Palo Alto Networks, Inc. (PANW) Earnings Call Transcript & Summary

June 8, 2021

NASDAQ US Information Technology Software conference_presentation 33 min

Earnings Call Speaker Segments

Tal Liani

analyst
#1

Great. Thanks so much for joining us this morning, this afternoon. This is my first session in our tech conference. And I'm very happy to start with Nikesh Arora, Palo Alto's CEO, one of the most important companies in my universe. As always in these conferences, the discussion will be kind of starts with high level to address issues that we don't normally have time to address and then we'll go down if time permits, we go down and discuss more details about the quarter, et cetera. If you have any question, there is a parallel Veracast session where you can e-mail me or text me questions there, and I will do my best to ask the question. So with no further ado, I want to welcome Nikesh for joining us.

Tal Liani

analyst
#2

And I want to start with the first high-level question which is, you reported a great quarter, billings were up 23.5%, NGS ARR were up 71%. I want to start with the big question. What is driving your success?

Nikesh Arora

executive
#3

First of all, Tal, thank you for having me. I'm excited to be here. Look, as you can tell, what has happened in the last 1 year has been this huge surge from work-from-home because of pandemic. There has also been a lot of focus on cybersecurity given all the hacks we're noticing, whether it's SolarWinds or the Exchange hack and a bunch of other hacks. We're seeing in the market a bunch of ransomware events that we're seeing. So the focus on cybersecurity is high and our reliance on technology has never been higher because we're all relying on some sort of online means to be able to get our day jobs done or to live our lives. So in that context, the focus on cybersecurity is high and people are getting more and more security conscious, and that's kind of our sweet spot because whilst we are known as the #1 security company, so we see a lot of traction when security becomes a focus. And to be fair, that's been some of the tailwinds behind us, and not to take away from the efforts of our team in the company who have done a great job in positioning us in places where we believe the puck is moving. So whether it's cloud security or AI-based security or it's transforming the network, we have been working hard towards preparing for those events, and it seems that, that is coming through.

Tal Liani

analyst
#4

Great. I want to understand the migration from hardware to software. And just to give the stats for those that didn't follow the quarter. Your total subscription and support revenue grew 33% last quarter. They account for 3/4 of your revenues give or take. And the question I have is, first of all, I'll start on the hardware side and then on the software side. On the hardware side is the life of firewall. Is it game over for firewall? Meaning if you fast forward 10 years from now, does it mean that all traffic will go to web-based solutions and on-prem firewalls will just not be deployed? I'm taking it to extreme.

Nikesh Arora

executive
#5

Yes, Tal, if you think about it, I think the pendulum was in the court of the hardware business for the longest of times. As we've seen the public cloud emerge, as you've seen the cost of compute and storage go down, it brings the companies, this is a much used word called hybrid. We expect the world to end up in a hybrid state, right? And you're seeing the movement away from purely hardware-based data centers to a public cloud plus on-prem data center. I don't think on-prem goes away. I think that shifts. I think in the next 10 years you end up with 50% of the world sitting in some sort of a public cloud outcome. There's still many use cases which require an on-prem or your own data center or your own hardware, which is a high throughput scenario, whether it's production networks or telecoms, or it's high data-intensive companies, which do financial service, for example, doing the same transactions back and forth, you really can't rearchitect your business on the public cloud. So you're going to see a mix of public cloud and hardware-based solutions in the future. I think you're seeing that shift beginning to happen. Having spent 10 years at Google, I saw the train coming. And the key was to make sure we position ourselves aggressively for a world that is going to be hybrid. And what that means is not just getting away from hardware, but it means maintaining the innovation of hardware, at the same time building software best-of-breed capabilities that allow there to be sort of equal citizens to both sides. So what we've done in the last 3 years is built a phenomenal sort of firewall in the cloud business, a virtual firewall business, which has shown you that 40% of our firewall business is now software-based. And we think that trend continues. We think we end up in a 50%, 60% scenario for software. But I think that's critical for the security industry to keep building that innovation on the software side because the world is moving towards a hybrid environment faster than people think.

Tal Liani

analyst
#6

And just to understand it, the background for this question, this coming question is the comment that Zscaler made last quarter that they've seen campus customers also migrating to their cloud-based solutions. And the question I have is, I look at it from the other angle, from the other side. How do you define the applications or the use cases that are still going to require hardware versus the ease of use when you move to the cloud, et cetera, also for your legacy situation? So where do you draw the line for, this has to be hardware. It's more efficient versus it's easier for the corporate to apply a single policy with a single type of service and migrate all solutions to the cloud rather than have 2 types of solutions, hybrid basically?

Nikesh Arora

executive
#7

Tal, I think there's a bunch of FUD in the market around this whole cloud security and cloud architectures. Let me clarify, it's down to 2 very fundamental principles. One is, how do you get to the cloud? So in the past, you had a data center. Everybody had to get to the data center to run any application and get back out of that, right? If you had cloud, you went from there, a little bit of cloud, you came back. Today, if half of your business is being run in the cloud, they're using Workday or SAP or Salesforce or Gmail, you're going to have to go to the cloud. What's the point of bringing your data back to your data center and then from there go to the cloud? You might as well start at this point and split the data and send it to different places. So that's effectively what remote access to the cloud is about. And that's where you'll see the solutions, SASE solutions, whether it's from Palo Alto Networks, from Zscaler or from others. This was the old VPN business, which used to allow people to connect to the data center. Suddenly, if you're going to the cloud right from here, from the endpoint, you need to apply policies right here to be able to go whichever way you want. So from that perspective, the first part of the business is how do you get to the cloud? Now given the cloud is going to require a remote access solution, which is able to deploy entire firewalls in the cloud for you because now with the pandemic, everything needs to be accessible from everywhere. So I think the days of proxy-based access are short-lived because you have to apply the full firewall stack in the long term. And many companies, all companies will have to come up with a much more robust security solution in addition to remote access solution from where they get data. Use cases that apply for hardware are data center use cases, large branches, retail stores. You're still going to need some piece of hardware to take that traffic and route it to 2 different places. So you're still going to need some hardware that sits in that branch, in that campus, in that sort of remote access location, which is going to allow you to split the traffic at some level. Now the second part is, once I'm in the cloud, how do I secure myself, which is where the world talked about CASB in the past. Today, it is 70% of the applications are homegrown applications built by organizations. Those need to be protected. That's something which is called cloud security or securing your applications in the cloud. And that's something we do with a product called Prisma Cloud.

Tal Liani

analyst
#8

We'll get to it. I want to speak about Palo Alto now specifically. NetSec, you're expecting this segment to grow 17% in 2021. The firewall market is hardly growing. I mean, it's growing, but it's not growing as fast. You're outgrowing the market. What are the components of this growth of NetSec?

Nikesh Arora

executive
#9

Well, Tal, fundamentally, what happened as we, and this is what we've been talking about. The customers trust us to put a box or a piece of hardware in their infrastructure. That goes through a tremendous amount of proof-of-concept, validation, trust, our ability to support the customers and secure the customers. What we've been able to do in the last 3 years, when you put a piece of hardware in there, given the low cost of compute and storage, we can now at low latency provide them cloud-delivered services on that piece of hardware. We can do data loss prevention on the hardware. We can do IoT security. We can do SD-WAN capabilities. What we've done is we've expanded our capabilities on our hardware form factor from 4 different subscriptions to 8. Right now we can do a whole bunch of other services on that one piece of hardware in the data center, allows the customers to reduce their hardware footprint in the data center, even if you have an on-prem solution, it reduces. What we also did is we took those capabilities and ported them to our software solution as well. So if you have a VM running or a software firewall or you have Prisma Access running, we can do DLP against that. We can do IoT against that. We can do cloud security against that. So what we've done is we've created software subscriptions or software capability against our firewall platform which allowed us to continue to grow both by expanding the number of subscriptions and obviously expanding the use cases going from hardware to software. So that's what's driving the NetSec growth. That's what's part of the transformation. As you know, software typically has better gross margins unless you're consuming a lot of public cloud. So we're seeing that transition happen for us in NetSec without a significant impact, either to gross margin or operating margins, and it continues to sustain very high cash flow margins.

Tal Liani

analyst
#10

So you touched on the attached subscriptions. Can you discuss the attached subscriptions? What are the main offerings? Should we expect more subscriptions? You spoke about 4 going to 8. So should we expect more or are you at the level that you're going to basically focus your efforts on the other segment, on the cloud side?

Nikesh Arora

executive
#11

No. Look, Tal, it's not or, it's and, right? Because on the network security side, we have a robust business. We've shared with you guys in the earnings call that we have one of the largest network security business in the world, which continues to grow at, like you said, many times faster than the growth rate of the firewall business in the world. So from that perspective, we want to maintain our momentum and our strength in the network security business. We think it has got legs. It has got a long time to go because we don't think network security goes away. Every customer, every company out there needs to provide robust, secure access to their applications, whether they are in their data center or in the cloud. Couple to that the fact that you still need a firewall when you go to the public cloud. You just need to be able to run firewalls to protect what's coming in and out of your public cloud into your data center. So from that perspective, this business has long-term strength. If you couple that with the fact that some of our software subscriptions are still early in their life cycle, right? When I came to Palo Alto Networks, we announced a service called DNS Security. And we announced a quarter or 2 ago that we've got to 5,000 customers of DNS Security from 0. Now we have 80,000 customers. We have 1,500 of the Global 2000. So it takes time once you launch a subscription for it to go and penetrate the entire customer base that you have and the entire both software and hardware firewall base. So the exciting part is, when I came to Palo Alto, we had 4 subscriptions and the last one we built was 7 years ago. So we had penetration rates of over 50% in our customer base. Now we've launched one 3 years ago. We've launched a bunch last quarter. We also launched a few quarters ago. So we think there's a ramp that's going to happen in the network security that is allowing us to make sure that our software subscription business continues to grow over many years. And yes, look, if there's more exciting things we can do with the hardware firewall on the customer premises or software firewalls, we will continue to evaluate which other capabilities we need to deliver to our customers to make them more secure.

Tal Liani

analyst
#12

Yes. Prisma Access, Prisma Cloud, Cortex, you're positioning the company to be played in the cloud. And I want to first start with maybe understanding your vision for cloud security and understanding where -- I want to understand where do you see Palo Alto playing? What are your strengths that you're going to utilize in how you get to your goals?

Nikesh Arora

executive
#13

Look, if you go back up to the top like where you started, if you believe in the next 10 years half of the world's compute is going to happen in a public cloud of some form, we're still some ways away from there. And this is a transition that takes years. When I came to Palo Alto, we had 7 data centers. We're down to one because we decided to move our entire processing to the public cloud because we believe to be able to provide customers this capability around the world at scale, we need to be deployed on various public clouds. We're not on one. We're in 2, most likely going to be in 3, right? So we are going to deploy in the public cloud. We're a $35 billion company. So if we can do that, you can imagine that there's going to be a large depth in that move to the public cloud. If you take that as given, then you got to make sure that the fragmented security that existed in the enterprise use case where customers had 40 vendors needs to go away. When you go to the cloud, you have 2 choices. You can use the underlying cloud provider security where they'll make sure your data center is secured effectively, the overall data center. But you got to make sure that the applications that you write in there are secured. So they all have some capability that provides the security. But what's fascinating, Tal, is that most customers are ending in multiple clouds. So you need a single pane of glass that can work against AWS, Azure or GCP against serverless workloads or containers. So what we've built in the last 3 years is this capability where we can protect people across multiple clouds and multiple technologies. And we are also trying to make sure that you get protected from your entire development life cycle, from the time you write your code until the time you put into production and monitor in production. So trying to make sure that there is a common platform available. Now there are some data points for success. We showed that we had 2,290 customers in the world. We have approximately 400-plus customers from Global 2000 using our cloud security platform. We also shared that we crossed $250 million in run rate on our Prisma Cloud capability. That, by far, is the largest cloud security business in the world, by far, right? We don't see anybody in that space. What we see is either CSPs building their own solutions, which makes sense for customers that are only in one cloud, and they don't have plans to have other clouds. So that's typically at the lower end of the spectrum or you will see people who are still doing some homegrown cloud security, which you think over time will have to make way to large-scale, multi-cloud, single pane of glass capability. So from that perspective, I think there's a lot of room in that space. I think there's a lag between when people sign their large public cloud contracts to the time they will deploy all their applications in the cloud and they will need the security. So I think we have an early lead and that early lead should do us well as long as we maintain the innovation and stay on top of it.

Tal Liani

analyst
#14

Are you missing any parts, any points or any areas of cloud security?

Nikesh Arora

executive
#15

Tal, it's hard to say, but when we started this journey, the world was in one cloud, and they were doing workloads. And we identified containers as the place where the exposure would happen. We bought Twistlock. We integrated it. We saw the container exposure happen. We looked at serverless. We added serverless, which hasn't taken off as well in the market. The customers are not deploying serverless as much as they're deploying containers because they want to be on multiple clouds or on-prem as well. We saw the need for identity and access management. We deployed identity and access management last quarter. It's doing really well. We realized that you need data loss prevention in the public cloud. We introduced that. That's doing well. So we are beginning to create modules depending on how the customer demand continues to grow. So I think it's early still in the public cloud space. I think lots and lots of capabilities are still getting validated in the market because customers are realizing what they need. I don't know if you saw yesterday, we found the first malware attacking Windows containers. Hadn't been seen in the industry before. So you're beginning to see that the hackers are also beginning to turn their focus on the public cloud use case, which as I said, requires them to start thinking about public cloud security in a much more robust fashion. So I think the space will continue to evolve. We've done a lot of acquisitions. We integrated them all. Now it's a lot easier for us to build on top of our platform than try and attach something to their platforms.

Tal Liani

analyst
#16

I want to maybe touch on Prisma Access specifically. You acquired CloudGenix before. The only reason why I focus on the Prisma Access is because one of your competitors is highlighting this space every conference call. And I want to make sure that we understand, first of all, the opportunity for you, your success in integrating CloudGenix, your offering, et cetera.

Nikesh Arora

executive
#17

So Tal, look, most fundamentally, as I discussed earlier, there is the question of how do you get to your application in the cloud? How do you get to the most efficient, secure way to get to your application, whether in the cloud or in your data center? In the past, the old solution was VPN. You VPN in into your data center, use your applications sitting there, sign out, you VPN out. That's it. That's a secure tunnel and you can access your applications. Now we found some problems with VPNs in the past, got some of them hacked. Plus, with the cloud architecture, VPNs are forcing you to go one way when you could actually be going in 2 different directions. Plus, there are new companies which are being formed purely in the cloud, why do they need to, they have no data center to go to. So when you do that, you have a choice of going in there through a proxy-based architecture or you can go in through a firewall-based architecture. The firewall-based architectures make a lot of sense. If you already have data centers, you have a firewall there. You want to make sure the same policy applies and make sure the same policy applies when you've got a firewall in the public cloud. From that perspective, we've built an integrated solution in Prisma Access where we apply the same firewall capabilities, whether it's in the hardware, whether it's in your data center, sorry, public cloud or for remote access. That's allowed us to scale our Prisma Access business hugely in the last 1.5 year or 2 since we've deployed a lot of resources against it. And I think that's in a very early stage of that trend. We are seeing customers accelerate the pace of VPN replacement over time because people want a full-service solution that allows them to be in a net new architecture in the future. We are beginning to see customers who realize that it's not enough to just route your traffic. You have to apply data loss prevention rules against it. You have to make sure you have endpoint monitoring to make sure that no remote server or remote access point is down. And we announced that in our quarter that we were very successful in Prisma Access. We announced a very large deal, which happened in the 1st of May. So we're seeing traction, especially at the top end of the market. We're seeing lots of network architecture transformation requests. Again, I think the pandemic has been a bit of a catalyst for people to evaluate their structures. Imagine, until 1.5 years ago, most companies were happy to make sure 20% of their employees could access most of their applications, I'd say most, most of the time. Now it's 100% of the applications, 100% of the time, 100% of employees. So you're going from a 20% use case to 100% use case is not going to go away. I think there is an amplification that's going to happen there. And I think people are going to migrate towards more and more full-service robust security solution in that space because it's here to stay.

Tal Liani

analyst
#18

Got it. Cloud and AI security or ClaiSec, if I pronounce it properly, you expect it to grow 90% this year. Can you discuss, first of all, the components, this is a new, this definition of this segment is new for many people. So maybe if we can take the time to discuss what's included in this segment? Why is it segmented separately than the others, than network security and then what's driving such a high growth?

Nikesh Arora

executive
#19

Great. So I think, Tal, as we discuss the network security business, and we felt that it was important for our investors to understand, we effectively have a two-part business, right? The one part is the network security business, which is the largest network security business world, which competes with people who are in the remote access business or in the firewall business. There, we're showing that, look, we can still grow that business 16%, 17%. We can retain gross margins in the mid-70s. We can have operating margins in the high 20s, and we can have free cash flow margins north of 35%, right? And in that business, we're showing that, that's a robust scale business. We continue to get leverage and scale, and we continue to drive a phenomenal business over there. So that's why we separated it in NetSec. And you can see the trends are being driven by software, hardware to software and more remote access using a firewall in the platform, in the cloud and these continued growth of more capabilities through subscription. That's the network security business. And you see where the puck is going, the puck is also going to the public cloud. And we need to make sure that our public cloud business is targeted towards that. That's Prisma Cloud. And that's in the cloud AI business. That's Prisma Cloud. So basically our one single pane of glass across multiple clouds, with multiple modules that allow us to provide a full comprehensive suite for security for the cloud use case. The other place where we believe that revolution is going to happen is what we call in the security operating capabilities or managing the SOC or how security is going to happen in the future. And if you look at some of the recent events of ransomware attacks, et cetera, it's taken companies 20, 30, 40 days to figure out where their servers are, what's on their server, are they vulnerable, are they not vulnerable, how do they patch it, how do they bring it all back up? I think that's the legacy. What you're going to have to need is going to have to need almost instantaneous capabilities to be able to block a zero-day attack. Now we were fortunate that unfortunately we were targeted, we were targeted, but we're fortunate that we were able to stop a zero-day attack using Cortex XDR, our product, which basically analyzes behaviors and takes anomalous behaviors and blocks it even if it has never seen it before. Now that's our product suite called Cortex. What it does is we have multiple products, one product which allows us to look at from a visibility perspective around the world which Internet assets are available by company or by government or by agency or by state to be able to understand what the vulnerabilities out there are, which is what typically a bad actor will be looking at. That's the acquisition we call Expanse, where we now are able to go into a company and say, look, these are all your vulnerable assets. Let's take a look at them. Let's figure out how to remediate that vulnerability before you get attacked. We also acquired Crypsis, which is part of that, which is Unit 42, which is where we are able to provide incident response and cyber architecture, broad support services, where we can make sure that if you're unfortunate enough to get attacked, we are able to bring our capabilities to bear and protect you or help you in that scenario to transition away from that. In the same category, we have Cortex XDR, which is effectively endpoint product, which our team is very proud of because in the last 18 months, we've gone from being a challenger to being a leader in the Magic Quadrant, effectively for us on Forrester Wave, sorry. And that puts us at par with the CrowdStrikes, the SentinelOnes of the world. We are seeing good traction in the XDR capability. In fact, our teams were the first team that actually cross-correlated the endpoint data and firewall data to reduce the amount of alerts and create more automation. And then we have XSOAR, which is our automation product. So it's effectively the best way to describe it, it's the AI-based security suite for the future, which kind of sits in a space where you collect a lot of data, you analyze a lot of data and you try and do an immediate response to it. The reason I describe it that way, I think there is still going to be more evolution in that space. I think you're going to see a change in a bunch of actors in that space. And eventually, I think our aspiration is to be a leader in that space with the combination of our XDR, XSOAR and potentially eliminating the need for SIMs in the future. So the reason we took it out separately, Tal, is we want to make sure you understand, that's a high-growth business. It's very early in its life cycle. High-growth businesses early in life cycle, one focuses on landing into a whole bunch of customers generating ARR. They are still early in its gross margin gain. We think over time it gets to the mid-70s. But right now, it's in the the 50%, 60% range. It's still negative operating margin, obviously, negative cash flow. We expect the cash flow sort of neutrality will come sooner than the operating margin neutrality. But it's a fast-growth business, and we all have seen the profile of fast-growth SaaS businesses in the space. So we're just trying to show the world that we have 2 businesses. One, we run like a traditional cash flow generating, high-leverage business where we keep the transformation happening. On the other hand, we're building this really fast-growth business for the future of security under one umbrella. And the reason it makes sense under one umbrella is because we demonstrated in our earnings that 40% of our customers bought 1 or all 3, our cloud capabilities, our SOC capabilities and our network capabilities. And that leverage the power of one would not be possible if we were not one integrated company.

Tal Liani

analyst
#20

One of the challenges that you had was to get into a company that is hardware-based, let's say, and transition it to be cloud-based, software-based. I'm not talking about the actual product. I'm talking about the sales cycle and the sales process. So can you talk about what you've done to the channels and to your sales organization, marketing, and what have you done to the sales process altogether in order to address the shift in the company's focus?

Nikesh Arora

executive
#21

That's a good question, Tal. Look, you can't take a sales force that is focused on hardware firewall that's competing with other hardware businesses out there and start getting them to focus on new products. And we tried that early in our story, we tried that, and we shifted that focus too much on to cloud and AI, and we saw that caused a little bit of lag in our network security business. So what we've done since then is we have tried to make sure we strike the right balance between both managing network security and cloud and AI. So what we have is we have specialist salespeople for cloud and AI, individually for cloud and for Cortex. Those specialist salespeople partner with our core sales team where they come in as backup or support when the core sales team unearths an opportunity. So we still have a quarterback, which goes in and helps try and sell the entire Palo Alto portfolio, yet they have specialist teams behind them that help them on specific areas because as you know, in many areas, we compete with very specialized companies who focus on providing only one solution. So it would be unfair fight if a generalist was to fight a specialist at a customer. So what we are able to do now effectively is strike that balance on an opportunity-by-opportunity basis where our core team can go to create the lead generation and our specialist teams can come in and help support it. And 2 years ago, we didn't have enough specialists. I think we've done a reasonable job in ramping up in certain areas this particular year, and we hope to continue to do that to continue that evolution of the business, both in the next sales cycle.

Tal Liani

analyst
#22

Got it. I have 2 questions and we have 2 minutes left. So I think we are fine. I'm hosting a panel separately. And when I'm hosting a panel, a different topic, and one of the ways that one of the panelists explained to me his market, he said the market is divided into companies that host their service on a private cloud and like Zscaler and they build their own cloud versus companies who host their service on the public cloud and Palo Alto is one. Two different approaches, why did you choose to go with one and not the other?

Nikesh Arora

executive
#23

Tal, I spent 10 years at Google. And I saw the power of a very large-scale cloud. I think we will all realize in 4 to 5 years as you start learning a very large, thousands of customers based solution, you have to have 99.99% availability. You have to have redundancy. You have to have reliability. You have to make sure that all the tools that are generated for like literally for AI, for machine learning can be instantaneously deployed across that entire base. Now can you do it? So can you do it, of course, you can. But what happens in that situation is that now you're going to end up spending a lot of time building a DevOps capability where your entire product suite depends on that DevOps capability. If there is a company that is spending tens of billions of dollars every year to develop that capability, I think in the long run they will provide that service better. You may debate this in the short term. I think we're early in the life cycle of companies relying on the public cloud. I think you will discover and you can discover that today. I think the best way to look at it is, think about the new companies built in the last 10 years. Whether that's an Uber, whether it's a WhatsApp, whether it's a YouTube, whether it's a, you name them, Airbnb, DoorDash. All these guys are relying on the public cloud. How many of these guys on Zoom have their own data center at scale? They don't. Why? Because they are able to go leverage what is being built on a large scale for the world to go consume. So I'm not smarter than those guys.

Tal Liani

analyst
#24

In the long run, do you think you can have better margins, comparable margins? Because for now, at your size, it means lower margin, if I understand it correctly.

Nikesh Arora

executive
#25

I think, Tal, at the end of the day, the question is going to be, it's going to be a few hundred basis point margin difference, but I think the scale, reliability and speed, which effectively translates into customer happiness and customer capability. And for example, when the pandemic came, we all had to improve our capacity by 10x. Now that's nontrivial, especially if you're trying to provide a localized data center in Hong Kong and localized data center in Germany and a localized data center in France. Guess what? The next debate is going to be sovereignty, right? Every country would like you to store their data in their country. Now you got to go solve that problem in every country and build your data center. Not only do I have to maintain data centers, I have to make sure that in France my data centers are manned by French people, and I've got an architecture that supports data centers in France. I've got to make sure that redundancy is created in EU, not in the U.S. So this thing is going to get, continue to get more complicated. It's a question of, do you want to build it yourself or do you want to let somebody else build it? I think in the long term the margins are going to be somewhat consistent. And whatever you might see as a marginal difference in margin is going to be made up by the convenience, speed, the tools available and the reliability of the underlying infrastructure.

Tal Liani

analyst
#26

Got it. Okay. So last question, which we don't ask you a lot about because we normally don't ask tech companies about it, but as a dinosaur in the space, I have to ask you about your balance sheet. You have a healthy balance sheet, very good levels of cash flow and cash generation and cash levels. What are your plans? What are you going to do with this balance sheet in the long run?

Nikesh Arora

executive
#27

Well, Tal, in the last 3 years, we've tried to create a balance between acquisitions and buying back our stock and maintaining a steady cash balance on our books. And we've struck the right chord. We've bought approximately 10 million shares. The dilution was approximately 10 million or 11 million shares. We try to keep it in a net neutral dilution over the last 3 years for our investors. We've also made sure we've been opportunistic and bought our stock when we believe that the stock was undervalued by the market. We've also used that equity or cash in an efficient fashion to build what is pretty much a $735 million ARR business, which you highlighted was going to grow at 90% organic and inorganic growth number is slightly lower. So we've tried to be good custodians of our investors' cash as well as manage the equity carefully, and that's what we're going to keep doing.

Tal Liani

analyst
#28

Great. So thank you. Time is up unfortunately. Thank you very much. It was very enlightening. For the investors, if you have any other question in the future, please e-mail me directly and I'll be happy to answer. Thank you so much.

Nikesh Arora

executive
#29

Thanks, Tal. Thanks, everyone.

Tal Liani

analyst
#30

Thanks. Take care.

This call discussed

For developers and AI pipelines

Programmatic access to Palo Alto Networks, Inc. earnings transcripts and 32,000+ others is available through the EarningsCalls.dev REST API. Plans from $24.99/month — full transcripts, speaker segments, full-text search, and the recently-added /api/v1/transcripts/recent polling endpoint for ETL pipelines.