Palo Alto Networks Inc (PANW) 2018 Q2 法說會逐字稿

Good day, and welcome to the Palo Alto Networks Fiscal Second Quarter 2018 Earnings Conference Call.

Today's conference is being recorded.

At this time, I would like to turn the conference over to Ms. Kelsey Turcotte, Vice President of Investor Relations.

Please go ahead, ma'am.

Good afternoon, and thank you for joining us on today's conference call to discuss Palo Alto Networks Fiscal Second Quarter 2018 Financial Results.

This call is being broadcast live over the web and can be accessed on the Investors section of our website at investors.paloaltonetworks.com.

With me on today's call are Mark McLaughlin, our Chairman and Chief Executive Officer; Kathy Bonanno, our Chief Financial Officer; and Mark Anderson, our President.

This afternoon, we issued a press release announcing our results for the fiscal second quarter ended January 31, 2018.

If you would like a copy of the release, you can access it online on our website.

We'd like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding our financial guidance and modeling points for the fiscal third quarter and full fiscal year '18; our competitive position and the demand and market opportunity for our products and subscriptions; benefits and timing of new products and subscription offerings; our ability to drive outsized growth rates; expectations regarding the impact of the U.S. Tax Cuts and Jobs Act; and trends in certain financial results, operating metrics, mix shift, and seasonality.

These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements.

These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future, and we would undertake no obligation to update these statements after the call.

For a more detailed description of factors that could cause actual results to differ, please refer to our quarterly report on Form 10-Q filed with the SEC on November 21, 2017, and our earnings release posted a few minutes ago on our website and filed with the SEC on Form 8-K.

Also, please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges.

For historical periods, we have provided reconciliations of these non-GAAP financial measures to GAAP financial measures and the supplemental financial information that can be found in the Investors section of our website located at investors.paloaltonetworks.com.

We would also like to inform you that we will be participating in the Morgan Stanley Technology, Media and Telecom Conference in San Francisco on Thursday, March 1; and the Raymond James 39th Annual Institutional Investors Conference in Orlando on Tuesday, March 6.

And finally, once we have completed our formal remarks, we will be posting them to our Investor Relations website under quarterly results.

And with that, I'll turn the call over to Mark.

Thank you, Kelsey, and thank you, everyone, for joining us this afternoon for our fiscal second quarter 2018 results.

I'm pleased to report that we delivered a strong second quarter.

On a year-over-year basis, Q2 revenue was $542 million, up 28%; billings were $675 million, up 20%; non-GAAP operating margin was 20.5%; and non-GAAP earnings per share was $0.97.

In the quarter, we continued to see healthy security spending and strong demand for our next-generation security platform.

With the addition of close to 3,000 new customers in the quarter, we are privileged to now serve approximately 48,000 customers around the world.

In addition to robust new customer acquisition, we also continue to rapidly increase our wallet share in existing customers.

Our top 25 customers, all of which made a purchase in this quarter, spent a minimum of $25.6 million in lifetime value in Q2, a 54% increase over the $16.6 million in Q2 of fiscal '17.

Specific examples of customer wins and competitive split displacements in the quarter included a Cisco replacement to secure the global network of one of Europe's largest manufacturing companies with more than 150 branch offices and factories; a legacy AV replacement and competitive wins against multiple stand-alone next-gen endpoint providers in a U.S.-based hospital system on tens of thousands of endpoints; a Check Point replacement to secure 2,000 gas stations with our VM-Series and a deal with a global oil company; a 7-figure on-premise deal with a global retailer that started with us as an Amazon Marketplace customer; and an expansion deal with one of the world's largest insurance companies to implement GlobalProtect cloud service, to secure hundreds of branch offices and tens of thousands of mobile users.

We continue to see customers adopt and expand the uses of our platform at rapid rates.

The world is undergoing a digital transformation that is driving massive productivity gains.

However, this digital transformation is also creating significant cyber risk that requires a corresponding security transformation.

At Palo Alto Networks, we have been consistently delivering on the transformation of security through increasingly rapid technical evolutions to build on each other, reinforce each other, show the attributes of automation, leverage, consistency and ease of use and get more powerful and valuable through the ecosystem growth.

A decade ago, we introduced the first evolution of security with the creation of the next-generation firewall and cloud-delivered network security services designed to improve security outcomes through integration and automation.

And we continue to innovate on the foundational elements of the first evolution, most recently, with last week's announcement of PAN-OS 8.1, the PA-3200 series with 3 models, the PA-5280, the ruggedized PA-220R and 2 new models of M-Series management appliances.

Our new 8.1 software that adds over 60 new features to our next-generation firewall, including more granular control SaaS applications, expanded SSL decryption capabilities, making it easier to secure encrypted traffic, many features to simplify the adoption of security best practices and much more.

In addition, the new hardware appliances increase SSL decryption throughput, bringing higher performance and capacity for securing large data centers and provide additional stability for managing large firewall deployments.

We're very excited by these recent announcements that complement the hardware and software we introduced last year and further expand our technology leadership.

And building on the first evolution, 5 years ago, we drove a second evolution, which is extending the capabilities of our platform to consistently secure customers' data no matter where it resides, from the network to the endpoint, and throughout the cloud and SaaS applications.

In Q2, we continued to innovate the second evolution.

We enhanced our partnership with AWS, where we're now the only security vendor to achieve AWS networking competency status, which recognizes that we provide proven technology and deep expertise in helping customers adopt, develop and deploy networks in AWS.

This complements the AWS security competency we achieved in 2016.

And just a few weeks ago, we hosted a global cloud security event for over 15,000 attendees, where we announced additional second evolution advancements, including Traps for Linux, provided insights into how customers can accelerate to move to the cloud, featured our cloud partnerships and announced new cloud capabilities.

These include enhanced features for Azure in AWS environments, simplified and centralized management for all major cloud platforms; automated integrations for frictionless workflows in multi-cloud environments and extending protection to the Google Cloud platform.

The announcements were very well received by our customers and further established our leadership position in endpoint and cloud security.

These first 2 evolutions are the building blocks required to make the third evolution in security, the Application Framework a reality.

Customer reaction has been very enthusiastic as they see the superior security and agility that can be achieved by using innovative security applications that leverage the data from their existing Palo Alto Network platform deployments and providing increasing value for their investments with Palo Alto Networks.

We will develop some of these applications ourselves, while others will be built by third parties.

Earlier this month, we introduced our newest application, Magnifier, in the Application Framework.

Tightly integrated with our next-generation security platform and our Logging Service, this cloud-based behavioral analytics application, which we acquired in LightCyber, enables highly accurate attack detection powered by scalable, cloud-based machine learning.

We're very excited about the Application Framework and look forward to the availability of Framework's third-party applications in the coming months.

These evolutions have resulted in a large and quickly growing global ecosystem of customers leveraging the automation, orchestration, consistency and ease of use achieved through our platform.

Of our approximately 48,000 customers globally, approximately 42,000 are using Threat Prevention; approximately 35,000 are using URL filtering; approximately 23,000 are using WildFire; and approximately 7,000 are using GlobalProtect.

And our endpoint and cloud offerings are also experiencing significant growth and adoption.

More than 2,200 customers using Traps with over 3 million endpoints under protection, while approximately 5,000 customers are using our cloud offerings, including over a dozen who have already adopted our new GlobalProtect Cloud service, which delivers our next-generation security capabilities in the cloud.

Endpoint and Cloud, together with our Application Framework offerings of AutoFocus, Magnifier and Logging Service, are growing very quickly with the Q2 billings exit run rate of approximately $240 million growing over 85% year-over-year, and we're very excited about the future of these offerings.

With digital transformation, the threat landscape will constantly evolve, which is why security transformation's critical.

We will continue to focus on delivering technology evolutions that push the boundaries of today's capabilities and lead the way to the security paradigm of the future.

I want to thank our employees for their relentless dedication to our customers, our partners for their continued support, and our customers for placing their trust in Palo Alto Networks.

And with that, I'll turn the call over to Kathy.

Thanks, Mark.

Before I start, I'd like to note that except for revenue and billings figures, all financial figures are non-GAAP and growth rates are compared to the prior year periods unless stated otherwise.

I'm very pleased with our second quarter execution as we continue to add new customers at a rapid pace, while also driving robust expansion business.

We're seeing a high degree of interest across our platform, which further extends our leadership position with a consistent result of us growing faster than our competitors at scale.

In addition to market-leading growth, in Q2, we again expanded non-GAAP operating margins, delivered record non-GAAP EPS and generated strong cash flow.

In Q2, total revenue grew 28% to a record $542.4 million.

Looking at the geographic growth of Q2 revenue: the Americas grew 26%, EMEA grew 35% and APAC grew 33%.

Q2 product revenue of $202.2 million grew 20% compared to the prior year.

Sales of the new hardware, which we launched in fiscal Q3 '17, continued to perform well, with both new and existing customers.

Q2 SaaS-based subscription revenue of $183.3 million increased 36%.

Support revenue of $156.9 million increased 31%.

In total, subscription and support revenue of $340.2 million increased 34% and accounted for a 63% share of total revenue.

Turning to billings.

Q2 total billings of $674.6 million increased 20%.

The dollar-weighted contract duration for new subscription and support billings in the quarter was approximately 3 years, essentially flat compared to the prior year period.

For the first half of fiscal 2018, billings of $1.3 billion increased 18% year-over-year.

Product billings were $387.2 million, up 16% and accounted for 30% of total billings.

Subscription billings were $492.6 million, up 24%.

Support billings were $391.3 million, up 12%.

Renewal rates for our SaaS subscription business are strong at more than 90%, while renewal rates for support are approximately 100%.

Total deferred revenue at the end of Q2 was $2 billion and increased 33%.

Q2 gross margin was 75.9%, which was down 270 basis points compared to last year.

The decline was primarily attributable to the very strong traction we continue to see with the new products introduced in the third quarter of last fiscal year.

Q2 operating expenses were $300.1 million or 55.4% of revenue, which is a 350 basis point improvement year-over-year, driven primarily by ongoing increasing leverage in sales and marketing.

Operating margin was 20.5%, an increase of 80 basis points.

We ended the second quarter with 4,833 employees.

Non-GAAP net income for the second quarter grew 54% to $91.5 million or $0.97 per diluted share.

Excluding the impact of the Tax Cuts and Jobs Act, second quarter non-GAAP net income and non-GAAP earnings per diluted share were $80.9 million and $0.86, respectively.

The act lowered our Q2 non-GAAP effective tax rate to 22% from the previously guided rate of 31%.

On a GAAP basis for the second quarter, net loss decreased 42% to $34.9 million or $0.38 per basic and diluted share.

Turning to cash flows and balance sheet items.

We finished January with cash, cash equivalents and investments of $2.4 billion.

During the second quarter, we repurchased approximately 863,000 shares of common stock at an average price of approximately $145 per share, leaving a balance of approximately $330 million available for ongoing repurchases through December 2018.

Turning to cash flow.

Q2 cash flow from operations of $243.7 million increased 14%.

Capital expenditures in the quarter were $25.6 million.

Free cash flow was $218.1 million, up 29% at a margin of 40.2%.

DSO was 59 days, a decline of 19 days from the prior year period.

Turning now to guidance and modeling points.

Please remember, this guidance takes into account the type of forward-looking information that Kelsey referred to earlier.

Our fiscal third quarter and fiscal year 2018 guidance includes the company's updated non-GAAP effective tax rate under the Tax Cuts and Jobs Act.

The updated non-GAAP effective tax rate of 22% is a reduction from our previously guided non-GAAP effective tax rate of 31%.

For fiscal Q3 '18, we expect revenue to be in the range of $538 million to $548 million, an increase of 25% to 27% year-over-year; product revenue to be in the range of $193 million to $196 million, an increase of 18% to 19% year-over-year; billings to be in the range of $665 million to $680 million, an increase of 22% to 25% year-over-year.

Using the updated non-GAAP effective tax rate of 22%, we expect non-GAAP EPS to be in the range of $0.94 to $0.96 using approximately 94.5 million to 96.5 million shares.

This EPS range includes a benefit of approximately $0.11 due to the new non-GAAP tax rate.

And we expect capital expenditures for fiscal Q3 '18 to be approximately $25 million.

For the full year fiscal 2018, we are raising our guidance across all metrics and now expect revenue to be in the range of $2.190 billion to $2.220 billion, representing growth of 24% to 26% year-over-year; product revenue to be in the range of $810 million to $820 million, representing growth of 14% to 16% year-over-year; billings to be in the range of $2.715 billion to $2.770 billion, representing growth of 18% to 21% year-over-year.

We also expect a full-year, weighted average, non-GAAP effective tax rate of approximately 24%, which includes fiscal Q1 at the prior tax rate of 31%, and the remainder of the year at the revised lower tax rate of 22%.

Using this updated tax rate, we expect non-GAAP EPS to be in the range of $3.84 to $3.91, using 94 million to 96 million shares.

This EPS guidance includes a benefit of approximately $0.36 from our new full year non-GAAP tax rate.

And we continue to expect capital expenditures to be approximately $100 million.

Before I conclude, I'd like to provide some additional modeling points for the fiscal year.

We continue to expect fiscal Q2 and fiscal Q4 to have the strongest sequential total revenue growth.

As reflected in consensus heading into this call, our non-GAAP EPS guidance continues to include approximately 150 basis points of organic operating margin expansion, excluding first half investments associated with the LightCyber acquisition.

Our fiscal Q4 non-GAAP effective tax rate will be 22%, and we expect fiscal year free cash flow margin to be in the range of 39% to 40%.

Before we turn the call over to the operator for questions, I'm happy to announce that Jean Compeau, formerly Senior Vice President, Accounting and Corporate Controller, has been appointed Chief Accounting Officer, with ongoing responsibility for accounting and tax function.

Jean, who joined us in 2012, has 20 years' business experience, having held senior accounting or corporate controller positions at various technology companies.

Congratulations, Jean.

Operator, please poll for questions.

(Operator Instructions) And we'll take our first question from Andrew Nowinski with Piper Jaffray.

I guess, I want to ask about PAN-OS 8.1.

You talked about some of the new SSL incursion capabilities in that platform.

Are your customers seeing an increase in encrypted traffic coming into the data centers?

And are the new features that address this problem a free upgrade for customers?

And -- or could that potentially drive a refresh cycle?

Andy, it's Mark.

Good question.

Yes, we're seeing across the board an increase in encrypted traffic.

That's been the case for quite some time actually.

It's not uncommon for us to see in a customer environment north of 35%, 40% of all traffic being encrypted these days, just simply because the bad guys know that the legacy technology's not going to be able to decrypt it or if it can, it can't do it fast enough to have traffic continue to be, in essence, the real-time aspect it has to be.

So we've been continuously trying to improve the capabilities there.

Every release we've done has improved SSL decryption throughput.

The release of the new hardware has about 20x your performance, which is fantastic, and the 8.1 software also has capabilities in it as well to help with throughput and performance.

As you know, I think for our operating system, we don't charge extra for that.

So those are features and functionality that go into the software just to make us better and better and better over time.

So we, hopefully, will continue to be sticky.

And then, the last one of the question, as far as upgrades and refresh capabilities, yes, anything that has an opportunity for us to speak with customers about use cases is a great opportunity as well for refresh and upgrade and expansion.

Okay.

And then, maybe, just us a quick follow-up.

I see you launched another service as part of the Application Framework.

Can you just give us an update on the progress the third parties have made regarding the development of applications that could start to contribute revenue to your framework?

Yes.

Sure.

And just briefly, the one we launched is called Magnifier.

That came to us through the LightCyber acquisition last year.

So we're super happy to see that go live.

Basically, LightCyber has a fantastic behavior analytics capability.

It formerly would be something that you would have to plug in as another piece of hardware.

It's somewhere in your environment, so we've taken the algorithm out and made it the application.

So it's a SaaS application in the Application Framework, and that's the theory behind the Application Framework in a lot of cases.

Third-party-wise, working about 30 companies right now to get their applications live, and we expect that to happen in the coming months here.

We're excited about that, and stay tuned as we progress through there.

In the spring you'll hear more about that.

Your next question will go to Michael Turits with Raymond James.

Really strong quarter, and again, a really strong quarter on product.

Last quarter, you talked about some of the things that really drove hardware and product.

Can you drill down a little bit on that this quarter, and especially the extent to which some of that may be coming from a product refresh cycle?

Yes.

Michael.

Yes, we had a good quarter across the board on the entire -- platforms.

So really, we're very pleased to see the market come into the platform for all 3 of the evolutions that we had driven.

And obviously, product is performing very well indeed, so we're super happy to see that.

As we said coming into the year that on the refresh side, that's a net positive for the company and we expect that to continue to be the case, but it wouldn't be the primary driver for hardware in the year, and that is still the case.

So we're seeing the overperformance being driven from new customer acquisition.

You can see it's really high and expansion business as well.

Refresh is going very well lately, but it's still not the major driver for the business so we think that's something that is in front of us, which will be great.

Okay.

Just to follow up and maybe just more drill down.

I think that Service Provider was really strong, and high-end chassis were strong last quarter.

Did that continue?

And was that a material part of the upside this time?

Our Service Provider business is doing very well for us.

Last quarter, we had said that on the hardware side, we had seen some overperformance on hardware dollars associated specifically with what's called NBC cards.

Those are swap cards you'd put into the chassis, and we saw more than usual.

This quarter was nothing unique in that regard, so back to kind of normal run rates we see along that.

So that's what we've talked about last quarter for some of the hardware overperformance.

But the Service Provider business in general is doing well for us and continued to grow.

We expect that to keep going.

As we said every time we do a release, whether it's hardware, software, we've been adding more features and functionality to make us continually more attractive for service providers.

We'll take our next question from Matt Hedberg with RBC Capital Markets.

Maybe for Mark, the product refresh, it seems to be moving along nicely.

And clearly, you called out growth in SaaS and some in emerging products was strong there.

I'm curious if you could drill down a little bit on pricing, both within kind of core firewall, but also some of the newer products that are seeing quite a bit of growth.

Yes.

That's a great question, Matt.

We are absolutely selling the value proposition of the entire platform, which has all the 3 evolutions put into it: automation, orchestration, consistency, and now, an entirely new consumption model with the Application Framework.

And I mention that because that allows us, from a pricing perspective, to be, on the one hand, very competitive, but also on the other hand, to be able to not have to sell to price as many, many of our competitors continue to do.

So in this example in this quarter that we saw discounting improve again, sequentially, and year-over-year, we've seen that for a number of quarters now, which is fantastic.

Our team, I think, has done a great job of selling to value and selling to the strategic nature of the platform.

That's great.

And then, I'm not sure if Mark Anderson's on the call, but EMEA looked like it was particularly strong this quarter.

A lot of us have been talking about GDPR as a potential driver this year.

I'm curious, is that showing up as just dialogue at this point?

Or is this actually driving real deals as far as you can tell?

Yes.

GDPR, I think, or any other phenomena that drives awareness for companies to build better security defenses is a good thing for us because it allows us to get in front of people that have budget and show how differentiated we are from our competitors.

So I think we've got a good talk track around GDPR, and more importantly, it's backed up with supremely better security.

In terms of attaching it to deals, I think, we've been, I think, considered in Europe the thought leader for security for a couple of years now.

And I think, more than anything else, just the awareness that customers have about what we can do for them has ramped as we built out a very nice team and great partner coverage there.

We'll go now to Gregg Moskowitz with Cowen and Company.

Mark, more recently, we've seen you effectively widen the gap on growth relative to this year.

And I'm wondering if there's been any changes in the competitive landscape?

Or in your view, was this just a function of having fixture go-to-marketing fees from a year ago?

Yes.

Gregg, you're kind of broken up there.

I think the question was competitive differentiation.

Is that the summary?

It was tough to hear you.

That's exactly right, Mark.

Just a function of the widening gap that we've seen on growth versus your peers'.

Great.

Okay.

Thanks.

Yes.

Well, thanks for noticing.

Yes.

We continue to perform very well in the market, we think, and we are growing at outsized rates relative to the competition.

And it scaled a couple of billion dollars in size right now, so that's not insignificant.

And I think that's due to the fact that the platform approach we've taken is really resonating for -- with customers.

A lot of security vendors all sound the same when they talk about automation and integration and vendor reduction, things along those lines.

But what we found, and we found it to be a competitive advantage for us, is the architecture really matters.

So we can sit with customers and say this is how we've done it over time.

We have a very high degree of confidence because we primarily build most of it ourselves and it actually works together.

It does drive that automation.

It does drive that orchestration.

And increasingly at scale, you can see the consistency from network, to cloud, to endpoints as well.

It's really resonating with the customers, and I think that's showing through with the results.

And if I could just add, I think, comparing the -- just the vast amount of innovation that our engineering team has cranked out in the last year, if you just think about the new products, new services, new capabilities, the new features and the 2 new versions of operating system that have come out, it really does separate us from anybody else.

Okay.

Terrific.

And then, for my follow-up, I'm curious, since older appliances like the PA-2000 and PA-4000 can't run on PAN-OS 8.x, is that driving some incremental refresh at this point?

Or do you think that it will going forward?

It doesn't appear to be the case now.

And yes, I think anytime we have more -- newer operating systems and new hardware and that gives a great reason to talk to customers.

And hopefully, you get them to upgrade.

Things along those lines, but those 2 things, particularly, I wouldn't call that yet.

We'll go next to Sterling Auty with JPMorgan.

Looking at the -- I think it's the billings for subscription and support that grew 24%.

I'm just curious, any FX or duration-type of impacts that would have prevented that from growing even faster when you look at the first half over first half?

No, Sterling.

No, there's very minimal FX inside of here, and then, you'll be pricing U.S. dollars.

And then on the duration side, duration has been very steady for about -- it [exed] very steady at about 3 years for quite some time now.

Okay.

And then the 1 follow-up, I think you've called out the endpoint plus cloud bookings run rate of like around $240 million.

I think at the Analyst Day, you talked about a $140 million run rate.

Can you kind of compare and contrast, what was the time frame for the $140 million?

And is this just seeing a lot more customers moving into production and just buying a lot more expansion that's driving that growth?

Yes.

Sure.

So at the Analyst Day, we had talked about $140 million run rate.

That was the Q4 billings run rate.

And today, we gave you the Q2 billings run rate.

So we're trying to do the apples-to-apples along that.

You can see it's growing very nicely.

It's been starting to contribute pretty well.

It's close to getting to be like 9%-ish or 10%-ish of total billings contribution overall, which is great.

Also, considering if you strip it out, the other portions growing at close to 20% in size of billings as well as 9x payer [CS].

I think the whole platform is selling very well.

And as far as what's driving the nonattached, one, the capabilities are very good in and of themselves; and I think customers are increasingly realizing the value of the consistency aspect of being able to have the same security outcomes in network, cloud endpoints.

And then, just to make that even better, we've put the application firmware on top of it, and said, "For all those things that you're deploying from Palo Alto Networks, so you've got consistency, we're going to drive even more value over the top for every dollar you spend with us down there."

And just a point of clarification, the $140 million was for our cloud and endpoint, which we broke out separately in our Analyst Day presentation.

And the number that we provided today included AutoFocus, which was a separate category at Analyst Day.

Which was what?

Do you remember?

Yes, 50 -- sorry.

I'm sorry, $15 million.

Yes.

$1-5 million, starting at 90%, right?

So you add those together, Sterling.

So we had $140 million plus $15 million at AutoFocus, $155 million at blended mix of somewhere between 85% and 90%.

And now we've put those together into $240 million growing at over 85%.

There you go.

We'll take our next question from Catharine Trebnick with Dougherty.

Could you dig a little bit more into the cloud and how differentiated you are from your competitors?

It seems to be that's an area that you continued to widen the gap on.

And particularly, what are the cylinders or products or services that are driving and widening that gap?

Sure.

Thanks, Catharine.

The -- we've been at cloud security now for over 5 years and the second evolution, which I talked to a lot about in the script, which is making sure we have that consistency.

So when we get -- we're talking about cloud security, there's a number of aspects inside of there about delivering security from the cloud, using cloud as a third-party infrastructure as well and making sure we can secure that for folks and also making sure that we can provide the same seamless security to third-party SaaS applications as well.

If you kind of think about the approach we've taken, we've been very native with the third-party providers like AWS and Azure.

And now you may have noticed we just announced support for the Google Cloud platform, which I talked about in the script as well.

So you have all the major platforms covered.

And inside all those platforms, we've taken a very native approach to not only protect the, I'll call it, the networking aspects of that with the M-Series, but also protecting the host.

We just announced, Traps for Linux, which is very important in cloud environments, and then, also, on an API basis with Aperture for both SaaS and public cloud as well.

So increasing things like visibility, compliance, and storage security.

So we're making a lot of progress at that.

You may have also you heard me talk about, in addition to having security competency with AWS, we're the only security vendor to get networking competency as well, which is kind of interesting because when some security vendors try to go to the cloud, they just want to just virtualize something, right, and take it into the cloud as opposed to working very natively with the cloud providers and really using their tools and capabilities as well so that we can do lots of relatively creative things along with them, like auto scaling and load balancing that really take advantage of their network capability as well.

So lots and lots going on there.

We think the cloud is super important.

Customers are talking about the cloud for sure.

Some of them are moving rapidly in that direction, and we're absolutely in front of all that, we believe, with the customer base, and increasingly with all these thought leaders there, and also, the technology leaders as well.

I'd just add 1 thing there, Catharine.

It's Mark A., here.

The go-to-market relationships that we have with all 3 of these large public cloud vendors is really strong.

They're becoming very important distribution partners for us.

Take our next question from Ken Talanian with Evercore ISI.

I wanted to go back on product.

I was wondering if you could actually rank order the drivers of product growth in the quarter.

And how, if at all, you expect that to change in the back half of the year.

Sure.

Well, I don't think it's going to change much in the back half of the year, Ken.

This is Mark, by the way.

And there's really 3 drivers in there, and I'd order them in this direction.

The first is expansion opportunities in the customer base.

That's simply a magnitude statement when you have those larger customer bases we have, and they continue to buy from us along the way for their needs and use cases.

That's going to drive a lot of business.

Then we have new customer acquisition as well.

You can see we just put up another -- close to another 3,000 net customer.

So that's very helpful as well.

And then, the third is the refresh opportunity, which continues to grow over time.

And of course, adding more customers helps that in the long term.

I don't see that changing through the rest of the fiscal year there.

Okay.

Great.

And as a follow-up, I was -- you have another hardware release out there.

I was wondering if you could tell us when gross margin might normalize.

Yes.

It's a great question.

So on the gross -- on product gross margin side, there's really 2 dynamics at play here.

So we have the product gross margins on the new hardware itself, right?

And then, we have the mix of the new hardware and the total hardware mix.

So the product gross margin clients we've seen for the last few quarters is due to the mix increases of the new hardware.

So let me break that on for just a second for you.

So when we launched the new products last year, we're going to naturally start off with lower margins on them, and then they're going to improve over time.

Now we've seen, along the way, higher memory and component costs.

But even with that dynamic in play, we've continued to have modest improvements each quarter since we released the new hardware, and we expect that's going to continue.

But at the same time, that's going to be in offset with the mix of the new -- of all the hardware we're selling, having more and more new hardware in it as well.

So the mix is -- will drag down the product gross margins along the way.

So we're sitting here at the mid-year, with an increased product guide, another great set of new hardware we just put out in the market last week.

And some headwinds on component pricing, so we're expecting that we're going to see the same -- this mix dynamics to continue throughout the end of the year.

But we expect the total gross margins to be based on the ZIP Code where we are today.

And then, of course, as you can see, we're continuing to manage the business so we can get continued operating leverage.

We'll go next to John DiFucci with Jefferies.

Kathy, I wanted to ask you a question on the numbers, but the numbers are really clean and they look really good.

So I'm going to go to Mark.

Mark, these new products that you just came out with over the last, I guess, week or 2, do you see these -- I just want to make sure because we tried to model this.

Do you see these more as evolutions or upgrades to existing products?

Or are these brand-new offerings that sort of fill some holes in your current portfolio along the range of next-generation -- around the range of firewalls?

Yes.

I think they're kind of both ways, John.

So as we said in the past, if you -- the way we think about it with customers is customers are going to have various use cases that they're trying to solve for over time.

And then these use cases have different price performance requirements if you want to be competitive in the market, right?

So if I laid out all the hardware capabilities and Pan or VM-Series camp I should throw in there as well.

If I laid them out on the table here, you kind of get left to right, smaller form factors and throughput, all the way up to the really big ones.

And then, what we've been doing is filling it in every year right along the way of putting more and more capabilities in there or form factors in there at the right price performance for the use cases.

And that, of course, then makes us more competitive so that competitors can't come in over top or underneath us from a pricing perspective for throughput.

So that's what we would expect to continue to into the future is just make sure that we're always solving for that.

And those don't stand still.

The SSO decryption needs, for example, as those go up over time, that's going to drive up throughput.

So we want to make sure that we've got the right throughput capabilities there.

Okay.

Okay.

And if I could, I know you gave some billings metrics, but when we take a look at this and we kind of try to back into new product, excluding refresh and new subscriptions, excluding renewals, the new product numbers look stronger than the new subscription.

First of all, I guess, is that right, I guess, directionally?

And what does -- is -- that do?

I mean, if you're seeing some benefit from product refresh, that would be one cause of that.

But just, is that what's happening here?

No.

I think -- well, I'm not sure there's -- I'm not sure exactly the question.

Let me try to answer what I think it is, though.

But when customers are purchasing from us or starting out with us, right, on purchases, if you look at the lifetime value creation over time, it takes time to get maximum lifetime value creation, which, by the way, is not standing still, right?

So when you go into the mix of what customers are buying from us over time with hardware, services that would attach, nonattached services.

And then, they're going to lap over.

They're going to renew their support.

They'll renew subscriptions.

They get a chance to sell more stuff.

The lifetime value, I think, naturally grows over time with our customer.

We'll take our next question from Rob Owens with KeyBanc Capital Markets.

I was curious on Traps and some of the big wins you saw.

Are you the exclusive -- are you exclusive to the endpoint at that point?

Are you complementary to someone else?

And in those bake-offs, who are you seeing typically?

Sure.

Bob, it's Mark.

I'll take those in reverse.

And as far as who we see, we see everybody.

A lot -- primarily we're going to see the legacy incumbent folks in there, who are providing AV protection and we're doing our best in doing a good job in taking them out.

And then we see a lot of next-gen folks in there as well, next-gen import providers who are also trying to do the same thing.

And to your first question, it's a mix.

Sometimes, we get to be the only provider over time.

Other times, we may be run as a complement or sometimes it goes -- you have to think of endpoints as suites as well because there's other capabilities and endpoints that we don't have like TLP, full-on TLP capabilities, for example, so that we continue to run different endpoint providers, but not specifically for the security functions we provide.

And second, you mentioned that when you get your subscription support up front, it's typically 3 years.

What does it look like on a renewal?

Renewal's been very consistent for quite some time, when it's steady range it's not really changed.

So it's been pretty consistent.

The overall renewals, as you heard us say, are about 3 years.

That's 3 years as well?

Okay.

No, I'm sorry, Bob.

Just to be clear, the overall duration is about 3 years.

And then, inside of that for renewal durations, those have been in a steady range for quite some time inside of that number, yes.

Just wanted to clarify.

We'll take our next question from Fatima Boolani with UBS.

Mark, a question for you.

You spoke about the first ruggedized appliance in your portfolio.

That was at last week.

And I'm wondering how you think about this broader opportunity around protection of critical and industrial control systems, and maybe your perspective on why this particular area has kind of been habitually under-invested?

And a follow-up for Kathy, if I may.

Sure.

Great.

Yes, so on -- the question's really about the PA-220R, which is the ruggedized version of our PA-220, which is a great opportunity for us.

A lot of our customers, which are in environments where that -- you would consider these not just IT capabilities, but OT capabilities, ICS skate environments, harsh environments, where the line is blurring between IT and OT.

They want to have the same capabilities that Palo Alto Networks provides, but they want them in those harsh environments.

We've had a number of folks ask us, would you ruggedize the 220 because that's the great form factor for oil rigs, for example, in different places.

It might be utility, substations and things along those lines.

So they -- actually essentially have been doing it kind of themselves with different contract manufacturers to ruggedize our equipment for us, so we said, well, we can do that.

So that was the impetus to launch the PA-220.

Now what that does for us is with customers who already like our capabilities, it gives us a whole new outlet of where to install this hardware because if you can now go into those environments that require those ruggedized capabilities.

Kathy, I'll let you take whatever the next part is.

Kathy, as the portfolio expands and begins supporting more cloud-delivered services like GlobalProtect, what are the implications for your CapEx profile?

And how are you thinking about that this year and at a qualitative level for next year and the years out?

Yes.

Thanks.

We are definitely investing in our Application Framework as we look to deliver more cloud-delivered services.

Obviously, that requires a bit of infrastructure investment.

And so the $100 million CapEx number that we've provided as full-year guidance in fiscal '18 definitely includes some investments in that infrastructure.

And I think we would expect that to be ongoing and continue as we build out the Application Framework.

Yes, and Logging Service as well.

So some of the new services that were brought to market are a good amount of infrastructure in the back end like Logging, for example.

That's not inexpensive to do that.

Our next question, we'll go to Jonathan Ho with William Blair.

Just wanted to start out with the sales force and in terms of the sales execution challenges that you guys saw last year, how should we be thinking about sort of the room for productivity enhancements and maybe where we are in terms of correcting those challenges.

Jonathan, Mark Anderson here.

Thanks for the question.

So I think on the sales force reorg that we started working about a year ago, I think, I've got to really compliment Dave Peranich for doing a terrific job of restructuring and getting the right butts and seats to focus on the right customers and clearly driving the right outcomes.

From a productivity standpoint, very happy with the productivity improvements that we see.

We talked about that in Analyst Day, and we still see continued improvements there.

I think with all the new services and the new products that we have, we've got more arrows in the quiver for the sales reps and SEs out there and I think we're optimistic in being able to see improvements there.

Yes.

We are expecting in our guide we gave for the second half of the year as well that there will be continued productivity improvements.

Got it.

And then, as we look at sort of the tax rate reduction as well as the strong balance sheet that you have, how should we think about use of capital going forward?

Yes.

We take a very traditional approach to that, Jonathan, but really looking at 3 possible uses of capital.

First and most important in our opinion would be to invest back in the business, assuming we can get the right rate of returns on that.

And we invest very nicely in the business as you can see and whilst continuing to drive leverage and capturing market share along the way to do that.

So we feel like that's working out for us.

And the second priority would be if we see technology capabilities in the market that we like that we think could help accelerate the evolution that we've been driving for some time.

We've demonstrated the ability to go to market and do some M&A to do that, and that could be the case in the future for us.

And then, the third is, if we are not doing the first 2, we've also demonstrated the ability to return value to the shareholders, primarily, through stock repurchases, while maintaining a good healthy balance sheet for any offerings.

We'll go next to Anne Meisner with Susquehanna.

At Analyst Day, you talked about leveraging AI tools along with your customer data to better implement some customer targeting program.

Can you give us an update on that and what your strategies have resulted from that initiative?

And then, in particular, as it relates to the refresh cycle, whether you think it's helping you optimize that opportunity.

Yes.

And that's a great question, and I really appreciate the fact that you took note of that at Analyst Day because we're a really data-driven company here, so lots of mathematicians running around and including in the marketing department as well as our CIO organization, who are using and harnessing the same kind of AI and machine learning capabilities you're seeing coming through in our product sets.

So a number of the things that we talked about at Analyst Day that are tools for our sales team to use like things called Quota Crusher for example, and the Deal Doctor.

Those are using AI capabilities to tell sales reps, what is the next thing you should do with this customer?

Recommend, for example, or if you want to maximize your earnings, this is how to do that.

And those are being very heavily used by our team as well as our partners as a better and better effect.

So as we continue to train those tools, they get better.

So if we can come back to the last question that just came up, in productivity, I would definitely put some of the productivity growth that we're seeing from the sales team in this bucket, which has given them fantastic tools to use in order to grow the productivity.

We'll go next to Saket Kalia with Barclays.

First, maybe for you, Kathy, just a quick accounting question on product.

Could you just talk about how the accounting for VM-Series works?

Meaning, could we see any carve-out of VM-Series in the product line as that business gets bigger?

Or perhaps as accounting rules change?

Just any color on how VM-Series could or could not impact the product line down the road.

Well, the VM-Series is -- really should not change the categorization of where we put revenue one way or the other.

Yes, Saket.

You may have heard us in the past, we talked about VM-Series, historically, a lump on the head, like the 2 flavors are perpetual, right, and non-perpetual.

And the perpetual piece would go into product.

That's pretty much gone, I guess.

It's just -- we're almost nothing there.

So every time you hear us talk about VM-Series, it's going to go into a ratable line for us.

Got it.

That's super helpful.

Maybe a follow-up for you, Mark.

Kind of a follow-up from last quarter, actually, but can you just talk about how the Application Framework is changing conversations with customers?

And maybe tying it to this quarter, whether the Application Framework was actually helping the core Network Security business at all.

Yes.

It's -- I think it's definitely helping the overall business across the board.

And as far as the conversation with customers, the -- 100% of the time, and I'm not exaggerating on that.

I've briefed hundreds and hundreds of customers as Mark has as well, we hear the same thing, which is them saying, we have this seemingly insurmountable challenge, which is how do we harness new innovation, which we know has to come.

We know no 1 company can do it, but we can't operationalize it because we can't run 1 more thing, right?

So this Application Framework sounds like you figured out how to solve this problem substantially for us.

So we hope you get this right, and that's very consistent.

Now this afternoon, we're trying to sell something this afternoon, it really goes back to the second evolution on consistency, which we're doing a great job at for each of the capabilities to consistency of security.

And now we've just given the customer a really powerful reason if they're going to think about us versus that endpoint provider or that firewall provider or that cloud provider, why you go with Palo Alto Networks in order to future-proof your investment, which is, now they're going to put the application on top of it.

So if I buy their firewall today, their endpoint today, their VM today, their CASB capability today, they're going to continue to bring more innovation to that purchase and make that purchase more valuable for me for every dollar I spend with them when I deploy them that way.

So it's been very, very positive.

I think that's really helping us in the market.

We'll take our next question from Keith Weiss with Morgan Stanley.

This is Melissa Franchi calling in for Keith.

Mark, I'm just wondering if you're seeing any change in customer behavior around refresh, and I'm mostly interested if you're seeing any customers that are opting to instead deploy a VM-Series instance versus a physical deployment and what would be sort of the use cases around that.

We've seen everything go in many directions, Melissa, but you can kind of see it's -- the cloud side of the business growing.

The VM-Series, our hardware side is growing as well.

But back to this consistency thing, if we get a chance to do something for a customer, they more often than not are going to use this in the environment everywhere.

So we gave an example on the call I thought was kind of interesting about a customer who was a large company net new to us as a customer, never bought anything.

First thing they bought was in the AWS Marketplace for VM-Series.

And then, over time, after we saw them there, we contacted them, and we said, how are you doing?

It's like lead gen for us.

And we just closed a 7-figure deal with them, on-prem, right, because people are living in these hybrid -- worlds in hybrid environments.

You can kind of see it going in VM to physical, physical to VM.

People are going to operate in these hybrid environments for quite some time, we think, and it's beneficial for us.

Okay.

And just 1 quick follow-up for Kathy.

It was helpful to see the tax guidance for the fiscal '18.

I'm just wondering if you could put some color around what we should think on the impact to cash taxes because as far as I understand, you still have NOLs.

Yes, that's right.

We do have NOLs, and we don't expect to be a cash taxpayer or a significant cash taxpayer for the next 4 years or so.

We mentioned at Analyst Day that we expect to pay about $10 million to $25 million per year for the next 4-ish years, and that doesn't change with the new tax law because of the NOLs, essentially.

We'll go next to Philip Winslow with Wells Fargo.

I have a question on gross margins and most of my other questions have been asked already.

But Mark, you laid out sort of the impact of the newer appliances versus some of the older appliances may have affected a lot of gross margins.

But as you sort of look up and down, call it that way, the appliance set, call it, the service provider, large enterprise, branch office, et cetera.

How should I think about the differential in gross margins there?

And as you think about what's sort of impacting gross margins over the past year, and then as you kind of think about that guidance going forward, how do you think about that mix, call it, between up and down the appliance range?

I think a better way to think about it, Phil, is not so much the size of things.

It's really about what goes into them from a componentry perspective.

And there's a mix of components in all these things, right?

They're not all the same across all the devices either, though it's not just about like a small thing versus a big thing.

Usually, and we definitely see it in this case, newer things, right, will have lower product gross margins than things that are much more mature over time because we continue to drive economies of scale and componentry pricing improves over time, things along those lines.

So I think about it that way, and the mix comment I was making was, as the mix of our hardware is -- goes more to the newer things that we've developed and we can see we're overperforming very nicely on the hardware side, that's positive for the business, of course.

It's got some short-term impacts on the product gross margins because that mix is larger inside there, even though we're continuing to improve the gross margins on those products every single quarter as well.

That concludes today's question-and-answer session.

At this time, I'll turn the conference back to Mr. Mark McLaughlin for any closing remarks.

All right.

Thanks, operator.

I appreciate that.

I want to thank everybody for your time this afternoon, and I know we're going to see many of you over the coming weeks.

I look forward to that.

I hope everybody has a great evening, and thanks so much for joining us on the call today.

This does conclude today's conference.

Thank you for your participation.

You may now disconnect.