applications and the bad guys are, and that's the edge. So the security stack needs to become ubiquitous, needs to be omnipresent. And that's where our edge platform really, really shines because we can put the security stack everywhere where it needs to be, near the users, near the applications, near the threat actors. So that's one dimension. The other dimension is, and forgive the longish monologue on this, but the other dimension is this sort of unification of the security stack. Gartner actually has a pretty nice exposition on this, that's the right word, that -- where they -- it's actually part of their SASE framework, secure access services edge, where they talk about bringing together a number of security capabilities in a unified security stack because as they rightly point out, employees these days, wherever they're working, they access the Internet. They access SaaS applications: Salesforce, Office 365, G Suite, whatever it is. They access internal applications, corporate applications, development applications, all in the course of doing their business. And all of those accesses need to be secured. You need to strongly authenticate. You need to authorize. You need to look at the traffic flows to make sure there's no attacks in there, there's no malware, all those sorts of things. And so Gartner rightly points out that securing all of these flows is actually the same problem. And the old world of delivering solutions in a siloed fashion, where access to the Internet is secured by your SWG, access to SaaS is secured by your CASB, access to your internal applications is secured by something else, that world of siloed solutions simply doesn't make any sense. So you need to put this stuff together into a unified security stack that can handle all of these access patterns. And it needs to be, as I said, omnipresent, delivered near the actors, if you will, applications, employees and the bad guys. So those 2 forces, I would say, really -- again, to summarize, the edge, so it's omnipresent, and the unification so that all of these capabilities can be delivered off one platform, those are, I think, the things that really play to our strengths. And then actually, Tom mentioned the greenfield. That's the -- again, you can't ignore that part of it because you look at somebody like Zscaler and there's just so much greenfield for both of us. We don't really have to be taking share from each other. But rather, we're taking share from sort of the old way of doing things. And again, that trend is just so bright lights clear.

Got it. Got it. So if we think about that competitive dynamic with someone like a Zscaler, Akamai comes into this equation, and you're talking about sort of bringing the security to the edge, bringing -- and you guys bring a massive edge, if you will. You have an extremely distributed build-out platform. I think it was 3,000 points of presence globally distributed or something in that range. But the counter argument would be, well, there's vendors like Zscaler or Palo Alto Networks who bring in the security expertise. And does Akamai really have the security chops, if you will? Do they have the go-to-market relationships? Are they talking to the right people in the organization to effectively sell a consolidated security solution, a cloud-based security solution to these enterprise customers? How do you make sure that Akamai is well positioned for that second half of the equation, that you have the security chops, that you have the right customer relationships?

Yes. I mean, certainly, one, we can leverage our existing enterprise customer relationships, whether it be for delivery, for acceleration or for what we call web security or web app firewall or Prolexic or bot management. Now you're right that it's a bit of a pivot because the buyer for the enterprise security is going to be different. But we do have very good relationships in many, many large enterprises, and that can help us pivot. I think another big piece of that is our partners. We increasingly are working with and leveraging the capabilities of channels in the go-to-market for enterprise. That's kind of how enterprise is done. And so we're committed to working with our channel partners in a channel-first pattern or model for our enterprise offerings, and that helps us scale. And it helps them benefit from this trend as well because they can do things like managed services, integration services. There's a lot of additional capabilities that they can bring to bear. And then one more, it's worth pointing out, the Asavie acquisition recently also brings that together because that is a unique capability that is offered through our carrier partners. And again, I'm not aware of anybody else having anything like this, the ability to secure access patterns off of devices that can't necessarily run a client. And it gives you this absolutely secure on-ramp from these cellular devices through the cellular network. And then you couple that with our security capabilities, that's a really nice combination. Again, that all drives through our partners, and that's where we can get scale.

Got it. One more question on the enterprise side, and then I want to shift gears a little bit. So you guys have talked about having enterprise access, enterprise network and enterprise security solutions. I think it's been about 3 years, plus or minus, that you guys have been talking about this pushing the enterprise. Any kind of update or sort of benchmarks you can give us on the relative traction of those solutions? Or sort of how far you guys have come in the past 3 years with that?

Yes. I mean, yes, growing very rapidly, still not big enough where we're going to break it out yet. We've said that we'll break it out when we get to $100 million, and we're not putting out a date out there, but we're very happy with the growth. We have -- basically, there's 2 primary products: our application access product, which is in the Zero Trust access model. And then we've got our enterprise web protector, which recently we announced now has secure web gateway capabilities as part of that product, and we're seeing early traction on that, that we're very excited about. The next thing that we're really seeing in that portfolio is a multifactor -- a push-based multifactor authentication solution that can't be phished. And this is something we -- a number of people, you might have seen some headlines recently where there was a breach, where the company that was breached was using multifactor authentication. They were using a push-based multifactor authentication, which increasingly is common because it's an easy type of multifactor authentication to use. But it's subject to -- it can be phished, and there's a whole technical explanation for why that's true. Our multifactor authentication solution that we're bringing to market, we'll be in beta later this year and then selling early next year, has new technology that makes it phish-proof. And that is, I think, really important in whatever regime you're in, especially if you're operating in a compliance regime. A phish-proof MFA is going to be very important.

Got it. And I lied. One last question on this part of the business, and maybe we could broaden this out to sort of broader security. We talked about the increased threat environment that you guys have seen with COVID. As we kind of go into 2021, taking into account the threat environment but also people's realization that this new way of working is going to persist for some time, any significant impacts on the demand trends for sort of the enterprise-like access, in particular, solutions or the broader security suite that you've taken note of, of like pre- and post-COVID, if you will?

Yes. I mean I do think, for example, it has highlighted sort of the traditional access model, VPN, being increasingly fragile and has a number of other issues that, I think, are becoming more and more apparent. So for example, in this environment where we're working from home and we're using the same device more and more for personal use and for business use, the bad guys, that's a great target for phishing because -- or other ways of getting malware on my machine because if my personal use of my machine causes me to go to a site that is producing malware, I now have malware on my machine. And it's not my personal machine. It's my work machine. So that's a very interesting target. Here's the next thing that happens is, is that I'm on the VPN into my -- well, Akamai doesn't use VPN anymore. We're doing Zero Trust obviously. But if I was on a VPN, the malware that's on my machine that I got from browsing some personal activity, that malware is now inside the corporate perimeter if I'm using a VPN. That's just a completely unacceptable regime to be operating in. One more thing is the performance implications. Generally, VPNs don't deliver great performance. Whereas our access solution, our Zero Trust access solution, not only has the security benefits in that it doesn't work in the way that I described, you're not on the corporate network so malware is not on the corporate network, it also can be combined with our performance capabilities, again, one platform, one edge platform. You combine those things, and now you can get a great user experience as well. So I do think that this environment has made it more clear that the VPN is kind of on its last legs and there's going to be -- as part of this big shift, a shift from VPN to Zero Trust as the access model.

Right. Got it. Got it. Running a little short on time, though. But I definitely want to touch base on kind of the edge opportunity. It's something that Akamai has talked about for a long time. This massive geographic expansive reach that gives you very broad edge. But now the competitive dynamic and the competitive noise about programmability on the edge or security on the edge and traditional box vendors are now edge vendors somehow, it's created a lot of FUD out there in the marketplace. Can you talk to us about how optimized edge capabilities have evolved over the past couple of years? And what are your customers asking you for? Where are they trying to pull you in terms of your edge capability? And in particular, like are they asking for that programmability to be able to sort of further distribute their applications?

Yes. It's a great question. Our edge has been programmable since about '99. If I think back on, I can remember sort of the first incarnations of that around late '99, I think it was, and certainly well into -- as we got into 2000, we had pretty mature programmable edge. And that's been sort of embedded in our offerings for all this period of time. And I think the evolution has been increasing more and more use cases from using that programmability to do bot management, to image manipulation, to video transcoding, to implementing a [ wait ] room, to implement different A/V testing. And the list goes on and on, and I think the frontier just keeps widening. With a programmable edge, as we've had for a long time, you find more and more use cases. I think probably the next really exciting use case would be programmability around messaging for IoT. There, you're in an environment where you have massive amounts of data in motion and programmability against data in motion. That's kind of our thing. We're not trying to compete with Amazon or Azure to do computing on data at rest. We're the data in motion guys, if you will. And with IoT and messaging, lots of data in motion and it makes sense to compute on that data at the edge, not centralized.

Got it. Got it. We're running up at the edge of our half-hour allotted time slot. But I want to sneak in maybe one last one. You brought up 5G before and that potentially being a really good opportunity that I think -- is 2021 should be the year, right, in terms of a much broader adoption? One, do you agree with that idea that 2021 should be a better year for 5G adoption? And maybe you could talk to us a little bit, because I don't think it's been a big part of many investors' investment thesis around Akamai, where does Akamai fit into that story? Where can you guys benefit from that?

Well, I think in a number of ways. One is simply that the more capacity you have in the last mile, the more access people have to broadband types of access, that just drives more content, more use, more traffic and that's always been good. So you can think of it in many ways as sort of like the broadband explosion that we had back in the, I guess, early 2000s that really drove some of the early demand for things like video online and shopping online and so on. This is sort of the next incarnation of that: more and more capacity at the edge. Now that does create an increasing need for this edge model because it means that the difference between capacity at the edge and capacity at the center becomes even more dramatic. So the edge model becomes even more relevant. And of course, Asavie is probably our first big example of where we're doing something where, again, our technology combined with what the partners or carriers can offer creates an exciting opportunity to provide security for these devices that are cellular and using 5G connectivity.

Got it. So actually, I lied. We have more time than I thought. We have 45 minutes, not 30 minutes, which is good because there's a huge area we haven't touched on at all as of yet. I want to switch gears back to security just for a second and talk about the broader security portfolio that you guys have. Again, you're going to -- we have you guys surpassing $1 billion run rate in security. And if we were having this conversation 3 years ago, say, investors would have said, "No way. There's no way they could do that much in security. They're in DDoS. They're in web application firewalls. Those are some pretty small markets. Maybe the markets themselves are only $1 billion. How can they do that much revenue?" Let me ask you that as a question. How can you do that much in revenue when you have such small target market? Like, where are investors getting the equation wrong?