Radware Ltd (RDWR) 2017 Q1 法說會逐字稿

Good morning. My name is Scott, and I will be your conference operator today. At this time, I would like to welcome everyone to the Radware Q1 2017 Earnings Conference Call. (Operator Instructions)

Anat Earon-Heilborn, VP Investor Relations, you may begin your conference.

Thank you, Scott. Good morning, everyone, and welcome to Radware's First Quarter 2017 Earnings Conference Call. Joining me today are Roy Zisapel, President and Chief Executive Officer; and Doron Abramovitch, Chief Financial Officer.

A copy of today's press release and financial statements as well as the investor kit for the first quarter are available on the Investor Relations section of our website.

During today's call, we may make projections or other forward-looking statements regarding future events or the future financial performance of the company. We wish to caution you that these statements are just predictions, and we undertake no obligation to update these predictions. Actual events or results may differ materially including, but not limited to, general business conditions and our ability to address changes in our industry, changes in demand for products, the timing and the amount of orders and other risks detailed from time to time in Radware's filings. We refer you to the documents the company files from time to time with the SEC, specifically the company's last Form 20-F filed on April 21, 2016.

Please note that in May, management will participate in the Jefferies Technology Conference in Miami and in the Oppenheimer Israel Conference in Tel Aviv. In June, management will participate in the Jefferies Tech Trek in Tel Aviv and the Citi's Small & Mid Cap Conference in New York.

With that, I will turn the call to Doron Abramovitch.

Thank you, Anat. Good morning, everyone, and thank you for joining us on the call today. We are pleased to report that the positive momentum underlining our business in the second half of 2016 continued into the first quarter of 2017, for which we reported today solid results.

In Q1, we continued to benefit from the very strong growth in our subscription and cloud business. Strong bookings led with book-to-bill ratio that was significantly larger than 1 for the third consecutive quarter and to a strong increase in our total deferred revenue balance. Let me remind you that the total deferred revenues takes into the account the deferred revenues on the balance sheet and in addition, bookings we invoiced, but didn't collect and are therefore not on the balance sheet.

Moving on to discuss our income statement. Q1 revenues were $48.9 million, up 1% from Q1 last year. Looking at the geographic breakdown, revenues from the Americas were $18.3 million, representing 37% of total revenues. Revenues from EMEA were $14.6 million or 30% of the total and revenues from Asia Pacific were $16 million accounting for the remaining 33%.

I will now move to discussing expenses and profit using non-GAAP figures. For a detailed GAAP to non-GAAP reconciliation, please refer to the financial tables accompanying our press release or to the investor kit also on our website.

Non-GAAP gross margin was 82.2% in Q1 2017 compared to 82.7% in Q1 last year. Our operating expenses were $40.7 million compared with $39 million in Q1 2016. The main differences from last year derived from our investment in sales and marketing, the consolidation of Seculert and the stronger Israeli shekel.

Non-GAAP net income in Q1 '17 was $700,000 or $0.02 per share diluted compared with net income of $2.3 million or $0.05 per share diluted in Q1 2016. As we had expected the acquisition of Seculert had a diluted impact of approximately $0.02 on Q1 '17 non-GAAP EPS.

Moving on to our balance sheet and cash flow. As of March 31, 2017, we had approximately $316 million in cash and financial investments. Cash generated from operations was $6.3 million in Q1 compared with $8.8 million in Q1 last year, leaving our operating cash flow for the last 12 months at $36 million. We expect Q2 cash generation to be stronger than in Q1. We are pleased that the transition of the business model has little to no impact on our cash generation and related metrics.

In addition to the stability of operating cash flow, our collection is not affected, and we are able to maintain a low DSO ratio, which was 39 days.

We ended Q1 with approximately $128 million of total deferred revenues, up 30% from the Q1 '16 balance of $98 million. The transition of our business model continues to positively impact our visibility and allowed us to start the next quarter with higher known revenues than we had in previous quarters.

The average duration of the total deferred revenues balance maintained a similar level as in the past several quarters. As of March 2017, the average duration was 1.79 years compared to 1.75 years for March 2016. Therefore, in the coming 12 months, we will recognize as revenues approximately $78 million out of the total balance of $128 million compared with $66 million that we recognized out of the total deferred revenues a year ago.

In line with our capital allocation policy, which includes both acquisitions and share repurchases, we announced today a new share buyback plan. Like our previous plans, this is a 1-year, $40 million plan.

Headcount at the end of March 2017 was 990 employees.

Last, our outlook for the second quarter 2017. We expect revenues to be between $49 million and $51 million. Non-GAAP gross margin is expected to be approximately 82% and non-GAAP operating expenses are expected to be approximately $41 million.

We expect non-GAAP effective tax rate to be 16% and non-GAAP EPS, including the diluted impact of Seculert, to be between $0.02 and $0.04.

I will now turn the call over to Roy.

Thank you, Doron, and good morning, everyone. We are very pleased with our results for the first quarter of 2017 and with the business trends underlying these results. As Doron noted, strong bookings led once again to a significant increase in our total deferred revenue balance and to an increase in the year-over-year growth rates of our total deferred balance to 30% in March 2017 as compared to March 2016.

This increase results primarily from the success of our subscription business, where bookings more than doubled from Q1 last year. Strong market acceptance of our product subscription and cloud offering demonstrates that our customers highly value its added benefits. These benefits include state-of-the-art cloud security offerings, broader and stronger application protection that can address the increasingly complex delivery environment as well as fully managed services that can address the security skills shortage our customers face in the market.

Meeting our customers needs with subscription offering in turn creates a consistent and predictable revenue stream for the company. The deferred revenue balance now represents more than 2.5x our quarterly revenues. This is a record level for this ratio that indicates the positive impact on visibility that this transition in our business model provides.

The first element of our strategy is to focus on the integration of our application delivery and security solutions. Customers are progressively more interested in this integration given the increasingly complex application ecosystem, delivery infrastructure requirements and security threats. These challenges create a growing need for solutions that together perform seamlessly.

For example, in Q1, a customer in the electronic data processing sector decided to displace its incumbent ADC vendor with Radware subsequent to their appreciation of the security integration and automation benefits across our complete solution. The existing and long-standing security customer is opening a new data center with extensive application delivery, security and agility requirements. Although they had already purchased equipment from their existing ADC vendor, they decided to return the equipment back and proceed with a complete Radware architecture. The customer was impressed with the level of integration between application delivery, and application and data center security and with how the various components share information and feed off each other. That, together with superior automation and orchestration capabilities, presented the customer with tremendous value for their next-generation data center.

The second element of our strategy is to continue to innovate new solutions and services. A core element of our innovation focus is our investment, not only in development of new solutions, but in pure research. A couple of weeks ago, our researchers revealed the existence of a malware that permanently destroys unsecured IoT devices. Such permanent denial of service attacks are performed remotely using commands that could ultimately corrupt storage, break connectivity and render the device nonfunctional. We named the malware BrickerBot, and its discovery received much attention with security professional circles in the business and IT trade press and was referenced in notable hacker blogs. In addition, the ICS-CERT, a part of U.S. Department of Homeland Security, issued an alert to provide an early notice of the BrickerBot threat. Such cutting-edge research and discoveries demonstrate our domain expertise and further enhance our position in the cyber security vendor landscape.

On the product side, the most significant new product launch in Q1 was the expansion of our cloud services suite with DDoS protection for application that reside on Amazon Web Services. This new, fully-managed service is designed for organizations that run part of their applications in private cloud data centers and part of them on public cloud, an intrinsically adopted IT architecture. Such organizations don't want to compromise on the level of security for applications residing in the public cloud and require one security solution for the entire infrastructure. Our unique solution automatically protects application wherever they reside, providing best-in-class consistent security policies and a single pane-of-glass.

Our expanded solution offering also allows us to cross-sell additional solutions to our customer base. As example -- an example is the deal we announced last week. An existing customer with a significant installed base of our application delivery and cyber security devices enhanced its relationship with Radware by signing a 3-year multimillion subscription deal for several application delivery and security modules on top of their existing devices. We believe that our sizable customer base, which includes thousands of organizations from verticals such as telecom, financial services, government, technology and others provide significant opportunities to expand our subscription business.

The third element of our strategy is to increase our market footprint for service providers and CDN providers, OEMs and alliances, system integrators and resellers as well as internal resources. In this context, I would like to highlight 2 developments.

The first is that, in early March, Cisco made our DDoS module available on its next-generation firewall, the FTD, which stands for Firepower Threat Defense. The availability is on both the FTD 4100 and 9300 Series. While we have already seen initial sales of Radware DDoS module on Cisco Firewalls that shipped with the older software version, the ASA, the FTD is the focus of the Cisco security sales force going forward in order for them to capture share in the next-generation firewall market. Obviously, we see that as a great opportunity to increase our footprint as a differentiating add-on to the FTD.

The second development relates to our CDN customer base, which include, as we've discussed in the past, some of the world's top CDN providers. As such, we were pleased to announce in mid-February that one of the CDN providers extended its relationship with Radware by signing in late 2016, a 3-year multimillion-dollar deal that includes subscription to our attack mitigation updates as well as maintenance of its hardware device installed base. We view this relationship with leading CDN providers similarly to our OEM relationships, a strong testimonials to our technology leadership.

In summary, we are very pleased with the continued momentum that underlies our business and with our strong opening for 2017.

Bookings in the quarter were strong in absolute terms and in particular, relative to the first quarter in past years, which was typically a less active quarter. This is reflected in a book-to-bill ratio that is larger than 1 and which is historically uncommon for us in Q1. Coupled with the positive business environment and early successes we have seen so far in Q2, we are confident that we are on track to execute on our plan for 2017.

We continue to develop our solution offering and, at the same time, benefit from an increasingly mature and experienced cloud and subscription business operations. The superiority of our technologies repeatedly proven by our ability to detect and mitigate attacks that our competition does not. We, therefore, continue to invest in expanding our access to opportunities to demonstrate our technology by implementing marketing programs and fine-tuning our go-to-market initiatives. We are excited about the multiple opportunities ahead of us and believe we're in strong position to leverage them for long-term growth and profitability.

I will now open the call for Q&A.

(Operator Instructions) Your first question comes from the line of Mark Kelleher with D.A. Davidson.

I was wondering if there's a way you could maybe give some insight into the security contribution, it's been very strong. How is that versus your ADC business? Can you give us any view on that?

Yes. As we've discussed in previous quarters that -- we are not looking on these as 2 separate business lines, and we are -- it's not the way we're interacting with our customers or developing our portfolio, we're really looking on a holistic offer for application security and delivery, for the next-generation data centers. So we're really looking now on a complete architecture with links between the modules, signaling, et cetera. So we're not breaking our view that way. However, if I'm looking across all the products that we sell in Radware, not specifically splitting it to ADC and security per se, in booking, we've seen very strong growth in Q1 across the whole product lines we have.

Okay. And how about Cisco, were they meaningful in the quarter?

They're not yet meaningful from revenue contribution, but they're definitely ramping up. As I've mentioned, I think, in March, we are now released on all the next-gen firewall business and I think it became -- if you visited Cisco Live in Europe or the Far East this past quarter, I think that this release, this next-generation firewall, became the centerpiece of their security strategy. And as a result, we are seeing a very strong and increasing activity. So we believe there's great potential for the Cisco relationship.

Your next question comes from the line of Alex Henderson with Needham & Company.

So I didn't catch a headcount number. I was wondering if you could at least give us that data point?

It's 990 employees there.

And so you're talking about this adjusted deferred number, and I don't see an actual calculation for it on your website. Do you have that actual data for the year-over-year number and the quarter-to-quarter number for what the adjusted deferred is?

Yes. So this quarter, it's $128 million of the deferred. In Q1 '16, it was $98 million, and this is a 30% growth that I have mentioned. Last quarter, Q4 '16 was...

That's the same as what's on the balance sheet. I thought you guys did an adjustment to it.

No, no way, Alex. On the balance sheet, it's less. You can see there are 2 different numbers. The balance sheet right now represent approximately $90 million in Q1 and $80 million last year. So it's still growing. But the number that we are referring and it's part of our investor kit, it's already on the site, you will find the $128 million, which is the total deferred revenues...

Okay. I'll go back and take a look at it. I must have misread it when I did it. Can you talk a little bit about the implication and the impact of the F5 product launches that happened in the back half of the year and now have a full quarter of impact in the March quarter? Was that an impact? Did that cause any of the decline in the U.S. results, particularly given your U.S. results were more biased to cloud and you did well on the cloud piece. And how do you -- how should we think about that relevance? And they also announced that DDoS protector-like product over the course of the quarter. Can you talk a little bit about your comparative on that?

Okay. So we didn't see any impact from the F5 new platform releases. We believe we are very well positioned versus them, and we didn't see competitive influence on us at least from the -- on the first quarter. You mentioned also the U.S. business and the decline in revenues. As you have mentioned, the U.S. is much more geared into cloud and cloud services and security, and I would not read anything into the revenue trend. Bookings was extremely strong in the Americas, and it's actually a big engine behind the growth of our total deferred and cloud subscription business, which was very good in that business. And the last point you have mentioned is about F5 launching a DDoS product. It's -- as far as we can tell, again, we don't have all the details. But from what we know and understand, it's a reworked version of the same Big-IP, packaged in a more, I would say, customer-friendly manner and marketed as a DDoS appliance. But again, going back to the core differentiation, we have a huge advantage in the way we detect attack based on our algorithmic behavioral analysis. We have a very significant advantage in the way we mitigate attacks because our algorithms are self-generating, the fingerprints to block based on that, that's unique in the whole industry, and we have a complete set of escalating automatically challenges. Again, unique in the industry. And last, but not least, there's a full degree of automation on top of our solution that's also unique. So I think our gaps in the security with the signaling, with the breadths of detection, with the strength of mitigation and above all, the use of real math algorithms, not ratios, not signatures, mathematical algorithms that are state-of-the-art that proves day in and day out that we are superior. And as I've mentioned, simply detect attacks that others don't.

Okay, and one other question. If you were to look at just the ADC market, what would you say the year-over-year change in that business and that market as a whole? Was -- is it now clearly a declining market? Or is it still flat? What would you -- how would you parameterize that?

I think if you look overall, including cloud applications that may be done by AWS and et cetera, I think it's still a growing market. If you look on ADC appliance business, I think it's maybe flattish. But if you look on the segments we are targeting now, which are the ADC -- the secured ADC area that is in conjunction with security, I think that's a growing market.

So if I were to eliminate the load balancing and other ADC applications that are built into AWS and Microsoft Azure, is the distinction you're giving between that and client, is that correct way to look at it?

So, I think total market growing, appliance minus Azure and AWS may be single-digit or flat. And secure ADC, which is within that larger more flattish market, I think it's going strong.

Your next question comes from the line of Michael Kim with Imperial Capital.

Could you talk a little about the integration -- early integration of Seculert, how you're seeing that -- those technologies, data analytics and machine learning added to your capabilities, and when we might be able to see either a distinct add-on module or how you might see that strength in the value proposition for the overall solution?

Okay. So we believe Seculert will add another layer of detection and mitigation to our capabilities by providing, as you've mentioned, cloud-based big data machine-learning layer on top of our solutions. We are in development phase. I believe we were going to see the first fruits of that early next year, but we'd definitely think that will take our solution to the next level and open another dimension for data center security.

And just in terms of financials, I'm not sure if I caught it, but what is the expectation for dilution in second quarter? And is it your -- do you continue to see that as accretive next year?

We talked about this last quarter, and we mentioned that the first one and the second one will be approximately $0.02 dilutive each quarter. We believe that 2018 will be accretive. So basically, we expect the next quarter, the guidance that we gave, which is -- included the Seculert impact, is we consider that $0.02 per share dilutive from the Seculert activities.

Got it. And then lastly, I think about a year ago, you talked about more than 10% of bookings coming from subscription sales, cloud and product subscriptions. Has that number move to sort of 15% or 20%? Can you provide an update on the contribution from subscriptions?

So without putting a specific figure, we've achieved our goal already as we've placed it. And now, of course, we're looking on higher goals. Not comfortable yet sharing the exact number, but as you understand, it's growing very strongly, and we achieved our previous mark.

Your next question comes from the line of Joseph Wolf with Barclays.

It's Erica for Joseph. Just to follow up a little bit on the Americas business. I know Alex asked a little bit earlier, but I guess just because that was at sort of the lowest level we've seen in over the last couple of years and kind of given that transition at the services model, I guess we would have thought that there would be maybe less volatility around that. I know you mentioned that bookings were very strong. Does that mean that we should infer that the first quarter is just kind of a little bit of a hiccup there? Can you just give any more color about that?

Yes. So I think from a revenue recognition, it's a hiccup. From the business, we're seeing continued strength there. And while the transition there to subscription and to cloud securities, the highest impacts the revenues. But we feel very, very good on the performance of the Americas in Q1.

Your next question comes from the line of Catharine Trebnick with Dougherty.

Mine is on virtual ADCs and SSLi. Have you -- what is your thoughts on how well the virtual ADC traction is going? Are you seeing an uplift in that in your product line? And then the second part question is, there's been a lot of introductory with stand-alone SSL platforms and I haven't heard you guys really talk about -- really working in that area, and could use some color on that.

Yes. So we continue to see a move to virtual ADCs, whether they are sold as software only or multiple instances on our appliances. We're seeing that very well. And the other point that you've mentioned, we call this area SSL inspect, Catharine. I think you are using a (inaudible) terminology. And SSL inspects and is available on our outlook product line. It's actually one of the secure applications we're pushing. We have a great reference and I think key patents in this area, where definitely it's one of our target areas. I think one of the top worldwide banks in the world is actually using us across all their data centers. I think it's the largest SSL inspection implementation in the world. So that's definitely a very active market for us.

And then just to follow on, could you quantify very good on your virtual ADC? I mean, is it -- any percentage of sales? Does it seem to be more popular? You've seen more traction in that now than a year ago. Just a little bit more detail.

I don't have the break for the revenue split. However, we started with vADCs, or virtual ADCs, I think, almost 5 years ago, and we see continued increase in the number of instances people deploy it. Those, as I mentioned, can be either a stand-alone software instances or sharing in the appliances. And if you track our platforms and our capabilities, we constantly push this number higher in response to customer demand for that. So it's definitely something people are doing more and more, and they're moving to instance per application or vADC per app versus the previous situation, the legacy ADC that they used 1 device in sharing it across application.

Okay. And I'll let you go after this one, Roy. The last one is, any price difference between a platform and a virtual instance because you do need to put them in front of, like you said, per application. So it seems to me, maybe the revenue for a platform for this might be the same. But could you clarify that or give me a more clarity on that?

Okay. So a software-only virtual ADC is selling for the same, I would say, price. As you scale with the number of instances, you are getting some break. But all in all, it's the same price. On the platform, there's initial price for the platform, but the cost per instance is then significantly lower obviously. I would say the breakeven point would sit around somewhere between 5 to 10 instances. Above that, our platform with multiple instances will become more cost-effective than separates software instances.

Your next question comes from the line of Ittai Kidron with Oppenheimer.

Doron, I just wanted to make sure I understand the very long-lasting weakness in enterprise. Is that just a reflection of you're selling more to managed service providers that use your cloud services? Or is there something going on there? It's like 7 quarters in a row for year-over-year decline.

Yes, maybe I'll take it, Ittai. So we are focused obviously more on the cloud solutions and so on. I think the enterprise is the one suffering most from this trend. Carriers and cloud providers continue to buy equipment or products. And as a result, I don't think you're seeing the same kind of trend of delaying or deferring revenues with the enterprise. That's where most of the subscription and cloud subscription specifically are going to. And I think that's the core thing you're seeing there. So while -- as we said, our bookings is growing and growing strongly, the revenue recognition on the carrier is almost intact versus what we used to do in past years, while enterprise is really where the business transition is happening.

Got it. And can you talk about -- going back to the Cisco situation, I mean, if I'm not mistaken, already last summer, around the August, September time frame, they started selling your solutions effectively in the market, and this is after you've been engaged with them for more than a year ago before that. I'm just wondering why does it take that long to ramp that relationship. And when do you think it will be a more important part of your business?

Okay. So I tried to make it -- to bring more color to it in my prepared remarks. So in the summer of last year, they've released -- starting even in Q1 and then in the summer, they released the ASA, the legacy firewall software on top of the new hardware platforms with our DDoS module. So in that point, it was not yet the next-generation Firewall. They released the next-generation firewall, I think, in the second half, the December time frame and added some to that in the March time frame. And now, in this March release, they made also the DDoS available on the next-gen firewall. So the next-gen firewall is very new in the market from Cisco. Why does it take so much time to release? I think you need to refer that question to Cisco and their product strategy, what to release when. I think they started with the hardware refresh, and then they're now to have a full-blown next-gen firewall product. And as of March 10, I think we are now available on all the relevant OEM platforms that we were designed for. And I think the real action starts now. I believe with regular sales cycle, 6 to 9 months, that's where we need to see the ramp up. However, already we're seeing a very strong and growing every quarter level of activity. So we remain very, very optimistic, and that's also the signals we are getting from Cisco about the potential here.

Got it, helpful. And then lastly, on your billings, especially the uncollected one. I guess, was there anything -- was there any one customer that had a very big contribution in there? Is there like a 10% contribution in there to kind of make this number move up quite substantially? Or it was widely distributed? How do I think about that?

In the total deferred balance, I don't think we have a single customer that's 10%, No.

I'm talking about the uncollected.

No, the...

No, we don't. We don't have, Ittai.

That was our final question for today. I will turn the call back over to the presenters.

Thank you very much for attending and have a great day.

This concludes today's conference call. You may now disconnect.