Expanse, Inc. (PANW) Earnings Call Transcript & Summary

Thank you for joining us on short notice. As you've seen, this morning we announced the proposed acquisition of Expanse. Joining us today to discuss the transaction are Nikesh Arora, Chairman and CEO of Palo Alto Networks, and Lee Klarich, Chief Product Officer. Please note that we are still in a quiet period and will be recording our fiscal quarter results on Monday, November 16. We will not be commenting on our fiscal first quarter results or our fiscal second quarter guidance during today's call. We would like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding our competitive position and the demand and market opportunity for our products and subscriptions, including our beliefs about the anticipated benefits of the proposed acquisition of Expanse for us and our customers, the anticipated timing of close and our integration approach, and our continued execution and focus on providing new products to our customers. All statements, other than historical facts, including the statements regarding the expected benefits of the proposed transaction, are forward-looking statements. These statements are based on management's current expectations, assumptions, estimates and beliefs. While we believe these expectations, assumptions, estimates and beliefs are reasonable, such forward-looking statements are only predictions and are subject to a number of risks and uncertainties, which are beyond our control and which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today and you should not rely on them as representing our views in the future. With that, I'll turn the call over to Nikesh.

Thank you, Karen, and thank you, everyone, for joining us at a short notice. First and foremost, today is November 11, it is Veterans Day. Before I begin, I would like to recognize and thank all of our veterans for their service, and particularly those in our Palo Alto Networks family. We're grateful for everything you do for our nation and feel tremendous benefit of your public service. Thank you. Now turning to our news this morning. We're delighted to share more about our proposed acquisition of Expanse, which will significantly enrich our Cortex product suite to proactively address all security threats faced by an enterprise. Let me first give you an idea of why we're excited about Expanse and their unique technology before turning it over to our Chief Product Officer, Lee Klarich, who is here to dive in further. Since releasing their first product 4 years ago, Expanse has become a leader in attack surface management. Expanse has dedicated themselves to developing an Internet collection and attribution platform that constantly monitors the global Internet, mapping the exposed and untracked assets of an enterprise that comprise its attack surface. This data gives organizations a crucial picture from the outside in. That is to say, the same view that an attacker sees when hunting for potential weaknesses. It's because of the insight that their technology is trusted by some of the world's largest and most complex organization, from members of the Fortune 500 to the U.S. military. While this category of attack surface management has been important on its own, we think it has more powerful implications for customers when combined with Palo Alto Networks' Cortex product suite. Once integrated after closing, Cortex will stitch together internal and threat data with Expanse's external view of exposed assets. This will give customers a complete picture and eliminate vulnerabilities across an enterprise. Together with Expanse, ours will be the first solution that combines the outside view of an organization's attack surface with an inside view to proactively address all security threats. We believe that no security solution is complete without this. As you can see, with past acquisitions, we were early to spot and invest in the best companies in emerging technology areas, and competitors have validated our strategy by following us and investing in the same areas. Our intent to acquire Expanse will likely continue this trend. Let me cover the details of transactions. Under the terms of the agreement, the total purchase price includes approximately $670 million of cash and stock, approximately $130 million in replacement equity awards, with each amount subject to adjustment at close. We expect Expanse to contribute $67 million of ARR in our current fiscal year ending July 2021, continuing its 100% growth momentum. Expanse transaction multiples are very favorable compared to other companies of equivalent size and even more so when adjusting for growth. As you've likely read already, expanse co-founders, Dr. Tim Junio and Dr. Matt Kraning, will join Palo Alto Networks once closed, and we're excited to join forces. With that, I'll turn it over to Lee.

Thank you, Nikesh. And thank you for joining us today. I'm excited to share how Expanse fits into a broader Cortex strategy. So let me start by telling you more about Expanse. As Nikesh mentioned, Expanse was founded about 8 years ago, and built up an incredible team of experts across many technical disciplines, including data science and machine learning, security and distributed systems. They figured out that there is a tremendous amount of information you can find simply by scanning the Internet. But to do so in an accurate, scalable and complete manner is extremely difficult. It requires a large dynamic and global infrastructure that continuously scans the Internet for any new or modified assets. To give you an indication of the scale, Expanse makes 10 trillion decisions every day with their analytics. With their Internet collection and attribution platform, they constantly monitor the global Internet to map exposed and untracked assets that comprise a customer's attack surface. This includes all exposed cloud resources, remote workers and on-premise assets. Every asset is attributed to an owner. Security exposure is identified and presented to the customer as an X-ray of their enterprise from the outside-in, the same view that an attacker sees as they probe for points of weakness. As an example, when we first activated Expanse at Palo Alto Networks, we found cloud workloads that we didn't know existed and remote workers with services exposed that shouldn't be. We were able to remediate this very quickly with XSOAR, but Expanse quickly became ingrained in our SOC processes. And we're a very buttoned up security organization. Imagine what other companies would find. Expanse packages this data in a very intuitive UI as well as an exec level report that can gain immediate attention with an enterprise. For example, the report will show cloud workloads that were deployed outside of enterprise security controls, something that happens all the time. It will show assets with remote access such as SSH, accidentally left open to the Internet and exposed to attackers, something that happens far too often; or in the case of one of Expanse's customers, it showed an unsecured military operation in a remote part of the world, definitely not something you want to find out the wrong way. Now let's talk about how Expanse accelerates our broader Cortex vision. But first, some context. We've spoken in previous calls and our analyst event in 2019 about the challenges facing security operations as they are constantly overwhelmed with alerts that could often go ignored. The underlying reasons for this are, first and foremost, data is collected into disconnected data lakes or not collected at all. Without the right data in the right place, analytics is difficult, limited and often left to static correlation rules. This then results in massive alert volume that requires an overly manual and reactive approach. It's simply not sustainable. Our vision for Cortex is to build the industry's first proactive security platform for securing -- for security operations. One that focuses on collecting a rich set of data into a robust and growing data lake, applying AI-based analytics for detection and leveraging automation throughout to dramatically reduce the number of alerts and amount of manual work needed. With this combination, we believe we can proactively detect and remediate all security issues. At the foundation of our Cortex vision is rich security data and deep knowledge and understanding of that data. When we look at data, we see 3 key types: enterprise data including endpoint network and cloud, threat data and attack surface data. The Cortex XDR data lake now holds close to 120 petabytes of enterprise and threat data. And Expanse will accelerate our goal to collect all relevant security data by providing the best attack surface data. This combination will provide, for the first time, a true 360-degree view of an enterprise. This integrated data will drive a rich set of analytics that will be a game changer for proactively addressing security issues. And with automation, we've seen an acceleration of XSOAR automation, where we've now crossed the 400 million mark of actions that can be automated, up 100% in just the last 4 months. This exponential growth is a result of increased automation playbook adoption, where we now have customers that automate more than 1 million alerts per day and achieve up to 20x alert reduction using automation. With the proposed acquisition of Expanse, we will take the great data and analytics from Expanse and combine it with the automation power of XSOAR, enabling full security remediation via automation. This is a great example among several of how the integration of Expanse can drive incremental value for our customers. This combination of Expanse, XDR and XSOAR, will accelerate our path to achieving our vision with Cortex. Expanse will provide a unique outside-in view of an enterprise that will become a must-have data source for enterprises. This data will enable the first 360-degree view of an enterprise, and at the same time, provide a unique and valuable data and analytics source to Cortex. As we expand Cortex to collect data from any relevant data source, we are setting our sights on building the most robust data lake to enable greater levels of analytics and automation. With that, let's open the call up for questions.

[Operator Instructions] Our first question comes from Sterling Auty of JPMorgan.

So just maybe to start off, I think it's very interesting technology, but can you help us understand exactly how have they monetized this capability? So what is the contract structure for the company? And is that going to change underneath Palo Alto Networks? And who do they compete with on a heads up basis?

They've been able to monetize their ability by sharing the data with their customers and giving them a vulnerability assessment as part of their -- they do -- they scan the Internet multiple times a day, almost on an hourly basis, and they're able to see any new assets that are exposed or created in any customer's enterprise. And then they're able to take that data and check that off against existing vulnerabilities, known vulnerabilities, and they're able to show the exposed assets, which should not be exposed to Internet, which basically allows the customers to take that and remediate that with whatever remediation that they have in place. Now the benefit we have is we have 2 incremental capabilities. One, we already have an inside-out view of the customer. So we know which assets are being created. Being able to marry that data with the data which looks at it from the outside-in, coupling that with playbooks that we have in XSOAR allows us to automate that remediation. So basically, the customers, over time, will not have to do much effort other than just be able to subscribe to the data feeds, both from them as well as use XDR. They can also use them without using XDR. So in the future, you will see a motion from us, which is an independent motion that Expanse sells, which they do today, and as we saw on the data sheet, they do $600,000 of ARR -- ACV per customer, which if you look at security, these are -- this is a big number. It's hard to find companies out there in the space, which can generate that amount of dollar value on an annualized basis for each customer. So I find that particularly exciting. It is a product which is targeted to larger enterprises. Given we have 1,600 of the Global 2000s, we find that's a very sweet spot for us for where they operate. We don't anticipate in changing their contract structures as much as we anticipate the ability as we integrate that into our Cortex data lake with XDR and XSOAR of creating new product offerings that allow us to not only sell them independently but also sell them as part of our overall Cortex capability. Do you want to add something? All right. He's about 10 feet away from me.

Our next question comes from Keith Weiss of Morgan Stanley.

Maybe 1 for Nikesh and 1 for Lee. For Nikesh, it sounds like these guys have a considerable government business. Can you talk to us about sort of who their customers tend to be? It seems very large enterprise focus. Is there a considerable government exposure here as well? And then 1 for Lee. Can you help us understand like post the acquisition, you have Expanse, you have XSOAR. Is there also a need for like the traditional VM perspective? Do you already have tools that are going to be competitive with what like Rapid7 or Qualys is giving you from that inside-out perspective? Or is that like additional functionality that will be vis-à-vis partnership or whatnot be incorporated into this inside-out view of vulnerabilities?

Okay. Well, first of all, Keith, you look wonderful. I'm just trying to figure out which movie I've seen you in.

It's pretty early in the morning for this conference call. Let's just leave it at that, okay?

Trust me, you and me both. I found my first malfunctioning railway track traffic light this morning. I just hung out of there for 10 minutes, what the hell is going on? Sorry, back to business. You know [indiscernible]. On the exposure, I don't know. Having customers in the government is, you call it exposure, I call it, phenomenal because they've been able to go, take a technology which they developed and have been able to convince that this is critical to national security infrastructure. Now unfortunately, I can't tell you who their customers are in the government. Otherwise, they will kill me. So they have customers in the government. I think they have applicability, not just to 1 government, they have applicability of many governments around the world because every government, they scan the entire global Internet. They watch 10% of the traffic on the Internet on a daily basis. That's a lot, because I believe there's like 4 million IP, 4 million IP addresses out there. So they do watch a lot of the Internet. We think there's tremendous opportunity, where they already have created capability. They've only had very few go-to-market people. And we have the opportunity of applying the Palo Alto Networks' marketing capabilities behind them. In fact, we're doing a commercial relationship with them to allow us to do some marketing with them in short order. So we think the opportunity is huge. We think most enterprises should have this data. I think without this data, it's impossible for enterprises to be able to understand what the attackers are seeing. That's why we're really excited about it. But I'm going to let Lee talk about Qualys and Rapid7, et cetera.

Yes. So look, the data that Expanse finds by scanning the Internet is we haven't found any substitute for it. So unlike more traditional vulnerability scanning, where you specifically scan the things you know about, what Expanse is doing is finding all of the assets, workloads, et cetera, that you didn't know you had. So it's a very unique data source from that perspective. Now we'll be able to combine that with the data that we're collecting already within Cortex. And recently, Cortex XDR added vulnerability information from all endpoints. And as Cortex opens up to additional data sources, including up to any data source in the future, yes, we'll pull in other data, whether that's from Qualys, Rapid7, et cetera, to combine with this other view that we have with Expanse, XDR, et cetera, makes sense.

Our next question comes from Fatima Boolani from UBS.

I wanted to dig into the competitive differentiation and the technological barrier to entry with Expanse. So my sense is there's elements of threat intelligence here, security validation and certainly traditional VA future functionality. So I really wanted to drill in on the approach Expanse has from a data collection standpoint? And to what extent is the data that Expanse generates proprietary versus partnerships with other third-party threat intelligence platforms to really reinforce the quality of the data that's coming through the platform?

Thanks, Fatima. I'm going to have Lee answer most of the question. But I will tell you, I was amazed at what these people have created. They've taken 8 years. This is a non-trivial engineering problem, trying to scan the global Internet, because most things do not like you to be scanned on a regular basis. So they had to build all kinds of technologies and servers sitting in different parts of the world trying to scan everything and make sure they can -- I would use the word circulant, but make sure that they are considered a valid scanner when they go and look at stuff. But with that, I'm going to pass it over to Lee to answer all the threat intel and security validation questions you have.

Yes. As Nikesh said, it is a hard problem to solve. It -- on the surface it seems easy, you just scan stuff. But the -- getting accurate results, being able to constantly update those results as assets change, being able to make sure you have a comprehensive view is actually a very difficult data problem, machine learning problem, et cetera. The vast majority of what they do is homegrown. It's what they do versus coming from partners. They do have a number of partners in order to help expand what they do, but the vast majority is from within their own team and own technology stack.

Our next question comes from Philip Winslow from Wells Fargo.

Great. Obviously, this deal makes sense in your thesis of sort of security is a data problem. So -- but I did want to focus on sort of the IT operations side of this because obviously, when you think about asset, inventory management, governance, there is an IT operation to angle this. So how do you think about sort of the [ blurring ] alliance between sort of security and IT ops and also just different buying centers for Palo Alto Networks and Expanse?

Well, Phil, first and foremost, you're 100% right, the data has applicability, both in the security domain and the IT asset management domain. Interestingly, our teams, once we put it in the SOC and did the security solve, they've come with a shadow IT use case where they found people spinning up stuff, which shouldn't be spun up, and we can go ask them, "Hey, we just found these from this stuff. If this will work, click here to accept. If it is, we're moving into the work domain. So yes, 100%. There is an IT asset domain capability that the data allows us to have. And I'll tell you what's interesting is over time. As you get into a world where you have more and more enterprise data and large data lake, it will have more applicability outside of security. It's kind of interesting. There are some companies out there, as you know, who started with collection of all data and they realized 80% use case is security. We start with 80% of the use case, i.e., security, and they understand there is a 20% use case, which also is outside of security. So for now, we're very focused on the ability to take this data and run all the security capabilities around it. As we've talked in the past, 2.5 years, we had a thesis. We expressed the point of view. We think all security is a data problem in the future. We think security is not a hygiene problem. It's not a policy problem. It's a data problem. That requires you to collect a lot of data, both inside and outside the firm. And in the past, historically, whether it's health care or it's education or it's security, it has been hard to collect and store, has been expensive. As you see, the world is going to a place where data is easier to store, collect and analyze. And we think we've got to stay 2 steps ahead of making sure all the data that's available for an enterprise that helps make them more secure is available and normalized by us in 1 data lake. So as Lee mentioned earlier, we have Cortex XDR, we added firewall capability to it. We've added our e-mail capability, we've added identity capability to it. We're going to add external points to redo it. So we're slowly and steadily normalizing all security data that's available to allow us to provide a sort of an auto-remediation capability to our customers because we believe security both is a data problem and also needs to become more proactive in real time.

Our next question comes from Brian Essex of Goldman Sachs.

Thanks for getting up early and giving us a highlight of the acquisition. Just want to ask about the history behind the 2 companies. And Nikesh, how long have you been working with them? And what might you expect in terms of integration? And then finally, in terms of the sales force's familiarity, how fast can this kind of go-to-market? What are the synergies across your platform from a go-to-market perspective? You guys have a lot of tools in your bag at this point. So just trying to -- want to understand how quickly we might be able to anticipate integration with the platform and then impact in terms of revenue contribution with your sales force.

Yes. Thanks, Brian. Look, first and foremost, we looked at them and a bunch of other people who claim to collect data from the outside in. I want to say about 9 months ago, approximately. And our CISO actually was the first one who took this, deployed it. He did the analytics on many such companies and data out there and came back and said, this is by far 3 to 4x better than any data I've ever seen. And we have a CISO, as you can imagine, for a cybersecurity company, we have somebody who's been around the block and seen most things out there. And that was kind of like the first aha moment. We looked at it, our team looked at it. And then he said, oh, wow, they don't do remediation. They do basically vulnerability assessment. They kind of like tell you what the problem is and then we're on our own. So our XSOAR team got involved, built a bunch of playbooks and said, wow, this is cool. Now we can find this and we can remediate it on the fly. As you know, our SOC has less than 500 alerts a week, which has come down from tens of thousands. And we said, wow, what is the larger applicability of this? And we sat down, the founding team. Lee, Nir and I talked about this, and it's very hard to get down near technical diligence. Nir is a firm believer in that. Everything is a simple matter of programming. When Nir tells you that this is hard, then you have to pay attention. And Nir got excited about the data they were collecting because it's a hard technical problem to go collect data from everything in the world and monitor 10% of the Internet traffic on a daily basis on multiple times a day. So when we got to that realization that they're collecting something unique, there's nothing out there, we looked at the viability as part of our platform. Now what's fascinating, Brian, is, for example, we're about to have our customer conference in 10 days, we've been working before this idea of Expanse with the notion, hey, what if we give our customers their vulnerability map? So we can actually -- if the customer wants, you tell us the name of your company, you say, yes, I would like it. We can build the app. We don't need anything. Remember, I'm looking outside-in. I don't need to be in your infrastructure. I'm looking outside-in, so I can actually build the vulnerability map for you and tell you how many assets you have exposed tomorrow. So I think that's the best sales tool our salespeople are going to have is we don't need to deploy anything in the infrastructure. We don't need to do a POC. We don't need to put a sensor in your infrastructure. We know. Now we can work with you and in about a week, we can make that data even a lot better because you can tell us what's what and why it's open, why it's not. So from a sales perspective, I think our team should be finding it easy to understand, like, we're telling you, this is the vulnerability map, here's where the vulnerabilities are. And it's typically something a CISO or CIO at that senior level is interested in. So we think that will act as a huge lead generation for us. And then after that question, I mean it's kind of like if I'm a CISO or CIO and I see this, I shouldn't -- I can't unsee it. It's like, okay, I don't have a problem. It's hard to unsee and say, "Oh, you know what, I don't need it. Thanks for letting me know that 5 of my things are busted, and I'll come back to you."

Our next question comes from Andy Nowinski from D.A. Davidson.

Great. So is the $67 million in revenue that Expanse -- is that something that Expanse may have already booked? Or does that assume some cross-sell contribution into your own installed base? And then second, how much customer overlap does Expanse have with your current installed base of 72,000 customers?

So first and foremost, Andrew, I want to thank you very much. I spend lots and lots of time with Luis, our CFO on those 2 slides with numbers, and I was like, oh, Luis, nobody wants to ask me a question about those 2 slides I worked hard on. On why we're early in technology on M&A and why this is a very, very attractive acquisition? So as you can imagine, we are in our quiet period. $67 million is their forecast for our fiscal year from an ARR perspective. It's a standalone number. It is to show the asset we acquired and what value we paid relative to their forecast and their growth rate for this fiscal year. We're not making any projections as to the incremental capabilities we can build and deploy in this fiscal year or next with the combination of Palo Networks and Expanse. We will leave that conversation for our earnings call, which is next Monday at a similar time. So we're not commenting on that. In terms of number of customers, as I said earlier, we have 1,600 of the Global 2000. Not counting many governments around the world. Expanse has approximately in the vicinity of 50 customers. So there's 80x more customers we have just at the top end of the funnel. I don't think it's applicable for 72,000 customers just yet, but I think it definitely has applicability to the 1,600 customers we have as well as for many governments around the world which have not seen this capability yet.