Akamai Technologies, Inc. (AKAM) Earnings Call Transcript & Summary

Good morning, everybody. Once again, I'm Brad Zelnick, software equity research analyst here at Deutsche Bank. And for this session, my colleague, Patrick Colville and I are delighted to be joined by none other than Mr. Ed McGowan, Chief Financial Officer of Akamai. Ed, thank you so much for joining us.

Well, thanks for inviting me, Brad. Nice to see you.

Likewise. The format of this session is going to be a fireside chat. We've got a number of topics, things to go through with that, get caught up on the business and what's happening out there in the world. We also have a feature by way of technology here where the audience members can submit questions. If time permits, we will absolutely try to weave them into the conversation. But maybe just to jump right into it, Ed. As the world shifted hard to digital over the past 1.5 years, Akamai was there for all of us. So a big thank you on behalf of everyone that relied on Akamai for working or schooling from anywhere, making an online purchase or even being entertained through gaming, video, what have you. I feel like the concern for your business over the years has been competition in pricing. And even though you've always been the premium brand in the market, along these lines, I've got 2 questions. So the first, what makes you optimistic that traffic growth remains robust for the overall industry? Just as we've had richer media formats over the years, interactive games, apps that consume more bandwidth. What apps and dynamics do you see ahead that drives confidence in overall traffic growth?

Yes. Good question, Brad. So I think we went through a little bit of a CDN super cycle over the last 1.5 years or so where you had launch of major OTT properties, those 4 major launches, and then you had the pandemic. And going into it, I would have thought you see the big spike in traffic and then things sort of go back to normal. But really what it did is accelerate a trend. And you hit on pretty much everything, right? It was -- whether it was people playing video games, more multiplayer gaming going, which becomes somewhat of a social event for kids, if they can't see each other, they can get online and they can play games. That was certainly a big trend that we saw. Obviously, OTT and I'd necessarily say it was cord-cutting per se, but certainly augmentation of your viewing habits. I was expecting to see things kind of moderate a bit. Those are the big traffic drivers. Those categories, shopping and doing other things online is not as much of a traffic driver, but certainly, we saw some growth there as well. But we actually saw it set a new baseline. And I sort of see that phenomenon in every Q4, we talk about having what I call a media season where you see new devices coming online that need firmware or you see game publishers coming up with new titles that all need updates and things like that as you turn the corner into the following year. And we've seen that. And we've talked about on some of our prior calls, how we're not only seeing new peaks every quarter, but we're seeing sort of daily averages that are higher and higher and sustaining. I think we're going into more of what -- and I've said this on my call, my earnings call last quarter, more normal year, right, a more normal Internet growth year. And we didn't see that decline. So we're sort of back to kind of normal CDN growth, but I think we really accelerated a trend and we didn't see that traffic disappear. So we're pretty optimistic about that as I talk to my customers and some of the projects that they have coming into the market as they're expanding into new geographies and that sort of thing. I'm pretty confident that we'll continue to see a pretty robust traffic growth, but more in line with what a normal sort of CDN Internet growth type year is perhaps a little bit better, but not like what we saw last year, obviously.

Fair enough. And I guess it's fair to say the world isn't going backwards. A quote -- another one of your colleagues, a CFO from another company in an earlier session. He said, there's no dictionary definition, you can't open up the dictionary and find the term, de-digitize. Nobody's going backwards, right?

That's a good point. Yes.

I thought it was a good way to put it. But as we then think about the context and the environment as you see it, how should we think about Akamai's differentiation and ability to deliver a broader value proposition to customers. And thus perhaps moderate unit price compression?

Yes. So it's interesting you had mentioned at the beginning of your question, you talked about pricing the dynamics in the industry, and I've been in this industry since it started. I've been at Akamai for over 20 years. So this is not a new phenomenon for sure. It's been around forever, and I don't see that changing anytime soon. If I look at my unit economics, we've been able to maintain high margins, which is surprising if you would sort of plot out over a 20-year period with unit price, your customer pricing coming down every year, you think at some point, you're going to hit some margin pressure, but we've been able to do a pretty good job of maintaining our cost structure. And we're actually the only profitable CDN out there, too. So that's another thing to keep in mind. But part of it also has to do with, as we've -- to differentiate ourselves, we've made a lot of investments in advanced functionality, including security. And security, you do not see the same phenomenon. That is not something where you see wallet shares shrinking or customers looking to save money. One of the other trends that was accelerated during this whole pandemic or digitization, as you called it, was the security, the bad actors have just become more fierce, and we're seeing more attacks, larger attacks, different attack vectors, more ransomware attacks, all sorts of different threats out there because as you pointed -- rightly pointed out, people are doing a lot more online. There's a lot more information to steal. There's transactions, whether it's people getting into trading for the first time or shopping for the first time. So you've got a lot of folks going after all that data to try to do malicious things. So that's really helped to prop up the business. So that's a pretty key differentiator. The other thing is on the CDN front, as you start to see a big flood of traffic, the Internet starts to struggle a little bit because it wasn't built for performance. And there's only so much capacity at the core of the Internet. And one of the big differentiators with us is the way we're architected, where we're in over 4,000 locations behind those choke points mostly in carrier networks. So that gives us a performance advantage for sure. And then the other thing I would say is our international footprint. As a lot of these OTT providers start to expand outside the U.S., even though almost all of them split traffic, we tend to get a greater share as we go outside of the U.S. because it is more challenging to deliver a lot of the networks in places like India or Latin America aren't well connected. So a centralized delivery solution isn't going to work, or at least not work that well.

Got you. Want to dive into several of those topics, but maybe for starters, as it relates to security, because it is so frontal lobe for all of us. We see these breaches every day. There's so much happening. I'm actually going to turn it over to Patrick to lead us with a few questions in security, and then I'm going to jump back in afterwards. Patrick, please take it away.

Yes. Thank you so much. Yes, I mean, the security trends are fascinating. And so I would really like to double-click there. I guess, I mean, my first question, if I may, would be around the business has seen steady mid-20s growth at scale. And so clearly, you've kind of exceeded expectations from kind of years past. Just help us understand what are Akamai's aspirations in enterprise security? Probably 1 question. And then 2 parter, I guess, where is your advantage versus other players in the market?

Yes. Okay. So just to take a step back, if you think about our security business, there's really 2 components the way we think about it. Think about it as web security, which is protecting all public-facing websites, web applications. So for your firm, for example, anything you may have for your trading applications, your public-facing websites. But then there's the enterprise security side, which is more of a traditional IT. So think about it as the employees of the firm and how do you help them -- the IT professionals secure your access or your -- as your traffic is floating across your internal network or between your clouds and that sort of thing. So we think about it in 2 different pieces. So as far as the web security business, we're by far the leader there, that's over $1 billion in revenue for us. We broke out at our Analyst Day in February. You can find all that information on our website. The different growth vectors with inside of our web security business, I think we're most known for denial of service and web application firewall. But there's other products that we have in that space that are growing very fast, like bot management, for example. Most of the traffic on the Internet today isn't human, it's machine. So giving our customers the ability to understand what machines are interacting with them at scale, to be able to block certain attacks. A lot of attacks we see now are machines that come with stolen information and do what's called credential stuffing. So being able to block that, application layer, denial of service attacks. You can imagine if you're launching a commerce site or a new OTT offering, there's going to be somebody out there that's going to want to knock you offline or potentially defame the site. So just our size and scale, certainly scale from any sort of an attack that we see. We're very unique. We block the attacks where they emanate from. We don't bring them into a central location. That's exactly what you wouldn't want to do. You could flood an entire data center, entire telco or even a small country with some of the size of the attacks that we see. So that's one big differentiator for us. The other is just the data and the information that we see. We see trillions of DNS queries a day. If you think about DNS, that's the gateway to the Internet. So just the breadth of information and data, the data scientists we have, the investment that we're pouring into security really makes us very differentiated in the web security side. And I think people have underestimated the size of these markets. And we've shared some TAMs for what we think the application security market in the fraud prevention market and infrastructure security side of the houses and they're fairly large TAMs. And I think folks have underestimated them. The other thing that we have going for us is we're very innovative. And we're seeing, as certain attack vectors start to firm up and we firm up some of those attack vectors, we see the bad actors coming in different ways. For example, with our Kona Site Defender product, where we're protecting your base page. A lot of websites have a lot of third-party content or third-party links on their site. And we were starting to see some of our customers get attacked where there would be malicious code embedded in some of those third-party links. So being able to block those attacks. We're coming out with a new product that just went into beta called Audience Hijacking, that's becoming another problem that some of our customers are facing. So I'd say innovation is also another key differentiator for us. And as I shift over to the enterprise security side, this is where I get a lot of questions from investors as to why you? What is the CDN going to do to be able to help in enterprise and IT professional with all the security challenges that they have? You're not a traditional vendor. You're going up against big guys like Palo Alto or Zscaler. If you think about the challenge that the IT professionals have and I think the pandemic accelerated it, you've got the applications are leaving the building. A lot of applications are now going to a cloud. They're not no longer just in a centralized data center. And the users are leaving the building, people are working remotely. So now if you think about people trying to access applications from far away, where applications are now sitting in the cloud, there's a lot of different threat vectors you need to think about. And one of the big challenges that, and where we, I think we can add tremendous value is around performance. So if you're doing something like secure web gateway where you're filtering traffic and you're looking at traffic going through across your enterprise. If you're doing that in a handful of locations and you've got users that are far away, that's going to cause some serious performance challenges. And one of the things that you worry about is the employees will opt out of that security posture and try to find a way of not using that because it's just too slow or it has a big performance challenge. Also the data that we see. So if you see traffic that's leaving an enterprise, think of traffic coming into an enterprise or leaving an enterprise, we know where a lot of the malicious actors are. We've got some story where one of our customers had infected HVAC systems. Where we were actually seeing that the HVAC system was actually communicating out of the organization, which might be okay because they might be trying to control temperature, say if you're a retailer, but the data was going to unknown botnet. So we're able to know that because we see all this stuff on the Internet on a daily basis. So that does give us a bit of a differentiation when it comes to that environment as well.

Yes. I appreciate that. And thank you for the comprehensive answer. I mean you touched on Audience Hijacking Protection, which actually was kind of my next question. So I'd love to kind of double-click there. The Page Integrity Manager is about a year old, and then the Audience Hijacking Protection is, I guess, the new beta product there. Can you just help us frame what the typical dollar uplift is for a security customer that takes these incremental offerings? And then I guess, conceptualizing kind of what's the pipeline looking like for these tools?

Yes. Great question. So obviously, Audience Hijacking is brand new. It's beta, so it's hard to tell at this point what the uptake will be. But it is something that the product [indiscernible] by customers, so it is a big challenge for them. So it would be a derivative of [ what should ] defender product -- and we broke out in our application security, our app and API protection business and fraud prevention was about a $650 million business last year, growing at about 30%. And there's -- we also disclosed some TAMs of what we think those 2 businesses are by 2025 in terms of total addressable market, about $12 billion in total. And if I think about Page Integrity Manager, it's a derivative of Kona Site Defender. So typically, a Kona Site Defender customer has used Kona and they've got a lot of third-party links on their site. Most web pages certainly have third-party content, not every application does. But -- so it's a derivative of a Kona Site Defender market, adds to that overall TAM. We are seeing very good uplift. It's still small. We haven't broken it out yet. We tend to break out products when they get to be about $100 million in run rate. And we'll do that certainly when we get there with Page Integrity Manager, Bot Manager was -- we just talked about it on our last call, that's up to $200 million and growing at about 40%, about 800 customers. So great uptick there. So hopefully, we see the same kind of uptick. We're seeing certainly a very, very strong early adoption of Page Integrity Manager. And it makes a lot of sense. It's a very easy add-on sale for our sales reps. And if you think about sort of how you expand the market, I might start off with your firm and say, let's protect the main web page and say your highest traffic site application. And then I spread out and get more and more applications and then I start to add more and more functionality. And we do that across all of our different verticals. So early days for Page Integrity Manager going pretty well. Audience Hijacking, it's a little too early to tell, but it would be similar to what we would see with the Page Integrity Manager in terms of uplift.

And I guess I mean the final one on security, if I may, is around -- I mean kind of complex question. I guess, WAF and DDoS have -- were traditionally thought as small markets, but Akamai has continued to grow pretty nicely. I could argue in that domain, like well in excess of market rates. So do you think if we have this conversation in like 3 years' time, 2024, do you think and we look back, do you think the outperformance or continued performance in security will come from those core segments, WAF and DDoS just continuing to be bigger than many of us expect. Or do you think actually the security business, the kind of kicker in security will be capturing share in access control from the likes of Zscaler and Palo Alto and I guess, security incumbents?

Yes. Good question. I would say, obviously, we think -- we expect the core's web security business to continue to grow. And mainly, it's because of what I -- we were just talking about, where there's new threat vectors that come into play, and we've expanded the TAM by adding new functionality. So I'm sure when we sit down and talk in 12 or 18 months, there'll be something new. There'll be a new avenue that the bad guys are coming in at, and we'll have some new add-on feature to sort of the web application firewall sort of protecting the web application space. You are getting to the law of large numbers. I mean, we're up to, call it, $1.3 billion run rate for our entire security business and over $1 billion in that area that from a percentage perspective, I would imagine that that's not growing as quickly as it is now 5 years from now, but it's still a franchise that's growing because I don't see the threat landscape changing. And it's not something that you -- you block this -- if you use a web application firewall, you're not going to throw it out and just say, well, the bad guys aren't coming this way. They're going to -- I'm safe, I can go, move on to something else. You open that door, someone is going to try to come right through it. We saw that actually with our Prolexic DDoS service. That's a service that has been around for a long time. It hadn't seen a lot of those volumetric ransomware attacks and all of a sudden last year, they popped up again and that business grew at about 17% last year, our network security business. So I'd say the biggest component of growth and the potential big upside for Akamai is in the enterprise security, the IT security side. I wouldn't say it's so much as taking share from Zscaler. I see sort of Zscaler is the first entrant that's really sort of modernizing the way folks think about enterprise security and really leveraging Zero Trust. I know there's a lot of other players that are coming into that market. A lot of them have to defend territory that they already have. They're probably the incumbent that has on-premise gear. So they're trying to replicate what we have, a distributed network, more intelligent about what's going on in the Internet. And we've got that advantage going for us. And that's a market and so there's a lot of research out there that shows that's a multi, multi tens of billion dollar market. And there's room for many players in there. And if you think about some of the stuff we talked about earlier with some of the performance challenges, multi-tenancy, all those things, a lot of these incumbent on-premise providers are going to have to figure that out. And that thing, we got a pretty early lead on that.

Great. Thank you so much. I'm just going to hand the mic back to Brad.

Thanks Patrick. And I want to shift the conversation over to edge computing. You've had some competitors out there focused on edge computing or serverless computing opportunities at the edge. And Akamai has had edge workers in this market, I think, for the last couple of years. Just a handful of related questions. From your perspective, where are we in terms of market maturity and demand for this type of capability? And why shouldn't I be surprised by your disclosure earlier this year that this generated, I think, about $150 million in revenue in 2020 and that you expect 30% plus growth in the next 3 to 5 years?

Yes. It's something that we hadn't broken out for a long time and a lot of -- I guess, when you poke the bear, the bear responds, everybody was saying, edge computing, edge computing, edge computing. And so we took a step back and said, let's take an honest look at what are some things that we're doing that are more edge computing-like and let's start to break it out. Actually, it was helpful in the sense that we're able to look at some of our customer interactions and realized that there are a lot of things they were doing. We're building them on just simply pushing traffic, but there was an awful lot of compute, some of the API management or personalization or any other things like that, that we're now starting to charge differently. We're looking at it as the alternative as you go to a central cloud and they're going to charge you based on CPU utilization, some notion of that. And we're also starting to hear an awful lot from our customers about alternative use cases. And I actually think about us, one of the big challenges we have is we acquire certain companies, a lot of them start off by leveraging some of these third-party clouds, right, the big players, the AWSs, Googles, et cetera. And that becomes really expensive. And also you have some performance challenges. It's much -- what I'm hearing from our customers is saying, listen, I'm looking for an alternative, I'm spending an awful lot. My cost is starting to run away from me. And I've got a lot more challenges with lower latency applications. And I want to do it cheaper. And so we're taking a lot of the stuff that we're using in the third-party cloud for developing that functionality in-house and bringing it in. And now we're looking and saying, can we build a business out of this? Are there certain workloads that we can take on and do ourselves. And we're seeing things like our EdgeKV, key value store, right, this notion of distributed data and being able to process data real time, do it quickly, cheaply. Examples would be like user profiles or language translations, customer security rules, storing TLS footprints, that sort of stuff. All that stuff is things that customers are looking to offload on to us, and we're doing some of the same stuff ourselves. So Edge workers has been a pretty good product for us. You saw, obviously, there was a nice bump we got from an application for waiting room for vaccines. Think about the challenge of everybody rushing to a website to try to sign up for a vaccine. And you could use that for anything, for tickets, for you name it. This notion of being able to give the user a good experience of knowing, okay, I'm here in the queue. I'm not going to crash the site or the database or anything like that, but I'm here in the queue and I can see myself moving through the line. But that's all done compute at the edge. If you think about some of the trends like Internet of Things, you've got thousands and billions of devices out there. And if you want to get real-time information and do it quickly and do it cheaply, we're a pretty good alternative for that to be able to do that sort of processing at the edge. And we're pretty optimistic this is a growing business, and we're hearing more and more from our customers of how can we take advantage of your footprint. You obviously -- you guys are great at building network can -- what other opportunities are there for. So we decided to finally break it out and it's, I think, a pretty exciting area for folks. And I'd be interested to see from you if you've seen other customers break it out. I know a lot of people talk about it, but I haven't seen any good examples of how big the other players are in the market in this business.

It's been actually a little while since I've attempted to do that myself, but agree. I haven't found any disclosure out there that breaks it out with any sort of integrity. So complements to you for helping to create some transparency and visibility to what's clearly a very exciting opportunity for Akamai as well as others. But along those lines, I mean we've got a lot of things to talk about, you know what, we can come back to the edge another time. Maybe if I could, I always like to check in with you, Ed, just on how you're thinking about network capacity across the overall industry as well as Akamai specifically and related the pricing dynamic and if in any way, it's changing from what the patterns we've seen over the years?

Yes. So we obviously went through a big cycle. We had talked about increasing CapEx in 2019 for the anticipation of the big OTT launches and then the pandemic hit, and we're glad we actually did that because we took on an enormous amount of traffic literally overnight. In 2 weeks, we just saw traffic explode, and you saw that in the sort of -- especially in Q2 of last year here in our results. And you saw double-digit growth in media, which you haven't seen in years. And that's at scale, too. I mean that's a meaningful business for us. So we're talking some significant numbers. I've talked about CapEx now starting to moderate a bit and talked about more of a normal year, and we're doing a lot of things from an efficiency standpoint to be able to reduce our CapEx. and I guided for 16% for the rest of the year. And if you look at -- do the math, you'll see Q4 in order to fit that in is a little bit lower. So we're hopeful to drive down CapEx to a more meaning -- more historical level, if not a little bit below that. And remember, you keep going to think of CapEx is in 3 buckets. There's the network CapEx which tends to run, call it, 8% to 10%. There's the capitalized software, which is around 7%, and then there's just G&A, which tends to be, call it, 1% in a normal year for IT and things like that. It's really that network CapEx is really where the focus is. And where I think people should think about in terms of efficiency of the network is really looking at that number. That was in running sort of the mid teens low, call it, 14% to 16%, bringing that down to be around 10% this year, and hopefully, we can drive it down a bit more. As far as pricing goes, really pretty much routine. I don't see anything there that's really unusual. Market's pretty efficient for the high-volume stuff for sure. You put an RFP out. Everybody splits traffic these days. So you're going to get prices based on whatever volume you're asking for, they are all going to be within a percentage point or 2 of each other.

Thank you. Helpful...

Brad seems to be frozen. So I'll keep going.

Sure.

Yes. I guess, I mean one of the things is international markets, I mean that was a big growth driver in recent years. Can you just talk about that trends in the international markets? And I guess where you're -- where you see greatest opportunities and probably where you're investing the most?

Sure. Yes. That's obviously -- if you look at our competitive landscape, most of our competitors, certainly for the traditional CDN business are here in the United States and growing internationally is challenging. Really, there's 2 things. You need to be able to make sure you have the infrastructure and the network outside the U.S. because generally speaking, that's where most of their customers are. So you need to make the investments in your network. And then the other big thing and the real challenge is finding the right people and making that investment and getting the right sales leadership, building out the support, having local language support, 24/7, all that stuff. And we've done a really good job there and our growth has been very significant. But just talk last quarter about 45% of our business is coming from outside the U.S., which is a significant portion of our business. And I'm always amazed as I look every quarter at where we're seeing growth and seeing a lot of growth coming from Asia, but also across Western Europe. We're seeing still pretty strong growth in Western Europe and Latin America is an area that we're seeing very fast growth. We did an acquisition of a distributor several years ago, and that's really starting to pay off for us. We're starting to see pretty significant growth down there. There's not as much competition outside the U.S. from a CDM perspective. There's some small niche players in certain countries. And then as far as our competitors here, it is a challenge, and you do need to make some significant investments. So we made a lot of investments in go-to-market several years ago and obviously make network investments all the time. So I think that's one of the big key advantages for us. And we're starting to see broad adoption of our security portfolio sweep across the globe. Obviously, the early adopters were here in the U.S., Western Europe, certain parts of Asia, but now it's starting to go everywhere.

Yes. That's helpful. I think we're running out of time. So just -- I guess, just one final to close out. A question we got over e-mail is around should Akamai spin out the Security business? Like is -- could that realize more value for the combined entity? And like our investors under appreciating, I guess, the security business in its current form?

Yes. That's something that one of the things I tried to do at the Analyst Day was to break out in great detail, all the different components of our security business and our CDN business, our Edge Computing business. and then provide relative profitability models for folks so that they could do with some of the parts if they wanted to do that. Obviously, if you look at the way our Security business trades relative if it was a stand-alone relative to what's out there in the market, that business will be worth more than the entire firm, right? If you've got a business growing mid-20s, $1.3 billion profitable, Look at some of the comps that are out there that are 1/3 of the size or half the size that are trading at $30 billion, $40 billion. So the challenge that we have, though, it's that part of the business, the web security business isn't separable that when I'm applying the WAF, the web application firewall rules, I'm doing at the same time I'm doing the delivery. It's running on the same platform, it's leveraging the same code, that if you were to go and try to break out the business, you'd create a tremendous amount of dissynergy and it really wouldn't make sense. So I think that's why there's a discount. We don't get the credit there. The access control or the enterprise business isn't at a scale yet where separating it would make a lot of sense, but that is something down the road we could consider. Obviously, it leverages our platform in a number of ways, but that is something that is a bit more separable, but it's just not at the scale yet.

Yes. Ed McGowan, thank you so much. I mean it's been a fascinating chat, particularly enjoyed the conversation about security. So on behalf of Brad and myself and the team at DB. Thank you so much for taking the time.

Well, thanks a lot, Patrick. Great to see you, and really appreciate the conversation. Take care. Have a great weekend.

Thank you. Bye-bye.