F5, Inc. (FFIV) Earnings Call Transcript & Summary

Great, thank you. Good afternoon, everybody. Thanks for joining us for the F5 fireside chat. We've written extensively on F5. And in the last few quarters, you've seen great progress with new initiatives at the company. It would be very interesting to dig deep and understand what drives growth and how the company deals with the transition from kind of legacy to new areas. With me on the call, we have François Locoh-Donou, the CEO of F5; we have Frank Pelzer, the CFO; and Kara Sprague, the EVP and GM of BIG-IP.

So I'm going to start with -- we only have 35 minutes, so I'm rushing in to make sure I cover everything. I'm going to start with the very basic questions. François, you joined the company a few years ago. You find a company that needs to evolve from a legacy ADC market to new areas. For those who do not know the company, can you take us through your strategic thinking when you started? What were the issues you had to deal with? And what you have accomplished? Meaning where did you take the company? How do you see the company addressing new opportunities today?

Tal, thank you for the opportunity, and thanks for having us. When I joined F5 3 years ago, the view of that time was that F5 would face significant headwinds for 2 reasons. Number one, that F5 was a hardware company and that increasingly, applications were moving to software-first environment, private cloud, and also moving to public clouds, where it was believed that F5 did not have a play. And then the second reason was that people felt that as applications, modern applications started to become more prevalent, where people built applications in native container and microservices and in public clouds, F5 had no relevance in these environments. And so I think we have proven over the last 3 years that those -- this hypothesis is actually -- has not turned out to be true. And let me tell you why. There are a couple of reasons for that, and they relate a lot to what we have done with the company over the last 3 years. So let me talk first about migration to software for us in public cloud environments. That -- we recognized, more than 3 years ago, that our customers increasingly wanted to be able to move their applications from traditional data center environments to either private cloud environments or public clouds and multiple [ prem ] clouds, in that it was critical for them to be able to consume F5 application services in all those environments. And so we have made deliberate strategic changes to move F5 from an ADC business to a software-driven application services business. And what do I mean by that? We have re-factored our software to make it lighter weight for private and public cloud environments. We have built all the integrations with the major public cloud providers to make it much easier to use F5 and frictionless to use F5 in public cloud environments. We have created per app consumption models for our software, to allow teams to slice their investments differently. We have created much robust APIs to make our software fit into automation and orchestration environment. And we have also created commercial model, subscription, 1-year, 3-year or utility models that give our customers much more flexibility in consuming F5 as a true software subscription company. And so as a result of all of these actions, and if you look at what they have led to in terms of the growth of our software over the last couple of years, we have proven that F5 is actually more attached to the application than we are attached to any underlying hardware infrastructure. If I look at where we're at today for traditional applications, our customers are consuming F5 on-prem in hardware, in software, on-prem in private cloud and many, many times in public clouds, which continues to be the fastest-growing part of our software business. The second reason that the -- what I think was kind of a bare thesis on F5 has not proven out to be true is that we did not have a real presence in modern applications. And today, we have a presence in modern application through the acquisition of NGINX. We acquired, in NGINX, a platform that was a cloud-native platform that fits natively in container environments and serves a number of use cases in these modern application environments, including not just load balancing but app server, web server, API gateways, which are critical for the infrastructure of modern application. And so if you look at what we've been able to do and where we're at today, we have transformed F5 into an application services business that offer a broad range of application services, both for modern applications and traditional applications that are consumed in all form factors. And so I think for those of you who may still be thinking about F5 as a traditional ADC company, this is, perhaps, an opportunity to relook at the company that we have become and how we have transformed into essentially a multi-cloud application services company.

Great. A few years back, when we talked about the market, and we talked with Avi Networks, your competitor at the time, they claimed that when you transitioned from ADC, the classic ADC, hardware-based ADC to be more of application centric, pricing, for instance, goes down dramatically. They spoke about 70% to 80%. Have you -- is pricing pressure on legacy revenues, is this a factor in what's driving sales today? Have you experienced this kind of pricing pressure in the transition to new areas? Or did something change? And these discussions were held up about 3, 4 years ago, so a long time ago.

No, but thank you, Tal. And I -- yes, I absolutely remember these discussions. And I think Avi created a little bit of confusion. And the best way to look at this, I think, for people following the F5 story is to think about the world, not in terms of infrastructure, hardware versus software, but to think about the world in terms of traditional application and modern applications. Let me start with traditional applications. BIG-IP, our platform, BIG-IP, which is the core traditional business of F5, serves primarily modern -- primarily traditional applications. In traditional applications, when an application is served, either on hardware or software, there is not a meaningful differential on the price per unit there. And whether it has software, is on public cloud or on-prem or somebody is using our hardware, it doesn't matter. There isn't a cannibalization effect from hardware to software. For modern applications, yes, absolutely. Modern applications is a very different game. And in modern applications, it's a much more distributed architecture, as I said before, a lot of times in container environment. And so a single instance of a load balancer or an application services platform, in modern environment is much lighter weight. And yes, the price per single instance is much smaller. However, there are also many, many more instances in these modern environments because the applications are distributed, and so they are much more east/west traffic that needs to be served. And so when you look at the size of the deals in aggregate in these environments, they typically start small and they grow over time. But to be clear, these new modern use cases are not cannibalistic of what we do with traditional application. In the majority of our customers, they are net new use cases. So we are not seeing NGINX as the cannibalization of BIG-IP, we are seeing BIG-IP transition and help people transition from hardware to software. And then in the case of modern applications, we're seeing net new use cases with platforms like NGINX.

Got it. So we spoke about NGINX, and you acquired it roughly a year ago, a little more than a year ago, if I remember correctly. Can you discuss first -- for those who doesn't know, again, we're dancing back and forth with knowledge here. But for those who don't know the company well, what did NGINX -- what did they add to your portfolio? And discuss also the steps you have taken to integrate the company into F5?

Tal, we are -- so really, if I simplify it, as I said before, we did not have exposure to modern application, and we bought NGINX because they were the most complete platform to serve modern application, specifically with their web server, app server and load balancing technology in lightweight containerized environments. And our thesis, of course, in the acquisition, was that we could create even more value with NGINX being part of F5. We are very pleased with how the F5 and NGINX teams have come together, and the synergies that we have already been able to create from the combination. And I'll give you a few pointers. Number one, so if you go back to where NGINX was when we acquired the company, I think they had just done $25 million in revenue in the prior year. And they were just nascent in their ability to monetize their open source community of customers. And the primary monetization model was converting open source customers to a more robust software data plane. We have added a lot of maturity to this model. Number one, we have added new use cases for modern applications like API Gateway and API Management, which is potentially a very large market for F5, and we have built a pretty mature offering in that space. We have ported security capabilities from F5. We just released a web application firewall from -- for F5 onto NGINX, which give DevOps users the ability to drive security on their own. And then we also have built a controller that is an easy button for the use of NGINX, and enables NGINX users to scale their NGINX deployment without being very sophisticated or knowing how to put all their LEGO blocks together. So with all these, we have brought enterprise-class capabilities to NGINX, and it is accelerating our ability to monetize this technology. And beyond that, what we are seeing is for customers who want to have both traditional and modern environments or modern applications in their environment, and that group of customers is growing extremely fast. We are providing for them a single pane of glass that gives them visibility both into their modern applications and into their traditional application via F5 and NGINX. And so we are already seeing the benefits of the synergies that we have created together with NGINX.

So I have a basic question, because I'm getting this question all the time, and I want to ask you the same question. What is the functionality of NGINX? Meaning, what kind of services? When we talk about -- we understand the addressable market. Investors would like to understand, in simple terms, what kind of functionality does it bring to your customers? What kind of service does it -- do you do with NGINX for running applications in the cloud or running a service behind it?

Okay. Kara will take that one.

Yes. So Tal, NGINX serves a number of capabilities in delivering along the application delivery chain of delivering business logic to an end user. So one of the capabilities that they're most well-known for is as a web server. NGINX is one of the most popular web servers in the world. They support some of the largest websites and web applications, with 400 -- around 450 million web applications that are running on top of NGINX, based on external third-party reports. So it's a very, very popular web server. Alongside being a web server, it also serves as an API Gateway. In addition to serving as an Ingress controller, it's one of the most popular Ingress control solutions as well. Again, third-party reports indicate that they have upwards of 30% share in ingress control. They are oftentimes used as a load balancing solution in those modern application environments. And then NGINX also has an open source project around an application server. So they have a container-native multiple language application server that can dramatically reduce the cost of the application server component for customers. So those are at least the main offerings that they have.

Got it. Another question I'm often getting on F5 is when corporates migrate to public cloud, how is migration to cloud computing is impacting the demand for ADCS? Meaning, what kind of services they get already, or tools, they get already from the cloud titans like Amazon and Google that maybe reduces the demand from vendors like yourself?

Okay. So I would I would encourage folks who are trying to understand the F5 story, not to think of our opportunity as tied to ADCs from what I said a few minutes ago, that we have extended significantly beyond traditional ADC, and we see the future of application services taking us further still. So we do not view cloud-native tools as our main competitors. In fact, we collaborate with virtually all the major cloud providers, and we help customers migrate application workloads to their environments. So if you look at where we are complementary to these tools, it's very simple. Any customer that wants to have in their portfolio applications is going to use multiple clouds. Typically does not want to have to train teams on multiple application services platforms, or have to replicate the work of creating different security policies for different environments. And so F5's -- a big part of our value proposition for all these customers is that we are cloud agnostic, right? We offer the same set of application services, whether you are in Azure or AWS or on-prem. Or even if you're working at your portfolio of applications, you get the same set of application services across that entire portfolio and the same security policies across that entire set of portfolio. That value proposition is very strong because when you have to do different things for different environments, you create vulnerabilities, and it is an exposure, both in terms of security and in terms of performance of the apps. The second part of our value proposition, of course, continues that we offer a richer set of services than any of the public cloud because we specialize in application services. And so those are the 2 dynamics that lead us to win in modern applications, where all the customers that are using F5 for -- sorry, I should have said starting with traditional applications, all the customers that are using F5 for traditional applications, when they migrate to public cloud, they remain on F5. And then in modern applications with the insertion of NGINX and the same cloud agnostic value proposition, we are also growing our presence in front of modern applications. And that dynamic is actually what led to our strategic collaboration agreement with AWS, where they are bringing leads to us, and we are bringing leads to them. When customers want to migrate and leverage the AWS infrastructure, we work together to make that migration much faster for customers.

Can you discuss your success in transitioning customers to NGINX? And what are the alternatives for customers? Once -- if they are your customers for the legacy ADC, they're going to modern applications. What are the choices that they have, if it's not NGINX?

Customers don't migrate from BIG-IP to NGINX. They augment their Big-IP deployment with net new modern application NGINX deployment. And so that's kind of the vast majority of the use cases where customers have traditional environments. They want to create a net new environment because they're building new applications in these native container environments. They need a different application services platform that's much lighter weight for these environments, and NGINX is the right solution for that.

Got it. I want to discuss CDN just because some of the services they offer are similar to the services you offer, some of them, those that have strong edge compute. Do you consider CDNs and the services they're offering? Do you consider them to be competitors at all? Or is there a clear differentiation, clear difference between the offerings?

Yes. I'll start with this one, this is Kara. So we don't consider the offerings from CDN also to be competitive. So much like François talked about with public cloud players, CDN players offering edge infrastructure also have their own suite of native application services that they offer. And the points that we -- François was making about public cloud players apply similar to CDNS, which is, there's still a value proposition from F5, of being the truly infrastructure-agnostic application service provider. And so those customers that care about a multi-cloud value proposition, and our research tells us that 87% of all customers are adopting a multi-cloud approach, are still looking for that abstraction layer between the infrastructure and their applications, which is what we provide. And I think the second point that François talked about with regard to public cloud also applies to CDNs, which is in many cases, the application services that they offer natively are not nearly at the level of robustness or level of sophistication that many of our customers eventually end up looking for their applications. And so F5 continues to have a very strong value proposition in our application services in those environments.

Got it. Before we move on, I just want to go back and ask, is there a market for your legacy appliances? Is there still a market for legacy appliances? And what are the trends in this market for BIG-IP Solutions, basically?

Kara, you want to talk?

Yes. I'll take this one as well. Yes. Yes. So yes, absolutely, there's still a market for our hardware systems. And we're prioritizing our investments and innovation in those systems where we believe the growth drivers will be most aligned. So for example, we see still a number of customer verticals that are still high demand segments for our hardware systems. You can imagine things like financial services or governments, where, for example, some of them have security requirements that require hardware level encryption. Other examples would be in utilities or service provider. Service provider is a good example of where they're looking for packing in as much hardware-based acceleration and throughput in as small a footprint as possible. There's other use cases where customers are seeing hardware acceleration as particularly helpful. Traffic break-in and specs, which is what our SSL Orchestrator solution offers is one such example. Internet of Things, where MS Process shifts massive amounts of data. And data throughput's another good example of a use case where that hardware acceleration is helpful. We still see geographies that show a preference for hardware environments or managed hardware environments. And so we see -- we expect to see continued areas of growth for that business.

Got it. Great. Let me stop. I want to ask you more questions on products and on security specifically, but I want to switch maybe just to make sure we cover this also. I want to switch to financials. And Frank, can you discuss the implications on COVID-19? What have you seen in the marketplace, kind of the last few weeks of March and beyond? What are the implication short terms? Are there any thoughts about implications long term?

Sure, Tal. Thank you. So as we discussed on our earnings call at the end of April, that's sort of the time frame that I will give you. We have seen only a slight impact, both positive and negative, to the business in relation to what we would otherwise have expected pre-COVID. And so as François and I both discussed on the earnings call, there were a few opportunities that were pulled in, probably for fear of what was happening in the supply chain. And then a few things that were also pushed out because people were trying to understand their overall business. And is this the right environment to spend? What we did also talk about in the call was that our exposure to the industries that were being most impacted by COVID was, call it, the retail, media and entertainment, transportation. Those types of industries represented less than 10% of new product bookings for us in any given quarter. And so we just weren't that -- and we have never been that exposed to the areas of the enterprise that are probably the most impacted. We also have got a very long-tenured relationship with a very broad base of customers, and what we think are our mission-critical services for these customers. But what we do expect, and why we have such a large range for our revenue expectations in Q3, is that eventually, this type of unemployment level, this type of just macro shutdown, would ripple from consumer into enterprise. But as of the end of April, we had just not seen that yet in the business. We do think that there is going to be a distinction between mission-critical spend and nice to have spend, and we do think that we are in that bucket of mission-critical spend.

Got it. So you spoke about many product initiatives, migration to software, next-generation offerings. What does it mean for margins? What does it mean for gross margin? What does it mean for operating margin? And how do you balance between probably higher-margin on some software offerings versus probably the higher need to invest in order to go after the opportunities?

Yes. So we -- great question. Thanks, Tal. We generally view this in a mixture between the long-term growth and the investments that we need to make to make sure that we are reaccelerating our growth into the double digits versus a very privileged place that we sit with our operating margins being probably in the top 10% of technology companies. And so when we take a look out at the business over multiple horizons, we do see the revenue accelerating from where it is today. And we want to balance that with operating margin profile that allows us to continue to make those investments to secure that revenue growth over a longer period of time. And we are not willing to make sacrifices to that long-term growth just for short-term margin optimization, unless we do feel like that growth is not attainable for us, which is, certainly, not our view today. And so we will continue to invest in the business. What we talked about in Q2 and part of the guidance that we gave for Q3, is that we're seeing savings in areas like T&E, like everyone else, and other portions of the business, but we are still hiring and making those investments that's going to secure the organic growth for the business over a long period of time.

Do you have any specific targets longer-term for margins?

We haven't given that. And I would ask you to stay patient with us, Tal, as we sort of work through what I would say is not any sort of economic normalization or stability at this stage. But when we get together at AIM, it is our anticipation that we will provide longer-term targets.

Got it. So I want to go back to security offerings. And can you discuss your security offerings? How do you define the addressable markets? And what are your strong areas? And what are the areas you're simply not addressing?

So Tal, our focus, to make it simple, is application security. And that's our strongest area. And that's where we intend to grow. And I will share a little more about what we do there and why. So first is why. The -- if you look at the secular trend in large enterprises, and even in service providers, everyone is going through digital transformations in some form. And what that means is they are creating more and more value and transacting more and more value with our customers and partners through their applications and through their digital experiences. And that means that where there is most value at stake is where criminals go. And so the challenge of the next decade, as far as we believe, is going to be attacks on applications. And so we have invested organically into that opportunity for several years now, and we have built a leadership position in web application firewall, in anti-denial of service, in access management and in API security, and now with the acquisition of Shape, in anti-bot and anti-fraud solutions. The acquisition of Shape for us is an extension of everything we've done in application security to date, but it does double our addressable market. Our addressable market in security was $4 billion. And we believe with Shape, the addressable market is about $8 billion. And with Shape, F5 now is the only company, as far as I know, that is capable of protecting applications, but also protecting how applications are used, leveraging the Shape technology. And so we think it's a game changer in terms of leadership in the application security space. We think it gives us a great opportunity with our existing customers, but also great opportunity to continue to drive the attach rates of security solutions for F5 in public clouds. And it also gives us analytics capabilities that we will leverage to continue to strengthen the efficacy of security solutions and also to create better automation for our customers, who are all accelerating their digital transformation. So that is where we play today, and our focus is application security.

Got it. Do you need to change your go-to-market? Or do you need to strengthen other parts of your go-to-market in order to address security applications?

The short answer is no. In part, because a meaningful portion of SI business, prior to the Shape acquisition, was already about security. So the go-to-market at SI, whether it's resale, sales, marketing, product management, we have already built a strong security DNA in the organization. And so there are a lot of F5 sellers that are -- it's not -- the majority of F5 sellers are actually -- were already selling security solutions prior to the Shape acquisition. So for that reason, there really hasn't been a need to transform our go-to-market. The need actually to accelerate sales came more from the product side, in that Shape is a great example of a security company that leverages application delivery technology, a proxy, to be able to insert their security mechanisms. And so if you look at a typical customer, for them to be able to use Shape, Shape needs to insert a proxy in the application traffic, which was something that disrupt the application environment. And so it took a bit of time for customers to get to the point where they were comfortable doing that. But once they did insert Shape in their application traffic, they were able to see the efficacy of the solution, and the fact that Shape is capable of blocking bot attacks and fraud that no other technology provider is capable of blocking. And so now with Shape being part of F5, and F5 being a proxy, the insertion of Shape into application traffic is absolutely frictionless. And with that, all of the F5 account managers are able to go back to their customers and show them the value of Shape without having to disrupt their environment. And we think that's a pretty powerful accelerator for the Shape project.

Got it. So we only have 1 or 2 minutes left, and you explained very precisely the growth opportunities. And Francois, I want to ask you kind of a more general question. As a CEO of a company that after 3 years, clearly, we see an impact of your strategy, what you implemented since you joined the company. I want to ask you about your challenges. If you need to articulate the biggest strategic or operational challenge and challenges, in plural, for you as a CEO, what are you focusing on?

Thank you, Tal. Look, I think there is a -- one key challenge that Frank and I are always mindful of, and we're trying to always strike the right balance, is with this transformation requires investments, both organic, and as you've seen, we've done some inorganic investments as well. And these investments are important to continue to reaccelerate growth at F5. But of course, we want to continue to balance those investments with maintaining a strong operating model. We have one of the most profitable operating models in the industry, and we intend to keep it that way whilst reaccelerating growth. And so balancing that, balancing short-term and long-term consideration, is an exercise that we constantly go through, and we're going to continue to be mindful of that. We're going to continue to be disciplined about it. But as Frank said, we're going to continue to keep our eyes focused on the North Star of the company that F5 is becoming. We used to be a hardware application delivery company. If you project into the company we're going to be -- we're becoming, we're obviously becoming a software company. But more than that, we are becoming a company that's about application delivery, application security and analytics. And if you look at those 3 pillars of application services, all of them have growth potential. In 2 of them, we already have a strong position. The acquisition of Shape gives us also a very strong start in what we want to do in analytics. And so the growth potential for where we're going to be as a company, as a platform, is very significant, and we have to be disciplined on the pace with which we're pursuing these opportunities, whilst making sure that we keep a strong operating model.

Got it. Great. I promised you speed dating. Time is up. But I think you managed to take us through the upside very, very -- and the growth opportunities, very, very precisely kind of -- so, at least me, myself, I can attest that I learned a lot from this call. So thank you very much for your participation. And for the investors, if you have any questions, as always, please feel free to contact me via e-mail or a phone call, and I will be happy to answer. And if I don't know, I'll approach the company for answers. Thank you so much.

Thank you, Tal.

Take care.