AvePoint, Inc. (AVPT) Earnings Call Transcript & Summary

Awesome. We will jump on in. Thank you for being here. I'm Roger Boyd. I'm the cybersecurity analyst here at UBS. Happy to have the team from AvePoint here. Thank you, gentlemen.

Thank you. Thanks for having us.

We got Mario at the end over there, then Jim and TJ. So glad to have the team here. And I think maybe just to frame the conversation, maybe to go back a little bit. I mean, AvePoint was founded, I think, 20 years ago, started as an exchange SharePoint backup service. Obviously, that's expanded quite a bit over the past 2 decades. It's a much more comprehensive SaaS and data management platform. For investors who are just coming to the story, can you just kind of go through that time line, what that kind of advancements look like and where you're at today?

Yes. So thank you, Roger, for having us. Yes, we started 20-plus years ago in the -- like you mentioned, SharePoint space, which is Microsoft's enterprise content management platform. And the nature of that is really highly targeted towards regulated industry, very large governments and banks and pharmas. So because of that, we expanded globally. It's a high-touch direct sales process where our value add is to focus on all the data capabilities for that platform. So whether it's data backup, data archiving, data migration, classification labeling and then, of course, build it as a full-fledged document management, record management, knowledge management platform. And then when Microsoft went to cloud in 2010, 2011, days called BPOS, we invested the earliest because we were able to by staying close to the customer forecast that this is our opportunity to really have a massive expansion of TAM for us. So instead of only focused on regulated industry, enterprise content management play, we were able to -- by shifting to cloud to address the entirety of Office. So Microsoft Office products, the foundation fabric for collaboration, for multi-editing, for co-authoring is actually SharePoint. So fast forward today, we are the largest SaaS data protection, data management, data governance player for Microsoft Office Cloud. We have our SaaS platform running in Microsoft Azure, which is their compute cloud. And we have a very significant relationship with Microsoft in that regard. So we're both a large customer of Microsoft as well as global partner. And because of our physical expansion years ago to go after the regulated industry, today, we have about 20% of the overall regulated industry from a user C coverage perspective. But outside the regulated industry, there's still massive headroom for growth in addition to regulated industry. So that's where we now because we have a global presence and because we also now in the last -- since we've gone public since 2021, invest aggressively into channel to scale. So we're able to not only sell to the Fortune 20, but also to the medium to small businesses. And now industries outside the regulated industry really care about data curation, data quality because of AI. So good data leads to good AI. And of course, not only have we done the unstructured data governance and management aspect of it, we also get into the space of agentic, so application governance, starting with Power Platforms, Power Apps and now, of course, now agents. So this is the evolution of the company. So while we are still relatively small, about $420 million revenue this year, we have all the markings of a much larger multinational corporation.

Yes. Makes sense. I want to get to agents and AgentPulse in a second. But just to frame out the purview of the company, you talked a lot about the reach you have with Microsoft, but it's expanded beyond that, and it's been much more of a multi-cloud story. What does that percent of business look like that's tied to the Microsoft ecosystem? And how do you think about longer-term targets for the non-Microsoft piece?

Yes. So today, we see fantastic growth in the Microsoft ecosystem and also outside the Microsoft ecosystem because every customer today are, by definition, multi-cloud. Right now, about just over 90% of our revenue come from the Microsoft ecosystem. But what we foresee the opportunity for growth outside of the Microsoft ecosystem could be potentially as high as 30% of our revenue mix by 2029.

Yes. Cool. And then jumping to AgentPulse, relatively new announcement. How does that kind of fit into the broader strategy and the vision for governance and AI in the cloud? And I know it's relatively early, but how have customers responded to that offering? I know some of the parts of the offering have been in the market for a little bit.

Yes. We're very encouraged to see the convergence of the market pretty much shakes out how we have always viewed the continuum of data. First from management, right, data protection, ransomware detection recovery, storage management into then governance, right, who has access to what access control, but then importantly, this delegated administration capabilities of IT doesn't really know what business, how they use data and how they run applications, what purpose there are, especially in a large organization. So we give that power to the end user, the business users to specify, to quantify and then leveraging a framework, a SaaS framework delegates administration that actually put this all together, right? So Gartner calls it data security posture management. So we start that with data and then we move it into, of course, applications and now agentic. So from an agent perspective, we're very pleased with the progress. So some of our largest customers, global Fortune 500 as well as the biggest audit firms around the world, they are already actively promoting agents. UBS as well. Last night, I was at the UBS leadership dinner and the top concern for UBS IT leadership is actually how to grapple with, on one hand, businesses want to push more to deploy AI agents to make work more efficient and productive. On the other hand, we need to -- because UBS is regulated industry, you are -- from a compliance and perspective, is even a higher standard than most other banks. So that become a huge concern, right, guardrails, if you will, around applications, around business processes, around agents. So this is where we see a common thread across all of our large enterprise customers and even also small- to medium-sized business. We have been doing this for a number of years for Power Platform, Power Apps. And of course, with AgentPulse, we're able to help businesses take stock on all the agents that's running in the environment, not only in the Microsoft ecosystem. And then once we identify them, discover them, then we bring them under control. So if you think about guardrails around these business processes and these applications, semi-autonomous applications, how long they live for, what kind of other system they can talk with and interchange data with and then what users can have access to them. So this is very, very important because over time, these agents are going to be much more powerful, the way hyperscalers think about it as full-fledged digital employees. So they will have an identification. They will have a CRM license. They will have office license, they have an e-mail box, they have a chat persona. And all these are fully licensed as almost if it's a real employee. So that kind of capability and power is something that brings forth a lot more complexity. So this is where we think there's a massive and very quick evolution towards that.

Yes. I wanted to expand on that a little bit and maybe bring Mario to another conversation a little bit, too. But where do you think we are in terms of like the regulatory side of AI? And you talked a bit about being exposed to a lot of regulated verticals and European banks are probably at the high end of that. But how do you see that evolving and potentially being a catalyst for your business and other security firms?

Yes, sure. That's a great question. A good follow-up to what TJ just mentioned. So if you think about regulatory impact on an organization, it starts with is your information secure? What are the policies that you in your industry should be following? So we actually went through all of this many years back with GDPR when many organizations, especially in the EMEA region, were saying, we need to understand the privacy of security and how do we automate with software, the controls for that. We're basically in a place now where for AI regulation that we're starting to see take shape, you're going to need to have the same type of controls. Earlier this year, we spent a lot of time working with policymakers, understanding what are the metadata values are you going to need in the application to track the agents and the behavior of agents. So the EU Act, which was just launched in September in the EMEA region, starts to set the framework for how organizations should think about the impact of AI and where regulation should really be applied. We are planning in our product, especially with the AgentPulse launch to help organizations start to track and create an inventory of these agents. So in the product already, you'll be able to apply metadata that will give you a really good way to apply the regulatory requirements no matter what industry you're in. And Roger, for your audience, it's really important to know that we've been working across regulated industries for many years. And what we've learned is the best way for us to make sure our product has market fit in those industries is to inject a lot of the regulatory requirements in the software automation layer, which we've done. So ultimately, you'll be able to track the agents, have an audit trail, understand what identity the agent is acting on behalf of and then more importantly, which type of data is the agent using for transfer. And if it's sensitive data, what's the right classification code. So the idea for us is to do the inventory, make sure that you have that inventory applied in the context of regulation to be able to help organizations. And then the last point is in the U.S. market, regulatory changes are starting to take shape. We see it at the state level. We don't have anything yet at the federal level, but we expect that next year, we'll see some changes there. And we just want to make sure we're ready to help our clients navigate that.

Yes. Makes sense. I wanted to transition a little bit to the business side of things and get Jim involved a little bit. But maybe to just touch on 3Q. I think it was a record quarter for net new ARR. I think the commercial side of the business is doing really well. Can you unpack that a little bit? And then I think conversely, sounds like U.S. Fed was maybe a little bit weaker, a lot about expected, but how are you thinking about 4Q and into next year and the ability to continue to sell into agencies?

Yes. I mean I'm glad you pointed out. You're right, everything you just said about Q3. The commercial side of the house, very strong, in line with really the growth we saw in Q2, which was really powerful, really strong, 42% kind of net ARR growth. So pretty consistent with that. And you're right, it was really the public sector and more specifically the federal piece of the business that definitely had weakness, particularly in Q3, but actually for the full year, it's been relatively weak compared to last year in terms of growth rate. So that definitely was the story kind of for the first 9 months of the year. Now despite that, we still had really strong growth overall. So we're really encouraged by that. And then for Q4, obviously, the government shutdown has kind of come and gone, which is good. And the rest of the business looks really strong. We're -- you mentioned we had record ARR, net ARR growth in Q3. We're expecting another net ARR record in Q4 as well. So again, we see good growth coming from all regions, really all customer segments. We talk a lot, Roger, about the balance of AvePoint in terms of our diversity and really balance, whether it's customer segments, whether it's geographies, even customers, not any one customer representing more than 2% of the business. So that good diversity continues. And we're going to see nice growth coming from really all sectors of the business in Q4. So we're excited about the closeout for the year, and I think that will give us nice momentum going into 2026. Really setting up the teams very well for a good year, hopefully, next year. And then that sets us up really well for this goal of getting to $1 billion in 2029. So we're excited about that. Teams are galvanized and really excited to contribute to that goal.

Yes. Awesome. I want to come back to that target in a second. But I think last quarter, you spoke pretty specifically about some of the momentum you have in the channel. And I know that's been an area of investment over the past year and beyond. What's been incremental there? And you've talked a lot about kind of the opportunity with MSPs and MSSPs. Where are you today in that segment, that channel?

Yes, we're still very pleased with the progress there. It's our fastest-growing segment for a vertical. It's our way to unlock SMB, the fat tail, if you will, the market with our enterprise-grade focus. So because SMBs don't have IT and they rely on these outsourced IT to manage all their data estate and cloud assets. So the use case here is really for -- I like how Jim puts it for these MSPs, we are fundamentally a revenue center. They're leveraging our platforms, what we call the Elements platform, is to actually drive and scale their business to manage hundreds, if not thousands of commercial customers behind the scenes, anywhere from, obviously, data protection, ransomware detection to also governance to also now license management and cost management because a lot of what's happening in cloud is there's compute costs, there's GPU cost, CPU costs, there's also bandwidth costs and storage costs and also license costs. If you just rely only on the hyperscalers, they will want you to buy the most expensive licensing possible, where we actually have software to say, Hey, this -- John has been licensed fully, but he actually barely uses a portion of his license. And there, there's economic optimization to be done. And this is something that's super keen to the MSPs. That's where they drive that additional margin for themselves. So this is where we see continued uplifting whereas some of the larger MSPs were experiencing 140% NRR just because how fast they're adding net new seat counts behind it. There's also a bit of a key roll-up in that market where every time they buy a company, they bring forth 100,000 seats, for example. And these are not big companies, right? So the MSP themselves. But behind the scenes, they're behaving like a very sophisticated, like a UBS type of level because they have hundreds of thousands of users behind the scenes under management. So we continue to be very excited about it. We feel like we're just scratching the surface here. We have about 3,000 MSP partners in the Microsoft ecosystem. According to Canalys, the total size of the market is at least 10x that. And of course, as we look at the multi-cloud space, there's MSP players in the other ecosystem, AWS and Google, et cetera.

Yes. We're talking with Mario about this last night, but how do you think about the demand for that MSP channel? And it feels like you guys are betting on a horse that is going to continue to accelerate here and especially with concerns around AI, it feels like the security maturity and security posture of SMBs needs to come up. How do you think about that kind of playing out from here?

There are a few pieces that I think we realized would be really important for MSPs. One was managing costs. So we have, as TJ alluded before, not only entitlement management, but cost optimization. So in our platform, MSPs are able to identify for clients, how do I help you reduce cost and that keeps them driving value for their end customers. So that's one side. The other side of it is empowering the MSPs with a set of capabilities that allows them to stand up security practice. And the security practice could be -- I'm going to protect your data. I'm going to make sure that when you have intent access or when you're sharing data with your supply chain partners, we're tracking, we're monitoring things. So we have that already in the platform. And then more recently, the desire from MSPs is can they actually be relevant now with AI, right? And so part of what we're doing with AgentPulse is bringing that also into the Element Edition of the platform, where they'll be able to actually do that measurement, that inventory analysis and not only stand up these agents, but also monitor and manage the agents. And that's taken a big burden off the hands of these companies that are looking to keep their IT staff quite small. So our decision and intention to build more value in that relationship with MSPs is all about giving them the right IP.

Cool. Yes, I want to come back to the $1 billion ARR target, and I think it implies pretty steady mid-20s growth for the next couple of years. A lot of opportunity across the table, but how do you kind of rank the key factors to getting there? What's in the secret sauce?

Yes. Everyone asked that question. So we do actually both the top-down and the bottom-up planning. So Jim can talk about the bottom-up perspective. But from top-down, we see multiple levers of growth. So as we talk about MSP being one segmentation, we think the SMB segment for Microsoft is 40% of their total revenue pie. For us, it's right now just under 20%. We could potentially -- at the rate it's growing, potentially, it could be easily 30%, if not 40% of our revenue pie in the next 4, 5 years. And then meanwhile, the whole -- I think in aggregate, we're growing mid-20s, as you mentioned. But in addition to that, we also see the multi-cloud side has a very high growth potential. Today, it's just under 10%. We actually think it could potentially reach 30% in the next 4, 5 years. So that's multi-cloud. And lastly, we also have all these different type of channel play in direct. We have different strength in different markets. So 45% of our recurring is North America, 35% EMEA and then rest -- the balance in APAC. But every region will have different strength where, for example, in America, we're very strong in direct and SMB is fully channel, but mid-market is still not yet fully channel. We think that once we get that going, that will continue to drive several percentages of higher growth. And then EMEA, for example, so Western Europe and Middle East is 80% channel today. And enterprise is something that we actually now are investing into to go after the bigger type of customers to drive that stickiness. So that's a growth opportunity for us. Japan, for example, mid-market SMB, it's a new phenomenon because historically, business they are very conservative, but now they're going to cloud in droves, thanks to AI. We see massive uplift there. In ASEAN, historically, we do services to generate IP, and now we're layering in channel. So we see really quick hockey stick growth in ASEAN markets, including India as well. So Microsoft is doing fantastically well in India, a couple of billion revenue in SMB. And then, of course, Australia. Australia is very much like EMEA. So there's large enterprise component that we can go after. So net-net, is that if we -- just across all the physical regions that we have presence in, if we're actually firing on all cylinders like we want to in the next couple of years, we would accelerate even our organic growth. And beyond that, of course, we are looking at M&A as well as a way to accelerate the go-to-market for multi-cloud and also enhance our capabilities around DSPM. So because today, we cover mostly focused on unstructured data, which is 80% of all data, fastest growth in data is unstructured and also most sought after cybersecurity assets from a criminal syndicate perspective are unstructured data because you follow the money, right? You follow the e-mails, follow the accounts, that's how you do the social type of phishing attacks. But beyond that, there's structured data that we can go after. So there's opportunity there, both organic and inorganic expansion. So amongst all these levers of growth, if we hit all of them, we would grow comfortably faster than what we forecasted.

Awesome. Maybe for Jim, as you think about that $1 billion ARR target and the associated operating profile to it and all these opportunities to invest across multiple areas of the business, how do you think about profitability and balancing that against growth? -- any guardrails to think about as we look at into next year and out to 2019 or 2029?

Yes. It's a great question and one that we actually spent a lot of time lamenting over and making sure we're making the right investments. It wasn't too long ago. It was really 3 years ago.

I'm not sure lamenting is the right [indiscernible].

Well, I mean we spend a lot.

Good problem to have.

Yes. It's a good problem to have. I mean, fortunately, we're -- we've turned the corner, right? If you go back 3 years ago, when we first started talking about this, we were essentially breakeven on an operating margin and growing nicely. But people were asking us at that point, we don't see a path to profitability. How are you going to show us profitability? And so we, at that point, focused on profitable growth as kind of our mantra and really the story, right? And now you've seen this accelerated operating income to get us to this point. And so you're right, when we think about, hey, how do we move the dials? Can we accelerate the growth, maybe dial back operating income make additional investments. And so you will see us do that over the next couple of years. And the common question we get is, are you going to show this 400 basis point increase year-over-year, and just to bring everyone in. We've got long-term targets, which is really 2029, getting to this $1 billion, showing operating income at that point of roughly 27% of revenue. And at that point, so the question is how do we get from where we are today to '27? Is it linear? Is it a couple of percentage points a year? And so I would just say that it probably will not be a straight line. There'll be a little sawtooth in there as we make investments. And so 1 year might only grow 1 point, maybe another year grows 2 percentage points. So -- but having said that, we're constantly managing, hey, where do we need to make the investments, not only for today, but really for that 4-, 5-year period. And this focus on $1 billion may seem a little crazy, but it has given us this unique perspective of making sure we're executing today to give us the best possible chance to hit that $1 billion. And so as opposed to thinking a quarter in advance or even a year we are evaluating all of our decisions based on like does that get us closer to the 2029 target, which I think is a great way to be aligned as an organization and focus. So you will see us make investments every year, obviously. And in some years, those investments might be slightly greater.

Yes. Makes sense. I wanted to finish with a couple of questions about the demand environment. How do you think about where we are in terms of AI adoption, AI utilization? And how do you think about that driving budget availability for you? And does it look significantly different when you look at heavily regulated verticals versus non? And I think there's been this debate of, do you see security controls come in before AI adoption or after? Do things have to break before we see some of the security dials get turned on? Just a very broad question, but how are you thinking about that?

That's a very good question. So Microsoft has been touting the Copilot licensing is now $150 million, but the actual consumption is little less than that. However, having said that, we already mentioned it's not to equate AI adoption with Copilot licensing penetration. It's really every companies are now experimenting with AI, whether it's leveraging Copilot Studio to design some applications or agentic AI running around, whether they design the agents via Microsoft stack or other open source stack. The reality is that AI is here. So last night at the dinner with UBS IT leadership, they talk about AI as its own budget. So the intentionality towards that. Now in terms of your second part of your question of which goes for security or AI, it really depends on the posture of the business. So obviously, for someone like UBS, compliance and security is top of mind that has to go first. It's internal deployments. We see majority of the company doing more internal deployment than just letting that direct AI capabilities surface out to clients because there's a lot more risk, a lot more liability and that because, again, there's still some of the kinks that need to be solved around accuracy, around whatever offering you use leveraging AI, you still need that human in the middle to make sure that you're providing accurate and highly confident type of services to your clients. However, we do see a mixed kind of adoption risk posture, if you will, across small businesses and large enterprise. Regular industry, we would we see that has a better job in handling this just because, again, good AI, the predicate to that is good data. So the regulated industry do have, in general, a much better data hygiene practice so then they can deploy AI with much higher confidence than a nonregulated industry. So this, we see, obviously, as a massive opportunity for us.

Awesome. Maybe we'll wrap it there. But TJ, Jim, Mario, thanks for being here.

Thank you, Roger.

Thank you.

All right.