F5, Inc. (FFIV) Earnings Call Transcript & Summary

Everybody. We are just debating safe harbors. So I will read one to kick off. For important disclosures, please see the Morgan Stanley research disclosure website at morganstanley.com/researchdisclosures. If you have any questions, please reach out to your Morgan Stanley sales representative. Cooper, also you have a safe harbor you'd like to read, and then we'll go into...

Thank you. It's exciting stuff. So just to get our safe harbor on record, our discussion today may contain forward-looking statements, which involve uncertainties and risks. Our actual results may differ materially from those expressed or implied by these statements. Please see our SEC filings for more information on these risk factors.

All right. Perfect. So with that, I'm Meta Marshall. I cover networking here and cybersecurity here at Morgan Stanley. Delighted to have F5 here with us today, Cooper Werner, CFO. Thanks so much for being here.

Thank you.

F5 has seen this resurgence in ADC use cases today. Just what are you seeing as -- or your customers seeing as kind of the growing number of use cases for F5, maybe particularly in light of AI as everybody just got out of the Jensen presentation.

Yes. So I think that something we've really been seeing kind of take shape over the last couple of years, and it's something that we saw coming several years ago was really just expansion into hybrid multi-cloud architectures. And I know that there have been a narrative for a number of years that everything was going from data center to public cloud. And we believe that there was going to be significant growth in public cloud, and we made a lot of investments kind of modernizing our portfolio to address those architectures. But our belief was that over time, what you'd see is that customers are going to continue to support many of their legacy mission-critical applications in a data center and then expand into modern architectures across both public cloud and the edge. But ultimately, they were going to be supporting these applications in all these environments and they'd be using multiple clouds. And with that, we're going to see a level of complexity that would be difficult to navigate with multiple disparate solutions. And so we had made aggressive investments in both supporting traditional applications in the data center and then expanding across into these additional environments. And so what we're seeing now is that, that complexity is really starting to come through in these use cases with customers, with their architectures and then AI is really kind of adding an accelerant to that dynamic. And so the market is really kind of coming back to F5 is really the only vendor in the space that can support these applications in any of these environments that can allow common sets of security protocols across all these environments, common management tools. And so that's really kind of been driving a lot of the growth that we've been seeing, both across software and hardware. And then as I said, AI has really extended that now to where API security is becoming more top of mind for a lot of our customers. And so we've made some investments in that space. data delivery is becoming a big challenge for customers because a lot of the storage arrays that are supporting these environments were not really meant to deliver -- to move data back and forth, and they're not well suited to that. And our hardware-based offerings are very well suited to delivering data just like they're well suited to delivering application traffic. And so that's kind of opened up some new use cases for us in this hybrid multi-cloud architecture.

Got it. I think you guys refer to that sometimes as the ball of fire. And so being extinguishers of the ball of fire. How -- there's also been just opportunities for share gains for you, not in only kind of these expanding use cases, but just in terms of kind of what the competitive landscape has been. And so just how are you capitalizing on some of those opportunities?

Yes. I mean, so much of the work we've done has been about taking some of the friction out of managing these environments and that they can come in various form factors. It can be managing different tools, needing different sets of expertise to manage these tools. A lot of it can be commercial friction where just as you're looking to expand and move some of these supporting services to follow where the app workload is, that can be really cumbersome on some of these IT groups. And so we've put in place some commercial models that are very flexible that allow you to quickly spin up these services as needed across these environments. We've continued to add new features and capabilities, particularly around security. So you've got common security capabilities in any of these environments. And it's really driving a convergence to a single platform for customers. And they -- that's really resolved some of that complexity. And then we continue to invest in something that we call XOps, which is analytic capabilities to help give customers more of a 360 view as to what's going on in their application environment so they can rapidly respond to changes, whether it's a performance degradation or newly identified security risks in their environment, and they can take faster action to improve the performance and the security across that application landscape.

Got it. On your recent earnings call, you noted kind of this demand inflection in AI use cases. Can you talk about that inflection and just the NVIDIA partnership, I think Jensen just talked about kind of partnering with people who could help deliver these ecosystems and you guys being kind of a part of that.

Yes. So we've said there's really kind of three areas where we're seeing potentially high opportunity. One is around the data delivery use case that I just mentioned, and this is really delivering this data back and forth between the models and the storage and we've seen a number of pretty sizable wins in that space. And that comes both in the form of direct use cases where it's specifically tied to a new AI use case where data delivery is an important component. But then there's a lot of, what we call indirect demand that we're seeing come through, oftentimes in our refresh motion on the systems refresh, where customers are expanding capacity readying for their future needs around data delivery as they start to move from more kind of training use cases to inference use cases. And so that's an area of the business that we've seen pick up, particularly in the last quarter. And then the second category is around AI security, specifically runtime security. And again, that's an area that we saw a continued inflection last quarter. If you look back to last year, the majority of our AI-related sales were on the data delivery opportunity. Last quarter, the runtime security opportunity was at about the same level. So we saw a meaningful pickup in both. And the early interest around our Calypso acquisition from September has been really strong. And so we think that opportunity is going to continue to build. And then the third use case is around AI factory load balancing, and that's where the NVIDIA partnership comes into to play. And so this is putting the same data delivery capabilities that we would traditionally serve in a BIG-IP appliance, putting those capabilities on the DPU in a GPU cluster. And so we became -- we got designed into NVIDIA's reference architecture as of November. And so that's been great for our sales teams. It's acted as a bit of a hunting license to go identify those opportunities to drive GPU efficiency, faster time to first token, improved energy efficiency. And so it's still pretty early days, but we think the opportunity could be fairly meaningful.

Got it. Okay. That's helpful. The distributed cloud business opportunity that you guys have spoken about it's pretty early days still. How have you refined this kind of sales motion, which is slightly different than kind of your traditional data center business and differentiated yourself in a maybe slightly more competitive landscape than you normally have?

Yes. So a couple of things. So we're making additional investments in a specialist sales force, an overlay sales force that has more background in selling into those environments and really evangelizing our capabilities around web app and API security where we're best of breed, and we feel like we really set ourselves apart, especially in large enterprises and then expanding that conversation into discussing the overall platform because these workloads, again, they don't run in isolation. And so resolving some of that complexity that you referenced when we talked about the ball of fire and presenting customers an opportunity to run these security solutions on a converged platform, so they get the benefit of the management capabilities and the insights that are coming from some of these capabilities that we've been introducing over the past several quarters.

Got it. Okay. Maybe let's just turn to the breach now. In the midst of some of these very good kind of demand environment for you with a number of tailwinds, you've also been going through a breach and a product refresh, announced -- just starting with the breach incident, can you just give a sense of how that impacted your kind of opportunity set in fiscal Q1 and fiscal Q2?

Yes, happy to. So just to kind of take a step back, as we guided going into the year, if you recall, we took a pretty conservative view on the revenue guidance for the year because we had I think it was nine businesses between the announcement of the security incident and when we are going live with our guidance on the annual call. And so we had -- that's kind of a challenging time to be giving an annual guide. But we had not seen any evidence of any disruption to our demand through those 9 days, but we took small comfort just because it was early days. So what we did is we profiled the revenue base. And if we were to see disruption, we it would be more tied to new projects, particularly new software projects or in some cases, potentially expansion at the time of renewal. And so we tried to size and shape where we thought any potential impact could come from. But business had been moving forward in kind of an orderly fashion. And what we saw through the course of the quarter is that the pipeline continued to build in a very normalized fashion. Close rates remain very high. And through the quarter, we didn't end up seeing any notable demand disruption. I think we had one customer that canceled the project, reevaluated their alternatives, came back to F5 and decided to move forward with that project. And that was the only signal that we had of any potential disruption. Now having said that, that didn't just happen in a vacuum. I think a lot of that was based on the response we had with customers. A lot of these customers have been through these kinds of incidents in the past. So they had experience dealing with security incidents and the feedback we got was that our response was very strong in terms of the capabilities we were -- we had in hand for customers, the visibility we gave them as to where the potential risks could be and then the depth of the support we had as they navigated that and did their remediation activities. And so customers were able to get through those activities in fairly short order. And I think that kind of the takeaway that they had was that while nobody wants to go through these kinds of security incidents, the response that we had in supporting them through that was built a lot of trust. And so the momentum that we saw through the quarter never really saw an impact.

Got it. I mean, how does that change how you think about some of the product refresh that's going on? Do you think it's accelerated any of the product refresh that you would have seen?

Yes. So we haven't seen any signs of it accelerating the product refresh. I think that, that likely will come later as we get closer through those end of software support dates. What we did see was a significant acceleration in terms of customers upgrading to current -- the most current version of our software that was supported on their existing appliance. So you think of a tech refresh that -- the tech refresh is really ensuring that you continue to get the most current software updates. So as you move past end of software support dates, on an appliance, you're no longer getting those software updates. But I think it's a sign that customers have an appreciation for the need to be running on currently supported versions because they upgraded so quickly, in many cases, on their software. And so as they get closer to those end of software support dates, you would expect that some of these customers may move more quickly than they had in prior cycles.

Got it. And then just as we think about this product refresh, can you just refresh investors on the impact it had to fiscal '25 and just how you see it impacting fiscal '26?

Yes. So fiscal '25 was the first year that we really saw kind of an uptick in the refresh. And those are customers that are getting out a little bit in front of those end of software support dates. And so we saw a lot of the growth that came through on the hardware side was tied to that refresh. What's interesting was that the growth we were seeing from the refresh motion was much higher than what we typically have seen in prior refreshes, especially the last refresh cycle that we had. And we dug into it trying to understand, is this just customers moving more quickly than in the past. We can look at what the rate of falloff is on legacy appliances is just kind of a proxy for is this all just a faster rate of replace? Or is this a replace and expand motion? And what we've seen is while the sales through that refresh motion were really inflecting at a higher rate than what we've typically seen, the retirement on the back end was kind of at more of a normalized level. And so what that's telling us and it's still fairly early. There's always a lag factor. When you buy -- do a refresh and you buy a new product, there's going to be a couple of quarters before you replace the legacy. But we've had enough quarters of growth now where we're not seeing that a change in that rate of retirement. And so what that's pointing to is more of the growth is tied to expansion at the time of refresh. And there's a number of factors that could be driving that. We think the biggest driver is AI readiness. So getting in front of the future performance needs that are driven by AI. A natural time to add capacity is when you're already doing a refresh. There's a lot of the -- some of the things we've been seeing around resilience and data sovereignty are coming through in the refresh motion as well as customers are very often repatriating workloads from public cloud and they're building out their capacity to support that. So it's kind of a long answer to the refresh question, but it's an important one because with the strength we've been seeing on hardware growth, there's a lot of dynamics that are behind that. And I think that refresh cycles are going to come and go. They're not a durable source for growth over time. But if there's additional expansion and capacity needs that are kind of feathering in as part of that motion and you can identify that, that points to a better growth outlook over time.

Got it. I mean another thing that you noted on the breach and just the mitigation was that it really introduced you to like a new audience of customer, maybe getting more access to the CISO versus kind of the network operator in the past. Just how do you feel like that is giving you kind of additional inroads or ways to kind of sell other pieces of the security portfolio?

Yes. I mean it has been a silver lining is that we've been able to get into more conversations with CISOs. I think there's a renewed appreciation for just how vital F5 services are in their application environment. Very often, we're cited as kind of the heartbeat of their operations, and it's an opportunity for us to continue to earn that trust. It's also an opportunity for us to share insights as we've navigated the security incident and some of the best practices that we've identified and how to mitigate risk going forward. And so it's giving us opportunity just to get better mind share with this audience. And then downstream, that may potentially lead to more opportunity. We talked about this crisis of complexity in these hybrid multi-cloud environments. That appreciation for how that complexity can manifest into a broader footprint of risk. ultimately gives better visibility as to why some of these security capabilities are so important. And so it potentially could lead to renewed opportunity for us.

Got it. Europe was very strong for you in fiscal Q1, and you've made comments about data sovereignty being a big reason for that upside. How are you seeing kind of this desire for increased data sovereignty kind of leading to could Europe become a stronger market for -- in the coming years? And are you seeing this dynamic in other markets?

Yes. It's a dynamic that we've seen starting to take shape over the last few quarters. It really inflected in the September quarter and then even stronger in the last quarter. We expected that trend to start to play out. I think it was more pronounced and honestly, we would have expected, especially going into last quarter. I think that a lot of these -- a lot of customers are getting much closer to these compliance dates. And there's also kind of a better understanding of the environment with regulators and how closely that's being governed. And so it's -- there is a little bit of a catch-up that some of our customers are facing in terms of making sure that they are in compliance. But resilience is becoming more and more important as well. And so that's where customers want to be able to fail over from cloud-based environments to data center-based environments. And we think that, that probably is a fairly sustainable trend. I think there's a little bit of a surge of just getting kind of current with some customers. But long term, those sovereignty and resilience needs, they're still pretty early stage. So it could drive a pretty good opportunity, especially in the systems business with data centers in Europe. And we're going to see that in other geographies as well. I think Europe is kind of at the leading edge, but we'll see it across Middle East and Asia Pacific, in particular as well.

Got it. And then clearly, memory pricing has been the discussion as Jensen tells us, memory is never going to get cheaper. Just how is F5 preparing for this? And just kind of what risk has been embedded into estimates?

Yes. So it is top of mind for everybody. We have spent a lot of time on this. I think there were a lot of lessons learned from the supply chain crunch of '22 that are kind of part of our playbook. We were getting in front of this as of last summer, early last summer when we first started to get indications that memory was both becoming scarce and the costs were going to continue to go up. And so we took a number of actions. We extended our build forecast to a longer-term horizon. So that's step one is just making sure your contract manufacturers have a longer-term horizon of visibility as to what your needs may be. We increased our forecast, build forecast, both to account for the upside we were starting to see come through in the data center business, but also just to have a bias more towards a high-end scenario. So accounting not just for the upside, but weighting it more towards upside scenarios. Now obviously, you take on a little bit of risk that you overprocure and there's an obsolescence risk on the back end. But if you're going to be balancing revenue risk versus downstream obsolescent risk in this environment, you want to be more weighted to covering any potential revenue risk on the supply side. We also took advanced positions on some of the components that we had line of sight we're becoming more scarce. So buying on broker markets or just securing availability with existing suppliers just in raw materials, just to cover any potential bottlenecks. And then we started qualifying additional suppliers in as well. So we haven't seen any decommits. Decommits were a thing in the last supply chain crisis in '22. And so we want to make sure that we've got -- we're leveraging every tool we can to provide some resilience to any potential risk in the supply chain. And so we think that we've taken all the right steps. We feel like we've got pretty good visibility into our supply in the near term. Now eventually, you get into a year down the road plus, I mean, that could change, but it's something we continue to watch very closely.

And any price increases you guys have had to do yet or contemplated?

Yes. So that's something that we are actively planning around. So we just introduced a price increase in February that was kind of more of our natural annual motion where we adjust prices tied to innovation that we're bringing to our customers. And so we had delayed that a month just coming out of the security incident, but that was more to do with new features and capabilities we're introducing to market. Related to memory, we'll continue to look closely at that, and we likely would explore price adjustments to offset the cost. I don't think that we would go to gross margin neutral on a percentage basis. We're not likely to put a big markup on top of these price increases. We're more looking at gross profit neutral scenarios, but we'll -- more to come on that.

Okay. Got it. Just can you walk through some of the go-to-market investments that you guys are making either expanding out between security and network, which we kind of talked a little bit about earlier or just the changing breadth of when you're getting to the network buyer? Getting to them earlier in the application development.

Yes. So I mean, the biggest one we've made over this year is we've been expanding our sales force, just adding additional capacity to support the demand that we see. And we think that -- I talked about that on the call in January about some of the investments we're making that are more oriented towards accelerating our growth opportunity in FY '27 and beyond. There could be some impact this year as we ramp the -- those additions up, but we think that's just kind of a broader investment that can help us accelerate execution on some of the demand that we're seeing. We're also making targeted investments in specialized sales teams around AI use cases, security use cases, and we think that there is additional opportunity that we can drive. And then we've invested in our partner ecosystem as well. We've made a number of partnership announcements around AI use cases, security use cases and we talked about the storage vendors where we've been integrating our capabilities to operate well in those environments. And that helps us get -- you talked about getting in upstream on some of the demand that gives us visibility as to where some of that opportunity is earlier in the cycle.

Got it. And then, I mean, obviously, you guys generate a lot of cash, always have clearly, maybe some investments being made in inventory at this point on the memory side. But just how are you thinking about capital allocation? And as new use cases emerge, how do you think about strategic activity?

Yes. So it's -- we've committed to delivering at least 50% of our free cash flow into share repurchases, and we've exceeded that commitment over the last couple of years. We were a little bit more aggressive last quarter, but that continues to be our approach. And then we feel like that still gives us the flexibility to do strategic actions, whether it's M&A. We've done a number of smaller acquisitions that have accelerated our road map in AI and security use cases, and we'll continue to look at where there's opportunity that can help us accelerate our positioning. We'll look at some investments we're making on distributed cloud. You could see CapEx increase a bit as we build out the infrastructure to support that SaaS-based opportunity. But broadly, I'd say there's not a material change in how we're thinking about use of cash from the posture that we've had over the last couple of years.

Okay. And then just kind of a question we've been asking everybody is just kind of how are you using AI internally? And how is it changing kind of the breadth of suppliers or software that you've been looking at in the past?

Yes. I mean we're spending a lot of energy on that. We've had really good success in some of our bigger organizations. Our support organization has been extensively leveraging AI to help customers self-solve issues that they're seeing or find the right solutions. And so that's what we call case deflection and embedding AI capabilities into that organization has helped deflect a lot of cases. It's also helped our support teams identify the right solutions in more complex environments so that you're not out there hunting and trying to find solutions that have worked in the past, but you've got an AI engine that can surface that solution very quickly and help resolve cases much more quickly. So it's driving a lot of efficiency in how we support customers. On the engineering side, over 60% of our engineers are leveraging AI coding capabilities. And that's really manifesting more in velocity in terms of innovation. We've got our large marketing event next week called AppWorld, where we'll be introducing a lot of new innovation to our customers. And that innovation has been really accelerated with some of these coding capabilities and leveraging AI. And then just across the -- some of the support organizations, we're looking at Agentic AI to accelerate some of the support functions around G&A, marketing, things like content creation, sales enablement in my organization, our procure-to-pay function, we're leveraging AI to more efficiently do things like invoicing and some of the procure-to-pay functions.

Got it. Well, thank you so much for being here today. Clearly, a lot of AI and just kind of resurgence of the ADC that is driving some enthusiasm in the business. Sounds great.

Thank you. Thanks for having me.