F5, Inc. (FFIV) Earnings Call Transcript & Summary

We're going to start with a love letter from the lawyers, and then we're going to keep going to our session.

Thank you, Tal. I will, therefore, read my love letter. So the safe harbor. Before I respond, I need to get our safe harbor on record. Please note that our discussion today may contain forward-looking statements, which involve uncertainties and risks. Our actual results may differ materially from those expressed or implied by these statements. Please see our SEC filings for more information on these risk factors.

Excellent. So today, I'm hosting Francois and Cooper from F5. I've been covering the company for many, many years, and I want to focus on this session. We have a webcast also. I want to focus on this session on the big fundamentals. It's less about the quarter, less about kind of -- I want to actually focus the session on the big drivers for it and how you drive growth for the next 5 years, for the long-term investments. That's basically the purpose.

And maybe I'll start with a general question. Francois, if you can take us basically, through how you see growth in your business? If you can give us kind of an overview of your business or big buckets of the business? What's the current growth rate? Where you have challenges and where you have opportunities?

Good. Well, thank you, Tal. Thanks for having us. So let me just say a word about where we've been, and it will explain the kind of markets that F5 is exposed to today and where we see the growth. So we used to be a traditional ADC company, and we have transformed to now a company that secures and optimize and delivers every application anywhere. And that's really increasingly, when our customers interact with us, that's why they look to F5, as a partner that can secure and deliver their apps in any environment. So with those capabilities, what markets are we exposed to? Of course, we continue be exposed to the traditional ADC market. That is an extraordinarily sticky franchise, that has a lot of durability, a lot of predictability. It supports traditional applications. Traditional applications continue to grow, albeit there are, I would say, single-digit growth in terms of the number of applications put in production. But we continue to support that with our traditional ADC business. We have continued to gain share in this market. And because we have continued to invest in this area, we expect to continue to gain share in traditional ADC, which is hardware and software. Largely, I would say a lot of it on-prem, but increasingly with lift and shift, some of it in public cloud. We now also support modern applications. Largely with NGINX and the addition of our F5 distributed cloud services, modern applications are growing quite rapidly. And NGINX is well positioned as the technology that allows these modern applications to go in production and be secured and be networked and be resilient. And so this is an area where we have seen and continue to see very good growth. We are now also exposed to the application security market, both for hardware and software and for Software as a Service. We used to be primarily -- we use to have a security footprint that was, I would say, limited with primarily, web application firewalls. Today, we play in web application firewall in bot defense against automated attacks, in DDoS and in API security. So we have a full application security stack, both for on-prem deployment and for SaaS deployment. Where we expect to see the fastest growth in this market is in the SaaS and managed services aspect of the business, which we expect will contribute quite significantly in the future for F5. And then I would say the fourth area, which is also an emerging area, is multi-cloud networking. Increasingly, applications are distributed for large enterprises between on-prem and one from public cloud on on-prem to another public cloud. And networking these applications together, making applications talk with one another and exposing one part of applications to the public Internet requires a lot of Layer 4 to 7 technologies, things like API gateways and ingress controllers and load balancers, and things like that. We have packaged that in our SaaS platform and are starting to get quite a bit of traction in this multi-cloud networking market. So those are between traditional ADCs, modern applications, the whole application security and multi-cloud networking. Those are, I would say, four of the core markets that F5 was exposed to with different growth rates.

Perfect. Great setup because I'm going outline my questions based on these 4 areas. So traditional applications, clear -- your dominance is very clear as well. The only question is whether tools offered by cloud companies -- because there is a trend where companies do lift and shift. They take the traditional application, run it in the cloud. Are the tools offered by the cloud companies, can they substitute the need for an ADC? Or is the experience that companies maintain their ADC tools?

Companies maintain their ADC tool. So I think we should separate. If you're building a new application in any public cloud, and it's new nascent app and you're building it in the public cloud, there are a lot of cases and reasons why using the native tools of the public cloud makes a lot of sense. When you're talking about applications that -- either the same applications that become larger and go into production, maybe need to be in multiple environments, have requirements for security and compliance that are significant, that's when the feature richness of ADC matters. And the fact that ADC is also infrastructure-agnostic, that matters, and you typically move to ADCs. For traditional applications that already exist, that started on-prem, whether you're moving them to a public cloud or keeping them on-prem or moving them to a private cloud, 99.9% of the time, you're going to want to remain on ADCs because if you don't do that, you'd have to refactor these applications, which is an enormous amount of work with questionable ROI. And so for most large enterprise that have applications in production, they will remain in ADCs and they will go -- they will lift and shift to the F5 virtual edition to be under the application if it goes into the public cloud or if it goes in a private cloud. And that is in part why the BIG-IP franchise of F5 is so sticky. In addition to that, I think one of the things that has changed over the last few years is we have invested in bringing the superpowers of the cloud to on-prem. And so we have new generation of hardware and software, as you know, that is coming into the market, rSeries and VELOS platforms. What those bring is things like the ability to automate scaling an application quickly, the ability to do upgrades much faster and to deploy new applications much faster. Hitless upgrades are on the horizon. Those kinds of things are some of the things that customers want from the benefit of the public cloud, but we are bringing these things to an on-prem experience which allows customers to have a better experience and operationalized platforms and consume more on-prem as well.

Got it. The second area that you spoke about was modern applications or cloud-native applications, and these are built completely different way, in a sense that there is, first of all, architecturally, there's Kubernetes, there is containers and in terms of building blocks, a lot of open source. Explain to us first the basics. Is this complexity making ADC more needed, or less needed, or the functionality? And second, what is your role in this world of modern applications? How did it change from traditional applications?

So a couple of big changes from traditional applications. Modern applications, as you say, are typically, they are container-native. They are typically built in these microservices environment. And they are, therefore, often more distributed. The components of these modern applications can live in different places. So if you want to provide application services to these applications, you need also lightweight application delivery. That is in container form factors. That's the big -- first big difference with traditional ADCs. Think of a traditional ADC as a 15-wheeler and a modern -- ADC modern application as a sports car. It's two completely different form factors of software. One is gigabytes, the other one is a megabyte. I mean it's just that order of magnitude different in terms of the size of it. So that's part of the reason we purchased NGINX, was to be able to insert in this environment. The other thing that is different in modern application is because they are increasing distributed, there's a lot of east-west traffic in these applications. That east-west traffic goes through APIs, and APIs need to be secured. So API security is emerging as an important practice in modern applications. And of course, we have a very significant play in this area. But I would say, the NGINX -- one of the things on modern application is Kubernetes is used as the technology that orchestrates the containers, helps to deploy containers and orchestrate them. But when you want to go into production, these different containers or microservices actually need to be -- you need to have resiliency for the application. You need to be able to network them together. You need to be able to secure them. And if you don't have NGINX, you're going to use 4 or 5 different technologies to do that. NGINX now is the technology that brings all of your networking and security together to be able to deploy and roll out and scale your applications into production. And the thing about modern applications is they can scale quite rapidly, and you need to have underlying technology that scales horizontally. We just did a -- just this quarter, we did a renewal for one of the large collaboration platforms that's built on NGINX. And the -- this is a deal that we signed 3 years ago. We just renewed it, but the renewal was 10x the size of what we did 3 years ago, just because of the scaling of that modern application, and that's what we're seeing in this environment.

This is more software-centric, et cetera, but your software revenues declined last quarter. There are -- the growth is less than expected before. What are the underlying drivers in this segment?

Cooper, do you want to take that?

So -- I mean what we've seen in the last couple of quarters is a lot of the kind of macro pressures that we've seen on the hardware side are also manifesting on the software side in relation to new large software projects. These are typically net new projects, multimillion-dollar opportunities, where budgets are being either constrained or they're being delayed. And so what we've seen in a number of cases is we've had opportunities with customers that have been sized. And we've effectively won the deal where the customers decided that needed to either downsize the deal or delay it until they either have the budget or the operational capacity. Because there's a lot of change happening within some of the operational teams. And so that has led to a reduction in the near term of the closed deals. What we have been seeing is the level of engagement with customers, the pipeline activity has continued to grow. And so we are confident that -- over time, that, that growth opportunity will continue to rise. It's just a matter of timing as to when some of these deals close. Now what we have seen is really good resilience on the renewal side of the business. And that renewal opportunity continues to grow. These are the large multiyear subscriptions we've booked in prior years. As they've come up for renewals, we've seen renewal rates in line with what we've seen from day 1. And so that gives us, again, a lot of confidence in the long-term trajectory in the software business.

And the renewals are on BIG-IP or on NGINX?

It's both, and Francois alluded to one large NGINX opportunity. And actually, that's -- kind of back to the prior question, that's where we've been seeing a lot of opportunity with customers. We talked about traditional applications and modern applications, but it's not always an either/or. A lot of times, you have customers that are looking to modernize traditional applications. You might have, for example, a large retail application where you're adding a loyalty program. And that traditional retail application, maybe a more data center-based application that's supported by BIG-IP. But as you're adding these modern components, you leverage NGINX just for the agility and simplicity that the NGINX application services provide. And we're seeing more and more customers that are purchasing both BIG-IP and NGINX together in our flexible consumption agreements because of how they're seeing their applications evolve. It's not just the new application that needs NGINX, but it's the continued growth of their existing applications as they add more modern components.

Right. And how do you know -- and is there a way to know if this is just about economic slowdown? Or -- the alternative concern is that when the company is migrating from BIG-IP to NGINX, the demand is just lower for whatever reason, maybe there are alternatives or maybe inherent, I mean, tools that the cloud has. So how do we this is about the current times, which as investors, we don't care about it? Meaning we care now, but not in the long run. How do we know it's about the current times and spending, and it's not about competitive losses conceptually?

Yes. I mean a lot of it is just the conversations we're having with customers, the kinds of opportunities that we're seeing in our pipeline, but we still have not really seen, in most cases, any of this migration from BIG-IP to NGINX. So customers are -- as Francois said, they don't refactor existing applications. It's very operationally intense effort and there's a low ROI. So it's more about the timing of -- as they either replace the existing BIG-IP operating system with the next generation or as they expand what they do with their applications, leveraging both BIG-IP and NGINX, but we're not really seeing that migration.

And we're seeing -- I mean in terms of the concern of -- is there something other than the macro? So we monitor that closely. First of all, we monitor our win rates. And our win rates against competition, or as they have been in the past, there's been no material change there. We monitor the service attach rate. So we're seeing customers are sweating their assets a little longer. So boxes that are 3 or 4 years old that typically they would refresh, we see them becoming 4, 4.5 years old because customers are holding on to them or trying to increase the capacity. And what we see is it's really scrutiny on projects that customers want to do, but can't do in the mid -- I'll give you a good example. In our March quarter, in the financial services sector, which is -- it was a very acute anxiety in part after the fallout of the SVB situation, we had a large 8-digit deal that was postponed indefinitely. You can look at that and say, wow, maybe that's a competitive issue and an architectural issue, while the customer turned around 3 weeks later and say, "We can't do this thing immediately. We will come back to this big transformational project. But for now, I'm going to buy some hardware to increment my capacity." This is what we're seeing that really tells us that we are at the heart of the architectures the customers want to build for the future, but we're in the middle of the short term where customers are delaying projects. One thing that has changed fundamentally from 6 years ago in our business is this, 6 years ago, and I actually remember having these conversations with you, Tal. When I joined F5, we were hearing a lot of, hey, all of our applications are going to be in the public cloud. They're going from a single location called the data center to another single location called the public cloud and 100% of them will be there in 6 years. And so whether or not we want to buy hardware or do anything with a vendor that has a history on-prem, maybe there's a question mark on that. Fast-forward to where we are today, that hasn't happened, right? And actually, it isn't happening. Meaning, what has happened and is happening is for most large enterprises. And remember, F5 is a company that's focused on large enterprises, not SMEs. For large enterprises, what's happening is more and more of their applications are distributed in multiple infrastructure environments, private clouds, traditional data centers and multiple public clouds. And that gives them a lot of flexibility of choice of infrastructure. There's a lot of benefits to that. But to secure applications across this environment consistently, and to make these applications perform across these environments consistently is incredibly complex, and it is very manual. And F5 is essentially the only company that is infrastructure agnostic and can provide the security and delivery for all these environments and increasingly automate that. That is a position that we are basically beginning to occupy in the industry. That is very unique. And it's a position of architectural strength. And it comes from the technology assets that we've built together, both organically and through the acquisitions we've made.

Got it. So two related questions, one is on pricing and one is competition, both related to one another is, how is the pricing and competition environment, both in legacy BIG-IP and in the new NGINX environment?

So in the traditional ADC market, the competitive intensity, I would say, hasn't changed. But because we have organically invested more consistently than we feel other players in the play, we feel that we're in a very strong position, both on hardware and software across any environment. And it's, in part, because of what I shared earlier about these new platforms that are coming and what we have done there, the operational experience is different. So when we go into these deals, if you look at -- even if you look at the discounting practices we've had, I would say we are probably discounting less this year than we were in prior years to give you a sense of the competitive intensity. And that, despite the fact that prices went up last year related to the supply chain thing. So I think we feel very good about the competitive intensity. In the case of NGINX, it's a different paradigm. And frankly, there's a lot of dependency on which application we're talking about. Do we have expectations that application is going scale? NGINX often starts with deals that are in smaller size, so frankly, therefore, have less scrutiny initially, but then can scale quite rapidly. So it's a very -- it's a more dynamic and different pricing environment than on BIG-IP.

Is NGINX and -- substituting BIG-IP? Or is it a new opportunity? And the reason why I'm asking it is because there is quite a big price difference, at least at the beginning, there's a price difference. So if NGINX is substituting, we might see a decline in the average price until volumes pick up. And if it's not, then it doesn't have an impact. So how do you view NGINX? How customers view NGINX, substitution or complementary?

Totally complementary, I mean 99% complementary, I should say. It's very rare that we have an opportunity where customers are like I don't know if I should BIG-IP software or NGINX because the environments are different. So if a customer has traditional applications, it's BIG-IP. If they want to add a modern component to that application, typically, it's NGINX that augments BIG-IP. If they're building a new modern application in public cloud or anywhere, and they need networking and security, typically, that's NGINX. And now increasingly, we have customers that don't want to own any software. They want us to provide all of these capabilities as a service, and that's F5 distributed cloud services, which is we introduced 15 months ago, but is gaining rapid traction.

How important is it, the cloud service? How important is it to the customer and how important is it to you?

So let me illustrate your question with an example. I was just in India 2 weeks ago. And I was meeting with one of the largest private sector banks in India who are an F5 customer. They started using F5 BIG-IP hardware on-prem to protect some of their core banking applications, then they lifted and shifted some applications in the public cloud. They went and used F5 BIG-IP software in the public cloud. And more recently, they had another 200 applications, which they had not protected in the past, but they now needed to protect. They wanted an as-a-service offering. They looked at competition of other folks who would do SaaS security, but they chose F5 distributed cloud services because they wanted the same WAF engine to on-prem cloud and protecting these applications. F5 is the only player in the industry that can provide the security across all these form factors in a consistent way and in the future, give a single pane of glass through which you can see that. So F5 distributed cloud services is really important to us, to answer your question, because we see a number of our customers that, for some applications, want to consume the Technology as a Service. They have this problem of the complexity of networking applications between cloud. F5 distributed cloud services automates all that for them. And so it is both really important to us and increasingly important for our customers to solve their multi-cloud complexity and their application security issues.

Right. And Cooper, the profitability of the cloud service is higher or lower than BIG-IP or the competitive kind of the alternative?

Well, right now, it's just based on scale. It's a lower operating margin. There's infrastructure that we invest in. So as we scale the revenues, you'll see those margins continue to go up. It is a software-based solution. So over time, we think those operating margins can approach the same levels we've seen at the BIG-IP level. But in the early days, it's an area where we are investing in.

Got it. Okay. I'll stop here. Just before I move on, I just -- to see if there is any question from the audience. No. Very good. I'll continue. By the way, in my 20 years career, I've never asked a question and someone raised a hand. I'm just saying. Well, I...

You still do after 20 years.

I'm going to be optimistic. I'll continue another 20 years. Security, I need to understand where you are and what is your value proposition. So define me -- if security is a big giant space, define me the competitive edge that you have in the market? Or where are you positioned in security?

Great. So in security, we are focused as a company on an area called application security. And I want to explain what that is. Understand that F5 -- the core thing to understand about F5 is that we understand application logic and application traffic at a level that's more granular than any other company on the planet. And so when we go into security, that's the heritage we bring into security, is the understanding of what happens between Layer 4 and Layer 7, how do you manipulate application traffic to make it work, to make it secure. So we didn't decide to go into security and go do all things in security. We said we are going to bring this heritage of application fluency to being the best in the world at securing applications. The technologies that secure applications today or web application firewall. They are a special type of firewall that really understand application traffic in Layer 7. API security, because increasingly, application are decomposed and there are billions -- enterprises deal with billions of API calls every single day that if you don't secure them, it's a new attack surface that is a problem, Layer 7 DDoS, denial of service attacks that are growing increasingly. And one of the biggest problems at the moment for a lot of enterprise is bot attacks, automated attacks on applications. So these 4 technologies now are part of a stack we call application security. We have a very strong position and a full stack in all 4 of them. And what we're seeing is customers want to consolidate. So in the past, they may have bought these 4 things from 4 different vendors. And it's these 3 vendors on-prem, it's these 2 vendors in the cloud, it's these other 3 vendors for CDN or at the edge. And what we're seeing is, ideally, customers want to have a single vendor that gives them this full security stack. And ideally, the same across these environments. That's where we're positioned. That is where F5 is extraordinarily strong, and that's why we're seeing a lot of growth in this area.

What makes you positioned better than others for this?

Two things. One is very strong application fluency. So understanding of Layer 7 attacks across all these vectors. API security, for example -- like API attacks, you have to understand application logic to do that. So to block them, you have to have application [ expertise ]. So number one is that. And number two is the fact that we're unique in delivering that in any form factor. You can -- there's no other company you can go to that says, "Hey, I want my applications protected with the same stack in the cloud, in hardware, in software, or in SaaS." You have some edge players that will deliver that to you on SaaS and in their environment. You have maybe traditional ADC players that will deliver that to you in hardware, but you don't have any other player that can deliver that across the board. And that's what makes us unique for large enterprises.

Got it. F5 started its roots in networking, but in the -- between applications and networking. This is more in between applications and security. Is it the same buyer? Is it -- are you going through the same channels? Did you have -- do you have to beef up your channels more on the security side? Speak about your go-to-market strategy.

Our go-to-market strategy has been and most likely will always be a focus on large enterprises and service providers. So in large enterprises, it's -- when I say that, it's really high tech, financial services, telco, retail, e-commerce, those large verticals. In large enterprises, our buyer personas are -- typically, network operations and security operations are really the two buyer persona that we spend a lot of time with. And the way we get to this buyer persona is through the F5 sales force, which is a high-touch sales force and the several thousands of partners that we have that both fulfill and initiate opportunities for F5. In that partner community, the majority of them actually do sell security already and used to sell it with F5, but increasingly, are now selling our security solutions. And one of the things that is quite exciting for us is the speed with which our partner community is actually embracing our distributed cloud services and starting to sell SaaS to our customers.

Do you feel that your -- the education of the channel, the readiness of the channel to sell your bigger portfolio, do you feel that you are at the right place? Or is there more investment needed, not in money, in terms of effort, investment needed in order to bring the channel more aligned with your portfolio?

I think there is more investment needed. I think we're in the early stages of it. We're happy with what's happened because over 50% of the deals we have won over the last 15 months in the distributed cloud services space have been opportunities that our channel partners brought to us. So we're happy with their involvement, but it's very early days. And I would say probably today, because we have thousands of partners, the majority of them haven't yet -- more opportunities in this space. And some of them are not even aware that we have this offering. So there's a ton of work that we need to do on our -- with our partners to accelerate the go-to-market and our presence in this space. I'd say we're probably 10% to 20% of the way to where we want to be.

Great. We have the red light blinking here. It means that we ran out of time. Thank you so much.

Thank you, Tal. It's a good conversation.

Thank you. Excellent.

Thank you. Thank you.