Cellebrite DI Ltd. (CLBT) Earnings Call Transcript & Summary

All right. I think we're going to go ahead and get started. Good afternoon, and welcome to the final session of the day. My name is Doug Bruehl, and I have the privilege of being joined by Dana Gerner, CFO of Cellebrite; and Andy White (sic) [ Andy Kramer ] from Investor Relations.

So to start off, can you give us sort of a broad update on the business since you were here a year ago, both sort of from the product front as well as the sales environment that you've been seeing?

Yes, sure. Hi. Nice having you, all of you here. So I would start by saying that we are operating in a very healthy environment and a very healthy market. Our main customers are law enforcement agencies and government agencies globally, working mainly in the U.S., more than 50% of the business, and then EMEA around 35%, and APAC and South America. We see this market as a very stable market. We see the funds coming into this market in a very consistent manner, and we enjoy being the leader in the digital intelligence market, which is actually serving the entire investigation workflow from the moment a digital device is collected and until the results of the collection and analysis of this data is submitted to the investigators and then to the prosecutor for determining how to proceed with this case. We have around 10% of the business being a private sector business, whereby our solutions are used for internal investigation in large corporations, mainly misconduct, IP thefts and such. And around 50% of that are used for eDiscovery purposes by service providers to the private sector and, of course, the large corporation themselves when they have an internal unit to deal with that. That's in a nutshell.

Great. Thank you for the update. So kind of shifting to your recurring revenue growth. Most of it is coming from expansion opportunities now. Given your high penetration rate among governments and the mid-, large federal segment, how does this affect the long-term TAM that you're seeing?

So indeed, we have a very respectful list of customers. We are serving more than 7,000 customers globally. Slightly higher than 5,000 of them are coming from the public sector and around 1,700 coming from the private sectors. We have the largest names on the federal side, state and local side and a long list of small law enforcement agencies. When we are speaking about these customers, we actually find ourselves in a situation whereby though we are penetrated in all these names, the additional opportunity of penetration there is much bigger than we can actually see. So in principle, we started a forensics lab. We put our first step into these customers. But these customer needs are constantly growing day in, day out by the mere fact that 90% of the data which is used in investigation is digital data. And most of it is coming from mobile phones, which is our specialty. So while we do have the logo or the customer, we don't necessarily fully penetrate it into their entire bank centers. Many of those customers have additional departments, field offices and other operation whereby we still did not touch the needs of these internal customers. And we are stepping outside of the forensics lab in the past few years, stepping into what we call the bridge between the forensics lab and the investigator, the ability to share in a compliant and audit trail manner, the results of a digital collection and analysis with investigators and prosecutor, which is a big pain currently as police is scrutinized for its transparency with the community. And we provide the analytic tool for the investigators to be able to go through enormous amounts of digital evidence, which is collected, and find this needle in the haystack, this golden evidence that will lead them into closing the case. So from a penetration perspective, we are more penetrated in the TAM related to the collection and review. But we are really scratching the surface, and this is really working in a greenfield when it comes to the sharing and review of data between the forensics lab and these internal customers and then after the analysis of the data.

Great. I think that makes sense. So you discussed churn on your last earnings call, which has been about 9% on average over the past few quarters. Can you help us understand the different drivers of both license downgrades and cancellations that you're seeing in any given quarter?

Yes, for sure. I would say that our churn is built out of churn licenses with customers that are still retaining their business with us, between customers that stop doing business with Cellebrite and with customers that Cellebrite, for business reasons, ethics reasons and sometimes even legal reasons, decide not to continue business -- doing business with them. In our last earning call, we mentioned around 2% of the business is coming from the last group of customers. Cellebrite, over the past years, have implemented legal, ethical and business screening of customers in countries whereby we do business and is stepping out from the long tail of countries in places like Africa or some places in South America or Asia Pacific voluntarily, and by that, churning the license there. So this is our own business deciding to focus on the main regions that we want to do business with, which is North America and Western Europe. The other 2 components are very small law enforcement agencies. If you think about the U.S., there are around 18,000 law enforcement agencies. Vast majority of them are extremely small. In many of them, there are not even the capabilities to entertain and investigate digital information, which is collected during investigation. In those of them that do have the budgetary capabilities, not all of them can repeat and utilize and put their hands on these budgets year in, year out. Some of them, because of budgetary reasons, may resort to cheaper solutions or to receiving services for the nearest county, larger forensics lab or FBI field office and so forth. So all of the churn that we are seeing is coming from those small agencies. We are very proud by the mere fact that our federal customers, and our strategic and large customers, we do not have churn with. So it's actually for the past years, we are seeing 0 churn with our most larger customers. The last part of the churn is coming from customers that are reducing their business with us. They are still Cellebrite customers. In most cases, Cellebrite is still their main go-to -- Cellebrite solutions are their still main go-to tools when they need to do a collection and analysis of mobile data or cloud data. But from either budgetary resources or because they are working in a manner of opening a task force for a certain period of time, licensing solutions for this task force, task force achieving their targets, closing the task force, shelving the licenses. So we see ups and downs between those customers and that is also part of the churn that we are experiencing.

And I would just add that as you look forward, as Dana outlined, there are a couple of areas where I think through a combination of seeing the voluntary churn, the countries that we've elected to withdraw from new sales activities, for example, that should largely dissipate as you move into the second half of next year. And the steps that we've taken from an inside sales perspective and how we approach smaller customers can hopefully result in some modest improvement in that other element of churn.

Great. I think that makes sense. And then shifting to everyone's favorite tech topic of 2023. You've had AI as a part of Pathfinder for a few years now. How has that development continued? And how do you expect to expand into other profit -- I'm sorry, product offerings?

So I would actually say that we started implementing AI capabilities in one of the most popular solution of Cellebrite, which is the physical analyzer. It is a solution that actually takes all the corrected data, decode it and make it readable to the examiner in the lab. Since most of the digital sources create a huge amount of data, also the examiner in the lab, as tech-savvy as they are, they need something to help them go and screen through this enormous amount of data. And we've introduced quite a lot of homegrown solution around image resolution, face recognitions, language capabilities, geolocation and so forth to help them sort through these amounts of data. Pathfinder is meant to be used by investigators. Investigators, detectives are usually not as tech-savvy as examiners. And the need there to further take the ability to use AI to help them answer their main questions of the investigation of who and where and how is critical, especially because investigators are not dealing with one source of digital data. They might have 10 phones, 3 CCTV footage and 4 computers when they need to go through all the digital data in the investigation. So the challenge there are much bigger. And there, we are using much deeper AI capabilities to help them sort through this data and flesh out, as we said before, the golden evidence, maybe.

Sure. And a lot of that capability is somewhat similar to what's packaged inside of the physical analyzer, but I think you use a much different model in terms of how you make it work for an investigator. So whether you're looking at images, you think about the different image types and the time and impact you can make for an investigator if they're focused on something like child exploitation, for example, having to manually sift through images like that would be very draining. So you can make a big improvement in their overall efficiency. You can look audio, you can detect screams, gunshots, things of that nature. So the way that you build your model, the way that you train your model and the customer's ability to influence that also in terms of how they train those models becomes very impactful to the overall workflow and efficiency of an investigation. Just the amount of data contained on multiple devices is enormous, and so being able to sift through that as quickly and as efficiently as possible is key.

Great. Thank you. And then sticking with the product ecosystem, what does the road map in terms of development look like over the next few quarters?

So I believe that we are challenged by a few things and we are still learning them. The first thing is the fact that we have introduced to the market from the first time a phone was encrypted. I think it was somewhere in 2013 or 2014, the ability to overcome the encryption of the phone and then after also the locking on phones. Now these capabilities are very unique. They involve deep research of vulnerabilities and the ability to transform these vulnerabilities into exploit. That means that we can use that in a constant and very efficient manner through many transactions. And we packaged for many years a separate solution called Premium, sold initially only to vetted agencies. We've been investing heavily in protecting those capabilities both on a software and hardware measurement, so we can actually deploy them to the wider populations of our customers because everyone needs the ability to overcome unlock and do full file systems of all the data that is being kept on the phone, not just what the operating systems allows it. Our research shows around 65% of phones arriving to a lab are actually locked. So every customer needs it. We've been able to increase the footprint of this solution to around mid-teens of our customer base UFED installed base, which means that we have still a lot to go there. We are doing it through dynamic models and dynamic pricing. And I think our very challenge is to get it to the last user and the smallest lab to cater both their needs and their technological capabilities. So this is one thing. And we believe the collection review is a huge growth engine still in Cellebrite because the challenges are growing and changing dynamically. If we look at the rest of the offering, our Guardian, our investigative data management and sharing is really hardly scratching the surface. This is meant both to the forensics lab to be able to manage their entire processes within, but also to share in an audit trail and controlled manner the data collected with the investigators. Until now, most of it is shared through PDFs or thumb drives, which can be lost, copied, shared with others without the control of the lab examiners themselves, which feel very responsible for the data. The data should not be tampered or changed, otherwise cannot be used as evidence in court. And we provide solutions to bridge this relation between examiners and investigators. And so we only launched it December '21, end of December '21. We started selling this solution in '22. It requires a change of mode of operations of the labs. It requires a lot of education, and we are at the very early adoption. Those who adopted it use it very nicely and constantly. So we feel very comfortable in our ability to go through the introduction of this solution. And of course, the Pathfinder, the investigative analytics, what every detective in a modern world needs because they cannot manage digital investigation in a manual manner. So every time we walk into our field of expertise and customer base, we see the ability to grow and grow substantially.

Great, great. Thank you. And then sort of turning to a strategic way you look at revenue, how are you viewing private enterprise as a whole market?

Private, until a few years ago, was something that Cellebrite was not fully focused on. We've done sales there, but they are sporadic in a way that they've been done and mainly by customers approaching us. We have acquired a company called BlackBag in early 2020. This company complemented our offering of mobile and cloud with computer forensics. Computer forensics and computer is actually the #1 tool when you go into corporate investigation, and eDiscovery, while mobile phones is actually the #1 tools you go to in criminal investigation. And we are very proud to say that we established the private sector business unit. The person who used to see -- be the CEO of BlackBag is now managing this unit as our general manager of the private sectors. And we believe that, currently, we have great solutions for them on the collection of data. Yet there is still more to go there through either partnership or through inorganic growth because after you collect the data, you need to process it and you need to review it and analyze it. And this is a place where we don't play yet. Of course, when we are collecting data, and we also collect data, remote employees are working from home now from both mobile and computers. You can use these capabilities to do more and help in mail detection, incidence response and so on. So we believe that the private sector being currently around 10% of the business, with the right inorganic investment, can grow to be much more fundamental in our business.

Yes. And I think the only thing I'd augment that with is that we've taken steps over the past year to really focus the sales organization on larger accounts, service providers like the large accounting firms, large consultancies that work with midsized and smaller enterprises. And I think that, in combination with a new sales leader, is making -- starting to make a very tangible difference in the effectiveness of the top line performance. We've seen that accelerate into the high teens in the first quarter, so growing off a small base but moving in the right direction. And it would take a lot to move the needle in terms of the mix between public and private sector. But I think standing on its own, it's pointed in the right direction in terms of the growth trajectory that it's on.

Great. Makes sense to me. And then shifting to competitive dynamics. For competitive opportunities, which companies are you seeing most? And how are your win rates coming out of those?

So we are working in a multi-vendor environment. And I think this is a great advantage for every company that is working in our market because our customers will, in most case, when they can afford it, will use more than one solution in their forensics lab. That is done because they cannot be attached to one vendor. That is done because in high-profile cases, they need to go through a validation process using additional tools. We are very proud by the mere fact that our tools are primary tools with our existing customers. So if you look at their entire installed base, most of it will be Cellebrite and then other solutions. And these are solutions would be the go-to tool when they need to do their work. We are seeing a wide variety of competition on the forensics side, whether it's by providers of mobile collection capabilities by different companies. Most of them are dealing better with the legacy phones and much less with phones which require unlock and collection of the entire data from the phone and especially the more newer phones. In principle, there is only one company that we see that can constantly provide some solution around iOS and very small capability around Android that can compete with us there. We are seeing companies who are competing with us on the decoding and analyze of data, coming mainly from the computer side. But since most of the data is coming from mobile, we have the advantage of expertise and capabilities, and we are doing in our perspective and also by our customers' usage rates, a much better work. But as I said, we are assuming that our share on the mobile collections review in those forensics lab is around 40%. And it's taking into consideration the number of competitors there. It shows our strength and capabilities in this market. Stepping out of the forensics lab into the investigation world, especially where we are playing, which is both the share and review of data to the investigators and the investigative analytics, there are not many solutions which are targeted to our customer audience. Most of the solutions are, I would say, general ones. So their capabilities are not at the same level that we are bringing. Our solution, which is dedicated to investigators and to the sources that are coming into investigation, but they are there. And when we are competing on very large deals, the deals that we've announced last year in Europe, one of our competitors who apparently, which is actually not an analytics solution, it's a fusion solution. So we are seeing specific solutions targeting analysts, specific solution targeting large organizations and those who are more specified on the computer side of the market.

Great. And then sticking with competition. One of your competitors, Magnet, was acquired earlier this year. So how will a combination of Magnet with GrayShift affect competition for public contracts?