Check Point Software Technologies Ltd. ($CHKP)

Great. Thank you. Good morning, everyone. My name is Brian Essex, I'm JPMorgan's large cap mid-cap software analyst. With me today, I'm very excited to have Check Point. To my right, we have Roei Golan, CFO of Check Point. Very excited to have Check Point new Chief Revenue Officer, Sherif Seddik. And to my left is Kip Meintzer, the Head of IR for Check Point. Before we kick it off, we'll pass it to Kip for a little safe harbor disclosure.

Thank you guys for joining us this early morning. During the course of this presentation, there may be forward-looking statements as with all forward-looking statements that carry risks and uncertainties that could cause material differences from those that are expected. If you'd like a comprehensive view, but not exhaustive view of all of these risks and uncertainties, you can right before bedtime, take a read of our latest 20-F, and you'll get some good sleep, but you'll have access to the majority of those risks and uncertainties out there. As with all of these types of call-outs, we reserve the right to only update where required by law. With that, I'll throw it back to Mr. Essex, and he can begin.

You didn't even need a cheat sheet for that.

I know. Too long.

So yes, thanks, Kip. Maybe a great place to start, Sherif, we could start with you. Recently appointed to Chief Revenue Officer. So congratulations on that.

Thank you very much.

I would love to maybe hear a little bit about your background and initial thoughts as you've taken the role and what you think impact that you can have is and might do differently?

Great. So Sherif Seddik, I'm originally from Egypt, I have a degree in communications and electronics engineering. So enough to know about technology that I always say nobody can tell me stories about technology. After graduating, I've been in the IT industry for more than 30 years now with 4 companies. I started in Dubai with NCR at the time. Followed 13 years after that, another 13 years with Microsoft in different roles then 7 years at Citrix and now 3 years at Check Point. I'd say what's unique about my career is that particularly in the early part of my career, I kept moving between emerging markets and mature markets. So I've lived and worked in 8 countries. And throughout my career, while predominantly in sales and sales leadership I've deliberately chose to do other roles along the way. So I did product management at a certain point of time, I led consulting businesses at a certain point of time. And probably the most common theme in all my roles has been around really driving change. So I've done things like turnarounds, transitioning businesses to subscription and SaaS models. Launching new products and incubation businesses. So that's really the common theme. Probably most interestingly, my last role at Microsoft was running the Enterprise business in Western Europe, which is a $3.5 billion business. At Citrix, I started running the EMEA business for 5 years than the last 2 years, I was running commercial strategy and go-to-market strategy worldwide where I was responsible for go-to-market design, all the strategic partnerships for the company with the hyperscalers and the largest systems integrators, running sales enablement, all of the back-end sales programs, et cetera. Here at Check Point, I started at EMEA President, after a year got promoted to Head International. And now just 2 weeks ago in this role, and I think what I bring to the role is a mix of really experiences with large and similar-sized companies. So knowing how to build systems and go-to-market models to scale. Also the fact that I've done strategy roles and execution role, so I really can straddle both. So when designing new programs, et cetera, I really understand what's the level of detail. And I'm excited about the opportunity ahead for us. I think that with the way the market is going, positions our 4 pillars that we choose to be in, in a unique way that really adapts to the challenges that companies face with AI and the transformation of AI, et cetera. And we have massive opportunities. So very excited about helping the company realize them.

Great. Great. And how should we think about, I guess, the depth of change within the organization. There's a lot of focus, particularly on the earnings call about the changes on the go-to-market motion of the company and how disruptive that was to parts of the business. How deep does that go? And how long do you think that this transition period lasts for the business?

So this process all started in the middle of last year, kind of where our transition in strategy as well around the 4 pillars and the desire to move to multi-pillar selling, et cetera. We did a review of our go-to-market model and said, is that go-to-market model will enable success for us in multiple of years. So being successful in all of the different parts of the stack that we want to operate in, focusing on building sustainable double-digit growth. And we realized that our go-to-market hasn't had really a significant change for 4 or 5 years before. And when we looked at where the market opportunity lies is what we realized, we need to do a significant change if we are to build towards that growth. So there are really 3 objectives of the go-to-market -- so one was around how do we accelerate growth, how do we put resources behind where we believe the growth is going to come from. And we believe the growth is going to come for us from large enterprise customers. from increasing our new logo acquisition. And obviously, you've all seen in the results our SaaS and subscription businesses have been seeing very healthy growth, and we wanted to fuel and double down on that growth. So we invested in these 3 areas and transition resources through those 3. The second thing was around, as more of our business transitions to subscription and SaaS, thinking of the whole customer journey becomes very, very important. So we also moved resources to our customer success organizations, we wanted, particularly in the territory part of our business to focus sellers on new business. So we increased the staffing of our renewal businesses to look after the renewals exclusively. Third thing that we've tried to do with it is how do we improve the efficiency and build scalable model. So we moved resourcing, for example, to marketing funds and partner programs as ways for us to scale the business. We also looked at the efficiency of our sellers across geographies, et cetera. So it was really a whole review and the results were pretty deep. So roughly 1/3 of our people were in a new role. And even many of those that are in existing roles, particularly our account finances and partner managers as we focused on fewer larger customers and fewer partners, they had new sets of accounts. So all of these things resulted in that disruption. However, we are absolutely convinced that it is the right model to take us forward. And we believe now that we've really exited the disruption phase or into execution phase. We're starting to see acceleration in our funnel generation across the different pillars, including firewall so I think we're on a good trajectory to start seeing the benefits of the change.

And how many of those changes were just shuffling seats within the organization versus hiring new talent from outside the organization.

So I'd say about 50-50 roughly. So one of the other things we're doing at the moment, we do have an accelerated hiring path. We still have a number of in all of these different roles, customer success, especially sales and generally sellers an accelerated path. So it was about 50-50. So we didn't just move seats. We really did a strong evaluation process of the people who are changing are they the right people for those roles. .

And how should we think about the disruption in the quarter? I mean it was very heavily weighted towards product, at least in the results. Was it a function of the pipe was disrupted and product just gets converted faster. I mean the product is converted faster somebody that I saw it sooner? Or was there something unique about the dynamics around the Quantum firewall platform that just made it more susceptible to disruption as you made those changes.

I'll start and then I'll let -- the product, which is the firewall appliances, was mainly -- most of the changes that Sherif mentioned was in the generalist team. So I mean, of course, we had many people to the other pillar to the specialists, but most of the changes of the roles that we are talking about, we are talking about the car managers, they changed their roles to be, I don't know, or specialist or even territory managers. That was mainly affecting the account managers that are working on firewall business. Renewals, it's less effective because in renewals in the end it's renewal, so you don't need -- I mean, it's good but is less affected, but on new business, when we are looking on new business and the final generation that usually the main quarter that was affected is Q2. You're looking on our guidance for the second quarter because Q1 was slightly less than what we expected -- was less than what we expected. But in the end, the main impact is Q2 because of this disruption and the changes, we did see -- we did see that the pipeline -- because the execution was -- took more time than what we expected. We see that there were delays with pipeline generation in the beginning of the year. We started to see and this pipeline that's usually affecting Q2 and Q4, it's not affecting Q1, most of the firewall net new business, the sales cycle that is between 5 to 9 months, I would say, sometimes even more than that. So that's mainly affecting the Q2 and Q3. So that was the fact that because of -- we did see less pipeline that was generated in the first month, I would say, even in the first 2 months of the year that have a direct effect on our Q2 numbers and also some on Q3 numbers. So -- and therefore, I mean that's -- therefore, we provided this updated guidance, and I saw and that's affected mainly the product because it's new business. On the other pillars, we did actually well. Again, also the well changes in the other pillar. I mean, the specialist we did -- we had it many people there, but I think that the disruption was less there than -- and mainly on the core business on the generalist.

And when you say new business, not necessarily new logos.

It's new logo and net new projects. Just replacing all the plants with new.

Do they not include a refresh?

Both refresh, but it's mainly the effect of the pipeline. It's net new. It means existing customers that's now buying -- doing extension data centers, that's the main effect or new logos, but both...

Sherif, maybe touch on the makeup of salespeople, the hunters, the more seasoned people that we're hiring, chasing after new logos and that approach.

Yes, I think -- so historically, we've had our account managers handle both existing customers and prospects. And what we've done in the current model, particularly with the focus on very large enterprises, we said for our strategic segment, the largest customers and the very large prospects, we are now going with a hunter farmer model in that space. And as a result, we are hiring that the hunter profile is a provider we didn't have, and we're doing a lot of hiring and expansion on that. In the major space, we still have the mix model. So that's another change. The other change that we've done also on the specialist side is wherever we have the scale, we've assigned the specialists to either work on the strategic nature or the partner-led motion, et cetera. So that was another mix in terms of historically, our specialist works across all sizes of customers wherever we have the scale now we've separated them. So we're putting a lot of focus, as I said on large enterprise and separating the motion between new customer acquisition and existing customer expansion. I think in terms of where we're seeing the disruption and the changes, et cetera, particularly on Q1 is -- when you look at our specialist teams, the impact of the change is increasing the number of resources. So the teams were relatively stable in Q1, so that's why the subscription businesses continue to see growth. And our subscription businesses generally have a faster sales cycle as well because the firewall project -- data center projects tend to be very complex and so -- so that's why the impact is a little bit less on the subscription business for Q1, Q2, while for firewall, we're expecting to start seeing the uptick again from the latter part of Q3 into Q4. And we are putting in place a number of strong initiatives around further accelerating beyond the pipeline increase that we've already seen. So we are launching a very strong competitive placement program. We are launching a program on the AI data center. We see that as a huge opportunity for us. We've already had some wins. We're seeing an increased pipeline. And the third thing is something that we are evolving into more focus on vertical use cases. So we're starting with industry and manufacturing vertical where we have identified 3 use cases that, again, we're building strong pipeline on. So a few things in terms of not just changing the go-to-market structure, but how we go after things.

So maybe if I could peel back a layer on all of those comments. So one is how should we think about the timing of the disruption that you saw is that -- if these changes are did earlier last year or the middle of last year, is that when the disruption started or is a disruptive impact more of like for 1Q and then that kind of hit the near-term particularly considering like the sales cycles, the duration of the cycles that you see on product side?

Yes. So I'll walk you through the process. So Q3 last year was really all about the analysis phase and the consulting phase around that. So at that stage, it was a relatively small group of people that kind of that we're working on that. By the end of Q3, we had the new design in place. And then Q4, we're all working around the change management and so we started to bring field leadership into this in the middle of Q4 of last year, okay? And so you could say, to some degree, there was in the latter part of Q4, not field disruption, but obviously, the management teams were thinking part about executing on Q4, part about preparing for the change. The change was launched to the field on the sixth of January. So that's why as Roei mentioned, like pipeline generation in January and February were really, really disrupted because of that people were learning with new roles, they are new territories, who are their new teammates, what's the new way of working that we're expecting. In February, we started to see an uptick in funnel generation. March was very strong, April even stronger from a year-over-year comparison. So we're starting to see signs of that, okay, now we're starting to get out of the disruption mode and into execution mode. And the pipeline generation increase that we're seeing is across our product portfolio. So it's also showing that we're starting to hit the areas that we want to hit. So for example, pipeline for new logos is growing faster than overall pipeline which was a big focus of us, how do we increase new logo acquisition. We're starting, as I mentioned, to see a pipeline increase in AI data centers, which is our target motion, our AI security pillar we're starting to see significant changes in that. So what we're seeing is not just pipeline increase, but pipeline increase in the areas that we were strategically designing the change to do. So that's giving us confidence. Again, the changes are starting to land. But as with any change of this magnitude, it will take 2 quarters more -- to get back to smoothness again. So we're expecting that at the end of Q2.

Okay. That's helpful. And you mentioned competitive displacement program. What are some of the aspects that you're leaning into with that program? Is it more aggressive pricing or sales incentives or better channel compensation? Like how do you think about the major levers in that program?

So there are 3 levers that program. So one is really focusing on use cases where we believe we have strong differentiation against the competition and giving our sellers and our partners kind of the playbooks saying these are the use cases where we believe we have a high opportunity. Then the second thing that we've done is around the partner incentives. So we put in different levels of partner rebates and partner acceleration on that. But also in terms of like preapproved pricing levels to speed up the process. And the third element is around the customer offer itself. And the customers care about -- what care about the most with a transition like this is how are you going to sort of safe harbor me to the other side. So we've included prepackaged services as part of that to make sure that the customer transition we've created tooling for example, to automate the transition of policies and rules from other vendors' platforms to our platform. So that's another important part of that. . And the third element that we believe this year is also going to be helpful is we've now put in CapEx and OpEx models for the customers. So as you know, different industries are more capital. So now we have a compelling offer whether you're CapEx focused or OpEx focused. So we try to cover all of the different elements of -- and what would make a competitive displacement success?

And on the pricing side, is that affected at all about how you go to market and competitively priced against your peers?

So we've done a full analysis on kind of pricing and not rather pricing points for these different displacements? And we've already, in a way, preapproved discount levels to get this pricing from day 1 that we believe would get us to that. But we also wanted to make sure that, that aggressive pricing does not seed back to our normal -- so we have a number of policies around proof of displacement and like that to make sure that we are ring-fencing the pricing around that model.

Got it. Got it. Very helpful. And you mentioned data center business and AI data center is now one of your peers calling out that as an opportunity as well. What -- how large are data centers as a percentage of your total business?

Significant. .

Yes. I mean so significant meaning like.

Significant. And I would say -- no, more than 1 -- I mean, other firewall business, not of the total business.

The total firewall business.

Yes, yes. The majority of our business today is data centers.

Yes. And so how do you -- how should we think about how you're positioned for AI data centers? And do you have a lot of visibility into AI data centers as opposed to data centers that customers may also be running AI inferencing on. How are you seeing that market play out?

So I think. So first of all, we're starting from a position of that because the data center is the area, and as Roei mentioned where the majority of our business is where you already have a lot of a lot of differentiation. As we evolve to the AI data center models, we think we have even further differentiation, and that comes from a couple of things. So one is, first, our partnership with NVIDIA. And so as you know, kind of AI data centers are running nearly at 100% capacity all the time. Latency is a huge issue kind of for these data centers. They are running multi-tenancy. They are running multi-workload -- so the fact that we have our partnership with NVIDIA, where we put our firewall effectively on the DPU addresses many of these issues. So first of all, it addresses the latency issue because you're on chip. The second thing is also because you are on the DPU, not the GPU, so you're leaving the GPU to do its work, you're not affecting the capacity from a GPU perspective. But it's not just that, that's just one factor of it. It's when you combine that with the rest of our product portfolio when the magic happens. So if you look, for example, if you look at the training side, it's only the firewalls on the DPU that work. On the inference side, then you add the AI guard rails through our acquisition of Lakera, and that, again, provides another layer of then on the data center side, with the traffic increase, the fact that we have our Maestro model, which is the best scalability in the industry can help us through that. then you come in and you include our WAF solution that addresses security for how do you address the -- access the application, the user access the application, et cetera. So you take the different parts of our portfolio, and it's really a compelling complete, differentiated solution. And we've already seen wins in different parts of the work we had in Asia. We had wins in the Middle East. We're in discussions with some massive opportunities in the Americas and in Western Europe. So we really see this as an opportunity for us so we now have a standardized architecture against standardized services for delivering it, et cetera.

And how large are these deals relative to the rest of the deals that you see in your pipeline?

So there are -- they're among the larger sizes inside of the deal. But the other thing is some of them as well become opportunity openers for other -- so we've won a deal recently in Asia. And these guys are providing services for application and AI application development for companies in that specific country. And what they become now is now they've utilized our services, but they are including them as part of what they sell in terms of and here is the security package secure the application, the AI applications and the LLM you're building on our factory. So the deal itself is bigger, but it has a multiplying effect from...

And do you have a sense of within the AI data center opportunity, I mean, how far along are we with data center build-outs? Has this been happening for quarters because a seen a lot of CapEx spend? Or is -- are we at the point where you've seen some of these data centers get built out. They've kind of figured out what they need. So now is when we're starting to see more demand on the security side to follow that initial spend?

So we think that the investment cycle is only starting. So in the initial phase until now, it's mainly been the hyperscalers and what we're now seeing is large enterprises are getting the game because of privacy issues or data software and laws that they have to buy to governments are getting into that again for data operator reasons and all that. So you're seeing new types of players that are into the AI data center. So we think the cycle is just going to accelerate because of that. And we think frankly, many people still don't know what they need. They know they need something, but they don't know what they need. And that's why having this standardized architecture that says like the discussions we have with the customers is you're embarking on this journey. These are the things that you need to think about, and this is how our technology. So it's also a very, very consultative sale that we're doing because we're helping customers understand here are all of the things that in the AI world, you need to deal with that are different from what you used to deal with before. .

Right. And Roei, how does this line up with the Quantum product cycle? I mean, we're pretty well into that now. And that was, I think, one of the issues this quarter, your comps last year were more meaningful. But from a product cycle perspective, is there another cycle in the wings? How do we think about the cyclicality of that firewall business after the most recent.

I know that we'd like to call it a cycle, but I think in the end, of course, we had last year, it was a strong -- did have a lot of refresh projects. last year and I think also 2 years ago. But also when I'm looking today on what we have now is just with our installed base, even without accelerate -- I mean, gaining new logos, acquiring new logos, I think that the potential to grow and firewall is there. This is even without AI data centers. We've talked a lot about data centers. I think the -- there is a lot of potential even for our current installed base, they still didn't -- I mean active customers, they still didn't place all the appliances. They expect to replace it in -- or in this quarter in the remaining of -- or in the second half of the year. Again, I think the guidance right now takes it to a cut that we're going to see some decline in Q2 and probably also in Q3, but that's mainly because of internal disruption because definitely, we do expect to see back to growth in product from Q4 and afterwards. So -- and again, that's based on our internal metrics, based on what we see. Pipeline to keep as Sherif mentioned the pipeline generation. We see very strong generation in the last month, in the last few weeks. So we do feel more positive with the firewall back to growth from Q4.

Got it. And I know on the earnings call, I think Nadav was pretty adamant about macro not having an impact this quarter. He's very focused on the disruptive aspects of the quarter. But how is customer spending overall? Are you starting to see access to budgets outside of traditional IT budgets and then maybe part B of the question is, have customer, I guess, spending intentions change since Mythos and GPT 55 emerged and people started freaking out a little bit.

I would say it's a good question. I think that, of course, that there will be more spending on AI, but I don't -- actually -- and again, Sherif can also comment but by what he sees, but I don't see the security budget going down. I think that security will continue to go up, of course, in terms of priority. I think that network security is a top priority. I mean, you're going to see more volume of data that's going through the network because of the AI. So I don't see our network security. I think that actually the budget for network security should go up. But again, right now, I think Nadav mentioned, it's not the macro. I mentioned in the beginning of the when I gave the guidance for the full year February, I mentioned that there might be some changes in customer behavior because of the rising cost of the memories. In the end, it's something that we also see today, the memories. It's crazy what's going on there with the -- I mean, the inflation of the pricing. But I have to say that right now I don't see -- I mean, I don't see it across the board customers sweating their assets because of memories because of the memory cost, it might happen. But right now, I think we've been very clear that what happened in Q1 and the reflection in the guidance for the -- I mean, the update of the guidance for the full year was not as a result of macro.

I'd say what we're seeing with customers is definitely an increased focus on cyber security how to reprioritize within the cybersecurity space. So it's definitely becoming more top of mind, Board issue for sure, more than ever before. Have I seen that as a result of that, the persons are open and someone is saying now your cybersecurity budget is 30% more, et cetera. We haven't reached that stage, but there's definitely no sign on the horizon of the budgets being stable or reduced. But what we're seeing is customers really thinking, okay, where do we need to invest based on the changes based on what we're going to see happening like -- that tsunami of vulnerability that's going to happen. How do we react to that in terms of our processes so that we can prioritize how do we change our patching processes, et cetera, in order to speed up. And we think that, that's bringing, again, for us, benefit. So the whole topic of exposure management is becoming much, much more critical. We are finding ourselves in significantly more discussions around our exposure management portfolio than we have before. And there, we have a unique -- a number of unique assets. One is through the acquisition of Cyberint. We got a lot of external vicinity. You combine that with all of the telemetry that we see from our products, and you have an incredible basis of intelligence to start from. Then through the acquisition of Verity, the fact that we can then go and implement things across multiple vendors and not just power side of things. The fact that we can -- now we are now developing capability to enable us if the customer allow that we, based on certain rules can go on auto patch, not -- again, not just in our technology but others. And so that's creating a lot of strength in that. Then network security is becoming in fashion again in different things because, again, like topics like segmentation, for example, and microsegmentation become more critical than ever because if you assume someone is going to get there, how do you stop lateral movement. So that's increasing, again, demand for firewall for segmentation purposes, which had slowed down in the last couple of years, AI data center. So we also feel that our choice of pillars to invest in is being vindicated by the changes and so there AI security, the investment there, top priority, exposure management top priority. People will need to rethink the network security posture where we have our prevention-first ethos and a lot of the things that we had in the past. So we're very positive about where the industry is going and where that allows us to position ourselves.

And how are customers thinking about -- I mean, obviously, 1 of the themes that we're seeing, particularly over the past couple of months/year-to-date is a collapse of the meantime to exploit, right? So now speed is becoming even more critical, not just in terms of finding the vulnerabilities, but quickly responding to those vulnerabilities or exploitable vulnerabilities. How do you view your platform? Is a tightly integrated platform an advantage in that situation? And maybe if so, how would you describe how that advantage plays out in terms of the ability to react in a faster way to some of those exploitable vulnerabilities.

Yes. I mean, I think the topic of -- we get asked a lot about the topic of our unified platform versus we talk a lot about our Open Garden and open approval. And I think it's important that we position that in the right way. We are not going away from platform and the benefit of platforms. So for each of our sellers, we're building a platform for that entire pillar. So if you look at the AI defense plane that we've launched around AI security, that's again, a full platform that covers protecting your data center to protecting the use of generative AI to protecting kind of your LLM and agents and the full stack full platform. If you look at Workspace, again, we have e-mail and collaboration endpoint, mobile, SaaS, SSE kind of part of that. So again, in each of these, we are building a platform. And what connects underneath is our threat prevention protocols, et cetera. And then we're also building a unified management across all of these. So we're not going away from us building platform. But what we're seeing is we're also realistic enough to understand that customers have installed base, customers have choices and that frankly, if we as a company, we wouldn't bet our cybersecurity on one company because that becomes an exposure in its own right. So what we want is still, if you use another vendor, we still offer you the best protection with that. Example, our workspace management play. You go and it's built and you get the best experience and the best protection if you use everything from However, if you use crowd strike for endpoint, you can still go and position and configure and say, "I'm using CrowdStrike. And then we will manage your entire workspace, will it be as good as if the whole thing is from us?" Of course, not because we don't control the whole stack, but we will still offer you significant capabilities to still have visibility across your entire workspace.

Where across your platform are customers saying, all right, native integration with this product is the most important. So we're going to beat a CrowdStrike and endpoint or we're going to beat -- kind of both for vulnerability or exposure management like where do you get that leverage from being able to accelerate your time to react?

So we get that leverage from -- so we build obviously, integrations for us, but we are building predefined integrations with other vendors as well. So for example, with Wiz and the partnership we have with on the Synapside or with Illumio the micro segmentation side. But then we also look at the entire usage of customers and we take what are the most important platform to integrate with Endpoint, CrowdStrike and Defender. So that's the majority. So we're going to focus there first. So we have more than how many now, I think 80 native integrations with competing products and some others. .

Great. With that, I think we're out of time. So Sherif, Roei, Kip. Thank you so much, everyone. I appreciate it. It's great to see you.

Thank you.

Thank you, everyone.