Check Point Software Technologies Ltd. (CHKP) Earnings Call Transcript & Summary

Good morning. Good afternoon. Welcome, everybody. I'm Brad Zelnick, software analyst with Crédit Suisse, and truly delighted today to be joined by the good folks from Check Point Software. We have Founder and CEO, Gil Shwed; CFO and COO, Tal Payne; and Kip Meintzer, who is the Global Head of Investor Relations. Before we begin, Kip, let me turn it over to you. If you would, please have the honors of reading the safe harbor.

Thank you, Brad. During the course of this presentation, Check Point representatives may make certain forward-looking statements covered by the safe harbor provided by the Securities Acts of the early 1900s. Because these statements pertain to future events, they are subject to risks and uncertainties. Actual results could differ materially from Check Point's current expectations, beliefs. Factors that could cause or contribute to such differences are contained in our latest earnings release and other factors and risks, including those discussed in Check Point's latest annual report on Form 20. Check Point assumes no obligation to update these information concerning its expectations or beliefs, except as required by law. Back to you, Brad, and thank you.

Thank you so much, Kip, and thank you all for being here. Just the format of this presentation, we will have about the next half hour for a fireside chat where I will be asking both Gil and Tal questions about the business and all sorts of things. If you would like to ask a question of them, please send me an e-mail to brad.zelnick@creditsuisse.com; and if time permits, we'll try to work it into the conversation. But with that, Gil and Tal, thank you so much for being here.

Hi, Brad. Good day, everyone.

Great to be here.

Thank you so much. Maybe to start, Gil, 2020 has been a crazy year in a number of ways and challenging for many. Maybe you can talk about the challenges organizations faced when COVID-19 initially shut down areas of the world, where we are now? And what were the priorities then? And how have those priorities shifted since?

So first, I think we've all faced it, so I'm not sharing anything you didn't face. But we, overnight, needed to change everything we knew about work. Initially, it was about connecting all the employees from work from home. It was about dealing with the supply chain. Remember, in the first few months, all the manufacturing facilities in China -- we don't manufacture in China, but like everyone, we are dependent on Chinese manufacturers for some components. Everything was shut down completely there to the point that there was even almost no communication. We didn't know what customers are going to do. It was the middle of March towards the end of quarter. Will customers hold off? Will customers continue? And I think we managed to do quite well. We shifted our entire workforce in terms of our development and so on. We always worked from the office. I always believed in the collaboration in the office environment, and we shifted. I mean, over like a period of a week or 2, everybody's worked from home. I think the world is -- I mean the level of uncertainty that we see in the world is still high, but we kind of got you to that situation of working from home. In terms of cybersecurity, that means that we've really, really increased the attack surface. We need -- before, our crown jewel were always were with our trading systems in financial companies or source code in development environment or test environment in a high-tech environment or factory floor in a factory. This was all well contained, secured. Today, we've really explored all of that. Now thousands of people can access it from outside the company. Many of them are using even computers that are insecure to access them. We've done some checks and turns out that like 40% of users at home don't even have basic capabilities for security on their home computers, which means that any key logger can take over the computer and find out how to penetrate the company. So the attack surface has really increased. The level of attacks has also increased. We've also seen attacks that are following the pandemic, like when people were interested in information in the early days or mobile application pretending to give you health information but were actually malware. Then when there were more websites that will -- that you do financial transaction, will get government paid, phishing sites or becoming these sites and get your credentials. And we see that phenomena going on all the time. I think now people do realize that, okay, we've opened up everything. Now we need to secure it. Again, in the early days, we thought it's for 2, 3 weeks. It's for maybe a month. Now we realize it's going to be not just for a whole year like the corona is, but most organizations are actually going to continue in a kind of hybrid mode work model in the future. So we need to secure that for the future, too. And I think that definitely presents some interesting opportunities and also a few challenges for people in our industry. How do you secure all that environment? How do you create a more holistic approach? Consolidation is becoming more and more important. When you have people that are trying to avoid being in the same room together or being even in the office, you want pure systems. So I think that plays well into our strategy at Check Point, but definitely accelerate a lot of the process that we were doing.

That makes a lot of sense. And maybe if I can ask you, Tal, as we look across the globe right now, I think it's fair to say we're entering a second wave of COVID. How does that impact your go-to-market strategy? How have you adapted to this new world? And how do you see that playing out?

I don't think I see a big difference between the first wave and the second wave. Since the first wave, when everybody had to practice their remote accessibility, we made a lot of changes, forced to make these changes; but it turns up to be quite a lot of opportunities as a result of the ability to work remotely. So I'll give you just a few examples. Marketing, everything moved to be now either digital, or even events are Zoom events or any other platform event, but everything is not face to face. It's an opportunity because we succeed. We talked about it before. We succeed to get much more people into these events, get new customers, existing customers, partners. So that's an example of a shift that had to happen very quickly. And we see many, many, many events as a result of that. It's just easier than finding a hotel and location and preparing and choosing the food and so on. So I think it's quite a nice ability to improve and touch much more people than you could in the past. So that's one example. Operationally, we had to learn to be agile. You remember, in the first wave, there was a lot of issues that might have related with the delivery of the units between the countries. We are very agile. We had a few issues, but we solved them like on the fly. So that was actually quite good because we were -- our model is running quite well in the way of preparing to the demand. So that works very well, and that continues to work very well. So that's required a different type of communication also with the vendors and preparation of the inventory and so on, just not to find yourself suddenly in a lockdown that doesn't enable you to deliver into the country. In terms of all the employees, collaboration tools, so the first wave, you had to practice how to do this collaboration. How do you make your meetings with the employees, with the customers, with the partners? Now everybody is well trained, and people are up and running. And majority of the people report much higher productivity than before, so that's nice to see. Mood-wise, I think it swings because all of us humans, when we check the mood of the people, then you see that, second wave, people were a bit upset about it, not with the company but with the situation. Everybody felt like, okay, after the first wave, we're coming out slowly and it felt nice. So everybody was a bit upset to get into the second wave, but we're investing a lot of time and energy and keep our people morale up and productivity up. So that's working pretty well, I think.

Yes. I think there is a little bit of fatigue in many companies. I don't want to tell you all about Crédit Suisse, but I hear this from other software companies as well, especially in places where we're getting into winter, more times indoors, less daylight out. I think people are looking forward to this time next year. Maybe moving on to a big quick picture question for you, Gil. Just I think you're credited as being one of, if not, the inventors of the stateful inspection firewall from many years ago. So I want to ask about security architecture. Recently, Check Point put out a press release highlighting that 81% of enterprises have adopted mass remote working, with 74% planning to enable it permanently. How does this change the way organizations need to think about security architecture for the future? Like do you believe this causes a fundamental shift towards security being delivered from the cloud?

I think we are going to see a lot of things from the cloud, and that started before corona. I'm not sure if necessarily security is going to be delivered from the cloud. Some capabilities of security -- I mean, first, I mean, if you look at our architecture, there are many things we are sharing from the cloud. We have our ThreatCloud at the center of our architecture or Infinity architecture. That's an amazing, I mean, real-time system that provides constant real-time updates and collects real-time information all the time from all over the world. And that's a cloud-based service, by the way, which is a great value because if we are seeing a malicious file in one part of the world and recognizing it, in the same second, it will be blocked all over. So it's a great architecture. There's other things like all these updates and all these information sharing and analogies that are very well done by the cloud. On the other hand, routing your traffic to the cloud, which gets analyzed, that sometimes makes sense. But a lot of the time, it's actually not the perfect solution. It slows down things. It's sort of the resource, and then the cloud are more expensive than the resources on the edge. And sometimes, when you talk about an individual machine, for example, when I'm connecting to the remote site, I can do the remote connectivity through the cloud, and that's fine. But to make sure that my home computer or my mobile phone are secure, that's something that, in many cases, requires an agent on the machine. By the way, the agent can work in a hybrid mode. Like, I showed my mobile, which is a great place, actually, when people are underinvesting because almost no company's using security software to secure the mobile, and yet the level of mobile incident is increasing all the time. Most of the analogies is down on the cloud, but you still need an agent to verify and check every application that you download or every website you're accessing to. So I mean the world will be hybrid. There will be many things that will be delivered from the cloud. But I think we still need a lot of edge software or even edge hardware, and that depends really on the circumstances.

That makes sense. And I appreciate that. Maybe to turn to what has become such a buzzword, I think, across many security companies out there and customers, which often happens when you get an industry analyst that comes and creates a new term or a buzzword, but I want to ask about SASE. You recently acquired a company, Odo Security, which I believe, you mentioned, will be the basis for Check Point's SASE solution. What does Odo bring to the table? And what are the other gaps that you need to fill to roll out on this complete SASE vision that I know that Gartner has?

So I think that the overall vision will take some time and it has a lot of components. Some will happen. I'm talking about the industry, not just in Check Point. Some may not happen, like every new technology shift. What we've done with Odo is -- or what we will be doing, we've -- although we just acquired the company, it's a small startup with very, very cool technology, seamless, clientless remote access powered by the cloud, can be provisioned in a matter of minutes and can be used by the end user in a very simple way. As a user, you go to a simple portal, and you can access all your assets. And now your assets may be on the corporate data center like they used to be for many years. They can be cloud-based assets. They can be with third party. And all the access to these assets, all the connectivity and all the security is managed and done smoothly by Odo. It's also multiprotocol. Unlike many other remote access solution, it's not just HTTP or web-based protocol. It also knows how to handle protocols like remote desktop and like remote SSH for management terminals and so on. So it's a very, very comprehensive solution, very small, very cool, and I think it's a great basis for a lot of the access that we will be providing.

Got it. And maybe just to look to another area within the SASE definition if you will. SD-WAN, which is core to any SASE implementation, you choose to partner for these capabilities. Other folks out there are looking to acquire. Why is partnership versus building out your own capability the right strategy? And might that evolve over time?

So first, we are likely to do both. Have some SD-WAN capabilities built into our edge gateways and have some that we will share and partner with others. And the reason is because kind of SD-WAN is on the edge between networking technology, and there is obviously, for every networking technology, there's also security elements to that. Now where it will end up, it will end up being a technology that security provider's owning or, like many other technologies, networking technology that's provided by the communication companies. That's a very good question. The leaders right now are not in the security space. It's companies like Cisco, VMware, and I think, eventually, the telco will be more and more active there. So we will, for sure, provide the added layer of security. That's what we've been doing forever, take every challenge in the IT space and provide the layer of security. How much of the connectivity layer we will need to implement in our product, that remains to be seen. So whether we will compete with Cisco or AT&T or VMware in building a cloud-based network to deliver traffic, that remains to be seen. I'm not sure that we will. And maybe it's better to cooperate with them. We will provide the added level of security, and we will provide because our gateways at the end, our edge devices, we will have the basic SD-WAN, or maybe not basic, maybe the more sophisticated SD-WAN capabilities built into our gateways around the world.

Got it. That makes a lot of sense. And maybe just taking that a step further, thinking about all the things that you've said about architecture, SASE and your approach to -- or thoughts about SD-WAN and how you're positioning in both partnering and delivering your own capabilities, I think -- and maybe this is just investors that get caught up in the distinction between proxies and firewalls. And I don't want to go back to the very simple of definitions. But -- and I appreciate your comments earlier about there being a need to service the edge in a very highly performant way. That will always exist. But as we think about what's happening as data and process proliferates out to clouds and we think about the distinction between a cloud proxy versus putting a firewall stack in the cloud, I think that there's a perception, at least among investors, that there's an advantage to the cloud proxy approach. Is that thinking flawed? And how do you distinguish -- are these comparing apples and oranges?

You can say it's apples and oranges. Both are fruit. Both you can enjoy them, but they are not exactly the same. Now sometimes it doesn't make -- by the way, for you, if you look for something sweet and a fruit, then maybe an apple will do it. Maybe an orange will do it. But they are not exactly the same. Now the proxies are much more limited in terms of what protocols they can handle and how we can handle that. And therefore, reach -- to this model when you, for example, handle mainly web trap, so when a proxy can do a pretty good job -- and again, especially if many, many things around the world are already configured, so we can easily just change the configuration and forward all your traffic to the proxy and without the need of additional layers. There's other application when you cannot change the routing of the traffic or let's say it doesn't use HTTP and it use the very more dedicated protocols, all the other Internet protocols that we have, in that case, the proxy won't work. For you, as a user, you don't really care. What you care is that your data is being secured, that you have -- by the way, where you do, do that solution, for example, we can do on the browser, inside the browser agent, which is lightweight, automatically being installed. Tons of the work with other vendors require a proxy. When you do it on the browser, you get many benefits. You get much, much faster. You don't introduce additional latency or delay. You don't share your data. One of the risks in any kind of gateway or proxy in the cloud is that your data is being now shared with the provider, and you may not want them to see what you're doing. I mean -- so privacy is much better when you're doing it inside your browser. So -- but for you, as a user, you don't really care. What you want is to log in and see that you can access the resources, that when you download the file from the Internet, the file is being inspected. I mean, for example, I use our solution, and when I download the file and tell me, analyzing the file, protect, cleaning up malicious content or cleaning up active content and gives me a file, I feel confident that I can open website. Or when I'm accessing a website and my browser checks that website, again, things that we have today, if it's a sort of legitimate website or a phishing website that imitates the Crédit Suisse website, for example, I feel very confident about it. I don't really care if it's done by an agent on my desktop or if it's done by a cloud service somewhere else. In our case, by the way, it's usually hybrid. The agent routes the traffic, gets the fastest route, gets the easiest way to do that. On the other hand, the wisdom, the sharing of information is usually done by what I mentioned before, the ThreatCloud that serves that. So that would be the preferred architecture for me, but we will also have a lot of components that are done holistically in the cloud in cases where customers want to route all their traffic to us.