Check Point Software Technologies Ltd (CHKP) 2018 Q3 法說會逐字稿

Greetings, and welcome to the Check Point Software Third Quarter 2018 Earnings Conference Call.

(Operator Instructions) As a reminder, this conference is being recorded.

It is now my pleasure to introduce your host, Kip Meintzer, Head of Global Investor Relations.

Thank you.

You may begin.

Thank you.

I'd like to thank all of you for joining us today to discuss Check Point's Third Quarter 2018 Financial Results.

Joining me today, as always, on the call are Gil Shwed, Founder and CEO; along with our CFO and COO, Tal Payne.

As a reminder, this call is webcast live on our website and is recorded for replay.

To access the live webcast and replay information, please visit the company's website at checkpoint.com.

For your convenience, the conference call replay will be made available through October 31.

If you'd like to reach us after the call, please contact Investor Relations by e-mail at kip@checkpoint.com.

Before we begin with management's presentation, I'd like to highlight the following.

During the course of this presentation, Check Point representatives may make certain forward-looking statements.

These forward-looking statements within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities and Exchange Act of 1934, include, but are not limited to, statements related to Check Point's expectations regarding business, financial performance and customers, the introduction of new products and programs and the success of those products and programs, the environment for security threats and trends in the market, our strategy and focus areas, demand for our solutions, our expectations regarding the acquisition of Dome9 and its impact on our business and financial outlook, our business and financial outlook, including our guidance for Q4 2018.

Because these statements pertain to future events, they are subject to various risks and uncertainties.

Actual results could differ materially from Check Point's current expectations and beliefs.

Factors that could cause or contribute to such differences are contained in Check Point's earnings press release issued today, October 24, 2018, which is available on our website, and other factors and risks, including those discussed in Check Point's annual report on Form 20F for the year ended December 31, 2017, which is on file with the Securities and Exchange Commission.

Check Point assumes no obligation to update information concerning its expectations or beliefs except as required by law.

In our press release, which has been posted on our website, we present GAAP and non-GAAP results, along with the reconciliation of such results as well as the reasons for our presentation of non-GAAP information.

Now it's my pleasure to turn the call over to Tal Payne for a review of the financial results.

Thank you, Kip.

Good morning and good afternoon to everyone joining us on the call today.

I'm pleased to begin the review of the third quarter.

Revenues for the third quarter increased by 4% year-over-year to $471 million, and our non-GAAP EPS grew by 6% to $1.38, both towards the high end of our guidance.

Before proceeding further into the numbers, let me remind you that our GAAP financial results includes stock-based compensation charges, amortization of acquired intangible assets and acquisition-related expenses as well as the related tax effects.

Keep in mind that, as applicable, non-GAAP information is presented excluding these items.

Now let's take a look at the financial highlights for the quarter.

Product and security subscription revenues were $257 million.

Our security subscription revenues continued to be strong with 13% growth year-over-year, reaching $136 million.

Our software update and maintenance revenues increased to $213 million, representing 4% growth year-over-year.

Deferred revenues as of September 30, 2018, reached $1,148,000,000, a growth of $112 million or 11% over September 30, 2017.

Revenue distribution by geography for the quarter was as follows: 47% of revenues came from Americas; 37% of revenues came from Europe; and the remaining 16% came from Asia Pacific, Japan, Middle East and Africa regions.

From a deal size perspective, this quarter, we had 58 customers with transactions over $1 million.

This quarter, similar to last quarter, the total value of this transactions increased significantly.

Non-GAAP operating margin for the quarter was 53%, similar to the previous quarter.

We continue to invest in our sales force and marketing efforts.

The full effects of these will be reflected naturally in the next quarters.

Effective non-GAAP tax rate for this quarter was around 18%.

Our Q4 tax rate is expected to be lower at 10% to 12%, relating mainly to exploration of tax provisions at the end of the year.

GAAP net income for the third quarter of 2018 was $198 million or $1.25 per diluted share, an increase of 7% from the third quarter of 2017.

Non-GAAP net income for the quarter was $219 million or $1.38 per diluted share, an increase of 6% from the third quarter of 2017 and towards the top end of our guidance.

As the share price increased significantly during the quarter, the number of options included in the diluted outstanding shares increased.

Our cash balance continued to increase, reaching $4,072,000,000 as of September 30.

Operating cash flow was $249 million.

Collection from customers continues to be strong.

Our cash payments increased in line with our continuing investment in sales and marketing.

In July 2018, we approved an increase of our buyback program to $2 billion and with a quarterly amount that may vary, but will not exceed $325 million.

During the quarter, we purchased 2.6 million shares for $300 million at an average price of $113.

Now let's turn the call over for Gil for his comments.

Thank you, Tal, and hello, everyone, joining us today.

In the third quarter, we continued to see results that are better than our projection.

Overall, this is the second quarter we have seen improved trends in execution by our sales force.

We continued to focus on further improvement to the sales organization, and we'll continue to invest as we move forward.

At the end of July, we made important change in the leadership of our sales organization and appointed Dan Yerushalmi to be Chief Customer Officer.

Dan has been not only a tremendous sales leader in his past, but also a CIO of a major bank in his last position, making his experience very relevant to C-level interaction.

We continued to execute on our major initiatives, primarily around the Infinity architecture.

A recurring trend in the feedback we hear from our customers is that Infinity represents a truly differentiated approach to security.

Infinity accomplishes this by consolidating security and providing a universal platform encompassing the network, mobile and across the cloud, with a focus on the prevention of cyber attacks, rather than merely detecting them after the fact.

The pipeline for Infinity deals continues to build.

During the quarter, we closed some nice deals in a variety of industries, from midsized law firms and non-for-profit organization, all the way up to some of the world's largest financial institutions.

We've continued to build the breadth and depth of the Infinity platform.

In this quarter, we extended our mobile security offerings, introducing advanced threat prevention capabilities to mobile devices with the launch of SandBlast Mobile 3.0.

This makes our product unique by preventing mobile phishing attack on all apps, prevent browsing to malicious sites and blocks infected devices from leaking sensitive data to botnets who are accessing corporate data.

On the cloud front, we just went GA last quarter and launched our CloudGuard SaaS security solution to address security needs of Software as a Service cloud application, such as Office 365, Salesforce and ServiceNow.

With an entire industry of solution for SaaS security called CASB, where the focus is mainly on detecting the use of such cloud application and a little bit on user identification, CloudGuard SaaS is much more than a CASB.

It focuses on actually preventing malicious access, blocking malicious content within SaaS application, while also providing transparent and reliable user identification.

We already have more than 100 enterprises that have begun to utilize CloudGuard SaaS.

Today, we announced the further expansion of our cloud security offering with the acquisition of Dome9.

The acquisition bolsters our Infinity platform by extending the breadth of our cloud security offering.

One of the key challenges in public cloud environment is to ensure the enforcement of corporate security policies across all elements of the cloud infrastructure.

Dome9 addresses exactly that challenge.

It enforces the corporate security policies and manages all cloud assets accordingly.

It makes certain that all cloud servers are protected.

It verifies that cloud apps have the right security setting and manage the native cloud security features of AWS, Azure and the Google Cloud.

It does so while providing compliance with security best practices and company-specific guidelines.

These technologies also provide a broader market potential for us, with the ability to address non-Check Point environments by leveraging these technologies as a cloud service without the need for any on-premise software or hardware.

Dome9 aligns with our strategy to drive prevention and protection across the network, mobile and cloud environment.

Check Point is known for management capabilities, and Dome9 enable us to extend our superior management capabilities further into a cloud-centric environment.

The combination of Dome9, together with our CloudGuard IaaS and SandBlast products families, will enable us to expand our cloud security capabilities and provide multiple layers of security to cloud environment.

This will be accomplished with server automation and scaling tools that are critical in the cloud.

We evaluated many average technologies in this space and found Dome9 to be the most comprehensive, the one that delivers on the Check Point principle on enforcing security and providing true threat prevention, rather than just detection and reporting, like many of the other products we evaluated.

The acquisition closed today.

While we don't disclose the full terms of the transaction, the main effects you are going to see in our financial results in the next quarter will be in cash consideration of approximately $175 million that will be part of our Q4 cash flow.

It will not have a material effect on revenues and will reduce our non-GAAP EPS by approximately $0.02 to $0.04 a quarter and our GAAP EPS by approximately $0.07.

Now we would like to share our fourth quarter projections.

Overall, the third quarter produced good results.

I do believe that our growth potential is higher than what we have seen in the past few quarters, and we will continue to work on making that happen.

You know my regular caveat, the future is always hard to predict.

There are many -- there may be an upside and obviously, the potential for downside.

With that in mind, here are the fourth quarter projections that include the effect of the acquisition.

We expect revenues between $500 million and $528 million; non-GAAP EPS in the range of $1.56 to $1.67; GAAP EPS is expected to be approximately $0.20 lower than that.

Now we would like to open the call for your insightful questions and feedback on our strategy.

Thank you.

(Operator Instructions) Our first question is from Ben Zelnick (sic) [Brad Zelnick] with Crédit Suisse.

Brad Zelnick, Crédit Suisse.

It's good to see billings growth back in the business and returning to market levels, and congrats on Dome9.

Gil, on Dome9, can you just talk a bit about why now?

And as you think about integrating the offering into your management console, do you envision that this is going to be something seamless a year from now that we won't even notice was a separate entity?

And what does that take?

And then I've got a follow-up for Tal.

So first, I think now is a very good time to invest in the cloud, and use of cloud application is getting higher and higher.

I don't know if it's getting too mainstream, but definitely, almost every enterprise in the world is expanding to the cloud.

And when they do that, they also tighten up security, and I think security is becoming more important to them.

We've been working and looking at Dome9 for a long time, so this is not something that happened overnight.

And that's something that we've been doing for quite a long time.

I think the Dome9 capabilities are far better than anything else in the marketplace.

They're the only company in the space to have active protection, network security, threat detection and better capabilities in compliance, in multi-cloud environment than everything else we've seen.

So we are very happy to be working with them.

We've passed on several other companies that we looked a long time, and I think we are very fortunate that we've been able to pull this deal through.

And hopefully, we will be able to integrate it quite quickly.

All the Dome9 employees are now Check Point -- are now part of Check Point.

The deal is closed, so we are ready to act right now.

And it will probably take us a couple of months to integrate all the different departments and all the different -- and all the employees and provide the true Infinity cyber protection for Gen V attacks and strengthening the cloud, which I think is more and more important.

And just, Tal, in following up on the financial impact, it is -- I trust it's all subscription revenue.

Can you just confirm for us, were these annual subscriptions paid in advance?

Does it flow through to the balance sheet or just directly to the income statement on a consumption basis?

And is it fair to say that the business was doing roughly $25 million run rate?

And anything else that you can tell us, I appreciate the impact would be great.

No.

The run rate is not $25 million, it's less than $10 million, just to clarify.

That's why we said it's immaterial.

So you won't see an impact that is relevant from the revenue perspective in our size of company, so that's one comment.

And the fact that we talked about it's relevant mainly is the result of expenses.

We continue to invest in the company as well.

It's a very exciting area.

That's why the numbers, the range that we talked about is 2 point -- $0.02 to $0.04 on a non-GAAP and about $0.07 on the GAAP.

And it is a...

Got it.

And the $0.02 to $0.04 -- that's helpful.

And Tal, $0.02 to $0.04, I mean, were they burning that much cash?

Or do you intend to invest that much more in integrating the business?

No.

They have over 100 employees.

They are spending cash.

And it's an area that we would probably plan to expand as well.

Our next question is from Michael Turits with Raymond James.

First, Gil and Tal, can you talk about Dan Yerushalmi and what any changes might be in the strategic direction for what he'll be doing around sales, how you'll be improving and again, obviously how that's changed?

And then I'll just throw out my second question, too.

There are a lot of things taking place at a macro level in the world, obviously.

To any extent you feel like you can look out to '19, talk about how tariffs might impact you and any impact that other macro trends might have on security spending right now.

Dan and then macro.

Okay.

So first, in terms of the sales strategy, I think our sales strategy is the right strategy.

And so our strategy is not something that we change very often.

I think the main challenges that we have or the main opportunities that we have, depending on how you want to look at it, is execution.

We are focused on new customers.

We are focused on broader sale of our Infinity architecture, getting the higher level in the C-level in the organization.

Dan is -- he is putting a lot of emphasis on better working with our partners to bring the products to market.

And I think all these things that have been part of our strategy will continue.

And hopefully, we will do them in a better way.

So I don't think that there's a huge change in strategy.

It is -- I hope that there's going to be a change in the execution of this strategy.

Second one?

And the second part was relating to macro changes in what area?

Can you repeat the question?

Well, we just had a bad semiconductor report tonight.

People are concerned about tariffs.

So in general, general macro concern about next year and potential impact around tariffs.

How do you think they get -- if it does impact you guys specifically and anything you could say about the impact on the security market.

So when you talk about tariffs, it's nothing that we expect that will affect us.

In the macroeconomics, I would just say the general changes that you're familiar with, with the tax regulations in Europe and the tax regulation in the U.S., we're still waiting for the regulation to come out during Q4.

And based on that, we will see what do we believe is the effect on us.

Our next question is from John DiFucci with Jefferies.

Yes.

I have a question for Gil and then a follow-up for Tal.

Gil, for Dome9, I'm just trying to, in my mind anyway, figure out now what you have versus what you might need.

I read something that Dome9 even has some identity technology.

Is there anything here that, in the cloud area, that you would -- that you don't have, that you'd have to partner with others or that you wouldn't go into.

Normally, you haven't gone into the identity space either.

I think we're not going to be a provider of pure identity software.

We're going to connect that identity into making sure systems are locked.

And that's what we've been doing.

By the way, we've started that also in CloudGuard SaaS, our solution for SaaS.

We were having announced a little bit more of that in Dome9, but that's not our focus.

The main -- there are going to be more areas in the cloud that we will get into.

The cloud is a very broad environment, and there is much more layers in specific areas, which we can secure.

And both of our Gen V, and next year, our sixth next-generation of security will also focus on that.

But Dome9 is not just a feature.

Dome9, I think, is a platform that's very, very strategic to us because it does know how to manage security and enforce security in very large and very complicated and very heterogeneous cloud environment.

And that's critical because the cloud is not one entity that's simple to manage.

Actually, if you look at the AWS Cloud, there's probably around 300 different services.

And when you activate any service, you want to make sure that automatically, the security is applied to that service.

Otherwise, that service becomes unintentionally the backdoor to the company, to the enterprise data.

And I think that's part of what Dome9 has, a lot of automation to automatically set security policies on all the cloud, automatic detection when things go wrong and automatic remediation, which is even more important.

Because think about that, if somebody, if some operator tries to do some maintenance to, let's say, a storage server on the cloud, they leave something open, they go home.

Tomorrow morning, you might get an alert that you left your data open, but that's too late.

During the night, somebody might have stacked all your database.

Somebody that's using Dome9, for example, automatically, these permissions will be reset to the lock's permissions.

And whether you see the alert or not, it should be in a good state, which is one example of what Dome9 can do, but nobody else in that industry is doing right now.

Okay.

Okay.

And Tal, the results were better than we had been looking for anyway.

And the subscription growth actually accelerated a little bit, about the same growth.

But the product numbers are still coming down year-over-year.

And I'm just curious, is that more to do with sort of a transition to -- within the sales, it sort of pushed more the platform sales, the Infinity Total Protection type sales, the selling motion?

Or is it just customers are buying more subscription at this point?

And ITP is exciting, but it's still really early.

So I would say, in general, when we look long term, then it's obvious the industry is an industry that's moving to providing new product as a subscription.

So all the relevant product that we present, basically since 2010, is subscription mode, all of them additional layers.

Cloud is subscription.

Dome9 is subscription.

So it's clear that the new area -- mobile is subscription and so on.

So everything, most of the new things are subscription.

Having said that, product can and should be positive, and that's what we're talking about, continued improvement on the execution of their field.

Okay.

So we should hope or expect to start to see product not only to beat numbers, but actually turn positive at some point?

That's our goal, definitely.

Our next question is from Andrew Nowinski with Piper Jaffray.

All right.

Maybe just starting with the Americas.

Growth was strong, I think up 8% this quarter, which I think you hinted at last quarter as well.

Is that a reflection of share gains?

Or is that a seasonal contribution from the Fed, U.S. Fed, or just an overall improvement in the market that drove that growth?

No.

Just remember that revenues and bookings, not always in the same timing, right?

So revenue is a recognition over a period.

So it's not necessarily, you have accounting movement, VSOE and so on.

So in general, you're right.

We've seen America positive and Europe positive and AMA had a few large deals in the previous quarter in terms of revenue recognition.

So you see it actually in the, I think, in the small negative.

So it's not necessarily a mirror of the booking.

I would say that I think we did have some slightly better metrics in the U.S., and I'm very happy about that because we are focused on gaining share and on doing more things in the U.S., but we are far from over.

I think our potential in what we can and should do in the U.S. should be much better than what we are doing, and there's still a long road until we'll be here and say, we are getting everything that we need to from the U.S.

Okay.

Very good.

And then just one quick question on your long-term deferred.

It looks like it went up a little bit this quarter, and your duration also went up.

Is that just the factor or is that attributable to the Infinity sales plan as more customers move to that sales model?

Not necessarily.

Of course, Infinity has been affecting their long term, but it's not -- it's still not a big number that will affect it in that way.

Remember, the long term can be just a fact of support of subscription contract that's signed for over a year.

And then the over a year portion, in case it was invoiced, then you see it in the deferred long term.

But also short term was very healthy, with a growth, if I recall, of about 9% year-over-year.

So that was quite healthy as well.

And remember also that some of the bookings, you don't even see because it's accumulated on invoice.

Because some of the long-term deals, you issue an invoice only once a year, and that portion is not reflected in the deferred revenue.

Our next question is from Daniel Ives with Wedbush Securities.

I just -- can you maybe just talk about Infinity just in terms of what you're seeing in the field, in terms of how, maybe the conversations are changing from kicking the tires back to the deal flow?

And I'll just stop there, and there is a follow-up question.

I think, first, Infinity does raise the conversation to not just product transaction, but how people actually think about security architecture.

And in my mind, by the way, that's one of the key elements in building today's cybersecurity.

It's not refreshing this product or adding another product.

It's the overall thinking about how to prevent threats.

And that gives us much better opportunity to present our vision and to challenge our customers, and they challenge us about actually delivering that.

I think Infinity software is generating a very nice pipeline.

We're still closing only a small number of deals because it takes a very long time for a company to make a decision about their long-term commitment and about change of an architecture.

But we are seeing that change is starting to happen.

And as I've mentioned, it goes from midsized -- last quarter, we even had some small size, this quarter, it's more midsized, going all the way to very large corporations that are willing to subscribe to that and see the potential in that.

So I think long term, it should have a very good effect, both on our, what we call, Infinity sales, Infinity Total Protection, but also, on the general dialogue and opening doors with customers that might lead to other product deals that extend our footprint within a customer environment.

Okay.

And just lastly, how do you view the cloud opportunity?

I mean, you're a veteran of security, and you'd seen all different phases and facets.

How would you compare this maybe over the last decade versus other opportunities that some bear fruit, others didn't, in terms of this cloud and how real this opportunity is and how Check Point is positioned?

I think, first, predicting the future is always challenging.

But I do think that the cloud is more real than other things we've seen simply because enterprises are truly -- I mean, we see that unlike many trends in IT that some happened, some didn't happen, some remains very small, the cloud is already substantial.

Every company in the world is expressing interest in moving systems to the cloud.

There is a new generation of companies that it's called born to cloud that only have cloud environment.

And I think all of these are potential.

What will happen in 5, 10 years, it's really hard to predict.

It's really hard to predict if cloud sales will be a small percentage of the market, but still relevant, or the majority of the market.

And I think we'll know that in 10 years.

And for us, meanwhile, I think it's a quite substantial opportunity to get into.

Our next question is from Ken Talanian with Evercore ISI.

So I was wondering if you could give us a sense for how the deferred growth was driven between either subscription or maintenance?

I'm just trying to get a sense for what's driving that uptick.

So naturally, the deferred revenue, most of it is relating to, as you said, subscription and support.

I would say both have been healthy and pretty much in line with what you see in the P&L.

We had a very good booking in subscription as well.

So I would say, nothing abnormal.

They both grew, and they grew nicely.

Naturally, when you're talking about double-digit growth, then subscription is the only one that can do that.

Support is typically single digit, low single digit.

You can see it in the P&L since it's a renewal of your installed base support.

So majority of the growth is driven by subscription.

Great.

And I guess around the Infinity deals, could you give us a sense for the kind of uplift you might be seeing in some of the initial deals versus the prior run rate for some of these customers?

I think it's anything from 30% to 200%, depending on the customer and depending on how big they were and how much they are getting into that in the future.

But I think that's the range that we've seen it.

It's a wide range.

But in general, it's a quite substantial increase per customer.

But remember, it depends on what the customer had to start with, right?

So if it's a new customer, obviously -- or if it is an uplift.

If it's a customer that had only, let's say, firewall, and now we added the entire family, it will be a very significant increase.

And if he already had before, let's say, NGTX and threat prevention and threat extraction, then the lift will be smaller.

Our next question is from Gabriela Borges with Goldman Sachs.

Tal, you commented last quarter on off-balance-sheet bookings activity being particularly strong.

I know it's not something that you regularly comment on, so I wanted to ask a follow-up which is, how did that bookings activity compare this quarter versus last quarter for deals that may not necessarily sharpen the balance sheet?

So again, we don't report it.

But just so it doesn't look like I'm avoiding, I can tell you it increased this quarter as well.

But it's not an indication that I'm going to give just because remember, it can be very lumpy and depends on large transactions that are coming in that can be multiyear.

So we can look at the deferred revenues, you can see the growth there.

I think it's a reflection of the run rate, which is better than just the fluctuations in the booking.

That's helpful.

And a question for Gil, if I may.

Earlier comment on how it does take time to close Infinity Total Protect deals because it requires a change of architecture with the customer.

For your customers that are coming back to you and saying, "Thanks for presenting.

It's really interesting, but we're not interested right now.

We're going to buy on the old model." What are the reasons that they give you for that?

I think I don't know if that's the typical discussion this year.

The typical discussion and for us, one of the challenges, is actually how to grow higher in the organization and to present to people that see the broader picture in that regard.

And that's the opportunity with Infinity.

I don't see many cases the customers are saying, they are not -- we are not interested.

They might say, "You know, this is a project for next year.

We are, right now, not evaluating big changes, but this is good." In general, almost everything that we have with the customer was either, yes, we are getting on and let's start the process or continue the process, or let's evaluate and let's see how it would make sense to us.

But I think the real challenge for us is simply presenting it to enough customers.

When I'm presenting, the feedback that I'm getting from customers, they say, this is revolutionary.

This is all, by the way, feedback that I got from a group of customers that spent a week with us here last week, a customer delegation like that.

And their feedback was, it's fresh, it's new, nobody else is doing that.

The focus on prevention is unique to you.

This is all good feedback.

It still doesn't -- but unfortunately, it's from a very small list of customers that we're actually presenting it.

So that's why I'm saying that in terms of our execution, we need to learn how to take it to more places, and then we need to translate that interest level and that acknowledgment on the strategy to actual deals.

Our next question is from Walter Pritchard with Citi.

A question for Gil.

Just on product revenue, I'm wondering if there's areas of the world or territories within the world that are doing consistently better than the down 8 or 6 that you've had the last couple of quarters.

And I'm wondering what might be different about those areas as leading indicators of how your product revenue could get better as we look in the future quarters.

First, I think it's very nonuniform.

We have areas in the world or countries that are performing quite well for -- I mean, if I take 8 quarters, the 6 out of 8, they show great metrics.

And they might have one quarter that's lagging behind and vice versa.

So it's not that results are uniform.

As I said, when I look at some of these territories, the main element is field execution, it's focusing on new deals and on new customers.

And I think that's one of the things we need to expand and do better in our culture is how to approach more new customers and not just base our relationship about the existing customers with the existing relations with the existing customers.

And as a follow-up to that, do we -- I mean, just from a feet on the street perspective, if I look at sort of where your peers are spending, it just seems like you're spending quite a bit more from a sales and marketing perspective.

And I'm wondering, do -- is there a notion that just more feet need to go on the street?

Or is it an efficiency or retargeting the folks that you already have in the organization?

I think it's both.

I always believe that the way to work is work efficiently and work smart.

And if you build the right engine, it will have amazing results.

So my focus is on that.

Still, I think we are going to add more feet in the street because there is more potential and because that will allow us to access more opportunities and more segments.

So we will do both, and I think we'll keep doing that in a responsible manner.

Our next question is from Philip Winslow with Wells Fargo.

I just wanted to get some color on the pricing environment that you're seeing during the second half here.

Anything that you'd note, change-wise, whether it'd be just from competitors on, let's call it, the base product or any maybe the add-on subscriptions?

Just general color on sort competitive environment and pricing.

I think the environment is quite competitive.

There is price pressure.

We have few competitors that their focus is on low price.

And when they come to a deal, the prices are going down.

We have others that are focusing on other attributes, so the market remains competitive.

I haven't seen that it become more competitive in the last quarter, to put it in that perspective.

Tal, any...

And I would say, no, typically, when you're in a transaction that is large with many competitions that you see many competitors and large bids, and you see more competition, naturally.

Remember, that product discounts different from subscription, different from support, so it can vary, depends also on the mix on a specific order.

Got it.

And then just one follow-up for Gil from a previous question about the cloud.

I mean, if you believe that the world is going to be hybrid going forward and you're going to see workloads, both on premise and in the cloud, could you talk about just from, I'll call it a policy in management and sort of like the operations side of security, what do you guys discuss about sort of having a single pane across both cloud and on premise versus, let's say, using Check Point on premise and then, let's say, just a native product and, call it, a cloud vendor and having to maintain 2 policies?

What is your thought process?

What are you hearing from customers on that?

So look, that's an excellent question.

So first, I think customers are more and more worried.

So 2, 3 years back, customers didn't have very secure -- their whole security thinking was very siloed.

Customers more and more understand that the role of the CISO needs to be on overall security policy management, on overall security policy enforcement and that's a new trend.

Again, new, which happened in the last maybe 1 or 2 years, but something that is changing in the world.

In terms of managing the cloud, you're absolutely right.

There is an hybrid environment almost everywhere.

Today, we do have that advantage that from our smart center console, we can manage our cloud, guard the ops and have uniform management of whether your instance is a physical appliance or a virtual security gateway in the cloud.

Dome9 addresses exactly that.

Dome9 is exactly getting to the point of how do I manage multi cloud.

Our motivation here is to incorporate that into the Infinity architecture and give the customer a single pane of glass.

But it's not just a single pane of glass, it's really the uniform thinking about how I can know what's in the cloud is very important, to know what are your assets, to know what is changing to automatically provisioning and most importantly, to enforce that policy everywhere.

And I think that's exactly the value of Dome9.

And that's why we like them, and that's why it's worked for us doing that kind of deal.

Our next question is from Sterling Auty with JPMorgan.

So clearly, you saw a really good step-up in the execution in North America.

This is actually the first quarter that Europe has slowed down underneath the growth of North America.

Anything in particular that maybe caused some deceleration in Europe?

I think Tal indicated already that the revenues and the business trends that you are seeing underneath don't always correlate.

And Europe is actually doing quite fine, and we are pretty happy with the performance of Europe at this point.

Okay.

And then Gil, one trend that we're obviously seeing is the number of vendors in security plays into EDR, the endpoint detection response, and use of machine language to ingest a lot of data and then go out in either threat seek, threat hunt to protect their customers.

I'm curious that now that you're making with the Dome9 investment, is this another area that you think you're going to need to have a presence in, either through organic development or through acquisition?

First, I think that we do have some presence in that.

Our SandBlast agent for the endpoint does have many of these capabilities and does have amazing capabilities of EDR.

I think the strategy on that looking forward is quite challenging, not because there is no technologies around and not because we don't have good capabilities.

Actually, there was just a test now where we rated very, very high, far better than many vendors, both traditional vendors and new vendors, in terms of our endpoint security capabilities and especially these new ones.

We got -- I don't remember what was the score, but again, it was one of the highest in the industry.

But the challenge for me strategically, I'll share it openly, the endpoint market itself is very fragmented.

There are very large well-established vendors.

There are many tiny startups, and there are even companies now in the middle, in the hundreds of millions of dollars of revenues that are midsized companies, but are quite sizable in the high-tech world.

And the question is how to play in that game?

Can any vendor who can just have an endpoint that's good and get a real important market share in that?

And I think I do have a few ideas.

I won't share all the ideas.

I'll share the challenge and the strategic thinking.

In terms of ideas, yes, we have a product, and I think it's a great product.

We can also acquire more technologies, and there are a few interesting technologies that I've seen around.

It's really unclear to me what's the right play in that market and what's the right way to provide that overall security.

Currently, I must say, we're the only vendor that has everything connected and has the cloud, the endpoint, the mobile, the data center, the network, all connected in 1 platform.

And we do have it now, and we do have customers that are using it.

Our next question is from Jonathan Ho with William Blair.

I just wanted to maybe start out with the sales and marketing investments that you're talking about.

Can you maybe give us a sense of magnitude?

And maybe where you are making those investments in terms of what the sales force is asking for?

I think the investments are quite uniform and around the world.

Let's say, to take an example, this quarter, we had like 20 local conferences, which we call CPX.

We had one big CPX -- not 1, 3 big CPX in the regions of -- in Europe, in the Americas and in Asia.

At the beginning of the year, we call it CPX 360, then we roll it into a local program of local conferences.

This quarter, we had like 20 of them, and it is all around the world.

This quarter, it was actually more focused on North America, but again, we had a huge one in Singapore.

And, actually, just this week, we had a big one in Russia.

So I mean, it is all over, and I think the potential is all over.

In terms of sales investment, again, the potential is all over the world.

The potential -- there is a big potential, again, in the U.S., but I don't think that I can say that there is one area that is more important than the other.

In marketing expenses, there are spend on everything, on trade shows, on conference and so on.

In sales, the biggest investment is simply headcount.

That's the number 1 driving it, and that's, by the way, most of the spend that we have on sales and marketing.

Got it.

And then just as a follow-up, can you talk a little bit about whether you're seeing an impact from SSL traffic increases, either drive people to purchase larger boxes or potentially on installed base renewals, drive any type of up-sell?

Okay.

That's an excellent one.

And I think technically, SSL is a very challenging thing because more traffic is moving to SSL.

And we need to inspect that, and that requires much more horsepower.

So yes, we are seeing more demand for more performance and more computing power.

By the way, we came last quarter with a new model called the 23900, the high-end model, and that's exactly its positioning.

With more SSL traffic, you need more power to do more threat prevention.

And actually, it's going quite well in that regard.

I do believe, by the way, that the biggest differentiator is not just speed.

Our SSL, our new capabilities in our latest version of R80.20 on SSL are far better than the competition.

I don't want to go into the technicalities right now, but everybody is claiming to have SSL inspection.

We will show soon how can you -- how we are doing the checks in a much more rigid way and in a way that doesn't let anything go unlocked when if you're a malware developer, you can easily develop an SSL malware that will bypass our company's SSL simply because they say, yes, we have SSL, but it's easy to bypass their SSL security.

So these are things that we'll actually discuss in the last few weeks here internally that we can show the value of what we do.

And by the way, I'm amazed that every technology review that I'm doing through our people that they are working on the right stuff.

We are providing the right security.

And sometimes I am simply puzzled to see that a lot of the competition is very negligent on the level of security that they provide, and SSL was a perfect example from last week.

Our next question is from Erik Suppiger with JMP Securities.

Yes.

Two questions on Dome9.

First off, I think Dome9 was used in a lot of environments where they were not using a third-party firewall, be it Check Point or anybody else.

Is the strategy here to get into environments that are not using firewalls?

Or is the strategy to leverage Dome9 to bring Check Point into those environments and integrate Check Point into the broader security profile?

And then secondly, do you have any incentives to keep the management of Dome9 as part of the terms of the agreement?

I'll start from the second one, it's easy.

Yes, and I think -- by the way, in all the acquisitions, the recent acquisition that we've done, we've put incentives for management to stay.

And as far as I can say, they did stay.

I mean, unlike what we see in the industry and what I've seen in malware, I mean, historical path many years ago, here, in the last few acquisitions that we've done, the management stayed 3, 4 years and is working well.

So that's for the second part.

For the first part, I think you are right about the need for Dome9.

I think that we are able to get into environments that haven't been using advanced security like our CloudGuard IaaS or other gateways.

So Dome9 clearly lets us get into that environment and provide your management.

If you are not a Check Point customer, the value is there.

If you're a Check Point customer, it's easy to see why you have tools to manage your network security.

Right now, you need to have similar tools for the cloud, so Dome9 should be an easy decision to extend your control.

And once you have that, it's very easy to see with the visibility tool that here, I'm using, let's say, level 1 security, I want to go to level 5. And we can provide also the level 5 or the Gen V security.

We were advanced for its capabilities.

But I think we need to start from securing the environment when the cloud is getting -- and it is out of control in most enterprises today.

Our next question is from Fatima Boolani.

Tal, maybe to start with you.

I wanted to follow up on your comments around product growth and your confidence that going forward, this could and should stabilize and, in fact, grow.

Beyond focusing your execution and continuing to improve your execution, are there fundamental aspects that you see, that maybe we don't that is underpinning your confidence in the form of maybe better appliance shipments than we can see or you have better refresh opportunity within your installed base that we could see.

And a follow-up for Gil, if I may.

Yes.

Actually, I didn't say this, just to clarify.

I said that when you look in the long run, the more technologies that you have that are subscription and virtual and cloud and mobile, then actually, we'll see less products.

So I think in the long term, there is a trend that is clear that everything moving to -- a majority is moving to subscription.

Even when you look at Infinity, then the more people will buy Infinity, the more portion of the deal is going to subscription and support and less on the product because the entire bundle has much more layers of service-orientated portions versus the appliance and the products.

So long term, actually, I think it's not.

I was talking in the short term that once we continue and see the improvement and you can start to see the improvement on the execution, then I want to see also a growth in the product.

But long run, it's -- I don't know whether the industry will go there.

All right.

Fair enough.

Gil, just as a segue, just off that point, as Check Point endeavors to become essentially a security as a service provider with Infinity Total Protection, what implications does that have from how you manage and build out your infrastructure, because the onus of SLAs and delivery of the security service would be from you instead of the appliance that the customer would have to buy to enjoy the security subscriptions.

So some of the things that we're doing and some of the future architecture that we'll be speaking about will be like that.

We'll provide more and more cloud services.

We have been doing that for quite a few years in several areas, and we will expand that, like our sandboxing and threat emulation is done mostly on our cloud, and we've been doing it quite effectively.

And I think that's an area that we are building and growing and learning, and so far, it's working well.

I believe that we are serving almost 7,000 customers today with security capabilities that we supply from the cloud.

Today it's in hybrid environment, eventually some of this might become not hybrid, but full cloud.

I think -- but for the foreseeable future, it will all be in the hybrid environment in that regard.

Ladies and gentlemen, we have reached the end of our question-and-answer session.

I would like to turn the floor back over to management for closing remarks.

Thank you, guys, for joining us today.

We'll be looking forward to seeing you during the quarter.

And also, if you'd like to have a call back today, pop me an e-mail, and we'll get you in the queue.

Thanks, and have a great day.

Bye-bye.

Ladies and gentlemen, thank you for your participation.

This does conclude today's teleconference.

You may disconnect your lines, and have a wonderful day.