Akamai Technologies, Inc. (AKAM) Earnings Call Transcript & Summary

Thank you. Okay. Good afternoon, everyone, and welcome to the conference. I am Mark Murphy, software analyst with JPMorgan, and it is a great pleasure to be here with Dr. Tom Leighton, who is CEO of Akamai. Tom, thank you so much. It really means a lot to us to have you here.

Nice to be here.

Maybe what you could do is just for the benefit -- Akamai has been around a long time. It's a large company, and I think most of the audience is familiar, but just for the benefit of anyone who might not be familiar or might not be current, could you give us the 1 or 2 minute overview of the company?

Yes, sure. We operate the world's most distributed cloud platform. We're not the largest cloud company, obviously, with the hyperscalers, but we do have the best content delivery services, the best web security capabilities, and we're growing a very interesting cloud computing capability that is the most distributed and performs better because you can run your compute instances closer to users and the devices and the data at a much lower cost than you would have with the hyperscalers. Today, Akamai's leading business is security. That's where most of our revenue is. Obviously, we won a very large content delivery business. That's where we started the company over 25 years ago. And compute is very fast growing. Today, 2/3 of our revenue is security, and compute in the last quarter grew over 20% year-over-year. So very exciting prospects for the future.

Yes. Those have been resounding successes. Tom, if we think back to when Akamai got its start, clearly, it was in the delivery business. You're the market leader in that business. As you just described, the business has evolved tremendously, and you now have -- security is the largest component as well as compute. And at some level, all those segments are interrelated and then they're all connected through your global network. Can you maybe help us to stitch together the pieces so that we can try to understand what the synergies are between those segments?

Yes. So the delivery and the security businesses are very synergistic. So when a request comes in from one of our customers, say you want to check your bank account, you want to buy something, you want to watch something or play a game, as that request is coming in, we're making sure it's really you accessing your bank account, because maybe it's a thief who stole your credentials. If it's a bot, we want to know what kind of bot it is so we can deliver the right response. Then we go and get -- or if we don't have, get the content that it is that you want to see and deliver it to you. And the content will change based on who you are, what your interactions with the site or app have been. If you're a bot, what kind of bot. So the content is actually tailored on the fly to give you the best possible and most secure experience. And so that means that our security products, a lot of them, are very tightly interwoven with our delivery products, and it creates great synergy, very cost effective and great performance. So it's not like we have to dish off the request somewhere else to apply security, which some companies do, and then come back and then try to deliver it. Before you know it, it's a terrible experience.

So I think you touched on this in your -- in the intro, but you have thousands of points of presence, and these are all spread out across the globe in strategic locations. The number of PoPs that you have is, we believe, is multiples of other competitors. So it's a remarkable scale. Is that a component of this business that structurally is an enduring type of a competitive advantage? And can you help us understand what is the kind of differentiated experience that that's going to enable versus some other provider that doesn't have as many points of presence?

Yes. So we operate over 4,000 points of presence in 750 cities, 130 countries. We are inside well over 1,000 networks. Not peering, inside those networks, which means that pretty much wherever you are on the planet, if you're going to one of our customer sites or apps, you get a very fast connection to Akamai. We direct you to the server that is right near you, and that makes for a very fast experience. In addition, it's a great first line of defense for security, because if you're trying to do something bad -- you wouldn't do that, but if there is somebody trying to do something bad, we will intercept that malicious traffic locally long before it gets to the target or even in the country of the target, never mind the data center where it could swamp the target. So you get great defense and depth with security. And increasingly, we're doing compute close to the end user. Now for a long time, we've operated JavaScript as a service at this edge platform. So in these 4,000 locations, we'll spin up JavaScript apps in 5 milliseconds in a serverless way based on end user demand. Now what we're in the process of doing is taking our edge, our computing, containers, VMs, Kubernetes, and migrating that. We want this year to be in 100 cities by the end of the year. Nobody does that. And over time, that will grow. And by getting compute instances closer to the end user and really at the edge, again, you get a better performance and better scalability. We can also do it at much lower cost.

So that's very helpful. And I want to come back to a couple of those aspects that you touched on, including the edge and the Gecko vision. But before we do that, Tom, I do think we should spend upfront some material time on the security business. The -- you have these very deep capabilities, and they're embedded and interwoven across the platform. The -- you've had quite an investment posture on the security side. It's been organic -- it's been a combination of organic and inorganic, excuse me. And the -- we also know -- I mean, I'm sure everyone in the audience knows, security spending is seeing prioritization, right? And that's a function of how intense the threat landscape has been. Thank you for giving our audience the benefit of the doubt that they're not bad actors out there, by the way. But so what is the differentiated role that Akamai brings to the table in security? Can we peel back the layers of the onion a little bit deeper on that and maybe just help us understand the longer-term vision?

Yes. So our goal is to protect enterprise applications and data, and we do that today in 3 tiers or layers of products. The first is protecting the enterprise from denial-of-service attacks. And that typically is at Layer 3 and 4. It's intercepting the traffic that is designed to swap out a critical resource, like DNS. If you take out the DNS for an enterprise, they're offline, or swamp a particular application or a particular server. And so we intercept that traffic in special scrubbing centers and in our 4,000 PoPs long before it gets to the data center. And we have the market-leading capabilities to do that. The next layer of defense is at the border between the enterprise and users. The users can be consumers or they could be partners of the business. And this typically works at Layer 7. And so we're trying to stop the injection of malware, the exploitation of vulnerabilities. This is where the bot management capability comes into play. This is where we do special things when somebody logs into a bank account or a commerce account to make sure it's really you and not somebody that stole your credentials. It's where we stop site scraping, site corruption, theft of data, and again, with the market-leading solutions. It's a marketplace that, in the cloud, we started web app firewall as a cloud service. We started bot management. And today, we're the market leader, and this is the majority of our security revenue is in this layer. And then the final layer of defense, which is now the fastest growing is inside the enterprise. Today, the problem is that you could buy everybody's solutions, everybody, and malware is still getting it. And GenAI is going to make that worse. The key really is to identify it when it gets in and to proactively block it from spreading. Malware is not so bad when it first gets in. Ransomware, if it gets into a server, who cares. The problem is it then spreads from there laterally to lock everything down. If your data exfiltration malware gets into your HVAC system, that's not a problem yet. It's a problem when it uses that as the base to go collect all your data and exfiltrate it. And then you got a big problem. And so there's where you need a segmentation solution to prevent the spread of the malware and to identify and tell you that it's there. And we have the market-leading solution for that with Guardicore, and we just recently put that on the same agent and same pane of glass control panel as our Zero Trust Network Access. So now we combine north-south and east-west, which is unique in the marketplace.

Yes. And that's the Akamai Guardicore platform, right?

Right.

And I want to come back -- I want to try to understand that a little better in just a moment, but just to clarify one comment that you made there, because you said generative AI is going to make the whole problem worse. I mean is it implicit in that? I assume you mean that the LLMs are going to be creating malware, [indiscernible] malware and all this. Do you think that that's going to happen faster than it's able to -- we're able to use the GenAI on the other side to...

It already has.

Okay.

Yes. Now you can train really nasty malware very quickly, and you don't have to be really skilled to do it. GenAI can help with QA. We use GenAI in our new human interface to the Guardicore platform, so you can do human language queries to find out what's going on in your infrastructure, what applications you have there, what an application is and what it does. Does it have the most recent firewall rules? So it's useful on the defense, but it's much more enabling now for the attackers.

So coming -- you mentioned segmentation. You mentioned that your security business is growing faster inside the enterprise than outside. And I think the first part of that you mentioned was segmentation. You have this very strong product called Guardicore, very healthy momentum. You landed one of the top telcos in the U.S. You landed a supermarket chain of more than 1,500 stores and then a major software company in Latin America. And that, I believe, it was all in Q1. What is driving the success of Guardicore? And when we think about the success there, has that kind of whet your appetite to -- or upped your confidence to say this is a good way to go, to maybe buy a security company of that size, that scale, that profile, and leverage it well.

If you get the right company and the right product, and we were fortunate because I think you go back a few years, and I think micro segmentation was not well understood or appreciated in the marketplace. And we felt it was going to be the important thing to have. And it is working out in that direction because it is really the best defense against ransomware and data exfiltration malware, and Guardicore has the best solution. Now at the time, they weren't recognized as #1, but we like them the best, and now they are recognized as the best defense.

So when we think about -- just a very quick question on your go-to-market and how you're able to drive the rapid absorption that you have seen with Guardicore and then even on the API side. The -- our understanding is that there's a bit of a unique dynamic in the security market where sometimes, for this very complex enterprise level of security, the buyers actually want to take that -- they want to absorb it through a channel. And we -- the -- these companies that will come up are Optiv, and you'll get CDW and Carahsoft and Insight and all that. Is this something that's active for you as well? Or is Akamai able to say, we already have the direct relationship with these customers. There's no need for them to go through a channel.

No, channel Is increasingly important for us. Guardicore in particular is channel-only. API security, we're making investments there. That will be largely channel. So yes, and security channel partners are very important for us.

So let's talk for a moment then on the Zero Trust side, you -- the more companies move into a cloud environment, the more they're going to be prioritizing that as an architectural advantage for them. The -- one of the questions we commonly hear from investors is that, well, you have some pretty big, pretty strong, pretty established players there, right? And they will commonly mention companies like Zscaler and Palo Alto and others. Can you help us understand, on the Zero Trust side, what is it that's differentiating Akamai? And why is that a logical adjacency for you?

Yes. So well, we have the best solution for segmentation, best way to stop ransomware and data exfiltration malware. So that's a big advantage for us. We've now combined that with our -- the Akamai Guardicore platform, as we talked about, with Zero Trust Network Access. There, we had a very competitive solution, so we would compete with ZPA, and we've now merged them. So you get north-south, east-west on the same pane of glass and agent, combined it with MFA, DNS protection and threat hunting, and that's a unique offer in the marketplace. So I think gives us a very strong leg up against the competition when it comes to protecting the applications. So we don't solve every security problem, but if you want to stop what we think are the big ones, we have the best capabilities.

And I'm wondering if that helped lead to this win that you had, one that certainly got our attention in the recent quarter, which was with the U.S. Army. And you talked about the Zero Trust and battlefield networks, and the comment was that it was a competitive evaluation of more than 40 vendors. So we would have to think -- and then the certifications that you would need and the validation you're going to get as a result, we would have to think that every security company probably wanted to win that piece of business. Can you walk us through how exactly did that transpire? What was it that you enabled to win that business? And I don't know if there's any comments or any way that we can think about the revenue implications of a big win like that.

Yes, the revenue is important for us. So it was a substantial win and there's, I think, upside down the road. We have had very successful businesses with the Defense Department and the government in the U.S. and in other countries. I think we have a very strong reputation for very high levels of security and reliability in our products, and I think that was very helpful. And of course, then when it comes to these solutions, they are the best at doing the job.

So then let's go back, because you mentioned it just a moment ago, the Akamai Guardicore platform is something newer that you're talking about. And I think you mentioned -- so there's micro segmentation, there's network access, there's firewall, there's threat hunting. I think you even mentioned a couple of other elements of that. It's going into a single console. It sounds like it's going into a single pane of glass. Is that a pretty big engineering effort in -- is that a marker for Akamai reaching a point where you're saying, we don't just have a couple of items on the menu, we sort of have everything, and so it's now it's time to put that in one single console?

Yes, it's not everything, but it's the key things, what we think are the key things. And not just on one console, but one agent. Because before, they were developed differently as products and you had different agents, and that's a very expensive real estate. And so to be able to go to the customer and say, okay, just one agent covers you. You can now apply your business logic across north-south and east-west. That's very compelling and customers have wanted that, and it did take time to do. We've been working on that over the last couple of years and now live and in the market and very positive reception from customer.

So one agent is going to be less taxing on all the other resources that a customer has.