Fastly, Inc. (FSLY) Earnings Call Transcript & Summary

All right. Thank you very much. So my name is Alex Henderson. I'm the Needham security analyst. It's a great, fun and pleasure to have Fastly here. We have Joshua Bixby, the CEO; and Adriel Lares, the CFO; and Maria Lukens, the IR, is also dialed in. We're going to primarily focus on a fireside chat type format. We'd love to have questions from the audience. [Operator Instructions] I will try to get any questions that come in, in a timely fashion addressed to management even if it breaks a little bit of the continuity of the conversation. So with that, I really want to thank you guys for joining me today from Fastly.

It's a pleasure to be here. Thanks for hosting us.

So I really have been looking forward to this conversation because a lot of the stuff that is out there around the CDN market and the like, I think people don't understand just how powerful the changes that's going on in the space with the shift left movement and the adoption of Kubernetes and the implications that has for how applications are managed and deployed. We strongly believe that this is one of the most powerful and significant changes in how technology has been purchased, deployed over a long period of time, since probably AWS was launched, which is a pretty powerful statement. A lot of people see Fastly as a CDN, which competes with Akamai and Limelight, and to a lesser extent, Cloudflare, but I think the architecture of these companies is meaningfully different. The platform that you have really has attracted the shift left, cloud-native modern application players, the Shopifys, the DevOps, the coders. Can you talk a little bit about how your architecture is different? And why that matters so much to your business model and to your customers?

Sure. Absolutely. I think -- and I like where you started here, like I think you've really got to get to a higher level to understand the magnitude of the shift. And so if we go up, we'll talk about architecture, but let's come up to a higher level here, which is organizations that are natively digital. And you're right, we have a really strong footprint into digital meters. What they've realized for a long time is that this web, mobile, API experience is all about iteration and testing, right? It fundamentally starts with we want to go out into the world. We don't know what the right answer is, whether you like a green button or a red button or it should be personalized this way or that way. But we're going to create a platform to test. We're going to assume we don't know the answer, and we're going iterate, and iterate, and iterate. And that is -- we say that we're a digital transformation. It's a great sort of buzzword, but what it really means, scientific method, testing constant change. So if you look at that and then you sort of come back to this architecture question, if you're a developer and you are constantly in the process of changing, you want as much control as you can possibly get. In the old days, you were told, you can work on the web server, you can work on the application server, you can work on the database server, but only ones that meet IT that I set up for you and manage for you. And the fundamental shift we're seeing is these people, these incredible, smart engines of growth of the company saying, "Hold on, I'm not going to wait 2 weeks for that to happen. I need it to happen now." And they're starting to get more control. So this is about experimentation. It's about control in the hands of those who are making the difference, who are creating these digital experiences. And so then if you segue into this question of architecture, what you see here is organizations and developers in those organizations are demanding architecture that they can have visibility and control over needs to feel and act like their own and it needs to be set up for the modern Internet. So if you look at our software-defined modern network, what you see is an architecture that's built for how the Internet has evolved, not where it was, but where it is and where it's going. So you'll see some real stark differences, thousands of servers versus hundreds of thousands of servers, less than 100 locations to thousands of locations. And ultimately, what matters is can it scale to the largest workloads in the world? Is it performance and is it secure? And I think when you look at the organizations that are picking us, the largest in the world, the most innovative and now really accelerated by COVID, those who maybe aren't the most innovative, but have to catch up, you're seeing both of these communities move because the architecture that we have is faster more scalable and more secure. And that's counterintuitive to a lot of people who think you'll always win with 300,000 servers over 3,000-ish. It's just not true in the modern world.

So as I think about Kubernetes adoption, I think about the shift left movement, code as infrastructure, these concepts are radically driven -- driving a change in the way applications are built. Microservices inherently put up on GitHub, pulled down into an application. And it may be a single version of a microservice, I like to use the example of a log-on function. Every program needs a log-on function. So if I put a log on function on GitHub, pull it down into my application, and I'm off and running with it, that coder makes a decision to update that log-in function, say, the initial one on single sign-on. And the next one, he says, "I should have multifactor authentication." And he puts that version 2 of that log-in function up on GitHub. There may be 100,000 programs out there running that log-in function that are automatically updated and that's pushed out in a continuous integration, continuous deployment pipeline. That microservice mesh is significantly different than anything that was deployed in prior environments, the STOs, the -- those type of mesh topologies. How does that impact the way you're architected versus the way, say, some of the legacy players are architected around those capabilities?

Yes. And you point to some really transformative trends. I mean, I think, again, if we elevate up here, this is a trend of empowering developers, right? So it starts there. It starts with a sharing ecosystem, right? This isn't a walled garden. I'm going to share, you're going to share, we're going to bring pieces together. And so I think what we're seeing is where do you bring those pieces together? Where is the location in the architecture which makes sense to be a place where you construct and you deliver? And what our customers see is that place is the edge cloud. The place where they can trust that it's a safe environment. The place that is close to users. And see you need 2 things in order to do that. You need the ability to write code that lives at those edges. That's number one. But you also need the content that you're going to use that code to act upon to be at those edges, too. So what you need in order to service that viewpoint of massively integrated and get distributed is you need the central points and those central points have to be close to users. And so what you see in our architecture is incredibly dense, very strategically-placed locations at the biggest interconnection points to the Internet. And in those places, you have massive amounts of compute and massive amounts of storage. And you need both layered on top of it, you also need programmability because your code has to live there. And then you need the security to make sure your code is safe. So it's like a sandwich almost. You need all of these layers. Now if you have 4 servers sitting in an insecure rack in some old ISP that you've had for 20 years, one, it's not secure. So it's not in this safe space that you can sort of feel comfortable that your code can live. That's number one. So that's a very different architecture, right? Just kind of sneeze these out across the Internet. Two, you don't have the computer storage capabilities to actually have the content that you need there, which is why we are so much more performance around the world than our competitors. It's because when you get one of our locations, we not only have your content, but we've got the code that can act upon it. And so the infrastructures could not be more different. Now I think it's important to acknowledge the Internet has changed a lot in the last 20 years. And so what worked exceedingly well 20 years ago and what was built for the Internet at that time, I don't think this is a question of sort of denying that, that architecture worked, it's just that the Internet has changed. And we have a massive concentration into a few cell phone and sort of ISP-type networks. You have a complete rewiring of the Internet. You have very different latency and packet drop situations than you had in the past. So this isn't about -- if Fastly was born 20 years ago, it would look much more like the legacy providers. The reality is it's born in a completely different era, with completely different infrastructure and therefore, requires a completely different solution.

So I have a laundry list of questions I'd love to ask. But I can't tell you that I've had a call today where the number of questions that have come in from the audience is as thick as they are right here. I've got like 10 things that have come in. So I'm just going to start reeling them off because this is more about them than it is about me. So the first one that came in is, you mentioned that you will be building a key/value store for Compute@Edge. How does this compare to Cloudflare having built out CDN database at the edge with their Workers product? And will you ever go in that direction?

Yes. So I think what we see in Compute@Edge, and I think stepping back, we built Compute@Edge with the largest work loads in the world. We're an enterprise company. We serve the largest websites and those that aspire to be. So every time we look at these problems, we're looking them through a very specific lens, an enterprise lens, which means we need incredible, consistent performance; we need incredible scale, and we need to make sure they're secure. So that's the mindset through which we look at every decision. It's not an okay answer for us to say, okay, we're going to give you a database, but we're going to limit it to 10 requests a second or 10 requests per location a second. So imagine everything we just come out with to the Internet has to be -- there is no instantly scalable, but that's what I want our customers to think we're going to use our products. So that is really important to sort of baseline in terms of what we are looking at. We have a key value story today, it's Edge Dictionaries. And as the question speaks to, we have spoken about and we'll continue to invest in the capacity to store more at the edge. It kind of comes back to the answer I had before, which is you need the content, you need the compute in order to be successful. And part of what you need also is the storage tool. So we have one today. It's going to continue as it has in the past to continue to advance. And we are certainly having that request from customers when they start experimenting with what they want from Compute@Edge. So my answer would be it has to meet our criteria, and it's something that we're working towards unquestionably to continue to enhance what we have.

So there are a handful of questions that come in talking about security. Obviously, the Signal Science acquisition is a key piece of that puzzle. Can you provide an update on the merger, the cross-selling, the examples of cross-selling? What's going on with the Head of Sales? Any update on hiring a new Head of Sales since the announcement that Wolfgang has to leave? And can you talk about -- and I can barely read this, it says bike code alliance.org article's 1-year update, loose net. And I can't read the rest of it.

Okay. Well, let's start with the -- where do you want to start? What's the best place to start? We can start in any of those directions.

Why don't you start with Signal Science acquisition.

Sure. Yes. So we're tremendously excited about that, and we shared that excitement throughout this process, and I continue to be very excited. So it's early. I mean, this closed 6 weeks ago, but -- and what I'm seeing in sitting there talking to customers is a real excitement, sort of the same view that we saw. But it's also worth stepping back and sort of acknowledging that one of the beauties of this innovator's tool box, right? This idea that you've got these tools, we don't all think we're going to eat up everyone else's business. We collaborate. You can see that through this incredibly rich set of partners that we have. One of the beauties of that approach is our customers don't have to use us for everything. And when it comes to security, we've got very specific security features that we had previous to the acquisition, but there were many customers that linked us or combined us with other solutions. That's actually a really unique almost crystal ball-like approach because we can look at it and say, okay, what are our customers excited about in this ecosystem? What do they want? One of the things that we saw very, very clearly was they were extremely excited about what Signal Sciences were doing. And as we dug into that, we had 20 or more enterprise customers who are using both of us. So that -- in this interconnected ecosystem, it means we have to build integration so we can all work together. So that's a very special sort of preview of what solutions can do, this emergent quality, 1 plus 1 equals 3, and we already saw that. So what we saw with Signal Sciences was, one, they really shared a passion for their customers in the same way as we did, we do. And their customers showed a passion for them. So if you look at things like their Net Promoter Score, if you look at their retention rates, it's just off the charts. And it's because they have fundamentally shifted the customer relationship in the same way that a number of vendors that I think we admire and emulate are doing. So that's one of them. The other element, which is as important, is they were working with these builders, right? So we work with developers, they work with security operators and developers and tapping into that builder mindset. You heard me talk about this earlier. There's a pipeline. You're going to be one tool in the pipeline. I'm going to be able to write code. I can configure you. I can see what's going on in real time. That is a really special attribute, which is not the way that these markets have traditionally been built. They've been built as sort of black box IT appliances. You click a button and you hope it works. You can't see what's happening inside of it. You can't really configure it or certainly can't program on it. So they broke through that wall, the first in the industry to break through that wall. And then really, really important with security is most times, these security appliances or products or software are used to check compliance check boxes, which are really important. But what it means is they're not actually in production blocking bad actors. They're in production logging bad actors because most of them are incapable of blocking the bad people and letting the good people through. Imagine that that's a real problem. If I'm blocking all of your good users, that's just as bad, if not worse, than letting through bad actors. So you actually have to look at both sides of it. And so 90%, 95% of Signal Sciences' products are in blocking mode. That's unprecedented in this market. So what we saw, what we're excited about was like values, customer -- a customer relationship that was off the charts exciting. We've already seen the efficacy and the products being used for the same kind of builders that are looking for more control and more power. And that's exactly what we're seeing in the first 6 weeks of excitement across both sides. I mean they have customers -- we have customers we're co-selling, and I'm excited to report in the future what that looks like in terms of numbers and growth. Right now, it's just a lot of really exciting customer conversations in which I feel blessed and honored to be a part of some of them.

So in a world where we go to a heavily Kubernetes shift-lefted application environment. So in that context, the service provider of say, AWS or Microsoft Azure protect the run time environment, the applications have infrastructure built in with them inside the container, inside the pod, inside the cluster that are used to run the application. And the only thing that really extends out of that container is the API gateway. And so the API gateway functionally becomes a point in the cloud and those points in the cloud need to be connected to other points in the cloud domain to domain, domain to user. In that environment, you see companies like Cloudflare providing that connectivity tissue in that security environment. To that extent, are -- now that you're pushing into security, are you, in fact, more directly competing with companies like Cloudflare? And how does Fastly differentiate when put head-to-head with these type of security players?

Yes. The security market is very much in flux. Billions of dollars are being thrown up in the air as we speak as people leave data centers and leave appliances behind. And right now, loosely, you see 2 markets here. You see an IT market. Think about this as I need to protect your phone, your laptop. I need you to get a VPN-like connection and -- to make sure you're safe. And then there's the web and API security, which is I need to protect a specific website or a specific mobile application. So those are 2 general thematic markets. They're coming together in certain areas, but right now, they still are separate budgets, for the most part, separate buyers. So today, Fastly is squarely in the web and API security market. And with the acquisition of Signal Sciences, we have a whole portfolio where we could meet the needs of, as I say, the enterprise, the largest customers in the world who are delivering at massive scale. So those companies also need to protect laptops and replace virus scanning solutions or whatever else. But that's not a market that we are in today. I think it's a very interesting market, but it's not a market that we're in. When we talk about the competitive landscape, obviously, we are living in this large enterprise space. And ultimately, there's one real competitor in this space that in the web side of the business is a dominant and that's our largest sort of legacy provider that we often are in the process of replacing within accounts. So that's -- we see the legacy provider in the enterprise, that's who we are replacing. We are not seeing any of the other start-ups really have a strong hold on the web and API side of the market for the enterprise. I think it's a very interesting question of how the website and the IT side are coming together and whether that is a part of this evolution. I think it's a really interesting evolution. I mean if you look at the server-less world, we come back to this with Kubernetes or any of these solutions, this is all the practice of I'm the IT -- I'm the developer. I want control. I want to be able -- I want my code to run at the right place at the right time. Why do I have to put a Jira ticket in to get a server up? Well, I don't have to do any more. Why do I have to only live on the 2 servers you provisioned? That doesn't make sense to me. So this is actually all about abstracting away from the developer some of these details and certainly making it not an IT process. And this shift left or -- actually, I was in a conversation earlier where people referred to it as shift right. So I guess, I don't know if that's part of the political spectrum. It would depend on which side of the equation. But shift in one of these directions is really about empowering the creators, these are the artists and the scientists that are being empowered to actually have no delays and no friction in order to experiment in their craft of creating these platforms for constant innovation. Like that's -- if we go really high level, that's actually what's happening. And Kubernetes is an element of that. Clearly, the cloud is an element of that. But if you're a developer, you just want the code to run at the right place at the right time. Some of it's going to run at the edge, some of it's going to run at the core and the central cloud. And that's the way this world is evolving. Most people just want it to be scalable and want companies like ours, Amazon and Google, to take care of the scaling for them. They don't want to think about it. And that's one of the value propositions we bring the table here.

So one of the questions that comes in, and I'm trying to knock some of these out is, how does the shift to adding more security products affect your incremental gross margins?

Yes. So Adriel is -- I've talked long enough. So let me hand that one over to Adriel, and we'll keep going.

I thought I'd give you a break.

Thank you. I appreciate it. We'll let Joshua have his tea. I think that's what he's drinking these days. So from a longer-term perspective, I'll sort of take us back to the time we went public, which was May of last year, 2019, which seems like a lifetime ago. And historically, we talked about getting to a 70% gross margin. And between where we were then, which was around 55%, I think we're around 60-ish percent today, to about the mid- 60s. We had sort of characterized that as just pure scale. We're in 55 markets today. We think we need to be in about 100 markets around the world, excluding China, to cover the world. And so when you get -- you begin to get to that point of enough presence, you can begin to leverage co-location, which is a portion of our expense; you can leverage labor, which you don't need as many people to grow that as well; you can leverage physical plants in terms of the pops that we have around the world. So that also drives the CapEx percentage of revenue, which historically is a lot lower than what we've seen in legacy providers. And so all of that off-line bandwidth had a greater percentage, you can get to sort of mid-60s, just from a utilization standpoint. The COVID year, in general, has given you a bit of a preview of what Fastly can begin to look like once you start to sort of rise -- raise utilization of the network that we have. Now as you begin to mix in for us, security products, such as Security@Edge, which we launched with the acquisition of Signal Sciences or Compute@Edge, it's worth noting that there are 2 in both of those markets, neither of which has a big primary impact from bandwidth, which today is about 30% of our cost to revenue. And then in the future, today, we're about 50-50 media versus non-media. And if you think about sort of the media portion, it's sort of lower on the gross margin. And the non-media, which has security and functions like Compute@Edge and is higher than the gross margin as you begin to have a mix shift more towards those markets and that becomes a greater portion of our revenue, you can see how we get from that 65% to that 70% gross margin. So hopefully, that gives you a bit of an overview on sort of how all the pieces are coming together.

Yes. There was a question that tied into that last comment. So let me hit that one. It says, on a recent quarter conference call, you mentioned quality traffic and commodity traffic. What percentage of your revenues is in these buckets, respectively? And how has it trended? Do you carry commodity traffic on a quality traffic most customers to be one-stop shop? What are the churn differences between the 2 types of traffic?

Yes. And I think if I can interpret the question a bit, there's a little bit of this concept of what is that traffic that is sort of not a ton of value-add that we can provide, which is more on the streaming side, but really specifically on the video-on-demand side, which is an area that we're not really necessarily targeting, although we do have some customers who where we can add a lot of value, especially in live linear they will have a mix of both, and we consider that sort of quality traffic, better gross margin and also an area in which we can hold our value relative to other providers that may be grouped in there. And when you get even further into other verticals, such as e-commerce, such as financial services, these are areas where we really do extend the capability where the developer used to sit, which is only at the database level, only at the origin. We can help him or her extend all the way to the edge, programmed in such and such, and when you actually provide that level of value, you really do also provide a level of stickiness, which is really what's driven our dollar based net expansion rate, which was 147% last quarter. You've seen our churn rate, which historically has been less than 1%. So with those levels of statistics, that's kind of how we're driving to that level of sort of quality traffic because we're sort of really trying to enable our customers, these are either developers, to program and sort of standardize on our edge.

Okay. So Adriel, I tried to get -- without asking questions about TikTok, but there's 4 different questions in here about TikTok. So I guess I can't really avoid not asking it. So what's happening with TikTok now that it's not banned anymore? Are you still servicing it? Is TikTok traffic going to be coming back on the network? Is the business totally gone? Do you have -- still have a chance to get TikTok's business back? Let's see what was the other one, any color on TikTok? Have you completely left the client? So people want to know, I guess I got -- I have no choice but to ask it.