Cellebrite DI Ltd. ($CLBT)

Good afternoon, everyone. Thank you for joining us. So my name is Brian Essex. I'm JPMorgan's cybersecurity and DevOps analyst. And with me today, I'm very pleased to have Thomas Hogan, Cellebrite's CEO; and David Barter, their CFO. So both of you, thank you so much for joining us.

Maybe a great place to start -- and by the way, for those in the audience, I'll leave 10 minutes or so at the end of the event, just to take any questions that you might have. But maybe a great place to start would be with this quarter's results for those that may not be too familiar with what you do and the trajectory of the company and the pathway that you're on. Maybe we could start with what you do, just a very high level and then Dave, if you want to hit results because I think it's worth noting the growth rate profitability and so forth where you are because I think a lot of people are focused on that right now.

I'll do a quick flash on who we are for those that aren't familiar, and then I'll let Dave give you the cliff notes of -- or the snapshot of the P&L and progress of the company. I guess in the simplest terms, we truly make the world that we live in safer. So our software, our platform and to some extent, we're an appliance, is used by virtually every law enforcement agency in the free world, any democratized nation, both at the local law enforcement and the intelligence and federal level to help prevent bad things from happening. And then when bad things do happen, we help catch really bad people and put them away. And so that's what we do. We've been in business for just about 20 years. And we're recognized and I think acknowledged as the market leader. Clearly, it's a small universe of people, but we're the market leader. So like if you're a citizen or you have children like you're glad we exist, even though you may not know us, you're happy that we exist. So that's what we do. So Dave?

Thank you, Tom. And Brian, thanks so much for having us. Just a couple of highlights. In terms of -- as you think about Q1 and really as you think about this fiscal year, it's really for us, it's an acceleration of ARR. We came off last year. And when you think about the heritage of our business really around unlocking extractions. We've really been building up a growth portfolio. And so we're real pleased with ARR growth of 21%, free cash flow margin on a 12-month basis of 32%. And for us, this quarter was really about just getting started at an ability to launch a couple of products towards the end of the quarter, started early access on an AI product. And really, this is one of those stories that the best is yet to come because we'll have almost a dozen releases over the course of this year. So I think we're really just pleased with how the year started in terms of really building that base of how we're extending the platform.

Got it. And then maybe, Tom, just one layer deeper. So you build a platform that extracts data from mobile devices, right? And then an analytics platform to help analyze and digest that data, store that data, share that data. How much of your revenue is hardware versus software? And can you talk a little bit about customers that use your platform and exactly the value proposition that you have for those customers?

Yes. I'll -- Dave, you go first with the mix of hardware and software, and then I'll click in.

Just because you said you're appliance. So I just want to make sure we address that.

Well, and such a strategic part of the business. So about 8% of the revenue is nonrecurring. I mean, it's a little mix of hardware as well as some professional services that go into making customers successful. 92% is a mix of term-based subscriptions, but we also have cloud subscriptions and even consumption contracts. And so it's a very contemporary business in terms of our mix of our software revenue and all running at about an 86% gross margin.

Yes. And then last year, it was kind of interesting. You had a number of different headwinds that you manage through. Can you maybe talk about what some of those headwinds were and then the outlook that you have for growth this year now that, that kind of environment is behind you and then you have a number of different, I think, attractive levers to really throttle your growth a little bit.

Yes. I mean, our historic growth rate over the past several years has been in the low to mid-20s on an ARR basis, while delivering, I think, healthy levels of EBITDA and free cash flow. In 2025, we dropped below 20, and that headwind was almost exclusively from we do just under 20% of our business in the U.S. federal market. So I think in the 17%, 18% of our business is U.S. Fed. And when the administration turned over 18 months ago, a combination of chaos, change in leadership, the whole early days of the DOGE initiative, but then the passing of the BBB, but the time it took for that to work its way through the system mean all those things conspired to take our U.S. federal business, which has historically grown in the kind of the 24% range to essentially flat in '25. So when 20% of your business is modeled at 24% growth, and that goes to flat, it's tough to keep the total in the '20s. So we dipped into the, I think, the 18-ish percent range as a company last year. And as you know, investors don't like decel on the top line even we maintain healthy margins on the bottom line. So now segue to this year, and we signaled throughout the year that this was a temporal sort of situation in sort of a set of circumstances that I just described. We expected that we would have a strong rebound in '26, which we have building confidence is going to happen. And we actually signaled in our last earnings call that we think there's at least an opportunity for the growth rate in that business to not just get back to where it was, but we think we have opportunity to exceed those historic growth rates, partly catch up, but largely due to the expansion of the portfolio and assets that are relevant to the U.S. federal market, and then unfortunately, for all of us, the geopolitical and stability around the world is also exacerbating the appetite for the things that help mitigate cyber and digital risk.

Great. And maybe if you can talk about the -- where you go from this quarter. So you reported 21% ARR growth, healthy profitability. To your point, pretty well positioned to go greater than your historical growth rate. Can you maybe talk about some of the levers that you have? I mean, you just launched Genesis, which we can talk about, advanced unlock product Guardian Investigate with [ a federal ] recovery. We've got international momentum, like a lot of different things are kind of like working in your favor. You mentioned the Big Beautiful Bill Act, which I think you've identified, you have half a dozen or so different initiatives in that Act that could bode well for spending in your exposed categories of all of those things, I mean, which are you the most excited about? And relative to your guidance in the high teens for revenue, like what has to go right to get you in kind of like low 20s or better category?

Yes. I'm going to answer it in a couple of different ways. If you look at just size of TAM and growth rates, we announced a product called Genesis, which we think is the market-leading agentic AI. I know everything is whitewashed AI. This is actually a real product. It's being used today by 500 people in the law enforcement and intelligence community as early adopters. The feedback will make your head spin in terms of the impact it's having on the efficacy and speed, efficiency, productivity, of processing all this data and information. And the other thing that we're hearing is we've tinkered with virtually every LLM in the market, thinking there's got to be some gold in those LLMs, and we get garbage data back, and we deployed the Genesis product from Cellebrite and the quality and the insights it's generating are things that we didn't even think was imaginable. We're solving cases in minutes and hours that would have taken months to go solve. And so we've pegged that TAM at $12.5 billion, which is about 3 to 4x the size of the TAM we've been chasing for the last 20 years. So it's a big market. We expect it to grow significantly, but it will ramp. It's not going to be an overnight thing. The other -- the product that, Brian, that I get excited about relative to, let's call it, in the next 12 months and upside to the current model that we all have is actually in the defense and intelligence space. And that leverages things like our kiosk capabilities, Corellium, Genesis and the drone forensics asset is of huge interest to intelligence and defense people in democratized, allied nations around the world and their ASPs, are orders of magnitude bigger than what we've seen before. So if we execute and convert in that space, the revenue potential there in the next 12 months is actually probably the thing that gets me most excited because I'm seeing these things and we can touch them. The Genesis thing is going to happen, but it's going to build. So I don't know, Dave, if you have a different point of view, but ...

I completely agree. And I think maybe to complement just being able to have our case evidence being through FedRAMP, which was an 18-month investment and when I think about the government vis-a-vis maybe some other verticals that have been slow to digitally transform, you're just at that point where you can really help the government do really what they're looking for, and this is within the agencies but also even within the congressional ranks where people are looking at the opportunity of connecting the data within the government all in the name of public safety and really accelerating justice. And so I think looking at that as a lever where, gosh, we just got ATO and already customers are lining up and so that's kind of an interesting dimension in terms of just thinking through a vertical that's a laggard and cloud adoption, something it plays to our strength.

If you're not a government geek, FedRAMP basically is the certification to run your asset in the government cloud and there are different levels of certification, Level 4 is the highest. Level 4 is reserved for data and applications and services that if there's a breach or leak, there could be catastrophic harm to the United States. To achieve that level, you have to clear over 400 security controls. It is a non-trivial multi-2-year millions of dollars, lots of people, and there are about 95 companies on the planet. Think about all the mega techs, Oracle, Google, those are the people on that list. We're the only company that's in this space that's achieved certification and authorization to operate at that Level 4, which means if you're a government and you want any cloud-based asset to make our world safer, we're the only answer.

Yes. And I want to ask you a little bit about the federal business. So I mean, Israeli company, you'd already grown a federal business a pretty meaningful size, but a while -- not too long ago, you bought a business which became Cellebrite Federal, can you talk a little bit about the composition of that business, the management structure of that business and how that changes the access that you have to federal contracts now?

Yes. So we form -- because we're viewed as foreign owned, and by the way, ironically, we're labeled an Israeli company because that's our roots and half of our employee base and our R&D is based in Tel Aviv. But we're actually -- when you say foreign owned, we're 41% owned by the Japanese, not by Israelis. So -- but you're -- the question?

Well, the question was the creation of Cellebrite Federal with the unit you acquired.

The proxy -- so to operate -- so we sell -- we have been selling to federal for a long time. and the foreign ownership didn't preclude that, but none of our people could get cleared. And therefore, if it was a super classified sensitive project, and they needed on-site expertise from Cellebrite to come help with the design or the deployment or the usage, we were unable. All we could do was sell our stuff, throw it over a firewall to the FBI or the Langley to somebody and wish them luck. And so the federal government asked and wanted us to set up this proxy company called Cellebrite Federal, very clever marketing name. But basically, it's a firewalled company with an independent Board of Directors. So we have 3 independent Board members that are not affiliated with the parent, there's a firewall of information. So anything that's classified, I don't even get to see. It fully rolls up as a consolidated operation. We do shared services for G&A things, but the IP and then the work on specific government classified projects and getting classified people now sits in that proxy company.

So what does that do for the health of that business in terms of the pipeline that you have particularly if you consider the headwinds that you had in federal last year and then the new products that you can sell into the federal this year?

That plus the FedRAMP ATO were the 2 big investments that took us a lot of time and some money to go set up to open the aperture of opportunity. Now it turns out that we bought a company, we announced the intent to acquire a company called Corellium in June last year. We closed that transaction in December. And as part of the mitigation -- risk mitigation strategy of buying a very sensitive classified technology, the CFIUS, which inspects U.S.-owned assets being acquired by a foreign company. It turns out that the proxy company is going to end up being a benefit or a tailwind for us because it is likely CFIUS will request or mandate depending on how you describe it, that the IP and Corellium be housed and contained within that proxy company gives them comfort that, that IP is being protected from bad operators or other countries around the world.

Right. And now that you mentioned Corellium, we'll kind of bring that one up too. Particularly given the demand that you see in that business from a defense and intelligence, how do you extend that technology meaningfully into enterprise or law accounts?

Yes. The most immediate opportunity, so if you think about our cohorts, we have -- we sell to the Global 5000, and that's roughly 7%, I think, of our total P&L. We sell the classic state and local law enforcement in the U.S. and around the world. So next week, I'm going to be with the commissioner, The Gardai, which is the national police force in Ireland, the metropolitan police in the U.K., the national police in Australia, they're all customers of ours as well as every major city, every major city in the United States uses our technology and our products. So the ...

I mean just how do you bridge the Corellium technology from D&I to commercial.

So that said, the Corellium asset plays most predominantly in defense and intelligence. But what we're seeing is a big use case opportunity in the private sector, which has been kind of a slower grower for the last couple of years, but Corellium's ability to assist with dynamic security, DevSecOps and mobile pentesting and some other use cases and specifically in the automotive space or any space that has an intensity of ARM-based technology is turning into a very powerful use case. So it's like a barbell where Corellium has huge upside in usage in defense and intelligence, and we think equally big opportunity in the enterprise. There is opportunity at the state and local level, but it's much -- there's much bigger TAM, we think, in D&I and the private enterprise.

Got it. And then in the international space, how should we think about the international pipeline and the demand that you're seeing there across multiple regions. Is it concentrated? Is it broad-based? And is that really -- how levered is that to geopolitical conflict that we might hear about every day?

I'll let Dave add some commentary, but we had a very robust quarter in Europe. Asia Pac was in the low 20s. I think Europe was in the mid-20s in terms of growth. Europe gets credit for -- so we made a conscious decision to move a year ago from the traditional post bang crime happens to get into prevention and intelligence, which really plays to the military like -- if you're in the military, whether you're the national army of, you name the country, you're not worried about a murder case. You're trying to protect your country and so I don't know if you want to add?

I think just in general, I'd say the team in Europe has done a great job extending the platform. So I think the -- I give them a lot of credit, where they've done a great job of going from the unlock extraction really through Guardian and starting to bring out the platform. They do a great job with things like Pathfinder, which is really oriented around multiple device situations where you might have 100 to 300 phones and so they've done a great job on the advanced analytics. Similarly, in APJ, which has also stepped up growth 4 or 5 points sequentially, they're starting to build out case admins of the Guardian platform in places like Australia, but they're also seeing incredible adoption with Genesis early on. And those are kind of all new things in the sense that historically, we've needed to move our products into a sovereign cloud and we're starting to see in those 2 regions, in particular, adopting Genesis on an early access basis even though it isn't in a sovereign environment. And so I think we have great commercial leadership in those regions, extending the platform to its full potential.

Europe really moved first on the focus in D&I and we saw their year-to-year growth bump up like 10 points from 15 to 25 and that was -- that's being driven by D&I growth in the mid-30s. And we think that we expect and hope that, that's a harbinger of what's about to happen in the U.S. now that we have ATO done, and we've been focused on D&I.

Got it. That's super helpful. I wanted to ask about a relatively new management team mean you've been on the board, but previous CEO, CFO, were based in Israel, you guys are based in the U.S., how does both the style of management as well as your ability to be domiciled where most of your revenue originates changed the way that you're able to manage the company.

We should pull Ronnen up here. He's one of our long-term veteran Israeli employees. Look, what I'd like to tell people is we're not an Israeli company. We're not a Japanese company. We're not a U.S. company. What I tell the market and our employees and our investors, this is a global company that's a force for good. And in this day and age of digital, just take the notion of work from home and extend it where the leadership team sits to us is less relevant. And I think we communicate and operate as a team. And I just want -- I have to give a shout out to 50% of our employees are in Israel, and we haven't skipped a beat in the last 2 years in spite of all the conflict and turmoil and things that our Israeli employee base has had to deal with, which is a remarkable testament to their commitment to the company. But I think it's working. Most of the senior leaders now are U.S.-based, but still 50% of the employees are in Israel and we're in it together, and we have a common bond, which is our mission, which is to make the world safer, and we unite behind that, and we communicate.

Very helpful. I do have one more question, and then I'll open it up because we do have a couple of minutes left, but I just want to ask more detail on the Big Beautiful Bill Act. How much -- like what are the programs that you've identified that you have exposure to? And as we kind of track what materializes out of that effort. How should we think about the way these programs will be identified, funded, distributed as we're just basically trying to track your exposure to those spending initiatives.

It's pretty -- it's spread across the board, which is what's exciting and I think speaks to the power of the portfolio. But to give you some examples, there's a lot of money that's earmarked at digital evidence management and collaboration. I mean Dave touched on, just to give you an example, I'm working with one of the leading congresswomen from Florida, who's trying to sponsor a bill to create -- here's a big idea. Okay, child exploitation is a big problem. And one of the ways to fight it is to share information. But sharing information, CSAM information is hugely sensitive and can be toxic. And so she reached out and said, "I want to sponsor a bill, and I've heard Guardian, which is our repository for digital artifacts has now got ATO certification, which means it's the most secure cloud based day you can find, can you act as a repository so that we can share critical information across agencies and geographies across the United States to protect children from child exploitation." So that's an example. A lot of focus right now on fentanyl and opioid. In the defense sector, I don't have to remind people about drones, you see it everyday on the news. What can you do with field-based triage for drone forensics and digital devices. So those are some of the categories in the BBB that -- and by the way, some of the specs that are coming out, specifically -- or explicitly say this must be cloud certified because of the efficiency for delivery and security, and we're the only player in the space that has that surgical. So it's across the board, counterterrorism, child exploitation, s** trafficking, fentanyl, all the things that you would expect, actually, we're in the middle of it.

Great. Great. With that, I wanted to reach out -- or anyone in the audience have a question? All right. Ken, we'll get a mic over to you.

I would just ask, can you give us a feeling for how you grow. We understand you have these digital forensic tools that are the best that they all need. But what drives your growth? Is there more need to use, you drive it? Do they pay per usage or do they buy for capacity? What drives your growth?

Yes. And the answer is yes, but I'll do a click down and give you a little bit of color. Our Guardian product, which -- so you think you extract data from a device. Now what do you do with it? Well, in the old days, they would put it on a thumb drive in the police department or wherever they were and then if they wanted to share, say if Boston PD wanted to share it with the DEA agent on the Texas border. Guess what they did. They took the thumb drive, and they gotten a SWAT car and drove because they had to maintain chain of custody, right? So Guardian is our cloud-based purpose-built repository to store that and that is based on -- it's not usage in the sense of users, it's usage gated by terabytes of information that's stored in that platform. Genesis, which is our new AI application, agentic AI. That's not also not based on users, that's based essentially on prompts and queries and it's a tokenization model. So the more they use the AI engine to help solve crime, it's a variable cost or variable revenue source for us that effectively becomes value-based. But on top of those, you have portfolio expansion. We've been very aggressive in the last 18 months in a combination of inorganic and organic build-out. So we have new things on the truck to sell. Unit growth is going up because unfortunately, digital crime is going up, not down. And so and then pricing. We have pricing power, and we don't abuse it, but it's probably 4% to 6% pricing power. There's unit growth. There's portfolio expansion in terms of new product and then there's usage of either terabytes for storage or tokens for AI.

Yes. I think we're about out of time now, so I apologize for that. But with that, Tom and David, thank you very much for joining us. We really appreciate it. I do think, by the way, I think there's also going to be a webcast. So there should be a transcript of this up there, too.

Thanks for having us. Great. Thank you. Appreciate it.

Thank you.

Thank you. Take care.