Elastic N.V. (ESTC) June 4, 2026 Conference Transcript

Let's get this started. My name is Koji Ikeda. I am one of the software analysts here at Bank of America. I'm thrilled to be hosting a fireside chat with Elastic. We've got Ken Exner, Chief Product Officer, and Eric Pringle, Global Vice President of Finance. So thanks so much for being here, guys. Before getting into product, and I do want to get technical with you, Ken. I'm thrilled to have you here because I want to talk about the technical side of Elastic. Eric, maybe first questions over to you. You guys reported results last week. It was a busy day on reported earnings that day. Lots of companies reporting. And so maybe just give us a high-level overview of what happened in that quarter. And I think most importantly, the guidance methodology as you're thinking about the next fiscal year.

Yeah. So we were really excited about the quarter. We saw CRPO grow 20% and RPO grew 28%. On a constant currency basis, CRPO increased five points growth from the prior quarter. So tremendous momentum. It was really a testament to the bookings that we're seeing and the strength in the product that Ken and his team put together where we're able to really win in the field. I think there have been a lot of people asking, oh, well, is any of this inflated? Is there some sort of thing that's going on where you have more discounting or something And the answer is no. This is truly the business performing. And so we were really happy about that. That was tremendously positive. One thing that did happen in our quarter is that there was a shift in the mix a little bit more towards cloud. And because there's an upfront rev rec component to self-manage, that took a little bit out of revenue. So think about there being a one-point headwind to revenue based on that, coupled with a little bit of FX. But overall, very positive quarter in terms of the commitments, a record quarter over the last couple of years in terms of the growth and commitments. So we were really happy around that. We also gave guidance for FY27. We initiated our FY27 guidance. And the way to think about our FY27 guidance, a couple of things. So we guided to a full year of 14.5% growth, which is actually acceleration from the Q1 guide. So we think that we're going to see the trajectory of the business accelerate nicely on a quarter to quarter basis, which is very exciting. And we're comfortable with the guide based on what our CRPO is and what that means in terms of how much we have to go get that's not already committed. So we feel really comfortable about that. And in terms of the guidance philosophy, I would just say that it continues to be, we want to put forward a guide that we feel comfortable that we can hit, that we feel confident that, you know, the business has plenty to execute against to get to that guidance. So we feel good about everything on the guide side.

On that point in the shift mix to cloud, one point, Edwin, can we dive into that a little bit more? Is that really around, hey, when you gave that fourth quarter guide the first time you thought, this amount's going to go to cloud, this amount's self-managed, and it turned out a little bit differently? Or was it bigger customers that decided to change their allocation between cloud and self-managed?

I'd say it was the former, but with a little mix of the latter. So the biggest thing for us was we won this CISA SIM as a service deal where we're providing security SIM to the U.S. public sector, the civilian agencies there through CISA. And so we've actually seen a much better uptake of that than we'd even expected. And so there were certain government customers who historically had been consuming us through self-managed, and some of them shifted over to the cloud when they did deals with us in Q4. And so that SysSIM as a service deal really drove an increase in the cloud portion of our business, which we were really happy to see. It's all going to come to us as revenue. It's just that the timing of the revenue recognition moved around a little bit.

Eric, I hate to put you on the spot, but FedRAMP, do you know exactly where you are, FedRAMP certification on the cloud side?

I believe that we got certified.

Yeah, we're fully certified.

Yeah, fully certified, and it's up as of last month. Okay, okay. Yeah, okay.

So I guess the key message here.

FedRAMP high. Yeah, we were FedRAMP moderate, and now we've got FedRAMP high.

So I think the key message here on the guide is look at CRPO as an indication of what's giving you that confidence in the CRPO.

I think that's the right way to think about it. Okay, okay. And one other thing besides CRPO I think it's worth noting because it's something that we've put a lot of effort into across fiscal 26 is field capacity. And so call it seven, two years ago in Q125, there were some execution issues. Since then, Mark Dodds has done a tremendous job of really getting the go-to-market motion on track. And because of the success that we're seeing in the go-to-market and the productivity that we've seen in our field force, we've actually started to invest a lot more in capacity. And so over the last 12 months, we've been putting more AEs into the field. and in Q4 we saw that was part of the reason we saw success in Q4 and that gives us a lot of confidence going into FY27 just given the capacity and productivity that we need to drive the business we feel very good about that.

Maybe on the question on kind of go to market with Mr. Dodds and really considering you just finished your fourth quarter and so good time to make any sort of strategy shifts for the next fiscal year anything we should be thinking about on any sort of account reallocation or any sort of geographic reallocation or anything on the go-to-market side?

No, nothing in terms of account reallocation, geographic reallocation, nothing in terms of sales compensation. We feel very happy with how our go-to-market functioned across fiscal 27. You can particularly see that in Q4. And based on the way the team is executing, we don't need to change the go-to-market. We just need more of it. And that's why we're adding capacity to the business.

Ken. Go, G. Let's talk Elastic technically, but I do want to start high-level first. And so it is a very technical product. Customers buy you for the technical benefits and the differentiation in there. But maybe just taking a huge step back, what is Elastic and why do customers buy you?

What is Elastic? That's a big question. The company started as an open-source search engine, Elasticsearch, which is one of the most popular open-source projects of all time. So I think it's the most popular Java open source project. So it's used by millions of developers. Initially, people used it as a search engine to power search within their applications. People started realizing that you could use it as a development platform. So people started using it to build matchmaking sites and ride-sharing sites and using it to build signal intelligence systems, things like that. A couple of the most common use cases were people using it for log analytics and observability to search through logs, to search through metrics, and also people started using it for threat hunting, also searching through logs and security event data to do security threat hunting. So over the years, we evolved into sort of three businesses, one around the search business, which these days is really about powering AI-based search. The observability business, which was taking a lot of what people were doing, using us as a log analytics platform and searching through metrics and traces and other things, and making a more out-of-the-box experience there. And then finally, on the search side, this is partly the newest, but growing incredibly fast. People were using us as a SIEM or as a security analytics platform. And then we've been expanding beyond that to sort of the adjacent spaces and security space. So those are the three core businesses, the search, which is these days, you know, AI, powering AI search or powering AI applications, not just human users, usages of search, but also observability and security.

Let's tackle each one of those opportunities one by one. You know, AI search or search, AI, we'll combine those two. Observability and security. And so when customers are coming to you, let's start with security. So when customers are coming to you and saying, hey, Elastic, help me with my security problem, what is that problem and how do you help solve it?

Well, the core of this is we became very popular for threat hunting. People would use us to search through logs and security event information, looking for that needle in a haystack, trying to figure out if there was an intrusion, trying to figure out what happened and trying to correlate it across different signals across their business. We package that up as a SIEM product, and this happened a few years ago. And this is the core land motion for us, which is we are the SIEM for most of these SOCs, security operation centers, that they use for that core threat hunting. But we also do some of the adjacencies. So we expand it into endpoint protection. We expand it into cloud security. We expand it into entity analytics and SOAR, to some of the adjacent spaces. But the core of the product is the SIEM application, which is a security events information system that people use for threat hunting. I will also say that these days, everyone in the security space talks about sort of an agentic SOC, which is taking a lot of the activities that these security analysts do and turning it into sort of agentic workflows that allow them to respond more quickly. We've been a leader there, sort of turning this security operations center, which is built around the SIEM, into a fully agentic security operations center. So these days, people talk about it as sort of using AI to automate the tasks of a security professional. You have to, you know, people are creating attacks using AI, so you have to kind of respond with the speed of AI as well.

And then same question on the observability side. What are they coming to you for?

The core of the business was always in logs, which is, you know, people were using this as the elk stack, as people used to refer to it as, became the most common solution for logs, continues to be a big part of our business, but we expanded into the adjacencies as well. We expanded into metrics, expanded into tracing, expanded into synthetic monitoring and ROM, a bunch of the different areas. So today, we're a complete observability solution. I will say that we've spent a lot of time over the last year trying to become a really great metric solution. And I view this more as an opportunity for us to expand. Even without investing a lot in metrics and infrastructure monitoring, we've had decent pickup and adoption, but logs has always been the core of our business. I'm very confident about our ability to win and go on the attack in terms of metrics because we've done a bunch of performance and efficiency work. We're now 30 times faster than Prometheus-based systems. We're 2.5 times faster than Prometheus-based systems, two times faster than ClickHouse or more efficient than ClickHouse. So we've done a lot of work to be a really highly performant and highly efficient metric store in addition to being a highly performant and efficient log store as well.

Can I add something there? So I think it's just good to note for everyone that, you know, logs is the primary portion of observability in which we play. And I think that if you look at the market growth, metrics and infrastructure monitoring has probably been the fastest growing part of that market. And so for us to be able to be much stronger in that market, more competitive, which we relaunched our product in fiscal 27 at SCO. we got on stage and talked about the tremendous strength in the change that we've made in the product, I think that presents us with a huge opportunity for our observability business to really be reinvigorated and go to the next level with those metrics capabilities. So it's something that the field is super excited about. It's something that the team is super excited about. And I think it's a really big opportunity for Elastic and FY27.

Yeah. We also now natively support Prometheus data and PromQL. So if you're using a system like Refana that is Prometheus based, you don't have to change anything. You swap out the backend and suddenly it's cheaper and faster, which is really, you don't have to change any of your dashboards. It's just, it's immediately cheaper, immediately faster.

So maybe a good question for you, Ken, thinking you're the chief product officer. And so the strategic move to invest more into metrics infrastructure monitoring, Was that a recognition of, hey, there's a pretty good opportunity here, we should go for it? Or were there customers saying, we need more because we want to use you guys for this?

It was both. One, it was, as Eric mentioned, metrics or infrastructure monitoring has been the fastest growing part of the observability space. And it's not one that we had focused a lot on. Even despite not focusing a lot on the space, we still had customers starting to use us for metrics workloads. And this is because we're seeing a bit of consolidation happening. People are wanting to use the same tools for metrics and tracing and observability and logs. So some customers were pushing us because they were wanting to consolidate tools, but we also saw it as a big opportunity for us to grow the business. I would say it's both. of both of those.

Ken, when you're out there talking with customers, I think one of the things we often debate with observability and security is that they're two different buyers. When you're out there talking with customers, are you still talking with two different buyers for your products, or are you beginning to sit at the same table as either one person talking about both or having both parties in the room at the same time?

The most common is it's different, but if it if it's a business that is trying to save money through consolidation, it tends to go up to the CIO. So oftentimes for consolidation plays, it's going to be at a more executive level, and that's usually the same buyer. Oftentimes CISOs or the SRE team and the InfoSec team report up to a CIO eventually. But they tend to be different buyers, but we're still able to use the accounts to move laterally. Like one of our most common plays right now is talking to our existing search users and getting them to consider us for security or for observability. And they just make the introductions to their CISO, and their CISO often already knows us because their security analysts are already using us in an open source form, and we're able to turn them into a security customer in addition to search.

How does the conversation go with customers that choose you for observability and security traditionally, but the natural progression is how do we use agentic capabilities within observability and security, and you guys can power that? What does that conversation look like with customers?

So in the security space, everyone's kind of talking about the agentic SOC. So there's a lot of curiosity about what it means. and we're able to actually show it in the product on top of real data and it's not just sort of this theoretical thing or not just a good demo. So usually in the security space what we do is we show it and we actually let them use it and there's kind of this it's gone from this theoretical or this marketing hype to something actually very real. I remember when we introduced Attack Discovery which was, this is one of the very first uses of agentic AI in security. We introduced this at RSA like a year and a half ago. And it kind of blew people's minds because what we were doing is we were processing all the alerts that come in and automatically figuring out which ones were false positives, which ones were real, which ones were correlated. And we're able to map this to the MITRE attack chain and basically show customers the entire attack path. Now, for security analysts that sifts through hundreds of these alerts a day trying to figure out which ones to pay attention to or not, we've just taken that work and just done it in a minute and showed them this is what you need to care about. And when we had these conversations, these analysts would start to cry or they would tear up. They were like, you've taken all the drudgery away from my work and gotten me to a point where I can actually fight the issues. I can actually act on these things. So when you show them how real this is, it's quite empowering. We were always worried that people might react to it as taking away their work, but it was actually quite the opposite. It's the drudgery that allows them to actually feel more effective because they're kind of buried in what they're doing right now. They're buried in drudgery. And the same thing on the SRE side. They're buried in drudgery. They're getting woken up in the middle of the night. They spend the first half hour, hour trying to figure out what the hell is going on. Why are they getting paged in the middle of the night? And if we can immediately show them this is what the issue is, this is what you need to investigate. These are the potential ways to remediate this. Again, they beam because you've taken that drudgery away from them.

I think what's really interesting and attractive for Elastic and customers is having a cloud solution and a self-managed solution. And so help me understand why having that both options is important. And then also how you guys think about driving innovation between those two products. Is it parity for the two products? Is one more important than the other? Or is one catching up to the other? How do you guys think about innovation between the two?

So this is a huge differentiator for us. We are open source. We have a core product that's open source. We have self-manage, meaning you can run it yourself on-prem or on your own AWS or GCP accounts, wherever you want. We have customers that run us on Battleships, run us on Humvees. You can run it wherever you want. We also have two different versions of our cloud offering. We have a hosted, which is sort of a single-tenant version of our self-manage that we manage for you on all three cloud providers. And then we have the serverless offering, which is kind of a pure SaaS version, which is on a modern serverless architecture. So we offer it multiple ways across all three major CSPs, across more than 60 regions, across GovClouds, FedRAMP Moderate, FedRAMP High. We're working on OWL 5 right now. So lots of different ways to consume the software. I think the other thing that makes this a little bit different is that these are not forks. We try to maintain for the core system together, which allows us to always lead with serverless, but eventually make things back into the other ways we offer the software too. So the promise we make our customers is that we will always launch things first in serverless, but we try to always make sure that we make them available for on-prem as well. And it's important, especially for our public sector customers, where they may be completely air-gapped, they may be on battleships, as I said, they need to know that they're going to have a great security product, or they're going to have a great observability product, and they're not crippled because of their environment.

Speaking of forks...

Sorry, I'll say one other thing. The other reason I think this is important is that it allows us to be where the data is. and this is important because think about observability like each of the cloud providers has their own observability solution despite that we have a very vibrant observability industry that works across these different cloud vendors because it allows them to create a common interface to those different systems but it can also be where the data is so in terms of our search business we don't have to you don't have to move your data into AWS because that's where your vector database is. You can have your vector database be wherever your data is. So there's two advantages to being wherever a customer is. One is you can provide a single interface across all the different, you know, wherever their data is. And you can be wherever, if they are in GCP or on-prem, you can have your Elastic Cluster or your Elastic Deployment there.

So Fork, there is a hyperscaler out there with the forked version of you guys. I don't hear about it that much when I'm talking to customers and partners out there. I'm curious from your seat and when you're out there talking with customers, does that forked version come up at all anymore?

It does if you're an AWS customer. So if you're an AWS customer, they bring it up because for an AWS customer, it's there, it's easy for them to use it. And they try to attack us and try to say their pitch is essentially it's the same thing. It's the same product. And we often have to sort of combat that and explain that it's not. It's a fork, and it's one that's not been maintained very well, and we have to talk about how we are significantly more performant, more efficient. And then they run the benchmarks and actually see that we actually are quite a bit cheaper in terms of the total cost because of the investments we continue to make in efficiency, the investments we continue to make in performance. But we have to combat that flood. But it's usually only with AWS customers.

So Elasticsearch has been around for a long time. And when we peel back Elasticsearch, it is based off Apache Lucene. And I've always wanted to ask you, Ken, how do you guys make it easy, or maybe it's not easy, to switch between different versions of databases, vector databases, solutions, search solutions, that at the very, very core are Lucene-based?

Switch between different...

If someone wanted to come to you and they're using some other Lucene.

The interfaces are completely different. So Lucene is the core search. We are the primary maintainers and contributors to Lucene. So people often view it as one and the same thing. With us, we're 90-plus percent, 95% of Lucene. Contributors and contributions, We chair the Lucene open source project. Others can use that as a core engine in whatever other implementation they have, but the interfaces are different. The implementation is different, so you can't very easily change. So if you have a system like MongoDB that also uses, it doesn't mean you can change. Okay, okay.

So I wanted to ask kind of the bull debate on you guys. And AI is a demand accelerator. And so Ken may be a question, or Eric, a question for both of you is, what are you seeing out there that's giving you the confidence that AI is going to be a long-term driver for you guys and an accelerator of growth for you guys?

I'll start. I like to look at it two ways. One is we're a foundational part of the Gen AI and the Gentic AI tech stack. And this is people using this as a retrieval system as part of their context engineering environment. And then we're also using all of these same tools ourselves to power our observability and security solutions. Both of those are important growth drivers for us. On the search side, as I mentioned, search has become something that doesn't power human interfaces anymore. It's powering agentic experiences. So people are using search as a retrieval system for passing data to an LLM or an agent. And this begins with us as a vector database, but includes a bunch of different retrieval techniques around that and a bunch of the supporting ways to pass data to an LLM or agent. It's no longer just RAG or prompt engineering. It's helping people build MCP tools, building skills, different ways of exposing data to an agent or an LLM. And we provide sort of a complete context engineering platform that supports various different techniques and everything from embedding models to different retrieval techniques for very efficiently figuring out how to get data to an agent or an LLM. That is a huge growth driver for us. How do we continue to invest in that and be a core part of the modern agentic AI stack? The other part is we use these things ourselves and we get to use our own toys. And it's allowed us to move very fast in observability and security and to be leaders there in applying these to those use cases. So I mentioned before ATT&CK Discovery. We were actually the very first observability and security company to introduce AI assistants and copilots. This is more than three years ago. And we've continued sort of providing that leadership, constantly providing the leading capabilities for using agentic workflows within observability and security. And it's because we can use our own technologies and we can use our own tools. And that's actually enabled us to move faster than anyone else. This provides growth because suddenly now it's not just selling the platform. It's now we can monetize this through token usage. We can monetize this through workflow executions that we charge for. We can monetize this through conversation turns, different meters that span based on us using these tools for those agentic and AI experiences.

The one thing I'd add is I think that we're seeing tremendous momentum on the AI front in terms of the metrics that we have. So we reported 600 of our 100K plus customers are now using us for AI capabilities. That's a pretty big step up from the prior quarter. We talked at the Analyst Day in October around some of the expansion metrics associated with AI and some of the metrics around the traction that we're seeing there. And so it's not just something that's part of the talk track. It's actually genuinely supporting the business. And so across the board, we're really happy with what AI is doing for our business.

I wanted to ask a question on embedding models.

This one's going to be Ken.

I've spent a lot of time over the last week trying to figure out what exactly is an embedding model and what does it mean for certain companies.

Embedding model is how you vectorize data. So you take data, whether it's text or image or whatever, and you want to put it into a vector database, you need an embedding model. It's a way to turn text or whatever into vector coordinates that you put into a vector database that allows you to do similarity search. So it's a way to turn it into a couple plots of data that you can put into a vector database. And it needs to create those coordinates based on an understanding of similarity. So it needs to process the underlying data, understand what is similar, and then create these coordinates to plot into vector space. When people introduced vector databases, initially it was about text, taking text, and trying to create coordinates for a vector database that allows you to say that a cup and a glass are similar concepts. And you can plot those in approximate space in a vector database. People also use it for images and text and stuff. Actually, one of the things people pushed us for very early on, even before generative AI, is people wanted to do image search using Elasticsearch. And companies like Adobe were using us to do image search, even before generative AI. So we've been doing this for a while. The thing that's been happening more recently is sort of a race to multimodal embedding models where you can take a PDF document which might contain tables of data and text and images and stuff and be able to vectorize that entire thing or take a video or take audio. We recently introduced our Omni series of GINA AI models, which are multimodal, which allows us to handle any type of data. And we're very proud of this because it truly is multimodal. It handles audio, video, images, text, and everything using sort of vision model techniques. And it's sort of state-of-the-art in terms of multimodal. The other thing I'm very proud of is this one often people overlook, but it's really important if you're actually using these, is that we have some of the most efficient embedding models. So we introduced a new small and nano class of our embedding models, which rank right now in the top 10 of all embedding models, but they're super small. Compared to the rest of the top 10 of embedding models, it is, I think it was 14 to 50 times smaller than any of the other models, which directly translates into cost. So if you're using this, people are picking these because they're still highly performant in the top 10, but they're a fraction of the cost to run. So I geek out over efficiency, and that to me is almost as cool as multimodal. Interesting.

Sounds like something I need to dig in a little bit more on here. So we are all out of time. Ken, Eric, thank you so much for doing this. This has been a fun conversation. Thanks for having us. Thank you. Yeah, I mean, I literally spent, I spent like,