Palo Alto Networks, Inc. (PANW) Earnings Call Transcript & Summary

Hello, everyone. I appreciate you joining us today for this session with Palo Alto Networks and the CEO, Nikesh Arora. So I am Patrick Colville, a senior analyst at DB covering the cybersecurity and infrastructure software space. The format of this session is going to be a video fireside chat with a listener Q&A. There's a chat box where you can ask questions. The questions are anonymous. We're not going to mention your name or company affiliation. So let's kick off with introductions. We got Nikesh Arora, CEO of Palo Alto Networks with us. As everyone knows, Palo Alto Networks is the largest information security vendor and a firm that has got a reputation for driving innovation in the space. Nikesh, thank you for joining us.

Thank you for having me, Patrick.

Well, given time constraints, I'm going to jump straight into questions. And I think, I guess, the elephant in the room right now is COVID-19. And so a trend everyone's familiar with, cybersecurity risks facing the enterprise are only increasing. But how is the coronavirus pandemic affected that trend?

Yes. Thanks, Patrick. Look, I think it has -- it's -- there's been puts and takes. I think we all saw a heightened interest in remote secure work the moment pandemic hit because you have to go set up your business to allow for 100% of your employees to be able to access stuff remotely. Not just that, you have to make sure they're going to access everything. So typically, a company would schedule 5%, 10%, 15% capacity. And you didn't deal with the most complex apps because you can always come to the office and use them. Now you got to make sure everything is accessible from everywhere. So we have seen both the capacity ask from people, but now that's translating into an architectural ask. People are saying, okay, my old model may not be the long-term model, and I might need to go to a different architecture if this thing is going to persist for a year, 1.5 years. And you're saying that, right? Banks are going 1 week on, 1 week off, people are going 2, 3 days a week. So you need full capability at home. So I think that's kind of accelerated some trends. I think the cloud computing trend is accelerating. I think people are sitting there and saying, where -- how quickly can I migrate off my infrastructure because everybody's been talking about the cloud and say, okay, let's use this opportunity to move our stuff to the cloud and be more robust and sort of more secure. And kind of like they don't want to manage too many moving parts. So you're saying let's do that cloud transformation conversation as opposed to build out more data center capacity, which is more complex in a COVID environment. So you're seeing cloud transformations. You're seeing remote secure work conversations. In some cases, people who are further along their cloud journey, you're beginning to hear them talk about SD-WAN and security in the same breath, saying, how can I get my traffic route? And how can I get it to be secure? So I think that's on the upside. I think there is a general concern that hardware is harder, no pun intended, to deploy in this environment. And you're seeing that in large enterprise hardware businesses, they're pointing downwards because that's all they do. And you'll see that, I think that trend will continue over the next 6 to 12 months. Their hardware is going to get harder just because it's a complex deployment, and it's harder to upgrade and hard to deploy. So I think you're going to see that on the other side. Now outside of that, I think it's just -- the question is, net-net, how many of the customers out there are seeing a positive or neutral impact in COVID? How many are seeing a marginal down impact? And how many are seeing a harsh impact on their own P&Ls, which is causing some degree of consternation or caution in the way people spend money? And I think that's more of a macroeconomic event as opposed to a company-specific event from an enterprise company perspective.

And I guess, I mean, talking company-specific for you guys, in your results, I mean it seems like COVID's been a pretty major tailwind for Prisma Access adoption. So it would be good to talk about what this tool offers for customers. And then as a CEO of Palo Alto Networks, why you think Prisma Cloud should be a tool that your customers adopt or amass.

Yes. Look, I think Prisma Access 2 years ago, it's just about global protect cloud services and is a very lumpy revenue stream for us. A building stream for us. And I think 2 years ago, probably we were lucky to see a $10 million quarter. And this past quarter, we saw 90 -- obviously, it has CloudGenix and there's a little bit of CloudGenix in it, but there's $91 million. That was -- I think it's all been built in the last 18 months. We've paid off a lot of technical debt, hire a lot of engineers, ordered the entire platform to Google Cloud and our larger customers deploying 220,000 concurrent users if they want at any point in time. So it has stood the test of scale. It has stood the test of security, and we're seeing a lot more conversation. In Q3 in COVID, we gave a bunch of free trials and we saw significant numbers that convert in Q4. So we've seen the COVID impact in that number as well. And I looked at these scanners' number, just very impressed they did $195 million. We did $91 million. 2 years ago, we were not in pitching distance or whatever favorite sport analogies. So I'm really excited about the product capabilities we've built. I think the combination of that with CloudGenix is going to position it as a SASE product, which is a must-have product category -- I think where in the future as people do more cloud transformation. So yes. So we're really excited about it. Also it's kind of a substitution product, but you have a choice. If you want to get more remote access to your employees, you can put more firewalls in a data center and run more VPNs, which is older tech. I think in the future, you want to split the traffic, take cloud traffic to the cloud and data center traffic to the data center that requires a solution like that. So I think this product category and the product itself has legs, and we will see more of it in the next few years.

I mean your point there about the kind of can [indiscernible]

[indiscernible] question, sorry.

No, no. So go for it?

No, no. You said, tell us why people should buy Palo Alto Networks because you can't take a Deutsche Bank trading application and work it from home using a proxy. You need a firewall.

Sure. Okay. But so you made a point about cannibalization, which is actually, I guess, fairly interesting. It's -- I mean how -- everyone's investors, everyone likes a bit in numbers, you used to be an investor yourself. So how can we quantify this cannibalization, Prisma Access versus on-prem?

Yes. I think, Patrick, what I do internally is I look at the 3 form factors of firewall we sell. We sell hardware. We sell virtual firewalls. We sell Prisma Access. If you add up the billings for all 3, if that number's growing in double digits, I'm happy. Now remember, my firewall has a 6-year life. My VMs are typically 3-year contracts. My Prisma Access are 3-year contracts. So I'm adding 3-year subscribed revenue -- billings and 6-year end-of-life product into one number. It's still going to grow that in high double digits or mid- to high double digits. I think we're taking share of the market. Now there are people out there who's selling hardware, and tracking that and saying that's growing at double -- they're taking share, but a lot of people are -- not a lot, many people we know in the firewall business are low single digits. So I think that people with the high double digits are taking share. We're taking share in hardware and software form factors. Some of these are taking share and hardware form factors and I said hardware gets harder. So I think software wins in the long term. With that, software is the world.

Yes, exactly. And I guess, in that space, in the software space, you mentioned Zscaler. They've got a great product. You guys -- the number's looking pretty favorable as well. So just talk us through Prisma versus Zscaler? And I guess how you guys win?

I'd say -- I don't think -- this is not the Internet. This is not a zero-sum game. I'm perfectly happy with 40% market share in any category. I'm perfectly happy with that. And if the numbers keep growing the way they are, we will have transitioned the hardware business into a robust hardware and software business. Couple that with everything else we do, I think we're in a good place. I think they have a solution which works in a certain set of customers. We have a solution that works with a certain set of customers. We have 1,500 customers who deploy our firewalls in the Global 2000. We didn't have a product for them 2 years ago, which did a software [ as all ] for remote secure access. So now we have a solution, and they have a consistent management pain that allows them to do what they do in the data center with our software delivered firewall on the cloud and VM. So we have a large installed base to go target our solutions. So I think there's enough room for us to peacefully coexist. It's just that they won't be able to run away.

Okay. So for the investors listening, I want to make this interactive as possible. So any questions, please use the chat box or e-mail me, I'm on patrick.colville, which is C-O-L-V-I-L-L-E @db.com, patrick.colville@db.com or use the chatbox. So Nikesh, as it come in from an investor. Q4 was a pretty impressive billing sprint, no doubt. Question from investors, was the Q4 benefited from a pull forward from the first quarter because the first quarter implies a fairly steep seasonal decline? So just any color and context around that would be great.

Yes. Truly, mathematically, the bigger Q4 is the lower Q1 looks relative to that. So yes, we had a big Q4. So by definition, Q1 looks a little less interesting than Q4. And there was -- Patrick, it's interesting, in my 2.5 years as CEO, we saw this is nearest to perfect execution we saw in Q4 that we've seen in the company. Very few deals slipped out of Q4. Normally, you see a reasonable number of slip in the following quarter. So there was ample deals that got done. There was a bunch of pull forward. So you did see a great set of numbers in Q4. So some of it is pulled forward. Some of it is customers looking for more certainly signing ELAs sooner than they probably needed to. So yes, so there's some of that that's coming in a comparison. But the other part of the year is we still continue to be watching the market to see that we still see some macroeconomic wins to some of our customers. There is a spectrum. Some customers are getting tailwinds because of what's going on in the market. Some customers are marginally on the upside. Some customers' tech is the only thing working, so they're trying to invest in tech but they're price conscious. Some customers are seeing no demand, so they're revenues are hurting, they're pushing back on everything that they're spending. So we have the same spectrum of customers out there. So we're just cautious of the ones who may not be able to play in the current environment and go with being continued or sustained for longer, causes us to watch on the margin, what's happening on that customer base.

Okay. I mean, you touched on this earlier, about the demand for appliance-based firewall. So I guess reading between the lines of your commentary, it doesn't seem like it's the focus. But can we just talk about the appliance firewalls and the metrics to help investors kind of quantify this around either deal sizes, churn rates, closing? Anything that's COVID-19 might have changed that you think is worth probably flagging?

Yes. Patrick, I will answer that question, but I will also make a plea to all the investors is this is a very backward-looking conversation. The hardware conversation. I don't mean that the [indiscernible] sense or I do not mean to question the intelligence of the question. But if you look at our business, we have a firewall business, which has approximately $1 billion of product in its billings, a significant $3-plus billion for what remain $2.7 billion of subscription billing. We just connected to hardware but also connect to an extra base of security. And then we have $928 million in next-gen security billing. What's happening is that our product proportion of our total billings has declined rapidly this year relative to the overall purely mathematically by product being flat and everything else going in [ 90-point ] on range. If that trend continues, product continues to become a smaller and smaller part of our overall billings, the quality of that revenue becomes more and more -- billings and revenue becomes more and more SaaS-like in the future. So if you should play the movie over the next 2, 3 years, you will see that product is less interesting about networks, software becomes very, very interesting about the network. If you noticed we started showing ARR metrics. We're beginning to look at deployment rates, net retention rates internally to make sure we understand how to create that flywheel that SaaS companies have. And if you look at this year, I think it was a pivotal moment, $928 million of the billings has shown approximately less than $100 million -- or around $100 million of revenue this year, $300-plus million of revenue will unfold into our P&L next year from our $928 million next-generation security billing. If we continue to grow NGS next year in the $1 billion-plus category next year, you will see that impact also roll into our numbers. Now it has 2 interesting impacts. One is trust by revenue growth for the company in a more sustainable, more predictable fashion because tremendous amount of revenue falls off our deferred revenue into our P&L. And the second part is what people need to just pay a little bit of attention to is on operating margins, we are guiding them to flat because we have a lot of upfront calls on NGS. We have sales commissions that will all kick in. We have deployment costs, which will kick in the cloud hosting costs for proof-of-concept, which are onetime amortized by us or written off by us, and that [indiscernible] which all hit gross margin. So in 2.5 years, you should see some degree of gross margin improvement in our NGS business. From cloud hosting efficiencies and deployment costs normalizing relative to the overall number. And secondly, you should see operating margin expansion because my quality of my year 2 in year revenue is way higher operating margin year 1. So you are going to see the SaaS benefits of Palo Alto Networks in 18 to 24 month time frame, at which point in time the product conversation becomes more. Product is interesting right now because it has disproportionate impact on our P&L from the revenue impact of it. Now having made that plea, I will answer your question. So I'm not playing for nothing. Sorry, [indiscernible] the [indiscernible] product. Look, product -- there are 2 things going on, specific product-wise. One, when a customer walks up to me and says, "I'd like to have remote access for all my customers. I also follow all the firewalls in the data center, can you give me more firewall?" I say, have you tried Prisma Access? Do that because I can give you a software capacity in the cloud, and you can dynamically adjust the capacity base for number of users. So when we get out of COVID, you don't have to be using that anymore. And we aren't [ coordinating ] with everyone, and you don't have to go to 50 different locations that deploy Palo every year because you're driving your traffic from the cloud into your data center for more use cases. So I am preferencing a software solve versus hardware and certain situations, right? So part of it is like I say, you use the word cannibalistic, and that's on purpose because I would rather have higher quality software revenue. And by the way, it's a better outcome for the customer. The cost of ownership is lower, the deployment costs are lower and their upgrade costs are lower. So that's a good outcome for the customer, and it's competitive. As a better advantage. I can do that and many people can't So that's kind of one impact of it. The second impact is a hardware's life cycles are 6-month cell life cycle. And I think in the last 6 months and everybody be being home, COVID, people not being in their offices, logistics, deployment. I think hardware is hard in this time. And I'm just being cautious to make sure that, that impact doesn't hit us and people get surprised and say, oh my God, yes, we get it is [indiscernible], we get it's hard to deploy, but you never realized that. So that's the second part. And the third part to be honest, II think this is more my gut than what data and hard data [indiscernible] all the time. I think the cloud transformation conversations have accelerated in the last 3, 4 months. People are beginning to see, can they move to cloud quicker. And that typically means that people pause data center spend and start from migrating to cloud, start talking about moving to cloud workloads. So I might see more VMs get spun up in the short term because people want their excess capacity in the short term, but they are eventually trying to move to the cloud. Some of them will end up in hybrid situations. All these things call for more software form factor deployment, which is the right answer from a technological infrastructure perspective. So I'm just being cautious. And I'm telling my team, make sure you give me double-digit firewalls to platform growth because that means you're playing in the software space, you're playing in Prisma Access place, I'm less posted about product, but the street seems to be more customer product.

Got it. Okay. Yes, I mean, that's a very comprehensive answer. And I guess -- so your guidance was for flat to slightly down product growth. And so is the way that -- I don't want to butcher your words, but that product is Palo Alto's legacy. The future is software and cloud delivered. And so that's kind of flat to slightly down is not really what you should focus on. We should focus on the, I guess, software-delivered form factors, Prisma Access, et cetera, because that's kind of really where the pack is going for Palo Alto, and that's kind of where you want to take them.

I think I'll take that one step up, and I'd say the industry is migrating from a -- needs to migrate from a hardware to software platform solution. And as long as the industry is growing at about 2% to 5% on the firewall side between hardware and software. And as long as I am growing twice or 3x that rate, I'm taking share in the long term. And if you focus on meeting share and the firewall capability out there, I'll be happy if 3 years now with more firewalls platform share than less. And if that means that I'm more biased towards wanting software share than just hardware share.

Got it. Okay. I mean on the kind of software/hardware kind of space. I mean CloudGenix, that was a big acquisition you guys did at the beginning of the coronavirus crisis. I mean, what's the feedback been there? SD-WAN is obviously one of the kind of hottest areas in cybersecurity. So just I'd love to talk about the early product feedback in SD-WAN and how that's changing as a result of COVID.

Yes. I'll tell you long term, and all these acquisitions we've made, we've made with the point of view of TAM, where the puck is going and where we believe the customer needs are going to be. If you look at what's happening, 2, 3 years ago, when we went to the market, and I joined Palo Alto, we're talking about cloud transformation, people moving to the cloud. So still talking about moving into one cloud. They go to GCP, Azure. What's happened the last 2.5 years is that now suddenly, you're seeing a wave towards multi-cloud. We got 1,800 customers in Prisma Cloud, most of them are multi-cloud customers. They're not just on one platform because typically you end up using AWS, GCB Azure tools if you're just on one platform, but then you're on multiple platforms, and on prem, you start using that. So you're seeing that shift has happened towards multi-cloud. I'll give you a case in point ourselves. When I came 2 years ago, we had our own data centers, and we did everything on our data centers. And that's like, if you want to do a cloud-hosted service like Prisma Access, we should put on GCP or Azure or AWS, we evaluated in GCP. It still took us 12 to 18 months back there to get on to GCP and move 70% of our infrastructure there. So every cloud deal you hear about today whether it is Adobe or Walmart, they're still in the early innings of their journey. They're going to take 2, 3 years to get most of their applications in the cloud. But let's assume that 2 to 3 years from now and some different people on different cohorts. When that move happens, 20%, 30%, 40% of traffic's in the cloud, it will make no sense for me to take all my traffic back to my data center because I have to go to the cloud, half my traffic has to go to the cloud. At that point in time, you got to get rid of expensive MPLS and go with SD-WAN. That it's important for SD-WAN to be secured. So I think the puck is going to secure SD-WAN, secure box or secure edge, which means you need both security and networking in a single product. So we're really going to security. We're leveraging a lot of Google networking underneath it, and we're going to leverage the SD-WAN capability of CloudGenix. That's how we'll deliver a SASE solution to our customers. So tomorrow, when a large retailer says, wait a minute, half my traffic is going all the way into the cloud. Why do I have expensive MPLS lines going to my data center, which are large cable lines going in there, let's rip that out. And you'll see, they'll see 50% cost savings ripping out MPLS, putting SD-WAN in. So this is a category that pays for itself over time. So I think it's still the early innings of SD-WAN. But over time, you need SD-WAN and security to be best-of-breed and be able to combine to be able to win those deals.

And would have cloud units bring that you guys didn't have stand alone? You guys have a phenomenal R&D team. And so what are these -- do this kind of scale up bring that you guys didn't?

Two things. What happens is that, first of all, if you deploy an SD-WAN, there are components in SD-WAN and there's an architecture of SD-WAN. The components are our firewalls. Our firewalls can do SD-WAN capabilities, so can other people's firewalls. And Palo Alto firewalls [ can do ] SD-WAN capability, you can put them into an SD-WAN architecture and be able to use them because you need to talk to both sides. Point A needs to talk to point B to figure out what's the least cost routing for getting the traffic there as fast as you can. So our firewalls have that capability. Our controllers have that capability, and you can put our firewalls into SD-WAN architecture. The question is, can you use me as a management control pain to manage that SD-WAN architecture? We didn't have that. That's what CloudGenix did. And it's based on -- they actually deployed on the cloud. They actually use some very interesting AI, where they actually don't have to talk to both ends. They can based on AI, they can figure out the lease cost routing. And give you a cloud-delivered SD-WAN pain. Couple that with the cloud-delivered capability of Prisma Access, we can merge those 2 into 1 cloud ping and say now you can SD-WAN metrics and security at the same time because there's a lot of interplay between networking and security, right? If you want to go from point A to point B this way as opposed to this way, that's SD-WAN telling you do that, you want to make sure you're security in lockstep with your packets moving across your network.

So to paraphrase it back, it's more the management [ plane ] and I guess the networking components that they brought to the table and is kind of really, I guess, thawed out the product set?