Mimecast Limited (MIME) 2021 Q1 法說會逐字稿

Good day, ladies and gentlemen, and thank you for standing by. Welcome to the Mimecast First Quarter 2021 Earnings Conference Call. (Operator Instructions) As a reminder, this conference call is being recorded. (Operator Instructions) At this time, I would like to turn the conference over to Mr. Robert Sanders, Director of Investor Relations. Sir, please begin.

Good evening. Welcome to Mimecast's earnings call for the fiscal first quarter 2021 ended June 30, 2020. I'm Robert Sanders, Director of Investor Relations.

With me on the call tonight are Peter Bauer, our Co-Founder, Chairman and CEO; and Rafe Brown, our CFO. Tonight's conference call is being broadcast live. A replay of this call will be available after the live call has ended.

We will make forward-looking statements regarding future events and the future financial performance of the company. These forward-looking statements are subject to risks and uncertainties that could cause actual results to differ materially from those in the forward-looking statements. We caution you to consider the important risk factors that could cause actual results to differ from those in the forward-looking statements contained in today's press release and on this conference call.

These risk factors are further defined in Mimecast's most recent Form 10-Q filed with the Securities and Exchange Commission. During this call, we will present both GAAP and non-GAAP financial measures. These non-GAAP measures are not intended to be considered in isolation from, a substitute for or superior to our GAAP results.

A reconciliation of GAAP to non-GAAP measures and the reasons for our representation of the non-GAAP information is included in today's press release, which can be found in the Investor Relations section of our website. The date of this call is August 3, 2020. Any forward-looking statements we make today are based on assumptions that we believe to be reasonable as of this date. We undertake no obligation to update these statements as a result of new information or future events. Now I'd like to turn the call over to Peter Bauer.

Good evening, and thank you all for joining us. On tonight's call, I'll begin with an overview of our first quarter results and discuss the cybersecurity landscape as we continue to see attackers applying their craft causing impactful business disruptions. Next, I'll discuss our Cyber Resilience Summit that we recently hosted with partners and customers.

Then I'll take you through some exciting new identity graft technology we have added to our platform with the acquisition of MessageControl. And finally, we'll look at some examples of how Mimecast is protecting customers and the types of solutions the market is demanding before I hand over the call to Rafe to cover our financial results in more detail.

So we began our fiscal year 2021 with solid financial performance, exceeding the high end of our guidance for both revenue and adjusted EBITDA. First quarter revenue totaled $115.2 million, exceeding the high end of our guidance by $1.4 million. This outperformance during difficult economic conditions is a testament to Mimecast's durable subscription-based business model and the highly valued services that we deliver. 600 net new customers joined Mimecast during this first quarter as we experienced some COVID-related headwinds in the lower end of the market, mainly sub-100 seat customers.

Among our new customers this quarter, was a U.S. retailer who purchased our E-mail Security 3.0 platform for 165,000 employees, representing a 7-figure engagement and among the largest deals to date for Mimecast. This is further evidence that our move upmarket is finding traction with some of the most demanding security organizations in the world. And I'm extremely proud of the way our organization has overcome the challenges of working remotely to continuously support our customers through these difficult days of the global COVID-19 pandemic.

During the quarter, we witnessed attackers carrying out several high-profile attacks, disrupting communications, research and commerce, illustrating the need for continued vigilance against adversaries looking to cause harm. Our latest threat intelligence report notes attacks incorporating a vast array of threats and a combination of generic Trojan delivery with phishing campaigns and other more complex threats preceding their deployment. We saw specific sectors repeatedly targeted during the pandemic.

For example, manufacturing, retail and insurance, possibly due to the essential nature of these businesses and their continuous operations during the crisis. A notable shift, indeed in attacker focus from prior periods. Additionally, we witnessed the media and publishing sector suffering high volumes of impersonation attacks, potentially as a vehicle for cyber criminals to spread disinformation. Finally, our researchers noted brand exploitation campaigns moving beyond global brands to target smaller organizations who often have less sophisticated defenses in place.

As we observe the threat landscape, we were reminded this is important work we do at Mimecast as we support our customers with defenses against these ever-changing threats. We're pleased to have recently been awarded a perfect score by ICSA Labs in their most recent efficacy test of e-mail security software, blocking 100% of threats presented. Now in June, we hosted our second annual Cyber Resilience Summit, bringing together customers, partners and prospects to share best practices and collaborate, including keynote presentations from industry icon, Steve Wozniak and CrowdStrike CEO, George Kurtz. Now building on the success of our first Cyber Resilience Summit, we welcomed over 3,500 attendees to this year's event, including 2,300 customers, 300 partners and 1,000 prospects, all interested in learning more about Mimecast. We received praise from both partners and the media for our engaging content and good humor while tackling complex challenges that organizations face today.

Central to the discussion was Mimecast's E-mail Security 3.0 strategy. Our solution framework that covers the primary attack surfaces that organizations are exposed to today, including perimeter defenses, impersonation, insider threat detection and brand exploit protection. This all increases the awareness of the broad range of solutions that Mimecast delivers on our unified platform of services. And thank you to everybody who helped make this event such a success.

Now I'd like to share with you some details of our most recent acquisition, MessageControl, an identity and intelligence layer that we're incorporating into the Mimecast platform to bolster our Zone 1 perimeter defenses and further enhance our threat detection. This technology tuck-in furthers Mimecast's E-mail Security 3.0 solution framework, which enables organizations to continue to benefit from e-mail as the most trusted and open electronic communications platform. MessageControl's innovation around the identity graph is another strategic component in building and underwriting that trust. In addition to the leading-edge technology that our customers will quickly benefit from, we incorporate a fabulous team of engineers to our R&D ranks to drive further innovation on our platform. In the last 12 months, we've added 3 diverse teams of engineers to the company through technology acquisitions as we invest to ensure Mimecast remains a leader in efficacy against determined and persistent attackers.

Operating our business during the COVID-19 lockdown, we have come to understand more closely how important our digital communications are and how important it is to be able to trust those communications networks. We've observed customers moving away from legacy e-mail security solutions that have failed to innovate and have become less effective. Several former Symantec customers have found Mimecast's platform to be more effective, including a U.K.-based financial institution, with 1,500 employees that selected Mimecast's full E-mail Security 3.0 suite of defenses.

Additionally, this customer adopted Mimecast's archiving solutions with our supervision extension to comply with financial regulation requirements. Seeking to leverage the breadth of Mimecast services while consolidating point solutions and simplifying IT. This customer also purchased our awareness training, our secure messaging and our Large File Sending services. Then a North American media company with 10,000 employees also found their Symantec set up less than effective and adopted Mimecast Zone 1 and Zone 2 services to strengthen perimeter defenses and the tech risks originating inside their organization. A serious threat vector at another North American-based microblogging service, who is not a customer, recently found can have devastating consequences to their operations. Then, an Australian retailer with about 16,000 employees moved away from Symantec in favor of a more integrated solution and adopted our full E-mail Security 3.0 platform that includes our 2 most recent offerings of DMARC Analyzer and our Brand Exploit Protection service. Additionally, this customer added awareness training to ensure their employees are an integral part of the overall cyber resilience strategy.

And a final example of an organization finding their legacy Symantec equipment to be ineffective at responding dynamically to the threat landscape is a North American health care provider with 7,500 employees. They purchased our Zone 1 and Zone 2 defenses, our continuity service to ensure availability of communications and our archiving service with the privacy pack to comply with industry-specific archiving requirements. In all of these examples, we find the simplicity of Mimecast's unified platform and our ability to address a broad range of customer needs, including industry-specific archiving requirements.

Underscores the desire of our customers to reduce point solutions and adopt cloud data technologies that integrate well with other modern cloud vendors. We were delighted to be named a leader in the InfoTech data archiving, data quadrant published in July ranking Mimecast first across a number of capabilities, including business value created, product features, ease of implementation and vendor support, among others.

In summary, we're on a solid footing financially as we exceeded our first quarter guidance and are raising our outlook for the full year 2021. Analysts and customers alike continue to recognize our best-in-class efficacy, enabling our customers to continue to rely on e-mail for their most important communication. We continue to strengthen our relationships with our partners and customers and attract new organizations to our platform. Finally, we are excited by the rapid pace of innovation as we invest behind our current and future offerings. The adoption of our newest offerings is an indicator of our strategy for meeting additional customer needs.

And it's working and it's targeting the right areas. With that, I'll turn the call over to Rafe for a more in-depth review of our financials. Rafe?

Thank you, Peter. As Peter mentioned, we had a very productive first quarter despite the COVID-19 headwinds we all faced. I'm pleased to report that for the first quarter of fiscal 2021, we exceeded the high end of our guidance for both revenue and adjusted EBITDA, continuing to deliver a balanced scorecard of growth and expanded margins.

In the first quarter, we generated revenue of $115.2 million, which represents growth of 16% over the prior year in absolute dollar terms. Adjusting for the $4.5 million of currency headwind we faced, our constant currency growth rate over the prior year stood at 21% for the quarter. Note that since providing guidance in May, foreign currency fluctuations positively impacted our first quarter results by $300,000. Adjusted EBITDA for the first quarter totaled $25.7 million, representing an adjusted EBITDA margin of 22.3% compared to $13.5 million or 13.6% in the same quarter of the prior year.

We are pleased that our focus on operational efficiencies and fiscal discipline continue to pay off in measurable ways. But since the realities of the COVID crisis materially impacts the ability to make a year-over-year bottom line comparison, let me dive into this a bit further.

Like many companies, we are learning a great deal about our ability to work remotely, travel less and conduct large-scale online meetings. A number of these changes drove savings in the first quarter. For example, we had significant travel savings in the quarter across the board augmented by the cancellation of our annual sales club event and conducting our fiscal '21 company kickoff in an all virtual environment. As Pete mentioned earlier, our Cyber Resilience Summit, which was also conducted in a virtual environment this year was fabulously successful. It reached far more customers and prospects than the in-person event last year and generated content that can be easily repurposed for internal training and future marketing events. And it was done at a fraction of the cost of an in-person event.

We've continued to expand our teams, though our overall hire rate has slowed as we closely examine the economic environments in each of our markets. Taken together, we realized a net benefit of approximately $6 million as a result of the sudden changes to our operating environment. As we look across the year in its entirety, we are planning to reinvest a portion of the savings we expect to see in the first half of the year as we hopefully return to a more normalized business environment in the second half. For example, given the importance of pipeline generation, we are investing in additional virtual events and more broadly, our digital marketing experience on an end-to-end basis. We are assuming that we will be able to travel in the coming months and believe that despite the success of online encounters, there will be significant demand to visit prospects and customers.

In fact, our central European team is already reporting that customer visits are beginning to return now that the virus infection rates have improved in their part of the world. We are also using the short-term savings to accelerate longer-term systems projects that will focus on customer success and driving greater efficiency throughout the organization.

Turning to average order values, we continue to see increases. Currently, average order values for all customers stand at $12,400, up approximately 10% over the prior year in constant currency terms. This trend of improvement in average order values is attributable to 2 favorable shifts within the company.

First, our continued expansion upmarket. Further to Pete's comments, our success in the enterprise market this quarter demonstrates the impressive work the team has undertaken to serve some of the biggest companies in the world. Currently, 48% of our revenue now comes from customers with more than 1,000 seats, up from 46% this time last year. Second, we continue to see an uptick in the average number of services per customer across our customer base, which rose to 3.4 services per customer in the quarter, up from 3.2 services last year at this time. I also want to point out that customers with 4 or more services now make up 42% of our customer base. Which is a 300 basis point improvement since Q1 of last year. In the first quarter, we added 600 net new customers, bringing our total customer account to 38,600 customers worldwide compared to 900 net new customers in the first quarter of last year. As you would expect, the COVID-19 crisis appears to be impacting smaller customers more significantly than their larger peers. The year-on-year change to net customer additions can be largely attributed to the lower end of our seat segmentation. Focused solely on these smaller customers, we saw approximately 200 fewer new customers in the quarter and noted an uptick of churn of approximately 100 customers when comparing the same segment of smaller customers to Q1 of last year. Despite the COVID-19 related challenges, I would note a bright spot on our efforts to acquire Symantec customers. For the second quarter in a row, we noted a meaningful uptick over the prior year in terms of new bookings attributable to customers leaving the MessageLabs platform. Net revenue retention, which we measure on a trailing 4-quarter basis totaled 106%. Looking at its components, upsell totaled 113% as at the end of the first quarter, while downsell insurance stayed steady at approximately 7%.

There are few points to consider when evaluating this numbers, so let me give you a bit more color. First these figures are clearly been impacted by the COVID-19 crisis, in particular, as we license on a per seat basis both upsell and downsell are sensitive to overall employment numbers within our customer base. Unsurprisingly, we are seeing headwinds related to our ability to upsell customers and to customer downsell. Second, while our downsell and churn rates stayed steady from Q4 to Q1, the economic fallout of the COVID-19 crisis is continuing to play out across the world. We are aware of a number of customers currently restructuring their business and reducing their workforces. As we discussed in our May call, this is very likely to create additional short-term pressure on the downsell and churn rate as the economic downturn progresses.

Finally, and turning to upsell. We have been discussing the fact that we are in the midst of a product transition. Our Zone 1 product offering, Targeted Threat Protection has now penetrated 75% of our customer base and by all accounts has been a great success in terms of driving upsell. In addition, an even higher portion of new customers by TTP as part of their initial purchase. As such, TTP's ability to drive upsell is now limited. Fortunately, we have 5 new products to introduce to our existing customers, and we're seeing successful sales engagements across all of these products, among which our Zone 2 internal e-mail protection solution is finding significant traction. As we examine current trends and now anticipating the economic challenges caused by the COVID-19 crisis will push into the second half of the fiscal year. I want to give you a bit more granularity on our financial modeling of net revenue retention. We are maintaining our estimates for downsell and churn, which we believe may rise to approximately 8% as the economic crisis drags on. Assuming the economic headwinds continue to stress both the seat and product-driven aspects of upsell, we have modeled in scenarios that further challenge our upsell rate, pushing it to between 11% and 12% for the year. We do believe there are a number of factors at play that will drive better performance and ultimately improvement in these rates.

First, a better economic environment would have significant impact on net revenue retention. Beyond the macro, we are confident that our Zone 2 offerings, awareness training and internal e-mail protection are important solutions that have the potential to reach a significant portion of our installed base and thus drive upsell. In addition, our newest offerings in Zone 3 and web are gaining momentum as our sales team becomes accustomed to presenting these solutions.

From a geographic perspective, all of our major markets, North America, the U.K. and South Africa are still struggling with the coronavirus crisis. However, I would note that the economic challenges in South Africa, from which we derive 10% of our revenues, are particularly acute and being felt across all segments of the business, including enterprise. We are pleased with the continued progress in Central Europe, which is our fastest-growing region in terms of revenue.

Turning to gross margins. For the first quarter of 2020, we recognized a 77% non-GAAP gross margin, up 130 basis points from Q1 of the prior year, driven by efficiencies we are finding within our customer support organization and grid operations. This continues our progress towards our long-term goal of achieving 80% non-GAAP gross margins. Our non-GAAP operating profit for the first quarter was $17.7 million or 15.3% of revenue, an improvement of 870 basis points from the prior year. In bottom line terms, our first quarter GAAP net income was $3.1 million or a profit of $0.05 per diluted share based on 64.7 million fully diluted weighted average shares outstanding. Our GAAP tax charges totaled approximately $600,000. Second quarter tax expense is expected to be approximately $1.1 million, and our full year GAAP tax expense is estimated to be approximately $4 million. Our non-GAAP net income for the quarter was $14.2 million or $0.22 per diluted share based on 64.7 million fully diluted weighted average shares outstanding. Our non-GAAP tax rate was 24.5% for the quarter.

Turning to cash flows. Our first quarter operating cash flows totaled $29.3 million or 25.4% of revenue. Free cash totaled $18.5 million for the quarter. Please note that Q1 free cash flow benefited from COVID-19 related incentives enacted by the U.S. and U.K. governments. The U.K. offered a VAT incentive that defers certain VAT payments until March of 2021. This served to increase free cash flow for the quarter by approximately $5 million. However, please take note that these funds will be due to be remitted in our fourth quarter. So there will be no net benefit to the year. In the U.S., free cash flow benefited by approximately $800,000 due to an ability to delay payroll tax remittances to the government. We will continue to see this benefit through Q3. These tax payments are deferred to fiscal '22 and fiscal '23. As of June 30, Mimecast had $199 million of cash on the balance sheet.

Turning to our acquisition of MessageControl, we are pleased to have the MessageControl team as part of Mimecast. The range of services and their talent will be another important differentiator over the competition as we go forward. After acquisition accounting, deferred revenue adjustments, acquired MessageControl customer revenue is expected to total approximately $400,000 for the remainder of fiscal '21. In terms of taking the MessageControl product to marketing, the first order of business will be to fully integrate the MessageControl solution onto our platform which we believe will drive significant market opportunity in future fiscal years. As such, additional FY '20 revenue benefit will be limited.

Let me now turn to guidance. For the second quarter of 2021, revenues are expected to be in the range of $120.8 million to $121.8 million or 17% to 18% growth in constant currency terms. Our guidance is based on exchange rates as of July 23, 2020, and includes an estimated negative impact of $100,000, resulting from the strengthening of the U.S. dollar compared to the prior year. Adjusted EBITDA for the second quarter is expected to be in the range of $26.8 million to $27.8 million. Free cash flow for Q2 is expected to be approximately $13 million. Given the ongoing COVID-19 crisis, it remains difficult to assess how quickly the global economy will recover. The persistence and now the resurgence of the virus in our operating geographies is pushing us to remain cautious about how quickly the global economy will recover, which we expect will directly impact our short-term growth opportunity.

However, as we have said before, the recurring nature of our revenue base and our disciplined approach to expense management gives us a solid baseline on which we can model our business. As such, we are updating our guidance to reflect the following: Full year 2021 revenue is expected to be in the range of $488.1 million to $493.1 million or 16% to 17% growth in constant currency terms.

Foreign exchange rate fluctuations are negatively impacting this guidance by an estimated $6.7 million compared to the rates in effect in the prior year. The prior guidance for fiscal year 2021 provided in early May, was $480 million at the midpoint. Our overachievement in Q1 is leading us to raise the midpoint of our full year guidance by $1.5 million in constant currency terms.

We've also raised the midpoint of our guidance by $400,000 to reflect the acquired revenue MessageControl is bringing to the company. In addition, this raise of $1.9 million is being positively impacted by $8.7 million of foreign exchange tailwind that has arisen since the rates used in our May call, resulting in the midpoint of our full year guidance moving up by $10.6 million in absolute dollar terms from $480 million to $490.6 million. Full year 2021 adjusted EBITDA expectations are being raised to a range of $97.3 million to $99.3 million, even after absorbing the operating costs associated with MessageControl.

With this raise, we are increasing our adjusted EBITDA guidance by $3.3 million at the midpoint, which would equate to 175 basis point improvement over the prior year. Full year 2021 free cash flow expectations are being raised to a range of $77 million to $79 million. This would reflect a free cash flow margin of 15.9% at the midpoint of our revenue guidance and a 720 basis point improvement over the prior year.

We are truly proud of our team's performance this past quarter. Given the increases in email-based attacks, our customers are depending on Mimecast more than ever. We are confident that by remaining focused on our customers and our team, we will be able to achieve our financial goals even during these uncertain times.

With that, operator, let us please now open the line to questions.

(Operator Instructions) Our first question or comment comes from the line of Matt Hedberg from RBC Capital Markets.

It's Dan Bergstrom for Matt Hedberg. You called out a number of Symantec customer wins in the prepared remarks. It sounds like they're purchasing additional products from you. How should we think of that opportunity unfolding in fiscal year '21? It seems like you've had good success there over the last several quarters. And I guess, it sounds like the opportunity could be accelerating here. Is that the case?

Yes. Dan, thanks for the question. It's Peter here. Yes, I think the way to think about it, Symantec has a pretty large -- they were a pretty substantial player in the cloud e-mail security business, probably between $100 million and $200 million of cloud e-mail security business and then some on-premise business as well.

In the last year or so since the Broadcom acquisition, the migration away from Symantec has certainly picked up a little bit. But we think it's -- these are large enterprise organizations in many cases with multiyear contracts. So there is some friction in terms of them migrating off. But we have certainly had success for many years in migrating Symantec customers over onto our platform. And I think the anecdotal examples that I called out in the prepared remarks, as you say, illustrate that we got some really nice wins in. We think it's an opportunity that will continue to work for us for quite a few quarters still to come.

And then I don't know if you had any thoughts on business trends or activity in July here. Any way to think about July relative to June, perhaps or July relative to prior July's in terms of activity or pipeline build?

Yes. And I'm sorry, just maybe trying to make sure -- can you just repeat the question? I didn't quite understand it correctly.

The quarter was strong. Just curious about any initial thoughts around flow through to July.

So I think we're not going to break down specific details on the month. It's very clear that the crisis is still going on in a number of parts of the world that are quite important to us. And so I think we're still dealing with that economic headwind out there more broadly. That said, it is very clear that the world is figuring out how to work in a remote environment. So I think we're kind of pleased with the demand out there. Certainly, very pleased with our team and the way they're executing in this environment. And so we've taken all that account as we gave our guidance for the year.

Our next question or comment comes from the line of Brent Thill from Jefferies.

This is Joe on for Brent. I appreciate the question. I also appreciate the extra color on the customer account increases. So just to be clear, the weakness was in the smaller customer segment. Was that below 1,000 seats? And otherwise, the larger customers was in line with seasonal? And then I think last quarter that you had noted 200 customers were buying stand-alone products or the next-gen products. Did that trend continue this quarter?

So on the smaller account, it was even on the smaller end of the sub 1,000 group by customer count, where we saw the most volatility that was the numbers that I highlighted. As you can imagine, a crisis like this just hits those customers quite a bit harder and directly impacts the customer count number because they're smaller, not as much on the dollar side, if you will.

In terms of customer on-ramps this quarter, we certainly saw the trend continuing. Not quite at the pace that we saw in the prior quarter in terms of those single on-ramp customers. But that trend does continue where we think of it as additional on-ramps to using Mimecast where you might come on for a particular solution, one of our emerging products. But that, of course, sets up the relationship where we hope to expand down the road.

Awesome. That's helpful. And then glad to hear about the strength in Central Europe. I think last quarter, you had noted some geo weakness in U.K. and South Africa. How do those regions do this quarter? Any further context?

Yes. Very much -- those 2 regions are very much in the midst of the corona crisis. As I've noted in my prepared remarks, South Africa is probably particularly challenged and worthy of taking note of just because they were having some economic challenges coming into the COVID crisis. It is certainly quite complex there in terms of both the double whammy between a tough economy and the virus really having significant strength. And that, without a doubt, is going to make doing business there harder.

On the U.K. side, it was much like North America, which wasn't the best quarter in the world in terms of environments to sell into just with all the changes afoot. But again, people are really figuring out how to do their business from home.

Our next question or comment comes from the line of Terry Tillman from Truist Securities.

This is actually Nick on for Terry. First one I had was actually kind of pivoting back towards the Cyber Resilience Summit. We heard you guys mention some capabilities such as SAFE Score and then case review and threat intelligence. How have these newer capabilities resonated with customers so far? And how do you fell these capabilities potentially help you move further upmarket and land some larger enterprise accounts?

Yes. Thanks for calling those out. Yes. So those are really exciting new capabilities that we're delivering, definitely resonating with customers. It was a strong reception to those new features in the platform as we showcased what we're working on there.

Certainly, as we've talked to larger customers, it's not just those features, it's the broader strategy that they fit into and the way the -- particularly on the E-mail Security 3.0 strategy, how concepts like SAFE Score and threat intelligence and our API integration strategy, how they work in concert across all 3 of the zones, the perimeter zone, inside the perimeter and beyond the perimeter. So as a collective, we think it's very powerful and definitely creates a value multiplier for customers as they adopt more of the suite and very appealing upmarket in the enterprise space.

Got it. That's helpful. And then just as a follow-up. Given the recent acquisition of MessageControl, even the acquisitions you guys did last year in Segasec and DMARC Analyzer. I guess how should we think about product development moving forward in terms of buy versus build?

Yes. So if you recall our history, we've spent a lot of time. In fact, almost the first decade-and-a-half of our company's history, building an organic, cloud-first, multi-tenant, multiproduct microservices platform and really getting those foundations in that design ideology right. And what we've done in the past few years is really build out with some very selective technology and talent tuck-ins to build out our portfolio. So if you think about E-mail Security 3.0, we've really been able to build out those zones over the last couple of years with acquisitions that brought us into the awareness training market, that gave us more advanced malware detection and efficacy capabilities with Segasec out of Israel.

We've built our Zone 3 capabilities with DMARC Analyzer and -- sorry, Solebit was the malware fighting technology. Segasec was the Zone 3, Brand Exploit Protect offering that we now have. So I think a very effective strategy for layering in capabilities that capitalize our ability to move into some of these adjacencies and provide a more broad-based strategy that is really, I think, expanded from our original e-mail security and e-mail archiving value proposition, which landed very well in the mid-market and below, up into a more broad-based value proposition that now traverses all the way from SMB right up into the large enterprise space.

Our next question or comment comes from the line of Sterling Auty from JPMorgan.

This is Matt on for Sterling. So the first question, around the -- in terms of the headwinds that you talked about, on the smaller end and even just in general, your customer base, is that more a function of downsizing or outright cancellations. Is that from business closures? Have you seen customers moving to absolutely no e-mail security or even to some Microsoft solutions?

Yes. I think the earlier days of the crisis, I think it's playing out more that we saw a downsizing where customers would stay with Mimecast, but it was more of a reduction in the number of seats. And obviously, some of the industries were really directly and very quickly impacted by the crisis, I think, travel or retail. And we called out in last quarter's call, we have about 14% of our overall customer base that we had in that really heavily impacted areas.

And so that's where we saw downsell in the earlier period of time. Frankly, our kind of running hypothesis is, is that some of the business is going -- or people closing their businesses and things of that nature will play out over a longer period of time. In that first 3 months, it was certainly very sudden, and there was a lot of companies that had to shrink their workforces, but we're still in the fight in a big way. As I mentioned, particularly in South Africa, we're aware of a couple of accounts there that are being restructured rather significantly. And so you do worry that some of those won't make it through the crisis.

Great. That's very helpful. And then one follow-up. In terms of billings, could you remind us, are there any large contracts in terms of the first quarter, second quarter of last year? Just looking at billings over the last 2 quarters have been in that 9% to low double-digit range. How should we think about that?

Yes. We always do caution people with the calculated billings that everybody does go through that. They can be quite inaccurate just because they do have FX, they don't reflect shifts in billing cycles and whatnot. I would say that the measure that you should take into account is, in this first quarter, we were engaged with a lot of these companies that were having a tough time, and we allowed some of them to shift from annual upfront contracts to quarterly for a shorter period of time, but it certainly would impact the billings calculation for that first quarter. So again, billings, I think, is quite an interesting measure when you're trying to recalculate it and back into it. And that's why we tend to just point people towards our issued revenue guidance as the best measure to look at.

Our next question or comment comes from the line of Brian Essex from Goldman Sachs.

I was wondering if you can maybe just comment on, I kind of tracking it every quarter, just the traction from Office 365. How much penetration was there this quarter? And are you seeing any kind of a pause there as enterprises maybe are a little bit less reluctant to migrate from on-premise into the cloud?

So we talked a couple of quarters back. We've crossed that threshold where more than half of our base is on Office 365. And so that continues to gradually drift upwards. We haven't been breaking out the same number because it's -- or breaking out the details of that number quarter-to-quarter. But certainly, the trend is there where Office 365's broader dominance in the market exists.

And we find a lot of Office 365 customers coming to us each quarter. It's one of the lead sources from where we gather customers as people who tried to go, as we say, Naked on Office 365 and realize they needed the added projection of Mimecast. So that trend very much still continues. I think we're aware of that, broadly, in these tougher financial times, the finance guys might push back harder on solutions than they would in more lucrative times. But the value that Mimecast brings to an Office 365 implementation just cannot be ignored and given the risks that are out there and the increasing risk because of the crisis, it's more important than ever to have Mimecast in conjunction with the Office 365 implementation.

Got it. That's super helpful. And maybe just a follow-up on some of the large enterprise wins. Any way to put a little bit more color around how many of those are Symantec-related? How many of those are other vendors where you have competitive displacements? And any other substantial trends like vendor consolidation playing out in the market is maybe a little bit of a tailwind for you?

Yes, great question. So I think a number of the stories that I called out in the prepared remarks, a number of those were Symantec -- not all of them, but a number of them were Symantec displacements, which was exciting. I think the competitive landscape or the displacement landscape is fairly broad still.

So there's Naked on Office 365. There's Symantec. There's Cisco. There's a number of other vendors. And the vendor consolidation opportunity, I think, sort of shows up in 2 ways. The one is customers looking at a broad cyber resilience strategy and looking to deploy a suite of solutions that can cover off a number of the risks around a concentrated dependency on Office 365, and it's not just an individual company's dependency on Office 365. It's the global dependency of almost all companies going forward that are dependent on Office 365 and the inherent risks of a homogenous security environment and extremely compelling attack surface. So mitigating those risks comprehensively with an integrated suite but it's also really looking at how to simplify IT and save costs going forward. With an economic downturn, and we learned through the economic downturn of '08 and '09 as well, that organizations are going to have smaller budgets, leaner teams. And as Rafe mentioned, there are greater risks in the cybersecurity landscape right now, and those need to be addressed. And so our ability to consolidate solutions and offer customers an opportunity to have less complexity in the environment, because of our architecture, we're finding to be very compelling in the marketplace.

Our next question or comment comes from the line of Saket Kalia from Barclays.

Okay. Great. And apologies if these have already been addressed. Maybe first for you, Peter, can we just talk a little bit about the increased usage on average? I think the users there is going from 3.2 products per customer up to 3.4. I guess the question is, what products are moving that needle the most? And which ones do you think are sort of getting ready to contribute more to that metric going forward? Does that make sense?

Yes. Saket -- yes, thank you. Yes, you're absolutely right. So year-over-year, 3.2 products moving up to 3.4, which considering the size of the base now, 38,600 customers, making those movements is exciting for us, and it's great to see, particularly as we built out this expanded product portfolio since going public 4.5 years ago, almost 5 years ago now. We've really expanded from what was 7-ish products, 6 to 7 products, up to about 11, 12 products now in the portfolio.

So as Rafe mentioned, TTP runaway success, and we've built a fair amount of saturation in the customer base there, of course, a lot of new customers out there in the market that we can still sell that to. Well, we're really finding great traction with now is what we talk about as our Zone 2 play. So that's really the IEP product and the awareness training product. Those are really strong sellers and gaining good traction for us. We've also found -- we were just looking at the numbers the other day, secure messaging has been a really strong grower for us in the mix. We don't talk about it very often.

But with data leak prevention and compliance requirements that organizations have, the ability to have a really slick, well-integrated encryption solution for e-mail has grown increasingly important. I think the main stage of archiving, those are bigger numbers that continues to be a driver of demand for us. And then going forward, we're excited about Zone 3. We think that is a market that is going to start to pick up.

And obviously, those 2 acquisitions in that space we think we have really good offerings there. And then longer term, the direction that the web security market is going in and growing in, we see that as a very big opportunity, but we've got to very much earn our space in that market and continue to develop capabilities. You probably saw we recently announced browser isolation as part of that solution. But the real secret sauce here is that all of these capabilities are delivered as part of an integrated suite that's really simple to manage, and we offer really easy to consume subscription plans for customers to get on board and start taking things off there to-do list in a really slick way.

Got it. Got it. That's really helpful. Maybe as my follow-up for you, Rafe, great to see the revenue go up by about $10 million for the year at the midpoint. And again, apologies if this was addressed in the prepared remarks. But how much of that is perhaps the better -- it sounds like better bookings performance here in Q1 and for the rest of the year versus perhaps some FX tailwinds versus inorganic? Is there a way to sort of parse out that kind of delta in guide?

Yes, you bet, Saket, and thank you. And first, just as a reminder for everyone, we use the FX rates as of July 23 for our guide. So just to set that. So the total raise at the midpoint was $10.6 million, and that's comprised of $1.9 million that is from the Q1 beat as well as the additional $400,000 of acquired revenue that's coming in from the acquisition of MessageControl. And then $8.7 million of FX tailwind. So it's the $1.9 million, plus the $8.7 million of FX tailwind.

Our next question or comment comes from the line of Keith Bachman from BMO.

I wanted to go back to the net retention rate for a second. You indicated some -- a couple of different hertz associated with perhaps lower retention and less upsell. So it sounds like it could be, call it, a 104 number this quarter. But how should we think that -- what's implicit in your guidance as you look out for the subsequent quarters thereafter. Do you anticipate that net retention will be in the mid 105-ish kind of range? Or do you anticipate with some improvement in the economy that might go up. So what's embedded in your expectations as it relates to the rev guide you just gave?

Yes. No, thank you for that clarification. It's a bit detailed. So one of the things to remember with all of these numbers for the net revenue retention numbers, that they are on a trailing 4-quarter basis. And so it does take some time for the numbers to reflect the full measure of the crisis as we're going through that. So just to hit on the components, when we're modeling this, we're looking at what we think is going to play out over the course of the year.

So it will take some time, perhaps for the numbers to move. And we've assumed that the crisis and the economic recovery are going to drag on, perhaps even a little bit longer than we had hoped just 3 months ago as we're seeing resurgences in some places. And so I wanted to break down and give you a bit more detail. So on the downsell and churn side, we believe that rate may rise to approximately 8% as the crisis drags on, 8% as we move through the year. And then on the upsell, we think in our overall upsell rate might come down to between 11% and 12%. Now this is not necessarily for this next quarter. We're thinking that will be -- reflect the economic crisis dragging on and playing out over the rest of the year.

Okay, okay. Yes. Thanks for the clarification. Okay. Yes. So it's probably going to tick down as we run through the year because of the forces you mentioned is essentially how we should be thinking about it.

If the crisis continues to drag on, yes, I'm afraid we'll have some additional headwinds there. But very much naturally if we get -- if the economy starts to bounce back, I think that has probably the single biggest most dramatic effect. But also to remember, we are out to market with a lot of new product and new offerings. And so again, some of the just tendencies of business returning more to normal even if there is tougher environment out there. It certainly gives us a lot of opportunity to get back in there and drive sales of additional products, even if the seat count numbers are somewhat suppressed.

Yes. Understand. Okay. Well, that leads into my second question then because I want to return to competition and just to make sure I poke this more directly in that it's understandable that your attrition rate is going up because you do have some exposure to the SMB community. So lower seat count, South Africa, things along those lines. So I think it's totally understandable that your seat count is getting a little bit of pressure. But to ask it more directly, are you seeing customers migrate away from Mimecast to a competitive offering in the course of this crisis. In other words, are you losing share directly that's impacting the attrition? Or is the vast, vast super majority the seat count and things like that?

Certainly, what we've seen thus far in the crisis, it's been really seat count driven is the biggest driver for where we've felt the crisis. And I think that was particularly so in that first quarter. As I called out earlier, we're worried about some of the companies making it through the crisis that are really directly impacted industries. So those are our 2 biggest concerns by far.

Okay. So in other words, you're not seeing more customers just go native with Microsoft. And that's crowding you guys out at all.

I called out a little bit in the net customer numbers on the very, very low end of the business, but the real dollars and the big trend are as I described.

Our next question or comment comes from the line of Daniel Bartus from Bank of America.

Maybe just one is a little bit more for you, Rafe first. Your exposure to the impacted industries, I think was 14% to 20% last quarter. Wondering if you've guys seen any notable improvement in any vertical sense you gave that metric? And if you think the 14% to 20% is still the right way to think about your revenue exposure right now?

Yes. And that's right. The 14%, just to make sure we're all on the same page was our hospitality, transportation, retail & oil and gas was in there. It's a relatively small amount. Then we have approximately an extra 7% and 7.5% in the medical space. So not surprisingly, that, especially within that 14% group was the group very directly hit during the quarter. And so that's playing out as you would expect. And no real change is there. I would say on the hospital side or the medical side, it's been a bit of a mixed bag. There's instances where people were looking for better security, responding to new attacks that were coming their way. But then likewise, a lot of medical groups are under some severe financial pressure whereas elective surgeries and whatnot dried up. So that was been a bit more of a complicated read. It kind of differs on a case-by-case basis.

Got you. Got you. That makes sense. And then just on the churn, it's good to see it was flat at 7%. It sounds like it's going to 8% in your assumptions. But can you just talk a little bit about the improvements you guys have made to customer success? Are you guys starting to see those investments bear fruit? And could that be a potential offset to the COVID headwinds in the second half of the year, perhaps?

Yes. No, I think that's a great point. One of the things that we've talked about over the last few quarters is Pete brought in a new leader to run the customer success group. She's implemented and is continuing to implement improvements in the group, a lot of which were really focused on making sure we are properly matched, having our very best people working on the big enterprise accounts, making sure they weren't -- those enterprise accounts weren't siphoning off too many resources from other parts of the business. And then really getting to know the accounts and get the early warning mechanisms, if you will, built into the system. So we can get out in front of potential churn risk. And I think that it's starting to pay off. We've seen a notable improvement in enterprise, large account level downsell and churn over the last couple of quarters. So that has certainly been encouraging.

So I think to answer your question, and as this plays out, I do think that there are fruits of that labor out there for us. It's unfortunate that it's perhaps playing out in this environment. So it's not as readily apparent broadly.

Our next question come comes from the line of Jonathan Ruykhaver from Baird.

I just have one question. It's regarding the security awareness training service and the synergies you see with the e-mail gateway products. How important is that in competitive situations? Or is it the content that is the prime differentiator when you go-to-market?

Yes, Jonathan, great question. So I think both of them are quite important. Certainly, we're a big believer in the power of content and the power of really well put together content and its ability to change and shift the culture inside an organization towards being much more security savvy and away from being the weakest link in the security chain. So content is really important, and we've put a lot of emphasis on that.

Having said that, we think there are real advantages for us as a gateway provider in delivering the service. So couple of examples, the opportunity for us to take actual live attacks that are being targeted at the customer, defang those and have those used by the customer as phishing simulation tests, we think is really compelling.

So this capability that we talk about now is SAFE Phish, which will be coming out in our product shortly, we think is really compelling.

The other thing is that we have really good telemetry on what customers -- what the customers end users are actually clicking on. So for example, we rewrite all of the URLs that come through e-mails on an inbound basis. And we can monitor what the clicking behavior is on those URLs, regardless of whether the URL is bad or not. When an end user clicks, we're going do that real-time lookup. So we know that the person has clicked something bad. And we can stop them from going there, but we can record the fact that they behaved in a risky fashion. One of the things that we've seen, which we thought was really interesting was our customers that have bought our awareness training product, which is about 2,300 across our base. The propensity of their users to click bad links is 5.2x lower than the propensity of the users in our broader user base. So that shows us some really good evidence of the power, not just of our awareness training product, but the value of being able to show that telemetry through the integration of the gateway service and the awareness training platform.

I'm afraid we have time for just 1 more question. Our final question will come from the line of Joshua Tilton from Berenberg.

I just wanted to follow up on Saket's question. Has the momentum around the Zone 2 products slowed at all in the current environment? And if so, how do we think about their contribution to upsell and cross-sell today relative to what bakes into your full year guide and even the long-term growth targets that you presented at the Investor Day?

So of our emerging products, the more mature of the set live in Zone 2. And that's the internal e-mail protection solution as well as the awareness training solution. The other emerging solutions are just a little bit newer and working off a smaller base. I think what we benefit from with the Zone 2 solutions is that they've been out there a bit longer. The sales team is just much more accustomed at presenting them to customers. They know the ins and outs. They know how to help make people successful.

And so I think that gives us quite a bit of confidence in their future in the organization. And in the investor deck, you'll see, in particular, IEP had a strong quarter in terms of just the number that have been deployed out there. Awareness training is continuing to grow.

So I think we have quite a bit of runway from those products. And certainly, as we look forward, whether it's just the short-term or the midterm, they're going to be an important part of that story.

Yes. What I would add to that is that we have some seasonality with this having been our Q1. So we have a peak of momentum that comes through in our Q4, typically, and this is just one of the rhythms of our business. And then our Q1 has had seasonally lower and it builds up through the year. So I think COVID probably compounds that a little bit as we look back at it. But I would definitely factor that into observations as well.

That was helpful. And then if I could just follow up. You guys highlighted that very large U.S. retail customer win in the quarter. Could you call out any specific reasons why that customer chose Mimecast over the incumbent solution in the space?

Yes. I think dissatisfaction with the incumbent was one factor. But I think they really liked our cloud-native platform. And the fact that this is built from the ground up with the inherent scalability and reliability and the open APIs and the future-proof nature of the way our platform is built and architected and the kind of agility that it offers them as a very large and distributed and dynamic organization. So I think the technological superiority of what we offer, the focus and attention of what we demonstrated to them during the sales cycle. Of course, efficacy is a key factor for these larger organizations. So it was a number of factors, but we were selected, I believe, because we can solve the problems as they see them going forward in a far better way than the incumbent was able to convince them.

Thank you. I'd like to turn the conference back over to the management team for any closing remarks.

Thanks for joining our Q1 FY '21 earnings call. We've enjoyed presenting our results to you. And stay safe and healthy out there.

Ladies and gentlemen, thank you for participating in today's conference. This concludes the program. You may now disconnect. Everyone, have a wonderful day.