Palo Alto Networks Inc (PANW) 2019 Q1 法說會逐字稿

Good day, and welcome to the Palo Alto Networks Fiscal Quarter -- First Quarter 2019 Earnings Conference Call.

Today's conference is being recorded.

At this time, I'd now like to turn the conference over to Amber Ossman, Director of Investor Relations.

Please go ahead, ma'am.

Good afternoon, and thank you for joining us on today's conference call to discuss Palo Alto Networks' fiscal first quarter 2019 financial results.

This call is being broadcast live over the web and can be accessed on the Investors section of the site at investors.paloaltonetworks.com.

With me on today's call are Nikesh Arora, our Chairman and Chief Executive Officer; Kathy Bonanno, our Chief Financial Officer; Lee Klarich, our Chief Product Officer; and Dave Peranich, our Executive Vice President, Worldwide Sales.

This afternoon, we issued a press release announcing our results for the fiscal first quarter ended October 31, 2018.

If you'd like a copy of the release, you can access it online on our website.

We'd like to remind you that during the course of this conference call, management will make forward-looking statements, including statements regarding our financial guidance and modeling points for the fiscal second quarter 2019; our competitive positions, and the demand and market opportunity for our products and subscriptions; benefits, continued execution focus and timing of new products and subscription offerings.

These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements.

These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future.

And we undertake no obligation to update these statements after this call.

For a more detailed description of factors that could cause actual results to differ, please refer to our annual report on Form 10-K filed with the SEC on September 13, 2018, and our earnings release posted a few moments ago on our website and filed with the SEC on Form 8-K.

Also, please note that certain financial measures used on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges.

For historical periods, we've provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the supplemental financial information that can be found in the Investors section of our website located at investors.paloaltonetworks.com.

We'd also like to inform you that we'll be participating in the 2018 Wells Fargo Tech Summit in Park City, Utah, on Tuesday, December 4; and the Barclays Global Technology, Media and Telecom Conference in San Francisco on Wednesday, December 5.

Lastly, once we have completed our formal remarks, we will be posting them to our Investor Relations website and our quarterly results.

With that, I'll now turn the call over to Nikesh.

Thank you, Amber.

Hello, everyone, and thank you for joining us this afternoon for our fiscal first quarter 2019 results.

As you know, it's been a busy few months for me at Palo Alto Networks, and I am delighted to report that we had another outstanding quarter.

And once again, we have been able to grow our top line significantly faster than the market.

I'm also happy to say that my cybersecurity education is progressing nicely as I continue to meet more customers, partners and employees.

During this quarter, we held our first-ever European Ignite, our user event in Amsterdam, and our second annual Federal Ignite event in Washington, D.C. At these events for our customers and partners, we consistently heard from multinationals to governments all the challenges that are associated with protecting data in the digital world.

Mobility, the movement of data to the cloud, data analytics and machine learnings are some of the trends that we believe are forcing companies to reevaluate their security posture in a more comprehensive manner, looking for high levels of integration and automation.

In this way, we believe we are uniquely positioned to support our customers across all these 3 events: one, securing their enterprise; two, enabling them on their journey to the cloud; and three, helping them with their desire to deploy advanced AI and ML across their enterprise.

So let's discuss some current examples of how we're solving customer problems, and what we have in store.

Service provider is a segment where we have traditionally not done as well as we would like.

We're about to change that.

We're excited to announce a new product for our service provider partners, an area we plan to focus on and invest in for future growth.

Our service cloud -- providers are facing a major mobile infrastructure transition from 4G to 5G.

We want to be there with them to help them succeed.

We're announcing a new super scale next-generation firewall, the K2 Series, that has been developed specifically for service providers with their high-throughput needs, taking into account their price considerations, their upcoming 5G and IoT transition.

We expect it will be available shortly in early 2019.

In a segment where we have done well, the federal space, WildFire, our cloud-delivered malware analysis service, achieved FedRAMP Ready status during fiscal Q1, which extends our ability to provide advanced threat prevention analysis capabilities to U.S. federal agencies.

For our largest customer, we introduced Panorama Interconnect.

The new Panorama plug-in gives customers the ability to manage the configurations of over 30,000 next-generation firewalls on a single Panorama console.

And they can push configuration changes to all managed devices from one single location.

This continues our quest to simplify a large-scale security management for our customers.

And lastly, in cloud security, we closed our RedLock acquisition this quarter.

RedLock adds to our already extensive set of cloud security offerings, which include Evident, Aperture, GlobalProtect Cloud Services and VM-Series.

By combining the Evident RedLock technologies, we'll provide customers with cloud visibility and compliance, cloud security analytics, and advanced threat detection in a single offering, to be released very early next year.

The new offering will help security teams better understand their cloud deployments, they tend to respond faster to the most critical threats and achieve automated remediation.

I know there's a lot of discussion around our philosophy and my philosophy on M&A, so I'd like to use the subject of RedLock to refine our point on the M&A philosophy.

The technology required is best-in-class.

We have a clear opportunity to be a leader in this space, and we believe that we can significantly enhance the value of the assets we acquire.

We invest in a product-focused team and technology that we believe we can integrate quickly and effectively into our infrastructure.

However, to reiterate as a shareholder and as an investor, my interests are aligned with yours to create long-term shareholder value.

So to give you some guidance, any activities in the area of M&A are going to be disciplined.

They're going to be guided by our aspiration to: one, participate in large market; two, become #1 or #2 in that market; and three, bring the vast execution capabilities of Palo Alto Networks to any acquisition, so that we can instantly enhance value.

Looking forward, we will continue to stay strong in network security, adding capabilities to solve our customer problems.

Additionally, we will lean forward into the trends of cloud, machine learning, and AI in a big way.

These important technologies paired with our vision of simplifying security and providing a platform with consistent protection across an enterprise environment is resonating with customers.

The Application Framework and XDR are the next step in our evolution towards this goal.

We're making good progress under the leadership of our Founder, Nir Zuk.

And while we're still in the early days, during Q1, 7 partners launched applications to the framework.

The technologies that these partners bring to the framework include analytics, MSSP, identity, threat intelligence, security for industrial control systems, IoT, and network access control.

Before I move on, I'd like to add a little bit more color on my first 180 days.

As we all know, execution has been a key variable in our success as a company, and we will -- and will continue to be so in the future.

During the last earnings call, I mentioned launching speedboats with focused leadership accountable for results in our more nascent market opportunity.

Whilst we have a great execution machine, we want to make sure our speedboats give us the flexibility to operate and execute effectively in some of the newer areas.

Our first speedboat in cloud security has been launched and is off to a good start.

We have products and sales leaders jointly guiding our cloud performance, and we expect this focus will allow us to execute as well in new areas as we have done historically.

We'll likely launch additional speedboats in the future, and we'll keep you posted on our progress.

We have an excellent go-to-market engine that is running well.

And with our new President, Amit Singh, we have a leader in place who brings extensive experience, bring enterprise and cloud businesses in driving revenue scale.

Amit joined us on November 1, has been extremely busy in his first few weeks on the job.

He's finished over 50 account reviews, met as many customers already this quarter, to both share our commitment to them and learn from our customers on how we can best partner with them.

He's running hard, and I'm excited that we found such a capable leader to fill this important role.

He joins a great team, and together, they will remain focused in executing against our significant market opportunity and momentum across the platform.

In our fiscal Q1, the team lived up to their reputation, as we once again acquired new customers at a rapid rate, and expanded our wallet share with existing customers.

Our top 25 customers each spent a minimum of $33.6 million in lifetime value, which is a 45% increase over the $23.2 million they did in Q1 of fiscal '18.

Examples of customer wins and competitive displacements in fiscal Q1 that demonstrate the progress we're making across the network, endpoint and cloud are: we landed a top 3 airline in the U.S. to secure their data centers; we also replaced a competitor in the data center, sold all of our attached subscriptions at a U.S.-based investment management company; our cloud firewalls, VM-Series, was selected as the security standard on the world's largest networking telecom companies in the world.

Our cloud monitoring and compliance offering, Evident, was selected to secure the public cloud infrastructure on one of the world's largest banks based in Europe.

GlobalProtect, our service was selected to secure remote factories, offices, and stores, one of the world's leading manufacturers and marketers of quality skin care, makeup, fragrance and haircare products.

No points for guessing who that is.

And our Advanced Endpoint Protection offering, Traps, was selected to protect 10,000 devices at a leading health care provider in Australia.

To round out the news in the quarter, we were happy to be positioned as a leader for the seventh consecutive year in Gartner's 2018 Magic Quadrant for enterprise network firewalls.

This positioning reflects our commitment to staying ahead of the threat landscape and providing our customers the best protection against the ever-evolving threat of cyber attacks.

I personally remain extremely excited about the opportunity ahead of us, and plan to keep my head down and continue to execute with our leadership team.

I'd like to thank our customers and our partners for their support, and of course, the team at Palo Alto Networks for their dedication to our mission.

I really enjoyed becoming more established at Palo Alto Networks and learning about cybersecurity.

And working with this great team, I wake up every day excited to be part of this great company.

With that, I will turn the call over to Kathy.

Thank you, Nikesh.

Before I start, I'd like to note that except for revenue and billings, all financial figures are non-GAAP and growth rates are compared to the prior year periods, unless stated otherwise.

All current and prior period financials discussed are reflected under ASC 606 as we adopted the new standard as of August 1, 2018.

As Nikesh indicated, we had a great start to our fiscal year.

We continued to see healthy security spending and strong demand across our platform.

In the first quarter, total revenue grew 31% to $656 million.

By geography, Q1 revenue grew 29% in the Americas, 35% in EMEA, and 35% in APAC.

Q1 product revenue of $240.5 million grew 30% compared to the prior year.

Q1 SaaS-based subscription revenue of $231.3 million increased 37%.

Support revenue of $184.2 million increased 24%.

In total, subscription and support revenue of $415.5 million increased 31% year-over-year and accounted for 63% of total revenue.

Q1 total billings of $758.5 million increased 27% year-over-year.

The dollar-weighted contract duration for new subscription and support billings in the quarter was approximately 3 years, consistent with what we have seen in prior periods.

Total deferred revenue at the end of Q1 was $2.4 billion, an increase of 34%.

Q1 gross margin was 76.7%, relatively flat to last year.

Q1 operating expenses were $366.5 million or 55.9% of revenue, which represents a 140 basis point improvement year-over-year.

Q1 operating margin was 20.8%, an increase of 150 basis points year-over-year.

We ended the first quarter with 5,645 employees.

Non-GAAP net income for the first quarter grew 64% to $115.4 million or $1.17 per diluted share.

On a GAAP basis for the first quarter, net loss declined 39% to $38.3 million or $0.41 per basic and diluted share.

Turning to cash flow and balance sheet items.

We finished October with cash, cash equivalents and investments of $3.8 billion.

Q1 cash flow from operations of $252.3 million declined by 8%.

Free cash flow for the quarter was $218 million.

During the quarter, we redeemed $327 million of the $575 million 2019 convert.

For GAAP accounting, $52.3 million of the amount redeemed is categorized as cash flow from operations.

Adjusting for this and other cash charges, free cash flow in the quarter was $275.4 million, up 27% at a margin of 42%.

Capital expenditures during the quarter were $34.3 million.

DSO was 58 days, a decline of 12 days from the prior year period.

Turning now to guidance and modeling points.

For fiscal Q2 '19, we expect revenue to be in the range of $675 million to $685 million on an ASC 606 basis, an increase of 24% to 26% year-over-year.

We expect second quarter non-GAAP EPS to be in the range of $1.20 to $1.22, also under ASC 606, using approximately 99 million to 101 million shares.

Before I conclude, I'd like to provide some additional modeling points.

Our non-GAAP EPS guidance includes expense of $10 million to $15 million associated with our recent acquisitions.

Also included is our expectation of a $0.01 to $0.02 impact associated with U.S. tariffs on Chinese-origin goods.

As we continue to retire the 2019 convertible debt through maturity in July, we expect approximately $45 million of the remaining $248 million balance to be accounted for as cash flow from operations.

We expect our non-GAAP effective tax rate to remain at 22%.

CapEx in Q2 '19 will be approximately $25 million to $30 million.

With that, I'd like to open the call for questions.

Operator, please poll for questions.

(Operator Instructions) And our first question will come from Ken Talanian with Evercore ISI.

So first off, could you give us a sense for what, if any, changes you have made to your go-to-market efforts on the firewall side?

And I'm thinking that inclusive of the channel.

Thanks, Ken.

Excellent question.

We haven't made any particularly major changes to our go-to-market on the firewall side, that I can think of, or -- including channel.

I think the efforts continue to be the same.

Dave, is there anything you...

Yes.

Ken, it's really been business as normal on that front.

The sales team is enthused and highly engaged.

We've got the industry-leading product.

We got great traction and great markets in front of us to grab, and we feel great about that business.

Okay.

And the second question, could you give us an update on your traction with GlobalProtect cloud and how you'd characterize your win rates there?

I think, Ken, on the GlobalProtect cloud front, we think we have a unique opportunity as we see people trying to go ahead and automate and put security and come up with a new architecture for their remote branches, and for their remote offices.

We think [GPCS] is a unique product, which does really well.

We've had some good success with some very large players.

We'll share more about the success in our next quarterly call.

But for now, again, it's an interesting product.

It's unique in the way Palo Alto's existing customers and Palo Alto Networks to be able to extend their network security, which they already have in their data centers, all for their remote branches, without having to change either of their control systems.

So very exciting.

We're seeing a lot of traction.

And hopefully, we'll tell you more about it next quarter.

Our next question will be from Matt Hedberg with RBC Capital Markets.

Nikesh, in your prepared remarks, you talked about an increased focus on the service provider segment, which is great to hear.

It sounds like there's a new product coming early next year.

There's obviously a lot of drivers here.

You mentioned a couple of them, including 5G.

I guess, I'm wondering, can you give us a little bit more detail on how this new product portfolio might accelerate the momentum there?

And is there anything else from a go-to-market perspective that needs to be also augmented?

Matt, thanks for your question.

Let me give you a very high-level point of view, and then, I'll have Lee jump in and give you some more insight into why we believe this product meets the needs for the future for our service provider customers.

It's a segment -- when I came here, I realized we haven't done as well as we'd like to do.

And there's structural reasons for it.

There's reasons on the service provider side for it, but that's not enough of an answer.

So we sat down, looked at what we should be doing, what we can do, and the product came really valued hard the last 6 months to be able to put this together.

Because we believe we already have the industry-leading firewall from a security and networking perspective.

We just needed to make sure we were emphasizing some of the future business service providers need in the future.

So from that perspective, I think the team has done a phenomenal job in getting us ready.

But remember, the sales cycles were served further along.

So you're not going to be hearing us blowing the top off from a sales perspective in 3 months.

But this is a prerequisite for us to be strong in that sector.

We have a very dedicated go-to-market deal with RFP space as one of our few spaces where we have a dedicated team around the world.

And they're very excited about this new product.

And I'll let Lee jump in and talk about why this product is relevant for 5G, IoT, and a next-generation perspective for the service providers.

Yes.

Thanks, Nikesh.

The -- when we look at what's happening in the transition from 4G to 5G, there's some really significant changes that are taking place.

The first is just the advent of IoT becoming really high scale on mobile networks, with the capability that 5G offers.

Second is a lot of that is going to be high-value IoT.

It's going to be medical device use cases.

It's going to be connected cars.

It's going to be things that are really important.

And the third is more and more applications are moving into these mobile environments.

And so when you think about that, you can just imagine the need for the best security, all of a sudden, becomes a critical driver for this change from 4G to 5G.

And so our timing of bringing about the new KG series out the new K2 series is aligned with this big shift in the SP space for this move to 5G.

That's great.

Maybe one other for, Lee, on the product side.

Obviously, RedLock seems like a great acquisition, really complementary to everything you've done.

I think, specifically, what I can tell from Evident.io.

Maybe a bit more color there.

I guess, it shares sort of -- it's an API framework, so it looks like it's going to be a nice integration.

But maybe just a little bit more detail on how that sort of supplements what you guys have done there, including continuing to build out that side of the business.

I think, Matt, that's a great question.

I think, as I walked around and talked to a lot of customers, it was evident that, no pun intended, that every one of our customers was undergoing some sort of journey towards the cloud.

And different shapes and forms.

Some people have a public cloud.

Some people are analyzing it.

Some people are trying to decide.

And many of them talk of a high-grade environment or a multi-cloud environment because none of them is quite yet sure where they want to land in the long term.

And as we went around and understood that journey, we understood that they need a multi-cloud security platform that allows them to carry the security posture from their existing data center and existing infrastructure into the cloud.

And as we look to that, we thought we had a product in this space called Evident, which was leading in its own way, in its own category.

But we look to the market and said RedLock also was nipping at our heels, and was also sort of doing really well in adjacent parts of the same market.

And so a good offering would be the integration of the 2. And to the credit of our Evident RedLock team, they will integrate in the next month and be able to have an integrated product in the market by the first week of January, which I think is phenomenal, given the base of that market and given the opportunity of that market, we believe that this is the only product of its kind in this space.

But, Lee, I'll let you talk more about it.

Yes.

Absolutely.

So one of the things we've seen in -- when we talk to our customers and their journey to the cloud is, one, they're all going through this journey; but two, they almost 100% don't fully understand everything that they have in the cloud already.

And so the combination of Evident and RedLock really gives us a great window into -- and our customers, a window into everything they have so visibility, asset inventory.

Based on that, I think, is the next step, which is how to provide security analytics for that, ultimately, detect threats and respond to those threats.

And Evident brought a certain aspect to that.

RedLock brought another component.

And as Nikesh said, we'll be integrating those 2 quite shortly into a single integrated offering.

Our next question will be from Andrew Nowinski with Piper Jaffray.

You announced a new service provider product today.

And that's definitely a market that you should be in.

And you've also researched your low-end and midrange firewalls.

So I'm wondering, when can we expect a refresh of the large enterprise, the 7000 series?

I'll let Dave answer that question.

We don't talk about product futures on these calls and don't make public announcements.

The 7000 series is extremely competitive in the marketplace right now.

It's doing great with our customers.

We're very happy with the performance on that box.

Okay.

Fair enough.

And then, a question for Kathy.

When talking to your sales team and your channel partners, do you feel like the enterprise buying cycle is more, perhaps, more back-end loaded this year than it was last year?

As it relates to the calendar year-end enterprise budget flush?

Well, our linearity has actually been pretty good the last couple of quarters.

And so I wouldn't say that we're really seeing more back-end-loaded nature of the business, necessarily.

So normal seasonality you're expecting this quarter?

In Q2, we've guided to, what, 24% to 26% year-over-year revenue growth.

Seasonality there looks pretty in line with what we've seen historically.

Our next question will be from Keith Weiss with Morgan Stanley.

This is Hamza Fodderwala in for Keith Weiss.

I wanted to just dig into just the security demand environment more broadly, hadn't (inaudible).

It seems like we've had this strong refresh activity in recent quarters.

Where do you think we are in terms of -- are we early innings still?

Or middle innings?

Just wanted to get your thoughts on that.

Yes.

In terms of refresh opportunity, we've talked about the fact that it's an important variable for us as our cohort size increases every year over our history.

It becomes a bigger and bigger opportunity for us as time goes on.

It's -- while it's an important variable, it's not the most important driver of our growth.

As you see, we continued to add customers at a very high clip every quarter, and our expansion opportunity within our existing customer base is quite significant.

So relative to the numbers in our customer cohort of 5 or 6 years ago, just the opportunity within our existing install base and the new customers that we're adding are really the primary driver of our growth.

Got it.

And just a follow-up question on that.

So it seems like the RedLock acquisition was a pretty good one for you.

You've gotten some good feedback in the partner channels that we've talked to on that product.

What other functionality gaps do you see from a cloud security standpoint that you still have to fill in?

Do you think these could be addressed organically?

Or are you looking at all options?

Yes.

Look, public cloud security is, obviously, very important.

And we're putting a lot of our weight behind that with VM-Series, which continues to do very well for in-line security, with Evident/RedLock combination, which we believe is the leading solution for API-based security and public cloud.

And with some of the enhancements we made to Traps over the last many months to include support for Linux, which is obviously the predominant operating system behind the applications that run the public cloud.

And so that combination of in-line security, API-based security and host security, we believe, is the right approach.

And we feel very good about being in a position where we have leading solutions in all 3 of those.

Our next question will be from Michael Turits with Raymond James.

This is Eric Heath on for Michael.

Nikesh, you indicated several times that Palo Alto will be focused on utilizing security data.

So does this mean that you want to enter the SIM market?

Or -- and with the automation aspect, what we call now the SOAR market?

How should we think about that?

We have some very exciting products coming up early next year in XDR, which allows you to do some degree of investigation, some degree of remediation.

We are looking carefully at what this entails.

Our Application Framework will allow for SIMs and SOARs to run on top of it.

So we believe that we will be able to provide a comprehensive solution to our end customers as long as we can deploy our firewalls and our endpoint agents more ubiquitously across an entire base.

Got it.

So I mean, just to kind of piggyback on that.

So without a major investment, whether organically or inorganically, can you develop like the intellectual capital and the culture on analytics and data science if you decide to go that way, needed to kind of become a data-focused company?

Or...

Well, we have significant effort around analytics with our product Magnifier, which does a bunch of behavior analytics that sits on top of the Application Framework.

We have embedded ML people in almost every one of our product teams, albeit small.

Our intention is to keep beefing that up because we believe machine learning is not just about taking a lot of data and trying to train it.

Machine learning is about taking every product of yours, understanding the data that it gives, understanding how you use that data to be able to create a better product to start with, and then, leverage the ubiquity of that product to improve the outcome for every customer.

So we're embedding ML people across the board, across the company.

We also have analytics apps on our platforms.

And as we see the deployment of the Application Framework, as we see the usage behaviors of customers, we'll decide which way -- which areas we need to put mobile behind.

Our next question will be from Sterling Auty with JPMorgan.

Kathy, you've mentioned, I think, $0.01 to $0.02 impact in terms of Chinese tariffs.

I had some discussion with

(technical difficulty)

there's been question as to if we see something go further in terms of the trade war, is there any concern about supply of products coming out of China?

And do you have alternative sourcing, if necessary?

Yes.

It's important for us to remind everyone that we do manufacture our products in the U.S. There are some components that we source that are only available in China.

And we are looking at a number of options in terms of being able to mitigate the impact of tariffs or ensure that we have dual-sourced opportunities.

And so our supply chain management is always very aggressive in terms of ensuring that we have a number of options available to us.

And we're doing the same in the current environment.

All right.

Great.

And then, just one follow-up.

Just strategically, how should we think about the subscription -- the product subscription growth from here for subscriptions that are not attached to a physical appliance.

So whether that's a virtual firewall, et cetera, moving forward.

How should we think of the growth dynamic there versus some of the physical product sales as you talk about service provider and other strategies?

Well, we've talked historically about the nonattached business being at a $274 million run rate as of Q4 of '18, growing at 68% year-over-year.

And so we are -- these are newer markets for us.

We're seeing very nice growth in them.

And Nikesh mentioned launching speedboats that we believe will help us to execute very well in these newer markets where we think we have great products, particularly in the cloud space.

And we talked about the Evident and RedLock combination.

And so we're very excited about the opportunity there.

But obviously, the business of the firewall growth, and the product growth, and our attached subscription growth is extremely important as well.

And we continue to focus there.

And those areas are also growing very nicely for us, which is why we continue to be able to grow at rates above the rate of the market.

Our next question will be from Saket Kalia with Barclays.

First, maybe for you, Nikesh, you talked about some of the early partners on Application Framework.

Can you just zoom out a little bit?

And can we talk about how customers are using Logging Service?

And maybe some of the next couple of milestones that you look forward to that can help drive the app framework opportunity.

Look, I think part of the app framework pieces has always been trying to collect the data once, and use it many times across multiple applications.

Because today, every cybersecurity solution that the customer sees requires some degree of intrusive probes into their infrastructure, whether it's the network or the endpoint or even their cloud security in some cases.

So the notion is, let's collect all the data once, and then, use it multiple times for multiple apps.

Towards that end, for example, our Traps product is probably going to collect close to 100 megabytes of data per user, per month, which I think is probably 15 to 20x higher than any other endpoint product in the market.

So that's what allows the customers to be able to collect their data once so we can just log to their applications against it.

That's why we're going to be able to deploy XDR for them.

And that's the reason why these customers need to have that data collection happen multiple times.

There are some customers who are running 6 to 8 endpoints at the same time because each endpoint is taking a sliver of data.

And the deployment life cycle of that endpoint is anywhere from 3 months to 12 months, depending on the complexity of the customer and the locations of their employee base.

So in that context, we're seeing good progress when we deploy logging servers with Traps, or people use Traps management services in the cloud to be able to manage their endpoints around their enterprise.

We're probably going to be able to leverage the same thing without an incremental sort of endpoint deployment for the same customer with XDR.

We can just offer that as a service on top of the logging service.

Similarly, there are products like Magnifier, which use similar data to be able to deploy the sort of the application of top of data collection from firewall and fusion endpoint.

So we're seeing the evolution of the Application Framework as an integration point across multiple solutions.

We're starting with our own first.

We want to make sure that our stuff works, so there is proof in the pudding.

And for me, the key milestones are, can we get multiple Palo Alto Networks apps to be useful, without deploying multiple sensors into the customers' infrastructure and be able to turn them on extremely rapidly because the speed of deployment is a key component in the future for cybersecurity.

So as long as we believe we're headed down that track I'm excited, as long as we can see other partners coming on and saying, oh this is interesting, we like the fact that you have all the data.

We don't have to go deploy multiple sensors across our customer base or your customer base.

We can just sit on top of the data.

As long as there is an economic model, which allows them to utilize that data and there's customer consent, we're fine letting them use it.

That makes a ton of sense.

Maybe for my follow-up for you, Kathy, just a quick housekeeping question.

Was there anything to note on the other income line, I guess, this quarter and last?

Feels just a little bit higher than what we've seen historically.

Just wondered if you could talk about some drivers there.

Well, there are probably a couple of drivers.

Number one, interest rates have been increasing; and then, number two, we have a higher cash balance, given the convert that we recently did.

Okay.

Got it.

But no other sort of onetime investment gains or anything like that, sort of straight graded...

No.

No.

Nothing like that.

Yes.

Our next question will be from Gregg Moskowitz with Cowen and Company.

First question is for Nikesh or Lee.

How did Traps do this quarter?

And can you perhaps provide an update on integration of Secdo as part of your XDR approach?

Yes.

Traps continues to do well.

We added a lot.

We added a lot of new customers, of course.

As Nikesh mentioned, the new Traps Management Service, which is a cloud-based service, the majority of these new customers are deploying -- using that service, which is great because that ties into logging service and Application Framework and sets us up for some of the futures around things like XDR.

And so, on that topic, we continue to make good progress on the integration of Secdo.

The -- as we had told you before, we believe that EDR is not sufficient, so with the idea of doing detection response based off a single data source is not enough.

We think that the endpoint data needs to be combined with network and cloud data as well.

And so we are actively working on that.

We haven't -- some of the endpoint data.

We're getting more.

We have network data.

We have cloud data.

And then, in parallel to that, we're making good progress in the XDR application.

We're on top of that and use that data.

And we're on track for early calendar 2019 to have that available.

Okay.

That's very helpful.

And then, just for Kathy, as you noted your operating margins were up about 150 basis points year-over-year.

And so it seems that you're absorbing the incremental costs from Evident.io and Secdo quite well.

And I know, of course, that you don't -- you're not providing fiscal '19 guidance.

I'm just wondering, though, if there are any unusually high investments that you're targeting at this time over the balance of the year, whether it be the K2 launch or anything else?

Yes.

We're providing guidance, obviously, one quarter at a time, as you mentioned.

We did reference a $10 million to $15 million investment in M&A in Q2, in our modeling point.

And aside from that, there's really nothing significant for us to report at this time.

Our next question will be from Jonathan Ho from William Blair.

Can you hear me?

Yes.

Fantastic.

So just wanted to start out with the reference that you made to the speedboats.

Can you maybe give us a sense of what this entails?

And maybe contrast that with your traditional approach?

Yes.

Look, what happens when you have very successful large teams filling a large amount of revenue, and you start a new product initiative, typically, some of those efforts get buried across a very large sort of people-functional organization.

So what we've done is we've taken all the people who are focused on some of our newer product areas, put them on the same floor, taken them across functions and effectively created 2 leaders, one on the product side, one on the go-to-market side.

And they have carte blanche to go move as fast as they'd like to move within certain guardrails.

And this has really increased our agility and our speed, both in terms of deployment of products, but also decisions that they need to make on a customer-by-customer basis and from a go-to-market perspective.

And the early results are promising on our cloud security space has really helped us.

For example, the cloud security team is run by Varun Badhwar, who we brought on board as part of the RedLock acquisition.

He's the CEO there.

He's very excited.

He's very motivated to keep driving the product strategy.

And Dean Darwin, who's a member -- a long-standing member of the Palo Alto Networks go-to-market and business team, they're both partnering really well.

Dean brings the capability to be able to deploy that product across our very large sales force, which is globally distributed.

Mark doesn't have to worry about that.

Varun has to worry about continuing to build a market-leading product and going in partnership with Dean, and making sure that some of our best customers sign up for the product.

So that's kind of like the model behind it.

It's working really well so far for one of the product areas.

We're working on carving out the next set of product areas.

So we are almost on to our second.

We'll be able to carve out a team that's kind of focused on GPC and Aperture as our second speedboat and really excited about being able to do that, which will be driven by [Adam] on our product side, and really our CMO.

So just trying to gain speed and agility on the speedboat front.

Got it.

That's helpful.

Just wanted to also follow up on some of the newer developments with AWS, and maybe your early thoughts in terms of what outposts and some of the newer impacts could have on the business.

Well, the good thing is that what AWS and not just AWS, GCP, VMWare and other -- or Azure, all of them are trying to encourage customers to think hard about the cloud and get out of this model of let me control my destiny by having my own data center.

They're trying to convince people that we all need to go to the cloud.

Now as people are going to the cloud, they're realizing that, yes, cloud is a fantastic platform.

It gives you little latency.

Allows you the ability, allows you to go scale globally, very rapidly.

But it's very hard to think about cybersecurity in that context.

There's a whole set of conversation that come up about 5G integrity, how do I move my security password from my existing platforms to the future?

And that's where we think none of these cloud transitions are going to happen in a meaningful way, unless customers are able to think about and secure transition.

So our job is to make sure that the partner with our invoice customers today and help them with the journey -- as they make the cloud journey in transition.

And there's a debate whether people are going to use AWS native security or GCP native security?

Or is there a room for somebody like us?

That answer is, yes, there is.

Because there's no -- there's very few -- never the last answer, but there's very few dedicated, single cloud-only customers out there.

Must customers are either hybrid customers.

Most customers are multi-cloud customers, in which case you need an independent cloud security partner who can help you across these myriad of platforms.

This is very hard for one native cloud provider to produce a multi-cloud hybrid and public cloud environment security provider.

So we believe that it's a huge space.

We believe it's -- behooves both us, and AWS, and GCP, and Azure, the partner in this journey because it's beneficial for them and beneficial for us.

And honestly, we're like, securities of 2% or 2.5% spend across a cloud transition, maybe, 3%.

So they're not going to go we try and compete with us in that 3% to 4% spend.

I know, I went from 2.5% before, but it depends on the customer.

I'd like it to be more, but it depends on the customer.

So we think there is going to be -- there is enough room for a partnership in this space.

Our next question will be from Patrick Colville with Arete.

Can I ask about core next-generation firewall?

What continues to differentiate you guys?

Because you guys are crushing it and doing great job.

And just from your perspective, what continues to differentiate Palo Alto versus the competition to produce these results?

Look, in my 6 months that I've spent talking to customers and traveling around the world trying to understand both why our customers buying us and what's differentiated in our product, I have to say at least a feedback I get from our customers is that there is a very clear differentiation around security.

Palo Alto Networks' firewalls were built with security first in mind.

And that's why you heard us launched a service provider K2 series just now because they balance both the throughput needs of the service provider as well as higher security requirements 5G and IoT.

So we are a security-first sort of firewall, and that resonates with all of our customers.

And it's kind of the right time in the journey because early cloud migrations or early data center migrations were a lot about moving your data there.

Now it's a lot about opening up the Internet.

And the more people started opening up ingresses and egresses to the Internet in a large-scale basis, you open the door for cybersecurity attacks, cyber attacks across your infrastructure.

At that point in time, every CIO, every CISO is concerned about making sure that their environment is protected.

So security is becoming a more and more relevant topic on the agenda of CISO, CEO, CIOs.

And they turn around and say do we have the security or not?

And that's not a price-sensitive conversation, it's a security-sensitive conversation.

And from that perspective, I think, and I can't take credit for this, this is the team here and the prior management did a phenomenal job of making sure we have people around the world.

We have customers.

We have gone ahead and worked with these customers over the years.

Some of the deals coming to fruition now are deals teams have been working on for 12 months, 18 months, and 24 months.

So this is a journey that have been started a while ago, and it's a security-focused journey.

And it is the product that is clearly differentiated in the marketplace.

And we hope, given the more [sensitivity] around security, we'll continue to take market share.

Got it.

Got it.

And can I ask -- and my follow-up, another high-level question like that.

So some investors are skeptical that clients' company can transition to be more of a software company over time because history and technology over the last 30 years shows us that, that can be quite difficult.

Clearly, the numbers you guys are putting out in unattached subscriptions are very healthy with the growth and momentum being very strong.

So the indicators for now are that this transition is happening very effectively.

But what gives you confidence that, that could continue and that you guys can continue pivoting away from product and more towards subs?

Look, I think whilst we look at it from an industry transition perspective because some of us analyze the industry and look at it from afar, if you asked the customer, for them, it is a continuous spectrum.

This feed is a continuous journey, and they want to be able to take their existing partner with them to the journey.

Because security is kind of a thing where your customers have to believe and trust in you that you are going to protect them.

We have many instances, many, many, many instances happen on a daily basis, where the customers -- we understand, they call us, we work with them, we show them how to protect themselves.

We show them how to improve their security postures.

So we build trust and reliability with over 50,000 customers around the world.

And I think as we come out with new products, would a customer rather buy the next-generation product from a small start-up of 40 people?

Or would they rather have the capability of a team that has been working with them for 3 to 5 years, helping the security posture.

We believe the latter.

Look, I am sitting in the pit, working with the team for the last 6 months.

There's 12-hour days, working hard on every product -- every part of the transition.

I'm convinced we can make the transition.

So as far as the skeptical investors, it's for us to know and for them to find out.

By the time they find out, it'll be too late.

Our next question will be from Gabriela Borges with Goldman Sachs.

I was hoping you could characterize for us the level of sophistication in education that you're seeing around cloud security awareness from your customers?

At this stage, how much of it is a push from Palo Alto, where you really need to educate around the virtual firewall and GlobalProtect and Aperture, and some of the cloud products that you have versus customers may be reaching a consensus and realizing that in order to be secure in the cloud they need more Palo Alto products?

Thanks, Gabriela.

That's a brilliant question.

Because when we did the acquisition of RedLock and I looked at what we have it Evident, I realized we have an awareness problem.

Many of the existing customers, AWS, GCP or Azure don't know what they need.

And part of the effort in the last even few weeks and going forward has been getting some of our customers, demonstrate the product to them, and it's about them saying, "Oh, my God, yes.

I do need this." So you're right, there's not a flash realization across the space that we need the security because some of these things are moving from a DevOps team upwards into the enterprise.

So there's a lot of awareness and education that is required and hence, we are stepping up our efforts to do that education, to the partnerships, to create the awareness.

But we also believe, like I said earlier, we are the only players right now with the product and sophistication, and we intend not to lose the sophistication and leadership of this product.

That's helpful.

And the follow-up is not specifically on the 7000 series refresh.

But I do want to ask how you're thinking about the cadence of appliance constructions at a higher level?

If I think back 2017, there are a number of product constructions on the appliance side.

So just maybe some high-level thoughts on how you think about those instructions going forward?

And how much morph will prove into that, if at all.

I'm sorry, could you clarify your question, appliance -- what?

How are you thinking about the cadence of new appliance introduction at a high level?

Yes.

Yes.

Got it.

Thank you.

Look the -- our desire as we build our hardware road maps and overall strategies, our large enterprise customers are sure-shot-ed customers that, in general, they do not want to see hardware technology change too fast because that necessitates a need for them to then go through and do a whole bunch of work to swap out old hardware for new hardware, and things like that.

And on the flip side, of course, we want to stay very up to date on the latest and greatest technology in order to be able to provide the best products.

So we're always balancing between those 2 aspects.

And there's no single answer to it.

It's just always looking for where the big technology inflections are on the hardware side, and then, looking at how we can slide those into a development schedule that makes a lot of sense to both us and our customers.

What you've seen us do over the last couple of years is, obviously, introduce a number of new hardware platforms that have been very well received.

And then, where we need to, we'll continue that process of bringing to market new hardware technologies where we get a lot of bang for the buck and really help our customers.

Our next question will be from Erik Suppiger with JMP Securities.

Two questions.

One, Nikesh, how do you feel your channel is currently prepared for moving into the cloud?

What kind of evolution do you need to see from your channel partners?

And then, secondly, on the service provider front, one of your competitors does a lot of development with the hardware with ASICs.

Is that something you would consider in order to achieve the performance that you need to meet service provider requirements for 5G?

So thanks for the question.

I think, look, the channel -- do you mind going on mute, Erik?

Okay.

Thank you.

We're getting a lot of feedback, so -- there we go.

Perfect.

Thank you.

Eric, from a channel perspective, the channel is not one entity.

Channel is a very large sort of set of partners where we have people who are very cloud-savvy and very cloud-ready and we have people who are going through their own journey of transitioning into the cloud because they've been very hardware-centric.

They come in different shapes and sizes.

We're very excited about the partners who are stepping up and creating the cloud education focus within their own teams to be able as part of the journey.

There are some others who are called BICs.

I want to call it Born-in-the-Cloud.

So they are people who are focused exclusively in the SaaS space and working with us and other players in the SaaS space.

So there's a transition going on in the channel as much as there is a transition going on around customer base.

And the channel is getting ready to be able to provide these capabilities to our customers.

So we see a very, very sort of healthy partnership going forward with the channel, where they're going to end up providing a lot of services to our customers, getting a lot of education and awareness.

The question Gabriela asked about, how do we create the awareness across 50,000-plus customers of the public cloud companies, and get them to see our product?

Can't do it alone with our smaller team on that scale.

We're going to have to leverage a large distribution network, which is in place, which is the service provider network.

So I think that's kind of answer for the first part of your question.

And as it relates to the ASIC and the throughput part, look, we believe in the cadence of these product.

We are going to match the price performance of everybody else out there from a throughput perspective.

And we believe we're going to be industry-leading in security.

In fact, the only ones in the industry who can deliver in security requirements for 5G and IoT.

So we feel very comfortable with the new cadence.

Like I said very early, the sales cycle in SP are long, but as we've announced just today, we're going to be launching effort toward our teams and our go-to-market teams to start approaching some of the largest service providers around the world, working with them to make sure they understand the capabilities of the effectively the next-generation firewalls now, and make sure that they keep us in consideration as they go towards their own journey of going to 5G and IoT.

Our next question will be from Catharine Trebnick with Dougherty.

Did you provide the number of customers you added during the quarter?

That's my first question.

Yes.

We didn't talk about it in the prepared remarks, but we added over 2,500 customers this quarter.

All right.

And any particular service that stood out in driving your subscription services?

Was there one that was stronger than the other during the quarter?

And then, any that underperformed?

Yes.

No, we had nice performance across our subscription portfolio.

And obviously, we're very happy with the growth we saw there.

So no -- none of them underperformed, like Aperture, AutoFocus?

I'm just trying to quantify.

Yes.

No, we will break out -- we break out more details from time to time, but we haven't provided details by product.

So that's how each one grew.

I'd now like to turn the call back over to Nikesh for closing remarks.

Yes.

Well, thank you, operator.

Look, in closing, I'd like to thank all of you for your interest in Palo Alto Networks.

I also would like to thank, once again, our customers, our partners, our employees, for the tremendous amount of effort they put into making sure that we're able to deliver our results.

I've been reading many of your notes, and I know that some of you are still anxious to understand me.

So before I wish you a happy holiday, I wanted to send out this invite to all of you who would like to come meet me.

We're going to -- we're going to try and schedule, over the next 3 weeks, for sell-side analysts to come visit.

If you reach out to Amber in our Investor Relations team, she can schedule it.

That way, hopefully, next time around, when I read your notes, you won't be as anxious about me.

I have enough -- anxious enough about myself.

I don't need you to be more anxious about me.

So with that, thank you, again, for your interest in Palo Alto Networks, and goodbye.

Thank you.

Ladies and gentlemen, this concludes today's teleconference.

You may now disconnect.