Check Point Software Technologies Ltd (CHKP) 2020 Q3 法說會逐字稿

Greetings. Allow me to introduce myself. My name is Kip E. Meintzer, Global Head of Investor Relations for Check Point Software. I'd like to welcome you to our third quarter 2020 financial results video conference call. (Operator Instructions)

Joining me remotely today on the call are Gil Shwed, Founder and CEO; along with our CFO and COO, Tal Payne. As a reminder, this video conference is live on our website and is recorded for replay. To access the live web conference and replay information, please visit the company's website at checkpoint.com. For your convenience, the replay will be available through October 29. If you'd like to reach us after the call, please contact Investor Relations by e-mail at kip@checkpoint.com.

Before we begin with management's presentation, I'd like to highlight the following. During the course of this presentation, Check Point's representatives may make certain forward-looking statements. These forward-looking statements within the meaning of Section 27A of the Securities Act of 1933 and Section 21E of the Securities and Exchange Act of 1934 include, but are not limited to, statements related to Check Point's expectations regarding business, financial performance and customers; the introduction of new products, programs and the success of those products and programs; the environment for security threats and trends in the market; our strategy focus areas and demand for our solutions; the impact of COVID-19 on our business, including on our product development and sales and marketing efforts and our financial condition and results of operation; the impact of COVID-19 on our customers, suppliers and business partners and the macroeconomic environment as a whole, our business and financial outlook, including our guidance for Q4 2020.

Because these statements pertain to future events, they are subject to risks and uncertainties. Actual results could differ materially from Check Point's current expectations and beliefs. Factors that could cause or contribute to such differences are contained in Check Point's earnings release issued on October 22, 2020, which is available on our website. And other factors and risks, including those discussed in Check Point's annual report on Form 20-F for the year ended December 31, 2019, which is on file with the Securities and Exchange Commission. Check Point assumes no obligation to update information concerning its expectations or beliefs, except as required by law.

In our press release, which has been posted on the website, we present GAAP and non-GAAP results along with a reconciliation of such results as well as reasons for our presentation of non-GAAP information.

Now I'd like to turn the call over to Tal Payne for review of our financial results.

Thank you, Kip. Good morning and good afternoon to everyone joining us on the call today. I hope you all keep safe in these times.

We are pleased with our third quarter performance and our financial results, which were ahead of earlier expectations. Revenues for the quarter increased by 4% year-over-year to $509 million, and our non-GAAP EPS grew by 14% to $1.64.

Before I proceed further into the numbers, let me remind you that our GAAP financial results include stock-based compensation charges, amortization of acquired intangible assets and acquisition-related expenses as well as the related tax effect. Keep in mind that as applicable, non-GAAP information is presented excluding these items.

Now let's take a look at the financial highlights for the quarter. Product and security subscription revenues were $289 million, a 6% increase year-over-year. Our subscription revenues continue to be strong with 10% growth year-over-year, reaching $169 million. Software update and maintenance revenues increased to $220 million.

During the quarter, we have seen a healthy growth in our network security products, mainly small, mid and data center appliances. We have seen strength in our strategic areas. Our cloud solution continued to have strong results and high double-digit growth. Infinity continues to gain momentum as we see deals closing in many new countries. We were also encouraged to see growth in new customer deals, especially in this environment.

We had strong results in a few verticals, government, telecommunication, technology and health care verticals, with significant increase in transactions over $1 million. Last quarter, we launched the vast majority of our Quantum appliances. We have seen a healthy transition of over 80% by the end of this quarter.

Deferred revenues reached $1.302 billion, a growth of $60 million or 5% over last year. We were pleased with sales execution in these times as we continue to see growth across all geographies. Revenue distribution by geography for the quarter was as follows: 46% of revenues came from America; 42% of revenues came from Europe, Middle East and Africa; and the remaining 12% came from Asia Pacific.

We delivered strong non-GAAP operating margin of 52%. This margin is significantly higher than last year in our original plan as a result of the higher level of revenues and the operating expenses decline. The operating expense reduction, similar to the previous quarter, relates mainly to employees' move to work from home and the lower travel and entertainment. Bear in mind, Q3 typically has lower level of expenses relating to vacation provision seasonality and co-op that is utilized heavily in Q4 versus Q3. Those expenses are expected to return gradually as more countries go back to some normalized business practices like travel, face-to-face meetings, entertainment and partial return to office work.

As a reminder, interest rates in the U.S. sharply dropped last quarter. And as a result, the yield of our marketable securities are expected to reduce consistently throughout the years as the portfolio is being reinvested, prepaid or sold.

Our financial income this quarter reduced to $14 million, in line with our guidance in the previous quarter and expected to continue to drop $1 million or $2 million as we discussed before. Naturally, this reduction is also reflected in the cash flow.

Our U.S. dollar -- as to the U.S. dollar, it's weakened against most currencies around the world this quarter. As an example, 3% against Israeli Shekel, 7% against the Euro and the Pound. Remember that 50% of our expenses are in non-U.S. dollar currencies, mainly compensation related. Hence, this weakening of the dollar is driving our expenses up.

Effective non-GAAP tax rate for the quarter was 17% and in line with our expectations. Remember that the fourth quarter, we forecast the tax rate will be around 0 as the lapse of statute limitation expect to occur by year-end as we've seen in the last 2, 3 years.

GAAP net income was $201 million or $1.42 per diluted share. Non-GAAP net income was $231 million or $1.64 per diluted share, an increase of 14% from the third quarter of 2019. The growth is related to the higher level of income on the one hand and the continued reduction of our diluted outstanding share.

As the share price increased during the last few months, more options are taken into account in the diluted outstanding shares calculation. In Q4, we expect the diluted outstanding number to be around 140 million shares.

As to our cash flow, cash balances for September 30 were $3.900 billion. Operating cash flow this quarter reached $248 million, similar to last year. Collection from customers continues to be very strong. During the quarter, we completed the acquisition of Odo Security, a new cloud-based technology that delivers secure remote access to enterprises. Part of the consideration is included in operating cash flow according to accounting rules. Excluding this payment, the operating cash flow increased by 4% this quarter.

In February, we approved the expansion of our buyback program for additional $2 billion and up to $325 million a quarter. At an average price -- sorry, $325 million a quarter. During the quarter, we purchased 2.7 million shares at an average price of $122. This quarter, our aggregated buyback, since the beginning of the buyback program in 2004, crossed the $10 billion bar.

And now let's turn the call over to Gil for his comments.

Thank you, Tal, and hello to everyone joining us today. First, I'm glad to see you all. This new format, I really like. I hope that you and your families are all safe and healthy in this new normal.

At Check Point, we are closing the third quarter in a virtual manner. Based on my recent discussion with our employees around the world, it seems see that people generally are adapting well to this new mode of operation and business continues with few disruptions. You can definitely see that in the third quarter results, which were better than expected in almost every measure. Revenues are ahead of expectation, and EPS was much higher than planned. The first is a result of our business activity and the second is driven by the reduction of physical activity.

On the business front, we continue to see many healthy indicators during the quarter. In the core business, we saw a growth of about 10% in network security gateways. Keep in mind that this figure includes subscriptions that are sold as part of the product and are deferred. This trend is quite positive, especially given the fact that customers today are a little bit more reluctant to perform physical upgrades on their data centers, which brings me to the other growth areas in our market, cloud and emerging technologies.

Cloud sales continued to perform well. We had many customers and expanded our footprint within existing customers, resulting in a strong double-digit growth every quarter this year, which is coming from both our native cloud security solution and our virtual gateway in the cloud. The entire CloudGuard family, the CloudGuard native, which include the workload, the posture management and the CloudGuard IaaS for the virtual gateway.

The same is also true to our other emerging segments. Our Beyond The Perimeter, or BTP business that provides advanced threat prevention for the endpoint computer and mobile devices also grew quite fast. Both categories are important in the delivery of our full vision of providing the highest level of security prevention, utilizing our consolidated Infinity architecture.

Sales of Infinity Total Protection, our solution for a full and consolidated enterprise security, also had a great result and almost doubled compared to last year. Infinity sales are still in the infancy, but I'm happy to say that I hear more and more feedback from our channel partners that Infinity is becoming an important door opener and a differentiator for Check Point.

Last but not least, we continue to focus on new customer acquisition. And this quarter, we generated significant growth in this area, another good indicator but with a future of -- but with plenty of future potential for growth. Overall, I believe that we have the right approach for the future of cybersecurity, real-time threat prevention, protection and consolidation using one architecture. It addresses the complexity and the economics of cyber while providing much higher level of security.

Our Infinity architecture is powered by ThreatCloud, which identifies new threats and performs immediate prevention across all attack vector and to all customers and solutions. Our research team continue to generate amazing findings about the state of cybersecurity. We continue to fight against cyber threats by building our security architecture to protect the world from a potential cyber pandemic. We uncovered several vulnerabilities that could have led to such a pandemic.

Earlier this quarter, we talked about the SigRed vulnerability in Microsoft DNS and Active Directory Server. Just this week, the NSA has put SigRed in the list of top vulnerabilities targeted by Chinese hackers. Later in the quarter, we published our vulnerabilities which could have been devastating, such as basic #InstaHack vulnerabilities, which allowed picture on social networks to take over billions of mobile devices, and Achilles, over 400 vulnerabilities, the (inaudible) of Qualcomm mobile chipsets, which power huge number of Android devices. We see more and more mobile malware. It is a market that remains largely untapped.

There are many trends in the attack landscape, one of which is the increased amount of ransomware attack we see. Over the past months, we've seen more than 50% increase in what's called double extortion ransomware, where the attackers demand the payment to get your encrypted file, but if you don't pay, they will publish the file. The attackers have also tuned their business model and are targeting multiple size businesses from industrials to hospitals and are seeing quite a lot of success these days.

We continue to invest in the future of cyber, addressing some of today's most important needs. Last month, we acquired Odo Security, a small start-up that has built an amazing platform for secure remote access. The new platform provides a good basis for what's called Secure Access Services Edge, or SASE. This solution will be the basis of our future remote access solution, which will provide easy and secure access portal to all type of assets; cloud, web and data center application, remote desktop and others. I'm really excited about this acquisition and its potential in our marketplace.

In the coming days, we will release our latest major software version for the year R81. R81 provides many new capabilities. Let me just go through the top 3 of its capabilities. First is a higher level of security with automatic AI technology that is designed to provide real-time prevention against zero-day attack, what we call autonomous threat prevention in our gateways. Second is automatic hardware and core allocation on the gateway to optimize its operation and provide higher level of performance and security. And third is very quick response to changing security needs with superfast policy installation, down to as little as 10 seconds from minutes. Quick upgrades and many other features that continue to underscore the leadership of our management console.

When we look into the future, I believe that we are working on the key initiatives to provide the world with a safer cyber environment, an environment that is needed now more than ever. 2020 was and is a very unique year. We've all learned the criticality of the Internet and cyber infrastructure. Imagine going through the COVID-19 crisis without the Internet or with Internet that's not performing well. The crisis is far from over. We are experiencing a strong second wave of corona in Europe with few restrictions and lockdowns. The U.S. is still on the first wave and is now at the risk of facing more unrest with the coming election. And the corona pandemic has accelerated many of the aspects of digital transformation, making cybersecurity even more important.

So I remain very positive on the future of our market. However, with the current world trend, the level of visibility and predictability for the short-term remains low. Having said that, we decided this quarter to provide guidance with a wider than normal range while reminding you that the level of uncertainty remains high, just as I've outlined for you.

So for the fourth quarter, we are expecting revenues to be in the range of $525 million to $575 million. Non-GAAP EPS is expected to be quite healthy in the range of $1.98 to $2.17 or $2.18, Tal?

It's actually -- sorry, it's actually $2 to $2.18.

Okay, $2 to $2.18. GAAP EPS is expected to be approximately $0.22 lower. Even while we pulled our annual guidance at the beginning of the crisis, our results so far have been quite consistent with the guidance we provided at the beginning of the year, so there is no change to make changes to the annual projection.

Now I would like to turn the call over to Kip for your thoughtful questions. And once again, I will repeat the guidance in case you missed it. Revenues are expected to be in the range of $525 million to $575 million and EPS is expected to be between $2 and $2.18.

Thank you, Gil. (Operator Instructions) Now for the first question of the day, it comes from Jonathan Ho followed by Saket Kalia from Barclays.

Congratulations on a strong quarter. This is a strong product revenue quarter. Can you give us a little bit more color regarding the cross-sell opportunity with Infinity Total Protect and perhaps what elements of the platform your partners are most excited about?

I think the opportunity is almost unlimited because, again, today, most of our customers are using our network security solutions and have not upgraded to the portfolio. I think when you look at it -- when a customer looks at it and trying to really get their hold on their security, the opportunity is really pretty big out there. I think with Infinity it's a real good door opener, not just to come and say, I have these 12 products and somebody else has 7 products and let's talk about the product, but really outline the full spectrum of solution that's needed and speak about architecture.

Now again, we're seeing an increasing number of people that buy into it, buy the whole architecture. But we're seeing even more people that are saying, well, that's really interesting, I may not be ready now to change all my security infrastructure, but the fact that you have this vision architecture allows me to buy more cloud, allows me to buy more Beyond The Perimeter endpoint, mobile, more IoT, with a lot of other elements. This quarter, we launched Infinity SOC for a security operations center. And I think that's a great way to elevate our way through the organization and to expand the solutions to new and existing customers, by the way.

Next question is Saket Kalia, followed by Philip Winslow.

Tal, maybe for you, maybe a little bit out of left field, but I remember this happened a couple of years ago where Yom Kippur actually fell at the very end of the quarter and had a material impact on billings. I believe it was also at the end of the quarter this year. So the question is, can you talk about whether that had any impact this time? And how, if at all, that could be impacting your Q4 bookings expectation?

So I'll say, we -- if you remember the previous one, I think it was Yom Kippur a few years ago, we just warned you that it might have an effect, but the good news was that it didn't, if I recall. So that's because we dealt with it internally with our backup teams all over the world, mainly in the U.S. for their order entry. I will say, right now, we don't expect any holidays to land in the next few years in the last day, exactly on the end of the quarter. So I don't anticipate any effects there.

Just to be clear, this quarter, Yom Kippur falls on the last day of the quarter, but we still have 2 business days. And these 2 business days were enough to get the right business in order. I think last time, it was really the Yom Kippur that fell on the same day, which is -- for those who are not familiar with Yom Kippur, it's like a complete closure on the country when people actually don't work. We had a strong lockdown on the country this time, but at least we could have worked from home.

All right. Our next question is from Philip Winslow, followed by Gray Powell.

Congrats on the good quarter. A question to Gil. I mean, Gil, earlier this year, it seemed like businesses were very focused on sort of call it triage in capacity, whether it be VPN or just call it bandwidth throughput, but we're now transitioning into more called strategic decisions made by customers about their security architecture. Are you starting to see that? And where are you starting to see that in your revenue in your pipeline?

So first thing I'd say that the market is behaving relatively as expected. I see it in our results. I see -- again, I'm not an expert on the entire market, but I think, I've seen -- I think, in general, the IT market is suffering a small number of interruptions from the world crisis around us. I think in terms of cybersecurity, people are really speaking about the day after and what they need to do. I'm not sure that we move that way. I mean -- so I mean on one hand, we see customers that are saying, yes, we've opened up so many things. The attack landscape on our enterprise and opening it to our vendors, to our employees and so on has really increased the surface that can be attacked. But I haven't seen yet that people have taken the step to really secure it. Now I think it's very clear to our industry that we need to do that. That's the discussion around CISOs, that's the discussion in forums. I haven't seen it materialize yet.

So I think, again, if we look at the opportunity -- the need, it's not even the opportunity, we are trying -- the need is huge because we really, really opened up and put business priority, what we call business is security for lunch and now we need to bring security back. By the way, while keeping things connected, while keeping them open, I'm not talking about closing thing, I'm talking about securing them. I think it's happening slowly. There is a growing discussion, not to be overly enthusiastic about that. Remember that some companies are also facing budget challenges and the economy might hit a broader set of customers than we've seen so far. But I think long term, clearly, we need more security everywhere. Things that we thought will never be open are now all connected to the Internet and are now all open to external entities.

And maybe I would just add that, again, not just looking at what happened in Q3, we saw quite a few nice Infinity transactions. And when you look at the uplift in the ACV, it was nice to see. It's not 10%, 20%, 30%, 40%. It's more. It's growing nicely, and it's a healthy growth. It's not just a conversion of ACV with ACV, which is similar, which shows there's a great opportunity in Infinity. The more we'll get there, the better it will do for our customers and ourselves.

And the second, cloud, I think, I'm not sure, but I think the largest cloud deal when it comes to a native cloud happened this quarter. So that was nice to see customers adopting solutions in above $1 million solutions, right? So that's nice to see also that move.

All right. Our next question is from Gray Powell of BTIG, followed by Sterling Auty at JPMorgan.

So yes, can you give us a sense as to how much the Maestro orchestrator is helping growth on the product revenue side? And then do you see that as a big differentiator versus peers going forward?

Yes, we did see -- we do see it as a huge differentiator. I don't have the numbers in front of me so I can't quantify that, but we do see more and more deals. But Maestro is becoming the game changer. We won many, many better deals this year. And by the way, it's not just at the super high end. I think one of the nice things about Maestro is before we had scalable platforms that allowed customers with millions of dollars of budget to get super high performance with sophisticated (inaudible), now it's available for everyone. Now customers that are in the mid-range of the market can build a scalable architecture, can add their capacity if they need to, can get the resiliency that it provides because Maestro provides both the performance and the resiliency.

One nice deal about that, I'm not sure even if it was very large, but it was sizable, was a very fast highway. That -- I mean the highway is now secured, both secure and fast security. So that's a nice customer to see.

All right. Our next call -- our next question is coming from Sterling Auty at JPMorgan, followed by Joel P. Fishbein of Truist Securities.

So Gregg's question kind of broke up for me. So hopefully, this isn't the same one. But Tal, in your prepared remarks, you talked about some really nice new company or new customer additions. And I'm curious what was either the product or the use case that you saw most common in those new customers coming on board?

So I will say Gil can add, but first, it came from many different countries. So that was nice. You saw large deals. That was nice as well because typical new customers can be smaller. We saw a few customers which -- it was actually, I will call it small but record quarter when it comes to new customers. So that was nice to see.

The differentiator in every deal can be different, but, I can say, very repetitive, the Infinity vision. The Maestro is a big differentiator. The holisticness of the approach, the fact that we have Infinity when you think of the full broad spectrum of solution that we can provide to the customers and the quality, the best security out there when it comes to catch rate and securing you in this environment.

Our next question is coming from Joel Fishbein of Truist Securities, followed by Walter Pritchard of Citi.

Just a quick one from me. If -- Tal, if things stay the same as they are currently, do you think that you can continue to grow in '21 the same way, at the same growth rate you're growing currently?

You're asking for 2021 guide. I think -- we just moved from no guidance to a guidance with a quite wide range to say, we are moving forward. We want to give you more visibility. But having said that, remember, Q4 is massive in terms of understanding when the markets are going for next year. Q4 is a big quarter. Remember, it's a quarter also that is much more affected by product because the product number in Q4 is sometimes 30% higher, right? So it's a big quarter. We need to see first Q4 and lock Q4 before we even start talking about 2021?

Our next question is from Walter Pritchard, followed by Ben Bollin of Cleveland Research.

Gil, wondering, just on the Quantum appliances, you launched those. I think your 80% volume this quarter is what you mentioned exiting the quarter. Can you compare how the impact of this Quantum appliance rollout has differed from prior ones? And how are you looking at that refresh opportunity in the coming quarters as drivers of demand? I guess you've given Q4 guide, but that and beyond.

I think, first, we usually -- I mean what we had successful -- we had some places when customers weren't leaning forward the new appliances and then it took a while. When we had successful transition, it usually was like a 50%, 60% transition over, I would say, 2 quarters, now we're at 80%. So obviously, it means that the transition is going actually better than previous time, which makes sense.

I don't know if it has a big impact on the -- on Q4 or will have a big impact on Q4. On the other hand, as we've said, we've seen healthy growth in appliance sales, which I'm happy about. It's not mind-boggling growth, but it's a healthy growth, which is unique even in the marketplace that we are today. And remember that it is impacted too by the fact that people today are minimizing the physical changes to the infrastructure. So I mean, on one hand, customers are trying to keep business as usual. On the other hand, they try to avoid doing too many physical upgrades.

So I think all in all, it means a good sign. Whether it will continue for a few more quarters or whether it was like a nice few percent of upside this quarter, it's very hard to say. Anyways, it's good.

Our next question is from Ben Bollin of Cleveland Research, followed by Brad Zelnick of Crédit Suisse.

Could you talk a little bit about what you're seeing from your customers in terms of how the work from home mix is settling out or what you're expecting? And could you talk through how you think that's influencing adoption of things like Quantum in the cloud portfolio? Hopefully, you could touch on CloudGuard, Dome9, Infinity and Odo, but -- that's it.

So I think that varies a lot around the world. When we ask people around the world, it really varies by countries. Asia, there is a high level of openness. Some countries are really open for business. Some countries are open but a few people come to the office. Europe is mixed, but unfortunately, the trend there is quite negative right now. It was opening up fast and now there's more and more restrictions and lockdowns in Europe, which is very unfortunate. And U.S.A., I think you know better than me, the situation.

Overall, by the way, when I look at Check Point, when I have very accurate statistics, in the -- it's about worldwide, it's about 16, 17 of the employees actually arrive to the office and 80% or so remain working from home. And it varies by geo. In the U.S., it's 90-some percent working from home. In Europe and Asia, it's 20%, 30% of employees arrive to the office. And again, it varies by country.

How does it impact our business? I think first, it's bound to buy -- it's bound to make people think more about the remote access solution, about securing that. Remember, it's really -- I mean, on one hand, we shifted very quickly to work from home. On the other hand, with thousands and thousands of connections, we're opening up the core of every trading floor and every factory to remote working. We've also opened up a huge opportunity for hacking. We've even tested and some people working from home are working from their personal home computer that they share with the kids. Sometimes, it's like 40% of these computers that are not secured at all and ultimately have insufficient level of security. So the need to secure that is huge.

And by the way, some of the things we're seeing, like ransomware, it's not where you see the tip of the iceberg of actually hackers exploiting that. I think we haven't seen the full effect on that, but customers will have to invest in that. At the same time, the whole digital transformation, the fact that we learned that we need to move more work close to the cloud, but we are so dependent on e-commerce, but everything is now online and fewer things are face-to-face. It has a very big impact.

And I think -- again, I think we will see the impact starting now because the good thing is that the Internet is working. And I mean, I must say that I'm very proud to be part of the Internet industry because, I think, when you expect the level of change that we went with a year and the Internet kept working and kept working fast, it's quite amazing. It's shows, by the way, that we have capacity, so that's -- which is good. But in terms of security, we will have to invest in more security.

All right. Thank you. Our next question is coming from Brad Zelnick, followed by Rob Owens of Piper Sandler.

It's also great to see the stable trends in the business. Gil, as we think about the R81 release, which I know a lot of customers have been anticipating, can you just remind us what impact does the new release of the OS have on the business and on the financials of the company, especially one like this with a lot of great functionality? Like should we think of this as helping win rates competitively or even inspiring some existing customers to come to the table and refresh an existing appliance?

I think overall, it's helping the business because customer look for innovation, customer look for the new features and so on. However, I don't think it's quantifiable in the short-term because in the short-term, on one hand, it may be help -- it helps closing deals but also everybody is busy with the upgrade, and the upgrade takes a lot of cycles. So that's something that we do have to worry --- think about. But the sales engineers need to work more closely with existing customers and existing customers get the new version through the subscription or through the support contracts that they have. So it's not generating additional sales.

But overall, I think it's positive. Again, I don't anticipate material impact or any impact on the business in the short-term. And we need to manage our business correctly. So we actually don't slow down new deals when we are busy with upgrading customer infrastructures.

Our next question is from Rob Owens of Piper Sandler, followed by Fatima Boolani of UBS Equities.

I'll give you the easy one before Fatima comes with the hard one. Gil, you mentioned a 10% increase in network security gateways. Just looking for some color there in terms of, a, how that's trended? And then are these capacity based upgrades or is it an aging installed base that's being replaced at this point?

I think it's all over, and I wish I could have given you saying, that's a great trend and everything is moving. We saw a little bit here, a little bit there. We saw some volume increase in number of gateway. We saw some different models being sold. Overall, it was very good. I mean, overall, I must say that for a long time we haven't seen growth in network security and seeing in almost 10%. And again, 10% is kind of the growth in our internal measures, which summarizes a lot of different aspects. Some models, it's higher growth in volume, some model it's higher growth in dollars and so on.

So overall, it's positive. I mean based on so far what I analyzed, I didn't find one trend that would say, here is something that takes off and drives the entire business with it. So I don't know, Tal, if you have more color about the analytics of it.

Yes. I would say, actually, it's both. So we see some that need more capacity as people moved the work more remotely. You need the higher capacity on the gateway coming in and out of the organization. And second, you have some that have an appliance over a certain number of years, and they use this opportunity to refresh it. So I think it's both.

And I think Maestro is definitely a driver here because I do see it when we analyze the wins, it's a differentiator. It's a nice differentiator in the ability to scale, start small. And then as you need to increase capacity, if you already bought the switch, the Maestro, you can add on capacity without having to throw an old one. And it's a big advantage, especially when you think in an environment where it is part of the discussion. Many -- as you know, many companies right now are suffering under the COVID. So if you can bring value to the customers, be it through Infinity or Maestro infrastructure that enables us to increase capacity in the future without having to sell the old box, it becomes a differentiator.

All right. Our next question is with Fatima Boolani from UBS Equities, followed by Shaul Eyal out of Oppenheimer.

Tal, the question is for you. You still have about 40 -- a little over 40% of your revenue derived from updates and maintenance and very traditionally flavored support revenue. And as I think about some of the dynamics around the adoption of the cloud portfolio and the Infinity portfolio, how should we expect the trajectory of your maintenance and support revenue to trend as physical form factors become maybe more challenging to go-to-market list?

So okay, I'll try to -- let's talk first long-term what's the direction. So the direction is pretty much -- when we talked for the last few years, we said subscription, everything that we come in with every new product, new capabilities, majority of them coming through subscription model. So you have the cloud, the subscription, you had all the blades that we launched throughout the year, probably since 2009, 2010, all of them are subscription. And that's why you see the major growth engines are coming through the subscription line. So cloud is a great example. Majority of it is sitting on the cloud.

When you talk about Infinity, then Infinity, it's a deal of an X dollars per year per employee or per user, but accounting-wise, you split it between the product, support and subscription. So theoretically, it splits also the support line. But because of the majority of Check Point products nowadays is subscription, then also in Infinity, majority of the dollars are being sucked into the subscription line. Same with bundled. Appliances, all of them are bundled. It used to be bundled with NGTP. Now it's bundled with SandBlast. More percentage of the product is being taken away to deferred revenues and will be recognized over the subscription.

So as a general direction, it's what you've seen in the last 2, 3 years, subscription, hopefully, will continue to see a growth and a healthy growth. Product, depends. Right now, we see a plus. So it's nice to see that, especially under the pressure of the subscription position that have been taken out. Support, it's very hard to grow unless your installed base growing. So I would say, support is tougher, especially since when you also -- when you get into discounted environment, that's usually the lines that get the most requests for discounts. So I would say, support, I don't expect to see significant growth. And if you remember, I even talked about at the beginning of the year, and I said, 0 is the reasonable assumption for the support line.

All right. Our next question is from Shaul Eyal of Oppenheimer, followed by Brian Essex at Goldman Sachs.

Gil, you might have addressed that indirect. I want to try and ask it kind of slightly more straightforward. So you've indicated COVID-19 numbers are rising. We are seeing -- we're hearing that Europe, for example, is going into some regional anecdotal lockdowns. U.S. still open for the most part. Hypothetically speaking, do you think we might be seeing a near-term incremental spending way similar to the one we had seen back in the April-May time frame? Do you think CISOs are mostly done right now with their initial spending wave of work from home or from anywhere? Or do you think actually we could be seeing a little bit of a tailwind over the course of the next few weeks, even months?

I think it will be a guess, but I think that most companies are okay with changing the infrastructure. We moved to work from home. We know that we can do that. The next wave here is going to be about securing this work from home, and that's a longer-term need because it's not about like we needed to do in March, which within 2 weeks the entire world had to change the way it works.

So I'm not anticipating a huge push on security in the near term-based on COVID. Again, I hope it will be over COVID. I hope that actually the push that we will see that corona will go away and then we will see the business rising up from a crisis and people do an incremental spending. But for the time being, I hope that we will remain in this stable environment because, as I said, the good news that we haven't suffered too much from the corona crisis economically. We suffered it for other means, but not economically. The less than good news -- I mean the better news is that it can be over and that people will need more security. The risk factor is that the fact that the economy hasn't hurt us doesn't mean it won't hurt us in the future. And I mean (inaudible) Check Point, it's all over the structure. It's not -- it's everyone related to us. There's nothing that I see particular to Check Point.

And maybe I'll say the way I look at it, even if I look at the CFO, right? So from a company that thank you, it didn't suffer, right? This is a privilege to be part of that area. But I can say, no, when you started with the COVID, you moved very, very fast and you're proving just to make sure everybody is running an operational. And we also -- we talked about it, I talked to you about it in the previous call and we saw some increase -- it's not material in our number, but some increase in the mobile access capabilities and the VPN and so on. So that was a few millions of dollars.

I think as now, as Gil said, we stabilized that area. So actually, this quarter, the growth is not relating to VPN and mobile access in this area. So it's good. It's a regular growth in a way. But you see more and more companies starting to suffer. And our customers -- we might not suffer, but our customers and our customers around the world are suffering depending on their size, and that can change their pattern of acquisitions and the upgrades. So I said that's where the caution should come from. Not our situation, but actually, your ability to look at what's happening out there to the large markets, to the enterprises in all verticals and to see what does it mean. Because when they suffer, naturally, they come to everybody else to help them, right? So it's part of the same dilemma.

Our next question is from Brian Essex of Goldman Sachs, followed by Gregg Moskowitz of Mizuho.

So maybe a question for Gil or Tal, whoever wants to pick this one up. Cloud and emerging technology, how do you think about disclosure for the emerging growth businesses versus maybe what we call the core businesses? How big is cloud and emerging technology? And is there a point where it would hit the threshold where we might get better disclosure in terms of faster growth businesses, recurring revenue to gauge a better sense of that subscription portion of your business and how it's growing?

Gil, if you want I can start and then you can add. I will say the following, remember that I understand the need to split. But in reality, majority of the deals you can't split. It's an accounting split. In reality, when a customer buys Infinity, he buys everything. So we split it between the line because of the accounting, but the customer bought the full package, the same when they buy SandBlast. It has in it the threat emulation, but it has in it also 5 or 6 other blades. So the split is a bit artificial.

Having said that, I can tell you that the good news that this cloud is in the subscription. And in this quarter, it's around the 10%. So it passed the 10% from the subscription line. So that was nice to see that, just to give you a bit of color.

I think, overall, I would say that depends what you count as cloud. I think there is like 2 or 3 layers of cloud that you count. One is securing the cloud, securing the customer cloud infrastructure. Second is delivering security from the cloud. And again, when you look at our industry, you see some companies that are -- companies that are called cloud. Some of them are using cloud to provide the same security we provide, some are securing the cloud infrastructure of their customers and also almost on every product today, we have some cloud component.

So if I -- so we are -- I'm trying to quantify it internally for me. I think that today, the overall cloud business that we have combining all elements is approaching 10% of total business, not just of the subscription. And again, some of it, you can say, this is actually cloud sales. Some of it you can say this is cloud aided. And in terms of which product is it in, it's in every product. I just mentioned in R81, we have this,, what we call, Autonomous Threat prevention, and that's driven by cloud. Now again, it doesn't make all our gateway sales cloud sales, just to be clear. But it's now getting mixed on almost every product that we have.

All right. Our next call is from Gregg -- our next caller is Gregg Moskowitz of Mizuho, followed by Keith Bachman of BMO.

Congratulations on good Q3. So I had a follow-up actually for Gil on cloud. And you now have a lot of products or offerings under that cloud card umbrella. I think Tal mentioned that, it may have been your largest ever cloud deal that was signed in the Q3. So it would be very helpful to get a little context, perhaps in terms of what customers are significantly buying and maybe looking at that large cloud deal this quarter, for instance, if you could give us a sense of how that customer is deploying Check Point in the cloud, that would be helpful.

There's a large number of subcomponents and technologies in this cloud family, but there is 2 that I mentioned in my script, and they're are the bigger ones. One is what we call cloud native -- managing cloud native. And I think a big part of is what we call the cloud posture management. It's managing the native security of the cloud. That's one big piece.

Another one is virtual gateways on the cloud. It's taking gateways like we used to have physically and putting them in the cloud or the CloudGuard IaaS, Infrastructure as a Service. And that's another big portion. These 2 portions are, by the way, very similar in size today. So they're pretty big. And these are the 2 leading ones right now.

On top of it, there's a long list of technologies that are emerging, like cloud workloads, securing several functions and containers, delivering security through the cloud, and there is a lot of other features that we introduce to the market that are gaining share. But I mean, I'm just -- if I frame it, these are the key elements. And I'm glad to say, by the way, that both are growing. So it's not that -- customers are moving gateways to the cloud on one end, which is great. Customers are also securing the native cloud with our cloud posture management.

All right. Our next question is from Keith Bachman at BMO, followed by Adam Tindle of Raymond James.

I'm going to direct us to Tal, if I could. Tal, I wanted to see if you could describe the trends on 2 different areas. One is if you could think about the percent of bookings that are driven by new customers versus existing, and how do you think that's been shaped over the last couple of quarters versus how you see it unfolding over the next year? So is it 80-20 existing versus new 90-10. If you could just give us a little perspective on that. And the second part of the question is similar, if you could give us a little sense about what the net retention rate is on your existing customers, recent trends versus how you see that unfolding? Attrition rate, obviously driven by mix up and perhaps some attrition. But if you could just give us some thoughts on those 2 vectors, that would be great.

Sure. So I can't give you much because we don't provide that. But what I can tell you, both numbers are quite steady with new customers being the first. So retention is -- touchwood was never a big issue here in the sense that we have good customers, they like us and the renewal rates are very similar for many, many years. So that's regarding the retention. Of course, they're moving from one package to another. So maybe someone started with support in a certain level and moved up to premium or -- and then you see them dropping from one package and moving to the other. But when you talk as a customer, we retain a majority of our customers. When you talk about -- and the challenge there is usually how do you upsell, in the sense, moving them to a high level of support that maybe match their size and trying to keep pricing on the same place. And that's actually tougher in a competitive environment. So that's one.

When you talk about new customers, so for us, this is the biggest opportunity. It's a huge opportunity because when you think about it, see, we have $2 billion revenues, but the majority of it is, by far, is coming from existing customers, which means maybe 75% or 80% of the market is out there for us to go and compete on. So that's how we have such a big focus on new customers. It remained similar for a long time. And for the last, I think, quarter or 2 quarters, we see a nice increase. And you know we're investing quite a lot in this initiative. It's not easy to move that. And we talked about it in many calls what do we do in order to enhance the activity in that area, and we intend to continue and invest a lot on that in order to increase those numbers.

Okay. So in COVID, it has moved up a little bit and particularly as your portfolio has expanded, perhaps. Is that helping to move a little -- the needle a little bit on new customer acquisitions?

It's a bit early to celebrate in the sense that it's 1 or 2 quarters. We need to see a phenomena continuing for a year in order to say, yes, we're on the train there, but we have a lot of focus there.

I would say in terms of Infinity, I can give you an example, when you ask about the percentage of new versus existing, in Infinity, you see that a significant portion is coming from new customers. So that's good tool to maybe to engage with new customers. So I think the more we will do Infinity, the more we will see success there as well.

I'll jump (inaudible) seen in sales, but salespeople are generally saying that in the corona time, customers are actually not happy to move to new vendors. They like to stick to their existing vendors. Still having said that, we've seen some good trend in new customers this quarter, and I'd like to hope that we will be able to continue with that trend.

Our last question of the day is going to come from Adam Tindle from Raymond James. Adam?

Perfect. Tal, I just want to start with thank you for the Q4 guidance. I think you mentioned in an earlier question that Q4 was massive in understanding trends for 2021. When I look at that Q4 guidance, not to get too granular, but it looks like revenue is going to be up around 8% sequentially at the midpoint and it's normally up 12% to 14% in Q4. So I guess the question would be why are you indicating below seasonal trends from the past few quarters? And if Gil wants to add any qualitative commentary, is this like a digestion period after strong trends or something like that?

I think now you're looking for an exact math. And remember, we're coming from 2 quarters that we did want to provide guidance. So it was like a step -- a leap of faith for you guys to say we're giving you the ballpark of the range. It's a risky time, and we wanted to make sure you understand that it's a risky time. Q4 is big, a bigger portion of products. So if it was only supported subscription, it's much easier because you have higher visibility there.

But when you talk about Q4 to items also in the support line, you have some things that have to do with the installation and the consultation that's coming in the support line, which is no visibility as usual. But the product portion is quite significant. So it reflects the risk that is part of this Q4 guidance. That's what it means.

And if you look, by the way, the total year, you will see we're pretty much, I wouldn't say, in line -- if you remember the original guidance that we had before COVID came and hit all of us, then it's pretty much in line with the midpoint, slightly higher than the midpoint of what we gave in the beginning of the year, and the EPS is way above the high end of the range that we gave in the beginning of the year. So that's the logic behind it. I hope that helps.

Thank you, guys, for joining us today. We appreciate your participation. Again, we'll see you throughout the quarter. And if you have any questions, please reach out to us after the call and we'll try to get it back to you as soon as possible. Thank you, guys, and have a great day. Bye-bye now.

All right. Thank you.

Thank you, maybe see you next year.

Goodbye.