Elastic N.V. (ESTC) Earnings Call Transcript & Summary

My name is Mike Cikos. I'm the lead analyst here covering cybersecurity and infrastructure software. Pleased to say we have with us Elastic. I'm joined up here on the stage for a fireside chat with GVP of Finance, Eric Prengel. We'll go through some questions we have planned on our side, but please would love this to be interactive. If you guys have any questions, lob them in and we'll get them while we have Eric here. With that out of the way, Eric, thank you for joining us again. Just in the interest of intros, do you want to walk through your background?

Yes. Thanks for having me. It's always a pleasure. I'm glad to be here in person. I think last year, I did this and I had technical difficulties on -- in the middle of the thing that was -- we can't have technical difficulties. We're literally in person. So we won't have that issue. That was terrible, especially as a tech company. But my background, so I've been at Elastic for 3 years now. I'm the Global Vice President of Finance. I cover FP&A, Investor Relations, procurement and a number of other functions. I basically have all of the finance function. Before the 3 years at Elastic, I was an investment banker for 15 years, most recently at JPMorgan. And at JPMorgan as I got to know Elastic, I was the banker who took them public, and then I also did the debt deal for Elastic. So I've known them for a while, seen the evolution, and I joined because I thought they were a phenomenal company with a phenomenal team.

And super high level, just for anyone who's new to the name, I know you guys have been in the public markets for some time, but potentially revisiting the story, can you just do a quick overview of Elastic? What is the value prop they're providing to their customers compared to the differentiation?

Yes, I'd love to. So Elastic is a platform that was built to handle unstructured data. and it handles unstructured data incredibly well. We can ingest unstructured data, we can manage it, we can search it. And that's really what Elastic does. And that can be used to solve a ton of different problems. It can be built for ride app hailing where you can apply it to geographies. It can be built for website search. But as the company evolved, we also found out that there were some specific use cases that were very monetizable and repeatable that search could be used to solve. And that was observability and security. In Observability, ingesting logs and then being able to search through those unstructured logs and parse them out was something that Elastic platform did phenomenally well. And in security, SIEM was a capability that was also involved dealing with log data and finding out incidents and being able to identify them was something that Elastic did tremendously well. Since that time, Observability has branched out, and we now have metrics in APM. And in security, we've added XDR. In addition to that, as the world has evolved, Elastic has been a search company at its core and a new problem with search has come around with vectors. And so when I joined 3 years ago, Elastic was already deep into vector search and vector databases. And I remember when I joined and at the leadership level, we were talking about the work we were doing on our vector database. I had no idea what a vector database was at that time. This is before ChatGPT really became popular, and it was something that Elastic has been working on for years. So when this whole GenAI revolution occurred, it wasn't that Elastic went and chased that. Elastic was actually very well positioned, had a lot of functionality in these GenAI capabilities with vector search with vector databases and really was able to build on them and augment them and really be differentiated in terms of what we can do in GenAI, where we have reranking models, we have embedding models. We've got a ton of different capabilities. We've got semantic search and hybrid search that really enable us to provide relevance and context when you think about GenAI. And if you think about the evolution of GenAI, where early days, it was just generating ideas and now it's becoming moving more and more towards Agentic, the importance of getting things right and the importance of relevancy is only increasing, where with an Agentic model, you're not just getting some words on a page, but you're actually taking actions and you need to make sure that you're taking the correct actions. And that's where Elastic really shines, providing that relevancy in that context in these GenAI workplaces. So that's, in a nutshell, how I'd think about Elastic.

And on the search specifically, let's go there first digest this, right? But on search, you guys already looked at as being a leader within enterprise search as an example. I remember when we had this conversation last year, and it just -- it struck me. I was having a conversation with a colleague at the time where everyone was trying to figure out database vector, what does vector search mean? And I was actually talking with a colleague who was working at Pine at the time when they were coming out and they were like, listen, the only one that I would actually give credit to is actually Elastic. Because I think you guys had built out those vector search capabilities as early as like 2019, 2020, like way before ChatGPT. So credit where credits to as far as being at the fore on that. I think one thing management has been astounding the alarm on is the fact that, hey, with GenAI, the search business has seen a resurgence in part because of GenAI, but also like there's incremental budget going into that search avenue. So can you help us understand from like a boots on the ground perspective, what are you guys hearing in the field? How has customer adoption been tracking towards those newer GenAI capabilities and the pull-through of the core search that's always been there now?

Yes. So as we think about what's driving the acceleration in search, it's really predominantly this GenAI motion where more customers are adopting GenAI. And that's driven search to be the fastest-growing part of our business for multiple quarters now, which is really exciting and did not used to be the fastest-growing part of our business. This is really a shift in the dynamics, and it's all attributable to GenAI. And so we've seen customers who've adopted us for a number of use cases, and they've been a broad range of customers. You've seen smaller AI native companies who are building their applications on us. You've seen ISVs who are using us to augment their applications and provide GenAI capabilities to their customers. And then you've seen some very large organizations outside of technology, financial institutions, health care institutions, what have you, who are using us to build applications that are either internal or external facing within their organizations. Now all that being said, I do want to remind everyone that we're seeing a lot of positivity in GenAI, it's still earlier days. A lot of the dollars that are being spent around GenAI are associated more with model training and the infrastructure that's needed for model training and the deployment -- the broad deployment of applications that are either internal or external facing is still a little bit earlier. And so that's going to -- we've seen some positivity in some revenue from GenAI, but it's going to continue as you see more applications be adopted more broadly.

And that was going to feed into the next one, right? Like it feels like we've been standing in this experimentation exploration. It was only like last year, we began talking about Agentic AI, and I was like really is that. And now it seems like it's almost certainly we're going to be going into that arena from where you sit today, does it feel like this year is going to have more of these workloads or applications moving into production environments? Or is it still too early to call that.

I think it will -- I think it's easy to answer there will be more because it certainly won't be less.

Coming off.

So more is a clear answer. I think the degree to which we'll see the adoption is still TBD. I think there will be an uplift and an increase, but I don't know exactly what that's going to look like. We're seeing a lot of positivity. We're seeing a lot of engagement. So I think that across the board, we're going in the right direction, and it's -- we'll see how it plays out in the year.

When you are seeing customers explore your GenAI capabilities, is that serving as an avenue now like walk us through what you guys are seeing from a new logo standpoint as far as customer engagement with the platform? Or is it predominantly -- I know that you guys have a massive customer base, just going back to the existing customers for cross-sell opportunity.

It's both, and it benefits us in so many compelling ways. So as GenAI has been more important, it's really up-leveled with the conversations that we're having with our customers where there's board level interest, there's C-suite level interest around GenAI. And so the level of engagement over the last year or 2 years that we've seen with our customers. Because we're at the forefront of GenAI has been really dynamic. And it's changed the kind of conversations that we're having. And so customers are investing with us because of what we're doing with GenAI. Customers are investing with us because of our GenAI road map. And they might not be using GenAI today, but they want to be partnering with a company who's got a clear road map and who already is doing things in GenAI because they see an opportunity to grow with us and to really partner with us over multiple years. And it's also just getting us in front of customers in a way that we weren't able to in the past because what's critical to us and the things that we're doing are very compelling to them. And so it's really a manifolded way in which it's benefiting us, this whole GenAI capabilities that we have and the ability to engage with customers around it.

All right. And again, we're going to unpack the different primary use cases here. But if we jump over to security for a standpoint, you had noted SIEM and XDR. I think both of those categories within broader cybersecurity are extremely active right now, topical just given recent acquisitions, potential for share displacement. Can you help us think about when you are winning a new logo from a security standpoint, it feels like it's going to be predominantly for that SIEM use case. And like correct me if I'm wrong on that. If that is the case, like how much of this is brownfield dual source?

You're not wrong. But we talked, in Q2, we talked about a $20 million-plus deal that we had, and it was a displacement of a competitor, and it was a net new customer for us. It was a large-scale global chemical manufacturer. And they chose us for not just SIEM, but also XDR. And they had us compete against, I think it was 8 companies that were in the RFP, the best of the best, and we competed and we won on the merits of our solution, both for SIEM and XDR. So SIEM is obviously where historically, we've been really strong, but I think that our XDR capabilities are ready to go head-to-head with anyone as well. And so this was a phenomenal win and I think probably one of the better proof points around our XDR capabilities.

With the traction you are seeing for SIEM and XDR today, is it fair to assume that for the most part, organizations are dual tracking you like the market is pretty established. I feel like in some ways, someone already has that SIEM vendor they're already tapping into. And so they'll dual track it and then potentially wean off of an existing solution, bringing more over time. Is that what the evidence...

There's a migration process that has to happen where and we're doing things. We understand that we've got a big displacement opportunity, and we're doing things in our go-to-market motion where we're proactively setting our reps up to succeed in displacement scenarios where we'll be able to make concessions to help people get us, get onboarded with us if they're going to make multiyear commitments so that they don't have to deal with the dual costs for too long.

And how do I think about -- again, there are even I feel like some of the large platform cyber guys are getting more aggressive in how they're talking about SIEM. And everyone sees this opportunity because we're how many years out of the chute now with Cisco acquiring Splunk. There are some other tools that are just long in the tooth, right? Are you actually seeing more competitive replacements today versus 6 months ago? How does that pipeline continue to build?

Yes. I think that the competitive displacements don't just come up out of nowhere. You have to build the relationship, you have to engage with them. You have to work towards getting them to understand the value of your solution, what you bring to the table. And then as they come up for renewal, that's when you have an opportunity to win those deals. But these are large deals. I mean some of them are 8-figure deals. And in order to win those away, you have to build a long-term relationship. You have to have a real path to migrate over on to your solution. And so it's not just that they're showing up today versus 6 months ago. They were here 6 months ago, they might be starting to close today, and there's a whole lot more that are in our pipeline that are going to take multiple quarters and even in many cases, multiple years to close, but they're definitely something that we've been putting a lot of effort into.

And last but not least is the observability element. So you guys, I think, predominantly known for your capabilities around logging. To your point earlier, you've built out metrics and traces, right? We've had this for some time. A lot of attention with the announcement that Palo Alto is going to be entering the market through its Cronosphere acquisition. What is Elastic's view on that consolidation? How is it you guys are thinking through either increased competition or just broader market awareness of what's playing out on that front?

Yes. I think that as you think about the consolidation between security and observability, that's hugely positive for us. It's very validating. I think for 5-plus years, Elastic has been talking about a convergence of those 2 and the benefit of putting them together. And the fact that the market is starting to follow suit plays really well to our strengths. Where I think that we're nicely differentiated is we have a common data platform across security and observability. So people can leverage the benefits of having both of those in one data platform to make them more efficient. A lot of people who are going through this consolidation motion through acquisitions to be able to bring those 2 solutions together, they have 2 different data platforms that they're sitting next to each other. So they can go to market together, but they can't necessarily have the data in one place or benefit from the efficiencies of not needing to have duplicative databases. And that's something that we can do. And so as customers get more accustomed to a buying motion that involves both SIEM and Observability or security and Observability together, the fact that we've brought them together on one platform makes us more compelling when they're thinking about that as a unified purchase.

Excellent. And we'll shift for a second over to the go-to-market. If I rewind the clock about a year ago, there were some changes where I think a little bit more disruptive than what had been initially anticipated. Those are increasingly, you could say they just are in the rearview mirror at this point. But can you just remind us what did the management team enact as far as the segmentation of the go-to-market effort? And we'll just start there.

Yes. At the start of fiscal '25, we made a change where we had an external consultant in and we did a lot of work thinking through what we could be doing to improve our go-to-market motion. And one of the things that was clear to us is that we weren't segmenting our customers such that we were paying enough attention to our high propensity to buy customers. And so we realized that reps might be covering 2x the number of accounts they should in conjunction with covering some really attractive accounts. And so they couldn't build that customer intimacy and go really deep with those customers the way that we should. And so what we did is we reduced a lot of our reps. We took away a lot of their accounts so that they could really focus on the core accounts that were going to drive the most value for us. And as part of that resegmentation of our go-to-market where we moved around a lot of accounts, that created a natural transition where in Q1 of '25, a lot of our reps were getting to know their customers instead of moving the sales opportunities through the pipeline. And so Q1 of '25 was a much slower quarter than we would have hoped for and frankly, than we anticipated because of all that time that reps are spending getting reacquainted with customers. Once we got into Q2 of '25, and we were worried after that. We wanted to make sure that, that was a onetime thing and not something that was endemic to our sales execution. In Q2 of '25, we had a very strong quarter. A lot of the deals that -- a lot of the resegmentation started to pay off, where now we're moving deals through the pipeline, things were much, we're showing a lot more positivity. And we've seen that continue in the 5 quarters since where with this new segmentation, we're paying much more attention upmarket to these bigger customers who have a high propensity to buy, and we've just got a lot more intensity around the coverage effort for those customers, and that's driving success in the larger accounts for us. So it's played out really well, but there was certainly a very stressful Q1 '25 as part of that.

And I know it's -- well, I don't want to speak on Elastic's behalf, but at least across our broader coverage, there's been this gradual melt up of go-to-market organizations, right? Go to the higher spend customers where the budget is more durable, you could be stickier, you can identify more value. It's easier to sell into an existing account. But it is also an iterative process. If the first go around, hey, my Coast gets cut from 20 to 15 accounts, then maybe the next year, it's 15 to 8 because we know, we've demonstrated value and we can drive that. Where are we in that iterative cycle with Elastic as far as the evolution, account assignments at the strategic or enterprise levels of this?

I got good news and I got bad news and the good news is we're a lot further than we could be. The bad news is probably because we moved too fast in Q1 of '25, and that's probably why we saw the disruption is because we basically took it. We saw where we were. We saw where we wanted to be, and we went straight to where we want it to be. And so we skipped all the interim steps of moving over. And so Q1 of '25 was pretty stretchful. There was -- there were issues in that quarter, but that was 6 quarters ago, and now we're in the place that we want to be. And so as we think about our go-to-market motion today, it's a machine that's running really nicely, and we think about it as being highly investable and a place that we can deploy more capital and see more returns out of. We talked about it at the Analyst Day in October, but we've seen a nice increase in productivity over the last year or so. And because of that productivity increase, because of the things that we're seeing both in our pipeline and in deals that are closing with some of these bigger accounts, we're really putting more dollars to work in terms of sales capacity.

That's great. Great to hear on the capacity. One of the things that you had mentioned as well as the productivity gains. And so I'm trying to get a sense of that from the outside. I'll recycle back to the Analyst Day since we were just talking about it. Company committed to 15% plus on just the core, 20% plus over some time frame if I start thinking about what the GenAI tailwind to the business model could be. Within that construct, again, you guys are layering in capacity. It's probably easier to see, all right, X times Y and you have your outcome based on capacity. Does that top line growth assumption embed an additional assumption around sustained productivity enhancements? Like did you know?

It's a great question. As you think about what's driving our growth, is it productivity growth? Or is it capacity growth? Capacity growth is very tangible. I can tell you, hey, we're going to go from having 10 reps having 15 reps, hire those 5 reps and be really focused on to do it. But to say each of those reps is going to do X more dollars is a little harder and a little less tangible. And so as you think about where we're -- what we're underwriting to, it's going to be on the tangible things that we can control, and that's going to be more around the capacity growth versus the productivity growth.

Excellent. And in addition to the segmentation we were talking about, you guys also have an initiative relatively new in the grand scheme of things, but call it in the last year or so, you started building out a specific sleeve within the go-to-market that actively pursues new logos, call them the hunters, if you will.

The greenfield.

So where are we in establishing that motion? Are we continuing to layer more capacity in there? Or should I think about the capacity really being towards those AEs going after the strategic?

I think it's in both places. I don't think it's exclusively in one or the other. The greenfield territories, which is a greenfield territory, is effectively a territory where we have no revenue today. And so there are reps who are getting territories that have no revenue. They're going to have a smaller quota because they obviously need to do all new business instead of expansion business. But that's a place that we are investing. We've seen positivity out of it, and we're going to continue to put more dollars behind it. But we're also seeing more positivity in the core business, which is this new and expansion. And so it's both that we're really investing in.

Excellent. And then the last one on the go-to-market for the time being, but you had noted that $20 million deal, new customer, chemical manufacturer. Can you feather that in because we're talking about that was both SIEM and XDR. As part of your go-to-market, you guys have also built out a security overlay team as well, right? So where are we in establishing that? We're obviously getting the tangible proof points with that $20 million customer, but...

Yes. I think it's not just a $20 million customer. We're seeing security really do well for us. I think that we're at a place now where when you compare us to other SIEM vendors and even other XDR vendors, we're in the top-tier best-in-class in terms of our solution. And what prevents us from winning isn't our product capabilities if we're in the deals. And more and more, we're getting into the deals, people understand that Elastic is best-in-class in the security space, and that's been phenomenal for our win rates and -- or just showing up. And then once we show up, our win rates are strong. And having this security overlay, I think that a lot of security companies are pure security sellers. And so there's a language that they speak with each other, the ability to talk to a CISO, the ability to engage with a security practitioner in a way that's really compelling. And having those security, that security overlay with those security sellers really helps us participate in that market and be a compelling option, and we've seen tremendous traction in security. And we've talked about it in the last 2 quarters about how the security business has done really well from a bookings perspective in these last 2 quarters. And I think it's a convergence of all of those things. It's not just the security overlay, it's also the product where it's really best-in-class in SIEM and XDR and it's also the awareness that the market has around our products. So all that has come together, but the security overlay has definitely helped.

And if I could come back to like, again, the tangible proof that these investments are starting to show up in the financials here, I'll come back to large commitments because that's something I'd like to unpack with you. On the 2Q call, Elastic disclosed $5 million, $10 million TCV deals, TCV deals, including 2 of which were security, both over $20 million. There were 2 for observability and one was AI, right? So great complexion as far as tapping into each one of those pillars that you guys stand on. I guess, the number of those large deals, how repeatable is that at this point? Again, like I'm thinking about those competitive displacements you were talking about earlier, Yes, they've been sitting in the pipe and great, they all fit, right, versus this is something we have line of sight looking into our pipeline, like this is something we're building towards.

It's a change in the way that we go to market. So I run deal desk at Elastic, too. And what that means is when we do a big deal where there are terms that we might not have put in place before where there's questions, there's uncertainty. There's questions about it, I get involved. And 3 years ago, when I started, I was getting involved in deals that were very low single-digit million, high multiple -- close around the $1 million range. I'm not getting involved in deals that size anymore because Elastic has a repeatable and executable motion around deals that size. When I'm getting involved, it's around those $5 million to $10 million-plus type deals because that's where we're moving. And just the type of deals that I'm engaging around has completely changed because Elastic and a business has gotten much more proficient, and we see many more of these larger deals. And it's just a fundamental shift in terms of what we did in Q1 '25, the fact that we're getting bigger as a company that we're maturing that a company coming in and writing a $10 million check to Elastic doesn't feel out of the ordinary to them anymore. It's just how we've evolved. And so that's been really positive, and we're seeing a lot more of those big deals.

Can I ask -- this is more just an odd ball question, but I've seen some other companies potentially get tripped up. Like as you are graduating into $10 million deals, like when you get to that scale, I give you an incremental 2 points of discount on this deal. That's not necessarily going to get this deal over the finish line on December 31, right? So what kind of guardrails are you putting in place? Or does it cause you to change how you are constructing guidance to make sure like if this deal doesn't hit, like that matters, right?

Yes. I think it's fair. I think that for some of these larger deals, you kind of want to be a little bit more, hey, should this be a committed deal? Or is this like a strong upside deal in terms of how you think about them and you probably put a little bit more of a risk around them just because there's less certainty around it getting done and you don't want to be -- you don't want to put too much risk around the deal getting done where it's a binary outcome. And so I think your point is spot on, and that's how we've been handling things for some of these bigger deals. They're more like the cherry on top versus the core of how we think about the guidance.

That's great. I think that's just the right approach, especially like, again, not you guys, but I've seen other vendors which really need to take a fine comb and go through deals to implement tighter discipline on how they go through deals from pipe to ultimate signing. On those larger commitments that we are seeing to -- is the sales team -- can you just remind us what are their incentives? How are you guys driving behavior? And I guess the build on to that is, are they being incentivized to drive larger commitments based on how those incentives.

No, absolutely. I mean they've got a quota, and it's a quota predominantly around NME, but also they've got a renewal component to their quota. And as the more business they drive, they get into -- they have 100% of their quota payment. Once they get beyond 100%, they start to see accelerators where they get paid a meaningful uplift from their core rate. And so if they can get some of these bigger deals done, Christmas is great. Everybody is celebrating. People are going on, people are taking nice vacations. People are -- like those are memorable years in their family when their W-2s have that kind of -- the impact that doing some of these big deals can make.

Is there a push towards longer duration deals or not necessarily?

We always like more duration because it means we don't have to come back to the customer and renew it. It just gives you visibility. With all that being said, I think that like when people ask us questions about our RPO and they ask us to unpack that, we're not going to not do a deal because it's 1 year. Sometimes the customer will be -- there'll be a trade-off where they would say, "Hey, we'll do a 3-year deal for this and a 1-year deal for this, and we'll get them in the door on the 1-year deal. And we're not like myopically focused on the multiyear deal. We'd love to have a multiyear deal, but a 1-year deal is great, too, and we're really managing our business to the ACV and the commitment level that we're seeing. Because we can always renew in the next year. And once you get on SIEM or once you've got a big observability implementation, it's not something you can replace that easily.

And for Again, I'm sorry, I'm spending so much time on the go-to-market with the 3 different pillars.

I spend so much time on the go-to-market, too, I promise you. So it works out well.

So like what are you seeing, whether it's security, search, I feel like it's a little bit more, again, if you guys are the leader there, but like what are you doing to ensure additional consolidation of the landed TAM within your existing customer base, right? How are you building on that success? And then the follow-on would be, how are you driving behavior if you already landed a security use case into a potential search case or into an observability use case. Can you see that?

You can. And I think that's where the benefit of having more of that customer intimacy and having a narrower scope of -- a narrower portfolio of customers for our reps is really benefiting us where they sell one thing. And if you've got a huge amount of customers, you sell one thing, you move on to your next customer. But if you've got a narrower base, you sell that thing and then you really double down, you invest with that customer, you're spending time with them, you're trying -- you're getting the appropriate people in front of them. If they're a SIEM, sorry, if they're an observability customer, you get your security specialist in front of them and talk to them about what they're doing for security. You know they have SIEM. You know that logging and SIEM go hand in hand. And so you go and you have that conversation with them, and it's something that we're definitely investing in at Analyst Day, we talked about, I think it was something like 20% of our customers have multiple solutions and 80% of our ARR is coming from those 20% of our customers. I'm paraphrasing because I don't remember the exact numbers, so don't hold me on this. But that really is the way that we're using -- we're operating in our go-to-market, where we're trying to double down and sell more products to our customers who are using us.

And if I come back to the large commitments, again, just those 5 mega deals, if you will. I think one of the interesting commonalities across those deals is the fact that they were all cloud. I know you guys are focusing on sales-led subscription revenue. We'll talk to that in a second. But is there a reason for why cloud again this quarter? Was there anything behind that? Yes.

I wish I could say yes to that, but I can't. The truth is we'll meet customers where they are. And historically, the way 5 years ago, you'd say, okay, cloud is modern and self-managed is legacy. For us, it's different. Our self-managed business is very frequently that customers are taking a license to our software and they're deploying it in their hyper modern cloud infrastructure to do some sort of AI use case with it. So it's not that self-managed is legacy for us. It can be just as modern as the cloud can be. And we really, our goal is to meet our customers where they are. If they want to buy us to the cloud, we'll sell to them through the cloud. If they want to buy to us through serverless, which is our next evolution of the cloud product, we'll sell them there. And if they want to buy through self-managed, we're happy to do that as well.

And I know the team has also been and this is shifting over to metrics a little bit now. But the team has been consistent in recent quarters as far as saying like, hey, sales-led subscription revenue is what you guys should buy us to that is how we incentivize and build this business. right? Can you just remind us for the audience, what is the calculation behind that? And why should that be our North Star when assessing the success of Elastic?

Yes. It's effectively, it's all of the subscription revenue, excluding the monthly cloud business. The monthly cloud is what tends to be SMB and it's self-serve business. And so the reason that we're focused on that part of the business is what we control. As we go through our forecast calls every week, as we think about our go-to-market motion as we incentivize our salespeople, they're not incentivized for cloud versus self-managed. They retire quota on both of those. And when we're thinking about our forecast, we're really thinking about our forecast for our commitments on both those basises. And so we're investing and driving our go-to-market motion to support all of the sales-led subscription and less so for the monthly cloud.

I was going to ask just another question, too. Like there's been -- just with how the AI stack continues to evolve. I remember it was very topical middle of last year, there was talk about people actually repatriating data into their own private data centers or on-prem data centers for cost containment perspective, right? Is that part of the calculus here as well? Are you seeing that play out? Or no, that's not -- again, you just meet the customer where they are, you give them.

Yes. I think it's that we meet the customer where they are, and we've always had that, and we're not seeing it as much for ourselves because we offer that flexibility. But we've heard of other players in the market who are now saying that they need to have a self-managed option because customers, especially who are doing AI, are wanting that option. And so I think that by offering this, we've kind of given customers an opportunity to use our products, however they want, which is as things have evolved, it's actually played out to our benefit.

Do you have -- like I'd be interested what the percentage of your customer base is. Would it even make sense for a customer to deploy Elastic in both self-managed and Elastic Cloud setting?

Some customers do. It will depend how they want to use us, but some customers do.

Interesting. I'll turn it over. Any questions? I know I got more to go on my side, but all right, we'll keep it going. One of the things that I know a lot of people were excited about, I'll give it to you from my standpoint. We went to the Analyst Day, you guys took up the guidance, and then there was a ton of joy around that. And then, all right, what are we going to be take up numbers. Then we get to the next quarter and you guys took up numbers again. So congratulations. I'll start with that. What gives you guys the confidence? What is it you see from a demand side perspective that instills that confidence that you guys have in the business today?

Yes. I mean we took the -- from before the Analyst Day until after Q2, we added $34 million to our top line guide, which is about 2 points of growth. So the reason we did that is because of the strength that we're seeing in the business because of not just the commitments that we've got today, but the demand environment as we look at our pipeline and as we see the way that the selling motion is working. So we've just seen a lot of strength in the business. We've seen head-to-head customer wins where the product is really showing a lot of market interest and competitive differentiation relative to our peers. And so we looked at that. We looked at what we're seeing, and it was pretty clear to us that it made sense to raise our guidance.

And then the other thing, it just feels like ancient history at this point, but like we just had the longest government shutdown, right? So can you talk about federal exposure that you guys have, maybe feather in commentary on the SI deal just for the sake of the audience as well.

Yes. So I'd say that we've got a similar amount of federal exposure as other infrastructure software players like ourselves do. There are obviously some who have more than us and probably some who have less. But I'd say that having been on the other side, while I dealt with a lot of companies as an investment banker, we're not out of line with kind of where infrastructure software companies are exposed. When the federal shutdown happened in October, there were some deals that didn't get closed because of the Fed shutdown. Those deals have subsequently been closed. So very happy to see that, and that is going to play through in terms of how that impacts Q3 revenue. And then just thinking about what we see in the demand environment and how we've forecast our business based on the likelihood of more impacts to the Fed. I think that we've got continuing resolution through January 30. And so when we put together our guidance, the assumption we had is that there is risk that you'd see another government shutdown. I hope it doesn't happen. I hope it doesn't become a regular part of doing business, but we're not discounting that as a possibility. And so as you think about our guidance for the full year, that's factored in.

And from where we -- sorry...

I was going to about CISO, go ahead. Ask about CISO.

We're already on the topic.

So CISO was a tremendously successful deal where we signed a $26 million cloud commitment with CISO, and they've got the ability to utilize our cloud services to serve other federal agencies. It's $26 million for 1 year. it can -- the way it works is a little bit, there are some subtleties to it where they effectively have 1 year to deploy the $26 million. And then from the time of deployment, there's 1 year to use the $26 million. And then it will be effective, but it's effectively $26 million of annual usage.

Okay. I understand the mechanics there. Remind me how that's going to be recognized from a revenue standpoint. So it needs to be deployed in the next 12 months.

Yes, it needs to be deployed in the next 12 months. The cloud deployment, it's the clock starts and they have 12 months to use the amount of dollars that have been deployed for them. So it's effectively like they've committed to buying $26 million worth of subscriptions, and those subscriptions can start any time in the next 12 months. And then once they start, we're going to recognize revenue based on the consumption that they have towards the cloud commitments they make.

Excellent. Okay. And then we're saying that there's been a catch-up as far as the deals that might have gotten pushed out during that.

Those are going to be closed, yes.

So that's all in the rearview mirror at this point.

All in the rearview mirror.

With where we are, and I know we're talking about a CR, who knows what happens at the end of this month. But from where we sit today, how is the tempo or tone of conversations, the demand environment been from PubSec specifically?

We've seen positivity out of the public sector. We talked about it, and we talked about the positivity that we're seeing when we announced earnings in November, and there's been no change since then.

On the SMB side of the house, again, not part of the sales-led subscription revenue that you guided to. Is there any change -- like what would -- is that just out of your hands? And so as a result, that's why it's less of a focus? Has there been any meaningful change?

I don't think it's out of our hands. I think there are things that we can do in the product to help make it more SMB friendly as you think about serverless that makes it easier for smaller customers to adopt and get online because they don't have to provision and manage the infrastructure that underlies the subscription. So I think that there are things that we're doing that make it easier for SMB customers to get up and running and to use our products more. But in terms of the go-to-market motion and where we're really putting big dollars behind, we're having less impact on the SMB, the self-serve motion through that. And so that's why we're more focused on the sales-led subscription.

And then last couple of points here with the time we have left. If I could just cycle back to competition for a second, please. Again, announcement comes out that Palo acquiring Cronosphere, we're going to get it. I'd be willing that you already got it. Did you ever overlap or run into Cronosphere competitively? What is that?

We actually partnered with Cronosphere a little bit. So we didn't see them as wildly competitive. They have a strong metrics solution. That's the core of their business. They tended to work in metrics and have some big customers there. And I think they'll be more competitive with some of the more metrics-centered observability players. We didn't -- they weren't competing in our core business in the logging part of observability nearly as much as they were in metrics. And we play in metrics and we compete in metrics, but logging is probably where our biggest strength and differentiation in observability lies.

Yes. And again, just to take it full cycle, but come back to your earlier response on the point, like you guys have been preaching this whole idea of a unified, hey, we can tie together observability and security. So this is just another validation of your view and at the same time, your differentiation is the fact that you guys are on one single data plane.

Exactly.

Instead of coming from 2.

I couldn't say it better myself, Doug.

What you said. I'm just reiterating. No, but that's it. I think that's all we have time for, but thank you very much, Eric, and thank you to the audience.

Thank you. Thank you for joining.