Palo Alto Networks Inc (PANW) 2018 Q1 法說會逐字稿

Good day, and welcome to the Palo Alto Networks' Fiscal First Quarter 2018 Earnings Conference Call. Today's conference is being recorded. At this time, I would like to turn the conference over to Ms. Kelsey Turcotte, Vice President of Investor Relations. Please go ahead, ma'am.

Thank you. Good afternoon, and thank you for joining us on today's conference call to discuss Palo Alto Networks' Fiscal First Quarter 2018 Financial Results. This call is being broadcast live over the web and can be accessed on the Investor section of our website at investors.paloaltonetworks.com.

With me on today's call are Mark McLaughlin, our Chairman and Chief Executive Officer; Steffan Tomlinson, our Chief Financial Officer; Mark Anderson, our President; and Kathy Bonanno, our newly appointed CFO.

This afternoon, we issued a press release announcing our results for the fiscal first quarter ended October 31, 2017. If you would like a copy of the release, you can access it online on our website.

We would like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding our financial guidance and modeling points for this fiscal second quarter and for the fiscal year '18; our competitive position and the demand and market opportunity for our products and subscriptions; benefits and timing of new products and subscription offerings; our ability to drive outside growth rate; and trends in certain financial results, operating metrics, mix shift and seasonality.

These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future, and we undertake no obligation to update these statements after this call. For a more detailed description of factors that could cause actual results to differ, please refer to our annual report on Form 10-K filed with the SEC on September 7, 2017, and our earnings release posted a few minutes ago on our website and filed with the SEC on Form 8-K.

Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges. For historical periods, we have provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the Investors section of our website located at investors.paloaltonetworks.com.

We'd also like to inform you that we will be participating in the Credit Suisse 21st Annual Technology, Media & Telecom Conference in Scottsdale, Arizona, on November 30; the Raymond James 2017 Technology Investors Conference in New York on December 4; the 2017 Wells Fargo Tech Summit in Park City, Utah, on December 6; the Barclays Global Technology, Media and Telecom Conference in San Francisco on December 7; and the Cowen Networking and Cybersecurity Summit in New York on December 13.

And finally, once we have completed our formal remarks, we will be posting them to our Investor Relations website under Quarterly Results.

And with that, I'll turn the call over to Mark.

Thank you, Kelsey, and thank you, everyone, for joining us this afternoon for our fiscal first quarter 2018 results. I'm pleased to report that we delivered a strong start to the fiscal year. On a year-over-year basis, Q1 revenue was $505 million, up 27%. Billings were $596 million, up 15%. And non-GAAP earnings per share was $0.74, up 35%.

In the quarter, we saw a healthy demand environment in all theaters as well as strong customer interest in all the extended capabilities of our Next-Generation Security Platform, from network to endpoint and cloud. The go-to-market changes we made in midyear fiscal 2017, which were designed to drive growth and leverage at scale, are paying dividends for us and our channel as we start off our new fiscal year. In the quarter, we added over 2,500 new customers and are now privileged to serve over 45,000 customers globally.

In addition to strong new customer acquisition, we also continue to rapidly increase the wallet share of our existing customers. Our top 25 customers each spent a minimum of $23.2 million in lifetime value in Q1, which is a 53% increase over the $15.2 million in Q1 of fiscal '17. The rapid growth and adoption of our platform results from our relentless focus on innovation and our customers.

Specific examples of customer wins and competitive displacements in the quarter included: a 7-figure competitive win against Cisco in a virtualized datacenter deal with a U.S. military organization; a Cisco displacement as the standard security vendor at one the world's busiest airports based in EMEA; a Check Point displacement at one of the world's largest technology companies to become its global security platform; a Check Point displacement in the data center of one of the world's leading payment processors based in the United States; and a Symantec displacement in an endpoint deal for 10,000 workstations at a U.S. federal agency that also included AutoFocus.

There are 3 hallmarks to our platforms that are increasingly well understood by customers and prospects. The first is our ability to provide increased prevention through automation and orchestration. Second is our ability to deliver these security outcomes consistently across on-premise, endpoint, cloud and hybrid environments. And third is our demonstrated ability to continually push the boundaries to simplify consumption models at a time when organizations are struggling to balance security needs with limited operational manpower and budgets.

To accomplish these objectives, we continue to drive disruptive evolutions in the market that are designed to meet today's most challenging security requirements and that build on each other over time to establish significant competitive differentiation.

To that end, we introduced 2 new offerings in September: first, GlobalProtect cloud service, which delivers the Palo Alto Networks next-generation security infrastructure for remote offices and mobile users as a cloud-based service. This offering opens up new use cases for us to help widely distributed organizations improve their security and reduce complexity.

Also in late September, we introduced the Palo Alto Networks Logging Service, our cloud-based offering that stores context-rich logs generated by our security platform. Managed seamlessly with our existing Panorama management product, the Logging Service is the foundation of our Application Framework, which is the next major evolution in security. We expect our Application Framework to provide a new model for the delivery of security applications that can apply advanced analytics to massive datasets and have automated workflow decisions enforced through already deployed capabilities in the network, on the endpoint and in the cloud. We have received great feedback from the hundreds of customers briefed on the Application Framework, which we are on track to deliver in the first half of calendar 2018. Initial reception to GlobalProtect cloud service and the Logging Service has been strong, and we are very pleased to have closed several deals in the first quarter.

In addition to our new services, we further enhanced the capabilities of Traps, our advanced endpoint protection offering, with the introduction of version 4.1. Among the many new features, 4.1 added behavior-based ransomware protection, enhanced kernel exploit prevention and local analysis for Mac OS. And just a few weeks ago, Traps scored a 100% protection rate and earned the "Approved" award in the Business Security Report published by AV-Comparatives, an independent organization that tests and assesses AV software. This is yet another third-party validation of our ability to replace traditional AV products.

And in October, we expanded the capabilities of Aperture, our Cloud Access Security Broker offering. As part of the migration to the cloud, many organizations are adopting a multicloud strategy that includes storing large amounts of data within cloud environments and which requires advanced protections that complement basic native cloud offerings to achieve comprehensive and consistent security.

Aperture now provides application protections for several AWS solutions, including Amazon EC2, AWS Identity and Access Management, and Amazon S3. We also enhanced our support for Office 365 and Google applications to include cloud-based e-mail services and G Suite Marketplace applications. We continue to see very good traction with customers as they look to us to help them work through the requirements of security in a hybrid world.

Also, we were recently honored to be named to Fortune Magazine's list of Top 50 Companies Changing the World and to the Fortune Future 50 list. These acknowledgments further underscore our commitment to innovation and our dedication to improving security outcomes for our customers.

I also want to welcome Kathy Bonanno as our next Chief Financial Officer. Kathy joined our team in 2014 and is currently Senior Vice President of Finance responsible for financial planning, treasury, enterprise risk management and facilities. With more than 3 years at Palo Alto Networks, a decade in cybersecurity and 30 years business experience, she has an intimate knowledge of our company, the industry and broad expertise across financial disciplines as well as a proven track record of building world-class organizations.

Congratulations, Kathy. I look forward to continuing to work with you

Thanks, Mark. I'm excited about this role and my work with the team. I believe we have a truly unique opportunity to continue to disrupt the security market, take share at scale and increase operating leverage. I will be at several of the upcoming investor conferences and look forward to meeting those of you I don't already know.

Congratulations, again, Kathy, and we look forward to taking the reins off from Steffan this coming Wednesday.

And before I conclude, I want to thank our customers and partners for their support and our team for their dedication to our mission, which is to protect our way of life in the digital age. And with that, I'm going to turn the call over to Steffan.

Thanks, Mark. I'd like to add my congratulations to Kathy as well. I've really enjoyed working with you, and I know you'll be successful in your new role.

Now let's turn to the numbers and guidance. I'd like to note that, except for revenue and billings figures, all financial figures are non-GAAP, and growth rates are compared to the prior year periods unless stated otherwise.

In the first quarter, we delivered strong performance against our land-and-expand go-to-market model. In addition, the power of our hybrid-SaaS model was evident in record deferred revenue that continues to be driven by our ongoing mix shift to subscription and support; year-over-year non-GAAP operating margin expansion, which drove 35% growth in non-GAAP EPS; and very healthy free cash flow generation. As we look to the balance of the fiscal year, we're pleased with our improving execution and widening competitive positioning, which is further differentiated by our new offerings.

In Q1, total revenue grew 27% to $505.5 million. Looking at the geographic growth of Q1 revenue, the Americas grew 25%; EMEA grew 35%; and APAC grew 25%.

Q1 product revenue of $186.5 million grew 14% compared to the prior year. Sales of the new hardware, which we launched in fiscal Q3 '17, continued to perform well as we land new customers and upsell them into our existing customer base.

Q1 SaaS-based subscription revenue of $169.3 million increased 40%. Support revenue of $149.7 million increased 32%. In total, subscription and support revenue of $319 million increased 36% and accounted for a 63% share of total revenue, which was a 420-basis point increase compared to last year.

Q1 total billings of $596.5 million increased 15%. Total deferred revenue at the end of Q1 was $1.9 billion and increased 37%.

Q1 gross margin was 76.8%, a decrease of 260 basis points compared to last year and within our target range of 75% to 78%. The decline was primarily attributable to the ongoing traction we're seeing with the new products introduced in the third quarter of last fiscal year.

Q1 operating expenses were $292.4 million or 57.8% of revenue, which is a 360-basis point improvement year-over-year, driven primarily by ongoing increasing leverage in sales and marketing. Operating margin was 19%, an increase of 100 basis points. We ended the first quarter with 4,707 employees.

Net income for the first quarter grew 36% to $69.8 million or $0.74 per diluted share. On a GAAP basis for the first quarter, net loss increased 12% to $64 million or $0.70 per basic and diluted share.

Turning to cash flows and balance sheet items. We finished October with cash, cash equivalents and investments of $2.3 billion. During the first quarter, we repurchased approximately 861,000 shares of common stock at an average price of approximately $145 per share, leaving a balance of approximately $455 million available for ongoing repurchases through December 2018.

Turning to cash flow. Q1 cash flow from operations of $274.1 million increased 35% and included the receipt of a $38.2 million upfront cash reimbursement related to certain of the company's lease agreements. Capital expenditures in the quarter were $32.2 million, including $11.2 million of CapEx related to our new headquarters. Free cash flow was $241.9 million, up 32% at a margin of 47.9%. On an adjusted basis, excluding the upfront cash reimbursement and investment in our new headquarters, free cash flow was $214.9 million, up 16% at a margin of 42.5%. DSO was 70 days, at the low end of the target range of 70 to 80 days.

Turning now to guidance and modeling points. This guidance takes into account the type of forward-looking information that Kelsey referred to earlier.

For fiscal Q2 '18, we expect revenue to be in the range of $518 million to $528 million, an increase of 23% to 25% year-over-year; product revenue to be in the range of $185 million to $188 million, an increase of 10% to 11% year-over-year; billings to be in the range of $640 million to $655 million, an increase of 14% to 17% year-over-year; non-GAAP EPS to be in the range of $0.78 to $0.80 using 94 million to 96 million shares. And we expect CapEx for Q2 fiscal '18 to be approximately $30 million.

For the full fiscal year '18, we're raising our guidance and now expect revenue to be in the range of $2.145 billion to $2.185 billion, an increase of 22% to 24% year-over-year; product revenue to be in the range of $755 million to $770 million, an increase of 6% to 9% year-over-year; billings to be in the range of $2.65 billion to $2.71 billion, an increase of 16% to 18% year-over-year; non-GAAP EPS to be in the range of $3.35 to $3.41, using 96 million to 98 million shares. And we continue to expect CapEx to be approximately $100 million.

Before I conclude, I'd like to provide some additional modeling points for the fiscal year. We continue to expect fiscal Q2 and fiscal Q4 to have the strongest sequential total revenue growth.

As reflected in consensus heading into this call, our non-GAAP EPS guide continues to include approximately 150 basis points of organic operating margin expansion, excluding first half fiscal year '18 investments associated with the LightCyber acquisition. And we continue to expect fiscal year free cash flow margin to be in the range of 37% to 39% as the nonrecurring cash reimbursement received in Q1 will be mostly offset by rent payments throughout the balance of this fiscal year.

With that, I'll turn the call back over to Mark.

Thanks, Steffan. Before I head over to questions, I want to take the opportunity to thank you again for all your contributions to Palo Alto Networks. You've been an inspiring leader, you've built a great organization and you've been a wonderful friend and a real pleasure to work with you. Thank you very much for that.

Thanks, Mark. I appreciate your kind words.

And with that, why don't we head to questions. So operator, would you please poll for questions.

(Operator Instructions) And our first question will come from Philip Winslow of Wells Fargo.

Obviously, the product number was strong again this quarter and saw an acceleration from the prior 2 quarters. I was wondering if you could double-click on just the sales practices that you all discussed following Q2 and just sort of how you feel in terms of just the go-to-market right now with the changes that you made mid-last year? And then just one quick follow-up to that.

Sure. So we saw a good, strong environment every theater. So we really like the health of the market out there and then it's with being able to go capitalize on that with some of the changes we made last year, which have really taken effect. And I think we're seeing the dividends from that work. We started mid-last year. We feel good about where we are with that process. We're in the, we call it the base stage before, the relationship-building stage, which seems to be going very well. And we expect that to keep paying dividends for us as we play out the year.

Got it. And then I was hoping if you all could comment on just the pricing environment as well, just sort of any changes that you've seen there as we exit toward this calendar year versus maybe early in the year or last year?

Yes. Seems like -- good question. Yes, it seems to change. It's a very competitive market. We've seen the competition price aggressively for quite some time, and what we've seen us to be able to do is continue to sell to the value of the platform. I think customers get that more and more. The -- our team is trained to do that, and we like the results of that. We've been able to continue to improve our product discounting continuously, sequentially, for example. We like to see that as well. And it doesn't seem like we have to succumb to all the pricing machinations that are going on with the competition here as the customers really adopt the entire platform.

And our next question will come from Pierre Ferragu of Bernstein.

So when I look at your guidance for next year, so you have 6% to 9% in product and 16% to 18% in billings. So if I make the difference, you're growing your subscription billing 20% to 23% year-on-year, which is, first, very impressive and so way above your product growth. So my question would be how does that split between attached and nonattached products? How much of that is still driven by your expansion of your installed base of firewall? And how much is really like subscriptions that are not attached anymore? And then my second question would be, if you keep growing like that, subscriptions much faster than products, next year, you're going to have, what, less than 1/3 of sub billings coming from products? And 2, 3 years out, you'd be like an 80% subscription and only 20% product business. Am I right thinking of it that way?

Yes. So obviously, we don't guide beyond the year. So let me start with that. But I think just as a general matter, we've seen our business continue to move into the services category over time, particularly in subscription services for a few reasons. One is the platform is very powerful, and the customers understand how the subscription services provide better security and reduce the complexity of their consumption models. And secondly, we continue to introduce new services. We just introduced 2 in September, the GlobalProtect cloud service and Logging Service, and we're happy with the performance already with those. Those will continue to bring new services to market as well. We would see the business move into subscription services direction as well, and then on top of that, the Application Framework, which will come to market next year as well, should also help move things in those directions. That's what we'd imagine would occur over a period of time. It would keep moving in that direction. But we -- for the year, we've guided about a 65% split. If you recall from Analyst Day, it is revenue that as to what would come from the services side of the business.

And our next question will come from Rob Owens, KeyBanc Capital Markets.

Maybe you could give us a little bit more color on the success you're seeing on the product side of things. And what's coming from preexisting customers that are within your original base versus maybe an increase in competitive wins.

Yes, Rob. Well, we're doing well in both cases. You can see like net new customer acquisitions continue to be very strong. And obviously, we're selling products into a lot of those customers, the vast majority of those, as a matter of fact, so we continue to bring in new customer wins. And also new expansion business has been strong for us for a very long time and is powering the majority of our business just by math, the size of the customer base. So our expansion business continues to do well. Our [fabs] are growing really great in whitespace opportunities and also convincing our customers to continue to grow the lifetime value with us.

And I guess, along those lines, with the -- much of the upside in the quarter coming from product. The billings was at the high end, but you overachieved on product and overachieved on total revenue. And so if I looked at billings relative to revenue field or, I guess, the inverse of product with the attach of subscriptions, is that product mainly coming in from preexisting customers, so you don't get as much of a subscription uplift? Or that you have less attached or less duration to the attached? Maybe you can help provide some color there.

Yes, sure. Our extension (inaudible) populations right around that quarter. We're very happy with the product delivery, obviously, and total revenue delivery and also on the billing side. In the quarter, we saw a couple of things going on, a couple in ratio. One was as we continue to improve the product discounting, then that would put more into the product revenue buckets if the mix is a little bit higher than we thought we would see in the quarter. And also in some of our service provider business as purchases some of those -- a little more CapEx-heavy than we forecasted as well so that would put some more into the product bucket as well. So just really the mix is a little different than one we expected coming into the quarter.

And our next question will come from Ken Talanian of Evercore ISI.

So another one on product. I was wondering if you could give us a sense for how much the VM-Series and Panorama contributed to the product revenue in the quarter. And how we should think about that for the remainder of the fiscal year.

Ken, it's Mark. Very, very little. VM-Series is -- primarily almost all data is heading into the subscription services line. That's how we recognize that. And it's performed very well, by the way, but very little of that goes into product.

And the same is true with Panorama.

Yes, same with Panorama.

Okay. And I guess you delivered double-digit year-over-year product revenue growth in the quarter, expecting the same next quarter. Is there anything that you see in the back half of the year that makes you a little bit cautious?

No, we like the way the quarter played out. So we overdelivered on product, which is great. Our forecast looks good in the second quarter. And based on that, we've increased the product revenue guide on a full year basis. But it's early in the year, so we want to see it play out a little bit more.

And our next question will come from Sterling Auty of JPMorgan.

First of all, Kathy, congratulations. Steffan, great job to finish off your tenure in such a strong note. But just wanted to take it to the high level. With the guide out of Check Point, out of Fortinet, there was all these concerns about what was happening in the firewall market. Obviously, you put up good results, but, Mark, in your comments, you specifically pointed out good demand in all theaters. That's what I want to point to. Can you give us additional color as to just the general spending environment for network security, and more specifically, firewalls? And there's still this big question on everybody's minds, how much is the move to the cloud going to hamper, help or be a nonevent to the firewall vendors?

Yes. So maybe I'll take that at a few different levels, a high level and I'll ask Mark to talk about that theater for just a second, which is very strong. At the highest level, we exceed healthy demand in the market for security period, right. I think what's happening is folks are definitely moving in the real platform direction, and we feel like we have the best one of those, and it continues to get better and better over time. And if you remember, Sterling, at Analyst Day, we talked about the 3 evolutions, all that built on each other and drive continued competitive advantage. That second one in there, which is -- we defined as consistency of security outcomes across not only the network but endpoints and also cloud environments, whether they're public or hybrid cloud environments, is very important. And customers, we think, agree with that. So we're seeing good adoption in our cloud offerings, VM-Series and Aperture as well. But lots of folks are operating in hybrid environments, so I expect them to continue to do that for some time, so that drives strength in not only the cloud offering, it drives strength in the -- what the data center is -- what's happening in data centers from a hardware perspective, and we see lifts in all those. Maybe Mark, you can talk about the theater.

Yes, you bet, Mark. Sterling, I think, from a geographic coverage standpoint, really happy across the board. We saw 25% in the Americas, by far our biggest theater and 25% in Asia Pac in Japan and 35% in EMEA. So really good strong execution across the board. I think in all theaters, we're getting tremendous at-bats because we've got great geographic coverage in all the subregions and really good partner traction as well. So we're getting a lot more at-bats. We're winning the vast majority of those at-bats because we have a much better solution. I think with regards to cloud, as we said pretty clearly at Analyst Day, we really think that there's major tailwinds coming with cloud. We're hearing constantly from customers that as they move more and more off of prem over the long term, they're going to want consistent delivery of security, and that's what we've been talking about for a long time, and we think we're pretty unique in that.

And our next question will come from Matt Hedberg of RBC Capital Markets.

Kathy, I'll offer you my congratulations as well. Mark, we continue to hear good things about GlobalProtect cloud services, and like you highlighted in your prepared remarks. Could you talk a little bit more about the competitive landscape there? What are some of the opportunities? And then I have a quick follow-up.

Sure. So I think the way to think about that, Matt, is -- and the way we certainly think about it is we want to make sure that, for our customers, when they want to consume the platform, that those consumption models are as broad and flexible as possible. So we have, for a long time, we've offered those capabilities from an on-prem perspective that people are matching themselves. We've had that with MSSP partners where it can be managed by third party and now with GlobalProtect cloud service, we give them the option of having that totally the cloud experience as well. We continue to evolve all the offerings based on what the customer needs will be into the future. So if I step back from that a second and say, okay, what are we doing, and we're bringing the full-on network security -- or the full-on enterprise security platform in that form factor to the market, which means we're going to be able to provide and we are providing the security outcomes we've been driving for some time across all applications consistently from endpoint to network and cloud as well and in ways that are just not based off like traffic that's leaving but also coming into the network and being able to bridge the local user. So a pretty distinct competitive advantage, I think, there and also our flexibility on our new model that customers' reactions so far have been very positive.

That's great. And then maybe just a quick one, could you comment on the relative rate of sales capacity adds in Q1 relative to your 15% billings growth? Was it less, more, about the same?

Nothing out of the norm historically. So very consistent with what we've been doing for many years.

And our next question will come from Saket Kalia of Barclays.

Congrats, Kathy, on the promotion as well. Hey, Mark, maybe just to start with you, just higher level, understanding it's still early days on Application Framework. I'm just curious how Application Framework is maybe changing customer conversations, if at all, at this juncture?

It's been really dramatic, Saket, in a positive way that when we're talking with customers, and we start off, are always with a very high level that say Palo Alto, for the last decade has been fundamentally bringing higher and higher rates of prevention through automation and orchestration. In addition to doing that, we've also been massively simplifying the consumption model along the way so the customers can have better security with a much simpler consumption model that drives better ROI, less manpower, all the things that we believe is important for a long time. And the world completely agrees with that now with the models, the way they are, they're really broken out to be fundamentally different. And then to show them the way for the third evolution with the Application Framework to say imagine a world that looks like this, that where you don't have to give up getting lots of innovation from the security market because security has to be highly innovative but no one company can do that. So here's a way to get even more automation, more orchestration, better prevention rates and do it with a vastly simplified consumption model as well. They really like it. I think what that's doing for us, right, right now is very much showing what the future is going to look like as the thought leader. We have lots of demonstrated capabilities in making those real. We have people writing applications, the Application Framework today. And we've always got to keep in mind that after that conversation, they're going to buy something this afternoon. Right? Might be a firewall. Might be an endpoint solution. It might be a virtual machine in the cloud or something along those lines for a project. And what I think we're hearing them say is we've given this a very significant reason why we want to choose Palo Alto Networks as our operating platform, for lack of a better term, in all places in our architecture for our security capabilities.

And our next question will come from Gabriela Borges of Goldman Sachs.

Maybe a follow-up on the demand picture but instead of geographically, by verticals. So maybe if you could comment a little bit on federal carrier a bit, Mark. And I think there was a comment earlier on some of the mix being towards product because of CapEx from service providers. So if you could just talk a little bit more about the demand profile and the mix you're seeing across vertical? That would be very helpful.

So first, let me start with we're very well diversified across our verticals, which is great. We like to see that. I mean, mostly, it demonstrates that we're truly a platform, because you can see that horizontally played out across all verticals. And from a Fed perspective, the Fed year-end, we saw some good nice wins there and continue to see increasing signs of spending getting back to normal, which would be fantastic. There's been a lot of ups and downs inside in the Fed market due to lack of leadership positions being filled. We're in continuing resolution right now. So any return to normalcy is a good thing there. And also, again, the Fed space fits very much within our mission for what we do, which is to protect our way of life in the digital age and the federal government is trying to do. They find that to be very in line with their mission so they like that a lot, which is great. On the service provider side, that's a good market for us. It continues to grow nicely. We continue to put more investment in there from a technology perspective of adding features and functionality for that. My comment earlier on the prepared remarks on service providers was that the product mix of the deal sets in the service providers that having been processed in the quarters, that contributed some to the product mix in the quarter, which, of course, we like to see.

And we'll hear next from Michael Turits of Raymond James.

Two questions. First one, I think this is a continuation of Rob Owens' question asking about the new risk versus existing. Can you give us some sense of where you are in that refresh cycle coming off of your big builds, where your process is really strong back in the 2012/2013 era and where you might be and if that's on track. And then I have a follow-up question about billings.

Yes, sure. So from a refresh perspective, the refresh opportunity, as we've said before, is large and continues to grow and we add this many customers and their cohorts [over] over time. That's been going well for us. We had a refresh on the quarter. We expect to continue that through the rest of the year. We also mentioned, Michael, as you may remember at Analyst Day that (inaudible) you wouldn't expect that to be the major driver of product growth in the year. We expect that to be really the platform itself or new customer -- or new product introductions increasing productivity from the sales team at [free org] but the refresh is definitely a positive for us, and we're doing very well in that.

And our next question will come from [Patrick Podau of Overnet Research].

Any way you can tell us the business or give an indication of the product revenue blends from the new hardware launched in Feb '17?

The product revenue blend. I'm sorry, [Pat,] I'm not exactly sure I understand the question.

So of the product revenue you sold in the quarter, what project portion, roughly was from the kind of new hardware you launched early this year?

The new products that we launched had a very healthy contributing factor to the mix of product. We don't give out specific percentages, but the traction has been very strong. It's opened up new opportunities to sell to new customers as well as selling into our installed base from an expansion standpoint, so it was a very strong contributor. We just don't give out the specific percentages.

And our next question will come from Andrew Nowinski of Piper Jaffray.

Congratulations, Kathy. So just need a clarification in [areas.] Your product gross margin was a little bit lower than it has been historically, which I think you said was due to the new products, the new hardware. But when do you expect to start to see the cost efficiencies from the new products, where they're no longer a headwind to your gross margin?

Yes. Well, we said earlier when we had new product launches that we would have some headwinds on product gross margins as we got to economies of scale and also that our providers, people who supply us with components can also take those components into a broad base into the market. When we look at the size of the product launch we just did back in February, it's the biggest one we've done by a long shot, so we don't have actually the perfect analogy in that, but probably the closest one is the 5000 series we did a number of years ago. And that took about a year-or-so before we were able to get those economies of scale. We expect that to be the case here.

And just a follow-on point, with that being the dynamic, we're still operating within our framework of 75% to 78% total gross margin. And we've incorporated that dynamic into that guidance range. So we feel good about that structure.

And our next question will come from Gur Talpaz of Stifel.

So quick question on endpoint, do you think we're at the point now where large enterprises are more willing to buy endpoint prevention and networking security from the same vendor? And are you seeing more in the way of standardization projects?

It's Mark. I think that's the case, and we believe, just as a big-picture matter that, that's definitely going to be the case in the future. We lean very heavily into the endpoint market, as you know. We think it's a matter of necessity and that we think about that second evolution and the way we define it is consistency from network endpoints in cloud. That's going to be very important. Some capabilities from a security perspective are better done on network, and some are better done on endpoint, and increasing the data in the cloud, some will be in the cloud. So we have to get all those right and, very importantly, they all have to work together. We're seeing that customers want -- they want that consistency. I think they also want fewer vendors as a big-picture matter as well. So being able to have a platform that has that consistency, that allows them to reduce the number of vendors and sprawl in the organization, that might be devices in the network, it might be agents on an endpoint is a net positive for them.

And Gregg Moskowitz of Cowen and Company has our next question.

Congrats, Kathy. Best of luck, Steffan. So I'd like to go back to new-customer acquisition because this was an impressive quarter on that basis and especially so for Q1. Would you attribute this to the product refresh earlier in the year? Or would you also say there's a more conservative go-to-market focus around reaching new accounts?

I think we have a number of things that are going on, Gregg. We had that solid performance from all the theaters you heard a little while ago, across all the customer profiles. We've got our continued productivity improvements as well from the work we started last year. Then the new products for sure getting a positive reception in the market. And then also, with increasingly growing the set of offerings with our new services, we have the ability to talk to customers about new opportunities and land new customers with non-attached services as well. So we have a whole bunch of stuff going on from -- as far as [potential] new customers and new products definitely are contributing nice wins out of that.

And our next question will come from John DiFucci of Jeffries.

I have a follow-up question per Gur's question. It has to do with Traps because it looks like you're seeing some good traction. And by the way, this question I think is more for Mark Anderson. And that Symantec displacement is really interesting. I assume when your conversations with customers who are first buying your firewall and everything that comes along with that and then they consider Traps. But I guess is that accurate? And have you ever seen -- I assume when they look at Traps, are they comparing Traps on its own merits against Symantec? Mark McLaughlin just talked about having both as they have some advantages, but do they also consider on its own merit against -- its own merits against the competing product? And has it ever been -- or do you think it will ever be the land product? Like hey, I want to buy Traps and then maybe I'll consider the firewall?

John, thanks for the question. No, I think, first of all, about 1/3 of our customers for Traps are -- their first purchase is Traps, not traditional network security. So we think on the merits of the solution with the focus that we have in the field that we're winning because we're delivering better outcomes. And we're going after traditional antivirus budget because customers have associated very little value with money that they're spending on traditional antivirus. I think down the road, we -- it's a really strategic space for us. And as Mark mentioned earlier, we're going to continue to see success here.

And I think one of the things, John, as well as -- and this is important for our teams as we're out there making these sales is the ability to be able to tell a customer, to say this second evolution where we defined it earlier is really important to have consistency of the security outcomes, regardless whether data is (inaudible) but we've got an endpoint. So we definitely want that consistency, and also be able to say, on a head-to-head basis, we're the best there, right? So you should choose us on a competitive bake-off, which we know you're going to do, and we feel very good about that. And as you think about that bake-off, in addition to winning head-to-head, you also get the consistency aspect that allows you to grow into the future into even more interesting things like the Application Framework over time. So more reasons why you want to deploy Palo Alto Networks everywhere that's important as a data collection point, and an important point in your architecture, sometimes network, sometimes endpoint, sometimes in the cloud.

Yes, it's really the trust and faith that we've earned from customers over the last decade where, if they know that we're going to provide a high-quality product, then we're going to support it in a way -- in a more focused way than anybody out there can from a product support standpoint.

And our next question will come from Fatima Boolani of UBS.

Mark, a question for you around your dedicated efforts around building a public cloud practice and bringing your partners in there. Just at a high level, I'd love to hear what sort of conversation you are having with the customers around their public cloud challenges and how you are positioned to sort of help them cross the chasm? And a quick follow-up for Steffan, if I may.

Yes you bet, Fatima, so I think we've got a little bit of broad spectrum of customers. Some are leaning pretty aggressively into public cloud. They're putting preproduction DevOps, new applications into the cloud. Some are dipping their toes. I think what we represent for them is an opportunity to provide a real consistent look and feel for the security that we can impose there. This is -- takes place over the next 5 to 10 years. We're going to continue to see more and more migration as people become more and more comfortable for that. And I think that comfort is going to come from the kind of security that we can help deliver to them. So I think we're in a very good space there.

That's helpful. And Steffan, if I look back to your billings performance a couple of years ago where you maybe signed some longer-term contracts, as those come up for renewal in '18 and even '19, what sort of trends are you seeing in the earlier crop of these longer-term deals? Are they renewing at the same duration? That would be really helpful.

Well, if you look back over the last several years, we've seen a modest gradual increase in duration, and it seems to have leveled out at approximately 3 years. And so for the companies who are -- who did a 3-year deal 3 years ago, there is really a mix of renewals business right now. We're seeing some re-up for a multiyear term. We're seeing others renew annually. So there's really a mix there. But what we said at our Analyst Day and what we still believe to be true is that for the rest of the fiscal year, we don't really see any changes in overall duration. And that should be roughly about 3 years.

And our next question will come from Walter Pritchard with Citi.

I'm wondering just if I look at revenue per customer, you highlighted your large -- I think it's $23 million to be a top 25 customer. Can you talk about what's happening at the other end of your business? Are you -- with some of the lower-end products being released in the last 6 months, are you dipping down into smaller customers at all? And what is your strategy around -- I know you're not a small-office [SMB] player, but -- just kind of -- when you look to potentially turn into that segment of the market, which has probably some revenue opportunity for you?

Walter, it's Mark. Our focus has been and continues to be in enterprise security market mostly because we find focus matters as delivering the best solutions and being able to support them in a high-quality manner. That hasn't changed for us, and we look at the customer acquisition and so the mix of customers and who are they, very consistent with what they have been for some time. So we haven't seen a change there as -- either. I think what we are seeing from some use cases in some of the larger customers is the ability to address interesting and new use cases around, like in retail environments and plus some of the services we just launched to be able to do some more campus work, mobile user work, things along those lines, and we would expect that to continue (inaudible)

And then question for Mark Anderson, just around the European theater. That looked especially strong. Was there anything specific, I mean, sometimes good execution is the answer, but I'm curious if there's anything specific you're seeing in certain countries or certain vertical markets that might explain the strong performance in Europe.

Yes, that was really good performance across the board in every subregion within EMEA, Walter. I think just what we're seeing across the board in Europe is they're typically 1 to 2 years behind the Americas in terms of their IT culture, if you will. And we're seeing just general awareness of the need for migration away from legacy disconnected products to more of an architecture approach. I think it's coming at a time when bad things are happening around the world, focused on legislation with GDPR, and frankly, the coverage that we have now in every major country in Europe that's getting us in front of customers and showing them how we can be -- we can be a much better provider for them.

And our next question will come from Keith Weiss of Morgan Stanley.

I was wondering, just on sort of go-to-market strategy. It seems like the differentiation in kind of the sales, sort of what your -- what the base of kind of selling to the customer base is changing in a big way. This isn't an appliance selling. It's not a box selling where you guys are selling a platform. Does this change sort of the partner strategy at all or change sort of the kinds of partners you're going to market with in terms of who can actually get across that value proposition?

That's a good question, Keith. Certainly, we're always on the lookout for surgically, frankly, for new partners, not looking to cast a wide blanket but really looking to improve the coverage we have around the world. So it just is naturally, as we've grown, the kind of partners that we couldn't address, the large global ones, the large systems integrators 7 or 8 years ago, now we're at the scale where it's hard for them to avoid us, frankly. So we've actually worked really hard on that over the last 5 years. And as I think we've discussed in each of the Analyst Days, we're getting more and more attention there. But I'd say, nothing really dramatically different than the last Analyst Day other than we're just very much focused on looking for large global distribution partners, large global systems integrators, service provider partners and national brands. What we do want is we want a message that's consistent with what our field team is talking to customers about, that's this platform or architecture delivery versus disconnected point products.

Got it. And just one follow-up on the federal vertical in particular. Any color you can give us on sort of strength of Federal in Q1? And given sort of current machinations with budgeting and whatnot, expectations for potential to continue that strength into -- further into the fiscal year?

Keith, Mark again. In the Fed space, like I said, we saw good wins here in the quarter. I would say big picture in Fed, it's been a mixed bag for a number of quarters as there's been some consternation of -- in the Federal space on seeing some leadership positions that still go unfilled. And there's also just the budget. We're still working at a continuing resolution right now that -- don't think it's fixed until December time frame, but the progression of seeing more normal spending and people understanding what their budgets will look like for the following year is very important. So hopefully, getting through the continued resolution will be a positive marker on the table and get people back to more normal spending patterns there.

And just to color that, it's a really important space for us to be in. We've invested in the team over the last 3 years, and we got great coverage across the Intel civilian and DoD segments. And I think we feel really good about the team.

And our next question will come from Karl Keirstead of Deutsche Bank.

For either Mark, I wouldn't mind going back to the relative performance. It feels like in this quarter, and the one you're guiding to, the gap between yourselves and Check Point and Fortinet seems to be widening. And I just want to ask if you can help us understand exactly where that wedge seems to be opening up. Is it as simple as you've got a product cycle benefit that perhaps they don't now? Maybe you could help us there? And then maybe as a follow-up to Steffan. Steffan, to build on a prior question, you raised the revenue guidance, but the billings guidance is, at least at the high end, essentially the same. Is that simply because most of the DR comes from maintenance and subscription, and those line items were a little bit more in line versus the outperformance on product?

So I'll take the first part. What I think we're seeing in the market and have been for a while is the importance of the platform, which I mentioned before, where things work together in a highly automated orchestrated fashion, and there's really positive benefits in prevention outcomes plus the simplicity of the consumption models that result. I think that's -- really continues to distinguish itself in the market because anybody can make those statements, but at the end of the day, what really matters is the architecture on how it's actually built. And I think that what we've proven over time is we got a lot of credibility there because we're a company that primarily is working on developing and building those things ourselves. We can make those statements at scale to customers and say, no, we really think this actually works together, right, and we have a lot of references you can talk to. Where other companies might be cobbling things together and trying to do things that really don't work out at the end of the day when we try to get to that automotive platforms. So I think that's one level. The second thing on the architecture is the elegance of the architecture matters as well, where, from a simplicity perspective, having it work in that automated, orchestrated way, or you're kind of being mostly in charge of that platform, you've built a lot of it yourself. It matters from a stability perspective, too. So we, increasingly as other vendors add more, like acquisitions into the mix because that stuff doesn't really work well together, and not only does it not drive the security outcomes, but it drives increasing instability in networks as well. That we hear a lot of folks come to powerful networks saying, one of the primary reasons is not just technicals, also stability in my current provider can't run at these big scales any longer. They just keep adding more stuff and they're starting to break things as well. So I think a whole bunch of stuff in the mix of that, but it all comes back to the architecture of the platform is the primary differentiator, and as we drive these 3 evolutions and they build on each other, we think that increases the moat, and over time, will continue to allow this to distinguish ourselves.

And Karl, on the second part of your question, as you mentioned, we did raise billings for the full year by $10 million. The mechanics are such that we look at our deferred revenue balance and what we're adding to it every quarter, very robust and healthy growth in both attached and unattached subscriptions and also maintenance that they're coming in line as expected. And I think to the point that you raised, we're having more in-period revenue than we had originally planned for because product was so strong, and so we also raised product for the full year. And the last point I'll leave you with is if you think about current billings, current billings was strong, and that reflects product revenue in the period versus the change in short-term deferred.

And our next question will come from Shaul Eyal of Oppenheimer.

Congrats Kathy on the recent promotion. Actually, Steffan, before we let you go, just a quick housekeeping: number of customers relating to Traps and WildFire. I think historically, you have been providing that. Any view, any update along these lines?

Yes, on that front, we release those on a semiannual basis, and we saw a very healthy growth in customer accounts for both of those product lines.

Fair enough. Mark, you mentioned in your prepared remarks an expansion of your cloud product. I think you also mentioned including an updated e-mail version targeting Office 365 landscape among other things. Just want to make sure, does that product fall under your successful partnership with Proofpoint?

Yes, what I mentioned, Shaul, is -- for our Aperture offering, which is our cloud access security broker offering, we continue to expand the application's API that it's worked with, and we've expanded it into cloud-based e-mail offerings like Gmail, for example, right. So that's what we've done. And -- so, just think of them as we keep adding more application coverage through Aperture.

But there is integration with Proofpoint that when we can make this discovery with Palo Alto Networks, the integration we do with Proofpoint can allow Proofpoint to actually do something about it. So it is really an add for Proofpoint.

And our final question today will come from Jonathan Ho of William Blair.

Just to make it quick, I'll lead with one question. In your early data wake and application or framework deals, can you maybe give us a little bit of color in terms of what those deals look like and the potential for upsell and expansion over time?

Sure, I'll take that. Mark was very involved in some of these. He can give some more color, but big picture on the third evolution, Jonathan, of bringing the Application Framework to market, maybe somewhat an obvious statement, but we definitely are reinforcing it with customers is that if you're going to have capability sets that are really based on analytics and increasingly (inaudible) in security will be driven on analytic capability, machine learning capability, the dataset against which it runs is very important, not only in terms of its size but also in the diversity of the kind of data in there, right. Like, for example, you don't need machine learning to tell you information's bad if the only dataset you put in there was bad stuff, right. So you want to have very big datasets, and you want the diversity of the datasets to have good, bad, unknowns in there and grow a lot over time. So the Logging Service is a capability set that we give to our customers and say, for a very cost-effective point of view, you can log all the information coming off Palo Alto Networks' capabilities because you want those really large datasets for all the analytic capabilities like LightCyber, for example, and things we'll bring to the Application Framework to chew on this, and the bigger they are, the better they are. And it doesn't have to be cost-prohibitive to log that information. So Mark, who's deeply involved in a couple of the sales this quarter, maybe you want to add...

I think you pretty much nailed it, Mark. I think for being able to leverage machine learning, our micro adversaries are leveraging against our customers every day in an increasing scale and velocity. You need to be able to log not just bad and suspected bad but also good to really let the machines crunch, as Mark said. So I think what makes us attractive beyond price is the fact that we're able to take the data from Logging Service and add that to the trillions of artifacts we have in our threat intelligence data centers around the world to really drive the kind of automation that you need to, to be able to reduce the tax service.

I think that's the last questions. Okay. Well, thanks. Before I close, I want to thank everybody again for joining us today, and I wish you and your families a very safe and happy Thanksgiving. We look forward to seeing many of you in the coming week at some of our investor conferences. Really appreciate your time. See you next time.

And ladies and gentlemen, this does conclude today's conference. We thank you for your participation. You may now disconnect.