Palo Alto Networks, Inc. (PANW) Earnings Call Transcript & Summary

I think a lot of the things that we built for the cloud world will be applicable in the AI world. So you'll have to expand your product. But you still need, let's say, a new product called AI-SPM, AI security posture management. You need to understand your AI artifacts, your models, your databases, et cetera. So you need some of that. We'll need an AI firewall, which is an extension of a cloud firewall. So you can call it a cloud firewall with AI capabilities, you can go on the AI firewall. Depending if you're a start-up, you'll probably call it the AI firewall. If you're an incumbent, you call the cloud plus AI firewall, right? So yes, I think that's where all the action is. I don't think the -- there is going to be agentic AI security, which is a whole different conversation. We can take 45 minutes. I don't -- I'm not there yet on agentic AI. I think there will be nonhuman identities which will need to be managed. That's more of an identity problem, and we'll talk about that in the context of CyberArk than an agentic security problem. And I'll do a segue here because I did that with a smaller group. Look, I'm pretty sure everybody in this room is convinced that with tens of billions of dollars being spent every month in AI, something is going to come out of this thing. You can all see the impact on the consumer space. And yesterday morning, we launched an ad campaign. The entire ad campaign was built using AI. We built one last year with Keanu Reeves over 6 months. We built this in 30 days. Last time it was Keanu Reeves because we need a live person. This time, it's Benjamin Franklin, Marie Curie, Alexander Graham Bell. In order to [ consents ] about these people, they are no longer alive. We brought them all back to life using AI. They were kind of free. We didn't have to pay them $5 million, like we had to Keanu. And they did not want artistic control about what they said, interesting enough, which we had to do with Keanu. So we got it done in 30 days instead of 5 months, it cost us less than $100,000. The last one cost us millions of dollars, and we didn't have to build a set and shoot in L.A. for 30 days and nor did we have to go to the actors guild and get involved with them. This ad campaign -- so this stuff is going to happen. There will be tons of use cases in the consumer space, the enterprise space they're going to build. So we believe that. If you believe all the hype around agentic AI, and you can imagine that Dario from Anthropic is building an Agentic browser, Google is going to turn Chrome into one, Perplexity is building one. There's going to be a few more. I think Atlassian just bought a browser company this morning. We bought one 1 year ago, 1.5 years ago now. So if you can imagine a scenario that your Agentic browser is going to book your next airline ticket and get your restaurant reservation and get DoorDash delivered to your house and your grocery is done and pick your favorite activity, that Agentic browser can only do that with your credentials in your browser. It'll have to borrow your credentials to go do it, log into Uber Eats log into OpenTable, log into DoorDash. One constituency that hates that idea is CIOs. They don't want your credentials being used by any automated piece of software within the browser. So this is a tough prediction, and we'll see if I have egg in my face. But I think Agentic browsers become real, they will be banned in enterprises.

Well, speaking of credentials, we got to talk about CyberArk.

We'd get there in a second, but I'm telling you -- let me finish the last sentence on that one. If Agentic consumer browsers get banned in enterprises, a whole series of secure enterprise browsers will be needed. We bought one 18 months ago, with 1 of 2 players in the market. Now we can talk about CyberArk.

We'll come back to that. So it's actually refreshing to hear you're less hyperbolic about Agentic AI. But in the context...

But it's a great talking point. It gets into a lot of meetings.

It gets everyone all excited. There's so much sizzle, right? But let's get down to brass tacks. You announced your intention to acquire CyberArk this summer. By all accounts, it is your single largest, most transformational transaction in your 7 and change years at the company. Now look, I can fully appreciate that you've bucked conventional wisdom time and time again. But I think there is a lot of sort of trepidation on a number of different facets as to what this means for you? What bets are you making that CyberArk is better under the Palo Alto umbrella than independent. So just sort of help us understand what the bulls are maybe not bullish enough on and what the bears are totally getting wrong with $25 billion check to CyberArk.

Bulls and bears, people in your industry who don't like it and people who like it. Got it.

There's more bears than bulls.

Okay. Well, good for them. That makes it an opportunity for the bulls. That's why you make money. If everybody saw the same thing, we have a problem, right? It's good. It's good for the market. Anyway, look, 7 years ago, when we were probably sitting on a stage similar, there were more bears than -- there were no bulls when I took the job. And at that point in time, we decided we want to be a multi- swim lane cybersecurity company. The last 7 years, we have anticipated and built 4 swim lanes. And in 3 of those swim lanes, we have built $1 billion ARR businesses in under 7 years. Not a bad thing, a bad stick if you can get it. And we have stayed away from identity for the entire period of time because we've said every time we want to enter a market and be big in it if there's an inflection point. And we didn't see an inflection in identity until about 8 or 9 months ago. We've been analyzing the market and understanding it. We believe with the conversation around agents and the fact that agents will start taking over credentials and start doing things is going to create a relook at the credential and identity infrastructure in the company, one. Two, 89% of breaches still happen because of credential theft. Somebody's credentials get stolen and used to extract or exfiltrate data. Three, the way the identity industry has operated is in this world of what is called identity access management, IAM, think Okta or PAM, privileged access management which is in CyberArk. The fundamental difference is if you work in a company, which I think all of you do, many of you can get a badge. If it's only your first day of work, the badge allows you to enter the building. Once you're in the building, you can pretty much go everywhere, except perhaps a few rooms which have another badge against them, but everywhere else, you can go. That's called identity access management in the digital world. You can log in, then you can do whatever you want in your enterprise systems. Nobody tracks you, nobody keeps -- follows you, nobody has a video of what you're doing. You just do what you want. It's called IAM. That's what single sign-on IAM is called. In an IT administrator, everything you do is logged and kept track of because you have access to the crown jewels. So you probably go into your server room. There's probably a camera in your server room in your company, but you probably know the CEO's office has a camera to make sure nobody goes in there. But everything else, you can go everywhere. We think that model is broken that needs to be changed. We think every identity needs to be tracked and followed and logged in the digital sense, which means we think everybody needs to become a privileged access user, not an IAM user. Let's assume why did they start that way? They started that way because the cost of deploying these 2 models was 1 to 10. It took 10x more to deploy privileged access management and 1/10 the cost to go deploy identity access management. So you can buy an IAM seat for $8 to $10, you have to pay $100 to buy a privileged access seat. Interestingly, you have 2 different players in this space. It takes CyberArk anywhere from 6 to 9 months to deploy a customer. They have to build special connectors to every room, every server, every data room to make sure that you have the privileged access available. So they've already done the hard work. The question is, can we get them to be able to do all the work required to be an identity access user in addition to being a privileged. We think we can. So we think CyberArk allows us to have a product that satisfies the user -- employee identity use case, not a type of user use case, which is the fragmentation comes in. I walk in, you follow everything I do. If I go to a privileged area, you have more controls in privilege, otherwise, still keep track of me as an employee. The breaches happen because there's a guy in finance who has access to your SAP system, who's not a privileged user, but he can take your earnings and release them 2 weeks before. Is that a breach? It's a breach. But in the traditional sense, not a privileged user. So we think every user should be followed. We think in the next 24 months, that is what's going to happen in the market. It will happen to every agent, every nonhuman identity for which we need an identity play. Then the question is, why don't you buy a startup and do it like you did the last 24 times, why buy an incumbent? Because the value or the disruption in trying to replace the company's entire identity infrastructure is too high. CIOs will not replace their identity architecture infrastructure because they don't know what's going to break. And if you break identity, you shut down the company, right? If you broke the identity system and a trading system, identity got dislodged and your trading systems go down in your company, the CIO and CISO don't have a job. It's worse than a breach. So nobody wants touch the identity infrastructure. So you have to go in as an identity player in the market who's doing the harder job of identity, not the easier job. So long story for sure, we bought CyberArk because we think -- and by the way, unequivocally, every customer we've talked to of CyberArk is delighted we bought them. CyberArk is delighted to be part of Palo Alto. So it's a good move from a customer perspective. They have 8,000 users with 8 million endpoints. We have 100 million endpoints we cover. We think we can take their 8 million endpoints and try and expand them into our user base and into their own user base. We think we can build incremental products. We think financially, we can gravitate them to our margins on cash flow and operating margins. So all in all, it's -- I think the industrial logic is very strong. I think time will tell if we got the inflection right. And then you have to trust that in 7.5 years, we have one of the better track records in M&A in cybersecurity and software across the industry, and you have to trust management that will do our job.

I don't know if you can stick...

For those who don't trust, they should sell their shares to the bulls and then they can buy them back and they become a growth stock from the bulls.

That how we make market.

Yes, exactly.

I don't know if you were conspicuous in not mentioning this, but how does CyberArk advance the AI strategic road map and the agentic AI product road map and maybe you can put Lee Klarich's hat on. You don't have a side burn, so I don't know if you could fit the bill, but...

Look, the other part of CyberArk business, they bought a company called Venafi, which is on the nonhuman identity part, the certificate lifestyle management. I think at the end of the day, if you believe everything -- I can't believe everything Mark Bennett or Bill McDermott say, but if you believe the idea that agents are going to get more prevalent in organizations and they will be fungible between humans and agents, then everything becomes an identity of either a nonhuman kind or a human kind. The question is you still have to understand credential across both those instances and see how the identities mesh and work with each other. So I think the identity needs a platform approach. It needs an approach where every identity is managed from the beginning until the end and needs to understand that it needs to be tracking both human and nonhuman identities. So today, this is fragmented across 4 different products in the industry, 4 different categories. We think they all need to become one, and that's where the opportunity is with the Venafi acquisition, with the Zilla acquisition, identity governance that CyberArk did with their PAM product and the IAM product that they have.

Let's talk about keeping the lights on at Palo Alto. And what I mean by that is all this AI opportunity and the secular tailwinds are great, but you're running a core that is a [ staller ], right? And I think one of the pieces that gets a lot of investors hot and bothered is the firewall franchise, right? There is absolutely cyclicality in that business. I think you've not been shy about expressing that. But in terms of the whole notion of the death of the firewall being greatly exaggerated, where are we on this curve of dissolution after several years of atypical and aberrant trends? And when you think about, again, AI, what does that do to the medium- and long-term trajectory of how all of us should think about the firewall business?

Look I think thinking about the firewall business in piece parts is the wrong thing to do. And I said this before, and I apologize if I'm repeating myself. The amount of digital traffic in the world continues to compound every year. AI is only going to compound it further. To deliver security, all traffic has to be inspected by a security product, whether it's traffic coming from your laptop going to your company, whether it's traffic coming from a nonhuman identity, whether it's traffic coming from hardware, all traffic has to be inspected. It gets either inspected through a hardware firewall, a software firewall or SASE. That's how traffic gets inspected. Even AI traffic will be inspected by any of these 3. If you believe that the traffic is going to continue to compound even faster with AI and all the data going in the cloud, you have to believe that inspection will continue. There's no other solution. Inspection doesn't go away. Like there will always be security scanners at the airport, unfortunately, if you're traveling. They're not going to go away. We're kind of like the same thing. We cause latency, we make it slow. It's a little irritating, but we're going to be around for a long time. So if you believe that, then the question is, where does the money come? Does it come in hardware? Does it come in software? Does it come in SASE? From a product development, quality, delivery, margin perspective, my software and SASE business are way better than my hardware business because hardware, I got to go produce it. I got to get chips from some different parts of the world. I got to go do quality control. If it doesn't work, I got to bring it back, I got to send you a new one. It's hard to upgrade software because customers decide when to upgrade the software. In software and SASE, I do the upgrades. You can't touch it. So it's a much more efficient operating model. It's a much more secure model. So the more the business moves from left to the right, the happier I am. In 7 years, we have taken our hardware -- 100% hardware business and 60% of that has been migrated to software. And our hardware business still grows at 5% to 8% on average a year. So I'm happy. I don't know why people are not happy.

I'm pretty happy.

That's good. Because only you and I are happy. These guys are not.

And what I'm happy about is using that as the linchpin to build what is a $5.6 billion next-generation security business. This was, by my count, a $0.25 billion business 7 years ago when you came.

It was 0 when I came.

So virtually 0. We'll round down to 0. So sub-$300 million, closer to 0. You've 20x to this business in the last 7 years, in excess of 30% growth pretty consistently. You've got goals to 2.5x this franchise in the next 5 years, right? And this is, as a reminder, completely on an organic footing. This is...

Not including CyberArk.

Not including CyberArk. These are big numbers. So I want to get a better sense from you on the micro, the bottoms-up factors that are going to help you achieve these objectives of going from roughly 6 to 15 in the next 5 years?

Yes. I think, look, if you go back to 2018, when we first met, we had 0 in this business. If I told you, in 10 years, it will be a $12 billion to $15 billion ARR business, you'd laugh me off the face of the -- whatever, right? So what we've come to realize is that like every enterprise business, you want to sell more to the same customer. The scale of Salesforce is such that they sell more to the same customer. You look at every platform business and software, whether it's Salesforce, Workday, ServiceNow, the idea is to build more functionality, sell it to the customer, add value, create value, and that's what drives your outcomes. Cybersecurity did not have such a [ player ]. So we -- after 5 to 6 years of product development, being #1 in 24 Magic Quadrants in Gartner, we came to the conclusion that integrating these much better from a technical perspective, giving the outcomes is what the customer needs. So we have them available in their own form factor, but also more effective integrated form factor. We started tracking the integrated customers, integrated sales, we've discovered that, a, these customers pay us a lot more than sliver customers because they have more products from us. They have the best NRR. Our NRR for our platform customers is 120%. We've never had 120% in any of our product categories because we've never been a platform business. So if I can maintain my NRR in the 15-plus percent range, 115% plus range, take my number of platforms from 1,450, which we announced last quarter, take them to 3,000 or slightly more, we can take this business to that $15 billion range in the next 5 years. And we're very focused on the platform business. It's land one product, expand that into a platform, deploy the platform, show up and ask customers to give you more consolidation.

Platformization was a new vocabulary word. You coined about 1.5 years ago and really shook everybody up a little bit. So you got 18 months of platformization selling underneath your belt. The sales org is better, faster, stronger, more mature in articulating that vision to the customer. But I'm going to pause it to you that does that potentially come as a double-edged sword because what you are championing is a lot of your very large customers continue to incrementally consolidate their product footprint with you, but also their risk footprint with you, right? So on the one hand, how are you mitigating some of the natural maybe pushback you're getting on, well, I can't have one vendor do so much of my cybersecurity because that's systemic risk issue just from a cyber hygiene perspective? And please feel free to disagree. And then secondarily, from a financial model perspective, these are potentially multiyear, very large deals that you're doing, right, $50 million, $100 million-plus deals. Just from a financial model volatility standpoint, how do you mitigate some of the effects of, hey, you're going to have some renewal cliffs happen every 3 to 5 years where you have these big chunky customers do for $100 million plus renewal?

So many questions. Let me start from the last one because that's the one I remember. We've discovered once you platformized a customer, there is no road back. because you have a software firewalls from Palo Alto, hardware firewalls from Palo Alto, SASE firewalls from Palo Alto. If you ever decide to rip us out, you'd have to replace us with 3 vendors and build the entire control pane between the 3 and make the integration happen. And like I start with a customer, it took them 3 years to replace 500 firewalls, we put them in. You have to decide at your last renewal that you don't intend to renew with me and you just start them. You can't replace a network security platform from Palo Alto in under 3 years if you are fully platformized across the board or you can't replace a SIEM platform in less than 12 to 18 months if you are fully platformized. So I don't know what a renewal cliff is. I think it's a renewal opportunity to give them more functionality and sell them more as opposed to renewal cliff. So the NRR at 120% is that's the reason it's 120%. We don't see churn. So I don't think there is a renewal risk. You did say there's a, let's call it, the consolidation risk. I was trying to find the best analogy. I guess perhaps the best analogy, which is old is I started my career at Fidelity in the technology team, and we had 23 applications, which made up what is today called CRM. And over time, 3 or 4 vendors emerged between Oracle, Microsoft, Salesforce and others who provided you a single platform did 23 functions that allowed you to consolidate those 23 applications. I'm pretty sure somebody had a conversation, "Oh my God, we're consolidating a risk," but the value of that being together is so high that you say that's the right answer. This was the wrong answer. And that same movie is played out in HR systems, same movie is played out in financial systems. Cybersecurity is the youngest industry in technology. We only came about when connectivity came about. Until your iPhones were connected to the Internet, there was no need for cybersecurity. It was all data center-driven, all terminal-driven in the office. You walked in IBM gave you a frame, mainframe, but terminals, you need security. Who needed security then? You did client server architectures, you did liberal security and did firewall inspection. Now with the sprawl of the technology infrastructure, you need security every juncture. I think it's just the stage of the industry where it is. I think 10 years from now, you will not be buying sliver products, which are small products based out of startups. I think that consolidation is happening. And I will say, look at our industry, 7 years ago, everybody played in the swim lane. Today, everybody is trying to cross swim lanes. If you take a look at the top 10 cybersecurity companies in the world, they are trying to get a product in the other swim lane, and you can ask -- I'm pretty sure you have everybody. So I think that's the trend. I don't think that's a risk the customer sees. The customer sees the value of these things being on one control pane and then they are not gonna go back.

Nikesh, my last question for you is 3 years ago, you made a prediction that you're going to be a $100 billion market cap company. That's absolutely come to a fruition. And I think it's worth mentioning, you were a $20 billion market cap company 7 years ago. So I wouldn't be a tiger mom if I didn't ask you, where is the next $100 billion of market cap going to come from? And what things absolutely have to go right to have that outcome?

Look, you guys do the math. I don't think we need to change our financial profile from an operating margin, free cash flow margin perspective. I'm talking just organically for us without the CyberArk piece. I don't think we need to change anything in our operating profile financially to achieve our $15 billion ARR target in 2030. So '25, 5 years from now, we are at $5.6 billion today on the next-generation security, you get to $15 billion. You guys have better multipliers than I am. You can figure out what that does. If you keep the multiple the same. I don't know what the math is. If you depress our multiple a little bit what the math says, I don't think -- there's no math you can do, which gets you less than $100 billion going from $5.6 billion to $15 billion, just what organically we can do. Then the question is what can we do with CyberArk? Can we do with CyberArk, what we did to Palo Alto? And of course, they don't have the option to go into multiple swim lanes. They can be the identity platform in the future. Even 5 years from now, we can make CyberArk identity platform of the future as part of Palo Alto and take their $20-plus billion market cap and double or triple it, that's gravy on top of the $100 million.

Well, we'll be watching from the sidelines.

Or $50 billion.

I like it. Make it $300 billion.

No. No. I'm not [ Moss ], I'm not investing in data centers in the United States.

All right. Fantastic. I think that's a great place to put a pin in. Thank you so much for an awesome conversation. Thanks.

Thanks, Fatima. Nice to see. Thank you everyone.