Akamai Technologies, Inc. (AKAM) Earnings Call Transcript & Summary

[Audio Gap] with us day 2 of Citi's Global TMT Conference. I'm Fatima Boolani. I am the resident software -- infrastructure software analyst here. I jointly run the software research team here. And I am absolutely thrilled to be sharing the stage and hosting Ed McGowan, CFO of Akamai. Thank you for being here.

Well, thank you for having us. Very happy to be here. Been a great conference so far.

Terrific. I hope we fed you and day was productive.

It was very productive. Yes.

Excellent. I like to hear it. So look, I think we have a lot of ground to cover, so I'm going to jump right in. Ed, I want to talk to you about kind of the state of business at large. Certainly, I want to drill into the 3 principal areas that you're kind of driving growth and driving efficiencies and things like that. But just at the highest level, just kind of wanted to get kind of a state of the union about the business from you, and then we could take it from there.

Sure. Yes. I mean obviously, we have 3 businesses, our legacy CDM business, our security business and our compute business. And there are all obviously at different stages of growth and sort of evolution, if you will. The delivery business is obviously very challenged at the moment. Internet traffic in general is -- growth has been very, very weak this year, which is -- I've been in the business for 25 years, and I've never seen a year where Internet traffic hasn't been growing at least 30%. So this is quite anomalous to see such a lack of growth on the Internet. So that's obviously challenging the business. 51% of our business now comes from security. Security has been an amazing business for us. It's now about a $2 billion run rate business, been growing in the teens, but a great growing business for us. A lot of exciting stuff going on in security, a lot of investment going into security. And so that business continues to do well. Obviously, there's -- that threat landscape continues to evolve, change, get more difficult. With AI coming along, it's going to become even more challenging for our customers. So there's a lot of great opportunity in security. I'm thrilled that we made the decision to pivot to security 10 or 11 years ago. And it's been just a home run for us. And then there's the compute business, which we have always been in the edge compute business. With the acquisition of Linode, we're getting into more traditional compute and starting to compete with some of the hyperscalers options that are out there now. That business is doing phenomenally well. We have a line item we call our enterprise compute, which is where we poured a lot of investment dollars into. We talked about hitting a $50 million run rate. We expect that to be $100 million or more as we exit the year. So that's going phenomenally well. So it's just the early days of our compute growth. We think, obviously, a huge market, we think that can be a significant leg up in terms of growth of the overall company in the future.

I appreciate that, Ed. Just let's start with the delivery business, and we'll peel back the onion on this. So you talked about, hey, traffic growth has been in a very anemic state. Based on what you've seen and you see a lot of the Internet activity, right? When do you think some of these trends that you're talking about that are weighing, when will the traffic trends specifically do you think will bottom out?

It's really hard to say. I mean if you think -- if you look at the kind of traffic growth on the Internet or traffic on the Internet, the biggest sources of traffic, obviously, streaming video, software downloads, gaming downloads tend to be the largest source of traffic. And each one of those has some interesting dynamics. Gaming several years ago was a massive source of growth for us where you had the introduction of the multiplayer gaming with Fortnite and some other me toos that came along the way. So that was a nice big growth driver. It's coincided with the pandemic, which obviously people are spending a lot more time just in general on the Internet. We haven't seen a year, last 2 years for gaming that has been particularly strong. It's been fairly weak. I don't know what the main driver of that is. It can be sometimes some of the titles that come out aren't as popular as titles in the past. Obviously, the size and frequency of the updates has a big impact on the business as well. And then with streaming, obviously, streaming several years ago, there was 6 big streaming platforms that were introduced. And that drove a tremendous amount of traffic growth and growth on the Internet in general. We had a writers' strike not too long ago. So I think that might have something to do with the fact that there's not as much new content. I think that's going to start to evolve and change over time. And also just the subscriber growth in technology over the years, whether it's 5G or just broadband to the home, that's kind of largely played out. So you don't see new countries coming online like you did with India several years ago when Reliance came in with the big 5G network and affordable phones and data plans. We saw massive growth in India for several years, and that sort of has leveled off. So I'm not quite sure what it is that's going to be the catalyst. It could be any change in terms of viewership, people watching, maybe satellite goes away, and you have to turn to the Internet or there's some direct-to-consumer offerings or maybe a new social networking platform like when TikTok came along or something like that. But there's going to be some catalyst that's going to drive Internet growth. I'm just not sure what that is or when that is going to happen. But certainly, over the 30-plus years of the Internet, there's been those catalysts from time to time.

You kind of helpfully broke down the traffic estate, if you will, for us, right? It's streaming media, it's social media, it's gaming. Any other types of traffic that are kind of on the up and up? And then within those 3 types of traffic, where has there been maybe most pressure? And how would you frame kind of the structural versus transient dynamics for kind of each of those traffic types because at some point, we're going to have more gaming hits come out, right? So that should help. Any framing on that?

Yes. So it's interesting. One -- and this sort of informed one of our decisions to go in a different direction, but one of the fastest-growing traffic sources on the Internet is API traffic. Now it's not a lot of bits, so it doesn't drive your CDN business, but it did inform us or help inform us with our decision to buy Noname Security, get into the API security business because that is a growing -- every modern application uses APIs. It's a growing threat factor. So that is obviously a good trend for the security business, but not necessarily the CDM business. In terms of the dynamics in the business, obviously, there's two when it comes to CDN. One is traffic growth, the other one is pricing.

Right.

So we're starting to see some pricing normalization in line with what you see for traffic growth. It does take a while for that to sort of play out. But if a customer is coming to me saying, "Hey, look, my traffic is going to double next year." Maybe I'm increasing my bit rates or I'm launching in 5 new countries or whatever, they're going to get a much better unit economic answer out of me than if their traffic is flat or declining or growing at 5%. So that dynamic will play itself out. There's fewer competitors in the market. There was a couple of large-scale players that exited the market last year. So there's always going to be healthy competition, but there's not anything I would call out from that perspective in terms of our business. I think if you look across the industry, most of us are experiencing the same thing. So it's not that there's big traffic shifts so in terms of like macro trends. It's not a big shift of traffic going from one provider to another. It's just a dearth of traffic growth.

You did call out a specific social media customer who's changed their traffic patterns for business reasons. I'd love for you to give us a recap on this behavioral change, how that's been creating a downward pressure of sorts in your delivery franchise, and how should we think about sort of the worst-case scenario? Because I think there's some elements of DIY traffic that you talked about, some in-sourcing. So again, how much of that would be maybe idiosyncratic to the social media customer versus hey, is this a general trend that we might see bleed into other types of traffic carriers that DIY is starting to become a bigger issue or bigger challenge?

Yes. No, it's a good question, and I get this question a lot. This is stuff that we've seen over time. The customers that will optimize for their traffic. Going back years ago, you see some social media sites that have the auto start for video where you just go to a site and the video is automatically playing. Customers over time will sometimes shut that off, and you realize that you know what, that's driving a tremendous amount of traffic, and maybe people aren't actually watching it. It's just because the site pops up, it drives that. So you see things like that. With the case of this particular customer, they were doing something called prefetching, which would be loading your cache with a certain amount of video. Obviously, everyone, at some point, abandons their session. So you serve some bits that you don't get a chance to monetize. So optimizing that formula between the performance gains you get by prefetching versus the cost, this particular customer was looking at that for the first time. DIY is another thing. DIY, do it yourself. It's funny, I tried to name all of the customers around the planet that have their own CDNs, and I can only come up with about 12. So it's not a phenomenon that is prevalent, and it's not something that makes a lot of sense. You need to be at a pretty massive scale. You're talking to Google, Facebooks, Netflix, Disneys of the world that will have their own CDNs because they have enough traffic that the economics can start to make some sense. Obviously, if traffic is not growing, it becomes challenging for them as well because their labor costs are going up, they're not getting the same type of efficiency with bandwidth in terms of their buying power, et cetera. But that's something that is very isolated, but it does tend to be with the biggest customers. So if I look at my biggest 1% customers, most of them have had their own CDNs for a long time. Generally speaking, there's only a handful that have -- do pretty much everything themselves. Most folks that do have their own CDNs do want to have 2 or 3 public CDNs in the mix just makes sense, for redundancy, for performance reasons, cost reasons, et cetera. So in this particular case, it was just a shift from doing some optimizations for cost and then just shifting a little bit more than they had planned at the beginning of the year to themselves. But we've largely caught that. We've baked that into our guidance. It's playing out exactly as we had expected.

Are there any considerations with respect to some regulatory changes that could maybe create some tail risk around this particular customer spending patterns? And how should we brace for that?

Yes. Great question. As a matter of fact, in our 10-K, we did put in a disclosure that we were not required to do it. It wasn't material enough, but we decided it was prudent to do it. I want to let investors know if the particular site is banned in the U.S., which there is some talk that may happen, whether -- who knows what happens in the court systems? That would be about a $50 million, 1.5% hit to us. So we have disclosed that so folks know if that does happen, what the potential risk is. You can handicap it yourself in terms of does the government actually have the capability to ban that? Seems like a stretch to me, but who knows? You never know how that stuff...

That's a fun statistical probability exercise, right? Any other patterns of behavior from this particular customer? I think you brought up this whole notion of multi-CDN-ing. I think that's become maybe a little bit more pervasive than it was in years past. So would you say this particular customer or frankly, this notion of multi-CDN-ing, is that a pretty contained dynamic? Because ultimately, you might be in a situation where you are sharing more of your traffic with a smaller set of competitors but sharing your traffic nonetheless. So how much should we be thinking about that as a potential sustained negative input from a quantity of traffic on your platform perspective?

Yes. Good question. So it's -- multi-CDN has been around for as long as I've been in the industry, 24 years. So it's not a new phenomenon. Typically, when you see the pattern, we generally see is you get someone who either starts off with one and then introduces another. And then you get the folks that get into the ridiculous where they might bring in 6 CDNs. And whenever they do that, they always go back down to a manageable group because now you're managing 5 or 6 different vendors with different platforms, different reporting. You have to negotiate 6 different contracts. You end up hiring a team to manage your vendor relationships, which makes no sense at all. So it generally tends to normalize down to 2 or 3. Typically, it's either do it yourself with 2 or maybe you have 2 if you're just using public CDNs. But in terms of what's impacted us this year, the shifts of that haven't really had any material impact, good or bad.

Fair enough. So we talked a lot about the Q side of the equation. Let's start by the P side of the equation, which is pricing, and you did allude to it earlier. I think you've been very deliberate in some of the steps you've taken to exercise more pricing discipline. And I'd love for the benefit of the audience for you to itemize kind of some of the things you've done. But that's not necessarily shown up or manifested in shoring up your delivery growth rates, right? It's equally as important a part of how the delivery trajectory trends. But just the itemization of some of the very discrete things you've done on the pricing side to drive better unit economics, but then also kind of giving us a flavor of, well, why hasn't that -- those really -- those good efforts, why have they not been showing up in the numbers?

Yes, sure. So there's really sort of 2 motions. One is just getting the price declines to align with the traffic growth. So if you're somebody who historically has been growing 30, 40, 50, even doubling, you tend to get much higher unit economic rates when your contract comes up for renewal. If you're not growing or it's 5% or 10%, we're going to obviously dramatically reduce the type of rate declines. That takes 18 to 24 months to kind of play out across the entire customer base. Obviously, the bigger customers, you'll see it a little bit more immediately, but it's still going down. So if I do -- even if I get something, a 5% or 10% break in traffic, if they're not growing, their revenue drops 4%, 5% or 10%, obviously, the next quarter. So the other thing we're doing is with a certain class of traffic, and it's usually your big software and gaming customers, you tend to have a ratio between the spike in traffic to the day-to-day traffic. So let's say, for example, somebody wants to get a software update out to 100 million people, and the file size is a few gigabits -- gigabytes, excuse me.

Is this a certain fruit-based company?

Well, not necessarily. So there's a number of -- there's a handful of them, both in gaming and in software. But they want to do that in 36 hours or 24 hours. That drives an enormous peak on your network. And the peak is the most expensive thing to build out for. So the balance between how much you get day-to-day, what the unit economics are and how much of a ratio you allow somebody to peak is probably the biggest economic decision you can make in terms of the bottom line. And there, what we were finding is, in some cases, customers might have 4 or 5 CDNs, but put those days when the peaks came, we were taking the bulk of it. We decided to push back on that. We've dramatically dropped our CapEx in the CDN business. That's probably the best outcome from that. And now the customers are either extending the period of time to get the downloads out, shifting the load between some. And we walked away from some business as well. If we can't get the right equation there, we'll turn some of that business away, which is not -- it doesn't make a lot of sense for us to take that, especially as the delivery business isn't growing.

You talked about API traffic earlier and maybe changing your position on how you monetize that traffic. What have been the specific steps you've taken to drive more discrete and discretely better pricing behavior for API traffic? Because I think you've talked historically about it being maybe more computationally intensive, even the volumes are lower.

Yes. So typically, you find that with different types of web traffic in general. So you might have like, say, a shopping cart, for example, it requires a bit more CPU because it's different for everybody. And the techniques you use to accelerate something like a shopping cart is very different than cashing a download that everybody gets. So with that comes some advanced features, and we do tend to get much higher unit economics from a per bit rate. It's not as price sensitive in terms of the unit economics. Generally speaking, those contracts are smaller in terms of -- they're not your multimillion-dollar contracts, but they can be $1 million or $2 million or whatever, but it's not the big 1% type customer. So there's not as much sensitivity around that. But you do find ways of monetizing. Sometimes you can charge by the hits. So you're looking at a different metric. It's not necessarily bits that are being served, it's more of the type of -- the amount of time that your servers are being utilized, so hits that go to the network versus the bits. So there's a number of different products that we sell, and we monetize traffic differently across the platform.

And just the last framing on this. Internationally, when you think about some of the monetization potential from a delivery standpoint, is there a lot of arbitrage to be had from a pricing perspective versus the U.S.? And that question just stems from, hey, your international business generally has been performing much better than your U.S. business.

Yes. I think there's a couple of things there. One, yes, there is areas of the world that are more expensive. So you do tend to price premium certain areas of delivery, and that could be for international and U.S. traffic. It's more where is the traffic going to? So I could have a U.S. customer serving in, say, the Middle East or Latin America or Southeast Asia, where it's more expensive, so you might get a premium for that. Also, just from a competitive landscape outside the U.S., we don't have as many pure-play competitors pushing the CDN business. Where we found that the investments we've made in go-to-market in our support organization and our SE organization and having that local expertise, you know with security, it makes a big difference so that you are able to get more market share but also get a bit more of a premium as well.

And just to kind of round out the conversation on delivery, I'll have you take out your crystal ball now and ask you, delivery has kind of been struggling kind of the double-digit declining ZIP code. How do we get a pass back to a lesser rate of decline and frankly, stabilization? What are some of the factors and variables that need to unfold favorably for that to transpire?

Yes, obviously, the fastest way is traffic growth, and we see something that the catalyst that drives significant traffic that will happen much faster. I'm not -- I don't see that today. I don't know when that's going to happen. But at some point, there'll be something that drives traffic growth, and that will be the fastest path back. The pricing takes a while to kind of normalize itself through because you've got thousands of customers that are going through that pricing dynamic. So that will take a little bit longer to take effect. But it's really just -- once you start to see traffic even grow several percentage points would be helpful in terms of from where we are today. Competition, maybe there's some disruption in the market and some competitors exit that can obviously move some share. That could be obviously helpful if that were to happen. Obviously, you don't count on that or depend on that, but that is another thing that could happen. I'd be watching the sequential declines in CDN because you obviously have to anniversary. We've had some pretty big declines over the first couple of quarters. But as you get to the back half of the year, maybe you start to see something -- back half of next year if we start to stabilize there as you get back to that level.

And conversely, what are sort of some of the risks that could actually stunt this recovery, right? Like what is the potential downside risk for actually delivery to kind of continue to bump along at the.

Yes. I mean it could be traffic declining if usage on the Internet were to go down. I mean unlikely that happens, but it's possible. More regulatory issues that we have seen from time to time if a regulatory body comes in and bans a certain type of traffic. Probably not a huge risk there. Any kind of meaningful shift to DIY. I don't see the economic reason for that to happen, but that can also cause some disruption, where you maybe for several quarters, you might be back at that kind of double-digit decline. But it'd have to be something like that, that would drive it.

Okay. Fair enough. Shifting gears to compute. I want to start with compute. It's small, but it's mighty. So about 10% of your business today, right?

15%, if you take the full compute.

15%, the full compute, yes. So about 15% of your business today. What has been the principal drivers behind this sort of catapulting from kind of nonexistent literally 2 years ago to 15% of the business?

Yes. Like I said, we've always been in kind of the edge compute business. We've always had a storage business. It was small, $50 million, et cetera. And for the edge computing or Functions as a Service, think about that as doing some compute for websites and web properties like doing an A/B test for advertising or maybe setting up a waiting room for someone who's selling tickets where you can run that sort of this JavaScript or that type of code on your network to offload your customers from having to do it themselves. You get a premium for that. It was a nice business. Some of the image optimization and video optimization we would do that would be compute intensive, you could sell separately. But that was sort of a limited market growing, but not a huge market. When we bought Linode, that entered us into the opportunity to really go after the big multi-hundred billion dollar compute business. So now if you want to build and run your commerce stack, you can do that on us. If you want to run your encoding and transcoding, you can do that on us instead of using the hyperscaler. So we decided to get into that business for 2 reasons. Number one, we had a few customers approach us and said, "What I can get from the hyperscalers today isn't going to work. I need to be massively distributed. Can I run this code in your network on -- in multiple locations?" We end up doing a couple of custom things for a few customers. And we started to see that, that was becoming a bit of a path that people are coming to us asking us to do more than just Functions as a Service, more traditional compute. And we saw the opportunity with the Linode acquisition to get into that business, had a platform that wasn't designed for enterprise but had all of the things that we wanted: self-service ability, it had a lot of the functionality, had stuff that all SMBs were doing with them that our enterprise customers wanted to do. We obviously have to harden the platform, make it more resilient, add locations, capacity, different types of capabilities and comply with certain compliance standards like PCI, et cetera. So we went on a 2-year journey to do that. But also the other reason was we were spending a fortune with the hyperscale. And we were finding that, especially as security was growing, the need for compute to do all the analytics around, is this a machine or a human? What type of machine? What type of human? Is it the right human? All that kind of stuff was requiring a lot of CPU and compute. So that we said, you know what, that cost is growing much faster than the business is growing. It's starting to show up in our gross margin. We should be doing this in house. So we took the Linode platform, we moved most of that spend, almost about 2/3 of that is done now. We'll be done by early next year, moving everything onto that platform. So we're our first "$100 million customer", although we don't record any revenue for it but with the size and scale of that. So we had the cost savings and also the push from the customers. Now what's really exciting is the enterprise compute, as we call it, which is someone who could go to an AWS or Google or an Azure or an OCI and buy from them, they're now buying from us. That business has ramped up to about a $50 million run rate business as of last quarter. We expect it to be over $100 million by the end of this year, growing incredibly quickly. And we're seeing great participation geographically from our reps and our customers across the globe. We initially thought this was going to be primarily coming from the media customers. We -- big customers of ours, very cost conscious that had kind of pushed us initially into the compute business to begin with. What we're finding now is, yes, we're making traction there, but we're getting traction across many verticals, many different use cases, things like observability, ad targeting, ad decisioning or seeing compliance, data localization folks that are looking at saving money on egress fees, a lot of storage use cases. We're seeing even in financial services, complying with certain low latency requirements with certain payment applications and things like that. So that business is growing very, very, very quickly. It's a massive opportunity for us. And I think it's something that a lot of people have been very skeptical that we'd be able to make any kind of a dent.

On that notion, I think there's definitely -- it feels like a David versus Goliath dynamic within compute, AWS, Azure or Google, maybe more of the household names now for enterprises. What is -- how are you ringing the doorbell? And how is the door being opened for you? Because you've been a relatively new entrant in the market.

Yes. So obviously, we've got relationships with a lot of customers. If you think about the spend for CDN, I mean, there's no magic formula, but we've got customers that might be spending $1 with CDN are spending $10 to $20 on compute. So the opportunity just within our installed base is in the tens of billions of dollars. Now I think people wrongly think it's a zero-sum game, meaning it's a binary switch where I say, I'm going to use Akamai or I'm going to use a hyperscaler. Now when somebody use a hyperscaler, and I'm going to use Akamai, right? So we've been able to, in some cases, win new workloads or win workloads from an AWS or an Azure or Google because it's cheaper, it performs better, the multi-cloud phenomenon was already going on. So it's not something unique, and we're trying to force an industry that has been single source to think about going with multi providers. If you just look at what happened with the whole CrowdStrike outage and the fact that people had single sourced and say, "You know what, I've got too much reliance on one particular vendor." We came from a world of multi-CDN. So we understand that world that people are going to look for other providers so that you don't have an issue with one, and it knocks you completely offline. So we're finding that, we are coexisting in this world. In some cases, people are coming to us to save money. Some people just want to use a competitor or a competitive offering for someone who doesn't compete with them. We have a lot of media companies that have some of the rights that they have for a year gets stolen from them by some of these big hyperscalers that they're funding some of that ability to be able to compete with them. So I'd say it's relying on some relationships that we've had for years. And also, we're finding a lot of the growth is coming from new customers to Akamai that have never bought from us, verticals that we're traditionally not strong in. So the growth is pretty ubiquitous across existing, new, across different verticals, use cases, much healthier base of business in the first $50 million to $100 million that we had initially expected.

If you just looked at the cross-section of your compute customers, would you suggest that it's a much more diversified base than, say, just your delivery customers? And is it acting as an opportunity or a conduit for more new logos to engage with you? And ultimately, is it helping your new customer acquisition velocity?

Yes, absolutely. Yes. So I would say today, it's pretty similar in terms of the diverse...

The demographics, yes.

But I'd say there are some verticals that today we traditionally don't sell into that spend a fortune in not only compute but also in security. So things like Guardicore and API Security, where it's not -- doesn't have to be a CDN adjacent. So between those products and compute does open up the opportunity for a lot of new business for us, and we are seeing that. With Guardicore, most of their growth is coming from new customers to Akamai, they've never been Akamai customers. And we're starting to see a bit of that with compute. And we'll make some shifts in our go-to-market, and we'll make some investments in our channel as well as with our direct hunting force because the ROI is there. It makes sense to go after some of these verticals that traditionally aren't big web properties but spend a tremendous amount of money on compute and security.

You said 2 things, and I want to try to link them. You said the connected cloud is -- derives 10x to 20x more value to a customer versus a CDN dollar, right?

Well, they're spending more.

They're spending more, right. But in the same breath, you said you're better, cheaper, faster than the hyperscalers, right? So just from a pricing standpoint and how you're competing in the market, how can -- how are you achieving both those -- what appear to be sort of opposing objectives. You're cheaper, but you're still able to extract 10x to 20x the value.

Yes. I mean, first of all, there's a well-established market for compute. And despite the fact that there's 3 major competitors, anyone who's purchased from them know that you really don't start to see any kind of meaningful discounts until you get to a really big spend amount. I mean you could be spending $10 million or $15 million, and the discounts aren't all that interesting. But you're spending hundreds or $1 billion, you start to get into some pretty interesting numbers there. So there's an enormous profit pool in that business today. We also have a lot of synergy that we bring with our -- we moved about 1,000 people out of our delivery business into compute that have done a lot of that engineering work, the build-out, the support of running a distributed platform. The same people that are building the CDN are building the compute platform. It's a very transferable skill. We're leveraging our existing sales force today. We haven't made a huge investment in go-to-market. I don't think we need to. Like I said, we'll shift some dollars from pockets and put more dollars towards compute, but it won't be a dramatic increase in our overall spend. So there's some natural synergies that we're getting out of that. Also, if you think about one of the big profit pools that we can disrupt for virtually nothing is this egress profit pool. So as people access their data and pull data out of the hyperscalers, they pay an egress fee, which is very expensive. We deliver hundreds of terabits per second. We've got one of the biggest backbones in the world, and we've connected that to all of our sites. So for me to deliver the traffic that someone was paying for egress doesn't cost me anything. So I can offer that for free and make my margin in other areas. We are -- I think our list prices are roughly half of what the hyperscalers are. If you go to the website, you can see that and with still an enormous margin there. And it's just been one of those markets that's been sort of ripe for disruption, and there's enormous profits there that I think we can go in and create a good value for our customers and still drive very attractive economics.

And I'm jumping a little bit, but you've been very disciplined about your CapEx and network CapEx. And you talked about driving a lot more efficiency within that base. Where is your comfort level vis-a-vis what the network capacity is in being able to support outsized growth in the compute business? I mean you're tracking mid-20s today. And it seems like there is a clear path to kind of at least continue that trajectory, maybe even improve it given the profit pool opportunity you talked about. But just from a capital intensity perspective, is that going to require a step up? Or can we think about it as, hey, all that build-out you did a couple of years ago for the big streaming media launches, you're actually repurposing a heck of a lot of that capacity towards these higher value and better monetized -- monetization outcomes?

Yes. So I'll break it in 2 pieces. The CDN side, we've dramatically lowered that to low single digits. You'll always have some growth in your uncertain regions and things like that. And there's some amount of the network you want to replace every year for economic reasons. You have some old servers that may have been in the network for 10 years, and you get better throughput with the newer machines and things like that. So there's always some small 1% or 2% kind of numbers in terms of replacements and things like that, but it's not a wholesale replacement. So that -- we've driven that down to a very sustainable level here. Now if we see a massive growth in traffic, obviously, they'll tick up with similar revenue. On the compute side, we actually took our guidance up and didn't take our CapEx. So we do have extra capacity to sell today as we grow from that enterprise compute going from [ $50 million to $100 million to $2 billion to $3 billion to $5 billion to $1 billion, ] I think the CapEx can stay in sort of the ranges that we are now kind of 15% to 18%, 19% of total business. Remember, half of that is R&D CapEx, but somewhere in that range probably gets you to that sort of first $1 billion. I think in any year, if I get a big opportunity where a customer comes to me and says, "I want to move $100 million worth of spend, and I want to do it in a couple of data centers concentrated into a few." I may have to take CapEx up a bit there, but you do have additional revenue that goes along with it. I think people also have kind of probably misunderstood that a bit and thought, well, if I look at the hyperscalers, they're out buying land, these massive data centers, sometimes building their own chip sets and power, that's way down the road. If we ever get to that point, that's a high-class problem we have. Right now, you can build a nice profitable business the way we're doing it today by getting into some of these lease facilities, 5, 10 megawatts, expandable to 30 to 50 megawatts. Once you get above that, you're a couple of billion dollars, maybe the CapEx trajectory changes at that time but as does the whole growth of the company at that point.

So steady as she goes for CapEx right now.

Steady as she goes for now, yes. And obviously, if we have big deals to announce, we'll talk about them. And if they're needle moving and they need to move the CapEx a bit, we'll put it in context for you so you understand, hey, we may need to go up 1% or 2% because we signed X or Y that's going to add to the numbers we already gave you. But kind of steady as she goes. It's somewhere in that range.

I want to move to the security franchise. There is so much interesting momentum, such a spectrum of capabilities in here. Can you talk to us about the powerhouse solutions within the security franchise? And then conversely, some of the areas where maybe you've been around for a very long time and maybe we've seen maybe some more plateauing or maturing growth because I think there is an element of hey, you've got rockstar products that are growing really fast and then you've got older, more mature products.

Correct. Yes. So if you think about the business, I'll break it into 2 pieces. There's the web or CDN adjacent security products, and then there's more traditional enterprise security products. I'll talk about the web stuff first. There, you have your web application firewall, your bot management, your denial of service protection, Page Integrity Manager. That business has been around for 10-plus years.

And that constitutes roughly?

That's the majority of the revenue. That's probably 2/3 of the revenue, 3/4 of the revenue. That business has been growing 15%, 20% on for the last 5 years plus. It was in a mid- to high 20s for a while, that's kind of down in the teens now. WAF is by far the biggest piece of that. Denial of service has been probably around the longest. That is a low single-digit kind of growing business. Occasionally, you may have a tax for things like what we saw with KillNet in the health care industry where you get a burst of business for 6 to 12 months. And that might get to kind of high single, low double digits for a year or something. The WAF business has been probably outperformed everybody's expectations. People say, how big can that business be? It's over $1 billion today. It's been growing at very healthy growth rates, very high penetration rate in the installed base. We tend to skew towards the top of the pyramid in terms of the biggest web properties. So we have the biggest applications and web properties in the world. That is inevitably going to slow down. Bot management was a capability we added that was a great, very fast grower. That's starting to get to maturity. So that's going to slow down a bit as well. Then -- so from that perspective, I would expect web side, the bigger businesses to slow a bit. But the enterprise business, the Guardicore micro segmentation business growing incredibly fast. That's reached over $100 million. That was growing at -- last time we broke it out several quarters ago, we said we had eclipsed the $100 million run rate. It was at the time growing 60% a year. There's enormous opportunity there beyond just our existing customer base as we talked about. That is going to continue to grow dramatically for the next several years. And as it gets larger, it will become a bigger contributor to the overall growth. API Security, which kind of fits both because you have web applications that have APIs, but you also have a lot of non applications. So I'm going to put it in that family, even though we will see a very high attach rate for our web security business to our WAF business, that by -- we're the market leader there with Noname Security now. That was about a $40 million business. Some analysts have pegged that at $1 billion to $3 billion over the next 5 to 10 years. So that can be a very, very big business for us over time. And again, that reaches beyond the traditional security customer and into every enterprise in the world. We also have our secure web gateway, multifactor authentication and our access -- remote access product that the Guardicore team has now embedded into the control plan that they have. Guardicore, of course, you know have one pane of glass that you can set policy for all of that. So we're starting to see some drag along growth with that. But that's where the future growth is in that area. We're seeing some really good traction there, big markets, potentially market-leading products. So over time as this web business slows down, that business will pick up. And hopefully, we can maintain very attractive growth rates into the future. And we're not done. We're still investing in security. We're still active shoppers from an M&A perspective. M&A is going to continue to be part of our overall strategy. I don't think you'll see us change our posture by the similar type deals that we've done in the past. I don't think we need to do anything transformative. But we'll still add capabilities that we think will make sense. So I think we've done a pretty good job there and continue to do so.

So a good segue into my last question for you, capital and resource allocation. You've been pretty active in the M&A markets in the last 3 years. So high level, broader views on asset valuations, what do you think about the bid-ask spread in the private markets? Where has the tone shift been the most dramatic? Again, just because you have been in the market, you have a good pulse on this. And then relatedly, when we think about your operating margin cadence, your free cash flow generation and free cash flow margin cadence, just from an organic investment perspective, what are some of the puts and takes around that? I think earlier, you talked about the insourcing dynamic. That's been a huge boon. Now you've been disciplined on the investment. So kind of a 2-headed monster of a question for you on views on M&A and organic.

Sure. Yes. M&A is great when you can find the right thing to plug in. And what I'm starting to see now is the dynamic of companies that raised a lot of money that are now starting to look at doing another round. To me, some of the most attractive assets are the ones like Noname that were at $40 million or Guardicore that was about $20 million-ish when we bought them, where they were just getting to the point where they're looking at doing a much bigger round, very dilutive and making a big investment in go-to-market. They've already approved the product. They've got some traction, and now they're looking at making a very expensive investment in go-to-market. And if we can take that and plug that in and grow it like we did with Guardicore, we got to $100 million very, very quickly after that acquisition. And being that the security franchise is roughly $2 billion now, you need to move the needle pretty quickly. Investors want to see an immediate return. Organic investments take time. It takes 5 to 7 years to get to $50 million to $100 million in revenue, which is something you're building. So M&A can cut off 5 years of that journey and get you to springboard pretty quickly. Valuations are still nuts in security. They are -- you do find more rational folks when you're faced with that really dilutive round and a big round when you have to make the decision of do I want to put my head down and go another 5 years before I get to an exit? Or do I want to exit now at a fairly reasonable price and take the next journey with the public company to help me get to that next level of growth? Some of the tuck-ins, those are generally reasonably valued because they don't have much traction. So we will still kind of play around in those worlds. I don't see us again doing something crazy transformative. And again, I think the patience of investors to make big investments. If I said, "Hey, I'm going to take margins down 4 points. Trust me, we're going to go build something great." I don't know that our investors have the patience for that. So that's very difficult to do. So you want to sprinkle in investments in areas where you think you can do some development yourself like with API Security, some of the capabilities for blocking and protecting. We'll probably do a lot of that ourselves. There's not a lot of companies out there to acquire for that, but it is going to be continued part of our process.

So M&A and buybacks kind of the sequence?

Yes. So obviously, if you can find the right M&A and start to grow and grow profitably, that's the best use of capital. Buybacks have been effective. We're buying back basically about 1% to 2% of our outstanding shares. If you look at over the last 5, 10 years, our share costs come down by about that. It's not our stated strategy, but we've been pretty opportunistically -- opportunity presents itself. But we do offset all of the dilution from equity comp, which is a big strategy for us to have our share -- our employees be shareholders of the company. We find that we get better engagement scores, lower turnover. It's a good recruiting tool. And folks are more bought in with some of -- especially the cost savings initiatives.

Fantastic. Well, I know we ran over, but thank you so much. I really appreciate all your time today.

Thank you.