Palo Alto Networks Inc (PANW) 2017 Q4 法說會逐字稿

Good day, and welcome to the Palo Alto Networks Fiscal Fourth Quarter Earnings Conference Call.

Today's conference is being recorded.

At this time, I would like to turn the conference over to Ms. Kelsey Turcotte, Vice President of Investor Relations.

Please go ahead.

Great.

Thank you very much.

Good afternoon, and thank you for joining us on today's conference call to discuss Palo Alto Networks' Fiscal Fourth Quarter and Full Year 2017 Financial Results.

This call is being broadcast live over the web and can be accessed on the Investors section of our website at investors.paloaltonetworks.com.

With me on today's call are Mark McLaughlin, our Chairman and Chief Executive Officer; Steffan Tomlinson, our Chief Financial Officer; and Mark Anderson, our President.

This afternoon, we issued a press release announcing our results for the fiscal fourth quarter and full year ended July 31, 2017.

If you would like a copy of the release, you can access it online on our website.

We would like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding our financial guidance and modeling points for the fiscal first quarter and full year fiscal '18; our competitive position and the demand and market opportunity for our products and subscriptions; benefits and timing of new products and subscription offerings; organizational changes; our ability to drive outside growth rate and trends in certain financial results, operating metrics, mix shift and seasonality.

These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements.

These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future, and we undertake no obligation to update these statements after this call.

For a more detailed description of factors that could cause actual results to differ, please refer to our quarterly report on Form 10-Q filed with the SEC on June 1, 2017 and our earnings release posted a few minutes ago on our website and on the SEC's website.

Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges.

For historical periods, we have provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the Investors section of our website located at investors.paloaltonetworks.com.

We would also like to remind you that we will be hosting Investor Day 2017 with on-site registration starting at 8 a.m.

Eastern Standard Time on Wednesday, September 27, in New York City.

For more information or registration details, please visit our Investor Relations website or email Shane Xie at sxie@paloaltonetworks.com.

And finally, once we have completed our formal remarks, we will be posting them to our Investor Relations website under Quarterly Results.

And with that, I'll turn the call over to Mark.

Thank you, Kelsey, and thank you, everyone, for joining us this afternoon for our fiscal fourth quarter and full year 2017 results.

I'm pleased to report that we ended the year with a strong fourth quarter.

On a year-over-year basis, Q4 revenue was $509 million, up 27%.

Billings were $671 million, up 17%.

Non-GAAP earnings per share was $0.92, up 39%.

And free cash flow was $190 million.

For the fiscal year 2017, revenue was $1.8 billion, up 28% year-over-year.

Billings were $2.3 billion, up 20% year-over-year.

Non-GAAP earnings per share was $2.71, up 43% year-over-year.

And free cash flow was $705 million.

I want to thank our customers, our team and our global partners for these results, their hard work and their ongoing support.

In the quarter, we saw a solid demand environment in all theaters and strong customer interest in all the capabilities of our next-generation security platform.

We also saw continued solid gains from the go-to-market work we started in our fiscal third quarter.

Customer acquisition in the fourth quarter was very strong with approximately 3,000 new customers added.

We are now privileged to serve more than 42,500 customers worldwide.

This is, by far, the strongest quarter for new customer adds in our history, including the addition of a record number of G2000 customers, which now total over 1,250.

We also added approximately 2,000 new WildFire customers in the quarter, bringing our total number of WildFire customers to over 19,000, an increase of approximately 50% year-over-year.

In addition to record new customer additions, we continue to rapidly increase our wallet share of existing customers.

In the quarter, all of our top 25 lifetime value customers again made purchases.

And to make this list, a customer had to have spent a minimum of $21.9 million in lifetime value, a 56% increase over the $14 million in Q4 of fiscal '16.

This represents a multiple of almost 100 times their initial purchase, which is up from approximately 50 times the initial purchase of our top 25 in the prior year period.

Specific examples of customer wins and competitive displacements in the quarter included an 8-figure Cisco replacement, at the one of the world's largest pharmaceutical companies, that included both attached and nonattached subscriptions; a 7-figure Check Point replacement at one of Australia's largest banks to protect the remote offices; a McAfee replacement on 40,000 endpoints at one of the largest energy companies in the United States; a 7-figure Cisco replacement and competitive win against Check Point at a large U.S. loan corporation for data centers segmentation; and a competitive win at a very large global service provider in a cloud data center deal.

Our ability to extend prevention capabilities consistently wherever data is deployed or computed is essential in an increasingly dynamic computed environment.

And as a result, our platform adoption is increasing across the board, along with market-leading growth for our hardware and SaaS security services.

Our nonattached subscriptions, including Traps, VM-Series, Aperture and AutoFocus all performed well in the fourth quarter.

More than 3,400 customers are now using our VM-Series in cloud deployments, and we have sold millions of endpoints to over 1,400 Traps customer.

At the beginning of August, Traps received a maximum performance score of 100% detection of real-world attacks on testing done by AV-TEST, a third-party organization with extensive experience testing endpoint security software.

In addition, we were positioned in the Leaders Quadrant of the July 2017 Gartner Magic Quadrant for Enterprise Network Firewalls for the sixth time in a row.

We continue to take market share, see a rapid adoption of platform and received industry recognition because of our relentless focus on innovation and customers.

For over a decade, we have been driving major evolutions in security that deliver increasingly high rates of consistent prevention regardless of where data may be and marrying innovation with a consumption model that overcomes the legacy siloed, expensive and people-intensive models that have reached a breaking point.

These evolutions build on each other, and fiscal '17 was a very big year for the introduction of new products and capabilities that are driving increased disruption in the market.

In the third quarter, we released our new hardware, high-performance virtualized firewalls and feature-rich 8.0 operating system.

Feedback in these releases has been very positive, which is evident in our Q4 results.

These new products and capabilities were quickly followed in May with the release of Traps 4.0, which added several key security capabilities and extended operating systems support to include macOS.

And at our user conference in June, we announced 2 new services, the GlobalProtect cloud service and the Palo Alto Network's Logging Service.

Our new GlobalProtect cloud service will deliver all the prevention capabilities in our platform, including application visibility and control, threat prevention, URL filtering and WildFire to secure remote networks and mobile users.

Our new Logging Service is a cloud-based offering that is a basis for better security analytics that provides scalable storage capacity and processing power to help organizations store, process and analyze as much data as possible without needing to plan for local compute and storage.

Both services will be generally available in September.

In addition, given our critical mass and deployments of architectural enforcement points globally, we made a game-changing announcement at our User Conference in June of the next evolution of the industry in our platform, the Palo Alto Networks application framework.

This open and flexible SaaS framework leverages the existing Palo Alto Networks security infrastructure already deployed across tens of thousands of global customers, which is growing by thousands each quarter.

The data from these deployments, our extensive threat intelligence and new data from the Logging Service allow customers to address the myriad of security needs by being able to rapidly consume and deploy innovative security applications built by Palo Alto Networks, third-party developers, MSSPs and their own teams.

This brings customers and security innovators a new level of agility and speed by reducing the complexity of creating, deploying and integrating security innovation by leveraging already deployed infrastructure.

More than 30 security industry vendors have already engaged with Palo Alto Networks to develop applications for the new application framework, which we are planning to have generally available in early calendar '18.

There's been a lot of excitement and positive feedback around our fiscal '17 announcements, which we had the privilege of sharing live with customers in June at Ignite and then again just last week at our sales kickoff, where we trained almost 3,500 team members and partners on the skills they need to sell the platform.

The energy level is very high as we come off a strong finish to the year.

As we look forward to fiscal '18, I'm excited about driving further disruption in the market and our opportunity to continue to quickly acquire market share.

I'll turn the call over to Steffan to review the financials and provide guidance in a minute, but before doing so, will bring you up to speed on a few organizational announcements we made this afternoon.

First, I'd like to congratulate Lee Klarich on his promotion to Chief Product Officer, expanding his responsibility to now include engineering as well as product management.

Lee, who has been with Palo Alto Networks since 2006, has been a longtime member of our senior executive team and has played a key role in leading the team that has delivered our market-leading security platform.

I'd also like to welcome Sridhar Ramaswamy to our Board of Directors.

Sridhar, who is currently Senior Vice President, Ads & Commerce at Google, brings deep technical engineering experience and extensive cloud, analytics and infrastructure expertise to the board, and we're very happy to have him.

And finally, Steffan has informed me and the board that he intends to retire from his role as CFO.

The company is initiating a search for his replacement, and Steffan will remain as CFO until the search is completed.

Steffan, you've been a great CFO and friend as well as a great business leader.

You've built a world-class team that has enabled our market-leading growth and positions us well for the future.

While you'll be with us until we find your replacement, I did want to take this opportunity to thank you for all that you've done for the team.

We're all very deeply appreciative.

And with that, I'll turn the call over to you, Steffan.

Thanks, Mark, and thank you for the kind words.

It's a privilege to work with you and the team here at Palo Alto Networks, and I'm very proud of what we've been able to accomplish in leading the market in such a short period of time.

Now let's turn to the numbers and guidance.

I'd like to note that except for revenue and billings figures, all financial figures are non-GAAP, and growth rates are compared to prior year periods, unless stated otherwise.

In the fourth quarter, we continue to see positive indicators of the changes we started to make in Q3 '17 in the go-to-market portion of the business as sales productivity improved sequentially.

This is, by far, the largest new customer acquisition quarter in the company's history, and we saw strong expansion sales in the existing customer base.

I'm pleased with the execution of our growth and profitability strategy as we continue to significantly outgrow the market, delivering record revenue, billings and deferred revenue while also generating record operating income, earnings per share and free cash flow.

In Q4, total revenue grew 27% to $509.1 million.

For the fiscal year, we reported total revenue of $1.8 billion, a 28% increase year-over-year.

Looking at the geographic growth of Q4 revenue.

The Americas grew 27%, EMEA grew 28%, and APAC grew 27%.

Q4 product revenue of $212.3 million grew 11% compared to the prior year and was greater than we expected.

Sales of the new hardware, which we launched in fiscal Q3 '17, contributed to the strong results this quarter.

Q4 SaaS-based subscription revenue of $155.7 million increased 46%.

Support revenue of $141.1 million increased 37%.

In total, subscription and support revenue of $296.8 million increased 42%, accounted for a 58% share of total revenue and is now approximately a $1.2 billion run rate business.

Q4 billings of $670.8 million increased 17%.

The dollar-weighted contract duration for new subscriptions and support billings in the quarter was just under 3 years, essentially flat compared to the end of the second quarter and up slightly year-over-year as customers commit to our platform as their long-term security architecture.

For fiscal 2017, total billings were $2.3 billion, up 20% year-over-year.

Product billings were $711.1 million, up 6% and accounted for 31% of total billings.

Support billings were $715.3 million, up 23%.

Subscription billings were $867 million, up 32%.

Support and subscription billings accounted for 69% of total billings in fiscal '17 compared to 65% in fiscal '16.

This mix shift towards subscription and support is a multiyear trend that we expect to continue given increasing customer adoption of our 8 subscriptions, new subscription services to be introduced in FY '18 and high renewal rates.

Total deferred revenue at the end of Q4 was $1.8 billion, and increased 43%.

Q4 gross margin was 77.3%, a decrease of 210 basis points compared to last year and at the higher end of our target range of 75% to 78%.

The decline was primarily attributable to the new products introduced in our fiscal third quarter.

In Q4, discounting decreased sequentially and year-over-year.

Q4 operating expenses were $273 million or 53.6% of revenue, while operating margin was 23.7%.

For the full fiscal year 2017, operating margin was 20.1%, an increase of 280 basis points year-over-year compared to FY '16 operating margin of 17.3% as reported.

Included in the 280 basis point increase is approximately 100 basis points of organic operating margin expansion.

We ended the year with 4,562 employees, an increase of 767 year-over-year.

Net income for the fourth quarter grew 42% year-over-year to $85.5 million or $0.92 per diluted share.

For fiscal '17, net income grew 47% year-over-year to $253.4 million or $2.71 per diluted share.

On a GAAP basis for the fourth quarter, net loss increased 22% year-over-year to $38.2 million or $0.42 per basic and diluted share.

For fiscal '17, GAAP net loss increased 12% year-over-year to $216.6 million or $2.39 per basic and diluted share.

Both Q4 and fiscal '17 GAAP results included an impairment loss of $20.9 million on property and equipment related to the relocation of our corporate headquarters.

Additionally, we expect to recognize a loss of approximately $15.4 million in our Q1 fiscal '18 GAAP results as we vacate our former headquarters facilities.

Turning to cash flows and balance sheet items.

We finished July with cash, cash equivalents and investments of $2.2 billion.

During the fourth quarter, we repurchased approximately 900,000 shares of common stock at an average price of $134.60 per share, leaving a balance of approximately $580 million available for ongoing repurchases through December 2018.

Q4 cash flow from operations of $239.5 million increased 28%.

Capital expenditures in the quarter were $49.2 million, including $25.5 million of CapEx related to our new headquarters.

Free cash flow was $190.3 million, up 11% at a margin of 37.4%.

Excluding CapEx related to our new headquarters, free cash flow was $215.8 million, up 25.8% at a margin of 42.4%.

DSO was 70 days, at the low end of our target range of 70 to 80 days.

Turning now to guidance and modeling points.

This guidance takes into account the type of forward-looking information that Kelsey referred to earlier.

For fiscal Q1 '18, we expect revenue to be in the range of $482 million to $492 million, an increase of 21% to 24%; product revenue to be in the range of $170 million to $173 million, an increase of 4% to 6%; billings to be in the range of $580 million to $600 million, an increase of 12% to 16%; and we expect non-GAAP EPS to be in the range of $0.67 to $0.69 using 93.5 million to 95.5 million shares.

We expect CapEx for Q1 fiscal '18 to be approximately $30 million, including approximately $10 million final expenditure related to our new headquarters.

For the full fiscal year '18, we expect revenue to be in the range of $2.125 billion to $2.165 billion, an increase of 21% to 23%; product revenue to be in the range of $735 million to $750 million, an increase of 4% to 6%; billings to be in the range of $2.64 billion to $2.7 billion, an increase of 15% to 18%; and we expect non-GAAP EPS to be in the range of $3.24 to $3.34, using 96 million to 98 million shares.

Before I conclude, I'd like to provide some additional modeling points.

For the full year, we expect seasonality for revenue to be in line with historical trends as reflected in FY '18 consensus heading into this afternoon's call; year-over-year billings growth for the first half of fiscal '18 to be approximately 15%; subscription and support revenue to make up approximately 65% of total revenue; our non-GAAP EPS guide to include approximately 150 basis points of organic operating margin expansion, excluding continued investments in LightCyber in the first half of fiscal '18; CapEx to be approximately $100 million; and finally, free cash flow margin to be in the range of 37% to 39%.

With that, I'll turn the call back over to the operator for questions.

(Operator Instructions) And we'll go first to Ken Talanian from Evercore ISI.

So first up, I was wondering, where are you in refreshing the group of customers who are likely to come up to renew hardware within the next year or so and with the new hardware?

And then what assumptions are you factoring into your fiscal '18 guidance around that?

Ken, this is Mark.

I can take that question.

So from a refresh perspective, the cohorts for our customers continue to increase each year, so that gets better and better for us as the years go on.

And we've been doing well in the refresh so far.

We're doing a lot of work to make sure that we capture refresh opportunity and into the future.

In our fiscal '18 numbers, we have a number of drivers associated with product growth.

Refresh is one of them.

It's not the primary driver for growth, but it's one of them in there.

Okay.

And then along those lines, are you seeing any changes to the level of attached for your attached subscription?

Or acceleration in the unattached?

Yes, we have -- the last time we had talked about attached, which was a metric that we were not going to provide any longer because we were more focused on the penetration rate.

The last time we talked about it a couple of quarters ago, we said it was 2.6.

And since that time, it's been rising, continues to rise.

We'll go next to Michael Turits from Raymond James.

Steffan, thanks for all your hard work over the years.

Best of luck in all things.

I'm glad you're sticking with us through the transition.

Two questions.

One, first of all, the guidance was all very strong.

But billings, billings growth is still lagging by about 5 points.

Any thoughts on what's happening there in terms of duration?

Or why we're still seeing that lag?

And then I have a product question.

Yes, sure.

So on the billings side, Michael, the -- as you know, as we came off of the first half of fiscal '17, we are working through some issues, and those are improving for us.

We saw productivity increasing through the second half.

So naturally, we were lower on the billings growth than we originally planned in fiscal '17 as that created a lag to revenue.

We -- as you've seen from the guidance, we'd expect that lag to continue, but it's compressing through the back half of fiscal '18 as we benefit from the ongoing work there.

And we're not seeing any change in duration for FY '18.

And then I wonder if you could talk a little bit more about GlobalProtect cloud service, initial reaction on that.

We've been very positively impressed by it in terms of its importance to the market, and I wondered what else can you tell us there.

Yes sure, very happy to talk about that.

The GlobalProtect cloud service, as I mentioned in the prepared remarks, is a new service that we'll be launching in September, so very shortly.

And this is a way for our customers in remote locations and branch offices to use all of our capabilities with the cloud offering if they choose to do so.

So some customers like to in those kind of locations use hardware, small hardware, and in essence run it themselves.

Obviously, we've been doing that for some quite time for them.

Others, like to have third parties manage that.

We've been doing that for quite some time with our MSSP partners.

And now we'll give them additional way to do that as well through a complete cloud-based solution.

The interest on this is great from when we rolled it out at Ignite and talked with our customers about it.

And we'll go next to Walter Pritchard from Citi.

Steffan, same, it's been great working with you.

Just wanted to ask you about the just free cash flow margin, sort of the high-end of the range you've talked about.

I think you talked about 30% to 40%, and you're at 37% to 38%.

Your revenue guidance at the low end of the range, you've talked about corresponding that cash flow range.

Any help you can give us understanding what's enabling you to drive that better cash flow on revenue that's at the lower end of that range?

Well, there are a couple of moving parts that go into free cash flow, but we are starting to see slight increases in productivity.

So billings growth will help with free cash flow, and then there's also just the overall improving operating margin that we're trying to drive as well.

We've signaled that we're looking at increasing operating margin by 150 basis points of organic operating margin expansion, so that should be helpful as well.

So those are 2 dynamics.

We're solidly within our growth and profitability framework.

And then the last thing is our taxes continue to be very de minimis.

Cash taxes for FY '17 were roughly $9 million, and we're -- we don't see a very big uptake in FY '18 as well.

So those are the moving parts.

We'll go next to Philip Winslow from Wells Fargo.

In your comments, you highlighted obviously strong expansion.

And in the Q&A, you commented on refresh as well.

I really want to touch on the new customer acquisition.

Because if I look at what you did in the second half versus the first half, you clearly saw an improvement there.

Just to the team here.

I just wanted -- I wondered if you could just drill down on that.

Have we started to see the positive impact of the changes that you made mid-fiscal year in terms of the new customer acquisition?

When you look at new customer acquisition, maybe comment too not just on count but deal size and any sort of color you can give.

Yes, Phil.

Yes, so customer acquisition, as you saw, very, very strong in the fourth quarter.

We're happy to see that.

I think there's a number of drivers inside of there.

The first and most important is I just think that the customer base continues to really gravitate towards Palo Alto Networks and the platform and what we can do with that with things that we're talking about doing in the future as well are really resonating with customers who really can't handle all the complexity and cost in the old way of doing things, so there's clearly a move towards platform and we consider ourselves a leader there.

The second thing is more tactical in nature or operational, which you touched on is the work that we've been doing in the go-to-market organization.

It has paid off dividends in the -- early in the second half and through the fourth quarter.

And we would expect that to continue to pay dividends into next year as well.

I think some of that is showing itself through in customer acquisition rates as well.

And then as far as the customers themselves, they are -- we're a very enterprise-focused company.

The ASPs for customers is -- continue to be in the mid-5 digits for us.

That goes up and down in various quarters.

And we certainly pay attention to that, but we pay more attention to the lifetime value and wallet expansion.

And as you heard us talk about, lifetime value continues to grow very nicely across the customer base, including the wallet expansion as well.

So that's all going well.

And then probably, one more thing that's worth noting.

In the fourth quarter itself is we're -- we've seen continued -- continued doing -- continue a great job internationally as well.

So our brand presence and recognition in international markets continues to grow over time and quickly.

And you saw a solid performance in every theater in the world, and that also contributed to the strong customer adoption.

Also, Steffan, just wanted to pass along my congratulations to you as well.

It's been a great run.

Thank you.

I totally appreciate it.

And we'll go next to Pierre Ferragu from Bernstein.

Steffan, maybe -- I hope it's not too difficult a question, but could you give us some perspective on what your thinking process has been?

And how you came to this decision to tell us about you would retire from the role?

And then if I think about Palo Alto going forward in the next few years from where you stand today, what do you think is going to be like is the most important challenge the company is going to face?

Pierre, I appreciate the question.

Over the past 5.5 years, I've been fortunate to be a part of the team that's helped grow and scale to be a market leader, and the company is in really good shape.

We have a lot of management bench strength, and I'm focused on an orderly transition to whomever my successor is.

And when I think about just the overall opportunity for Palo Alto Networks with leading technology, great go-to-market organization and the vision and leadership that the company has, I think the future is very bright.

But I'll turn that part over to Mark.

Yes, thanks, Pierre.

And the second part of your question, I'd say the most important challenge for us in the future is one that's been with us for quite some time, which is to make sure that we can scale well.

I think from an innovation technology perspective, the team has done a very nice job.

We get very high marks from the industry, from the customers, from third-party recognition.

We just launched a whole slew of new services, the application framework that we just announced, we truly believe is very, very disruptive, and it's going to change the entire industry as well again.

We're going to do it again.

It's our plan.

But through all that, we're a large company, growing very quickly.

We have to execute well all the time, and I would make -- I believe that would be the single biggest challenge for us, is just make sure we get it right again and again and again.

And we've been more right than wrong, but we've had our [missteps].

We'll go next to Rob Owens from KeyBanc.

You mentioned in your prepared remarks less discounting in the period, and I was curious if this is a function of the environment or a function of the new solutions that you have.

If you could elaborate, that'd be great.

I think it's a mix of both things, Rob.

So -- and what I mean by that is that Palo Alto has been very well known for bringing the highest levels of security into the enterprise space for a long time.

And as a result of that, I think we're the premium provider in terms of innovation, and we're not the cheap providers in the market from a price perspective.

So our customers pay for value, and we believe we're delivering very high value.

And as we keep delivering more and more capabilities and value to that, they're continuing to pay at the prices we're looking for, and they're getting a lot for that.

So in addition to that, from the price performance throughput on things in the hardware category, those change over time as customers need better and better performance with better and better price for performance, to do things like SSL decrypt and use cases that are growing in nature.

And we've been able to continue to deliver on that for customers as well so that they can have all the performance they need at an acceptable price.

I think it's a mix of a combination of things there.

Great.

And then on the DSO front, massive improvement on a year-over-year basis.

And I guess, it's one of your best results this year.

Was this a more linear quarter than you have seen?

It really speaks to you guys coming -- getting back to a normal cadence of sales?

Yes, that's a great question, Rob.

So we've been operating in the range of 70 to 80 days.

We were at the lower end of the range this quarter.

There are a number of puts and takes to DSO.

We have seen improved linearity.

That's one in particular.

But we've also seen just good business traction as well and good collection cycles.

So a number of things that go into it.

But being at the low end of the range is a good thing and -- but we have a range for a reason because we do see some ebbs and flows to DSO.

We'll go next to Jonathan Ho from William Blair.

Can you, maybe just starting off, give us a little bit of an update in terms of what inning you're in, in terms of the sales reorganization and maybe what steps (inaudible) about that or...

Yes, sure.

Jonathan, it's Mark.

And just so you know, we're barely able to hear you, but I think I got the question.

And from using the baseball analogy of -- from the go-to-market work we've been doing, it's called the bottom of the fifth.

As we mentioned, before, we took a 4-phased approach to this.

We were going to design what we're going to do.

We're going to communicate it to folks.

We were going to implement it, and then we have to put it in run time.

We finished the first 3 phases.

We're in the run time phase.

We have the folks in the chairs for the most part that we need and established the relationships appropriately with the customer.

And this is the human element portion of it now, where we have to have those relationships bake over time.

We're exactly where we expected to be at this time, so very happy with the progress, and we think we're seeing the fruits of that as you can see from the Q4 results.

Got it.

And then just in terms of the application framework.

Can you give us a little bit more detail in terms of how you think that can maybe further differentiate Palo Alto?

And what that can maybe mean for win rates going forward?

Sure.

Well, let me start off on this one in the hundreds of customers that I've spoken to about this over the course of this past 6 months at Ignite, VDCs.

The reaction has been very, very positive.

And the reason for that is that it's pretty obvious that the consumption model in security is fundamentally broken.

What I mean by that is most customers will complain and rightfully so, that they have way too many vendors, how do you add the next one with less people to do it, less money to do it and the complexity to do that.

And what we're doing with the application framework is to continue to change not only what the definition of security is, which is very high rates of prevention, in this case, using increasingly better and better analytics of massive sets of data, but also to be able to consume innovation in a different model.

So there's no single security company that can innovate everything that's going to be needed.

Customers know it.

We know it.

So the application framework is leveraging all of the infrastructure that we've already deployed, and we're increasing that by thousands every quarter from a customer perspective into a big data lake, which is already running at petabytes and petabytes of data for a long time, applying analytics on top of that, which we've been doing for a long time with WildFire and MineMeld and LightCyber now.

And then opening that up through an open API, the tops of it.

Not only the Palo Alto Networks service and capabilities can be consumed off of things you've already deployed, but third parties as well.

I had mentioned on the prepared remarks, over 30 security vendors are currently writing applications into the framework.

We expect that to be a lot more over time, so it's a route to market for other vendors, and including ourselves, where the customer gets to use that capability simply by turning it on without having to deploy something additional into the network or their endpoint or the cloud, which is the very traditional model.

So that's why we think it is very compelling, and customers seem to agree with that.

We'll go next to John DiFucci from Jefferies.

Mark, you said that ASPs for new deals were in the mid-5 digits, but it sort of bounces around a little bit.

By my math, and I tried to figure it out, it was lower than it used to be, let's say, a year ago.

I know we're getting over the last year, where there was a lot of things happening.

If this is the -- does it have anything to do with the greater ratable portion of revenue from new deals, more ratable subscription maintenance than product?

Or is there something else going on there?

John, it's a good question, and I think that when we are adding as many customers as we add every quarter, you see a whole slew of use cases for why people are coming to Palo Alto Networks.

As a general matter, where we can average it all out by the definition of what ASP is, the general matter and you average that all out, we are displacing our competitors at very high rates.

And lots of times, the way that, that happens is they want to use us for something, and they go from there and they expand.

So usually, when we're going to get to come into an engagement somewhere, we're going to -- one of the first things they would do is like put us in a lab environment or a DevOps environment or some environment to get started and test it.

And that, of course, goes into the ASP for what they're doing.

But then what happens almost all the time is they buy a lot more from us and spread out very rapidly, which is why we tend to pay a lot more attention to the lifetime value expansion and the wallet expansion of the customers as well.

So it's not really about ratable subscription services.

It's really about how do you start off with Palo Alto Networks and then what happens after the initial purchase.

Got it.

Okay.

And if I could on the refresh, and maybe this one maybe for Mark Anderson.

Since your new products that just came out last quarter imply improvements, are you seeing with, sometimes, let's call it, the sort of a trade-down we've seen with other companies in history when they come out with new products and when customers start to refresh, they may actually buy a lower-level product because they don't need the same -- maybe they don't need to spend as much as they did previously.

Are you seeing any of that at this point?

I mean, we see -- anytime we bring out a new product family that offers dramatic price performance, we see really 3 things.

We see customers continuing to need more bandwidth because they're moving a lot more applications around, maybe back and forth to public cloud, and then they'll trade up.

We'll see some customers that will trade down because the price performance and the port density meets their needs on the trade down.

But more importantly, this has really become a big factor already as quickly as Q4, is we're getting deals that we would not have otherwise won with the price performance of the -- in particular the PA-850 and the PA-5200 family.

It's just very, very disruptive relative to what's out there with the competition.

So for customers that want real fast capabilities and our next-generation visibility to applications and user behavior, there's nothing like it out there, and that's been a big help.

We'll go next to Sarah Hindlian from Macquarie.

I wonder if you can talk about the overall threat environment a little bit more, where you're seeing dollars rotated in your product?

Or what's sort of driving the better attach rate there on the subscription side would be of great interest to us as well.

Sure, Sarah.

Yes, so on the threat environment, I think the threat environment never stands still, let's start with that, and you can see it all the time in the newspapers in the various attacks.

What we see from that from customers is the increasing recognition that the position you want to be in as a customer is the ability to get every possible shot you can to prevent an attack and be able to do that very consistently everywhere possible.

So that would mean whether it's in your network or in the cloud or endpoints and to be really interjected into the attack life cycle everywhere so you increase the probability analysis that you're going to prevent that attack successfully.

That is the definition of platforms and security, which is the ability to get high degrees of prevention in a highly automated way with less and less human involvement, with tons of leverage from other companies all in the same kind of network effect, if you will, and to get it consistently wherever data resides.

And that's what we're delivering for folks.

So earlier, somebody asked a separate question, which I said the recognition of the need for platform in this kind of environment where the adversary is increasingly automated really is starting to underline the need for less and less complex and manually dependent systems that have been delivered through legacy platforms and point solutions, and that's fundamentally what's happening with the Palo Alto Networks and what's been driving our growth.

That's very helpful.

Sorry for the bad reception.

And on product attach, can you dive into that a little bit, maybe a little bit more color?

And [versus] the order around Traps if you could.

Sorry, Sarah, I missed half of that.

My second part of the question was about Traps.

So first was attached, then was Traps.

Okay.

Yes, as I said earlier on the attached side, a metric that we're not sure is all that helpful for what's happening from the lifetime value and wallet expansion of the customers.

So we're looking at penetration rates, which continue to grow up over time.

And attach rates have increased, as I said earlier on the call, and continue to increase.

We expect that to continue as customers adopt all of our services.

And then on Traps, very happy with how Traps is performing for us, it's getting to be a good-sized business for us.

We have, as you heard, over 1,400 customers now and millions of endpoints, and that's growing really well.

And our -- not only does our sales force agree with that.

They're very excited about selling Traps.

We can see it working very well for customers but so is the partner community as well, where an increasingly large number of partners are becoming Traps specialized partners, getting all the training that's needed in order to bring that to market.

We'll go next to Gur Talpaz from Stifel.

Steffan, thank you for all the help over the years.

So I wanted to ask about interest level and uptake in your standalone subscriptions, namely the VM-Series following the refresh earlier this year.

Given the added capacity going all the way up to 16 gigs per second with the 700 series and as well as the new feature you've added, in the PAN-OS 8. Have you seen any change in the demand pattern for products like 300, 500 or 700 over the past few months?

Gur, we've -- what we've seen is really good demand in both cases.

So customers have lots of use cases, and we are trying to address all of their use cases.

Obviously, some of them, and a big growing part of that, is cloud-based.

And where they're using our VM-Series is in cloud environments, which is -- whether it's hybrid or private or public, we can service all those with the VM-Series.

And with the increasing amount of bandwidth required through because of cloud and SaaS adoption, things along those lines, where we have been and will continue to deliver faster and faster throughput in the VM-Series as well.

At the same time, with the hardware that we have and we're going to continue to have, hardware is an important part of the business, we -- the biggest hardware security provider in the world today by a long shot, we think.

The -- some customers are doing both.

They have physical hardware, and they also have virtualized capabilities in the cloud.

They need the consistent protection between both of those.

And so lots of customers are using our hardware and our VM-Series, and we would expect that to continue into the future.

That's helpful.

And maybe one more follow-up, if I might.

On Traps, within endpoint, there's been a lot of talk about endpoint conversions, primarily through the incorporation of EDR.

Do you feel like that's somewhere you need to go?

Or is this somewhere -- is that a feature you think that can be addressed through the application delivery framework and some of the third parties that are building on top of your framework?

I think it will be both.

So as we went to the very basics of when we launched Traps in the first place, so some of the really simple way to think about things about what you need from a next-generation endpoint security solution, you would want the ability to do prevention if you could, detection if you can, you would want EDR capabilities, and you'd want the ability to do some automated forensics as fast as possible.

So I'm oversimplifying things along those lines.

And what you've seen us do with our road map with Traps is continually march down that list of things and also partner in cases where we don't have those capabilities in the market.

So I think it'll be a mix of those.

And then on the application framework itself, the other endpoint vendors as well are writing applications into the framework, and I think other security vendors will do that even perhaps.

Hopefully, some of our competition will at some point.

Because ultimately, what's best for the customer is the delivery of the best capability against the largest set of data, right?

And we think we are the -- we have the largest set of data today, and we're going to continue to have that because of the very, very fast rate of deployment of Palo Alto Networks globally as you see from the customer additions and lifetime value expansion.

We'll go next to Sterling Auty from JPMorgan.

Let me start, Steffan, congratulations on a wonderful career.

I do know I'm going to get the question, so I'm going to ask it in this form.

Are you retiring or just retiring from Palo Alto?

And can we see you as a C-level executive in another company going forward?

I'm currently retiring from Palo Alto Networks as CFO.

I'd like to take a little bit of time off to figure out what I'm going to do next.

But the most important thing for me right now is to ensure an orderly transition and be here through my -- until my successor is named.

Understood.

Again, congratulations.

And then one follow-up.

Really impressive results out of EMEA.

We saw a struggle out of Check Point and CyberArk in the quarter, and there's been lots of questions about GDPR and other things.

Mark or Mark, any commentary to what you saw in the quarter, perhaps the linearity or the discussions and demand, specifically to the theater?

Yes, Sterling, it's Mark A. here.

We did have a very good quarter in EMEA.

I think a big part of it is the continued kind of elevation of our brand.

And the combination of the marketing and the sales coverage that we have has really helped drive awareness to how we're different, and it gets us appointments.

And with -- and especially with GDPR coming in May of next year.

There's sort of a forced awareness that we're not running around chasing ambulances, but we're certainly being asked questions as subject matter experts.

And we're turning -- showing ourselves to be much more relevant and much more of a thought leader than maybe some of our competitors.

And I think just secondly, the team -- the performance across all regions in EMEA, without exception, was very good and very consistent.

So all the way from the Middle East back to Western Europe and the U.K. and down to South Africa was just very solid.

So I think it's a combination of a good team, elevated brand and just heightened awareness of the fact that legacy point products, security, devices, we need to move beyond those.

We'll go next to Gregg Moskowitz with Cowen and Company.

Steffan, congrats and best of luck.

Mark, I wanted to follow up on the application framework because it does present a fairly radical change to security architecture as we know it.

Can you talk about over what time period you see this playing out as well as what do you think this might mean for your financial model both over the medium term and the long term?

That's a great question, Gregg.

As -- well, we like to be the disruptors in the industry, so we're going to keep doing that.

I think the model for security today or for some time has been increasingly broken consumption-wise, right?

And we did a huge amount of work around that.

I'll call it the first evolution that we drove with the next-generation firewall, where we proved that you could subsume a lot of the capabilities that used to be provided as point solutions as hardware into SaaS applications delivered off of hardware, and that's been a big part of our business.

We did the second evolution about 3 years ago by proving this we have still a lot of way to go on this.

Of course, we're proving that the consistency of having the same kind of security not only to network but also in endpoints and cloud is absolutely critical, and will grow in criticality over time.

And very few vendors are going to end up being able to make those claims that they can do that, high rates of prevention exactly the same way everywhere where the data may be.

And then the third major change of evolution is how do you consume all these things in the future where data will become more and more important.

So that's sort of the set-up.

I think the specific question, though, about the model in the business is we would expect that this would be transformative to the industry over time.

It's going to take time, of course, to do that.

The application framework, as we said, will be available in calendar '18 from us.

And we would expect that over time, it would grow nicely.

And as routes to market become open to security innovators, that would not be able to go build businesses and reach scale and get the data importantly themselves is they could -- that we have because we have it in massive amounts.

And then just a couple of other thoughts around that.

It's a very virtuous cycle, if you will.

And the more capabilities, analytics you can do and data that you have with your own, things that you bring to market like Palo Alto Networks has done in the past and will continue doing in the future or the third parties can tap into through that application framework makes the whole thing more valuable and will pull through the sensors, if you will, the endpoints and the hardware and the virtual capabilities because that's actually how you consume, right?

And then more of those that are deployed, and we deployed a lot of them, we deployed a big amount and drive more data, which makes the data lake more attractive to people to write applications into, right?

So I think you kind of get it, if you will, from the bottoms up and the tops down.

These things are very self-reinforcing and would grow over time.

(Operator Instructions) And we'll go next to Fatima Boolani from UBS.

Mark M., I have a question for you around the lifetime value metric.

That metric continues to be resilient for you and continues to slope upward.

And maybe going back to the basics.

Can you help us understand sort of what's going in that metric?

And maybe what the most sensitive drivers are that are in there that we're underestimating and that continue to outperform for you for that number to breach the $20 million mark?

Yes, sure.

Well, in light -- well, maybe the simplest answer would be everything goes in the lifetime value.

So if you purchase something from Palo Alto Networks, it could be hardware, it could be virtual, it could be maintenance and support, it could be subscription services, it's going to count inside the lifetime value metric, which is one of the reasons why we talked about the multiple of your initial purchase.

Somebody earlier asked about ASPs.

And so if you look at the multiple of initial purchase, it's really big and continues to grow over time.

As far as the other part of the question about what might be less evident, if you will, inside of that, I will turn it over to Steffan and see if he has any thoughts on that one.

Yes, I think as our platform resonates with customers and they're looking to adopt all of our subscription services, all of the new hardware, we have this dynamic where the expansion value of an opportunity once we acquire the customer dwarfs the initial purchase.

So our customers continue to come to us and say they want less security vendors in this space, they're looking for a consolidated platform.

And the fact that we have great innovation engine going on at the company, we're coming out with subscription services and products that customers want to buy, that's playing right into the wheelhouse of where the industry is moving.

So platforms are winning over time.

We believe we have the best platform.

And that -- those are like the key drivers.

Yes, and there's probably a dozen different places in a large enterprise that we can sell our use cases to.

So we're constantly looking to pull more arrows from our quiver and -- which we've certainly done with amazing innovation over time.

And we can do that in multiple places within the enterprise.

So with the right account coverage, we're looking to continue to expand at all times.

We'll go next to Erik Suppiger from JMP.

Steffan, good luck with retirement.

Great working with you.

My question has been -- is, as you look into 2018, how do you see the expansion into cloud services progressing?

Did you see -- what kind of adoption did you see in Q4?

And how do you plan to position the company for that into 2018?

Sure, Erik.

It's Mark.

Well, we saw very strong adoption in cloud.

And in cloud, there's a number of things inside of there.

One is the VM-Series, and so lots of strong customer adoption.

That's a good-sized business for us as well.

It keeps growing at very rapid rates.

We also saw good adoption from Aperture, which is our CASB offering, and we'll throw that into the cloud category as well because I think customers, they do that.

And then the third thing of the services we just announced, the Logging Service and the GlobalProtect as a cloud, a cloud service as well.

We'll also add into the ability to serve use cases into the cloud for customers.

So we'd expect a good adoption over time from that as well.

We'll take our final question from Karl Keirstead from Deutsche Bank.

Maybe given I'm last, I'll squeeze in 2. One is, Mark, on the federal government side, we've heard from Juniper, and most recently, Ciena, this morning about some expected softness in the federal government side.

Obviously, their big quarter is right now.

Your guide for Q1 doesn't seem to reflect weakness, but I'm just curious what you're seeing there.

And then if I could squeeze in a second.

It seems like Palo Alto is replacing John as the head of U.S. Sales, and I'm wondering if you could put that in context.

And is that sort of the last big piece on the sales leadership front as you close on your reorg?

Sure, I'll take -- this is Mark M., and I'll take the fed question and give Mark Anderson the John Spiliotis question.

On the fed side, just as a big picture item, we're a very well-diversified company from a revenue perspective, no vertical in any quarter is representing more than 12% to 14% of revenue so -- which is good because verticals go up and down obviously in sentiment in spending patterns.

Fed has been a very good business for us for a long time.

We'd expect that to be the case in the future, but I believe that there's a lot of uncertainty in the fed space right now giving budget anxiety.

So if you just pick up the paper, you can read about whether we're going to have a budget, a continuing resolution.

And I think that, that has cast a cloud over what's going to happen from a spend perspective, unfortunately, and through the end of the fed year we're spending, which ends in September, as you know.

So we've taken all that into account from a guide perspective, and we hope there'll be more clarity in that space in the not-too-distant future.

But we're watching like everybody else.

I'll turn the other question to Mark.

Yes, sure.

So Karl, with regards to Spili, he was with us for over 4.5 years.

And gosh, what a incredible job he did building the business.

He came to us over a year ago and said that it's mostly for family health reasons, he wanted to shut it down at some point and just in a move of incredible character said, what would be the best time for Palo Alto Networks.

And so as we went through our transition challenges in the second quarter, John was there leading the changes and really driving that and finished up with a really good, strong Q4.

And just hats off to him.

I've known him for 25 years, and he's a good friend and a tremendous guy, and he deserves to take a rest, which I know he's going to do.

So with that much time, we're able to do a good, I think, a good, discreet search and spent a lot of time with Patrick Blair.

Patrick comes with incredible credentials.

He's a good guy, a great culture fit, and he's inheriting a team that's just got incredibly strong bench strength and a lot of tenure in the senior leaders of that team.

And we're excited about what Patrick brings to the mix.

Patrick's got scale, managing thousands and billions, which is important for us as we look to our future.

And he had an incredibly warm welcome at our SKO last week.

And I think people are excited to have him on board because he's got a great reputation here in the Valley.

We're going to quickly wrap up.

Before I turn it over to Mark, I know we gave you a lot of modeling information today.

By practice, we post our script to the website as soon as we hang up this afternoon, so please do go look for that information because there's a lot of detail in there that I think you'll find helpful both for Q1 and for the full year.

And with that, I'll turn it over to Mark.

Yes.

Thanks, Kelsey, and thanks again, everybody, for joining us in the call today.

And as Kelsey mentioned in the opening remarks, our Investor Day will be September 27 in New York.

We hope to see everybody there.

Appreciate your time in the call.

Bye-bye.

That does conclude today's conference.

Thank you for your participation.