Mimecast Limited (MIME) 2021 Q2 法說會逐字稿

Good evening. Welcome to Mimecast's earnings call for the fiscal second quarter 2021 ended September 30, 2020. I am Robert Sanders, Director of Investor Relations.

With me on the call tonight are Peter Bauer, our Co-Founder, Chairman and CEO; and Rafe Brown, our CFO. (Operator Instructions)

We will make forward-looking statements regarding future events and the future financial performance of the company. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those in the forward-looking statements. The COVID-19 pandemic creates additional uncertainties when making forward-looking statements. We are providing guidance on a good-faith basis aligned with SEC recommendations. We caution you to consider the important risk factors that could cause actual results to differ materially from those in the forward-looking statements contained in today's press release and on this conference call. These risk factors are further defined in Mimecast's most recent Form 10-K filed with the Securities and Exchange Commission.

During this call, we will provide both GAAP and non-GAAP financial measures. These non-GAAP measures are not intended to be considered in isolation from, a substitute for or superior to, our GAAP results. A reconciliation of GAAP to non-GAAP measures, and the reasons for our representation of the non-GAAP information, is included in today's press release, which can be found in the Investor Relations section of our website.

The date of this call is November 2, 2020. Any forward-looking statements we make today are based on assumptions that we believe to be reasonable as of this date. We undertake no obligation to update these statements as a result of new information or future events.

Now I'd like to turn the call over to Peter Bauer.

Good afternoon, everyone, and thanks for joining us. I am pleased to share with you that we delivered results at the high end of our guidance range this quarter, due in large part to our solid execution amid continued pressures relating to the COVID-19 pandemic.

In our second quarter, we drove revenue of $122.7 million. That's up 19% year-over-year, with strong free cash flow and EBITDA growth, and we added approximately 500 new customers. While Rafe will take you through more details of our financial performance and our outlook, later in the call, I want to share with you how we're thinking about the road ahead from a business and market perspective, with a focus on the threat landscape affecting customers, the impact of COVID-19 and the work we're doing to both protect our customers and grow our business profitably.

As we all know, the pandemic has posed challenges for companies of all sizes and across industries, including Mimecast. In particular, market pressures are muting the impact of some of the actions we've taken to accelerate our growth as we confront the challenges of slower project decision-making in the enterprise and the economic impact, especially on the smaller business segment. We are ensuring that we offer the best value to customers by expanding and innovating our capabilities, while at the same time, running our business efficiently and profitably with Rule of 40 thinking as an important context. We remain focused on achieving the targets that we set out in the long-term model, which we described in our analyst day earlier this year in February. Though COVID has the potential to impact the timing of how this plays out, we're focusing right now on the elements we can control, winning new customers, taking care of them, selling them additional services, all the while taking steps to build our bottom line.

So for example, we've continued strategic hires that we expect to have a positive impact on advancing our enterprise strategy, but we're reducing overall hiring. We have also shifted towards virtual meetings and events. Given how successful we have been in using remote collaboration tools, we expect many of the related cost savings to be durable after a return to a more normal work environment as we rethink where and how we work and how we engage with customers.

To that end, we're evaluating hybrid work structures that allow people to balance office and remote working time, which we expect to drive real estate savings over the long term. These shifts enable us to continue to build the bottom line while also further investing in R&D and other strategic growth initiatives. We are building our leadership in the industry by continually evolving our platform to anticipate customer needs and the changing nature of cyber threats. Through successful execution of the strategy, we have consistently delivered top line growth as we have seen the rise of blended attacks that involve e-mail as well as social engineering, fraudulent web properties and phishing sites, malware and ransomware hosted on cloud infrastructures and non e-mail messaging systems being used as part of the attack chain, we have continued to innovate to protect our customers.

Our holistic e-mail and messaging security 3.0 strategy, and integrated suite of offerings, gives customers an advantage in defending against these blended attacks. As a reminder, we've expanded our product portfolio, now over 12 products in our solution framework versus 7 5 years ago. Our Zone 1 offerings include perimeter defenses and threat detection through our secure e-mail gateway and targeted threat protection, or TTP, platforms. Zone 2 comprises internal e-mail protection and awareness training, which focuses on strengthening the human factor. Zone 3, including our DMARC Analyzer and Brand Exploit Protection act as an offensive countermeasure that actively fights back against cyber threats. Partnering and shared threat intelligence has also elevated Mimecast's role in enhancing cyber resilience, especially in larger organizations.

Recently Mimecast joined CrowdStrike's Elevate Partner Program, and joint customers can leverage their current security investments to benefit from a deep technical integration utilizing our APIs. Our platform and partnerships of significant opportunity upmarket in the enterprise space and recent market expansions, such as Central Europe, Canada and the public sector, position Mimecast for sustained long-term success.

Now given our global footprint and experience, we view the public sector as a large untapped market, and we actually saw good progress there this quarter. In one of our international markets, a department of justice purchased Zone 1 for 20,000 seats. And a department of health purchased a broad suite that included archiving for 4,000 seats. A U.K. government agency purchased Zone 1 for 30,000 seats. We also achieved U.S. FedRAMP Ready status this quarter. And upon receiving full approval, this will open up significant additional public sector opportunities in the U.S., which we believe we're very well positioned to capitalize on. As our results this quarter show, this opportunity extends beyond the U.S., and Mimecast is already competing for and winning engagements with federal, regional and local government agencies around the world.

We also view Central Europe and Canada as potentially significant growth drivers longer term and continue to make progress on both in this quarter. We drove over 100% growth in our Central Europe market this quarter, making it, again, our fastest-growing region. This included a storied watchmaker who purchased our archiving services for 1,000 employees. We believe Mimecast is very well positioned to service customers of all sizes, including the vast number of SMB customers found across the Central Europe region.

In Canada, last week, Mimecast hosted a virtual ribbon cutting, commencing commercial operation of a new Mimecast data center (inaudible), spanning Toronto and Montreal. With data residency on the minds of many organizations, we believe giving Canadian customers the option to store and process data in-country will accelerate our ability to penetrate this dynamic and fast-growing market.

We were also successful in upselling and cross-selling to existing large enterprise customers, and saw especially strong engagement with our Zone 2 and Zone 3 offerings. For instance, a U.S. financial services customer added additional services in Zone 2 and 3 as well as Sync & Recover, one of our cyber resilience extensions for 3,000 employees, resulting in a multi 6-figure deal. This is a good example of the power of our multi-service platform to consolidate vendors and help simplify IT for the customer. Zone 2 and 3 are our newest offerings, and I'm really pleased to see that the targeted investments we've made to innovate on our platform and broaden our offerings are driving returns.

In another example, a U.S.-based engineering and construction company added archiving, our highest-value service, for 25,000 employees to their current security subscription. Now our excellence in archiving is another reason customers adopt additional services. And Mimecast was identified as a leader in Gartner's Magic Quadrant for enterprise information archiving for now the sixth year in a row. These results verify our belief that expanding our share in enterprise customers will enable us to drive greater upsell and cross-sell. And as Rafe will explain, this increased engagement and upsell drives higher average order values.

Now let me turn to efforts to increase penetration in large enterprises and acquire SMBs that are switching security platforms. We continue to win large enterprise customers. For example, this quarter, an international professional services firm purchased Zone 1 and 2 for 10,000 employees. We also continue to acquire customers previously with Symantec. For example, a global consulting firm with 7,000 employees purchased Zone 1 and 2 defenses, our secure messaging service and our continuity service to ensure communications uptime, even when other service providers experienced downtime. In fact, we recently witnessed such an event as Office 365 was offline for a period of time. Mimecast continuity customers are more resilient than those simply running naked on Office 365.

While our second quarter top line growth is trending below our long-term target of 17% to 21%, we believe that the initiatives we're implementing now will continue to gain traction and drive results as market conditions improve. So in summary, amid a challenging market environment, we are adding new customers, we're cross-selling and upselling to existing customers and we're operating efficiently and profitably.

And with that, I'll turn it over to Rafe to review the details of our results. Rafe?

Thank you, Peter. I'm pleased to report that we exceeded the high end of our guidance for revenue, adjusted EBITDA and free cash flow for the second quarter of fiscal 2021. Our results continue to demonstrate our ability to deliver both top line growth and bottom line margin expansion amid a challenging operating environment.

Before I jump into our financial results for the quarter, I would like to take a moment to discuss the impact of COVID-19 on our business. When the pandemic began to take hold in our core markets in March, we undertook an extensive review of our business to understand what levers we had at our disposal to protect our customers, support our team and derisk our business. Despite the challenges of the past 2 quarters, we learned a great deal about our ability to work remotely and believe there are a number of important lessons that will allow us to build ongoing efficiencies into our business. For example, we believe we can drive long-term improvements in our facilities, travel, marketing and event-driven budgets. We are also closely managing headcount increases to ensure we are responding to the business demands of this now prolonged pandemic.

As Peter noted, we worked tirelessly for our customers to deliver world-class protection in the face of ever-increasing risks. As the impact of COVID-19 continues and as infection rates are seemingly reaccelerating, our customers and our teams' safety and health remain our top priorities.

Let's now turn to our financial results. In the second quarter, we generated revenue of $122.7 million, which represents a 19% improvement over the prior year in absolute dollar terms. Adjusting for $200,000 of currency tailwind, our constant currency growth rate over the prior year also stood at 19% for the quarter. Note that since providing guidance in August, foreign currency fluctuations positively impacted our second quarter results by $300,000. Bolstering our top line results were continued year-over-year increases in average order values, or AOV. Calculated at October 26 FX rates, AOV for all customers stands at $12,700, up approximately 9% over the prior year in constant currency terms. This trend of improvement is attributable to a favorable shift in the average number of services per customer across our customer base. Currently, at 3.4 services per customer compared to 3.2 services this time last year as well as our increasing success with larger organizations, despite these strong results, it is clear COVID-19 created challenges that were felt in the second quarter.

As we noted over the last 2 earnings calls, new and upsell pipeline generation activity was significantly impacted by COVID-19 in the early months of the fiscal year. Given the time lines to convert our pipeline to bookings, we expected there to be an impact on Q2 business. Looking at our current pipeline, typical lead times would now suggest that larger accounts, where pipeline generation activity has improved off its lows, will show a sequential rebound in enterprise bookings by the fourth quarter. We added approximately 500 customers in the second quarter, approximately 100 of which came from recent acquisitions, merging into our systems and thus entering into our official customer count. As we noted last quarter, the COVID-19 pandemic is having an outsized impact on our smaller customers. However, we did see decreases in net customer additions across all segments when compared to the prior year. As the COVID-19 pandemic continues, we expect to see the net new customer count metric continuing to run at approximately these levels for the near term.

Net revenue retention totaled 105% for the 4-quarter period ended September 30, in line with our expectations.

Looking at its components, upsell totaled 112%, helped by strong interest in our Zone 2 solutions of internal e-mail protection, which added 700 customers in the quarter; and awareness training, which added 400 customers; as well as our Zone 3 DMARC solution, which added 100 customers. Downsell and churn totaled 8% as of the end of the second quarter, driven most significantly by increases in our downsell run rate, which clearly reflects the economic challenges our customers are facing.

Returning to our gross margins, we recognized a 77.5% non-GAAP gross margin, up 130 basis points from the second quarter of the prior year. This continues our progress towards our long-term goal of achieving 80% non-GAAP gross margins.

Adjusted EBITDA for the second quarter totaled $33.6 million, representing an adjusted EBITDA margin of 27.4% compared to $20 million or 19.3% in the same quarter of the prior year.

On a net basis, the quarter derived approximately $3.5 million of discrete bottom line benefit as a result of COVID-19-driven cost reductions, consisting primarily of travel savings. Thus, even excluding these cost savings from the computation, our adjusted EBITDA margin would have been approximately 24.5%, representing over 500 basis points of EBITDA margin expansion compared to the prior year. We achieved this expansion through operational efficiencies driven by gross margin improvements, resource prioritization throughout our operating expenses and year-on-year improvements in our real estate footprint. This improvement speaks to our progress executing on the stated goal of simultaneously delivering top line growth and expanded margins.

Now turning to the bottom line. Our non-GAAP operating profit for the second quarter was $25.1 million or 20.4% of revenue, an improvement of 790 basis points from the prior year. Our non-GAAP net income for the quarter was $20.7 million or $0.32 per diluted share based on 65.6 million fully diluted weighted average shares outstanding.

Our non-GAAP tax rate was 19.1% for the quarter. As we have implemented a number of changes to our global operating structure, we now are modeling a full year non-GAAP tax rate of approximately 20%. We reported GAAP net income of $10.1 million for the second quarter or a profit of $0.15 per diluted share, again, based on 65.6 million fully diluted weighted average shares outstanding.

Our GAAP tax charges totaled approximately $600,000 in the second quarter. Third quarter tax expense is expected to be approximately $2 million. Our full year GAAP tax expense is currently estimated to be approximately $3 million.

Turning to cash flow. Second quarter operating cash flows totaled $31 million or 25.3% of revenue. Free cash flow jumped to $21.6 million for the second quarter or 17.6% of revenue, driven by higher profitability and by better-than-expected collections in the quarter. Again, demonstrating our business model's ability to deliver bottom line value as we build toward our long-term goal of 23% to 25% free cash flow margins.

As of September 30, Mimecast had $231 million of cash on the balance sheet, up $57 million from the beginning of the year. Net of debt, our current cash balance stands at $123 million giving us significant strength to manage the challenges of the current economic environment.

Let me now turn to guidance. For the third quarter of fiscal 2021, revenue is expected to be between $126 million and $127 million or 15% to 16% growth in constant currency terms. Our guidance is based on exchange rates as of October 26, 2020, and includes an estimated negative impact of $500,000 resulting from the strengthening of the U.S. dollar compared to the prior year.

Adjusted EBITDA for the third quarter is expected to be between $28 million and $29 million. At this point, we are assuming very little travel in the third quarter, with travel resuming in the fourth.

Free cash flow for the third quarter is expected to be approximately $16 million.

Turning to the full fiscal year. Fiscal 2021 revenue is expected to be between $490.5 million and $493.5 million or 16% to 17% growth in constant currency terms. Adding the details, foreign exchange rate fluctuations are negatively impacting this guidance by an estimated $4.4 million compared to the rates in effect in the prior year. The prior guidance for fiscal year 2021 provided in early August was $490.6 million at the midpoint. We are decreasing the midpoint of our full year guidance by $1 million in constant currency terms due to the continuing impact of COVID-19. This decrease of $1 million is being positively impacted by $2.4 million of foreign exchange tailwind that has arisen since the rates used in our August call, resulting in the midpoint of our full year guidance moving up by $1.4 million in absolute dollar terms from $490.6 million to $492 million.

We are raising full year 2021 adjusted EBITDA guidance to between $109 million and $110.5 million. At the midpoint, this represents an $11.5 million or a 230 basis point improvement over the prior guidance. A significant accomplishment, even as we plan to continue to hire in the back half of the year to support and enhance key product development initiatives and our ongoing shift of resources toward our enterprise go-to-market efforts.

We are also raising full year 2021 free cash flow expectations to a range of $82.5 million to $84 million, reflecting a free cash flow margin of 16.9% at the midpoint of our revenue guidance. This is an 820 basis point improvement over the prior year and 100 basis points improvement over the prior guidance provided in August.

To conclude, we are pleased with our second quarter results. And despite the challenging macro environment, the Mimecast business is demonstrating its resilience, continuing to grow and delivering bottom line margin expansion.

With that, I'll turn it back to Peter for some closing remarks before we open the call up to questions.

Thank you, Rafe. Cyber Resilience is more important than ever. We have an industry-leading technology platform and a predictable business model. As trends shift towards cloud architecture for e-mail security and customers consolidate their other e-mail service needs, we believe we are uniquely positioned to capture additional market share. There remains a very large market opportunity and favorable market drivers that position us for disciplined profitable growth for years to come, and we believe we have the right strategy and the right team in place to deliver.

In the near term, we will remain nimble and execute with discipline, taking actions within our control to deliver strong value to shareholders even in a tighter growth environment.

Operator, let us please now open the lines for questions.

(Operator Instructions) And our first question is from Shaul Eyal with Oppenheimer.

Congrats on the performance and an improved outlook. Two questions on my end, Peter or Rafe. Back in your -- during your analyst day February, the beginning of RSA, well, seems right now like really ancient history. You've provided some metrics about the Office 365 customer base and how underpenetrated that landscape is. Can you talk to us maybe about any changes you've seen since that analyst day? Have you continued to see ongoing success penetrating that customer base and shifting them into the Mimecast platform? And I have a follow-up.

Yes. Great. Thanks, Shaul. Yes. So at the analyst day in February, we certainly outlined some of the size of the market available to us in Office 365. Just as a reminder, today, over 20,000 organizations use us in addition to their -- to make their Office 365 investments more secure. I think what we've seen during COVID, generally, is a little bit of a slowdown in project decision-making and because of economic pressures, some organizations simply sticking with what they've got for the time being.

Having said that, organizations that are in a position to make decisions and implement new systems and improve their security, certainly, we've seen a continuation of that theme, and we've continued to build our Office 365 customer base with those organizations quite well since February, too.

Got it. Got it. And Peter, you've also mentioned the archiving being the highest-value product offering in your prepared remarks, if I'm being correct. I know it's hard to provide sort of metrics about maybe the bundled versus unbundled archiving offerings. But can you or Rafe maybe provide us with a little bit of color whether the archiving is mostly going out bundled or unbundled during the quarter or kind of just generally speaking over the course of the past few quarters now?

Great. So we see probably the greatest uptick of archiving taken as an attachment alongside other solutions of ours. So customers may come along because they're looking for our e-mail security solution and then learn about the opportunity to do archiving with us alongside that. And archiving has a diverse set of use cases that can range from security requirements to data resilience through to compliance, e-discovery, even storage management, getting out of the legacy archiving business. So we're quite often picking up archiving business along with the security sales motion. We do have certain situations, typically larger-enterprise situations, where customers are buying archiving stand-alone. And those are typically bigger deals. And from a logo count point of view, those would be the minority of deals.

Given this last quarter, we added 200 new archiving purchases to our set. And then we also had a -- an archive extension, the Sync & Recover offering, used to be called Archiving Power Tools, with the Sync & Recover capability, 300 additional customers added Sync & Recover during this last quarter. So nice growth in our archiving business there.

Our next question comes from Matt Hedberg with RBC Capital Markets.

I guess I wanted to ask about Europe. There were certainly some more positive comments on Central Europe, which is really great to hear. I know you guys invested a bunch in continental data centers there over the past couple of years. I wanted to ask a little bit more about sort of the expectations for that particular region. And then also U.K., I know, obviously, you guys have a lot of exposure there. A bit more -- an update on the U.K. would be helpful as well.

Yes. Thanks. So we are quite pleased with the Central European team. It is still coming off a much smaller base than some of our more established locations, but it's nice to see them getting their feet under them and really coming together to execute. We actually think there's quite a bit of long-term opportunity in Central Europe. I mean, to a great extent, we're just scratching the surface with our operation there. So this should be a growth driver for us for years to come.

Turning to the U.K. It's a bit of a complicated situation in the U.K. right now because there is -- we're hearing now they're going back on lockdown due to COVID, but we also are dealing with the Brexit side of the house. That said, we've seen some nice strength on a number of deals, a couple of which were featured in Peter's call-out that he went through on the call. So much like the rest of the world, business has to be done, and the teams out there hustling to keep moving the ball forward despite some of these shorter-term challenges.

That's great. And then one of the things that I -- that certainly you guys highlighted on the call that I thought was great to hear was public sector success. Clearly, it is a huge market globally, and it sounds like there was some good progress there this quarter, both here in the U.S. as well as abroad. Maybe a bit more on that just in terms of kind of the health of that market. And when we look out another couple of years, how important of a driver could that be to sort of your long-term growth rate that you talked about at analyst day?

Yes. So Matt, in the prepared remarks, I called out a number of solid public sector wins in our international markets. And that's really building on our public sector customer base that we started building up internationally some time ago. Well, I think what we're really excited about over and above that is this North American public sector opportunity. I mean, particularly, as we make progress with our FedRAMP certifications now having the FedRAMP Ready status, having dedicated grid infrastructure, data center infrastructure for that client base. And beyond that, besides just the specific agencies, there are obviously a number of people in the supply chain around public sector that are looking for these certifications to give them confidence that they're working with cybersecurity providers that are going to be acceptable to their major public sector clients. So we actually think there's quite a lot of spend and the sort of halo ring effect around that of additional spend that we're setting ourselves up to have greater access to and really an increase in the opportunity for our teams.

Our next question comes from Saket Kalia with Barclays.

Peter, maybe for you. I think you hired a new Head of channel sales recently. Can you just refresh us on what percentage of the business roughly is coming through the channel currently? And how you think about your channel strategy going forward?

Great. Thanks, Saket. So yes, we recently announced a new appointment onto my Chief Revenue Officer's team, that's Jon Corini, who is now running global channel sales for us. He started a couple of weeks ago. So in terms of our channel mix, it's actually quite a high percentage of our business that is done through channel today. And that, obviously, as a total mix across our entire base, has some history in it. So as we've gone into new markets, sometimes the initial part of the business is done on a direct basis as we recruit new channel partners. And we've been really pleased with our channel progress over the last couple of years and really looking to refine that and develop that in a couple of directions. On the one hand, as we've made progress upmarket, with the enterprise, looking at what are the right type of channel partners to help us continue that growth is what we've demonstrated there. And then secondly, downmarket in the MSP and the MSSP space, where we have a considerable number of partners but probably room for improvement in terms of programmatics and how we work with those partners. So we're excited about that opportunity with the channel on both ends of the market.

That makes a lot of sense. Rafe, maybe my follow-up for you. Great to see the EBITDA beat this quarter. I think the guide for next quarter implies margin down sequentially a little bit. I know you talked about some travel maybe starting to come in later on this year, but is there anything to consider just in terms of seasonality of expenses or pace of hiring that would maybe drive those margins down a little bit here in the third quarter?

Yes. As we look to the back half of the year and increasingly start preparing for the following year, there is some more hiring activity that we have targeted in the next couple quarters. Very much focused on some of the things Pete called out in our strategy to making sure we're funding R&D heads for our key projects as well as on the go-to-market side, some enhanced resources on the enterprise side of the house, which is a big priority for us, as you know. And as you noted, we do expect some travel in the fourth quarter if things free up, of course. And then finally, just the -- our annual raises kicked in at the beginning of this quarter. So that's probably also touching the numbers as well.

Our next question comes from Keith Bachman with Bank of Montreal.

My question is related to bottoming. And just wanted to get your thought process on a bottoming sequence. How does it unfold? And to be more specific, the net retention rate, I thought it was actually pretty good this quarter at $105 million. You had forewarned us that it was going to drop a little bit. When do you see that bottoming? And I know that your calculation is on a latest 12-month basis, so it's a little bit different. And the corollary part is: Might your revenue growth actually increase before your net retention rate bottoms? So that's my first question. And I have a follow-up, if I could.

Yes. No, thank you for that. I think the virus is humbling people who are trying to forecast exactly how quickly it will come and go. Certainly, right now, as we sit here looking at the virus rates picking up, that makes it particularly challenging. The way we've approached this consistently through the year is try to be as transparent as we can in the details of a number of metrics, as you pointed to, like on the net revenue retention side.

What we do expect is over the coming quarters, there is still going to be pressure on those downsell rates and things like that coming out of markets where the virus is really hitting them hard. And so we expect to see, in line with the guidance that we gave earlier, that we'll gradually be working through the virus, that we'll hopefully start to get a better view of a recovery along with the virus, hopefully, in the coming quarters, but I think we have to be quite cautious on that front.

I think your broader question on the revenue versus the downsell and churn rates. Our fundamental growth drivers are in place, whether it's going upmarket to enterprise customers, whether it's getting new products out there, expanding our markets or taking away business from some of those legacy players. So we're seeing positive proof points, if you will, on that side of the house that the fundamentals are in place. We just need to keep our eye on them, and hopefully, we'll get clear sailing as we move along.

Okay. Well, let me ask my second question on net customer adds. And you indicated that you'll be around 500 for the next couple quarters. Are you seeing anything -- any differences in the change in the win rates? Is that one of the reasons why you think it stays at 500? Or is it just that the pipeline doesn't suggest that you can do more than that, in other words, win rates are the same? And I wanted to add a couple of different dimensions. There's -- within the net retention rate -- or excuse me, the net win rate, there are some emerging companies like IRONSCALES or Abnormal Security that might be standing up with a Microsoft 360 solution that perhaps you're not seeing the same kind of opportunity associated with 360 situations. But, a, can you just talk about your win rates? And then b, the competitive situation that might feed into those win rates? And Peter, congratulations on the ribbon-cutting ceremony in Canada.

Yes. Thanks, Keith. Yes. Yes, we got your city in there in one of our data centers. So okay. So customer adds. Two things to consider there. Yes, I think we would like more customer adds, for sure. But 2 things at play. One being, remember, we are focusing more upmarket now. So where we would have accumulated some of those logos through more work downmarket, we're seeing a little bit less of that and a focus on bigger customers with greater seat counts. And you're seeing some of that flowing through in terms of our average order value. I think secondly, in the COVID economy, there is -- there are many organizations that are a little bit of a standstill from a new project perspective. And so momentum, velocity through pipeline is challenged in certain geographies, certain sectors and on an account-by-account basis for sure. So those factors are coming through.

Yes, I guess, interesting question in terms of other models to supplement Office 365. And does that impact customers' appetite? I think the reality is that our value proposition, which is a comprehensive wrapper around 365 that covers not just a sort of tactical problem around a phishing issue or an impersonation issue, but a comprehensive shielding of bad things coming at the Office 365 environment. Spanning mail security, also capabilities for web security, protection from Office 365 downtime, data protection and recovery capabilities, compliance capabilities, sophisticated reporting and then API capabilities that wrap all of this and allow one to integrate it really well into the broader security environment, yes, I think that's a very compelling value proposition, and we're seeing that playing out as being an enterprise-grade solution that we have a lot of confidence in the demand cycle for that in the Office 365 base.

Okay. So don't feel like your win rates are changing is the short answer?

So I think as I described, the win rates as a result of COVID, I think, are impacted for sure. But I don't believe that it's impacted as a result of...

Competition.

Competitive niche players, yes.

Your next question comes from Terry Tillman with Truist Securities.

Yes. I just -- two questions for me. First, in terms of -- I think one of the comments was on the enterprise side, in terms of an expectation that you start seeing an improvement or kind of recovery in bookings in 4Q. I guess, kind of where does that confidence come from? Are you just seeing improving sales coverage from some of these go-to-market investments? Or are just the conversations, the verbal interactions suggesting that some monies are just going to start freeing up or the resources will start freeing up as we get into the new calendar year? And then I have a follow-up.

Yes. That comment really centers around what we're seeing on deal activity and specifically around the pipeline generation activities on the enterprise. Clearly, in early Q1, pipeline generation activities dropped off across the board. What we started to see is in the bigger organization, that's what popped back more quickly than the rest. And so we're now a couple months into that, we're seeing good activity. And so I think that's what's given us that confidence that sequentially, we should start to see some of those deals. Enterprise deals do take a bit longer to mature and come to fruition, but that pipeline activity would indicate that we should start to see more deals coming later this year.

Okay. And Peter, just maybe a question as it relates to emerging products. Our research has picked up or suggested MessageControl's actually had some interesting kind of traction quickly. I don't know if that's the right emerging product that you'd want to call out, but I would love to hear your perspective either on that or something else that maybe we should kind of hone in on that could start to add up to something more than just an emerging product?

Yes. That's a great question. So yes, the product portfolio and the way we built it out and expanded it, I think, has a lot of potential, and we saw some encouraging and good signs there across the portfolio. IEP adding 700 new customers this last quarter, which was great to see. And obviously, another part of our Zone 2 value proposition is the awareness training product, 400 new customers there. Each of the components doing quite well. I think Rafe called out DMARC, 100 new customers. That's the brand-new offering in Zone 3. And obviously, web security, making an additional contribution to the base with 200 new customers, too. So we feel good that our product expansion strategy is showing signs of working well within the base and also providing on-ramps to new customers. And we think MessageControl will ultimately complement that over time, too. And certainly, the technology and how we build that out is we're busy building that out on our platform as the Mimecast cyber graph using machine learning and graft database technology. To add additional efficacy and insight into the message flow for organizations, we think, is a nice differentiator and potentially something that can be an additional revenue generator in time, too.

Our next question comes from Sterling Auty with JPMorgan.

In your prepared remarks or in answers to other questions, you talked about how in terms of customer acquisition, some strength upmarket, but then in Central Europe, saying all sizes. What I'm curious about is, if the net customer additions are supposed to be around 500 for the foreseeable future, what should the mix of those customers look like in terms of their size that's going to comprise that customer-addition profile?

And Sterling, you're talking by customer count, correct?

Correct. So in other words, so should average order value go up because there's a bigger percentage of those that are larger customers? Or will the profile remain consistent?

Yes. No. Yes, I'm with you. So of course, the biggest impact on the raw customer number is often the smaller customers. But as you're talking about -- we have to look at both elements of it, both the customer count and the AOV. So as the year progresses, we would expect and we're working towards making sure we're driving bigger deals, if you will, from 2 perspectives: one, more products being sold to customers, including upsell, to our base. And our continual trend of selling to larger customers. So I think this kind of moves that -- or turns at a battleship pace, if you will. It takes time for those to play out. But that is the trends we're seeing in the business and that's we've been reporting and that's what we really look to see over the next few quarters as well.

Our next question comes from Brian Essex with Goldman Sachs.

Peter, just had a quick question for you and then a follow-up. Last time we spoke, you talked about your hiring profile into this year, how you'd hired ahead of the pandemic and then the pandemic happened and maybe you're going to hang on to those hires and maybe not hire as aggressively or at a lower pace into next year and enter the next fiscal year with a more mature sales force. How should we think about any adjustment to that strategy as you're throwing some better profitability to the bottom line? Might you kind of throttle that forward, given the better growth rate that we've seen and penetrated accounts where you might have better opportunities, like in Europe, as you've highlighted? And then what do you think that, that's going to -- what opportunity do you think that would drive in terms of your ability to reaccelerate revenue kind of heading into like the next fiscal year?

Yes. A great question, Brian. So I think the overarching philosophy here is really informed by kind of looking at where are the growth opportunities, particularly during the economic challenges and the COVID crisis, where are the best growth opportunities for us to invest in? And how do we realign our workforce around those? And how do we hang back a little bit from areas that are naturally going to be softer and in doing so, benefit from some efficiency by getting that mix or optimizing that mix. And part of that has also been slowing down hiring and seeing some of the benefits of that flow down to the bottom line. But I think our big growth opportunity here and what we'll be hunting for before, during and after this crisis has gone is really around that move upmarket and that big enterprise opportunity, making sure that we're executing well in these expanded geographies like Central Europe, and I mentioned the traction that we're starting to get there, and then executing on this multiproduct strategy, this expanded product portfolio that we've got with the email security 3.0 strategy and the broader solution framework that we've laid out. So we'll make sure that we're well staffed to be able to grab hold of those opportunities and transform and make the most of those as we move forward into next fiscal.

Okay. That's helpful. And then is there -- I guess, Rafe, is there a way that we can maybe quantify what you think might be the quarterly savings generated by operating in a remote environment? And what your levers might be for maintaining margin expansion in that environment as you might expand into next year?

Yes. So we've been trying to call out the very obvious COVID savings, which, frankly, starts with travel and there's a shortlist of things that are particularly unique to our time here. But -- and especially once we start giving guidance for next year, we'll be able to be a little bit more refined. But we certainly think there's savings opportunities. You start with gross margin, it has continued to uptick over the last few quarters, that kind of on a -- march up towards that 80% margin that we've talked about. And then we think more broadly, things like hybrid work environments. So you're getting much more efficient use out of the same real estate platform. We found quite a bit of success with a bunch of these virtual events. It's not right for every situation. But those are the kind of things that can drive a lot of travel savings that are good for the environment and good for the bottom line. And we think those are something we can maintain well into the future even as we kind of hopefully enter into a more normal work environment. And then I would say, lastly, we're going to continue on those fundamentals that we had in mind back before this all began when we set out our long-term targets, if you will, for 23% to 25% free cash flow. We think there's room for G&A over time to get more efficient. We think we can, throughout the organization, continue to drive efficiencies of scale. So hopefully, as we come through this, we can take what we've learned from this unique working environment and get to kind of a best-of-both-worlds environment coming out of it.

Our next question is from Brent Thill with Jefferies.

Just wanted to clarify the seat count. I think in February, you mentioned 13 million. Today, you're mentioning around 15 million. So it looks like seats growing faster than customers. I just wanted to clarify that stat.

Yes. Pardon me, over the last few calls, if you know, Pete's announced some very big customer -- some customer wins that had very large seat count numbers behind them. And so we are continuing to as we, again, move upmarket, start to see some real nice benefits from some of these very large customers that are helping.

Okay. And then another thing, I think, many of us have heard during the pandemic is going to the cloud was kind of the #1 objective. Customers went to Microsoft and to Google, and really, it was like that was their focus. And ultimately, now that they have a little more time on their hands and they're coming back and realizing that architecturally, it might not be the best decision, are you starting to see some of those customers now say, "Look, I've actually got some time to refocus back on this." That those customers are in the pipe, and you feel that they're coming back to you. I'm just curious if you could talk more directionally about the pipeline, how you're feeling around transitioning some of those customers. Because I think there's effectively a very different impact numbers that they're seeing versus kind of what you're seeing. So I think I was just trying to reconcile what might be going on. That may be one example of something we're hearing in the field that they may actually just be coming back because they didn't have the time. They had to get -- they had to race to get in, and now they can.

Yes. I think there are many different pieces of the market here. I think by the time the pandemic hit, there was a significant amount of the market already on Office 365, those that weren't -- some of those stragglers were moving over. So certainly, we're seeing some of those addressing their security issues. It's really a mixed bag because there are equally companies that are unable to move forward or make changes or do different projects or still playing catch-up in terms of getting those infrastructures right and enabling remote working, sometimes distracted by re-orgs and other challenges like that. So it's a little bit all over the show. But certainly, the idea that there may be some sort of pent-up demand as the crisis dissipates, I think, is an alluring thought. And we're working hard to continue to build pipeline and maintain our visibility even amongst more distressed organizations to make sure that when they're back and ready to launch projects, we're the preferred provider to help them with this.

Our next question comes from Catharine Trebnick with Colliers.

Nice quarter. You did on your prepared remarks talk about Canada and some new data centers. And could you outline the opportunities there? And then the follow-on question is you have gotten FedRAMP Ready, right? What are you doing in terms of your sales force for the federal government versus a year ago, you had hired someone to really go after North America state local governments?

Great. Thanks, Catharine. So the Canadian opportunity is large in GDP terms. And in terms of the organizations that we can go and target, not just in public sector up there, but significant private sector, solid SMB market as well, which is really drawn to our broader suite. So we feel good about that Canadian opportunity, and our sales team up there is doing their work and capitalizing on the differentiation that we have with local services.

In terms of our -- the U.S. public sector business, that sales team has grown. FedRAMP Ready is a milestone along the journey. We're still working towards our ATO, authority to operate, which will create even more opportunity and access. But some of the preliminary market opportunity today, we're already capturing, as you said, the state local education and some of the sort of ring around that of organizations. So we'll continue to build out. We won't preemptively do too much spend in that area until we've got a little bit more line of sight about what's happening economically as well as the time lines for ATO for Mimecast.

Our next question comes from Joshua Tilton with Berenberg.

Just 2 quick ones from me. I just wanted to follow up on the profitability question. So when we look to the remainder of the year, last quarter, you expected travel to pick up in the second half. This doesn't look like it's going to happen now until the fourth quarter. So the way to think about it that if we all work from home in Q4 and you don't travel to meet customers, should we expect the bottom line beat going into the end of the year?

Yes, you would is the short answer. We're hopeful they'll be traveling again. We've got that in our model. And I think this is consistent. We're putting that out there, so you can see how we're modeling the business.

Okay. And then just one more from me. On the Zone 2 products, it looks like they had a great quarter in terms of customer additions. So how do we balance this relative to the 12% upsell number? Is this like a land-and-expand-type situation? And then just to clarify, have your expectations changed at all for NRR for the remainder of the year since last quarter?

Yes. So on the Zone 2 customer account numbers, that does reflect both new and upsell. So that's a combination there. Those 2 products are getting -- they're getting good interest. And I think this is -- one of the things we look for with new products is the sales team becomes very accustomed to selling them, they find traction, you get this positive loop, whether it is on new or upsell business. So I think that's what's -- where you're seeing those -- that traction there.

In terms of the net revenue retention numbers, we're still on course with what we talked about last quarter, I broke it out in detail. And I mentioned that overall, we are modeling 103% to 104% on a net revenue retention, and we are pleased this quarter to still be at the 104%.

That was helpful. And then just maybe if I could squeeze one more in. How do we think about the gross margins going forward as you increase the utilization of this new Canada data center and maybe even some of the public sector infrastructure?

Sure. I think the best way to view that is, we -- back in February, when we gave out our long-range targets, the target we set out for ourselves there is an 80% gross margin in that 3- to 5-year time frame. So we've had some really nice upticks, and a lot of the hard work of the team has paid off and showing up. We think that will continue to improve over time, but somewhat gradually.

And our last question is from Nehal Chokshi with Northland Capital Markets.

Yes. Just wanted to talk about MessageControl. I know you've got it for about a quarter now. Can you talk about the opportunities you're seeing with MessageControl in terms of potentially help to address some of the more advanced phishing threats? You hinted at that with bolstering your Zone 1 technologies last call.

Yes. Great. So 2 pieces to that. Obviously, we closed the MessageControl acquisition at the start of last -- at the start of the quarter. Yes, at the start of this last quarter. And so a bunch of technical work looking at architecture and how to merge that into the platform so that it can become a more mainstream part of the offering. And then in the meantime, continuing its life for a period of time as a stand-alone offering and using that really to bolster and supplement our core product and as a differentiator in some of the enterprise opportunities that we're working in. So great technology, great talented team, and we're excited to have them as part of Mimecast. And we will keep you posted in terms of progress and product capabilities that we bring out in subsequent quarters.

What I was going with that is that some of these smaller players are touting the ability to leverage the APIs of the cloud e-mail providers as being able to have a better mousetrap. And I believe MessageControl utilizes the same sort of approach. So will you continue to utilize that approach and bring some of the IP that you have in Zone 1 towards that delivery mechanism of leveraging the API, utilizing the MessageControl IP there?

Sure. We haven't made any announcements around that. But the option of a deployment model that doesn't require an MX record change certainly is an interesting one. And to be able to bring the full weight of the Mimecast capabilities into a model like that is interesting and compelling for us. Obviously, there are considerable benefits of having the API as well as the in-line traffic capabilities around some of the other offerings that we have, be that secure messaging and encryption or the continuity capabilities and others. So we think that, yes, there are opportunities to provide alternative deployment models, like the ones that you described, and controlled offers today.

Thank you. And we have no further questions in your queue, sir. You can continue with your closing remarks.

Great. Folks, thank you very much for joining our call today. I would like to just express my appreciation to our staff, who worked really hard to deliver these results under probably not ideal conditions. They appreciate that cyber resilience and security is really important to our customers and to the world in general, and so we appreciate their efforts and their work. We appreciate the support of our customers and our partners to -- in continuing to build our Mimecast business and stop bad things from happening to good organizations in the world.

And with that, we'll speak to you, again, in about another quarter's time. Thank you, and good night.

Ladies and gentlemen, this concludes today's conference. Thank you for participating, and you may now disconnect.