Akamai Technologies, Inc. (AKAM) Earnings Call Transcript & Summary

All right. Well, welcome back, everyone. For those of you kind of surfing the web or streaming some of your favorite apps right now, perhaps you're securely logging into your corporate network right now, you're probably using Akamai maybe. We have the great honor today of actually having Co-Founder and CEO, Tom Leighton, with us from Akamai for this next session. And we're joined by one of my favorite IR teams in Tom Barth and Rick Eskelsen. Welcome, guys, and thanks for joining us.

Thanks very much for having us today.

Honor is ours.

So Akamai has had a major journey really over the last decade, now really having become both a delivery and a security company all in one. But just to start on the delivery side, Akamai has the advantage of seeing just a large amount of Internet traffic, Tom, be it across media or web. I guess how has Internet traffic been this year relative to what we saw during the pandemic and even pre-pandemic? And are you seeing a more rapid shift towards digital channels, like streaming, than you expected, including -- it seemed like you guys had really good trends out of the Olympics and EuroCup these past couple of months.

Yes, great question. Last year, obviously, huge increases in traffic associated with the pandemic. This year, I would say, strong increases in traffic, pretty close to a normal year, maybe a little bit less given that last year was so extraordinary. And we expect normal growth from here. Obviously, a lot of use for streaming and e-gaming. Both segments, generally speaking, very strong. I think a lot of growth in the future still to be had there. And of course, we deliver a very large share of that traffic. I'd say the growth rates are pretty much within expectation and adoption of streaming as you're doing your video, watching the sporting events, live events. By and large, I'd say, pretty normal.

Got it. And on the travel and hospitality side of the business, clearly impacted last year. Have you seen stability or even growth at this point in web delivery traffic? And one big thing that I think people are missing is this zero overage model. I guess how have the early zero overage renewal has been going so far?

Yes. No, good question. The good news with the renewals is that we're getting the renewals. The churn is very, very low, and that's great for the business. I would say, underneath that, there's a dynamic that a lot of our customers that buy our products, like Ion, the web performance, the acceleration products, they have been impacted by COVID. So you've got -- most of our commerce customers had big brick-and-mortar operations, so they were negatively impacted. Travel and hospitality, I think, are still pretty heavily impacted as their businesses. Now they need us more than ever because there's more use of the digital channel for them, but their financial situation has been hurt by the pandemic. And they account for more than half the revenue for our web performance products. So the dynamic in renewal is that there's lower pricing for the web performance products, and in some cases, lower revenue there. At the same time, they have increasing need for our security products, and so we'll be selling those products into those customers. So the bottom line for a typical customer is revenue will go up overall for the customer. The breakdown, the split between the performance product revenue might actually decline. The security revenue, very likely to be growing. And so that's sort of the dynamic we're seeing in that customer base right now.

Yes. And just rounding up the delivery side, we have had a few of your competitors bring up that they're now directly interconnected with providers. Some are starting to get to 100 or more POPs, really, with their stance being if they are close to kind of the Internet exchange points, they can address 80%, 90% of the population there and can provide a good performance at a lower cost than Akamai. I guess how are you feeling about your competitive moat in delivery? And what's giving Akamai the competitive edge in specifically just the delivery space right now with some of these developments from some of your competitors?

Yes. I think you got to look at that and really understand what they're saying and what the reality is. Okay, 100 POPs that they're trying to get to. Akamai has 4,000 POPs, and that makes a big difference. Now they're trying to get closer to the Internet exchange points, and that means they're trying to get, peering through those points with the -- which are the most congested places in the Internet. Akamai is inside 1,500 networks, inside, not peering, and that makes a big difference in performance. Next, you got to look at the claims about somehow they have lower cost, simply not true because those points they're trying to deploy in are the most expensive places for colo and power in the world. You can't pay more than to be there. When Akamai is in those 1,500 networks, the large majority of the time, it's free for us because those carriers want us, those ISPs want us in their network. Now you can see this is true when you look at our economics versus theirs. We are a very profitable business. The CDM side of the house is very profitable. And those competing companies, they're big enough today that if they really had any reasonable cost structure, they would be profitable and have -- and very good margins, and they don't, and they're not going to as they grow in that model. And so it's just -- it's not true. It's a story, and you got to look deeper to see what the reality is. And that is one of the reasons why Akamai has such a strong market share and we are the go-to provider for pretty much all the world's major companies that need content delivery. Now on top of that, you got all our security solutions, which the competition just doesn't have anything comparable. And the fact that we can offer or protect and perform packages, where you get it all in one bundle, and you get it as just even part of the same transaction. A client goes to a website, wants a fast, reliable experience, and the owner of the website wants it to be secure. That all happens in the same transaction, the bits that, as they pass through our edge platform, are being accelerated and being secured at the same time by the same server. And you look at the competitors, and they -- maybe some of them have some security offering, but it's totally disjointed. And that results in making an even worse performance and also just nowhere as near the level of security you need. And so I think that explains why Akamai, not only is so competitive, but has such much stronger financials.

So speaking of security, that's a perfect segue to where I wanted to move. I think moving over to the part you're most excited about with Akamai in the security piece and really starting on that core security portfolio that we think of for Akamai, so Kona, Prolexic. And actually, I put Bot Manager now with the success you've had there at about, I think, a $200 million ARR business. I guess what percentage of the business do these solutions really represent for you? How much new opportunity actually is out there for what's left to kind of migrate to the cloud from an on-prem solution?

The overall security products are nearing 40% of overall revenue. And of course, that share is growing because the security products last quarter grew at 25% year-over-year, so incredibly strong growth. We have 5 product lines in security, one of which is services, and 4 product lines, all now at over $100 million a year run rate annually and all -- last -- in the last year growing in double-digits. Now the 3 product categories you called out are the 3 largest, all growing at a very good clip. We are the market leader, by far, in all 3 of those categories, and there is plenty of room for cross-sell and upsell in our base. The majority of our customers buy just one security product, and so that gives us a lot of opportunity to sell the other products that they don't have today and that they need. And so that's a reason why all the product lines are growing at a very good clip today.

But does the shift towards more cloud apps and the infrastructure itself really change the demand environment in your favor at all?

Well, I think so. You'll see less and less being done on-prem. And in fact, I'd say the model for things like application firewall -- web app firewall used to be all done on-prem. And today, we have largely displaced that with our Kona solution. And so now it's a services model with our shared platform. Bot Manager, I would say, didn't really exist before with Akamai. You can still -- you can buy boxes and operate them on-prem to try to do bot management, but most companies much prefer Akamai's solution. DDoS prevention, there, you could buy boxes that do that, but just -- it doesn't work for any large-scale attack because you can't afford the pipe into your data center to withstand a large attack, so it never gets to your DDoS box. They get bought. And that's, again, Akamai has a huge advantage there. With our edge platform, we can absorb the largest attacks, and we're the only company that can absorb and defend against the largest attacks out there. And you saw that with the wave of ransom DDoS attacks in the past year, drove a lot of enterprises to Akamai, where they've been doing something different before. And the more there's adoption of the cloud, that is good for Akamai because we are the leading cloud provider for security services.

And then maybe on the newer products with access control, right, newer products, for those that are unfamiliar, like Secure Web Gateway. Page Integrity Manager seems to be off to a great start, Multi-Factor Authentication. And that's really part of your Zero Trust and SASE kind of architecture in the future here at Akamai. First, Tom, how should we think about Akamai's role in Zero Trust and how win rates really been against other competitors out there, like Zscaler, Cloudflare, Palo, who seem to be a little bit louder in the market with their kind of SASE and Zero Trust offerings?

Right. I think when it comes to application access, we're the strongest player there. We give access on a per-app basis for an employee working for an enterprise. The traditional approach is network layer access. And of course, that's a disaster today because the device -- the employee device can easily be infected with malware, and you authenticate it to give it network access, and then the malware spreads. And that's a big problem. At the app layer, the device never gets direct access to the network. Everything comes through us, and we filter it. And so for Enterprise Application Access, I think we have the best capabilities today. For Secure Web Gateway, that's a relatively new capability for us. And I would say we're catching up there against -- probably Zscaler, you would say. As for Swig is probably the -- has been the leader there. For the DNS protections, there, I'd say we have the leading capability. And that keeps data from being exfiltrated from enterprises, keeps internal devices from going to dangerous places. Multi-Factor Authentication, just a brand-new capability there. You would think of that as like -- works like Duo would work, and they're clearly a market leader, but has the advantage that it's secure against the man-in-the-middle attacks, which is going to make a big difference going forward. It's compliance -- compliant with the latest standards there. I think, as you look forward, we're continuing to invest in more capabilities to stop ransomware attacks, to stop malware attacks and data exfiltration. Already, if you look at the headlines out there, the ransomware attacks, I think most all of those are existing product suite stops. In fact, with the Microsoft Exchange server hack, Akamai IT, our internal IT department was running that for our e-mail services. We had the vulnerable software like thousands of other companies. But because we were using our own Enterprise Application Access software, that product kept us from being hacked because it doesn't let the end user directly get in touch with the application. It runs through our security services. And therefore, they couldn't exploit the hack, which makes a big difference.

I think that's quite a statement when you're -- I'll say, I think I'm stealing from Tom Barth where -- eating your own dog food to protect your own environment, right?

Yes.

But just to follow up on sort of the SASE piece, one of the pushbacks we get is that the SASE strategy here at Akamai still has holes in it, whether it be cloud access security broker, DLP, browser isolation and actually SD-WAN. So I guess, in your view, Tom, in looking at these subcategories to really round out the SASE architecture, how are you guys looking to address these kind of holes? Is it partnerships, build, buy? And with Akamai really owning a network really, why not also provide the connectivity or SD-WAN part as more of a holistic solution than competitors like Zscaler?

Yes, great question. And nobody out there sells all those things or at least they're not having leading capabilities in all those areas. Typically, a company will be strong in 1 or 2. They might have nascent capabilities in some of the others or a partner. In our case, we are really focused on access, stopping malware, stopping ransomware, stopping data exfiltration because that's -- I think that's where the action really is, basically stopping the headlines. Now you need all those things you listed, but not all those things are core to stopping the really bad things that are happening out there. We do have a lightweight CASB capability, a lightweight DLP capability. You'll probably see us partner or work with other companies for heavyweight capabilities there. I think to have a full defense, you probably want a very strong CASB, each of those things, probably really strong ultimately to be in a perfect state. To stop the headlines and stay out of the headlines, I don't think you need all that. And so where we're focused on is having what you need to not let the malware in, to not let it spread, to not let it get stuff out or the ransomware kind of capability. And it's an area of continued investment for us.

So speaking of investment, you guys did a decent restructuring at the beginning of the year in terms of really the go-to-market and the division. So I think it's almost 2/3 of your edge delivery customers buy a security solution today. But what have been the biggest changes for the security go-to-market over the last 9 months? And what's left to do?

Well, now we have a unified sales force, and we are very focused on cross-selling and upselling. And as you noted, about 2/3 of our customers buy a security product. But for most of our customers, they are buying just one today, and that's a terrific opportunity to get them to buy the others. And as I mentioned before, that's a reason why all of our product lines in security are in double-digit growth. And the solutions all work very well together, very efficient, which is great to see. And they work well with our performance products. Usually, you buy these security solutions, and they crush your performance to the point where a lot of companies, they buy a WAF, and they don't even have it on -- in block mode or deny mode. It's just an alert mode. Because as they turn it on, it kills their performance. Where at Akamai, heck, if you bought our WAF, your performance improves. And that's just an amazing capability that we have. So yes, I think there's a great opportunity to upsell, and that's what our sales force is focused on. I would say 80% plus of the deals, especially the new customers today, are led by security. There are some geos where emerging parts of the world where we might lead with CDN, but I would say most of the established areas for the field force today, leading now with security sales.

So you and Ed and the team outlined growth and profitability objectives here earlier in the year at the Analyst Day. But one thing I was kind of curious about, with such a big opportunity on the security side and kind of your positioning overall and security margins being, I think, mid-30s, if I remember right, I guess why not take security margins down with more sales and marketing investments to really further grab the market as it's really come to you?

Yes. And I think we will be continuing to invest in security. We're investing, I would say, pretty heavily today, especially on the enterprise access side, because that is such a large potential market. And I think you'll see us continue to do that. To take margins down, it's not impossible through an acquisition. You could see margins tick down in a noticeable way, a point or 2. You can't really find security companies to buy that have anything like our margins. And so if you bought one, that's not just a tiny tech tuck-in. That could dent margins for a year or so, and that may happen. It's a tough market for M&A right now in security, but we're always looking. And you should expect us to see us to continue to invest for growth. In the long run, we're interested in very strong bottom line growth, and that needs good top line growth and strong margins. And so we really care about both.

And a lot of the success on the security business has been into -- like selling into the web delivery customers historically, and we've really started accelerating into media. I guess how does the contract and sales process then change as you start selling into more of that media installed base where customers are huge, let's face it? And really, what solutions are you leading with in this vertical?

Well, big media customers are big buyers of our security services because they have big brands they got to protect and lots of users they got to protect. And these days, your video subscriptions, your gaming accounts are -- always people are trying to hack in there. And so they are big buyers of bot management and our DDoS services and our application firewall services. Now they're such big delivery customers that the security portion of the deal would be a small portion of the overall deal, but big media is among our largest buyers of security service. I would say financial services, obviously, another big buyer of security services for the obvious reasons.

So moving on to probably the next decade as we think about Akamai and Edge Workers, and Edge Workers is really an exciting part to a lot of investors here. So amazingly, you called out really the move from public cloud workloads to actually Edge Workers this last quarter probably a lot sooner than I would have anticipated than others. Have you noticed increased interest in the edge applications business from large customers? Or are you still seeing a majority of workloads really flow from less business critical applications at this point?

No. I would say what would flow to our platform is business-critical applications where performance matters or instant scalability matters. Less critical stuff is just -- that will stay in the cloud because you don't care about performance. You don't have big scalability issues, and you don't need an edge platform. But if you need low latency and good performance and you need scalability, that's where the edge platform makes a big difference. And that's what we see those applications coming to Akamai. A great example are the vaccine registration websites where you have scalability challenges, and you need good performance. You need queuing applications built on top of that, and that's perfect for our edge platform. And that's why we support those sites for dozens of governments and health agencies around the world.

So what's going to differentiate you in the space? And who would you even come across? Or is it really just all greenfield opportunity as customers are like, hey, can we use your edge network here to run this application?

Yes. I'd say that's greenfield. Obviously, the compute is being done somewhere. Maybe it's mostly being probably done in-house. Some is being done in the cloud. But I would say that's greenfield, and we're differentiated by our edge platform at a very low latency, very close to the end user, great scalability, built in, obviously, load balancing capability. Performance also for spinning up the application is very strong, a few milliseconds. And you go to the big cloud providers, that could be 1,000x slower, just to spin up the app. And we're doing that over 5 billion times a day now. So that's why customers will come to Akamai. Also, it just works in conjunction with your overall front-end content delivery acceleration and security. It all fits together as one service, so very natural to want to do that on our edge platform.

I did want to circle back to actually the media delivery business. I guess multisourcing was a big headwind last decade to Akamai that pioneered the CDN space. It wasn't necessarily DIY that was part of the multi-sourcing strategy, right? But are we through the multisourcing headwind, in your view? And how do you feel about the potential DIY efforts you're starting to see from media customers again? Like it does seem like Disney is starting to pick up their own CDN a little bit more.

I would say that's been a normal situation, steady state and has been, well, for several years, and I expect it to sort of stay that way. So there is multisourcing. Many providers use multiple CDNs. Often, they'll have a dominant CDN and then a few that have a small share they can use maybe as a backup of some kind. Quite often, generally speaking, Akamai is the dominant provider. And the biggest ones also have a DIY capability, and they will -- usually, when they have it, they will also multisource with Akamai. There's a couple that really do it all themselves, but that's not the norm in the business.

Got it. And Q2 kind of was an interesting time for the space overall where you had a couple of outages across, not just Akamai, but multiple of your competitors actually. So from your -- from Akamai's business standpoint, were there any lasting customer impacts from the outages that were experienced in Q2? Have they been resolved in Q3?

Yes. So first, it's good to understand that the competitive situations you're probably referring to were total platform outages, which is a serious thing. The issues that Akamai had impacted about 1% to 2% of our traffic, so a very small segment of the business. Now of course, anything like that, we work very hard to avoid. And we have a lot of procedures put in place that we're continuing to strengthen to prevent even something that impacts 1% to 2%. So we take it incredibly seriously, and we're known as a very reliable provider. And I think even if you look at the stats, even this summer, we're still well ahead of the competition in terms of reliability and no meaningful financial impact.

Got it. So I guess we're coming up on time here, and we're about 9.5 months into this year, but what are you most excited about looking to next year in 2022?

Well, we're seeing great growth in the edge applications business and in our security business as a whole, and it's really exciting to see all 5 product lines in security in double-digit growth and our strong and improving market leadership in areas, such as web app firewall, bot management and DDoS prevention. The analyst community is pretty unanimous that we're the market leader, by far, and improving the capabilities there. And then the new service is being built on top. Page Integrity Manager are off to a very good start. I'm really excited about Audience Hijacking Protection that is now entering beta. I think that has a lot of value for a wide segment of our customer base. And then we talked about enterprise access, enterprise security and Zero Trust, which I think has huge potential value for us, and we're investing heavily in that area. So I think the collection there is very exciting for Akamai.

Awesome. That's all really great details from you, Tom. And thank you to your company for supporting the Internet over the last 18 months, especially with the pandemic, and really appreciate your time and all the extra info here. So thanks again.

Thanks very much.

And for the record, Fish, I said caviar, not dog food, just to be clear.

Caviar. Got it.

All right. Have a great day, everyone. Stay healthy.