F5, Inc. (FFIV) Earnings Call Transcript & Summary

I know it's a tough time giving between food and presentations. I'm hosting today, Francois and Cooper from F5. It's a company we believe in short term and long term. Company went through some not struggles, but challenges in the market just because of market conditions and transition of business models. And I want to address all this, we have about 30 to 35 minutes. And maybe, first of all, welcome. Thanks very much for joining us today.

Yes, thank you.

I want to start with the...

Tal, I have to read my...

Of course.

My little statement here, safe harbor. So before I respond, I need to get our safe harbor on record. Please note that our discussion today may contain forward-looking statements, which involve uncertainties and risks. Our actual results may differ materially from those expressed or implied by these statements. Please see our SEC filings for more information on these risk factors. Thank you for indulging me.

Thank you. I'm going to -- in all these fireside chats, I start from a very high level because I want to -- this is not designed for people who are just talking about the number in the last quarter. This is more designed for people that want to learn the company. And the purpose of kind of the first question is to understand your historical transition. You were an ADC company. You're now more an application infrastructure software company. Take us through the transition. What are the components that you had to take the company through? You are a relatively new CEO for the company. Kind of last few years, you drove a major transition in the company. What are the components of it? And where are you today? What's waiting for us for the next few years?

Great. Well, thank you, Tal. Let's start at the -- a little bit with history. So yes, historically, F5 was an ADC company. ADCs are traditionally hardware appliances that sit in a data center in front of application servers, and they intercept all of the user traffic coming from users trying to access applications and they manipulate the traffic to make application perform and increasingly to make application more secure. So over the last 5 years, we have, as you said, transformed the company pretty significantly. So the first thing is we have continued to invest in hardware ADCs and in the traditional hardware ADC market, we have, in fact, grown our share and continue to do so. And I think we will continue to do so based on the execution, the new appliances, et cetera. and there continues to be demand for hardware ADCs in data centers. However, we also embraced the fact that applications were increasingly going to be not just in traditional data centers but in multiple public clouds and private data centers, number one. So the locations of application was becoming multiple. And number two, the way applications were being built was changing rapidly from 3-tier monolithic applications to containerized application typically born in the cloud, deployed in micro services and so forth. And so we made a decision for F5 that our future identity would not be about data centers or hardware appliances. It would be about serving application, but serving all applications. And so the first thing we have to do is make sure that our technology would work into all of these new environments for applications. And so there was a lot of work to turn Big IP, the hardware ADC, into a software appliance that was deployed in public cloud and on-prem, and that has driven a lot of growth in our software business. We then said we have to be in front of applications that are in containerized environment that led to the acquisition of NGINX in 2019 to have a container native form factor to support container in native applications. And we have since then had significant growth in modern application environment. As we learn through that, we also recognize that increasingly, the challenge of securing applications was the big challenge of application security and application delivery. And so we really wanted to increase our capabilities in application security and really become the leader in application security. That led us to organically develop more security capabilities in our portfolio and make some acquisitions. Recently, we acquired Shape Security in about 2 years ago, and then more recently, we acquired Threat Stack. Both of these acquisitions increased our ability to protect application, protect how applications are used at Layer 7. And we firmly believe that this coming decade is the decade of application security. There's been a lot of work on network security and endpoint security, but application-layer attacks are the most damaging for organizations. And so we have significantly increased our footprint in security. And more recently, we have also moved into SaaS with the acquisition of Volterra. That allowed us to deliver all these capabilities as a SaaS form factor for our customers. So those are some of the steps that we have taken. And increasingly, they have turned F5 from a traditional ADC company to really a company that secures and delivers applications across multi-cloud environments.

I have a question on almost every word you said. I hope we can fit it into 20 minutes. Is there a room in the market still for hardware ADC? And what are the applications driving it?

There's a lot of room in the market for hardware ADC, Tal. And I would say, the first thing that's driving that is that hardware ADCs make traditional existing applications perform. By the way, when I say traditional application, it could be an application that was born 30 years ago or one that was born 3 years ago. But it's about the architecture of that application. And typically, those applications drive revenue, they drive customer loyalty, they drive collaboration within organizations, A lot of the Gen 1 SaaS players that have seen their business explode, their stack is built on these hardware ADCs. Their application logic is tied to these hardware ADCs. So they are very sticky and they're absolutely critical to a lot of the applications that we're using today. So you see the growth in all of the e-commerce, all of the online banking applications that we're using more and more, online health care, online collaboration, all of these applications, the vast majority of these applications rely on hardware ADCs. And they are growing faster than actually we anticipated, in part because of the pandemic and in part because we're moving to all these digital channels. So other ADCs support that, and that's why there will continue to be a room for them. But also hardware ADCs also support large service providers who have growing needs in 4G and migration to 5G and increasing capacity that is supported by these sophisticated appliances. So for those reasons, whilst we don't see hardware ADCs as a growth engine for a company like F5, we do see them as a technology that will continue to play a very big role in the future of large enterprise organizations. For that reason, Tal we have continued -- actually, I should say that -- because of that belief, because it's one thing to say we believe it, but because of that belief, we have continued to invest in the development of hardware technology for F5. We are, just this year, we're launching next-generation hardware ADCs that actually incorporates some of the cloud-native capabilities. So they enable more automation for people who want to do automation on-prem. They enable multi-tenancy, they enable the deployment of containers on these appliances. And because of these investments in price performance and modernizing the technology, we have continued to gain share in this market, and we think we will continue to gain share because we are probably the player that's investing with the most intensity in this market.

So maybe a question for Cooper. It's what are the trends in this segment of the market? And how much cannibalization do you see between the software versions and the hardware versions? Because I'm sure that there is some substitution between the 2 groups.

Right. So over time, our customer base does lift and shift some of their applications, and that's been a fairly steady trend. But that's something that's planned typically years in advance based on where they're going with their business model and wanting more agility sometimes in how they're supporting these applications. So there is a trend where some of the software growth we're seeing is from applications that are either moving or some components of the workload is moving to a software-based environment. It's not a solution for most customers in the near term for a supply chain crunch, right? If you don't have that project already in flight, typically, based on where our lead times are for our products to end users, it's still going to be faster to resolve with the hardware that you already had planned for your application deployment. So there's not a big shift that we see from hardware to software related to supply chain. Now over time, we do think that customers will continue to accelerate their software journey. And that's where, not only with our virtual edition, but also the investments we've made into supporting modern applications and having a comprehensive portfolio, we're the best solution for those customers as they make that journey.

Right. So modern applications are written in a different way. And this is why there's still a need for an ADC, but different form factor, a different way of doing ADC. The question is, I'm trying to understand behind the scenes, when a client like Bank of America, any other client is developing modern applications, does it mean that the demand for the traditional applications goes down, demand for hardware goes down, and demand for software versions of ADC goes up or it doesn't? It's kind of -- you have a stable market for the hardware and only the modern part is going up? I'm trying to understand how much substitution there is between the software and the hardware versions of solutions.

So in terms of the way you've asked the question, the answer is the latter. It's more stable demand for the hardware and the software goes up. But let's just bring it back to -- where you have substitution...

By the way, the way you look at me, I know I didn't ask the question the correct way.

No, no. The heart of your question is exactly right, though. But I think you have to answer it in when you think of traditional applications, this is where there's a substitution. Because a traditional application is going to be supported by a traditional ADC. Within that, a customer can decide, while I really was using a hardware ADC, and now I'm going to use a software ADC. And this is where there is some level of substitution. Modern applications are net additive to all of that, right? There is -- so this is modern applications are absolutely on new form factors that are in software, typically in containerized environment. Half of the time, they're in public cloud. The half of the time, they're in private cloud. But that is all net additive. Oftentimes, you see customers modernize existing applications. So there is a traditional applications and it's supported by hardware and software traditional ADC, but the customer will say, well, I want to modernize some components of these applications. So they're adding new components that are container-native that they actually tie to this traditional application. And so for most customers, you end up in an environment where they have traditional and modern environments in the organization. What's key to them, though, is they want to have the same policies and consistency across this environment. And this is where the combination of F5 and NGINX is pretty unique for these customers is because we can provide that consistency from a single vendor and the ability to deploy policies across the board. That's one of the reasons why when you look at the growth we've had in software and multiyear subscription agreements, a lot of the multiyear subscription agreements that we're doing include both BIG-IP and NGINX as complementary technologies. And it's one of the reasons why the fear, if you will, that existed a few years ago that NGINX would be cannibalizing BIG-IP has not materialized because these are actually complementary in terms of deployment.

Modern applications often not always often running on public cloud. Why can't the public cloud companies provide this kind of solutions?

They can with 2 pretty significant caveats. The first is that their native services are very basic relative to what a specialist like F5 would provide. And so there's some -- if a customer is born in AWS, and it's going to -- sorry, if an application is born in AWS and it's going to just be in AWS and it's going to remain a fairly basic application with not a lot of requirements, there's a lot of good reasons why it could use what's on AWS. But the moment the requirements become a little more complex than a specialist like a fiber and gen X capabilities become really important. And the second big caveat or the second big reason customers will turn to us is that increasingly, they want their applications to be in multiple public cloud and to be able to port applications or components of applications will not be locked into a single infrastructure and, of course, using an independent software vendor makes a lot of sense. I wouldn't say also that the consistency of having the same vendor or the same family of technologies will support your applications on-prem in the public cloud, gives you great operational simplicity. You don't want to have different technology stacks in 3 different clouds or between your own clouds or public clouds and on-prem. And we essentially abstract that complexity for the customers.

Is NGINX -- and again, same question in different ways. NGINX in a way substituting the demand for your BIG-IP? Or is NGINX completely separate opportunity, separate upside? If it grows, it grows on its own merits, and kind of what's the correlation between demand in one versus demand to the other?

Yes. So if you think back years ago, we used to talk about the -- our ambition to expand not just our role but also our reach. We used to talk about the long tail of applications and where F5 historically has served customers is in that kind of top-tier of mission-critical applications. These are those traditional monolithic applications that drive a lot of the business value, but we really didn't have that opportunity to get in front of that next generation of applications. And that's where the opportunity is with NGINX. And we had done some initial work on our own to support those applications and build new technology. And through that effort, we got more knowledgeable about the market and the needs of our customers, and that's what led us to NGINX. And so that's really where we're seeing the biggest opportunity is in net new opportunities with new workloads with our customers. And then very often, as those customers grow those applications, they start to integrate with BIG-IP. So you'll have components of an application as they reach scale that might leverage some of BIG-IP, some of our security technologies. As an example, we just ported our BIG-IP web application firewall on to NGINX. So now if you have an NGINX environment, you can leverage F5's Web Application Firewall to protect those workloads.

Got it. So software grew for you, I think, 40% last quarter, 47% the quarter before. What are the components of this growth?

So our software spans our BIG-IP portfolio as well as NGINX and then our SaaS offerings. And so we've seen really good success as we've expanded the footprint of BIG-IP, and a lot of this has been supported with our subscription models that Francois referenced. But as we made that transition from hardware to software on the BIG-IP franchise, there were a lot of questions as to whether or not the revenue opportunity would be the same or it could be trading down in terms of the value. And what we've seen is the subscription model has really facilitated a much wider adoption of BIG-IP. We've made it a much more lower friction experience for customers with these flexible consumption agreements, they're able to provision new features of BIG-IP over the duration of their term. And so we've just seen a much larger expansion on what they're doing with BIG-IP. And as a result, the revenue opportunity for essentially what was the same use case has become much bigger on the software side. So that's been one big driver of the software growth. And of course, the NGINX, we took the use cases that NGINX was successfully selling pre-F5 and with integrating NGINX into our portfolio, introducing them into those subscription models, building new use cases, adding security, we've really expanded what customers are doing with NGINX. It's increased the level at which we're monetizing NGINX from the open source base. And then now the SaaS opportunity with particularly the distributed cloud opportunity, we think that's a big opportunity heading into next year because, again, that really expands the reach of what we can do for our customers because we're able to support their application wherever it lives.

While your software growth was high, you also lowered guidance for the last 2 quarters. So why do we see great growth and great success with what you're trying to do, but on the other hand, overall revenues are expected to be lower than before? What are the components of this transition or these trends?

So the overall revenue guidance that...

Yes. So you -- I even have the numbers here, but you lowered the fiscal year '22 revenue guidance for 2 consecutive quarters. You are now expecting growth of 1.5% to minus 4%.

To plus 4.

Plus 4. Yes.

So the -- that one is easy because it's really contained. The only reason we lowered revenue guidance is because of supply chain issues, right? So there's not really an issue with demand. It's really been an issue with component availability, which I know you've seen across the board. For us, it's been -- so we -- the supply chain had been getting tighter throughout 2021. We were feeling it, but we had been able to manage through it. The sudden change that we saw at the beginning of this calendar year was really the increase in the decommits from suppliers on specialized networking chipsets was a big factor. And lately, even power distribution components, which in some ways are more standard, but are absolutely critical to our platforms, we've seen the availability from our suppliers really restricted. And of course, the broker markets for both types of components have completely dried out. And so all of these components, of course, are part of the semiconductor supply chain. I would say, in some cases, even very large suppliers of ours have been surprised upstream by their own suppliers. And that's essentially what's led to the change in revenue outlook for the year. So it's not a demand issue. Basically, at this point, the hardware revenue that we've guided to is essentially a manufacturing forecast about how many boxes can we ship.

Do you have any good news for us in terms of light at the end of the tunnel or not yet? Any better visibility now than before?

I wouldn't say better visibility now than before. But I would say, light at the end of the tunnel, yes, in the sense that we -- our suppliers feel that things will improve. Where we've said we expected things to improve is in our second fiscal quarter of 2023, which is first calendar quarter of 2023, where we would expect to see more components coming into our supply and our ability to start growing our hardware revenues again and then hopefully ramping through 2023.

So a question for both, Francois and Cooper. It's -- I hosted here Juniper CFO, and one of the things he said, orders are going to get negative year-over-year. He said orders were really strong on early ordering because customers couldn't get the supply, so they started ordering 4 quarters in advance and 5 quarters in advance. And that's what led to giant growth rate of orders. And he said we're annualizing it, and it's going to get negative. And Cisco said the same thing. We've seen Cisco. Cisco's orders growth went down from 30% to 8%, it's probably going to get negative next time. What's the -- what are the trends that you're seeing in terms of order growth, early ordering, how much of the great orders that you've seen is related to the fact that customers couldn't get products? It's not about the demand, it's rather than just prudent planning on their side to order in advance.

I think for us, the dynamic is a little different than Juniper. So I would say, first of all, our exposure is more 80% enterprise, 20% service provider. And we see a little different behavior in service providers who are, in fact, more apt at ordering a little more in advance. What we've seen in terms of behavioral. So our lead times have gone from 1 to 2 weeks prior to the pandemic to now they're averaging more 4 months in general. What we've seen because of that, some customers actually have ordered earlier. And it's typically the larger customers that are more sophisticated in their planning. We're also seeing other customers do the exact opposite, which is saying, I have demand for you, but I will not place an order until you've delivered the last one. And it's a way to get leverage on the sales teams to get their equipment sooner. So when we balance those data points, we actually find that it's a wash and there hasn't been a fundamental change. And I think the ordering for us is really more driven by application -- the growth in application traffic, and it's true, the growth in application traffic, especially on traditional application, has accelerated in the pandemic, Maybe we'll see a deceleration of that if the macro environment changes fundamentally. But I don't think we have been the beneficiary of customers ordering a lot in advance or customers taking our equipment, putting it in inventory in a warehouse and waiting for things. So I think the equipment that people have ordered or the software, people use it immediately to support existing applications. So our view is that the demand that we've seen is actually not really a -- it's not distorted by that fundamentally.

I want to talk about your security. Can you first take us through security? What are you doing in security? Any trends that you can highlight?

Yes, I mean the trend I would highlight, Tal, is we continue to see growth in demand for application security. We think that category, which is really protecting the front door of applications is becoming really important. And even more important as the perimeter is disappearing, and applications are not just in a data center, but they're in public cloud, they're in multiple components. So even the communications within applications need to be secured increasingly. And that's the area that we have placed our focus. So we are in, of course, the web application firewall market, DDoS protection around Layer 7 attacks, bot protection, we play a big role in that and increasingly API security. We have just -- so we've offered all of that in a hardware form factor over the last several years in a software form factor. And as of a few months ago, in a SaaS form factor for customers that want security delivered at the edge or don't want to have to manage deployable software. And I think we're now unique as effectively in the industry as being able to serve customers with the same security stack in all 3 form factors. And so we continue to expect good growth coming from security.

I also cover some CDN companies and they -- when they talk about security, they talk about some of the products you're offering, not all of them. Are CDN companies, do you view them as growing threat or growing competitors to you?

Yes, I think to some extent, we do compete. It depends on which market we compete in. Of course, in the -- when we're serving -- when we're protecting applications on-premise or even a virtual appliance in a public cloud, we don't really see them competing in that space. But when we are with our SaaS offering, which is also an edge-based capability, then we absolutely compete with them. And it's a question of does a customer prefer to take their security from the CDN provider? Or do they want a kind of best-in-class security proposition, something that was built for security from the ground, perhaps has best efficacy but doesn't have the 3,000 POPs that an Akamai has. But yes, we do compete with them for edge-based SaaS security. And I think that competitive dynamic will grow over time.

Got it. Cooper, you noted that you're seeing some operating margin pressure in second half fiscal '22 operating margin reaching roughly 27.5% below the prior guidance of 30%. What are the drivers for this? And what's the outlook?

So there's really kind of 2 drivers. They're both supply chain related. One is just the lower guidance on the top line. That's the biggest impact. And we've noted that because our demand is above plan through the first half of the year, we don't see a compelling reason to pull back on investment. We think that this will normalize over time as we resolve the supply chain issues. But that fundamentally, our business is still in a very healthy position and that we want to maintain the investments to continue to drive longer-term growth. So we have not reset our operating model against this, but we view as a more temporary reduction in the revenue level. So that's the first component. The second one is just the gross margins are lower related again to the supply chain where we're seeing expedite fees, we're seeing component costs in the near term going up. Very often, we're resolving some of the challenges through broker markets where we're paying significantly higher prices on these components. Again, that's something that we think will resolve over time. But our model for gross margins, we believe, is an 85% plus model over time. But right now, we're in kind of the 82% to 83% range. So that's going to have an impact on the operating margin, of course, of 2% to 3%.

When things come back to reality or to normality, when you have a constant flow of supplies, do you expect the pricing level to be higher? Do you expect, for example, if I compare your future margin level to your historical margin level, do you expect it to be the same? Or do you expect the pricing environment of components to be different?

For components, well, I mean, it's anybody's guess. Typically, what we see is prices of components as we reach scale, like we talked about the new lineup that we're introducing, as you reach scale with volume, that those components come down over time. And so that would be our expectation. I think your question probably is where component costs have been reset to a higher level, do the component providers hold up pricing. And so I think a lot of that is going to just come down to competition and capacity. I think that as you see capacity increase, you would expect those prices to come down. The question is more whether they come all the way down to what you would have traditionally seen. So that's something we'll have to see. I think that the benefit from our business model transition as we continue to go more to software, is it the impact, even if those prices stay somewhat elevated the impact becomes lesser and lesser over time.

Francois, you touched on acquisitions you made, and I want to go over the acquisition, if you don't mind, if you can take us through the acquisitions and why were they strategic to the company or how they can -- how the company can benefit going forward from this.

Yes. Well, Tal, I mean I just want to start, at the highest level, the strategy of the company is what? It's to serve large enterprises. And for those large enterprises, be able to secure and deliver any application anywhere for these enterprises, okay? And that value proposition is very compelling for a large enterprise if, in fact, we can deliver on it. Okay. So to secure and deliver any application anywhere, first, you have to be anywhere. So you have to be anywhere these applications are going to be, which is work with it organically by making BIG-IP available in all the clouds and private clouds, all these integrations that we did, and also making sure there was a commercial form factor that made sense anywhere for the application. Why was NGINX strategic in that context is that the majority of modern applications are built in these container-native environments, and we have to be part. If you're going to support any app, you have to be in these environments. Shape was strategic because increasingly, when we say securing and delivering application, the securing part involves protecting applications against automated attacks and protecting how applications are used. Things like network firewall and network security protect the traffic coming into applications, but have no visibility into Layer 7 traffic and whether somebody is exfiltrating a credit card from a banking application and really understanding what is being done in an application, who's authenticating into this application, what exactly do they intend to do. And so Shape Security really allowed us to protect applications against automated attacks and how these applications are used and do that for effectively any application. Volterra was really important because to protect any application anywhere, you have some applications where customers don't actually want to manage software. They don't want to manage the life cycle of it. They don't want to patch vulnerabilities. They don't have the resources to deal with that complexity. And so having a SaaS offering increasingly for modern applications is absolutely key. That was one big reason for the Volterra acquisition. But the other big reason is you remember, Tal, about 5 years ago, there was this view that applications were in a single location called the data center, and they will all move to a single location called the public cloud, and we would be done with it. The reality has proven very different, right? All of the large enterprise are in hybrid environment and increasingly, it's on-prem plus multiple public clouds. And that's going to be the way forward. Now Volterra allows us to do something for customers, which is pretty unique, which is if you have an application and you want to replicate it from on-prem to a public cloud, or between this cloud and that cloud, you now have to figure out all of the networking and security issues between these 2 applications, the DNS addressing, the IP addressing, and it's very complex. So you either have a lot of resources that have the sophistication and the time to do this or you can come to us, and we have through the Volterra acquisition, essentially become the middleware that allows you to network all these clouds without having to deal with that complexity. And that's why it was strategic. So it's allowing us to fulfill that vision of securing and delivering any application anywhere and making it easier for large enterprises to deploy applications across multiple environments.

So we have 30 seconds, I'll ask you my last question, which is, together with it, the buyer is changing. You secure applications, you do the direct applications. We -- in software, there is something what we call shift, the shift to the left. Are you also changing the way you sell to be more with DevOps, to be more with application developers? How is your "go-to-market" changing?

Yes, it's a great question. Yes, the go-to-market is changing. We used to sell to a single persona called the NetOps person. And today, we sell to multiple persona, largely SecOps, NetOps, and DevOps or platform teams. And those are the 3 personas that F5 go-to-market addresses. And we've made fundamental changes to our go-to-market, our technical sales organization, our lead generation engine and engagement engine to be able to serve these 3 personas increasingly with better and better efficiencies. So that's a big change that actually is going on at F5.

Perfect. Thank you so much, we ran out of time. Thank you so much. It was very deep and thorough.

Thank you, Tal. Appreciate it. Thank you.