Zoom Communications, Inc. (ZM) Earnings Call Transcript & Summary

It's too early to see the actual -- to measure the speed gains. We see a lot of potential, and I agree with this. What we want to do with the automation is take the robotic task out of the way. The repetitive things that a machine can do and free our limited human resources up to do what humans do better, which is do the analysis and make the decisions at their level and provide that communication. So we want to just squeeze the air out of the process with the automation and the other actual value add.

I'll tell you a place where we are seeing a little bit of progress, material changes, right? So you've got your FedRAMP certified offering and version upgrades don't really count against you in terms of having to recertify or to involve the 3PAO for an additional audit. But the -- if you go -- if there's a material change to it, if you add a feature functionality that wasn't looked at before, the automation piece has kind of helped and speed that process up, right? So you input the changes. If you've got somebody that's at the wheel and in the agency that's sponsoring you, that can generally happen pretty quick, right? So it's not as scary as it used to be, right, when you would add a cyber feature or whiteboarding or whatever it is that you're going to add. So that time to market has decreased a little bit, and I think automation is definitely out there.

And what are some of the risks that you're seeing for the security -- security-driven automation. And David we will start with you, either the things that the common traps that can come from automating things that should be automated or that we've learned that can be avoided with a little bit of planning. Are there kind of common pit falls that you're seeing.

I know we've got enough experience to say what the common pitfalls are, but some of the things that we're -- I'd be concerned about are not tuning our thresholds correctly and maybe ignoring an alert or a warning that we thought we should have looked at, but because we set the threshold in the system, it gave it a different status and we didn't maybe jump on it or maybe being overloaded in the dashboard with too much information not hearing it on the right threats. We're obviously in a high threat environment with Zero Trust coming over. We have to basically assume everywhere we are, we're in a dangerous environment. So the threats are coming from everywhere. So our telemetry is going to be high, and we've got to tune our settings in our automation to really focus us on the real threats and take it and not to get as distracted with things that aren't real threats, right? So that's going to be the key in the learning curve that we, I think, from an automation standpoint to tune those thresholds to minimize the risk.

Okay. Brian, what about you. What do you seeing from the CISA seat?

So configuration management to me would be one of those threat vectors because you don't want another -- you don't want to introduce another SolarWinds type event. So as Dave goes through his learning objectives, you might be very curious to see from his cyber perspective, what they've -- or how they've configured security within their automation.

And we have an office of information security that's focused on the threat aspect of this and helping us configure the tools. So we work very closely with them to try to tune the settings and figure out dashboard elements report and warnings. And so it's going to be an iterative process as we get smarter, and we'd be happy I'm sure to share what we can, help everybody improve.

Okay. What about from your deployments? What are the what are the automation warning flags you might see?

The first thing I would say is net new use cases, right? So use cases that have an exist that come in, and we've got a handful of them that we've experienced over the last 18 months or so. I know I spend at least 10 minutes, not agreeing with the lack of reciprocity, but reciprocity, right? If an agency says, well, it was good enough for them. It's good enough, perfect for us. And the use case is different for that specific technology, that's obviously going to introduce risk. So yes, I think, primarily, I think first time use cases where technology is not being used in the manner that it was initially purchased or intended for, that's going to introduce vulnerabilities and potential issues.

Okay. Brian, I see you scribbling furiously there. Do you want to add?

So I'm very curious about the use cases. So you only have a handful of them, right? But from what perspective are they? Are they from a user perspective or...

Both, right? So one of the use cases that we've come into is Zoom was born a meetings resume company, right, video conferencing for lack of better term. But now with the level of government to citizen, citizen to the government engagement, our platform is being used for different things and just holding meetings, webinars, things like that. So there's a use case at CBP where our technology is embedded into an application, and this is an automation in story too where at nonphysical border crossings, right, hunter in Canada or somebody coming across some place where there is no physical presence to process like you would at Dallas Airport, there's an application that exists that allows for a face-to-face meeting with a CBP agent and that information that is automated on the back end to pop up. So that the real-life scenario is that you still face to face, that CBP agent still has all your passport information, right? So there's a lot of integration in an application like that or a use case like that. And when that happens, there's more than one FedRAMP certified offering there and the back-end APIs and anytime that you're integrating more than a single application, that's where the inherent risk would come in, right, into those potential holes. So when -- for us, that's not a use case that was born out of a Zoom meeting. That was somebody at CBP saying, "Hey, we've got an issue here and we think that Zoom can be a part of a solution". So that configuration and that architecture, that was a long going-out process to arrive at something that was secure enough, right, to warrant permission. Does that make sense?

I think so Yes. Yes. And just -- we're going to pivot to audience Q&A here and just going to get a couple of questions to come in, but if the rest of you have them, make sure that you're either submitting them or getting ready to raise your hand. But David, I was wondering if you could talk a little bit about the VAs road map for the various efforts. You touched on a few of the projects, but what's on the agenda for the next 6 to 12 months? What should we really be watching with you guys?

So we're continuing to execute on our cloud strategy. Part of that includes getting better at what we do, where we do it, not so much do more of it even though we've got a lot more planned for migrations and modernization of applications. So I think just looking at as maturing our processes is a big focus in the next 6 months. We're improving our level of operational excellence and engineering excellence as we do that to just get better at what we do, automate as many tests, whether it's simple things like automating more provisioning or automated AI ops for operational monitoring, things like that to make sure our systems are more reliable. And then, of course, from a security and ATO perspective, how can we leverage automation to speed up that process as well. And improved automating other compliance. Once we give somebody an ATO, we don't just stop there. We have to make sure they maintain controls as they've changed the configuration or release new code or features, they have to make sure their ATO stay current. And so that's part of it too. We have to go back periodically and check that there's still in compliance in the sense that we can automate that is also a goal that we have.

It's been a huge change at VA since, since I think, doing some, right? So what is that 10 years ago-ish. It's been a huge change in the skill set, right, the communication. We've noticed, I think most vendors would say that there's been a massive improvement in the way that the VA does business within technology over the last to 10 years has been remarkable.

And Lou and Brian, you both get to sort of interact with people across the federal space, from your different perspectives. I'm curious if there's any patterns you're seeing about how customers or the agencies you're communicating with are approaching automation. Is the focus on configuration management is the focus on more on the monitoring side? Are there any patterns you want to spotlight or other areas besides the VA that we should kind of call out as a good place to look.

Citizen engagements, number one, right? That's what we're consistently hearing, right? How do we make things easier. And I thought Steve's presentation before ours was a classic example, right? Automating that process so that any time there's better calling into the VA and time to somebody calling into the IRS anytime. There's somebody hitting or interfacing with the government to make that experience not what it used to be, right? And the citizen engagement initiatives that have been launched. I think for the most part, have been fairly successful. The other part I see is the federal employee right? The federal employee him or herself is not what it was pre-pandemic and automating the workspace, the future of work where people are using automation to improve, retain and recruit, right? Federal employees is a big thing, right? Because it's -- folks have realized that they don't have to sit in traffic for 1.5 hours, right, to do their job, they can do it from kind of wherever. It's nice to get together, right? I mean, it's wonderful to be out in public and have pants on and all of the above, but it's certainly nice not to be sitting traffic for 1.5 hours every day.

Very good. Brian?

I'd like to automate the clearance process, so governments... This is what takes so long to bring staff on. But you talk to different federal departments on a daily basis. I've got a couple of pilots right now with about 25 agencies because we keep hearing the same things over and over, and over. We really need automation because there's just way too much information out there for us to consume them. So in my field of expertise right now, which is supply chain risk management. There really is a very shallow pool of subject matter experts out there in this area. And because that pool is so shallow, we have to turn to automation to help us identify risks, reduce risk, be able to work with vendors on what we're finding out about their products or their companies be able to mitigate problems quicker, faster and communicate with other elements within our own organization. So they're made aware of these issues or these threats faster, but we're working on it.

Okay. I want to make sure we leave time for the questions I have a couple from the virtual audience. Folks on the room you have questions for our panelists. Yes, there's a microphone coming behind you. Just a second.

Yes. I wanted to ask a question. With the various products, vendors products coming out there promoting or marketing what works best here, what works best there. And you alluded to the simultaneous of manual analysis and automation. At what point do you -- can you validate the efficacy of the product that you own right now before you scrap it and use another product?

Is that for me?

Not me.

I'm not on that one.

So we have an office of strategic sourcing that we work very closely with. It helps us engage with the vendor community. So there's a whole process of VA. We do market research. We look at our current product stack. We will know some of the contracts coming due and to decide whether we think that's still a good fit or whether we need to, we always do market research even in that case and see if the market has changed since the last time the contract was put in place and then we'll do an evaluation of what that market -- once we do get the market research data in to look at what the next would be. So and one of the criteria that we use in terms from cloud-related product releases, whether it's FedRAMP certified or not. If it's not, it doesn't mean if we wouldn't consider a product, but it adds time to the process and we have to invest resources either potentially sponsor a FedRAMP certification or see if there are agencies in the process. That goes back to my question or my suggestion by getting better visibility to what's in flight because that would help us understand where the market is going to be in 6 to 12 months from now and help us plan. So it's a complex process, but we try to do our best in market research to kind of be evaluating what's out there and the best serve our veterans.

Here at the front table.

This question is for David about Check Point Software. A question for you is, what do you find most of your FedRAMP products coming from? Is it from the JAB? Or is it from an actual ATO that you're sponsoring yourself?

We try to rely on the JAB as much as possible. There's a few that we've sponsored. But for the most part, we try to leverage that opportunity there.

And the other David will get you in one second, if time allows that one of the questions that came in virtually is about, trying to figure out where to start on the automation process. And I think this question is from an agency, asking about like are there tools or resources to bring to bear on automating the FedRAMP process from the agency side because it is so time and labor intensive. So I realize we're not going to shut up particular products from the stage, but are their advice or people you would encourage this person to go talk to.

I would say you heard a couple of products mentioned for managing your ATO process and your controls. If you're not already doing that, that would be the first place to start. And then from there, build on that, I mean, I'm sure there are capabilities in those tools to help you do that, and that's where I start. You're not doing that, you really need to start there first.

Very good day. David we're going to give you a last light from question.

Following up on David's question and what I brought up earlier is the biggest challenge for a vendor is to find a sponsor. And I was just curious of your 2 organizations, whether or not you're still sponsoring manufacturers or products or like you said, you're primarily going to the ---------- job.

It's always a possibility that we would sponsor someone. We haven't shut that process down, but it's not our first choice. We prefer to find something that's already ATO just for speed has the certification already, right?

Do you find the process on -- on the agency side. Should you sponsor?

Well, it's -- I don't know how onerous it is in terms of there's obviously resources involved in the age, and then it also may affect our acquisition strategy, right? We may not be interested in using that product or have it in our road map. So but if we sponsor it, that then becomes a factor, right? So there's a lot of variables that come into play whether we decide a sponsor or not. And again, it's always easier just to take a certification off the shelf and use it.

I think we are going to leave it there. But if you have questions you didn't get, and you're here in the room, by all means trying to corner our panelist here at lot. Please join me in thanking them for great discussion. Analysts as a service. At our lunch break, we've got 30 minutes. There is food outside. Again, those of you who are virtual or on your own for your calories and caffeine. But we will pick things back up here at 12:35. Thank you very much.