F5, Inc. (FFIV) Earnings Call Transcript & Summary

Thank you so much, Abby. My name is Alex Henderson, I'm the networking and security analyst at Needham. And it's a pleasure to have F5 here today. It's one of my longest-standing companies under coverage. I think we date back into the '90s on you guys. We have Kara Sprague, who's the EV of -- and Chief Product Officer; and Cooper Werner, SVP over in Finance. We're going to do a 35-minute fireside chat. If you have questions you'd like to ask, I have the dialogue box at the bottom of your screens, you can type in a question there, and I will see it come up and try to feather it into the conversation. Or you can e-mail me at [email protected], and I'll handle it that way. So with that, welcome, guys.

Thank you. Great to be here.

Thank you for having us.

So I hope you guys can remember what you've said and not said in all your one-on-ones today. I know it can be grueling or remembering what's been covered. I think it's a useful exercise to remind people where you are in this transition of the company. I think a lot of investors certainly know of F5, who've been around forever. In fact, you were one of the great stories in the networking space for over a decade. But I don't think they understand how much you've changed. And I was hoping you could talk about that significant change that you've done over the last 3 to 5 years, and what you're transforming into.

Great. Let me start with that one. But before I respond, I'd like to get our safe harbor on record. Please note that our discussion today may contain forward-looking statements which involve uncertainties and risks. Our actual results may differ materially from those expressed or implied by these statements, and please see our SEC filings for more information on those risk factors. So Alex, to your question of what have been some of the changes that we've been driving? I'm going to benchmark it back about 6 years. That's about the time frame in which Francois came in as CEO, and the executive team largely has been new with the exception of one member since then. And over that 6 years, there's been an enormous amount of change in F5. At the top-most level, from a business model perspective, 6 years ago, we were a company that was 87% of our product business was perpetual hardware. And where we are today in 2023, we just provided our earnings a few weeks ago. and we have managed to reach 50-50 split between hardware and software in our product business, which is just a phenomenal transformation. By all accounts, or at least by our own research, we are the only public company to have achieved transitioning from being a hardware-led business to being a software-led business. And we did it in a quite short amount of time relative to other players in the industry that have been at it for a much, much longer amount of time. Well, how was this possible? Well, the capability that F5 provides to our customers, it's a capability -- technically, it is described as a Layer 4 through 7 services. But in human speak, what that means is that we provide a bunch of capabilities or empower different application components with better availability through load balancing; with better security through things like web application firewall, tying individual's identity to the application, meaning if I'm not who I say I am or I can't prove who I say I am, then I do not get access to the application. We provide the component parts that ensure that those applications are running as effectively, as available, as resilient and as performant and secure as possible. And that was something that we provided back in 2017, 6 years ago, and it was provided for applications that at that point, we're still very largely based in an organization's on-prem data centers. And we provide that capability still today, only what we've done with our portfolio is expanded it significantly so that we can now address any application no matter where that application is. So we are the only solution provider out there that secures, delivers and optimizes any application, any API, anywhere; in the on-prem environments, in any public cloud, as well as now in the edge with our capability in Distributed Cloud. So I'll pause there and see if there's a follow-up on that.

Well, there's plenty of follow-ups on it. So you've done some of this through acquisitions. You've changed the nature of what you're doing quite substantially. I think the first one that was quite trend-disruptive to your historical business was the NGINX acquisition. So NGINX is a virtualized ADC, it's used in most Kubernetes environments. Can you talk about why you acquired that, and how that changes your capabilities to participate in what I would describe as modern software development?

Very, very happy to. And to put that in context, over this transformation I talked about from 2017 to today, we've completed over $2 billion in acquisitions -- or around $2 billion. And I'll talk about NGINX specifically. That is an acquisition we completed in 2019. And what NGINX does is it enables us to expand our reach into modern application footprints. So historically, what F5 had, we have a product family called BIG-IP. And BIG-IP is the market share leader in deployable application delivery controller solutions. BIG-IP historically has been in the 45% to 50% range, and it continues to be in the 45% to 50% market share range for deployable, meaning hardware-packaged software solutions. NGINX is a great complement to our portfolio because NGINX is ideally suited to be providing proxy services, load balancing, application security to modern applications. And when I say modern applications, it's those that are container-native. Most applications developed today, anything after 2014, the vast majority of them are container-native and microservices-based applications. And so for F5 to have that capability, with NGINX, which lets the same kind of availability and security functions that we were serving more monolithic applications for with BIG-IP, to now reach into modern applications with NGINX, it was a tremendous expansion of our reach into the more modern space.

So NGINX is heavily coder-centric and it's cloud-delivered product. The ADC market is heavily IT-centric and generally, CTO-, CFO- or CISO-oriented. So how do I bridge between those 2?

Yes. So the bridge between all of those 2 is in -- and I would connect them in terms of the life cycle of an application. Applications are developed by developers. And those developers, once they make the code, they then want to have the application become accessible to their user group. And they do that by putting it into a production environment, and adding these capabilities that we're talking about in terms of load balancing, security, et cetera. And those are often capabilities that are added by production operations teams. And so all of these are connected across the life cycle of an application. Within IT, as I said, that's traditionally been the domain of network operations and IT operations, security operations team members. And what would happen would be, a developer would develop logic or an application, they toss it over the fence to the production team of network operators and security operators. They would put BIG-IP in the line of traffic for that application to ensure the enterprise standard was added. And then end users would then access it. With NGINX, NGINX allows F5 to now shift left much more of those functions, meaning that developers, because NGINX is a preferred developer tool, it is the world's leading web server, and it is deployed already and embedded already in over 260 million web applications. What that means is that our services are getting embedded and used by developers at the time of an application being developed. And that is very powerful for -- very powerful for security operators because that means that they don't have to go back and forth between the development and production team in tuning security policies. That means you can do that right when the application's being developed. So very excited about having a suite of capabilities now that addresses end-to-end, from the time of an application of origination, all the way through to when it's actually serving its production traffic. And I'd be remiss if I didn't mention the third pillar of our portfolio. I talked about BIG-IP. We talked a little bit about how NGINX extends our reach into modern applications. But then the third pillar of F5's product portfolio is what we call Distributed Cloud, F5 Distributed Cloud or we call it XC as the shorthand. And XC is a suite of SaaS and managed services capabilities which provide, similarly, application security and application delivery for multi-cloud and hybrid cloud applications, but it does it via a SaaS and a managed services deployment model. And so between the 3 of those, BIG-IP, NGINX and F5 Distributed Cloud, that is why we feel very confident in making the claim that we are the only solution provider that secures, delivers and optimizes every app, every API, anywhere.

Great segue to the next piece of your process, which I think was the Shape acquisition. What does Shape bring in? And how does that fit in? And I think you said the NGINX-ADC marriage gives you better security, and here's the security acquisition.

Yes. So Shape Security was an acquisition we made in 2020, and that is a business that is 100% SaaS and managed services. So today, what it looks like, it's integrated into our portfolio as are the rest of our acquisitions. But Shape shows up in our F5 Distributed Cloud web app and API protection offering, which is Gartner, it's short for WAAP -- or WAAP is the shorthand name for that. But that is a capability that includes a web app firewall, it includes API security, it includes distributed denial of service, as well as anti-bot. And so Shape, when we bought them in 2020 and also still today, has best-in-class machine learning-based traffic profiling capability. What that means is that it can discern, based on signals that it's looking at, whether or not the traffic is being generated by a human or by an automation or a bot. So we can tell if it's human or bot. And then secondly, it can also infer, from those same signals, is this good traffic or is this bad traffic? And so that traffic-profiling capability, again, it's using very sophisticated machine learning models, that is now being used as the anti-bot portion of our web app and API protection offering within Distributed Cloud.

Okay. So putting all of that together, you're very much tied to the application. And the application market has gone under some dress over the last 12 to 18 months, what Zuck calls the year of efficiency. Whether it turns out to be a year or longer, we'll see. But a lot of applications having been pushed out to the cloud were then left somewhat idle by a lot of coders, inefficiencies built into the cost structures. As the year of efficiency played out and we clean all of that stuff up, does that diminish your -- temporarily diminish your growth for that business because those instances are now being taken down?

Well, let me talk about that in parts. So I think, at a fundamental level, at the highest-order level, F5's growth of our product portfolio is tied to the demand for applications. And I put APIs or small microservice applications. So our demand and our business is fundamentally tied to the growth of apps and APIs. We can grow by extending our reach to new apps and APIs by adding more services on top of load balancing on top of a web app firewall, on top of anti-bot, on top of those apps and APIs, by extending to net new customers that have apps and APIs that need these services, and also by simply the underlying growth of those apps and APIs. So for example, if we sell our services into a customer that has an application that just totally takes off and rips, they will by nature and need more of our capabilities in order to simply sustain that application and its growth, okay? So that means that if you believe that the world is going to continue to become more digital and that organizations are going to continue to invest in applications and APIs in order to better their customer experiences, to streamline their operations, to take advantage of AI, that means that F5 is going to benefit. So that's the first-order of thing and we...

Well, let me stop you there for a second. So the rate of growth in applications for the last 5 years, let's take a longer-term view of it, has been in the 20% to 30% range, yes?

Yes. It's growing very fast.

And so the year of efficiency may have devoted that, but it's -- the trend lines as well established, probably going to get back on to that trend line.

Precisely. And COVID, the pandemic, accelerated all of this digital transformation. And look, I don't really think of myself as a technology optimist, I think of myself more as a pragmatist. But the world is going to become more digitized. That is a secular trend, and AI is only going to further drive that trend. The second secular trend I would comment on that serves F5 well is that we are a neutral player. We help customers arbitrate between their on-prem environments and public cloud, between multiple public clouds. And so all of our technologies, every single product family, from BIG-IP to NGINX to Distributed Cloud, is fundamentally hybrid and multi-cloud. Where is the world going? The world is hybrid and multi-cloud. It is very hard to find an organization or multiple organizations that have gone all in and intend for the next several years to be all in on a single public cloud because they're realizing that they want to be able to take advantage of the capabilities across them or play them off against each other. And what F5 is doing is we are now putting in place the glue that connects all of these environments together. And that is incredibly powerful and incredibly valuable for our customers. So that's -- those are some of the trends. You talked about the year of efficiency. And the way that we have seen that play out is, yes, customers have been scrutinizing their cloud consumption and making sure that they don't have their various cloud accounts running wild with overages and having to pay for that. And I would say that has not -- that is not a material impact to what we have seen in our business. But also what we are seeing is customers are sweating assets. And so I mentioned that half of our product business is still tied to a hardware-based model, in the data center. And one of the things that customers have with hardware, because it's the kind of thing that you buy and you set it and you can hopefully forget about it, is you can also sweat that asset. You can decide, I'm not going to refresh that asset this year, I'm going to push it for one more year. Now that imposes risk on them because they're using more outdated technology and maybe they're pushing the consumption beyond what they would have previously. But customers do have that optionality with some of these things to effectively sweat these assets and hold off on putting in more capital.

Well, going into that side of the ADC business, you had a huge backlog build. The supply chain wasn't allowing you to ship stuff. That turned around very quickly. As supply chain rapidly improved, you shipped a ton of product. I think you've talked about $180 million headwind in the fiscal '24 numbers. And that should play out and get you back to normal environment on the other side of that. Is that a fair depiction?

Yes. And we talked about that, you're right, $180 million represents the reduction to our backlog over the course of FY '23 as we were able to source the components we needed to kind of get back to a more normalized shipping capability. And so you saw that, over the back half of the year, our backlog return to kind of more sustainable levels. And so I think as we move forward, the revenue that we see on the hardware side should be more approximate to the underlying demand. Now what that doesn't speak to is the extent that customers are continuing to sweat their assets. Our expectation is that they are getting close to that point where they need to reinvest. And whether that's a full snapback and they get caught up to their normalized aging of their infrastructure or that they just kind of keep the aging where it's at, either way, it's -- that would be an increase in demand versus what we saw over the prior year. And so that's kind of the offset to that headwind. Do we fully expect it to fully offset that headwind in FY '24? Not likely but we do expect to see a bit of a resumption on the hardware demand. And we started to see signs of that in our Q4 of FY '23, where we had our strongest bookings quarter from a hardware perspective.

All right. Just to put some content around that, I believe the ADC market is a fairly stable flat to down a slight market in terms of overall systems demand. And I think it was the second quarter where you guys posted a very strong growth rate in systems, what was it, FY 2Q, which is up 42.5% in product system sales. Obviously, that's not normal. And that's the comp here for the current quarter, right?

Well, yes, so the first half of the year is when we really start to get caught up on our shipments. So if you look at the second half of our fiscal year, and that's kind of more indicative of what kind of the underlying demand is. But you're right, the March quarter that, from a comp perspective, that's -- I mean, that was a high revenue growth quarter, and then we started to see that kind of come down to normalized levels.

So once we get on the other side of that, it starts to normalize. Looking at the ADC systems business, you guys launched a new product line at about this time last year, maybe a little later. The problem was that you didn't have all of the use cases in place. Can you talk a little bit about the mechanics of that launch? What it implies in terms of renewals? When do you start to benefit from that? All of those elements.

Yes, happy to. So we launched our next generation of physical systems. This is our -- the hardware business, which is the half of our product business. And that next generation is called rSeries for the appliance line; and VELOS, which is a chassis form factor. Both of those were launched or introduced to the market in around February of 2022. So we're almost going on -- we're around 20 months right now. And we planned an accelerated path to get to use case parity with our prior generation of iSeries and VIPRION. And also to address -- we were going through these supply chain challenges, and we wanted an accelerated ramp-up of this next generation particularly because we had fewer supply challenges with the new generation because we weren't using as many dated or old components. We have achieved the fastest transition in our history in terms of the amount of our systems business that is shipping from this new generation. We achieved 80% of that in Q4. So that is the fastest, and we're very proud of that accomplishment. In terms of the future for iSeries as the prior generation, we have announced end of sale on that one that's coming up in the first quarter of calendar '24. And it will follow our standard kind of end of sale through to end of service and end of life process.

And so what is the end of life on that product implied by that?

Alex, I'm going to -- I don't want to misquote the specific date on it. I can -- but it's years out. We generally have somewhere around 3 years from end of sale to the end of software development and then several years beyond that to end of technical support.

Okay. I got it. So given the lack of all of the use cases that kind of lagged in terms of orders, that's now fully caught up?

Yes. We are at -- we have provided a rSeries and VELOS offering or platform That addresses more than 95% of the addressable refresh from iSeries and VIPRION.

So the software business has pretty significantly decelerated, it actually turned negative for a bit there. Can you talk about why that occurred and whether -- when you see that recovering to a growth trajectory?

Yes. A lot of it was some of the same dynamics we were seeing on the systems side of the business where you saw budgets really constrained with customers. And so what you're seeing is a pause on some new digital transformation initiatives or, in some cases, kind of reducing the scope of those rollouts and just given the budget challenges that customers were seeing. And so we saw a significant decline in business related to new software projects in our customer base. On the flip side, the part of our software business that's associated with renewals or software subscriptions that we have previously sold, where we continue to generate revenue either through a license renewal or from the ratable recognition on the SaaS side, that business has been very predictable and we've seen very healthy renewal and expansion rates. And that's something that gives us a lot of confidence that we can return to strong software growth in the future. But in the near term, it's really just been about kind of budget challenges around the new projects. And that's something that we do expect will get better. But that, the timing of when budgets will improve and when customers will kind of resume some of these activities, that's a little bit more difficult to predict.

So I think about you guys in WAF, DDoS protection and the like. Web application firewalls is still a category that's got growth to it. I look at the Akamai security business growing 18% in the most recent quarter. Some of that is Gardicore, clearly, which is not comparable to what you have, but the rest of the product line is still growing pretty well. How do I reconcile the lack of growth in that business? Is it in the Shape area? Is it in the NGINX area? Is it in the other Distributed Cloud areas? What's causing that?

Well, some of it, I think, is a lot of our security offerings are associated with systems business. So where we've had the kind of the pullback on demand with hardware, that's kind of slowed some of the security growth that we would see associated with that. I think the underlying SaaS business with our XC platform has been very strong. In the software offerings, we continue to see strong growth from, but it's more associated with the system side. And then the other thing we talked a little bit about was some of the transitions we're doing with some of the legacy offerings in the Distributed Cloud business, namely Silverline, where we're looking to transition those customers. Either transition some of the customer base onto the Distributed Cloud platform, or in a couple of cases, we are retiring legacy applications -- our legacy platforms that came through acquisitions. And so that's been a bit of a gate on that growth rate, but that should largely be out of our revenue base over the next 2 years.

Let's shift over to the Distributed Cloud platform. Now that's a pure SaaS platform. And to that extent, can you talk about what is embedded in that cloud platform? What's the common management, the services, the app architectures? What are you delivering?

Yes, I'll start with that, Cooper. Our Distributed Cloud business, let me just start with the business because I'll just distinguish that from the platform itself. Our distributed cloud business is a roughly $200 million ARR SaaS and managed services business. And we expanded more on what that business is and talked about some of the legacy components in it in our earnings call a few weeks ago. That business includes within it a SaaS business built on top of the Distributed Cloud platform, which is very fast-growing. And the focus of that SaaS business is twofold. One, we have a web app and API protection SaaS offering which we're seeing really, really promising signs of growth there. It's got a web app firewall. It's got the API security, it's got DDoS as well as anti-bot. And so that's one component of it. And then the second major focus area for that SaaS platform is multi-cloud networking, which is providing a security-focused and application-centric approach to providing hybrid and multi-cloud connectivity for both the network layer as well as up to the application layer. So those are the 2 big focus areas. Now also in our distributed SaaS -- Distributed Cloud SaaS portfolio, we have CDN capabilities, we have DNS, we have load balancing as a service, we have management of distributed apps. And so where we're going with this is building a very robust set of capabilities that span the application delivery and security services that a customer has historically looked to F5 for. But our 2 focus areas, at least in the near term, is web app and API protection and multi-cloud networking.

Yes. And just to add to that, we disclosed on our earnings call that we're -- we have more than 500 customers now on the SaaS offerings, and that's up over 200% since Q4 of '22. So we're seeing really good early growth and momentum in that space. It's a little bit clouded just by the -- on the top line just from the transition that we're seeing on some of the legacy offerings. But underneath, we're seeing really strong growth.

So when I think about that platform, does this put you in more direct competition with somebody like a Cloudflare?

The answer to that is yes. In the web app and API protection space, we do compete with the likes of an Akamai, Imperva and Cloudflare. Our differentiation and our distinction in this space is that we offer a truly hybrid cloud capability and multi-cloud, in that this platform, our nodes and our mesh can extend natively into a customer's on-prem environment as well as into their public clouds. That is not a capability that you see Akamai or Cloudflare providing to their customers. And we believe that, that is truly the direction that these kinds of capabilities need to do to give customers fine-grained control over the distribution, not just of their application logic, but also the distribution of their application delivery and security services into these hybrid and multi-cloud environments.

Do you need, as part of that capability, to be able to reach the coding community and shift further left?

We're very happy with the reach that we have with the world's leading web server in NGINX. And so what we're seeing is using that popularity and affinity that we have with the developer community through NGINX, and using that as a path to bring more of those enterprise developers to Distributed Cloud.

Okay. So are you integrated into Hashi's Terraform-type products? How do you get that connection into multi-cloud from that perspective?

Yes, we leverage both Terraform and Ansible. We provide capabilities for customers to use the automation tools from Terraform and Ansible. We've historically been one of Ansible's leading partners, and every single one of our product family supports Terraform.

So one of the questions I get asked very frequently is what's the plan for your massive cash balance sheet and cash flow? The stock looks awfully inexpensive at current valuation, I think it's one of the cheapest stocks in my coverage. It's selling at a discount to Cisco and Juniper, which doesn't make a lot of sense to me. So are you planning on doing something to improve that valuation with your cash position?

Well, certainly, that's our aim. So we did commit to continuing to repurchase shares at, at least 50% of our free cash flow. We will also look to be opportunistic and continue to kind of evaluate what makes sense for the business. Last year, we did, I think, 58%. So it's just something we'll continue to kind of evaluate as time goes by. And then also just kind of looking at where does it make sense to do inorganic things, maintain that strategic flexibility. We feel like we've got the right portfolio in place to prosecute the markets that we're addressing. But there are still opportunities, especially in this environment, where you may have the opportunity to kind of accelerate things that you're doing in your road map. But it would be in a very disciplined manner. First and foremost, we're committed to maintaining the earnings growth and operating margin trajectory that we've communicated on our previous earnings call.

So just looking at it from a perspective of operating margin. You did 30% operating margins in fiscal '23. I think you guided in the fourth quarter to 33% to 34%, if I remember correctly. What's causing the expansion in the operating margins?

Yes. So we did a cost adjustment in April where we looked at where do we have excess capacity, just given the demand environment that we were seeing and made some adjustments there in terms of just selling capacity. We also looked at some areas where we were maybe -- had some growth initiatives that were a little bit more speculative or longer-term time horizons. And so we made some of those adjustments as well on the product side. But we did still retain capacity for a reinflection of demand on the sales side, and we are continuing to invest in the Distributed Cloud side of the business and make sure that we have the right investments in place to continue to drive growth. So we felt like there was an opportunity to make an adjustment while still preserving our opportunity to grow the top line at the levels that we would expect.

Well, we're running out of time here. So is there -- any summary comments that you guys want to make, why investors should be looking at your stock at this point? What's the 30-second elevator pitch?

Yes, I'll go back to the secular trend we talked about. Our growth is secularly tied to the growth in apps and APIs. That will grow. Our growth is tied to the distribution of those apps and APIs across hybrid and multi-cloud environments. That will grow. And we are therefore also tied to the distribution of AI inference and AI technologies across hybrid and multi-cloud environments. That's going to grow. So we feel very well positioned with the portfolio that we have as the only provider that can secure, deliver and optimize every app, every API, anywhere.

And I would add to that, the stock is ridiculously cheap at 11x EV to E.

[ I wanted for a ] third-party to share that.

Strong cash generation a 30%-plus operating margins, very high cap -- gross margin. If this company gets back to growth in software, which I think it will, it double-digit growth probably within the next 12 to 18 months. The stock should work very nicely. If it doesn't, then I think you guys are in danger of a private equity coming after you. So you need to deliver, guys. So with that, thanks, everybody, for tuning in. And Kara and Cooper, thanks for coming. And I know Suzanne is somewhere back there and she's lurking. Thanks for agreeing to come. For those who Zoomed in, we appreciate your participation. And I'm around for question, Q&A. If anybody wants to talk, I'm here all week. So with that, it's a wrap. Thanks, guys.

Thank you, Alex.

Thank you.