Cisco Systems, Inc. (CSCO) Earnings Call Transcript & Summary

Hello, everyone. Thank you for joining. I'm Heather, your Webex host for today's event. In a moment, I will turn things over to our speakers. So before doing so, I have a few housekeeping notes to cover. Please note you've been muted. Should you have any questions, please ask them by using the Q&A panel, which is down at the bottom right of your screen. When submitting a question, please be sure to select all panelists. And if you happen to experience any issues, please reach out to me directly. With that, let's get started.

This is Marty Palka, Cisco's Investor Relations. Welcome to Cisco's tech talk on our securities business. I would like to introduce today's speakers, Jeetu Patel, Executive Vice President of Security and Collaboration; and Tom Gillis, Senior Vice President of Security at Cisco. Jeetu and Tom will have an interactive conversation with Tal Liani, Managing Director and Research Analyst of Security and Networking at Bank of America. [Operator Instructions] Before we begin, I'd like to remind you that we will be making forward-looking statements today. Actual results may differ materially from those forward-looking statements and are subject to the risks and uncertainties found in our 10-Q and 10-K. With that, I'll turn it over to Tal Liani, Bank of America Managing Director.

Thanks, Marty. Thank you very much for joining us. We recently upgraded Cisco, and one of the reasons was expected improvements in security after Jeetu joined the group about 18 months ago, if I'm not wrong?

Tom joined 18 months ago. I joined 3 years ago.

Three years ago.

Build out the team.

Yes, I know. And we're going to talk about basically the market and Cisco in the market and how Cisco is changing to address changing needs of the market. So with that, I want to just welcome you, Jeetu and Tom. Thank you very much for doing this.

Thank you for having us.

And I want to start with a high-level question because we want to understand when we ask your competitors about how is Cisco in security, you're obviously one of the largest companies, if not the largest company in the space -- in certain markets. And they're talking about some share losses, and you made changes in your strategy. So what is the strategy of Cisco in cybersecurity? What are the markets you're addressing? And what are you leveraging? As a leading networking and security company, what are you leveraging out of all your assets in order to improve your position in cybersecurity?

It's a great question. There's a couple of questions in there. So let me just unfold them. Firstly, I think if you looked at us 5, 6 years ago, we had some work to do on the product portfolio to make sure that the portfolio is world class. And Chuck's talked about that at earnings. And we have gotten to work about 3, 3.5 years ago to make sure that we built a world-class platform because I think the industry is moving from a lot of point solutions to integrated platforms. And as we -- so about 2 years ago, we launched this vision around the Cisco Security Cloud, which was our platform that abstracts security services from hyperscalers. And you can basically acquire this in all traffic to any of the cloud providers. And as you move your workforce from one to the other, you can process policy. The interesting part of it here was, as we thought about it, what are the big problems we want to solve in the Security Cloud. There are a few that I can remind that's how we structure. The first one was we have to make sure that it's built in the foundation of our own. But we want to protect the user from many threats and attacks that they might have in the IP that they might actually use them. So user protection was the first objective. Second one was cloud infrastructure and cloud protection. And then the third one was breach protection. So you could actually make sure that in near real time, you can detect, respond, remediating the cover from a breach. As we started building that and the definition of a platform that's traditionally understood in the industry is you have to have common login, common telemetry, common design language, common sort of policy objects so that you could have one way to go manage all of these solutions rather than having a bunch of different piece parts. We actually agreed to all of those, and we've done all those, but we've taken one step further, which is I don't think in today's day and age especially with AI being weaponized against humans that you can have a platform that is actually not built natively with AI for the defenses. But one of the things we did was we said we have to have deep hooks into the infrastructure. To your point of like, what are you doing with networks, I think networking and security are coming together. And if you don't have deep hooks into the infrastructure and deep hooks into the applications, I just don't think you would effectively do well. So the last point I'll make on where the strategy is really differentiated because if you assume for a moment that the endpoint is compromised and that the attackers are going to be in your system, and you assume that the end-to-end traffic is always encrypted, it's really hard to see what's happening and what's transpiring and what anomalies can we detect for the packets that are going through the network unless you have presence also on the server. You can see every IO operation and every process that instantiates on the server as well. And so not only do we have presence on the endpoint. Not only do we have presence on what's happening on the network but we also have presence now in the server, build that out. We hired almost the entire NSX team to go do that. I mean it was -- it's actually been a fantastic -- and they'll be generally available in the late July, August time frame, but we are oversubscribed on early access. We cannot take that many more customers because that much demand coming. So that's basically what we've done, our move to the platform, AI and the fabric, identity of the fabric, user protection, cloud protection, breach protection on the foundation of firewall.

That's the strategy. Where are you on the journey to achieve your goals in terms of product availability, in terms of go-to-market, everything that makes the strategy into reality?

Go ahead, Tom.

So the name of the game is product excellence, putting these pieces together in a way that it's easier for the customer to deploy and create a better security outcome. The user protection suite is the most advanced in this regard. So we've taken what used to be 7 separate functions: firewall, IPS, VPN, zero trust, browser isolation. We built this into a single integrated console, one login, one set of policies, one set of capabilities a customer can deploy it, works on-prem, works in the cloud. That's the direction that we're going. The breach protection suite is probably next in terms of its maturities. So we introduced a new technology we call Cisco XDR. And so it's a real-time analytics engine that can identify unique sources of telemetry to build automated actions necessary. And then the cloud protection suite is a place where we're putting the current amount of focus. Hypershield is a premier part of the cloud protection suite. That's where we're at the journey.

I'll say on sort of pure evolution, we have -- since we launched the capabilities in the platform, in 2023, we probably have had more innovation in security than we did in the history of -- in the past previous decade combined. And I think '24 will see multiples of '23. So what you have seen as kind of rate and pace of change within Cisco has actually just never been experienced before. And I think we have -- overall the entire leadership team, we've invested a lot of dollars into this. And you're starting to see meaningful change in sentiment in the market from both partners and customers alike. We recently had at the St. Regis probably 2 months ago, 41 CISOs that came in that we wanted to give them early access to some of the stuff. They all came in slightly skeptical. They were not really sure. By the time they were leaving, 100% of them said this is one of the most game-changing strategies we've seen. And you're showing execution because everything we showed against that strategy were products being built on the ground up that are in general availability other than hyperscale. So our SSC product, available in market today. Our XTR product, available in the market today. Multi-cloud defense, available in market today. Identity intelligence will be available in market by this month. You talked about Hypershield, will be available in the market by August. So like there's a fair amount of innovation that's happening to take these products to market.

We touched on many things, and I want to go back to something you said. You talked about the platformization platform. And what Palo Alto spoke about is, Microsoft is doing, but what -- first of all, what is the difference between bundling and between platformization? And where are you on the platformization? What are the benefits that you bring to customers that will enable you to gain share on top of -- as you said, on top of the firewall that you're having today?

Yes, it's a great question. And so let's break this down a little bit because I think there's 3 stages that companies go through. The basic stage, which is just bundling, is just purely a discounting exercise. So it's interesting, but not consequential. What actually gets me really, really interesting is when you brought a common way of managing identity across the products. We have a true way to make sure that you can manage their policies. Your policy objects are commonly set so even if you set them in different places, there's actually no contention between the policies. You have a common design language, which we have between not just our security products but between networking and security. So those are the sort of -- and common telemetry. So the first aspect of the platform is common identity, common design language, common telemetry, common design language. And then the second piece, which is what I talked about earlier, is deep hooks into the infrastructure. So if we happen to have Hypershield that we built, which is basically a distributed security fabric, you can have multiple enforcement points, and you take security to the workload. If you want to show go out and secure a factory floor, you can do that. An IoT and OT device, you can do that. If you want to go secure a microservice or Kubernetes container, you can do that. And security gets distributed in this hyper -- in a highly distributed network. As you do that, one of the key things is, where does that security actually get enforced. We can -- over time, we will be able to enforce security on a GPU sitting on a net, on a server or even a top-of-rack switch. That is deep hooks into the infrastructure. The way you think about this, if you've taken security, melted it with the fabric of the network. That's something, by the way, that no one else does quite the way that we do because we are -- if you think about what is the name of the game in security, it is to prevent lateral movement, assuming that the attacker is already in your environment. And they're going to make tops to help you steal data, right, and cause harm. Who knows the most about lateral movement? Cisco. Who has the most -- where does lateral movement happen? On the network. And so the more you can go out and detect lateral movement, the better off you're going to be. And that's what we've been able to do. That, we believe, is when you actually have a true platform, you have hooks into the infrastructure. Anything to add, Tom?

No, I think that's it. Yes.

So we're a financial analyst, and we look at things in dollars and cents. And the question is, when you -- at the end of the day, in the last few quarters, you've grown submarket, meaning you've grown 3%, 4%. And there were times that you grew 10% and above. Two questions. Number one, can you break down your growth in the last few quarters for us? What are the growing parts? What are the declining parts? I'm sure it's a mix. And then second, how long does it take you or will it take you to translate all this innovation into better world?

I can't comment about it. We're in a quiet period right now, so I can't comment too much about specifics, but I'll give you some macro pieces on growth. In general, when you take something, you take on an endeavor like what we had taken on a few years ago. We basically rebuilt our platform, right? And there's a few things that need to happen. You have to make sure that you're building out the products, and you've actually got market recognition that, that's happening. But there is a level of that, that's organic, where you can't just go tell them. People have to tell each other. You're now finally starting to see that momentum start to shift. And we've only seen that happen now in the past quarter or 2, where you could probably see the difference in sentiment in partners and in customers. And we're now starting to replace some competitors as well, which is great. I think it's still a long game. It's not going to be something that next quarter, all of a sudden, you can see that. This is a consistent, steady movement. And the way that we think about this is we're in this for the long haul. We've built capabilities that we're going to continue to keep investing in. And we're going to make sure that we have deep hooks into the network. And we're going to use our advantage that we have in the network to also make sure that we drive security because where security meets the network is where we shine the most.

Two questions. Competition and pricing. Is -- cybersecurity is one of the most resilient spending in the network. But we see a lot of competition. For example, Microsoft, that turned from a small player to a giant player in the space. How do you view competition? What are the areas where you think you're going to excel versus competition? And where do you see bigger competition? And then secondly, how is pricing environment in cybersecurity? Is there any price element of the competition? Or it's more about product, technology, benefits of platformization, et cetera?

It's a great question. Why don't you start and then I'll actually add on to it?

Yes. So customers care about outcomes. And so we think about how we deliver a better outcome than our competitors. Now when we think about in the eyes of the customer, who are the stalwarts of their IT structure? Microsoft is still at the top of that list. So we don't view Microsoft as a direct competitor. We view ourselves as complementing Microsoft. They have unique capabilities on the endpoint and the application. We have unique capabilities that connects the endpoints to the application. So folks think much more into our competitive targets are going to be folks that are in that network security, Palo Alto networks supporting that. Zscaler, they are much more in that domain. And the way we can win is not just like coming up with some security feature that they could copy. It's by coming up with things that are uniquely advantaged by integration into the network. And that's our core is what can we do to put security into the fabric of the network that allow us to be more effective for our customers. And I think the market has been looking for that, frankly. The opportunity, in my opinion, is fairly obvious. And it's up to us to be able to articulate here's how that works and your customers can experience. So as we start to roll this stuff out, we expect continued growth in terms of just our awareness, presence in the market and customer adoption.

Let me add a little bit more color because I think this is where our acquisition of Splunk will be very strategic as well. And so what we've done with our surveillance and then how all of these things come in. So firstly, what is our high-level areas of differentiation? Three things. We want to make sure that we can have meaningful differentiation and efficacy. Efficacy should be higher because we've actually got an end-to-end view of everything that's happening in the endpoint on the network as well as on the server and the host. Number two, our experience has to be better. The way in which we manage, we've got generative AI now as a user interface paradigm across most of our products at this point in time. We've got a software system, we've got a firewall system. You could set policies and just natural language and English. And number three, the total cost of ownership for customers. The economics will be more favorable, right? Now as you think about this from a competitive standpoint, I think it's important that we understand where unique differentiation for us is. Like Tom said, when you think about who has the data on the endpoint and telemetry -- Cisco is a data game, right? And security is a data game. And the one who has the most data that can be most effectively correlated with, we've got over 250 million endpoints with AnyConnect. We've got a fair amount of traffic that traverses our networks at every packet and every e-mail forward is -- and every web request that's happening. And we now have presence on the host with [indiscernible] DBPF and with Hypershield that we built, where we will now have every single IO operation and process that's getting kickstarted in the kernel without actually being in the kernel that's sitting in the user space. That combination of telemetry then combined with Splunk is something that is very hard to go up and replicate overnight by competition. So when customers are rethinking their architecture for AI-related data centers or for enterprise data centers or for the public cloud workloads, and they say, what's the one end-to-end platform that we can bank on? What we're starting to see is the lightbulbs are going up, and Cisco has the best and the integration at this point, where things like ThousandEyes just seamlessly integrated into our product than we've ever had before. And so it does -- our challenge right now is how quickly we can see awareness in the market. But we are starting to see that curve to be pretty exciting to see.

And just my second question was on pricing. Is there any pricing pressure in cybersecurity on cybersecurity exhibitions?

I think the pricing dimensions are interesting because what's happening on pricing is we've been spending more money in security year after year every year for the past couple of decades. If you sit on any audit committees, one of the first conversations that CISOs have is we need more money to go out and keep ourselves protected, our security posture in line. But what ends up happening is ransomware has not reduced any. And you're still being old. And so the challenges that are there in pricing is it's more around the total cost of ownership that you have where point solutions are just no longer feasible because of the complexity and because of the amount of cost it takes to manage 70, 80 different policy engines. On average, most customers have about 70 different product spend, right? And so from a pricing standpoint, I think there's a lot of economics that comes into play, where we can increase our ASP while simultaneously reducing the cost for the customer. So I don't think those are mutually exclusive.

Okay. Maybe we'll -- I want to talk about your solutions and drill down the solutions. And you mentioned Hypershield multiple times. Can you take us through it? What is it? What value does it bring to customers, et cetera?

There's a man who actually all about it. So I will let him talk.

Sure thing. If you think about the way security controls have been built for decades, they've been built -- they come in a box. And the lock sits in a place in the network, usually at the edge of the network. And that's fine, but it has limited granularity and therefore, limited effectiveness. So what we did is we said, we want to security everywhere, not just kind of the perimeters and corners, but everywhere. And this is increasingly important in a world where applications are more spread out. Remember the 3-tier web app, web server apps, server database through big giant VMs. Now it's 300 or 3,000 microservices. And conversely, users more so, probably don't need to elaborate, but it's iPhones and Android tablets and not just users, but smart devices that are running in the factory floor or a hospital environment, et cetera. Hypershield is designed to address exactly those trends. So it allows us -- it's distributed system that allows us to put the security enforcement where you need right next to the application with a level of understanding of the application that wasn't available before. Jeetu talked about the new software constructs, one of which is called EDPF. It's kind of a nerdy name, but it's really powerful capabilities. It's an interface in Linux and Windows operating systems that lets us tier into the memory and the heart of the system, and deeply understand the application. And that allows us to tune our security policies to match the vulnerabilities of an application. Now with AI, we have the ability to provide management for these systems that wasn't possible before. So this is literally a system that can write its own rules, they can test its own rules, deploy its own rules, life cycle manage its own rules, remove them when they're not needed and then upgrade itself with no human intervention. When customers see that, it's startling leap forward, right? It's not an incremental improvement. And this is something that's unlike anything they've ever received before.