Elastic N.V. ($ESTC)

Let's get this started. My name is Koji Ikeda. I am one of the software analysts here at Bank of America. I'm thrilled to be hosting a fireside chat with Elastic. We've got Ken Exner, Chief Product Officer; and Eric Prengel, Global Vice President of Finance. So thanks so much for being here, guys.

Before getting into product, and I do want to get technical with you, Ken. I'm thrilled to have you here because I want to talk about the technical side of Elastic. Eric, maybe first question is over to you. You guys reported results last week. It was a busy day on reported earnings that day. Lots of companies reporting. And so maybe just give us a high-level overview of what happened in that quarter. And I think most importantly, the guidance methodology as you're thinking about the next fiscal year?

Yes. So we were really excited about the quarter. We saw CRPO grow 20% and RPO grew 28%. On a constant currency basis, CRPO increased 5 points growth from the prior quarter. So tremendous momentum. It was really a testament to the bookings that we're seeing and the strength in the product that Ken and his team put together, where we're able to really win in the field. I think given a lot of people asking, "Oh, well, is any of this inflated? Is there some sort of thing that's going on where you have more discounting or something like that?" And the answer is no. This is truly the business performing. And so we are really happy about that. That was tremendously positive. One thing that did happen in our quarter is that there was a shift in the mix a little bit more towards cloud. And because there's an upfront rev rec component to self-manage, that took a little bit out of revenue. So think about there being a 1 point headwind to revenue based on that, coupled with a little bit of FX. But overall, a very positive quarter in terms of the commitments, a record quarter over the last couple of years in terms of the growth and commitments. So we're really happy around that. We also give guidance for FY '27. We initiated our FY '27 guidance. And the way to think about our FY '27 guidance, a couple of things. So we guided to a full year of 14.5% growth, which is actually acceleration from the Q1 guide. So we think that we're going to see the trajectory of the business accelerate nicely on a quarter-to-quarter basis, which is very exciting. And we're comfortable with the guide based on what our CRPO is and what that means in terms of how much we have to go get that's not already committed. So we feel really comfortable about that. And in terms of the guidance philosophy, I would just say that it continues to be, we want to put forward a guide that we feel comfortable that we can hit that we feel confident that the business has plenty to execute against to get to that guidance. So we feel good about everything on the guide side.

On that point in the shift mix to cloud, 1 point headwind. Can we dive into that a little bit more? Is that really around, hey, when you gave that fourth quarter guide, the first time you thought this amount is going to go to cloud, this amount self-managed and it turned out a little bit differently? Or was it bigger customers that decided to change their allocation between cloud and self-managed?

I'd say it was the former, but it was a little mix of the latter. So the biggest thing for us was we won the SISA, SIEM as a Service deal, where we're providing security SIEM to the U.S. public sector, the civilian agencies there through SISA. And so we've actually seen a much better uptake of that than we'd even expected. And so there were certain government customers who historically have been consuming us through self-managed and some of them shifted over to the cloud when they did deals with us in Q4. And so that SISA SIEM is a service deal really drove an increase in the cloud portion of our business, which we were really happy to see. It's all going to come to us as revenue. It's just that the timing of the revenue recognition moved out a little bit.

Eric, I hate to put you on the spot. But FedRAMP, do you know exactly where you are, FedRAMP certification on the cloud side?

I believe that we got...

Certified.

Yes, we're certified.

Certified and its as of last month.

Okay. Okay. Yes. Okay. So I guess the key message here...

FedRAMP high.

We work FedRAMP moderate, and now we got FedRAMP high.

Got you. So I think the key message here on the guide is look at CRPO as an indication of what's giving you that confidence in the CRPO.

I think that's the right way to think about it.

Okay. Okay. And one other thing besides CRPO, I think it's worth noting because it's something that we've put a lot of effort into across fiscal '26 is field capacity. And so call it, 2 years ago, in Q1 '25, there were some execution issues. Since then, Mark Dodds has done a tremendous job of really getting the go-to-market motion on track. And because of the success that we're seeing in the go-to-market and the productivity that we've seen in our field force, we've actually started to invest a lot more in capacity. And so over the last 12 months, we've been putting more AEs into the field. And in Q4, we saw -- that was part of the reason we saw success in Q4, and that gives us a lot of confidence going into FY '27 just given the capacity and productivity that we need to drive the business, we feel very good about that.

Maybe on the question on kind of go-to-market with Mr. Dodds and really considering just finished our fourth quarter. So good time to make any sort of strategy shift for the next fiscal year. Anything we should be thinking about on any sort of account reallocation or any sort of geographic reallocation or anything on the go-to-market side?

No, nothing in terms of account reallocation, geographic reallocation, nothing in terms of sales compensation. We feel very happy with how our go-to-market function across fiscal '27. You can particularly see that in Q4. And based on the way the team is executing, we don't need to change the go to market. We just need more of it. And that's why we're adding capacity to the business.

Got it. Ken, let's talk Elastic technically. But I do want to start high level first. And so it is a very technical product. Customers buy you for the technical benefits and the differentiation in there. But maybe just taking a huge step back, what is Elastic and why do customers buy you?

What is Elastic? That's a big question. The company started as an open source search engine, Elastic Search, which is one of the most popular open source projects of all time. So I think it's the most popular Java open source project. So it's used by millions of developers. Initially, people used it as a search engine power search within their applications. people started realizing that you could use it as a development platform. So people started using it to build matchmaking sites and ride sharing sites and using it to build signal intelligence systems, things like that. A couple of the most common use cases where people using it for log analytics and absorbability to search through logs, to search through metrics. And also people start using it for threat hunting, also searching through logs and security event data to do security threat hunting. So over the years, we evolved into sort of 3 businesses, 1 around the search business, which these days is really about powering AI-based search the observability business, which was taking a lot of what people were doing, using us as a log analytics platform and searching through metrics and traces and other things and making them more out-of-the-box experience there. And then finally, on the search side, this is partly the newest, but growing incredibly fast. People were using us as a SIEM or as a security analytics platform. And then we've been expanding beyond that sort of the adjacent spaces and in the security space. So those are the 3 core businesses, the search, which is these days, I power and AI search or power and AI applications, not just human usages of search, but also observability and security.

Let's tackle each one of those opportunities one by one. AI search or search AI, we'll combine those 2, observability and security. And so when customers are coming to you -- let's start with security. So when customers are coming to you and saying, "Hey, Elastic, help me with my security problem." What is that problem? How do you help solve it?

Well, the core of this is we became very popular for threat hunting. People would use us to search through logs and security event information, looking for that needle in a stack trend figure out. If there was an intrusion, trying to figure out what happened and trying to correlated across different signals across their business. We package that up as a SIEM product, and this was -- happened a few years ago. And this is the core land motion for us, which is we are the SIEM for most of the SOC, security operation centers that they use for that core threat hunting. But we also do some of the adjacencies. So we expanded into endpoint protection. We expanded into cloud security. We expanded into entity analytics and so to some of the adjacent spaces. But the core of the product is the SIEM application, which is security events information system that people use for threat hunting. I will also say that these days, everyone in the security space talks about sort of an agentic SOC, which is taking a lot of the activities that these security analysts do and turning it into sort of a genetic workflows that allow them to respond more quickly. We've been a leader there sort of turning the security operations center which is built around the SIEM into a fully agenetic security operations center. So these days, people talk about it as sort of using AI to automate the tasks of a security professionally. You have to -- people are creating attacks using AI, so you have to kind of respond with the speed of AI as well.

And then same question on the observability side, what are they coming to you for?

The core of the business was always in logs, which is people were using us as the ELK stack, as people used to refer to it as became the most common solution for logs continues to be a big part of our business. But we expanded into the adjacencies as well. We expanded into metrics, expanded into tracing, expanded synthetic monitoring and rum a bunch of the different areas. So today, we're a complete observability solution. I will say that we've spent a lot of time over the last year trying to become a really great metric solution. And I view this more as an opportunity for us to expand. Even without investing a lot in metrics and infrastructure monitoring, we've had a decent pickup in adoption, but logs has always been the core of our business. I'm very confident about our ability to win and go on the attack in terms of metrics because we've done a bunch of performance and efficiency work. We're now 3x faster than Prometheus based systems. We're 2.5x faster than Prometheus based systems, 2x faster than ClickHouse or more efficient than ClickHouse. So we've done a lot of work to be really performing highly performant and highly efficient metric store in addition to being a highly performing and efficient log store as well.

Can I add something there? So I think it's just good to note for everyone that logs is the primary portion of observability in which we play. And I think that -- if you look at the market growth metrics and infrastructure monitoring has probably been the fastest-growing part of that market. And so for us to be able to be much stronger in that market and more competitive, which we relaunched our product in fiscal '27 at SKO, we got on stage and talked about the tremendous strength in the change that we've made in the product. I think that presents us with a huge opportunity for observability -- for our observability business to really be reinvigorated and go to the next level with those metrics capabilities. So it's something that the field is super excited about. It's something that the team is super excited about. And I think it's a really big opportunity for Elastic in FY '27.

Yes. We also now natively support Prometheus data in PROMQL. So if you're using a system like Rafina that is Prometheus based, you don't have to change anything. You swap out the back end and suddenly it's cheaper and faster, which is really -- you don't have to change in your dashboard. It's just -- it's immediately cheaper immediately faster.

So maybe a good question for you, Ken, thinking you're the Chief Product Officer. And so the strategic move to invest more into metrics, infrastructure monitoring, was that a recognition of, hey, there's a pretty good opportunity here, we should go for it or where their customers saying, we need more because we want to use you guys for this?

It was both. One is, as Eric mentioned, metrics or infrastructure monitoring has been the fastest-growing part of the observability space. And it's not one that we had focused a lot on. Even despite not focusing a lot on this space, we still had customers starting to use us for metrics workloads. And this is because we're seeing a bit of consolidation happening. People are wanting to use the same tools for metrics and tracing and observability and logs. So some customers were pushing us because they were wanting to consolidate tools, but we also saw it as a big opportunity for us to grow the business. I would say it's both, both of those.

Ken, when you're out there talking with customers, I think one of the things we often debate with observability and security is that they're 2 different buyers. Are you seeing -- when you're out there talking with customers, are you still talking with to different buyers for your products? Or are you beginning to sit at the same table as either one person talking about both or having both parties in the room at the same time.

The most common is it's different, but if it's a business that is trying to save money through consolidation, it tends to go up to the CIO. So oftentimes, for consolidation plays, it's going to be at a more executive level, and that's usually the same buyer. Oftentimes, CISOs or the SRE team and the InfoSec team report up to a CIO eventually. But they tend to be different buyers, but we're still able to use the accounts to move laterally. Like one of our most common plays right now is talking to our existing search users and getting them to consider us for security or for observability. And they just make the introductions to their CISO. And their CISO often ready noses because their security analysts are already using us in an open source form, and we're able to turn them into a security customer in addition to search.

So how does the conversation go with customers that choose you for observability and security traditionally, but the natural progression is how do we use agentic capabilities within observability and security, and you guys can power that. What does that conversation look like with customers?

So in the security space, everyone's kind of talking about the agentic SOC So there's a lot of curiosity about what it means. And we're able to actually show it in the product on top of real data, and it's not just sort of this theoretical thing or not just a good demo. So usually, in the security space, what we do is we show it, and we actually let them use it. And there's kind of this -- it's gone from this theoretical or this marketing hype to something that's actually very real. I remember when we introduced attack discovery, which was -- this is one of the very first uses of agentic AI and security. We introduced this at RSA about 1.5 years ago. It kind of blew people's minds because what we were doing is we were processing all the alerts that come in and automatically figuring out which ones were false positives, which ones which ones were real, which ones were correlated, and we're able to map this to the miter attack chain and basically show customers, the entire attack path. Now for security analysts that sifts through hundreds of these alerts a day, trying to figure out which ones to pay attention to or not, we've just taken that work and just done it in like in a minute, and showed them this is what you need to care about. And when we have these conversations, like these analysts would start to try or like they would tear up. They're like, like you've taken all the drudgery away from my work and like gotten me to a point where I can actually fight the issues. I can actually act on these things. So when you show them this -- we showed them how real this is, it's quite empowering. We're always worried that people might react to it as taking away their work, but it was actually quite the opposite. It's the drudgery and allows them to actually feel more effective because they're kind of buried in what they're doing right now. They're buried in drudgery. And the same thing on the SRE side. They're buried in drudgery. They're getting woken up in the middle of the night. They spend the first half hour trying to figure out what the hell is going on, why are they getting pages in the middle of the night. And if we can immediately show them, this is what the issue is. This is what you need to investigate. These are the potential ways to remediate this. again, they beam because you're taking that drudgery away from them.

I think what's really interesting and attractive for Elastic for the end customers is having a cloud solution and a self-managed solution. And so help me understand why having that both options is important and then also how you guys think about driving innovation between those 2 products. Is it parity for the 2 products? Is one more important than the other? Or like is 1 catching up to the other? How do you guys think about innovation between the 2?

So this is a huge differentiator for us. We are open source. The core product that's open source. We have self-managed, meaning you can run it yourself on-prem or on your own AWS or GCP accounts, wherever you want. We have customers that run us on battleships, run us on humvees, like you can run it wherever you want. We also have 2 different versions of our cloud offering. We have hosted, which is sort of a single tenant version of our self-managed that we manage for you on all 3 cloud providers. And then we have the serverless offering, which is kind of a peer SaaS version, which is on a modern serverless architecture. So we offer it multiple ways across all 3 major CSPs, across more than 60 regions, across GovCloud, FedRAMP moderate, FedRAMP high. We're working on all 5 right now. So lots of different ways to consume the software. I think the other thing that makes us a little bit different is that these are not forks. Like we don't -- we try to maintain for the core system together, which allows us to always lead with serverless, but eventually make things back into the other ways we offer the software, too. So the promise we make our customers is that we will always launch things first in serverless, but we try to always make sure that we make them available for on-prem as well. And it's important, especially for our public sector customers. We're they may be completely air gapped. They may be on battle ships, as they said, they need to know that they're going to have a great security product, they're going to have a great observability product and they're not crippled because of their environment.

Speaking of forks...

Sorry, I will say one other thing. The other thing -- the other reason I think this is important is that it allows us to be where the data is. And this is important because think about observability, like each of the cloud providers has their own observability solution. Despite that, we have a very vibrant observability industry, that works across these different cloud vendors because it allows them to create a common interface to those different systems, but it can also be where the data is. So in terms of our search business. We don't have to -- you don't have to move your data into the AWS because that's where your vector database is you can have your vector database fee wherever your data is. So there's 2 advantages to being wherever a customer is. One is you can provide a single interface across all the different -- wherever their data is and you can be wherever -- if they are in GCP or on-prem, you can have your Elastic cluster or your Elastic deployment there.

Fork. So for there is a hyperscaler out there with the port version of you guys. I don't hear about it that much when I'm talking to customers and partners out there. I'm curious from your seat and when you're out there talking with customers. Does that fork version come up at all anymore?

It does if you're an AWS customer. So if you're an AWS customer, they bring it up because for an AWS customer, it's there, it's easy for them to use it. And they try to attack us and try to say -- their pitch is essentially, it's the same thing. It's the same product. And we often have to sort of combat that and explain that it's not. It's a fork and it's 1 that's not been maintained very well, and we have to talk about how we are significantly more performant, more efficient. And then they run the benchmarks and they actually see that we actually are quite a bit cheaper in terms of the total cost because of the investments we continue to make in efficiency, the investments we continue to make in performance. But we have to combat that. But it's usually only with AWS customers.

So Elastic Search has been around for a long time. And when we peel back Elastic Search, it is based off Apache Lucene. And I've always wanted to ask you, Ken, how do you guys make it easy or maybe it's not easy to switch between different versions of databases, vector databases, solutions, search solutions that at the very, very core are Lucene based?

Switch between different...

If someone wanted to come to you and they're using something...

They're not. The interfaces are completely different. So Lucene is the core search. We are the primary maintainers and contributors to Lucene. So people often view it as one and the same thing with us, like we're 90-plus percent, 95% of using contributors and contributions we chair Lucene open source projects. Others can use that as a core engine in whatever other implementation they have, but the interfaces are different. The implementation is different. So you can't very easily change. So if you have a system like MongoDB that also uses, it doesn't mean you can change.

Okay. Okay. So I wanted to ask kind of the bull debate on you guys. And AI is a demand accelerator. And so Ken, maybe a question, or Eric, a question for both of you. What are you seeing out there that's giving you the confidence that AI is going to be a long-term driver for you guys and an accelerator of growth for you guys?

I'll start. I'd like to look at it 2 ways. One is we're a foundational part of the Gen AI and agentic AI tech stack. And this is people using this as a retrieval system as part of their context engineering environment. And then we're also using all of these same tools ourselves to power our observability and security solutions. Both of those are important growth drivers for us. On the search side, as I mentioned, people -- search has become something that doesn't power human interfaces anymore. It's powering agentic experiences. So people are using search as a retrieval system for passing data to an LLM or an agent. And this begins with us as a vector database, but it includes a bunch of different retrievable techniques around that. And a bunch of the supporting ways to pass data to an LLM or an agent. It's no longer just rag or prompt engineering. It's helping people build MCP tools, building skills, different ways of exposing data to an agent or an LLM. And we provide sort of a complete context engineering platform that supports various different techniques. And everything from embedding models to different retrieval techniques, very efficiently, figuring out how to get data to an agent or an LLM. That is a huge growth driver for us. How do we continue to invest in that and be a core part of the modern agentic AI stack. The other part is we use these things ourselves, and we get to use our own toys. And it's allowed us to move very fast in observability and security and to be leaders there in applying these to those use cases. So I mentioned before, a tack discovery, like we were actually the very first observability and security company to introduce AI assistance and co-pilots. This is more than 3 years ago. And we've continued sort of providing that leadership, constantly providing the leading capabilities for using genetic workflows within observability and security. And it's because we can use our own technologies and we can use our own tools. And that's actually enabled us to move faster than anyone else. This provides growth because suddenly now it's not just selling the platform, it's now we can monetize this through token usage. We can monetize this through workflow executions that we charge for. We can monetize this through conversation turns, different meters that spend based on these us using these tools for those agenticNAI experiences.

And the one thing I'd add is I think that we're seeing tremendous momentum on the AI front in terms of the metrics that we have. So we reported $600 million of our 100,000 plus customers are now using us for AI capabilities. That's a pretty big step up from the prior quarter. We talked at the Analyst Day in October around some of the expansion metrics associated with AI and some of the metrics around the traction that we're seeing there. And so it's not just something that's part of the talk track, it's actually genuinely supporting the business. And so across the board, we're really happy with what AI is doing for our business.

I wanted to ask a question on embedding models. I spent -- this one is going to be Ken spent a lot of time over the last week you've been searching trying to figure out what exactly is an embedding model. And what does it mean for certain companies? What is it and why?

Bedding model is how you vectorize data. So you take data, whether it's text or image or what and you want to put it into a vector database, you need an embedding model. It's a way to turn text or whatever into vector coordinates that you put into a vector database that allows you to do similarity search. So it's a way to turn it into a couple of plots of data that you can put in direct your database. And it needs to create those coordinates based on an understanding of similarity. So it needs to process the underlying data, understand what is similar and then create these coordinates to plot into vector space. When people introduced Vector databases initially, it was about text, taking text and trying to create coordinates for a vector database that allows you to say that a cup in a glass or similar concepts, and you can plot those in proximate space and vector database. People also use it for images and tech and stuff. The -- actually, one of the things people push this for very early on, even before generative AI is people wanted to do like image search using Elastic search. And companies like Adobe were using us to do image search even before entered to AI. So we've been doing this for a while. The thing that's been happening more recently is sort of a race to multimodal embedding models where you can take a PDF document, which might contain tables of data and text and images and stuff and be able to vectorize that entire thing or take a video or take audio. We recently introduced our omni series of Gena AI models, which are which are multimodal, which allows us to handle any type of data. And -- we're very proud of this because it truly is multimodal. It handles audio video images, text and everything using sort of vision model techniques. And it's sort of state-of-the-art in terms of multimodal. The other thing I'm very proud of is -- this one often people overlook, but it's really important if you're actually using these is that we have some of the most efficient embedding models. So we introduced a new small and nano class of our embedding models, which rank right now in the top 10 of all embedding models, but they're super small. -- compared to the rest of the top 10 of embedding models, it is -- I think it was 14 to 50x smaller than any of the other models, which directly translates into cost. So if you're using this, like people are picking these because they're still highly performing in the top 10, but they're like a fraction of the cost to run. So I like -- I geek out over efficiency. And that to me is almost as cool as multi-modal.

Interesting. It sounds like something I need to dig in a little bit more on here. So we are all out of time. Ken, Eric, thank you so much for doing this. This has been a fun conversation.

Thanks for having us.

Thank you.