Palo Alto Networks Inc (PANW) 2016 Q2 法說會逐字稿

Good day everyone, and welcome to the Palo Alto Networks fiscal second-quarter 2016 earnings conference call.

Today's conference is being recorded.

At this time I would like to turn the conference over to Kelsey Turcotte, Vice President of Investor Relations.

Please go ahead.

Great.

Thank you very much.

Good afternoon, and thank you for joining us on today's conference call to discuss Palo Alto Networks fiscal second quarter 2016 financial results.

This call is being broadcast live over the web, and can be accessed on the Investors section of our website at investors.paloaltonetworks.com.

With me on today's call are Mark McLaughlin, our Chairman, President and Chief Executive Officer, and Steffan Tomlinson, our Chief Financial Officer.

This afternoon we issued a press release announcing our results for the fiscal second quarter ended January 31, 2016.

If you'd like a copy of the release you can access it online at our website.

Before going further, I want to acknowledge the inadvertent posting of our earnings press release on our website earlier this afternoon.

We have identified this is a manual error, and will remediate accordingly so it does not happen again in the future.

We would like to remind you all the during the course of this conference call management will make forward-looking statements including statements regarding our financial outlook for fiscal third and fourth quarters of 2016, the spending environment and market opportunity for our products, subscriptions and services, investment in and increasing demand for our products and subscriptions and services from both new and existing customers, trends and certain financial results and operating metrics, our revenue, billings, deferred revenue and free cash flow growth rates, sales productivity, seasonality, operating leverage, ability to expand market share and deliver profitability, hiring expectations, expansion of our partner ecosystem, product and services development, and our competitive position.

These forward statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements.

These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future.

And we undertake no obligation to update these statements after this call.

For a more detailed description of factors that could cause actual results to differ, please refer to our quarterly report on Form 10-Q filed with the SEC on November 24, 2015 and our earnings release posted a few minutes ago on our website and on the SEC's website.

Also please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges.

For historical periods we have provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the Investor section of our website located at investors.paloaltonetworks.com.

For planning purposes we expect our fiscal third-quarter 2016 earnings conference call to be held after the market closes on Thursday, May 26.

We would also like to inform you that we will be presenting at the JMP Securities Technology Conference on February 29, the Morgan Stanley Technology, Media and Telecom Conference on March 1, the Pacific Crest Emerging Tech Conference on March 1, the Raymond James and Associate 37th Annual Institutional Investment Conference on March 8, and the Piper Jaffray Security Symposium on March 9.

In addition, we would like to invite institutional investors and sell-side analysts to join on Investor Track at Palo Alto Networks Ignite Conference at the Cosmopolitan in Las Vegas.

Our program will start with lunch at noon on Monday April 4. Formal presentations will kickoff at 1 PM Pacific time.

While the event will be webcast, guests who attend in person are invited to stay for our User Conference, which will run through Wednesday, April 6. To register, please email Shane at sxie@paloaltonetworks.com or call him at 408-638-3200.

And finally, at the conclusions of today's conference call we will be posting our prepared remarks to our Investor Relations website under Quarterly Results.

And with that, I'll turn it over to Mark.

Thank you Kelsey, and thank you everyone for joining us afternoon.

I'm pleased to report that we had a very strong fiscal second quarter.

In the quarter revenue grew 54% year over year to a record $335 million.

Billings grew 62% year over year to $459 million.

Free cash flow grew 93% to $136 million.

And reported non-GAAP earnings per share of $0.40.

I am very proud of our results for the quarter and the team's continue hard work in delivering on our mission to secure the digital age.

Security remains a top strategic priority for global enterprises and organizations as they realize that without a significantly improved security posture it is likely that the productivity gains from the Digital Age are at risk.

With this backdrop, it is evident from the results that we continue to capture mind share and market share at very high rates as we become the primary go-to security partner for enterprises globally.

There's a paradigm shift underway, as legacy point products that are primarily reactive are rapidly giving way to our next-generation platform that not only provide superior proactive security but also simplifies networks and reduces the total cost of ownership.

We are unique in having this platform.

And as a result, customers are standardizing on Palo Alto Networks as their security architecture.

We see this in new customer additions, continued strong lifetime value growth and rapidly accelerating adoption of our subscription services.

In Q2 we added close to 2000 new customers.

And are proud to now be serving over 30,000 customers across the globe.

Some examples of wins in the quarter include becoming the advanced end-point protection standard for one of the world's largest consulting and business services companies where we replaced McAfee; replacing Checkpoint in a very large US retailer for both data center and in-store security; and beating Cisco as the standard for company-wide security at one of Europe's largest agricultural producers, as well as that one of the Middle East's largest government agencies.

Our technology differentiation, best-in-class customer satisfaction is also reflected in the continued expansion of customer lifetime value.

To make our top 25 customer lifetime value list in Q2, a customer had to have spent a minimum of $11.4 million in lifetime value compared to $7.4 million in the prior-year period.

Also as an indication of the rapid expansion inside our customer base, 24 of our top 25 customers made a purchase in the quarter as they continued to invest in the complete platform.

The consistent increases in lifetime value demonstrate that not only are customers adding more of our products into their architecture, they are also quickly accelerating adoption of the recurring subscription services that maximize their prevention posture.

The result is strong momentum across our hybrid SaaS model.

For example, as of the end the second quarter we now have over 9000 customers who use WildFire, including over half of the Fortune 100.

We saw the fastest ramp in sales in our history for a new service on our platform with AutoFocus.

We had another very strong quarter, and our largest quarter ever, for TRAPS for sales and new customer additions.

Additions continue to validate the power and prevention capabilities that come from our platform approach with protection at all stages of the attack lifecycle, from the network to the endpoint.

We continue to expand our presence in the data center and service broader market with both our PA-7050 chassis as well as our new PA-7080 chassis.

We also had the largest quarter to date for Palo Alto Networks addition for NSX, the joint solution of our VM series and VMWare's NSX.

Our success here demonstrates our unique platform capabilities in the cloud.

And as we mentioned last quarter, we now serve well over 1000 customers who utilize our VM series offering.

Finally, we substantially expanded our presence within an existing customer, a large financial services company, where we became the securities standard for their software-defined data center strategy in which almost all of our services were adopted.

Our plan to drive high growth, capture market share and have all companies adopt all of our platform capabilities is working.

In fact in Q2 we saw faster adoption of the subscription services capability to the platform than we anticipated.

And our second-half pipeline review at this stage indicates continued strong adoption of our entire platform, especially subscription services.

Very few companies have been able to sustain this level of growth at our scale, and we know the effort takes to deliver results that consistently outpace the competition.

Our go-to-market capabilities and demand generation, field marketing, sales, partnerships and customer support are world-class.

I was particularly pleased and proud of the fact that in the second quarter we were recognized by JD Powers and the Technology Services Industry Association for exceptional services, further evidence of the teams commitment to delighting our customers which result in a strong competitive advantage for us as we displaced existing legacy providers globally.

And we continue to expand our partner ecosystem, including our recent announcement with Proofpoint where we have teamed up to share intelligence on sophisticated attacks, enabling the creation of automated and coordinated protection across our next-generation security platform and Proofpoint's targeted attack protection and social control capabilities.

As we look forward, we know there's concern in the macro environment.

While we do, of course, monitor that closely, some observations early in the quarter are that our customers continue to indicate that security is a strategic issue, and hence a priority spend category in calendar 2016.

Our pipeline is at a record high.

Our executive briefing center continues to run at very high capacity.

And our partners and sales teams around the world are well-trained in proving that a true platform allows customers to not only have a superior security posture, but also superior ROI, total cost of ownership savings since the platform simplifies their network and results in fewer vendors.

Also, I'd like to welcome Frank Calderoni to our Board of Directors.

With more than 30 years of business and financial experience, including his current role as Executive Vice President Operations and Chief Financial Officer at Redhat, as well as his previous role as CFO at Cisco, Frank brings a wealth of experience and a unique perspective to the Board.

And we're very happy to have him.

We look forward to seeing you at RSA next week and at analyst day in early April.

And with that, I'll turn the call over to Steffan.

Steffan?

Thank you Mark, and thank you all for joining us.

I'll start by first covering the results for Q2.

Then we'll describe the business trends and the financial model.

Then we will conclude with Q3 guidance and modeling points.

I would like to note that except for revenue figures which are GAAP, all financial figures are non-GAAP unless stated otherwise.

Q2 total revenue grew 54% over the prior year to reach a new record of $334.7 million.

The geographic mix of revenue for Q2 was 68% Americas, 19% EMEA, and 13% APAC.

Compared to the prior year the Americas grew 56%, EMEA grew 38%, and APAC grew 67%.

We saw a broad strength against a wide range of verticals, and didn't have any end customer concentration.

The three components of our hybrid SaaS model: product, subscriptions, and support all grew well in Q2.

Q2 product revenue of $169.9 million increased 47% over the prior-year.

Growth was healthy across our product portfolio, in particular the PA-7050 and PA-7080 chassis continued to help accelerate growth in the high-end data market.

Recurring services revenue of $164.8 million increased 62% over the prior year, and accounted for a 49% share of total revenue.

Looking at the two components of recurring services, revenue the first component is our SaaS-based subscription revenue of $84.3 million, which increased 68% over the prior year.

Support and maintenance revenue, the second component of recurring services, was $80.5 million, an increase of 55% over the prior year.

Billings in Q2 were $459 million, an increase of 62% year over year.

Total billings for the first half of FY16 were $847 million and grew 62% year over year.

First-half product billings were $315.3 million and grew 44%, accounting for 37% of total billings.

First-half support billings were $250.4 million and grew 72%, accounting for 30% of total billings.

And first-half subscription billings were $281.3 million and grew 77%, accounting for 33% of total billings.

Renewal rates remain high, and contract duration modestly increased to just over two years.

Total deferred revenue grew to $928.8 million in Q2, an increase of 73% year over year and 15% sequentially, underscoring the power of our hybrid SaaS model and increasing visibility into future revenue streams.

Total gross margin for Q2 was near the high end of our target range at 77.2%, a decrease of 60 basis points compared to last year and a decrease of 70 basis points sequentially.

Product gross margin was 76.4%, a decline of 70 basis points year over year and 30 basis points sequentially.

The sequential decline was due in part to product mix.

Over time we expect there will be fluctuations in product gross margin.

Services gross margin for Q2 was 78.1%, a decrease of 60 basis points year over year and 90 basis points sequentially.

The sequential decline was due in part to investments in WildFire and AutoFocus as well as customer support.

Total headcount at the end of the quarter was 3343, up from 2998 at the end of the prior quarter.

We continue to thoughtfully add talent across the business as we scale to support our growth.

For the quarter research and development expense was 11.2% of revenue, increasing approximately $3.5 million sequentially to $37.5 million.

The increase was primarily due to headcount.

Sales and marketing expense for Q2 was 43.7% of revenue, increasing approximately $16 million sequentially to $146.1 million.

This was primarily due to our strong Q2 billings performance and the associated sales commissions.

G&A expense for Q2 was 5.4% of revenue, increasing approximately $400,000 sequentially to $18.1 million.

In total Q2 operating expenses were $201.7 million, or 60.3% of revenue.

Q2 non-GAAP operating margin was 16.9%, representing growth of 450 basis points year over year and 20 basis points sequentially.

Net income for the quarter was $36.3 million, or $0.40 per diluted share using 91.7 shares, compared with net income of $16.9 million, or $0.19 per diluted share in Q2 2015.

Our effective non-GAAP tax rate for Q2 was 38%.

On a GAAP basis for the second quarter net loss was $62.5 million, or $0.72 per basic and diluted share.

This compares with a Q2 2015 GAAP net loss of $43 million, or $0.53 per diluted share.

We finished January with cash, cash equivalents and investments of $1.6 billion.

Cash flow from operations, free cash flow and free cash flow margin for Q2 were $153.8 million, $136.4 million, and 40.7% respectively.

Capital expenditure in the quarter totaled $17.4 million.

The accounts receivable balance was $254.4 million in Q2, up from $196.4 million in Q1.

DSOs decreased sequentially by 1 day and increased year over year by 9 days to 61 days.

With the Q2 recap completed, I'm now going to provide some perspective on the momentum we've been seeing in the business year to date and an update to our target model for exiting Q4 FY16.

We have been, and we remain, committed to driving growth and profitability.

And the growth engine has never been stronger, as evidenced by new customer additions, expansion in current customers and continually increasing sales product.

Billings, revenue and deferred revenue are very robust, and have far exceeded the rate of the market growth and our competition.

With our hybrid SaaS model we have delivered top-line growth with expanding non-GAAP operating margins and generated significant free cash flow.

Customers are increasingly buying all elements of our platform, which is been our strategy and has long-term benefits for our financial model.

As a result we are in a good position to exceed our internal sales expectations, particularly in the rate of services adoption, which you can see in the billings mix which is now 63% services for the first half of FY16 compared to 58% for the first half of FY15.

Overperformance in billings, which drives the mix towards ratable services, means higher deferred revenue and higher free cash flow.

It also means incurring 100% of the commissions expense in period against the higher ratable revenue.

And as a result, slower near-term growth rate of non-GAAP operating margins and EPS.

As we head into the second half of the fiscal year our pipeline is at record levels and indicates strong year-over-year growth in product billings and, with a faster rate of subscription adoptions the pipeline indicates continued overperformance in services billings relative to our original forecast.

For this reason we're making two updates to our full-year guidance.

First, given the timing mismatch of higher services billings and ratable revenue with higher in-period commissions expense, we now expect to exit Q4 at approximately 18% to 19% non-GAAP operating margin, which represents approximately 400 to 500 basis point increase year over year.

And because of that overperformance on billings, we are increasing free cash flow margin estimates to approximately 40% for Q3 and Q4 of FY16.

We continue to refine our target model which will call for increasing our long-term profitability targets.

And we look forward to sharing it with you at our analyst day on April 4. With less than 10% market share in an $18 billion total addressable market, barring any systemic macro issues, we're well positioned to continue to deliver strong top-line growth and profitability.

Now turning to the fiscal third-quarter guidance and modeling points.

We expect revenue to be in the range of $335 million to $339 million, which represents 43% to 45% growth year over year.

And we expect non-GAAP EPS to be in the range of $0.41 to $0.42 per share using 90 million to 92 million shares.

We are starting to see some moderate seasonality in our business, with fiscal Q2 and Q4 showing our strongest sequential revenue growth.

And we continue to expect CapEx for FY16 to be in the range of $85 million to $90 million, which includes investment in infrastructure, cloud service and facilities to support the growth of our business.

With that, I'll turn the call back over to the operator for Q&A.

(Operator Instructions)

Sterling Auty, JPMorgan.

Yes, thanks.

Hi, guys.

I know you mentioned the momentum in the business, but you are right everybody is very concerned about the macro.

Can you give us maybe a little bit of color by some of the major theaters, Europe versus North America?

Are you seeing any lengthening sales cycles or anything else to be concerned about for the macro side?

Hey, Sterling.

It's Mark.

A couple anecdotal points here.

One, in the quarter itself we have January in the quarter.

And the linearity for the quarter was exactly the same as historical precedence.

So we didn't see anything happen in the quarter that would raise any concern around that.

I travel around all the time myself globally.

I had the chance in January to be not only in Europe, but in Asia as well.

And in all places that I went to, the customers that I talk with said that security remains a priority spend item for them as well.

We haven't seen anything to indicate that what we're saying in the stock market means anything about the macro economy yet.

But we watch that closely.

Got it.

And then one follow-up.

On the product gross margin, can you maybe give a little bit more color there?

You mentioned the mix, but in the prepared remarks you were kind of highlighting the higher-end solution as having particular strength.

I would expect that to be good for product gross margin.

It is good for product gross margin.

But remember, as I've highlighted in the past, whenever we come out with a new chassis or a new product there's usually a slightly depressive effect on near-term product gross margins because we haven't achieved volume.

So COGS are a little bit higher than they will be on a go-forward basis.

That's definitely true with the 7080 which was introduced relatively short time ago.

Even though we saw a very strong contribution from our higher-end products, there was a slightly depressive effect until we get to scale.

Karl Keirstead, Deutsche Bank.

Thank you.

Steffan, if we could go to the 4Q operating margins and the decision to lower the guide somewhat.

I just want to make sure I understand.

I feel like Palo Alto Networks has been overperforming on the billings actually for several quarters now.

And you have been able to meet roughly the non-GAAP operating margin guide and expectations.

So what's changing in 4Q?

Is it that you expect a particularly strong billings performance as a result of a good subscription attach?

Or maybe is some other element in the model changing that sort of didn't give you the lever to offset it?

Maybe a little color would be helpful.

Thank you.

Sure thing, Karl.

What we are seeing is customers adopting all elements of our platform, which is very positive for us.

In fact, the attach rate concept that we have introduced over the last few years is becoming less and less relevant, mainly because now we have seven subscriptions that we are selling.

And three of the newest ones are TRAPS, AutoFocus and Aperture.

With the adoption of the overall platform we are looking at outsized billings numbers.

And that's driving incremental billings.

Because those subscription services are effectively deferred revenue and they become ratable revenue, we have 100% of the commissions period -- 100% of the commissions that we are getting in period.

With the mix shift happening, that is what you're seeing.

Bridging from, call it 22% at the low end of our range to roughly 18% to 19%, the vast majority of that is commissions.

And there is a little bit relative to the mix.

Okay.

Helpful color.

Thanks a lot, Steffan.

Rob Owens, Pacific Crest Securities.

Great, and thank you for taking my question.

If we look at the billing strength, you did see a shift to more long-term contracts.

Is that just a function of the environment right now, people are locking in.

I would think given the speculation of weakening, things would be going the other way.

Just a little color.

And I realized it was a modest extension duration.

But your long-term did show some nice outperformance relative to expectations.

We are seeing customers standardizing on our platform.

They want to go with multi-year.

The net effect of that for contract duration was actually very de minimus, just a modest uptick.

If you look at the actual dollar growth from a short-term deferred revenue standpoint, short-term deferred actually grew more in terms of dollars than long-term.

So we are seeing a nice pick-up in both short-term and long-term.

But to your broader point, customers want to standardize on the platform of choice.

And they went to be locking in for a number of years.

That's all good for us.

Yes, Rob.

This is Mark.

That's what we've always wanted to occur and we hope to continue to drive that in that business where folks are making these architectural decisions with Palo Alto.

And I think the market's really starting to realize that the more the prevention capabilities that they adopt, the better the prevention gets.

And you can see that in the growth of subscription services.

And for my follow-up, just want to touch on the partnership with Proofpoint.

And I guess at a higher level, the concept of threat intelligence and where you guys are sharing back and forth.

Is there an opportunity for you to monetize some of the threat intelligence?

Or as a solutions vendor, is it a given that your products should inherently lever this knowledge to increase efficacy?

That's a great question, Rob.

I get that from customers all the time.

So the big picture is, the way that we monetize intelligence is in the platform itself.

The platform is a high proactive prevention capabilities.

And the more intelligence we have in perform, the better job we do with that.

With that in mind, we have an insatiable desire for threat intelligence.

And being able to partner up with Proofpoint to have everything they're seeing from an e-mail gateway perspective is beneficial for us and vice-a-versa for them.

Really interesting, when I'm talking to customers, I have a lot of customers who telling me that they think the day of security vendors trying to monetize intelligence is long over.

And they are very upset with security vendors who come in and try to sell them intelligence as a service where they're trying to monetize that.

I think that's going to change pretty rapidly into the future where you just better be able to take intelligence and put it in your platform and do -- or your products and do something with it for the customer.

And that's where the value proposition will lie.

Michael Turits, Raymond James.

Hey, guys.

Although obviously with that mix shift less than the expected EBIT margin on the exit rate, but really strong guidance at the 40% of free cash flow margins.

So two questions.

One, if we look out long term, and I know you said that you would address that at the analyst day, do we return to reasonable amounts of growth in the EBIT margin?

And also is there anything unusual in those 40% free cash flow margins, or is that sustainable and is that something we should see t expansion in?

Well, as we indicated in the prepared remarks, longer term this business will generate much higher EBIT margins, as we call them, operating margins here, over the longer term for sure.

What the dynamic that you are seeing now is, given that there is more adoption of services and you have higher services billings, because of the commissions expense being hitting in period, as the revenue's coming off the balance sheet that's going to be accretive to margins down the road.

This will be a building margin story.

I think one of the most important things, which you highlighted, Michael, is we just grew free cash flow 93% year over year.

And we are basically looking at very high free cash flow margins.

Many companies have a correlation, a near-term correlation between operating margin and free cash flow.

If operating margins are coming down on a growth rate basis, free cash typically comes down.

That's not the case with Palo Alto Networks.

Because of our powerful hybrid SaaS model, we are actually delivering much more free cash flow than operating margin.

And we feel very good about the overall growth engine in the business.

So as I said, my follow-up is just to clarify.

It's strong, but as we look forward is there anything that is one-time of nature in those 40% free cash flow margins?

Maybe what happens with cash taxes?

How should we think of that trending over time, to the extent you can help us out there.

We'll give you more color commentary on the convergence of free cash flow margin and operating margin over time.

But for the foreseeable future, call it the next at least three years, there should be a pretty wide separation, positive separation between free cash flow and operating margins.

Over time those numbers will converge because we will become more of a cash taxpayer.

And that will -- that plus a couple of other things will see the spread narrow.

For the foreseeable future there should be pretty wide spread between free cash flow and operating margin.

Michael, it's Mark.

There is no one-time aspects in the free cash flow numbers you're looking at right now.

Andrew Nowinski, Piper Jaffray.

Thanks a lot, and congrats on the nice quarter.

Maybe just to start I had a question on product revenue.

It was up 47% year over year, which was not only an acceleration from last quarter but also one of the strongest growth rates we've seen with the exception of fiscal Q4 of last year.

But your total customer count continues to go up by about the same amount, in that 2000 range.

Is product growth coming from a hardware refresh cycle within your install base, or are they just purchasing more of your product within your platform?

Andrew, yes, you can see platform growth generally, right, and then product growth was your specific question's going to come from a number of areas.

One is continued customer acquisition.

You saw almost 2000 new customers.

That's a great land engine for us.

And that continues to drive the entire platform, including products.

That is very healthy.

The second thing is expansion inside the existing customer base.

As we get bigger and bigger, more and more of our business will come from expansion opportunities instead of -- or in addition to the land opportunities.

Expansion is going very nicely as well.

And then the third is we are growing a very large base of business here as far as customers, all with products and all whom at some point will refresh those things.

When we think about what that can look like into the future, using sort of a five-year rule of thumb on refreshes, that would take us back basically to the 2011 cohort.

We add up the 2009, 2010, 2011 it's about 4000 customers total across those three cohorts, which means there's 26,000 more after 2011.

And when we throw in close to 2000 customers a quarter on top of that, that's a gift that just keeps giving into the future.

That's great.

Thanks.

Just a follow-up.

If we go back to comments in fiscal Q4 of last year, you said that TRAPS would be a material contributor to revenue in FY16.

I'm wondering if you put any parameters around that in terms of what we should expect now that we're in the back half of the year?

So what we said was we thought it would be like a more material contributor to the overall business.

And we have seen that.

We have seen a record quarter for TRAPS in terms of billings.

However, because it's a subscription-based revenue model, revenue will be coming of the balance sheet coming into the P&L.

That is more of a future growth driver for top-line revenue.

It's definitely been a more meaningful growth driver for billings, but it's coming off a relatively small base.

So we feel very good about the endpoint business.

It completes -- helps complete our platform story.

We'll give you more color at analyst day about customer accounts and that sort of thing.

But there's been very nice traction there.

Philip Winslow, Credit Suisse.

This is Filipe Vinagre for Phil.

Congrats on another awesome quarter.

Just wanted to drill into the subscription business.

Good to see solid growth there.

Last time you gave subscription attach rate around 2.2 per box.

Just wondering if you have any update on that, what you're seeing there?

And also one of your new subscription, just wondering what kind of feedback you are getting on AutoFocus?

That would be great.

This is Mark.

On the attach rate side, attach rates are good and growing.

We will give you more color on that in analyst days in about 35 days or so.

The attach rates continue to do very well.

And then on the new services, which are in the order of history there TRAPS, AutoFocus, and Aperture.

TRAPS Steffan just spoke to.

Continues to do very nicely for us.

AutoFocus you may have heard, I mentioned in my prepared remarks.

We've enjoyed the fastest sales ramp in the history of the Company for a new service with AutoFocus.

So there's great demand for that.

And a very strong pipeline for Aperture as well, as people continually get interested into the CASB for third-party applications.

Just harkening back to the attach rate thing as well.

And we will discuss this in more detail at analyst day.

As we continue to have more services that don't have attach rates on them, we will talk through how that impacts the concept of attach rates, but I think it'll become increasingly irrelevant to the business over time.

We're thinking more in terms of billings or subscription billings on those services because it's how much dollars that comes in that really matters.

Got it.

Thank you.

Matt Hedberg, RBC Capital Markets.

Thanks for taking my questions.

Another one on TRAPS.

It sounds like there was a nice McAfee AV replacement in the quarter.

I am curious, do customers normally replace their antivirus solution completely with a TRAPS install?

And I'm wondering if you could talk about the drivers for adoption versus legacy solutions.

Is it cost?

Is it better prevention?

Or maybe a combination of the two?

Hey, Matt.

It's way more about security than it is about cost.

So folks are more and more realizing that if you are thinking about security and prevention, which is what they want to do, where the data is.

A lot of data is at the endpoint.

And that's one of the easiest ways to get into the network as well, as AV continually to be less and less relevant there for them.

On your first question, folks want to -- I think more and more want to replace AV, not because so much they want to get rid of AV, but they just want to have security that actually work for them.

In the cases we see people who said, I have to have, I really want to have AV.

It's become more and more places that have to do that for compliance reasons or audit reasons, and they are doing something additive on top of that.

The primary driver there is security.

The other interesting thing that we hear a lot, and it's really analogous to where we started in the firewall space, and then all the other components that made their way into the networks over time, [co]-stateful inspection, firewalls more working for them as they built more and more complexity in the network.

It's the same thing on the endpoint.

People are -- they're not interested to add one more agent onto the endpoint.

They have a lot of them there.

So the same kind of simplification for better security that would result in better total cost of ownership, but primarily simplified on the endpoint of better security is a driver.

And it's very analogous to what we saw when people said, I don't want firewall-plus-plus-plus.

They want the simplicity of the network and better security.

It's working just on the endpoint as we thought it would.

And we have a lot of experience in selling that kind of concept from our network genetics.

That's great.

And then I think you called out the 7080 box in the prepared remarks.

Could you talk about some of the performance benefits there versus some of the other high-throughput boxes?

And how are yours holding up under pressure now that they're under increased traffic, now that it you've got more history there?

Sure.

Well, the 7080 first, so everybody know.

That's our latest chassis.

It's a 200 gig throughput and it's a10-slot cards in there.

So that's what it looks like.

It's pretty exciting in the data center server for better space because it's very high throughput.

But even more important than the high throughput, it has all of the security capabilities that Palo Alto's known for now fro a prevention perspective.

So you get the best of both worlds with all those prevention capabilities and increasingly a higher throughput with none of the degradation in performance that you get with stateful inspection firewalls when you have to turn on various concepts that are really reduces those throughput.

So one of the favorite angles for our competitors is to talk about faster and faster and faster stateful inspection firewalls, partially because they have to because every time you turn on one of these other cobbled together capabilities for IPS or filtering or APT or something like that, it seriously degrades the performance in the first place.

And that's something that we don't experience because we have a single throughput engine.

So we're getting really high marks in the market so far for this.

Keith Weiss, Morgan Stanley.

Hi, great.

This is Melissa Gorham calling in for Keith.

Mark, I just have a high level question.

Growth is clearly pretty impressive, or very impressive on the billings line.

And if you look across the universe it seems like some of your peers are seeing decelerating growth.

It does seem as though potentially your share gains are accelerating.

Is that the right way to think about it?

And how much runway do you think that you have in terms of share gains within the core network security market?

That's a great question, Melissa.

A couple angles or ways to think about that, or at least the way we think about that.

If you start with the size of the addressable market, as you know, is very big and us at high single digits, or about 10% market share.

There seems to be a lot of runway from an addressable market opportunity capture perspective.

And then inside of that, who is capturing what?

There's money here.

It's up for grabs.

I did a simple math experiment the other day, just because I saw some third-party numbers on market share.

And they tend to be kind of confusing to me because it's really hard to tell who's doing what there.

So what I did was I took five vendors.

Palo Alto Networks, Cisco, Checkpoint, Fortinet, and Juniper, and using the last calendar reported quarter, meaning this one for us and their fourth quarter for everybody in their fourth quarter.

I added up the year-over-year increase in revenue across all five of those vendors.

And the total amount of new revenue across all five of those vendors was about $3 million.

That's the total of pie that everybody added.

Inside of that, Palo Alto is about $120 million of the $300 million.

The average is $58 million, Roughly $58 million if you do the math.

We're about $120 million of that.

I can give you the other numbers if you care about that.

It's very obvious that we are taking share from everybody in the space in order for those kind of numbers to work out that way.

Okay.

That's actually -- that's really helpful.

One quick one on the federal opportunity.

There is definitely more of a push from the Administration on enacting fiber security laws and also incorporating more into the budget.

I know there's nothing necessarily concrete today.

But can you just give us a high-level overview of what you're seeing in terms of federal traction?

And then what you're expecting in terms of growth.

Our federal business is good and growing.

So it's a market we like a lot, not surprisingly given what our technology does and what the government more and more needs and recognizes they need.

A couple things that are interesting.

You noted that -- or I think you were noting that recently President Obama came out and called for a 40% increase in cyber-security spending.

We will see what happens with that.

That's a request, not in order.

We will see what happens with that, but if -- obviously if there was that amount of spending there, it's $5 billion of additional dollars if it comes into the federal budget, specifically for cyber-security.

And on the same day he announced that, the Director of National Intelligence said that cyber-security is the number one national security issue facing the United States.

So I think the amount of attention from the government on cyber-security is very, very high, and could even be higher.

But more interesting than that, they're trying to put the money where their mouth is there with some of these announcements of what we have to do to take legacy architecture across the federal space and get it into next-generation platforms so we can really do prevention.

Ryan Hutchinson, Guggenheim.

Great, thank you.

Steffan, my question's on billings.

I know you don't give guidance.

But one way to look at it as a percentage of revenue.

It stands at 137%, which is the second highest ever outside of Q4 of last year.

So given we're going into the seasonally weak period, obviously offset by some subscription attach rates and this platform plate you have alluded to, is this trend sustainable?

Any color there would be helpful, because basically you can look at this one of two ways.

If it trends back towards more of an average of where you've been over the last eight quarters, billings will be down sequentially.

You look at it the other way and it trends flat to slightly flattish, let's call it.

Billings actually could be flat to slightly up.

So that would be my question

Okay.

So we don't guide on billings, I can just give you kind of directional commentary.

It would be -- candidly be a surprise to us if we went backwards on a sequential basis.

The power of the platform, the pipeline that we have, you look at how the set-up is for Q3 and Q4.

Even though we are in a relatively seasonally weak quarter in Q3, we are still looking for growth.

And so that would be my answer.

I can't give you a rule of thumb relative where billings in revenue is, but with more subscriptions being adopted, and I'll parse that out, more being attached and then more of the three subscriptions that we're selling without being attached, there should be good growth there.

Okay.

So it will grow sequentially, is what you're telling us?

Directionally.

Thank you.

Erik Suppiger, JMP Securities.

Yes, just first off on the duration.

Steffan, can you give us a heads-up on where that was last quarter or the year-ago quarter?

Yes, it just shy of two years last quarter.

And I'd have to pull up with where the year-ago quarter was.

But there's been a -- we have been calling out that there's been a modest uptick in duration.

But quarter on quarter we're talking -- it's measured by -- in a couple months type of thing.

Not a very big move up in duration.

Okay.

And then on the services growth, is that driven more by the installed base going back and up-selling, or is that equally driven by new products going into new customers?

It's a combination of both.

What I can tell you is, we have seen a fantastic opportunity going back into our installed base, selling them more elements of the platform.

They are adopting a lot more subscription services than they have in the past, both the ones that attach to the devices and the new subscriptions.

So proportionately, given the fact that we have, call it 30,000 customers, or heading into this quarter we had about 28,000 customers, that the pie is much bigger there than new customers that are being brought into the fold.

The expansion opportunity is definitely bigger than the new opportunity.

The up-sell and cross-sell that we are able to do is a testament to our go-to-market functionality that we've put in place with Mark Anderson leading the charge there.

We have been able to put in programs to monetize the accounts.

Jonathan Ho, William Blair.

Hey, guys.

Congrats as well on the strong quarter.

I just want to understand, you guys talked a little bit about strengthen in your NSX business.

And I just wanted to get a sense from you, or some additional color in terms of what may be driving this, as well as what you're seeing in the data center market?

Hey, Jonathan.

It's Mark.

Something we have seen for a while, and I've mentioned it before is, is that when customers are thinking about security, they're thinking less and less around topology and more around data and prevention.

So what they want to do is make sure they have this best prevention posture as they can have, wherever the data is.

So when you think about where is data going, more and more a lot of it's going into public/private cloud environments and next-generation data centers, right?

When that's where it's going, they want to make sure it's secure.

And that's I think partially what's driving a lot of strength in NSX itself.

And then with our relationship with VMWare with the integration of VM series in there, that's better that they're going to do in that space.

And they've been reporting pretty good numbers there.

That's a great opportunity for us as far as where we can hunt along with them to provide the security.

Got it.

And then could you talk a little bit about the investments that you are making on an international basis?

Whether you are sort of pleased with the performance that we are seeing out of EMEA and APAC?

What you think those regions, the potential could be over time?

We are pleased with the international performance.

You can see, if I back away from that a minute, just the North America which is a continued powerhouse for us.

So it's fantastic to see a business the size North America continue to grow at the rate that it's growing.

I think that just shows how much demand there is still in a mature market for Palo Alto, with single digit market share.

And then when we look internationally as well, we're seeing strong international growth.

You can see in our numbers there, we had a very strong growth in APAC, quarter over quarter -- or year over year.

And we also had a good quarter in EMEA as well.

As we continue to make investments in various areas, we expect to continue to grow these businesses.

And our market share in those markets is even lower than it is in North America today.

So there's even more upside.

Fred Grieb, Nomura.

Thanks, guys.

First up, going into RSA, can you discuss customer interest in WildFire versus TRAPS?

I know for a few years APT has been a top priority for CSOs.

But is there any chance you're seeing the shift towards the endpoint this year?

Hey, Fred.

I think I'll make a prediction here.

(Laughter) that it's always dangerous to make predictions.

But I think you're going to see in RSA this year a lot more folks than just Palo Alto talking about prevention.

Last year we were talking a lot about platforms.

And people came around to that thinking right away from a marketing perspective.

And I think you're going to see a lot more people trying to market around prevention, now that we've shown that that's the right approach to this philosophically.

And when you're doing prevention, you have to do it everywhere, wherever the data as I was saying a little earlier.

And there -- I think there will be a lot of focus and conversation around endpoints, given that prevention historically has been pretty weak there.

And that's why people are adopting TRAPS so rapidly.

So I would expect that be the case.

On the WildFire side, while thinking about advanced persistent threats and threats, and how do you take an unknown threat and turning it into a known threat, that's as relevant as it ever has been.

And it's probably going to be incredibly relevant into the future because it's the unknown threats are the ones that are going to get you.

That's why people are adopting WildFire so rapidly as well.

Got it.

And then maybe can you provide a little bit background on why it made sense to partner with Proofpoint instead of bringing to market your own solution?

Well, Proofpoint's an e-mail -- primarily e-mail security company.

So what they're sitting in front of email server or a gateway with their technology.

And that's messaging security.

If you parse out the whole security industry, messaging security is separate from traditional network security.

We're just in different markets with very complementary capabilities.

Things that come through email are interesting to us from a threat perspective because sometimes it's the first place you see something.

And there's obviously a lot of phishing attacks and things like that.

So getting the ability to gather the information from a threat perspective from somebody like Proofpoint and put it into WildFire makes WildFire very powerful.

On the flipside for them as well, everything that we are seeing from endpoints and networks that are related to threats that they in turn can use to make their technology smarter about the threats as well makes sense, too.

So it's a very symbiotic relationship.

Gur Talpaz, Stifel.

Great.

Thanks for taking my question.

As customers migrate workloads into the public cloud, have you seen any sort of pick up in interest for the VM series for AWS?

And then more broadly speaking following up, how do you feel about AWS and public cloud adoption more broadly impacting your business?

Thank you

Hey, Gur.

It's Mark.

So for AWS, I think we mentioned in the last call that we had -- well, on this call we mentioned we had over 1000 of our customers and growing using our VM series.

So start with that as sort of a baseline.

And then the VM series capability and use and integrated at different places is growing well too, like NSX in the private cloud environment.

I think last quarter we said we had over 100 customers currently using our VM series and AWS.

And that's growing too.

And we'll update you all that -- on those kind of things at analyst day.

So what we are seeing again is folks saying, where is my data and I need to protect it.

And we don't want security to be an inhibitor about where the data can be.

So if it's going to the public cloud, then workflow, a lot of times developers just put it up there and the security guy doesn't know about it yet.

Those are the kind of things that worry security people.

They want to make sure that they can secure those things.

On the general question of AWS as a platform versus security, AWS is doing a lot and will do a lot to secure the platform itself.

But from a security perspective of things like applications and network connections back to the ones who are consuming this stuff, the enterprise who consume this stuff, that's not something that they do and I doubt that they will because that's where companies like a Palo Alto Networks who've spent a decade honing prevention capabilities, and that's why having more capability in AWS is very powerful.

Gregg Moskowitz, Cowen and Company.

Thank you very much.

Mark, I'd like to go back to your comment on AutoFocus being the fastest ramp of any Palo Alto subscription.

My understanding is it's sold per security operator.

And because of that, I was always wondering how big would this market be, and would it just relevant to a fraction of your very high-end customers?

Is the strength that you saw mostly a function of high ASPs?

Or are you also seeing pretty broad customer uptake out of the gate?

Anything you can do to help size the AutoFocus opportunity would be helpful.

Yes, sure.

So if I back up for a second.

Just say AutoFocus, list price for that is $35,000 a year per operator rights.

Think of this as a tool that an operator would look at and get highly correlated, relevant intelligence that can give them things to do proactively about threats in their network based on everything we are seeing from 30,000-plus other networks today and growing.

That's what it, and that's the price point today.

As I noted, that is the fastest growing service we've ever had, which is fantastic.

I think the appetite for people to want to do proactive prevention is very high.

And the ability to bring that kind of hard-core correlated analytics to bear is interesting.

It's been interesting to large companies and medium-size companies as well.

So what we've seen so far in selling is, is that people understand it very quickly.

Now, in the base of customers, large companies are going to have a lot more operators than small companies.

So we've seen and we expect to see some companies will buy one of them, for a license for one of them, for operator and larger companies will buy multiple license for multiple operators.

So the early view on this is it's got a very wide applicability.

Jayson Noland, Baird.

Thanks for fitting me in.

Mark, I wanted to ask about non-perimeter defense.

Palo has a network segmentation gateway.

Others have talked about their internal segmentation firewall.

What are your thoughts on this market today and what should we expect down the road?

Yes.

I think segmentation is very important and customers want to do that.

I think they're great to try to do, and rightfully should do it everywhere they can.

They may do segmentation on internal networks from a user perspective and segmentation of data on externally-facing servers in data centers.

And that's a good idea.

I really don't think is any correlation between the two from how many -- what are your needs internally versus what your needs going to be externally.

There's no correlation about doing more in one area is going to be reduce the need in others.

It's just a good hygiene idea to do segmentation wherever you data is.

And the more they want to do it in the internal, that'll drive internal business.

And the more they want to do it external, will drive the external business.

I wouldn't think of that as an either/or.

I think of that as both.

Okay.

And then as a follow-up, you mentioned the seven subscription modules earlier.

In cal 16, is focus on ramping some of these newer modules versus launching new modules?

What you've seen us do in the past is be -- we think we are thoughtful, hopeful you would agree with this.

But be very thoughtful from a platform perspective that does prevention as to what should be a in the platform.

We are not attempting to roll up the security industry just to have a lot of stuff.

What we are trying to do is to make sure that when we think about the attack lifecycle, and every chance we can get to interdict an attack before it can ultimately be successful across the lifecycle, can we have a very good, and increasingly better and better and better prevention capability, every one of those points.

That's really the philosophy that's driven the Company in our entire roadmap over the last 10 years, and will into the future.

So I would expect we will have more services later as the attack landscape changes, and we'll definitely want to make sure wherever the data is going to be.

And that does conclude the question-answer session.

I will now turn the conference back over to you for any additional or closing remarks.

Great.

Thank you, everybody, for joining us this afternoon.

I'm really excited about the future.

And I'd like to thank our customers, partners and the whole Palo Alto team for their hard work and support in Q2.

We look forward to seeing many of you at analyst day in April.

Thank you

Thank you.

And that does conclude today's conference call.

We do thank you for your participation today.