Palo Alto Networks Inc (PANW) Q1 2021 Earnings Call Transcript

Good morning. And thank you for joining us on today’s conference call to discuss Palo Alto Networks’ Fiscal First Quarter 2021 Financial Results. I am Karen Fung, Senior Director of Investor Relations. This call is being broadcast live over the web and can be accessed on the Investors Section of our website at investors.paloaltonetworks.com. With me on today's call are Nikesh Arora, our Chairman and Chief Executive Officer; Luis Visoso, our Chief Financial Officer; and Lee Klarich, our Chief Product Officer. This morning, we issued a press release announcing our results for the fiscal first quarter ended October 31, 2020. If you would like a copy of the release, you can access it online on our website. We would like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding the impact of COVID-19 on our business, our customers, the enterprise and cybersecurity industry and global economic conditions, our expectations related to financial guidance, operating metrics, and modeling claims for fiscal second quarter and full year, expenses, contribution to our fiscal 2021 ARR, our expectations regarding the timing of completing our acquisition of Expanse, our competitive position and the demand and opportunity for our products and subscriptions, benefits and timing of new products, features and subscription offerings, including those from our proposed acquisition of Expanse, as well as other financial and operating trends. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today. You should not rely on them as representing our views in the future, and we undertake no obligation to update these statements after this call. For a more detailed description of factors that could cause actual results to differ, please refer to our annual report on Form 10-K filed with the SEC on September 22, 2020, and our earnings release posted a few minutes ago on our website and filed with the SEC on Form 8-K. Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges. For historical periods, we have provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the Investors section of our website located at investors.paloaltonetworks.com. And finally, once we have completed our formal remarks, we will be posting them to our Investor Relations website under the quarterly results section. We'd also like to inform you that we will be virtually participating in the Wells Fargo TMT Summit on December 1 and the Barclays Global TMT Conference on December 10. Please also see the Investors section of our website for additional information about conferences we may be participating in. And with that, I will turn the call over to Nikesh.

Tomorrow morning, we have our user conference starting. This is my tenth quarterly call at Palo Alto Networks. The one thing in common between the first and the tenth is that they were both 5 am calls. I finally feel that we're turning the corner on all that we've done over the last few years. We have a lot of interesting content for you on this call. In addition to sharing our first quarter results, we will discuss the financial impact of our proposed acquisition of Expanse. Since Luis joined us last quarter, he and I have had the privilege and opportunity to talk to many of you. And based on the feedback, we've come up with a more transparent approach to understanding our business. Hopefully, it gives you a better perspective on what we have been up to and a way to think about Palo Alto Networks 2.0. Over the last 7 months, I've been cautious about the pandemic, and our teams have continued to deliver and surprised me positively. I'm delighted to report that this is no longer a coincidence. Our customers are investing, our teams are executing, and our strategy of innovating in our firewall business and focusing on the next generation of products around cloud and AI in the industry is working. As you can see, we had a great start to fiscal year 2021 as we exceeded guidance across all metrics in Q1. Here are some of the highlights. We delivered strong billings of $1.08 billion, up 21% year-over-year, with strong growth across the board, driven by continued strength in Next-Generation Security or NGS. Billings grew at 53% year-over-year, and NGS ARR was $719 million. Revenue was up 23% to $946 million, driven by strength in our cloud-based subscription and support revenue businesses. Non-GAAP EPS was up from last year. EPS expansion was driven by revenue growth and operating expense leverage due to efficiencies we've seen across the industry from lower spending associated with travel and events due to COVID. Adjusted free cash flow margin was 53.4%. As mentioned last quarter, we expected a strong cash quarter following the record Q4 2020 billings. We think some of this will continue into the next quarter, but we expect this to normalize for the year around our full year guidance. This continued strength during the pandemic makes me cautiously optimistic about the future prospects of the business. While we expect the winter will test all of our collective resolve with COVID, the worst-case scenarios are unlikely to unfold, and we expect our customers to continue to invest in technology. I also feel that the strategic bets we made a few years ago are right for our customers in the current environment. Against that backdrop, I feel comfortable raising guidance for the full fiscal year even before including the contribution of our proposed acquisition of Expanse, which we announced last week. For fiscal 2021, at the midpoint, we expect total billings growth of 19%, up 300 basis points from our prior guidance. Total revenue growth of 20% to 21%, also up 300 basis points from our prior guidance. Next Generation Security ARR to be approximately $1.15 billion, up 77% year-over-year. We also expect non-GAAP operating adjusted free cash flow expansion up from our prior guidance to be flat year-over-year. Subject to close, this includes a benefit from Expanse of approximately 100 basis points of billings growth, 50 basis points of revenue growth, and $77 million in ARR. We will absorb Expanse’s operating expenses within the framework of our guidance. Let me now highlight some key innovations launched in Q1 and the very positive customer traction, starting with our Firewall business. We continue to drive innovation within our Firewall business. We recently extended our new enterprise DLP solution to integrate with our complete Firewall platform. Our DLP offering is a cloud-delivered service that is powerful, simple to deploy, and protects sensitive data where our customers store data, whether in the cloud, on-premises, or through a flexible approach. This launch increased our number of potential attached subscriptions to eight from four just two years ago. We also introduced an innovative joint solution with our VMCs, virtual firewall and AWS Gateway Load Balancer. Our engineering-level partnership with AWS enabled us to launch this capability, significantly simplifying deployment, improving the scale and performance, and reducing the total cost of ownership for our VMC customers. Going forward, we will continue to provide leading innovation to our customers. One example of this is the upcoming launch of our new 5G native security offering. Our unique approach to 5G security includes being the first to introduce 5G network slice security and 5G context-driven security, all in a containerized solution matching the preferred architecture of 5G. This not only allows mobile operators to secure their 5G infrastructure but also enables them to launch value-added security services to their growing enterprise customers who are leveraging 5G for various new use cases. As a result of our efforts to drive innovation, our firewall business continues to receive industry accolades. I'm excited to share that Palo Alto Networks has again been crowned as a leader in Gartner's Magic Quadrant for Network Firewalls. This is the ninth consecutive time we have achieved this status in the Magic Quadrant. Once again, we achieved the highest and furthest overall position in the Magic Quadrant for our ability to execute and our completeness of vision. Not only was our strength in next-generation firewall product capability recognized, but our services like DLP and our cloud security focus were noted as trends as well. In Q1, we were also recognized as the leader in The Forrester Wave™: Zero Trust eXtended Ecosystem Platform Providers report, noting that we have assembled a robust portfolio that delivers zero trust everywhere, on-premises in the data center, and in the cloud. Our strategy in the firewall space is working as Firewall as a Platform grew billings by 16% in Q1 2021, and we added approximately 2,000 more customers for a total of 71,000 next-generation firewall customers. Our software next-generation firewalls, VM-Series, and CN-Series continue to gain momentum as well, with over 10,000 customers using our software firewalls. Moving on to our SASE or secure access service edge solution, Prisma Access, and CloudGenix, as SD-WAN has become the primary WAN architecture, organizations are demanding solutions that improve user experience while being simpler to deploy and manage. In the quarter, we introduced a number of new additions to our next-generation SD-WAN solution, CloudGenix. This included new AML-based capabilities to enhance our AI Ops approach and further simplified network operations. We also delivered the first CloudGenix and Prisma Access integration which enables cloud-delivered brand security in just a few clicks. In addition to the Gartner Magic Quadrants for network firewalls, Palo Alto Networks’ CloudGenix SD-WAN was recognized as a leader in the 2020 Gartner Magic Quadrant for WAN Edge Infrastructure. For many of our customers, COVID accelerated digital transformation timelines, and we continue to see conversion and remote access trials, together with a very strong pipeline generation. We now have more than 1,000 Prisma SASE customers, more than double from a year ago. To highlight a deal from the quarter, we won a seven-figure SD-WAN deal with a U.S. retailer who had been a Palo Alto Networks customer for a number of years and was an early adopter of Prisma Access. The success we had with Prisma Access and the strong integration with CloudGenix was a winning combination. Switching to Prisma Cloud. Prisma Cloud is very well positioned for sustainable growth as it is at the heart of the global shift to cloud computing. In Q1 2021, we launched Prisma Cloud 2.0, introducing four new modules to enable customers to easily and rapidly extend their cloud security coverage in a number of critical areas, all within a single cloud-native security platform. These modules include data security, which discovers and protects cloud storage data at a scale and velocity common in public cloud environments, addressing one of the most common data exposure issues in cloud transformation. Additionally, we have web application and API security, which protects web applications from attacks. Our approach addresses the challenges of deployment, complexity, and scalability by leveraging the same agent as our container and host security, making it very easy and horizontally scalable. We launched identity-based micro-segmentation with the integration of Aporeto technology, enabling zero trust security for cloud applications with a cloud-native identity-based approach. Lastly, IAM Security allows security teams to gain visibility into effective cloud identity permissions, user activity, implement governance, and respond to issues. While these modules were only recently introduced, we are excited about the strong customer interest we’re seeing. Prisma Cloud now serves 20% of the Global 2000 companies, 70% of the Fortune 100 companies, and secures 1.8 billion cloud resources. This customer momentum is up from the 14% of Global 2000 companies reported last quarter, and up significantly from the 43% of Fortune 100 we reported two quarters ago. We're also seeing a substantial increase in Prisma Cloud customers utilizing both cloud security posture management and cloud workload protection for containers and serverless applications, now at 45%, up from one-third reported last quarter. Highlighting the benefits of our consumption model, we won a high seven-figure deal with a leading technology company to use Prisma Cloud for CSBM for AWS and cloud workload protection. This customer has quickly consumed the workloads purchased, and we are working with them to support the expansion to new clouds and new workloads. Moving to Cortex. Cortex is on its way to being the industry's first proactive security platform, collecting data across multiple security data sources, applying machine learning techniques to detect sophisticated threats before they have a chance to succeed, and fully automating response for known threats. We've seen incredible benefits for customers who adopted Cortex, with some experiencing up to a 50x reduction in alerts, and others automating over one million incidents per day. Based on telemetry, we can see that we have recently passed the mark of 400 million actions automated, up 100% in just four months. As a result, we're winning with customers who share our vision, including 34% of the Global 2000 and 65% of Fortune 100. We continue to drive product innovation in Cortex XDR. Our recent XDR 2.5 release includes many new capabilities that have enabled us to catch up in a number of various leading EDR products. For example, we've introduced host insights, our first add-on module for XDR, which provides vulnerability assessment, application visibility, and our new search and destroy feature. To our knowledge, we are the first EDR product to offer the search and destroy capability, significantly speeding up security response, and eliminating the need for additional endpoint agents. This might be a good time to highlight a customer we recently acquired. We won a seven-figure deal with a company that had a small SecOps team managing multiple point products generating too many alerts with too few resources to investigate every alert, leaving them exposed to advanced threats. Being able to quickly investigate alerts and identify and remediate threats was a critical requirement for them. Their existing EDR product was disjointed from the rest of the security infrastructure, making it difficult and time-consuming to correlate data, while simultaneously consuming a large portion of their annual budget with little ROI. We demonstrated how the Cortex platform could automate and streamline security operations, allowing them to consolidate multiple products, including the SIM into Cortex. We showed them how Cortex would help transform their SecOps team by automating routine processes and reducing alert volume by over 95%, allowing them to focus on the critical threats. In Q1, we also launched the XSOAR Marketplace, which opened up the platform to both our partners and customers. We now have over 500 content bags available to customers to enable automation for security solutions. Additionally, we see engagement and momentum within our partner ecosystem, with contributions and use cases ranging from insider threats to cloud security and threat intel management. The last deal I want to share with you is a Fortune 500 diversified financial services company. Before implementing Cortex XSOAR, this customer received over one billion threat alerts per week. This was completely overwhelming their security operations team, leading to a state where alerts were often disregarded, creating a significant security gap. By leveraging XSOAR and XSOAR threat intel management, they took full control of threat information by aggregating disparate information sources, automatically customizing and scoring feeds, matching indicators against their environment, and leveraging playbook automation to drive interaction. This combination dramatically reduced the number of threat alerts they received by more than 99%, creating a significantly more secure environment. Moving quickly to Expanse, last week, we announced our intent to acquire Expanse and discussed how they fit within our overall vision for Cortex. Expanse has dedicated itself to developing an internet collection and attribution platform that constantly monitors the global internet. They map the exposed and untracked assets of an enterprise, comprising its attack surface. This data provides organizations with a crucial picture from the outside, meaning the same view that an attacker sees when hunting for potential weaknesses. Their technology is trusted by some of the world's largest and most complex organizations, including members of the Fortune 500 and the U.S. military. With our user conference Ignite kicking off in a little over 24 hours, we're excited to share that outside-in view with our customers. We will work with Expanse to offer all CIOs and CISOs attending an Expanse Exec Report, which provides a vulnerability map and immediate insights into the complete attack surface, risks, and suspicious activity for customers. This serves as an outstanding lead generation tool for our sales teams to hit the ground running once we close the transaction. Expanse’s transaction multiples are very favorable compared to other companies of equivalent size and even more so when adjusting for growth. Now moving to the financials. As stated on our call last week, we expect Expanse to contribute $67 million of ARR to our current fiscal year ending July 2021, continuing its 100% growth momentum. With Palo Alto Networks and subject to close, we expect Expanse to contribute $73 million of ARR in FY 2021. Assuming a mid-to-late Q2 close, we expect Expanse billings to contribute approximately 100 basis points to our overall growth for FY 2021. Adjusting for purchase accounting, we expect Expanse revenue to contribute about 50 basis points to our overall revenue for FY 2021. I know you may have concerns about our M&A strategy, perhaps because the inorganic impact or P&L is hard to forecast using new models. But if you look at the $2.7 billion of acquisitions we've made since 2019, they contribute approximately 15% to our forecasted FY 2021 billings. Very large enterprise companies have been built by successful M&A strategies. Good M&A strategies require ensuring that the products are easy to integrate, that they're what customers want, and that we at Palo Alto Networks can significantly change the trajectory. We believe our ability to acquire, integrate, and leverage our go-to-market strategies for acquisitions is a strategic competitive advantage, and we expect to continue to be opportunistic in increasing our long-term growth strategy. As I mentioned earlier, Luis and I have spent considerable time with all of you, and you've highlighted that you love our business. Some of you have questions regarding our firewall business being under pressure, while others wanted more transparency on our gross margins, and some of you have requested more visibility around ARR, eventually wanting to understand how to put it all together. Well, we heard you. It has taken a herculean effort to share our quarterly results in the shortest period we've ever done this, but also to deliver detailed reports on two categories, just to show that our business is doing extremely well. Let's take a look. Over the last quarters, we've discussed our total performance at Palo Alto Networks and provided details for next-generation security and firewall as a platform. We wished that the firewall as a platform metric would show how we're continuing to gain market share in the firewall space. The challenge has been that we did not provide anything below that number. We've decided that the best way to address our concerns is to show you the pro forma P&L around Firewall as a Platform and demonstrate that it enjoys strong margins, which are higher quality businesses as we are transforming our hardware business into software and subscription business. We like this shift as software revenue is higher quality and increases revenue visibility. Our next-generation security business, which has been the thrust of our innovation over the last two years, has been highlighted to illustrate how we're building a bigger and better business faster than anyone else in next-generation security. Next-generation security offers a perspective on our fast-growing SaaS business on a billings basis, NGS is nearly a quarter of total billings, up from 8% in FY 2018. NGS ARR closed Q1 at $719 million, up from $651 million in Q4 2020, and up from $568 million in Q3 2020. To provide a better understanding of our business, we've reorganized a few elements. For our firewall as a platform business, we added related subscriptions, support, and professional services, which we call network security. We removed the software firewall from NGS so that the two areas can be cohesive. We call this combined offering cloud & AI. With that context, we've prepared the recast of our full-year guidance, which I've just raised across both categories. Let's take a closer look at network security. Our network security business, on a standalone basis, remains the largest firewall business in the industry by revenue. It enjoys double-digit growth due to transformation towards software forms. Our success with VMs, Prisma SASE, and increased subscription attachment enables us to rely less on hardware and enhances revenue visibility. We feel confident that these growth rates are robust and sustainable. Our gross margins and operating margins are extremely healthy. The gross margin was slightly less than where it could be due to our SASE gross margins, which, given the early stage of that product, scale relative to firewalls, has slightly lower margins. As we scale our SASE business and the new subscriptions we have launched, we expect these margins to improve over the next few years. Needless to say, these numbers speak for themselves. On a standalone basis, this will be a very valuable network security business. As noted, our firewall business has the largest industry-leading financials and we're undergoing a transformation. We will continue to invest in this transformation. Palo Alto Networks has already transformed into a highly ratable business, but the ratable revenue as a percentage of total revenue has increased from 59% two years ago to 71% in Q1 2021. Now, onto Cloud & AI. This story has just begun. If you ask every CIO about the two trends that excite them, they will point out the transition to the cloud and the impact of AI. However, there's no transformation without secure transformation. I believe we have put to rest any questions about whether customers would get their cloud security solely from the CSPs, given that 70% of the Fortune 100 are served by us. I see this as our opportunity to build upon. We are singularly focused on improving our platform to meet our customers' needs. On the AI front, we're in the second iteration of this trend. The first trend involved data collection with attempts to correlate it for security. The next trend, which we're poised to capture, is the normalization of data to reduce the signal-to-noise ratio and improve the security posture using AI-based practices in security through Cortex. We have organized our financials for our Cloud & AI security category. This business, which we began building two years ago, is gaining traction as we ensure it evolves into a SaaS and ARR business. We expect ARR for Cloud & AI to grow by 89% year-over-year in FY 2021. Even when excluding the Expanse contribution, we expect the growth to reach 71% year-over-year. While the gross margins appear lower in FY 2021 compared to FY 2020, partially due to Crypsis integration, we expect this business to continue to improve gross margins year-over-year and significantly enhance margins over the next three to four years. Operating margins will naturally improve as ratable revenue is recognized from the balance sheet to the P&L. We believe there's a considerable opportunity in Cloud & AI, representing the next $100 billion TAM in security. That said, we will continue to invest aggressively in this business. In summary, if you put it all together, we have two excellent businesses performing as we'd like them to. In conclusion, we had a fantastic fiscal quarter across the board. As a result, we are raising our fiscal 2021 guidance. We've been building two businesses at Palo Alto Networks. Our Network Security business is the largest Firewall player, enjoying sustained gross margins and operating margins. Meanwhile, we have a fast-growing Cloud & AI business where we anticipate FY 2010 on ARR of 89% year-over-year growth. Lastly, I want to provide a brief update on what we call FLEXWORK. I emphasized at the beginning the continued resilience of our employees during COVID-19. We are supporting each employee with our FLEXWORK approach, a series of initiatives that provide employees with greater choice as they adapt to the challenges this year in areas ranging from work location, benefits, to learning, all underpinned by how we lead and communicate with compassion and authenticity. We continue to advance this approach through Q1. We launched the first phase of FLEX benefits, providing our employees with an additional $1,000 allowance for the year to choose from a wide range of wellbeing and childcare options. We rolled out the first module of FLEX learn, an individualized learning path designed for our sales teams, leaders, and managers to support them as they work and lead remotely. We’re delighted to see our FLEXWORK approach gaining traction beyond Palo Alto Networks. Last month, we introduced FLEXWORK at Zoomtopia, and invited other companies to engage in open-source discussions and share case studies and learnings. Over 600 attendees expressed interest in the work. Simultaneously, the CEOs from Uber, Box, Splunk, and Zoom joined me in announcing the FLEXWORK coalition, a community of leaders collaborating to develop and share best practices as we focus on the future of work. We collectively agree that the pandemic has highlighted opportunities for meaningful workplace change. I look forward to ongoing conversations with these leaders about accelerating new work practices that prioritize our employees. With that, I will turn the call over to Luis.

Thank you, Nikesh, and good morning to everyone. Before I start, I'd like to note that, except for revenue and billings, all financial figures are non-GAAP, and growth rates are compared to prior year periods unless stated otherwise. As Nikesh indicated, we had a great first quarter as we continue delivering winning innovation and adding new customers. This strength gives us confidence to raise our guidance for the year. In Q1, total revenue grew 23% to $946 million. Looking at growth by geography, the Americas grew 27%, EMEA grew 16%, and APAC grew 11%. Q1 product revenue of $237 million increased 3% compared to the prior year. Q1 subscription revenue of $428 million increased 34%. Support revenue of $281 million increased 26%. In total, subscription and support revenue of $709 million increased 31% and accounted for 75% of total revenue. Turning to billings, Q1 total billings of $1.083 billion, net of acquired deferred revenue, increased 21%. Strength was broad-based as we continue to see strong execution across the company. The dollar-weighted contract duration for new subscriptions and support billings in the quarter was up slightly, remaining at approximately three years. Total deferred revenue at the end of Q1 was $3.9 billion, an increase of 31% year-over-year. Remaining Performance Obligation (RPO) was $4.4 billion, up 40% year-over-year. In addition to adding approximately 2,200 new customers in the quarter, we continue to increase our wallet share with existing customers. Our top 25 customers, 24 of whom made a purchase this quarter, spend a minimum of $57.2 million in lifetime value through the end of fiscal Q1 2021, a 37% increase over $41.7 million in the comparable prior year period. Q1 gross margin was 75.8%, down 80 basis points compared to last year, mainly driven by a higher mix of our NGS products, which are less mature. Q1 operating margin was 21.7%, an increase of 590 basis points year-over-year. The operating margin expansion is driven by operating expense leverage as we benefit from lower travel and event expenses due to COVID, which more than offset the incremental investments in headcount. We ended the first quarter with 8,376 employees, including 156 from Crypsis at the close of the acquisition. On a GAAP basis for the first quarter, net loss increased to $92.2 million, or $0.97 per basic and diluted share. Non-GAAP net income for the first quarter increased 51% to $158.1 million, or $1.62 per diluted share. Our non-GAAP effective tax rate for Q1 was 22%. Turning to cash flow and balance sheet items, we finished October with cash, cash equivalents, and investments totaling $4.1 billion. During the first quarter, we repurchased $500 million or 2.1 million shares of common stock at an average price of approximately $242 per share. We have returned $2.7 billion to shareholders since Q1 2017 through share repurchase programs, including ASR where we repurchased 15.1 million shares of common stock at an average price of approximately $179 per share. Q1 cash flow from operations totaling $535 million, increased 138% year-over-year. Free cash flow was $505 million, up 184%, with a margin of 53.4%. As we mentioned last quarter, this was driven by strong cash collections following record billings in Q4 2020. DSO was 81 days, an increase of 18 days from the prior year period. We expect another strong collections quarter in Q2, which should bring our DSO down to historical levels. Turning now to guidance and modeling points. For the second fiscal quarter of 2021, we expect billings to be in the range of $1.17 billion to $1.19 billion, representing an increase of 17% to 19% year-over-year. We expect revenue to be in the range of $975 million to $990 million, reflecting an increase of 19% to 21% year-over-year. We anticipate non-GAAP EPS to be in the range of $1.42 to $1.44 using 98 million to 100 million shares. Additionally, I would like to provide some modeling points. We expect our Q2 non-GAAP effective tax rate to remain at 22%. CapEx in Q2 will be approximately $30 million to $35 million. As Nikesh reviewed earlier, for the full fiscal year 2021, we are raising our guidance across all metrics. We anticipate billings to be in the range of $5.08 billion to $5.13 billion, reflecting an increase of 18% to 19% year-over-year. We expect next-generation security ARR to reach approximately $1.15 billion, increasing 77% year-over-year. We anticipate revenue to be in the range of $4.09 billion to $4.14 billion, up over 20% year-over-year. We expect flat year-over-year product revenue. We anticipate operating margins to improve by 50 basis points year-over-year. We expect non-GAAP EPS to be in the range of $5.70 to $5.80 using 99 million to 101 million shares. Regarding free cash flow, for the full year, we expect an adjusted free flow margin of approximately 29%. With that, I’d like to open the call for questions.

In the interest of time, please limit Q&A to one question. Our first question comes from Walter Pritchard from Citigroup.

Hi, thanks. Can you hear me?

Yes. Hey, Walter.

Alright. Great. Thanks. So I guess you've seen really strong customer ads around Cortex and Prisma, and I think your Global 2000 Fortune 500 penetration is pretty strong here. Can you talk about where you are in terms of standardization amongst some of those clients and how you think about revenue from those products around up-sells versus new customers going forward?

Look, we have a different answer for both of them. As you know, our Cortex XDR platform is only about two quarters old, and we're delighted that we're crossing 1,000 customers in that category. We continue to see opportunity in penetrating both our existing customer base and new customers as far as XDR is concerned. We keep launching more capabilities in our XDR platform, moving from normalizing data across endpoints and firewalls to more and more data sources. With the combination of Expanse, we think that's a very powerful proposition. We believe that in the future, it's no longer just about aggregating data and throwing it into a large data lake for analytics; it's about being able to normalize the data. I believe we are still early in the transformation of data and AI-based security around Cortex, and we have a long runway ahead of us. In terms of Prisma Cloud, it's fascinating; we highlighted an example in the call where a customer estimated how much workload and capacity they needed in the cloud as they navigated through it in a quarter. We think throughout time, this will happen to all cloud customers because it's interesting. The gap between how much people have moved to the cloud versus how much is still ahead of them is substantial. It took us two years to move to the cloud, ramping up to 70% of the capacity of our data centers. So we believe most customers are still early in their adoption journey. Some are further along, but most are in the early stages or perhaps the first or second innings of a ramp. We expect a long runway ahead for the cloud. Thus, we're focused on acquiring customers and landing customers. That's why we continue to share that 70% of Fortune 100 or 20% of Global 2000 because the more customers we have, we expect their consumption to keep growing. Hence, we have a consumption-based model for most of our products now since the more they consume, we expect recurring revenues to follow. Does this give you a better sense?

Yes, thank you.

Our next question comes from Keith Weiss from Morgan Stanley. Keith, I think you might be on mute.

Are you back asleep? I know it was a long call, Keith, but not that long.

We will move on to the next caller, Sterling Auty from JPMorgan. Then we'll move back to Keith afterward.

Thanks, guys. Thank you very much for the additional disclosures; it's incredibly helpful. I just want to ensure I understand how you have guided for total product revenue to improve to flat year-over-year. However, I'm curious about the impact you're seeing from SD-WAN and other areas that might provide further improvement in that product growth rate as we move through the year?

Sterling, we include the SD-WAN revenues mostly in our Prisma SASE product, which is part of the overall firewall as a platform billing. You will see the impact of SD-WAN in our firewall as a platform billings number. We're continuing to see strength in the SD-WAN category as well as the entire SASE category I mentioned. Most remote work transformations and network transitions are still in progress. Our customers are recognizing that they need to migrate their network infrastructure to a more SD-WAN style setup and will probably need to sustain significant capacity for remote work for longer than initially anticipated.

But I thought with the two products, one of them was on Box. I wasn't sure whether that would be able to provide some additional pull-through for some extra product growth as we move through the year?

Even that on Box SD-WAN subscription is part of our subscriptions number, which again shows up in the FY billings number. In this new left-hand side, we just showed you.

Understood. Thank you.

No problem.

We will try this again. The next question comes from Keith Weiss from Morgan Stanley.

Good morning, Mr. Weiss.

Good morning. Can you hear me now?

Yes.

Yes.

Excellent. Thank you for taking the question, bearing with me and my technical difficulties. Very nice quarter. I loved the expansion disclosure; I think it's really good overall business perspective. I wanted to focus a bit more on the firewall side. I think it’s going to surprise guys as both the growth in the overall customer base, which I think was up 8,000 year-over-year, and overall billings growth in that business. Can you talk us through one, kind of where the customers are coming from, how you guys are expanding your overall firewall base? And two, what are some growth vectors we should consider moving forward? Where are we in terms of subscriptions per customer? How far can that go looking ahead? How much of a mix are we seeing with virtual versus physical and how much further that could take up your spending per customer?

The best way to think about it is that the software side of that business continues to see strong growth. The SASE pieces, Prisma access pieces, the SD-WAN capability and CloudGenix are also where we capture our subscription growth. Our subscriptions have grown from four to eight. We've launched the LP, which is generating considerable interest from our existing customers. IoT, while still in its early stages, is also receiving lots of attention from our customer base. SD-WAN typically forms part of a larger SD-WAN infrastructure deal where they enable the SD-WAN capability in the firewall, and then they will also purchase pure SD-WAN with CloudGenix since the architectures integrate. We expect most of the growth to come from the software side of the house. The VMs have surpassed 10,000 customers. We've seen a lot of interest and activity there in the VM space. As we highlighted, we've launched the 5G capability, which is unique in the industry. We are returning to our service provider partners and showing them what they need to get 5G done right and support their customers leveraging 5G use cases. So we expect a significant portion of the growth to come from the software side. The hardware customers are mostly refresh and some are existing customers. Occasionally, we witness hardware wins as part of an overall platform deal where companies want to deploy the complete Palo Alto architecture across their infrastructure. Thus, hardware growth is notably slower than software, especially in the current environment.

Got it. Excellent. Super helpful. Thank you guys.

Our next question comes from Fatima Boolani from UBS.

Good morning. Thank you for taking the questions. Can you hear me?

Just for you, because you didn't believe that we were growing a business on the other side.

I could see that. Thank you for that. I'll keep it short. Nikesh, can you put on your mix hat for a second? Into fiscal 2021, you're going to have an even bigger portfolio than you did in fiscal 2020. I'm wondering if you can speak to, or at least quantify the extent to which enterprise adoption agreements or enterprise licensing style agreements are becoming a bigger part of your overall sales motion, particularly as you look to drive more next-gen solution adoption activity?

The enterprise agreements typically kick in stronger in renewals than in the first phases of our deals. Much of the original business comes on a product by product basis until we reach a scale where customers feel it makes more sense to consolidate everything. Rarely do we see someone walk in and say, 'I want to do a $20 million or $30 million deal.' Instead, we see incremental deals where customers get one product, enjoy it, then proceed to acquire the next set of products. We've seen this happening repeatedly over the last two to two and a half years during my tenure. We expect enterprise agreements will continue to be significant, but they typically occur at renewal times. We have reasonably good visibility regarding which customers are up for renewal, making it an appropriate time to discuss enterprise agreements. However, our teams understand that you cannot renew someone and simply categorize it as an enterprise agreement. There must be a substantial amount of upsell and deployment of new products into the customer base before qualifying for enterprise agreement status. And this hat is a little smaller. I tried wearing it on the weekend.

Our next question comes from Jonathan Ho from William Blair.

Hi, good morning. Congratulations on the strong results. I just wanted to start by understanding how the integration with CloudGenix is progressing and what the initial customer feedback has been regarding the combined products. Thank you.

I'll let my colleague Lee Klarich respond to that question since he's been actively engaged.

Thank you, Nikesh, and good question, Jonathan. In the SD-WAN space, while it certainly offers a lot of value to customers, the implementation process can be clunky, and deployment can be difficult. With CloudGenix, we believe we've addressed many of those challenges. Further, the integration with Prisma Access allows us to deliver cloud networking integrated with that offering. As Nikesh stated earlier, we recently introduced a deployment feature with essentially one-click integration. This combination resonated well with customers, and we see it as the future architecture for connecting branch offices and remote sites to a broader cloud network while enhancing security and tackling deployment challenges.

Our next question comes from Brian Essex from Goldman Sachs.

Hey, good morning, and thank you for the question. The additional metrics surrounding NGS are appreciated. Investors have been awaiting that for a while. Maybe, Nikesh or Luis, how should we conceive two things: first, the progression of gross margin, is that resulting from delivery on cloud infrastructure? Second, seasonality; I noticed that billings were seasonal this quarter, which is similar to the larger business. How should we interpret that moving forward?

To your second question, we will always experience a little bit of seasonality, with Q4 traditionally being stronger than Q1. In terms of gross margin, we have strong plans in place. As Nikesh mentioned, we expect to achieve competitive gross margins over the next few years. We're committed to implementing efficiencies in our cloud and AI business, so, expect improvement here over time.

Is that primarily on the infrastructure side, or is there something else affecting those margins?

As I mentioned during the last call, the two largest influences on gross margins are our cloud infrastructure pieces. We're actively working on both within Luis's team, trying to reduce those costs. We have a clear path toward achieving these savings, providing confidence as we state that we're comfortable predicting significant gross margin improvements over the next two or three years. While those costs rise, revenues are ratably recognized, leading us to experience a natural progression in the right direction.

Understood, thank you.

Our next question comes from Philip Winslow from Wells Fargo.

Great, thanks for taking the question. The disclosures are really helpful. From what I've seen in this latest quarter regarding Prisma Cloud, are you noticing an inflection point regarding customer adoption regarding compute security, and could you share insights about your evaluations?

As mentioned previously, early cloud adoption by enterprises was often 'lift and shift'—simply moving applications from data centers to the cloud without re-architecting or leveraging cloud benefits. More mature companies are adopting a cloud-native approach, which increasingly utilizes containerized security architectures and patterns. Interestingly, this trend is also making its way back to on-premises configurations. As enterprises adopt containerized designs, our Prisma Cloud compute security functionalities are increasingly vital. That offering, which stems from our acquisition of Twistlock about a year and a half ago, remains best-in-class. We're committed to investing in it and consistently receive positive customer feedback.

Great, thanks team. Keep up the great work.

Thanks, Philip.

Thanks.

Our next question comes from Gray Powell from BTIG.

Great. Can you hear me okay?

Yes.

I want to revisit an earlier question on the core Firewall side. How should we assess the growth of attached subscriptions in that segment? I’ve observed a rise in core firewall subscriptions, yet product revenue growth is flattening. How should we evaluate these two dynamics?

They shouldn't net against each other, as we believe the newly added four subscriptions should be applicable to most of our customers. The majority of our customers still don't have them. The DNS Security, which we discussed last quarter, has seen penetration of over 5% or 6% of our base, so we anticipate a good runway for the new subscriptions to penetrate our base of over 70,000 firewall customers. Product revenue may appear flat, but our install base continues to increase due to one-time sales. Each sale is generally to new customers, which establish a recurring revenue model over time. Although the product revenue might be stable, our installations are rising, which is clear from the 8,000 new customers we've gained year-over-year. Many are potential candidates for subscriptions that may be attached. Additionally, those customers, while slowing product revenue, also deploy Prisma SASE or Prisma Access, which allows new subscription potential. These subscriptions apply not only to the 70,000 hardware customers but to a substantial part of the 10,000 software virtual firewall customers or 1,000 Prisma SASE customers.

Got it. That's really helpful. Did you mention DNS is already at 5% to 6% penetration considering that it’s only been on the market for about a year?

Around 18 months. Yes, I'd say that we reported 3,000 last quarter, which my calculations suggest is approximately...

Your math is good.

My math is good in the morning.

Alright, thanks.

Just want to confirm, 5% is accurate.

Next question comes from Andy Nowinski from D.A. Davidson.

Great. Thank you, and congrats on a good start to fiscal 2021. At a high level question, given the thousands of new customers added this quarter, I'm curious about the percentage that started solely with your Cloud AI products. Did most customers initiate with network security products? I want to better understand what is driving new logo growth.

My CFO will not let me disclose the exact number of new cloud AI customers. However, a significant portion of Fortune 100 and Global 2000 have shown no interest in hardware products because they are cloud-based entities in transformation. We're observing numerous new customers who are Prisma Cloud clients that have no need for a firewall, as many don't possess substantial data centers; they have cloud presences instead. With the eight modules we provide in Prisma Cloud, they are increasingly finding interest in our platform. Many of our customers in the defense and financial services sectors, where we haven’t had a strong presence, are showing newfound interest in both the cloud transformation and data collection capabilities, including Cortex XDR and, hopefully, Expanse in the future. We're engaging with a new set of customers that we couldn't address previously with the hardware capabilities.

Thanks Nikesh.

You're welcome.

This question comes from Saket Kalia from Barclays.

Okay. Hey, good morning. Can you hear me okay?

Yes, Saket. How are you?

Okay. Excellent. Good. Nikesh, how are you? Luis, regarding profitability, I believe the operating margin guide for fiscal 2021 is trending upward slightly. I presume this factor incorporates the Expanse cost base. Did I get that right? More strategically, looking at the long term for the cloud and AI business, who do you consider as your benchmarks for long-term profitability?

Yes, to your first question, our margin guide is indeed increasing year-over-year. Therefore, we're raising our guidance on the margin, so you are correct. We're factoring in our fiscal year margin alongside Expanse, which we’ve offset. We benchmark ourselves against the industry's best-performing companies regarding profitability. We believe it's reasonable to achieve those margins as we scale and deliver the savings we previously mentioned. Our gross margins from our cloud infrastructure and cost management will ultimately help achieve that core profitability.

Yes, Saket. Just to clarify, our firewall business is as strong as any other firewall business in the industry because I've received inquiries about how the firewall segment remains under pressure due to our overall gross margins fluctuating, which it does not. I want to emphasize that although achieving $735 million with a 100% growth rate in just 18 months is quite difficult, we are building that alongside continuing to focus on the firewall business. While overall gross margins and operating margins may seem slightly outside our complete control as management, we aim to show the areas where we are investing, driving ARR growth by sizable double digits for the long term. Your inquiry emphasizes the need to invest across both sectors, even if the level of investment is not equivalent. Prisma SASE is a new product category within our firewall division and I assure you within two years, whenever you look back, you will appreciate our success in transforming our business from hardware reliance to software and subscription.

Very helpful. Thanks, guys.

Cool.

Our next question comes from Patrick Colville from Deutsche Bank.

Hey there, thanks again for the new disclosure. I suspect it will resonate with others. It's clearly a strong quarter with a host of positive metrics here. One that stood out to me was the increase in Prisma Cloud. Understanding customer adoption, compute security is critical as we become focused on it, with customer insights regarding the evolution of cloud security strategy. Can you elaborate? Thank you.

We are eager to develop a portfolio that stands out in cloud-based security. To that end, we expect positive movements to stem from recent enhancements we've introduced.

We await the positive impact from transitioning organizations to cloud-native architectures and mindsets, as well as the collaborative opportunities that leading our customers toward effective security strategies entails.

Our next question comes from Rob Owens from Piper Sandler.

Good morning, and thank you for taking my question. Since you’re one of the first to report for the October quarter, I was curious if you could provide a broader view of growth internationally? Domestic numbers seemed strong, but growth rates in the rest of the world declined versus the prior half or quarter. Could you clarify what's influencing this on year-over-year trends?

There's a varied impact globally given how markets are navigating the pandemic. We see diverse results. For example, various parts of Asia are doing well. In Europe, early in the quarter, we managed acceptable results, but since the second half, it’s become harder due to recent lockdowns. We'll likely witness distinct impacts across the board compared to performance months before. Just keeping in mind, as you know, these deals often unfold over several months, not days. As a whole, while Europe had seen acceptable early-cycle performance, the U.S. maintains strong performance. The upcoming winter season will likely test us all. However, we believe that the groundwork laid out by our teams will help us endure these challenges over the next few months as we continue investing internationally.

Alright, thank you.

Our next question comes from Gregg Moskowitz from Mizuho Securities.

Okay, thank you for taking the question. Nikesh, regarding your next-gen security transparency and growth, can you provide insight into one or two NGS products that haven’t yet contributed significantly, but which you think could soon move the needle on growth?

NGS products are encompassing Prisma SASE and NGS. Prisma Access is showing strong traction, driven primarily from its installation and continued deployment momentum. In prior quarters, we saw Prisma Access as GPCS not having enough traction; now that has changed, and we are observing outstanding performance. The pandemic response has played a role in our success and is causing customers to select comprehensive solutions instead of fragmented ones. Conversely, Prisma Cloud, while experiencing the peak of its landing phase for Adoption Month, will continue to expand its footprint as customers evolve and heighten their cloud investments with our modules. As for Cortex XDR, its performance is a direct comparison against established XDR vendors like Cylance and Crowdstrike, among others. We’re seeing solid traction due to our substantial customer base for our existing traps, coupled with our XSOAR, which is now the largest security automation platform. We believe that the combination of Expanse, XDR, and XSOAR presents considerable future potential. However, this growth primarily pertains to fiscal 2022. In fiscal 2021, our focus will remain on Prisma Access and Prisma SASE, and we expect their ongoing success.

The next question comes from Tal Liani from Bank of America. I don't think we have Tal. So I'll move on to our last question, which will come from Brent Thill from Jefferies.

Thank you, Nikesh. Regarding your go-to-market strategies this year, could you detail any alterations made to approach? Is the strategy substantially similar to last year?

Brent, I appreciate the question. In terms of evolution, the previous few years initiated a fierce kick towards recognizing the need for NGS while aiming for a significant target of $1 billion ARR by the end of this fiscal year. I believe we succeeded in that aspect, even while causing concerns within our product scope. We normalized that approach last year, leading to leveling out billings between NGS and products. More so, we strategically allocated resources within our cloud AI team to directly drive ACV and ARR. Coordinated within our Network Security segment, we focused on driving TCV. You may encounter slight variances aligning with changes in billing versus ARR. This initiative can be clearly observed as we outline the left-hand side focused on detailed reporting, operating margins, and revenue, while the right-hand side revolves around ARR, which we expect to generate substantial growth. By focusing on each team’s purpose within their respective business models, we aim for enhanced visibility and improved consumption growth.

Thank you.

That concludes the Q&A portion of our call. Thank you all for your questions. I'm going to turn it back to Nikesh for closing remarks.

Thank you, Karen, and everyone that's dialed in today. I want to take a moment to acknowledge the hard work of Luis and our finance teams. This was a challenging close to achieve, especially with just ten days before our user conference. Based on your feedback, we spent a lot of time with auditors and others to ensure that we were able to share the splits to enhance transparency. I hope you found the disclosures instructive. We are building two great businesses at Palo Alto Networks and will continue focusing on creating value across both segments. We will keep seeking the best practices for increasing transparency and see if it makes sense in the long term to continue with these updates more regularly. I wish you and your families a safe and happy Thanksgiving next week. Looking forward to seeing many of you in the coming weeks at our investor conferences. I will be speaking with some of you shortly after. A final shout-out goes to our Palo Alto Networks family; our employees, customers, and our entire ecosystem. Thank you very much, everyone. Go Palo Alto Networks.