Mimecast Limited (MIME) 2018 Q1 法說會逐字稿

Good day, ladies and gentlemen, and thank you for standing by. Welcome to the Mimecast Limited First Quarter 2018 Earnings Conference Call. (Operator Instructions) As a reminder, this conference call is being recorded. I would now like to introduce your host for today's presentation, Mr. Robert Sanders. Sir, please begin.

Welcome to Mimecast's earnings call for the fiscal first quarter of 2018 ended June 30, 2017. I'm Robert Sanders, Director of Investor Relations. With me on the call tonight are Peter Bauer, our Co-Founder, Chairman and CEO; and Peter Campbell, our CFO. Tonight's conference call is being broadcast live via webcast. A replay of this call will be available 2 hours after the live call has ended. During the course of this call, we'll make forward-looking statements regarding future events and the future financial performance of the company. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those in the forward-looking statements. We caution you to consider the important risk factors that could cause actual results to differ materially from those in the forward-looking statements contained in today's press release and this conference call. These risk factors are further defined in Mimecast's most recent Form 20-F filed with the Securities and Exchange Commission. During this call, we will present both GAAP and non-GAAP financial measures. These non-GAAP measures are not intended to be considered in isolation from, a substitute for or superior to, our GAAP results, and we encourage you to consider all measures when analyzing Mimecast's performance. A reconciliation of certain GAAP to non-GAAP measures is included in today's press release, which can be found in the Investor Relations section of our website. The date of this call is August 7, 2017. Any forward-looking statements we make today are based on assumptions that we believe to be reasonable as of this date. We undertake no obligation to update these statements as a result of new information or future events. Now, I would like to turn the call over to Peter Bauer. Peter?

Thanks, Rob, and welcome everybody. We're really delighted to be sharing our results with you this evening. On tonight's call, I'll highlight some of our key business results and then I'll discuss what we're seeing in terms of the market and the rapidly evolving threat landscape. Next I'll cover some of our recent successes in expanding our partners and services, and finally, I'll share some customer stories from the quarter to illustrate where we're having success penetrating the market.

So starting with the first quarter, we're very pleased with our results. Revenue of $58.2 million, which exceeded the high end of our guided range and that represents 40% year-over-year growth as reported and 43% growth in constant currency. This better-than-expected performance was aided by new customer adds in the mid- and high-end of the market as well as strong retention and upsell. Peter Campbell will talk in more detail about our financial results shortly.

Looking broadly across the markets we address, our first quarter was punctuated by several high-profile cyber attacks. WannaCry and Petya received the bulk of the headlines. However, there were many serious exploits of IT systems. In fact, during the quarter, Mimecast's e-mail security risk assessment or ESRA report identify a 400% increase in business e-mail compromise or whaling attacks sequentially from the prior quarter's report. Vulnerabilities were also discovered in Google Docs and Microsoft's Security Gateway. In this constantly evolving threat landscape, companies now more than ever need to consider their overarching cyber resilience strategy. Cyber resilience means more than just keeping the bad guys out. Cyber resilience also means planning for recovery and operational uptime in the event that attackers are successful in penetrating an organization. In this regard, Mimecast is exceptionally effective. Specialist security layers, high-availability services and an independent copy of the data from which to recover compromise systems, strengthens our customers' cyber resilience, while at the same time reducing complexity and simplifying IT. Mimecast's architecture is well suited to adapt to today's rapidly evolving attacks. In response to the recent wave of ransomware attacks, Mimecast announced Sync & Recover for our archiving offering. Now leveraging our core microservices architecture and Mime | OS, we've innovated here and delivered additional functionality to meet customer needs. Over 85% of our customers using Mimecast to protect Office 365 deployments are also running hybrid e-mail environments with some mailboxes on 365 and some residing on local service. Our Mimecast's Sync & Recover service is the only pure cloud solution on the market today to provide unified services across hybrid Office 365 environments without the need for on-premise hardware. Now we constantly innovate and we're anticipating adding additional functionality to meet more customer needs over time and further enhancing the value of our platform services. Besides expanding our product portfolio, in the first quarter, we also strengthened our distribution channel with the addition of Insight to our North American partner program. They're a leader in providing technology solutions for organizations of all sizes. Another indication that our channel strategy is working well for partners and customers came from the recently published CRN U.K. Intelligence Vendor Report for 2017. Mimecast ranked #1 for overall service in the security industry. And as we expand to new markets and further penetrate our regions, our channel partners will continue to play an important role in our success. So this recognition is important to us.

Now as in past calls, I'd like to share few of our wins this quarter to illustrate the success we're having in the market and the types of problems that we're helping customers to solve. First off, a global hotel chain with 5,400 employees had moved to Office 365 initially without additional layer defenses and their experience there prompted them to evaluate options for more protection. Mimecast and other industry leaders were evaluated. But our ability to scale across the geographies and our global customer support capabilities were deciding factors in choosing Mimecast. Now consider a leading U.S.-based physician management practice organization with 5,600 employees. Prior to selecting Mimecast, this organization was using a disparate set of solutions from a competitor. Now the customer sought a more effective security solution. Additionally, the customer had struggled with poor support and looked for a more responsive vendor. So Mimecast's core security with our TTP offering was deployed along with our Secure Messaging Service. Then a U.K.-based energy company with 14,000 employees was running a competitive set of e-mail security appliances from 2 different vendors. Despite this, they were struggling with spam and impersonation attacks. And as part of this company's cloud first strategy, they were preparing to move to Office 365 and wanted additional protection over and above what Microsoft offered. So they required a cloud-based vendor who could do this and also integrate into their Splunk environment. So Mimecast was selected to protect their Office 365 environment and, at the same time, simplify their configuration into a single integrated platform.

Finally, I'm delighted to share a larger enterprise win. An aviation company with over 75,000 employees, that was using an industry-leading competitor of ours and they were not satisfied with the number of phishing, impersonation and weaponized attachments that were able to enter their network. Initially, Mimecast had won business with 4 of those companies' smaller subsidiaries and we'd very effectively met the requirements. And then in recent quarters, as Mimecast performed well for the subsidiaries, the parent company had struggled with malware and they were dissatisfied with the service that they were receiving from their incumbent. Mimecast's ability to provide the best protection with the fewest false positives with our targeted threat protection services won this fantastic customer over.

So in summary, we do continue to execute on our financial targets, supported by the right architecture to innovate and adapt to today's rapidly evolving threats. Our channel partnerships are strong and continue to grow. And by focusing on the success of our customers, we've gained recognition and status in the market and will stay focused on that goal as we grow.

With that, I'd like to turn the call over to Peter Campbell, my CFO, to walk you through the numbers in greater detail. Peter?

Thank you, Peter. In this first quarter of our fiscal year 2018, both revenue and adjusted EBITDA exceeded the high end of our guidance range. We generated revenue of $58.2 million, which represents growth of 40% as reported and 43% in constant currency over the first quarter of 2017. Adjusted EBITDA was $5.1 million, representing an adjusted EBITDA margin of 9% compared to 4.5% in the first quarter of fiscal 2017. The quarter benefited from strong customer retention, upsell and new sales during the period. We saw strength in all geographies and had success in our core mid-market as well as the large enterprise segment. We closed 16 deals over $100,000 in the quarter compared to 6 in the same period in the prior year, demonstrating our competitiveness across all market segments, in particular, the large middle market, which our architecture is uniquely suited for. The U.S. market has been especially strong over the last several quarters and now represents over 50% of our revenue. Part of this growth has been due to the benefits of the McAfee end-of-life, which we believe peaked in the third quarter of fiscal '17. We expect the benefits from sales to McAfee customers to have a reduced impact on new business for the remainder of the year.

Net customer additions, which includes customers that churned in the period, was 900, which was lower than the fourth quarter of 2017, due to normal first quarter seasonality and fewer micro customer adds as we move beyond the McAfee end-of-life for their hosted gateway. This customer mix shift away from micro customers, an increase in deals in the large enterprise market and continued strong upsell to our existing customer base, positively impacted our average order value to $8,800 in the quarter. We will continue to focus our selling efforts away from micro customers and expect to see additional gains in average order value, both from upselling and from larger initial orders.

Product bundles introduced this time last year are positively impacting the number of products per customer. The percentage of customers with more than one service has increased. And in fact, the percent of customers with 4 or more products continues to grow. Across our base, customers buy an average of 2.8 services. Our newest release, Sync & Recover for archiving customers, represents an additional future revenue stream, leveraging our architecture and Mime | OS.

Our TTP service is now deployed with 11,500 customers. Demand continues from both new and existing customers. In total, 42% of our customers are using Targeted Threat Protection. During the quarter, the number of customers using our services in conjunction with Office 365 continued to grow. 24% of our customers are now using Mimecast to protect their Office 365 deployments. Over the last several quarters, we have seen on average, 2% per quarter increase in this percentage. That trend continued this quarter, an indication we are benefiting from the market adoption of these services. Office 365 customers have a higher number of services per customer compared to our customer base as a whole, reflecting the reduction in complexity customers experience, as more workloads are consolidated onto my past Mimecast's platform. When customers purchase multiple products, the margin on the incremental product sales is higher, the result of our multi-product, multi-tenant architecture.

Additionally, customers with multiple products tend to stay with us longer. Our revenue retention at a 111% remains strong and is consistent with last quarter. Revenue churn was consistent with the fourth quarter and remains low at 3%. Upsell of our product continues to drive a higher revenue retention number.

Now let's turn to expenses and profitability. We recognized a 74% GAAP gross margin, consistent with the prior period and an improvement over the 73% reported in the first quarter of 2017. Gross margin was higher than anticipated and benefited from the timing of certain data center investments. As noted on prior calls, GAAP gross margin can fluctuate due to the timing of expenditure to support our ongoing operations. We anticipate gross margins to be in the 71% to 73% range over the next several quarters. First quarter operating expenses were $44 million. R&D expense increased as a percentage of revenue to 14% from 12% in the same period in the prior year. At the same time, G&A expense decreased to 15% from 16% in the same period. Sales and marketing expense of $27.6 million decreased as a percentage of revenue to 47% from 51% in the prior quarter. The decrease in sales and marketing expense is partly a result of efficiency and partly the result of the seasonality of investments and certain marketing initiatives.

Adjusted EBITDA in the first quarter of $5.1 million was above the high end of our guidance of $4.3 million. Our adjusted EBITDA margin was 9% versus last year's result of 4.5%. The increase is due to higher revenue than anticipated, the timing of data center expenditures mentioned earlier as well as the timing of some marketing expenditure, which we now expect to occur in the second quarter. Note that this will have the effect of a relatively flat adjusted EBITDA margin target for the second quarter as compared to this current quarter. We remain on track to show annual progress towards our 20% to 22% adjusted EBITDA margin goal.

First quarter GAAP net loss was $1.9 million or $0.03 per basic and diluted share, based on 56.3 million weighted average shares outstanding. Non-GAAP net income for the quarter, which reflects our GAAP net loss exclusive of the effects of stock option expense, was $0.4 million or $0.01 based on 60.6 million diluted shares outstanding. We generated $3.9 million in free cash flow in the first quarter. Recall, free cash flow can fluctuate from quarter-to-quarter based on the timing and payment of capital equipment and other investments. We expect our free cash flow for the year will continue to track broadly in line with adjusted EBITDA.

Turning to the balance sheet. As of June 30, Mimecast had $112.2 million in cash and short-term investments, as well as $7 million in investments with maturities between 12 and 18 months. Long-term debt was $1.2 million.

Now, I would like to turn the focus to guidance for the second quarter and an update for our outlook for 2018. For the second quarter of 2018, constant currency revenue growth is expected to be in the range of 33% to 34% and revenue is expected to be in the range of $59.7 million to $60.3 million. Our guidance is based on exchange rates as of July 31, 2017, and includes an estimated positive impact of $0.7 million, resulting from the weakening of the U.S. dollar compared to the prior year. Adjusted EBITDA for the second quarter is expected to be in the range of $5 million to $6 million. From a full year 2018 perspective, revenue is expected to be in the range of $246.8 million to $252.1 million or 30% to 33% growth in constant currency. Foreign exchange rate fluctuations are positively impacting this guidance by an estimated $3 million. Note that the strong linearity of new and add-on business generated from McAfee sales in the second half of last year will result in tougher compares in the second half of this fiscal year. This guidance also incorporates an accounting change to the length of a customer life from 5 years to 6 years. This change will negatively impact our revenue in 2018 by $1.2 million. Adjusted EBITDA is expected to be in the range of $20.1 million to $22.1 million, demonstrating continued progress towards our long-term adjusted EBITDA goal of 20% to 22%. We will continue to invest for growth, as we progress in a measured way toward that goal.

In summary, I'm pleased with the results of our first quarter of fiscal 2018. We had continued strong growth in top and bottom line, showing the strengths in our operating model and demonstrating progress to our long-term goals. We continue to focus on the success of our customers, which underpins the success of our subscription model and drives our business going forward.

So with that, I would like to thank you for your time and open the line to your questions. Operator, can you please poll for our first question?

(Operator Instructions) Our first question or comment comes from the line of John DiFucci from Jefferies.

I have a couple of quick questions. First of all, when you look at the numbers here guys, they look really good. They are really strong. Second consecutive quarter with over 40% constant currency growth and the guide gives us confidence in the future. All the metrics look good. The one, and I think, Peter, both Peters talked about it but you didn't come right on and say that the customer adds were lower than they have been. And I just want to make sure that was probably because of the benefit you got from McAfee and Peter Campbell, you called them micro customers. That's sort of behind you. So you're not seeing that anymore, and are you -- you did talk about the average order value going up. So are we seeing larger deals? And are those deals -- are you also getting some of those deals from McAfee? Because McAfee still have their on-premise business, right, that they didn't end-of-life and they are not going to for at least a couple of years, I think, now.

Right. John, Peter Campbell here. Thanks for the questions and the comments. Just a couple of things there, and taking these a bit one at a time. As we talked about in prior calls, we were saying -- we did say that we were moving away from micro customers. And that our focus has been and would continue to be on the large mid-market, but the distinct movement away from those micro customers. So that your comment that we're not seeing those anymore and that is having effect on the customer numbers, that is absolutely, absolutely correct. I think the last few quarters, some of the customer account in terms of volume of customers we were seeing was atypical. But with Q1 seasonality, which I mentioned in the call, along with the focus away from these micro customers, we're seeing a smaller number of large customers come across. And as you said, as we move away from that, the AOV continues to increase and we saw that in Q1 was a shift from 8,500 up to 8,800, and that's across the entire customer base. That's not just the customers that we added this quarter. So we are seeing larger customers come across, and we did see that in the prior quarter. I did talk to the number of customers we added being 16 customers greater than 100k compared to 6 in the same quarter in the prior year. And some of those are from McAfee as we continue to win some of that -- those mega opportunities. But there are a large number of customers of that size that are underserved out there, and we're going after those from a number of different competitors.

Great. Okay. So that's very clear. And if I might, just a quick follow-up, Peter Campbell. You mentioned the accounting change going from 5 to 6 years. Can you just give a little more detail on that? You're not talking about 606 there, are you? Or are you?

No. 606 comes into effect for us in April of calendar 2018, so our fiscal '19. So that doesn't come into effect until next year. What that is, is we have a small amount of revenue for professional services that comes across and we amortize that over the life of our customers. And as you can see, the effect of 5 to 6 years was about $1.2 million. So these are not kind of massive amounts of revenue. But we amortized and have amortized that over our customer life. And as we moved out and increased the average customer life to 6 years, we saw kind of a slightly downward effect on the forecast for 2018 as a result of that. So that's purely an accounting change and that's purely for the account of the current revenue standard of customer life and how we amortize that. We actually just did not plug this, but we don't expect to see any impact on our revenue for 606 in the coming year.

Our next question or comment comes from the line of Matt Hedberg from RBC Capital Markets.

Maybe as a follow-up to John's question, it was great to hear about the large airline win and I believe there were 16 deals over $100,000, which is great. I'm curious, as you continue to target this larger end of the SMB market, how do you think about additional investments in the sales or distribution? You talked about the large -- I believe, that was the distributor in North America, but just trying to get a sense for maybe the change of investments that are needed to continue to move up into the higher end of this market?

So Matt, great question. I think (inaudible), we have always done a proportion of our business in the 5,000-seat plus space of the area that we would consider larger enterprises. Now importantly, $100,000 deal doesn't necessarily need to come from a 5,000-seat plus organization, it can come from a company with only a few thousand seats. And likewise, our focus isn't on the mega enterprise, although as you pointed out, we do periodically get pulled into opportunities that are very large, like the airline deal that we referenced winning in the prepared remarks. So given that a percentage of our revenue will always come from the upper end of the mid-market and perhaps the lower end of the large enterprise, we're sustaining our investment in that area and continuing to win. But very keen not to take our eye off the ball of that really large scale price of the tens of hundreds of thousands of mid-market organizations. So really our focus has been on putting some flow pricing in to discourage the micro business aspect of it. And so what you're seeing in our numbers is an uptick in AOV, a reduction of new customer logo adds compared to when we had less floor pricing in place. And so that's very consistent. But the goal is to be getting better at all segments at all times. So we're naturally refining our pitch. We're refining our product across all segments, and that will include working with some of the larger opportunities too.

That's great. And then maybe as a follow-up. When we look at your opportunity, we think Office 365 is significant, and I think we're seeing that in the results. And I think you mentioned 24% of your customers are now running Office 365. You also mentioned the take rate of new products is higher in that base than sort of outside of Office 365. Can you refresh our memory? What sort of take rate are you seeing on TTP continuity or archiving, just to give us a sense of sort of the magnitude of that versus sort of outside of Office 365?

Matt, it's Peter Campbell here. Yes, I mean, that is something historically that we have seen. We've seen a higher take-up from a multi-product point of view, from customers that are running 365. As you mentioned, we have 24% of our customer base now that are running us in conjunction with 365. As we also mentioned, we see a higher take-up in many products, first one being continuity, where about 60% of our customers have continuity but 72% and over -- a little over 72% of our customers are running continuity with us when they're on 365. Archiving, we have about 40% of our customers run archiving and about 53% of our Office 365 customers run archiving. And then similarly, you also mentioned TTP, where we're looking at about 42% of our customers have bought our TTP product. But when you look at just the subset of our Office 365 customers, over 50% of them have bought TTP with us. So it's a very strong multi-product uptake when they're on 365. And as you know, the more products that customers buy, the higher the margin and the longer they stay with us.

Our next question or comment comes from the line of Sterling Auty from JPMorgan.

This is Ugam Kamat on for Sterling Auty. I just wanted to touch upon the geographic diversification related to demand. Europe has been a key discussion topic for many security companies this quarter. And in terms of GDPR drivers that are going on, I understand that it's more of a long-term perspective, but what are you seeing right now in the short term? Is it relating to more demand for your solution? Or are you seeing customers getting distracted and trying to push security out for the next year?

Ugam, Peter Campbell here. So couple of points there. So it's a good question. As you know, we're a global organization. About 50% of our revenues are in the U.S. and 50% are outside of the U.S. I mean, we originated in the U.K. or a U.K. company and we've been selling into Europe for many years. And so we're going to continue to invest in all of our core markets. There is a real focus on the U.S., which is our largest market and our fastest-growing market, but we're also going to continue to invest in Europe. We do see an opportunity for us with GDPR. And as we're looking at it now, we're seeing a lot of companies that are still, I think, trying to come to grips with what it means to be compliant in May of 2018. And people are asking a lot of questions and trying to figure out exactly what they have to do. And I think that our solution and our position as kind of a U.K. company that's been selling there for some time and the uniqueness of our proposition to be able to help our customers with GDPR, I think, will see us benefit from that opportunity in the back half of this fiscal year.

Perfect. And just a follow-up on your e-mail security risk assessment product, the ESRA. So I saw a press release couple of weeks back, which stated that around 45 million e-mails passed from other incumbent solutions and, of which 25% were unsafe. Have you seen any customer convergence from enterprises that took on ESRA and noticed that their current solution is not capable of detecting the threats? And if yes, what is the conversion rates you're seeing?

Great. So Ugam, Peter Bauer here. Just -- ESRA is not a product that we sell, per se. It's a security risk assessment tool that we offer to prospects in order for them to understand their risk profile and then ultimately, convert -- give us the opportunity to solve that problem for them by migrating or adding our solution. So we run that solution continuously with many different organizations and the report that you're referencing is the quarterly update that we provide that gives the latest view on what we're seeing on a cumulative basis having put ever more traffic, ever more content through that solution. It's very effective for us as a conversion tool and as a way of quantifying the additional benefit that we would bring to customers over and above whatever their incumbent is. It's also effective as -- the report itself is also effective as the conversion tool, because generally, not every prospect needs to run an ESRA to understand. They can look at the experience that has come from other organizations running it and they can get a pretty good picture of what it might look like for them. So it's a great tool. It's just another way in which we can quantify for customers or give them an ability to test drive the Mimecast technology in some way ahead of a purchase.

Our next question or comment comes from the line of Shaul Eyal from Oppenheimer & Company.

Pete Bauer, one of your -- one of Mimecast's major differentiator is the multi-tenancy architecture that you guys bring to the table. In recent quarters, have you started to see that as becoming a key decision-making point to your customers over some of the competition out there?

Shaul, great question. So from an architectural perspective, multi-tenancy has tremendous benefits for us as a provider in terms of our ability to address a very large market opportunity, denominated in number of organizations. So to be able to spin up services very efficiently for tens of thousands or in time, hundreds of thousands of organizations. So profound benefit to us operationally, profound benefit to our partners, in terms of our speed of being able to provision services. From a customer point of view, I think there's 2 primary benefits that they are drawn to. And in many situations, these are important parts of the deal-making process. But first is the fact that the infrastructure is a grid-style infrastructure. So when a customer signs up and they receive a tenant, that tenant is being serviced by hundreds of devices underneath the cupboard, which is very different from when a customer works, perhaps with a competitor and they are provisioned with a hosted appliance or a host of virtual machine and their service is -- they have dedicated hardware and software resources specifically for them. So the benefit for a customer in being serviced by hundreds of devices across a grid and across multiple data centers is a performance and a reliability benefit. So the speed of our archive search, the resilience of our e-mail gateway infrastructure, those are great benefits that customers are really drawn to. I think the second key benefit of this integrated architecture is the ability for us to respond faster to security threats. So because we have such a large volume of customers, as we detect threats, all parts of the grid, all other tenants can instantly get the protection that is afforded a customer that's under a particular attack. So there's a reliability and a performance benefit in this architecture for customers, and there's a security benefit in terms of speed of response and the power of the immune system that is built into this infrastructure. So very attractive.

Got it. Got it. And second question, if I may so. You guys are bringing on board in the U.S. and site at one of the bigger security VARs out there. Are there sales people already on board or there's going to be like 1 or 2 quarter education phase? How should we think about it?

So typically when we bring on a partner, there is a ramp-up and there is a training process and there is an alignment of the sales organization. So I think that's very typical in our engagement with Insight. So we're not changing any of our forecasts or pointing to any sort of bump expected directly as a result of signing them up as a customer. But we're very excited that they form part of our channel and our go-to-market expansion opportunity in North America. And we're looking forward to doing great things with the folks at Insight.

Our next question or comment comes from the line of Alex Henderson from Needham.

So if we can go back to the geographic split for a second? So a lot of the companies in both security and networking space have seen some slowdown in the high-end customer base in Europe as a result of the consideration process around what's the best way to attack the GDPR problem. Did you see any evidence of that? It seems to be somewhat more skewed to the higher-end customers and less skewed to the lower-end, midrange-type companies. I would think that you might be able to see some of that differentiation.

So I think -- it's Peter Campbell here. So I think with GDPR, the opportunity really hasn't -- hasn't really begun in earnest yet even from a kind of a small, medium and a large customer point of view. I think companies, as the larger customers have been, I think, spending a longer amount of time trying to evaluate what it means to them. And sort of the mid and some of the smaller customers are in the process of doing that, but maybe at a more compressed time frame. So I do think that, while the larger customers are maybe taking their time to see what really -- what the impact of that are as they are much broader and a larger organization, the medium and the small customers are doing something similar but in a smaller time frame, but they are earlier in that -- they are earlier in their discovery than say a larger customer would be. So I don't think you're really seeing that much from the account of what you'd expect from that opportunity at this point in time. I think it's still to come. Because even though they're smaller and they're not taking it long to figure it out, they are at the very beginning of that process. So I think, again, we'll see that a little bit later in the year.

So you are seeing some slowdown in the decision-making process at larger companies because of how do I do these considerations?

So I think for us, I don't know that we're seeing any slowdown in the addition of customers in Europe to our services. We are more of a mid-market-focused organization, so maybe we're not seeing the same kind of things that those who focus solely on the very large customers would. I think what I'm trying to highlight is that smaller customers are at an earlier stage of evaluating what it means to them. So I'm not -- we're not seeing that as a part of our selling cycle just yet. But I do think that it will be an opportunity down the road. I would say I'm not seeing a slowdown of large customers, but I've not yet -- I wouldn't say that's the case. But what I would expect to see is to see more mid-size customers come our way, but I don't expect to see that yet as they are still evaluating it. That's the way that I would frame it.

On a broader strategic perspective, one of the things that I've heard from virtually every security company I have talked to over the last 6 to 9 months is that user behavior analytics and other Big Data applications to the data being captured on the security front is becoming the critical determinant to performance and viability of security companies. To the extent that you guys are sitting in what looks to me like the high ground of the security market relative to being the focal point, entry point into the enterprise, how do you see you taking that strategic advantage and expanding it from here? Will you be going next into social media? And how do you see expanding that into cloud applications?

Yes, that's a great question. So if we think about our platform and we think about the fact that all of our products and technologies are both on a common software backplane that we call Mime | OS with a strong micro services infrastructure and a common API set on the back end and as we build out more products, they can all seamlessly benefit from all of the code and capabilities and underlying Big Data infrastructure that our current products can benefit from. That certainly sets the stage for exploiting those capabilities with new products into certain adjacent areas around e-mail and even going deeper into some other areas of e-mail security and data management. So yes, we're very excited about that. You've seen us release a new product in the last couple of months called Internal E-mail Protect, which really does look at that issue of the malicious or the compromised insider inside an organization and leveraging some of those techniques to help organizations deal with the threats that can be presented on that front. So we absolutely expect to continue this journey, to continue building more capabilities, more micro services in the back end and extending the product portfolio to be able to benefit from those in different areas of the security and data management and cyber resilience market.

If I can throw one last question, and great detail around the take rates around the Office 365. Where do you think Microsoft is at this point, in terms of converting the 90 million-plus enterprises globally to Office 365? How far into that process do you think we are at this point?

Yes. We've sort of commented on this from time-to-time. It's a good question. And it comes up where people are trying to get a read on it. I think that our customer base is a reasonable sort of proxy for the world and its migration to Office 365. So we're at...

20%.

24% of our customers using us with Office 365. So whether -- we might lag the market slightly because we're in certain geographies where Office 365 take-up is lower because of more local services like South Africa, for example. But if one assumes that terminal velocity for Office 365 is, I don't know, we'll pick an arbitrary figure, 75% of the market, we're at 25% today. That's 1/3 of way in. And Office 365, I guess, has been in market for more than 5 years. So let's assume 1/3 of the market moves every 5 years, you've got another, I don't know, maybe it accelerates at a point, 5 to 8 years of migration. So that would be my read in terms of where we are in the general cycle of moving to Office 365 for now.

Our next question or comment comes from the line of Catharine Trebnick from Dougherty.

Hello, can you hear me now?

Yes.

So my question is around North America. You've really done a very good job in North America. Is there anything, in particular, that you've done with adding new partners? Can you give us some of the background flavor? And how you're gaining more larger partners like the recent one, Insight? And then, what are some of the mechanics that are going into driving the good adoption in this mid-market segment?

Great. Thanks, Catharine. So yes, we made program investments in channel partner recruitment, channel partner enablement and the like. I think what the most significant thing is that we do is we focus on having an excellent product and, in particular, focus on really demonstrating leadership in the burning issues of e-mail security. And I think partners are really looking for, not just any product, they're looking for a great product that they can offer at a reasonable price point, delivered as a cloud service that they can really take to customers of all sizes. So there's certainly no shortage of solutions that will work for the high-end of the market, but then will the pricing scale done and enable them to go and have a conversation with thousands of mid-market customers with that same technology? And likewise, there are plenty of low-end solutions that don't quite cut it when dealing with advanced threats that can be sold to little customers, but can they take those technologies, can they take the knowledge of those products and scale them up to some of their larger opportunities? And so we're really in this exciting sweet spot of being able to scale up and scale down and remain relevant to those partners as well as demonstrating a great opportunity to land and expand within those accounts. So getting into those accounts, landing with perhaps an e-mail security opportunity but then really being able to expand out into the broader cyber resilience suite that we offer and grow their revenue opportunity, grow their customer loyalty and the stickiness of that proposition over time. So I'd really place our product at the center as a keystone of our formula for success in both North American market generally, but also with those channel partners.

And then just if I may, one follow-on. The government vertical is really with Office 365 and their movement there. What are your plans to really tackle that market?

So Catharine, our focus is on state and local governments. We see that as a big opportunity. It's an area that we have had some success. Typically, lean organizations in IT there not able to deal with a lot of complexity, not a lot of budget, looking at how they can leverage cloud solutions. And so we see that as the focal area, particularly in the North American market. In some of the other markets that we're in, we have had good success with both central government organizations as well as state and local organizations. And in fact, some of our biggest clients in Africa, some of our biggest customers in the U.K., and some of our biggest customers in the Australian market are, in fact, government customers. So we've transferred a lot of that knowledge into our work in the U.S. market too.

Our next question or comment comes from the line of Gabriela Borges from Goldman Sachs.

For Peter Campbell, I'm hoping you can level set us on the magnitude of customer adds and the average order value numbers, as we go through the year. Did the 900 new customer number in 1Q '18, how did that compare to your original expectations when you guided for the quarter? And as we think about the rest of the year based on the pipeline, can you give us any color on how to model that going forward?

Sure. So, as you know, we guide to revenue rather than customers. But as we kind of guided, we looked at the opportunity in front of us. We were looking -- we start -- obviously, we started with the base. The basic customers, we look at the retention rates and then we look at the new customer adds and the size of customers that we're going to add at any given quarter and any given year. So we did know that we had moved away from those micro customers, as I mentioned earlier, and we didn't know that those micro customers, while they can increase the customer account, like the number of customers that are added, they don't affect the revenue as much. So if you consider in previous quarters when we tried to -- we've called out some of the larger numbers are very small like sub-10 seat customers, 800 sub-10 seat customers is one sub-8,000 seat customer. So these large numbers of very small customers may have been increasing the customer number, but not affecting my revenue as much. So I was able to kind of guide my revenue a little -- with a bit more clarity, because I know that the larger volume of these tiny customers won't affect it as much. That said, and you mentioned, talking about AOV and about customer numbers going forward, I do expect -- so the first thing I would call out is Q1 seasonality, because Q1 typically is a smaller quarter for us. Q4 is the biggest quarter, Q1 is often the smallest quarter. So I would expect the customer numbers -- I expect those customer numbers to be moving in a kind of upward direction throughout the rest of the year. But I wouldn't expect them to kind of shoot heavily away from the 900 that we saw in Q1. I expect them to be more in line with that, and I would expect that we're going to see -- as they moved away from the micro customers, we're going to see more larger customers, and you're going to see that AOV shift up throughout the year as it did in this quarter from 8,500 to 8,800.

That makes a lot of sense. And a follow-up for Peter Bauer, if I could. It's on the commentary on operational uptime and the high availability for (inaudible) that you guys are able to achieve is really interesting. How does that compare to competitors? Is that conveyed via an SLA at the time you sign the deal? Is it a function of maybe the multi-tenancy and the integrations with the continuity software? Any additional color there would be helpful.

Yes. Absolutely. So I mean, e-mail is mission-critical, that's not news. It's critically important when a customer is choosing somebody that is going to receive and deliver all your e-mail from you at an internet level. Irrespective of the security functions that the infrastructure provided to, to send and receive e-mail is -- it's critical that it operates in a high availability mode. And our architecture is very much designed for that capability. What we do is offer the leading SLA in the industry in 2 key areas. The first is 100% uptime SLA and that is something that somebody might argue and say, "Well, it's impossible to provide an uptime of 100%." We come extremely close, but that's the standard that we hold ourselves to and we are -- we'll compensate customers if we ever fall short of that. So that's a unique standard that we hold ourselves to, and we have confidence in that, I think, far beyond our competitors because of the architecture and because of our track record in delivering that. I think the second area is SLAs around the actual performance of the functionality of the system, and we offer SLAs around these 2 areas. One is security effectiveness, so spam and malware protection, and the second area is in terms of archive search speed, where we have the fastest SLA on archive search speed for the industry. And that is despite the fact that extremely large volumes of data are housed in our system and there are very high number of search requests that are made against our system because it's been optimized and presented with end-user tools as well as the discovery and compliant professional using it. We offer a 7-second search SLA. But we actually deliver consistently well below 3 seconds in terms of our search performance. So that architecture translates directly into -- we put our money where our mouth is and we offer specific performance SLAs, and that's very compelling to customers, particularly customers that have suffered outages or performance problems with competing solutions, whether those be on-premise technologies that they've had to run themselves or cloud providers that have let them down in the past.

(Operator Instructions) Our next question or comment comes from the line of Saket Kalia from Barclays.

I think most of my questions have been answered here, but maybe one for you, Peter Bauer. And again, apologies, if this has been asked already. But how did the internal e-mail protect product perform in the quarter? I think we got about 100 customers last quarter introduced right really at the tail end of RSA. How did that do this quarter? And more importantly, how would you compare the adoption of IEP versus end-pricing perhaps of IEP versus TTP at sort of a comparable point in its life cycle, if that makes sense?

Yes. Great. So Saket, as you say, we introduced IEP a couple of months ago. I think when we last spoke, as you say, was about 100 customers. We're approaching double that now, so encouraging uptake of that solution. One of the interesting things -- we consider that part of that TTP family. It extends the revenue of the ARPU headroom within the TTP family, so it creates some additional white space there. It's early days. So we're seeing adoption and we're talking to customers about it. I think we'll have good attach rates of the solution with TTP. It's obviously not as painful as spear phishing or impersonation in terms of the capability at something that's relevant to a subset of our TTP customers, but we're not sort of forecasting what percentage of it is likely to take it up. But we're watching it build nicely, and we think that it's going to be a good incremental revenue generator as part of the product portfolio. And certainly, it's a used case that our ability to address is also relevant to landing some new customers too onto the platform.

Thank you. I'm showing no additional questions in the queue at this time. I'd like to turn the conference back over to management for any closing remarks.

Great. Well, everybody, thanks for joining the call today and for your interest in our results. We've enjoyed presenting, and we've enjoyed answering your questions. And we look forward to doing this once again in about a quarter's time. Thanks, folks.

Ladies and gentlemen, thank you for participating in today's conference. This concludes the program. You may now disconnect. Everyone, have a wonderful day.