SailPoint Inc (SAIL) 2018 Q3 法說會逐字稿

Greetings, and welcome to the SailPoint Technologies Third Quarter 2018 Conference Call. (Operator Instructions) As a reminder, this conference is being recorded.

It's now my pleasure to introduce Josh Harding, Vice President of Financial Planning, Analysis and Investor Relations. Josh, please go ahead.

Good afternoon, and thank you for joining us today to discuss SailPoint's third quarter financial results. Joining me today are SailPoint's CEO and Co-founder, Mark McClain; and SailPoint's Chief Financial Officer, Cam McMartin.

Please note that today's call will include forward-looking statements and because these statements are based on the company's current intent, expectations and projections, they are not guarantees of future performance and a variety of factors could cause actual results to differ materially. Since this call will include references to non-GAAP results, which exclude special items, please reference this afternoon's press release in the Investor section of sailpoint.com for further information regarding forward-looking statements and reconciliations of non-GAAP results to GAAP results.

And now I'd like to turn the call over to Mark McClain.

Thanks, Josh, and welcome to everyone joining our Q3 earnings call. I'm pleased to report that the third quarter of 2018 was another strong quarter. In fact, our Q3 2018 results were well ahead of our guidance with total revenue growing 52% year-over-year to $66.4 million. And we delivered non-GAAP operating income of $11.6 million.

We believe our results are due to a continuous demand for identity governance, our market leadership, and our commitment to delivering innovative best-in-class solutions to help customers secure digital identities for all users, all applications and all data. In fact, SailPoint has consistently been positioned as a leader by the major industry analyst firms. We've been a leader in every identity governance focus in Gartner Magic Quadrant since their first report in 2011. We are also named the overall market leader in both KuppingerCole's recent Leadership Compass on identity governance and administration as well as the European Analyst Firm's Leadership Compass on cloud-based identity governance. And most recently, SailPoint announced that we were named the clear leader in Forrester's Wave for Identity Management and Governance. SailPoint and our open identity platform received the highest score across all 3 evaluation categories: strategy, current offering and market presence.

We believe our positioning in these analyst reports validates our innovative platform, our strong execution and our comprehensive delivery strategy that provides customers with the freedom of choice to consume our solutions in any way they want to. And importantly, we continue to invest in our platform and recently delivered updated versions of both IdentityIQ, targeted to large-scale enterprises; and IdentityNow, which we target at mid-market enterprises. In August, we shipped IdentityIQ 7.3 to address the growing reality of the digital identities managed by an organization are no longer limited to humans. In fact, enterprises are increasingly relying on nonhuman identities such as software bots to drive business efficiencies and to keep pace with digital transformation.

IdentityIQ now allows organizations to govern bots and their access to all our enterprise applications and data just as they would with the access of a human identity. IdentityIQ 7.3 also deepens the functionality for governing access to mission-critical Amazon Web Services and SAP environments, ensuring they are secured in the same way as the rest of an organization's infrastructure.

Finally, as part of 7.3, we also released our new IdentityIQ Accelerator Pack, which helps organizations onboard the thousands of applications needed and requested by the users more efficiently and rapidly. Through preconfigured options and best-practice use cases, enterprises can now onboard new applications and configure governance processes in a matter of hours versus weeks. As I mentioned, IdentityIQ is targeted for large-scale enterprises. These organizations have incredibly complex hybrid IT infrastructures and need a highly flexible identity governance solution that can deliver the level of scale and performance necessary to manage millions of identities and tens of thousands of applications.

In addition to the recent analyst validation noted earlier, we continue to help the world's largest companies achieve success with IdentityIQ, which is one reason hundreds of enterprises have migrated away from outdated legacy tools from CA, IBM and Oracle. For example, in Q3, we closed a sizable net new IdentityIQ customer who wanted to replace Oracle Identity Manager because of its lack of functionality and nonintuitive user interface. This credit reporting agency decided it was time to migrate to a modern solution and will now use IdentityIQ to govern the identities of its 17,000 employees. Federal governments are also turning to IdentityIQ based on its scalability and performance. And we are building on years of success in this vertical. This is especially true with U.S. federal agencies, the need to address the Department of Homeland Security's Continuous Diagnostics and Mitigation, or CDM, initiative to help combat and prevent the risks associated with cybersecurity.

In the third quarter, adoption of our Identity platform by U.S. federal agencies was stronger than we had expected, including both net new customers and expanding our footprint with existing agencies. For example, one of the executive departments purchased IdentityIQ in 2017 through the CDM initiative to replace a legacy tool being used for user access certifications. Last quarter, this agency added SailPoint's life cycle management capabilities to its program in order to provision and deprovision access for 150,000 users.

SailPoint remains focused on the enterprise market. But while large enterprises are heavily weighted toward replacing outdated tools, most mid-market enterprises are new adopters of identity governance solutions. Companies in this segment face similar challenges around security, compliance and IT automation. However, they typically don't have a large dedicated identity team or extensive identity governance knowledge. We continue to see success in the mid-market with IdentityNow because the SaaS delivery model addresses these organizations' lack of identity experience and resources while still providing the enterprise-grade identity governance they need.

In October, we announced the latest enhancements to IdentityNow to make identity governance even more accessible to mid-market enterprises. That point was validated by FTD, one of the largest online floral delivery companies, in our recent IdentityNow press release, where FTD reported they had achieved quick wins on the audit compliance front and now have a comprehensive identity program in place with only 1 dedicated person on staff.

Some of the new features in IdentityNow include the Dynamic Discovery Engine, which allows users to easily and quickly create new policies, access reviews, dashboards and reporting by identifying and editing existing ones. It also includes a streamlined separation-of-duty policy management that drastically simplifies and speeds the process of investigating access, quickly uncovering any access-related conflicts of interest and creating automated policies that ensure compliance.

We believe IdentityNow is the most comprehensive true SaaS identity governance platform available today, which is what mid-market organizations tell us they need. For example, in Q3 a midsized retail chain purchased the full suite of IdentityNow. The company was new to identity governance and had previously addressed their identity-related needs manually, which was costly, time-consuming and frustrating to their corporate staff. With IdentityNow, they'll quickly be able to automate the entire user life cycle in order to securely and confidently enable their employees.

In summary, SailPoint is the recognized leader in identity governance innovation. We continue to invest in our best-in-class solutions, and their being selected as the identity platform of choice for enterprises of all sizes that want to improve their overall security, compliance and IT efficiency. Now let me hand it over to Cam.

Thank you, Mark, and thank you to everyone on the line for joining us today.

SailPoint's third quarter financial results beat our guidance on both the top and bottom lines with strong revenue growth, positive non-GAAP operating income and meaningful cash flow from operations.

Total revenue was $66.4 million, an increase of 52% over Q3 of 2017. License revenue increased 66% year-over-year to $28.1 million and was well ahead of our expectations. This result was driven by exceptionally strong federal performance coupled with a balanced contribution from other verticals. As we mentioned [it] on our Q2 earnings call, we expected our federal business to be spread across Q3 and Q4, in line with recent historical patterns. However, the large majority of our expected federal business closed in the third quarter of this year.

Subscription revenue increased 54% year-over-year to $28.5 million. This was driven by a combination of healthy SaaS growth and strong IdentityIQ maintenance renewals -- renewal rates that remain above 95%. In addition, we want to note that Q3 subscription revenue benefited from approximately $700,000 in nonrecurring catch-ups.

Services and other revenue was $9.8 million, up 22% compared to Q3 of 2017, and was slightly ahead of our expectations. On a geographic basis, the United States contributed 69% of revenue in Q3 and the rest of world made up the remaining 31%. This compares to 75% in Q3 of 2017 and 25% for rest of world.

We continue to be pleased with our performance on a global basis. The quarter's strong results highlight the investments we've made over recent years in several new markets. With that said, our international business in the quarter benefited from several large deals and from an increasing revenue contribution from our SaaS business. Given this and the fact that our international business is not still at scale, we believe it is best to assess our international revenue growth on a multi-quarter basis, as we've noted before.

As I transition to the remainder of the income statement, I want to note upfront that unless otherwise stated, all references to expenses, margins and operating results are on a non-GAAP basis and are reconciled to our GAAP results in an earnings release that was just published before this call.

In Q3, license gross margin was 99%. Subscription gross margin was 83%, an increase from 79% in the third quarter of 2017 due to improving scale of our SaaS business and increasing maintenance support efficiency. Within our service business, gross margin was approximately 26%, in line with the third quarter of last year. On a combined basis, total gross margin for the quarter was 82% compared with 77% in Q3 of 2017.

Moving to operating expenses, we continued to make investments throughout the business in order to drive top line growth, deliver product innovation and strengthen our leadership position. Total operating expenses for the quarter were $42.5 million compared with $30.8 million in Q3 of 2017.

Overall, our operating income was $11.6 million in Q3, resulting in an 18% operating margin for the quarter, which benefited from the license outperformance we referenced earlier and is well ahead of our prior guidance. This compares with an operating margin of 6% in the third quarter of 2017.

Net income was $11.2 million for the third quarter of 2018 or $0.12 per fully diluted common share compared to a net loss of $1.1 million or a loss of $0.02 per basic and diluted share for the third quarter of 2017. Adjusted EBITDA was $11.8 million in the third quarter of 2018 compared with $3.4 million in the third quarter of 2017. As of September 30, 2018, cash and cash equivalents were $83.4 million.

During the third quarter of 2018, we generated cash flow from operations of $3.8 million compared to cash use in operations of $200,000 in the third quarter of 2017. In the third quarter, we added 69 employees and ended at 936 employees, a 22% increase over the third quarter of 2017.

Before we turn to our Q4 and full year 2018 guidance, I'd like to update you on our adoption of ASC 606, which we plan to implement on a modified retrospective basis. SailPoint is in a unique situation where we're required to report our fiscal 2018 results and issue our 10-K under 606. However, in addition to 606 figures, we plan to present 2018 quarterly figures both on a 605 and 606 basis for comparability. We will continue to assess any impact from 606 and plan to update you when we report Q4 results.

Moving to guidance. For the fourth quarter of 2018, we expect total revenue of $70 million to $71.5 million. We expect the non-GAAP operating income in the range of $8.5 million to $10 million and a non-GAAP income per diluted share of $0.08 to $0.09. This assumes cash taxes of $800,000 and 91.5 million diluted shares outstanding.

For the full year of 2018, we are raising our guidance and now expect total revenue in the range of $240.7 million to $242.2 million. We now expect our non-GAAP operating income to be in the range of $27.8 million to $29.3 million and a non-GAAP net income per diluted share of $0.25 to $0.26. This assumes cash taxes of $1.5 million and 90.5 million diluted shares outstanding.

Let me now provide some additional color on our guidance. We continue to see solid momentum in the business and are raising our full year revenue and profit targets. As I noted earlier, our third quarter license revenue was positively impacted by greater-than-expected Q3 deal closures within the federal vertical. These movements are reflected on our Q4 guidance, which assumes license revenue of $32 million to $33 million in the fourth quarter.

When you look at Q3 and Q4 license revenue in combination, our guidance for the second half of the year implies greater license revenue than we expected when we guided in August and strong growth for the full year. We also expect subscription revenue to increase sequentially by approximately $500,000. With the continued growth in the subscription line, we are on track to exit fiscal 2018 with the majority of our product revenue coming from recurring sources.

When looking at year-over-year comparisons for the fourth quarter, in addition to the shift in timing of federal deal closures, it is important to remember that we recognized approximately $4 million of license revenue and $1 million of nonrecurring subscription revenue in the fourth quarter of 2017 that came from contracts signed prior to that period.

On the OpEx front, we continue to manage the business to balance growth with profitability and positive cash flow, and we are meaningfully increasing our operating profit guidance for the full year.

Finally, I would like to note one item specific to Q4 OpEx. We now expect to recognize approximately $2 million in onetime facilities expense related to our new Austin facility, which we had previously expected to capitalize and depreciate over an extended period of time. This change is reflected in our Q4 operating income and EPS guidance.

In closing, we are pleased with our performance. We continue to believe we have an opportunity to drive strong top line growth for many years while continuing to deliver non-GAAP operating income and positive free cash flow.

With that, we'll now open up the call for Q&A. Operator?

(Operator Instructions) Our first question is coming from Walter Pritchard from Citi.

It's actually Jeremy on for Walter. I have 2 questions. First, I just want to dig into the federal vertical a bit. I guess, can you maybe talk about what drove strength there? Are there specific programs where you're seeing a big uplift from like CDM? And then, what would you attribute the earlier-than-anticipated closure of pipelines to?

Thanks, Jeremy, this is Cam. Appreciate the question. Yes, so the strength in the business was -- as we highlighted in the prepared remarks, was nicely beyond what we had anticipated for Q3, but overall for the second half the year, really -- our expectation continues to be really fundamentally unchanged for the federal vertical for the second half of the year. As we've highlighted for you previously, the federal vertical in total, along with state and local and education, is low double digits as a percent of our total typical business mix. And again, the second half of the year for us looks like it's going to be stronger than that overall for 2018, really driven by I think a continuation of heightened awareness and attention in the federal government around breach risk. And as we've highlighted in prior calls, we won the CDM program several years ago. We've delivered now to many of the federal government agencies on the civilian side. Both department and agency business has been strong for the last several years, and Q3 really represented a continuation of that trend. But as we've highlighted, more concentrated in Q3. I think we attribute that fundamentally to an awareness of urgency coming from those agencies and departments that they need to accelerate their progress and in looking at where they were relative to the CDM goal timelines, they felt like that purchasing in Q3 was the right accelerated decision. And so again, last year, what I think I had commented in the Q2 call was, we were expecting a more balanced mix between Q3 and Q4. But it pulled all into Q3 -- or not all, but largely into Q3 as a result of this I think heightened awareness and urgency on the buying group.

Okay, got it. That's helpful. And then on the Q4 revenue guide, license came down by roughly $5.5 million at the midpoint versus the prior implied guide. Granted, full year total revenue did go up by about $7 million, but should we think of the $5.5 million as sort of the pull-forward into Q3 from Fed? And then should we anticipate any further revenue deferrals or flush in Q4?

Well, so a couple of comments. Yes, largely what the adjustment in Q4 from a guide perspective is reflects the federal acceleration out of Q4 into Q3. And that's essentially the move that you're seeing. Again, we had expected in the way we had guided Q3 previously, back in the summer, that we would see a -- if you will, a balance or a split between Q3 and Q4, and we saw -- what we really saw was a concentration in Q3. Again, we will have federal contribution in Q4, I want to be clear on that, as we look at the mix of business that we're working to close for the quarter. But we're seeing a bigger concentration and -- in Q3 of this year and different from prior trend in terms of that business mix split. So we have guided in a way that we think reflects what the Q4 performance will be reflecting that $6 million-ish pull forward into Q3 for federal. Overall, what you can see is that the business for the full year on a license basis is going up, right? At the end of the day, we have increased our total license business several million dollars for the second half of the year. That's reflected in the way we have guided Q4 overall. And as we look at the business for Q4, we think we have properly reflected the overall federal contribution that we expect for the second half of the year in the way we've guided. What I can remind you of and we highlighted in the prepared remarks is, last year we saw, as the year -- as the quarter closed, a bit of budget flush acceleration in the buying behavior, as we told you last year in the results of the fourth quarter, was we saw buying behavior accelerate. We're not reflecting any of that type of activity in our guidance at this point because it was atypically high for us last year, it moved to the high end of our typical close rate range in the way Q4 of '17 performed and we have prepared our guidance for Q4 of '18 philosophically consistent with what -- how we guided quarters during calendar year '18. So I think that's important. So -- but again, it's an uplift of a couple of million dollars in the way we've guided second half license revenue for the full second half of the year, but effectively, largely concentrated in Q4 based upon the way the pull-push worked.

Our next question is coming from Matt Hedberg from RBC Capital Markets.

I'm getting a lot of questions, obviously, on the Q4 guide. I think sort of mid-single digits. It seems to be all timing-related to me. I guess, Cam, is the right way to think about this, given the federal deals that pulled in, should we normalize by backing out the $5 million out of Q4 of last year? And then really looking at the second half of '18 versus the second half of '17, that implies close to, I think, 29% growth for the second half of the year. Is that kind of the right way to think about normalized growth for you guys?

It is, Matt. I think fundamentally, as you look at it, there are a number of moving parts in all of this. As we -- in terms of the way we -- or reflected our results for last year for Q4 of '17, we talked about this $4 million of license revenue in the '17 period Q4, $4 million coming into that quarter that's not expected. So you need -- as you think about your year-over-year growth rates, remember to take that into account as well as $1 million of nonrecurring subscription revenue falling into Q4 of last year. Obviously, I highlighted in the prior question that we also saw kind of an exceptionally high Q4 of '17 close rate percentage that we attribute to budget flush. And then, for this year, the way we're looking at it, Matt, is it's about $6 million of total business that moved into Q3 out of Q4 and so you can normalize your growth rates that way. And finally, to your last point, yes, I think the way you should think about this in looking at what the overall performance of the business is, is to look at it on a full 2-half, second-half basis. And yes, that gives you a healthy mid- to upper-20s growth rate overall, which obviously we're very pleased with in terms of the strength of our overall license business. We continue, I think, Matt, to see good performance across the vertical segments. We've talked today a lot about federal so far, but in addition, the rest of the verticals all contributed at a pretty typical fashion. There are always ups and downs in a particular vertical for the quarter, but our historically strong financial services business was good in the quarter. Other verticals were strong as well. In addition, we saw a good contribution and, on the license side, across the globe as well. So as I look at the underlying strength of the business, I am pleased with the overall performance of the business, taking into account that there's a bit of anomalous activity in Q3 of this year just based upon what we felt like, in the buying activity that we saw late in Q3, was an increased urgency on the behalf of the federal buyer to get this product in their hands so they could get underway for deployments.

Super helpful. That's great. And then for Mark, in your prepared remarks, you talked about the Accelerator Pack. And we've been hearing a lot about that as well. Seems like a really interesting way to get customers live quicker. Can you talk about some of the adoption that you're seeing there? The -- what sort of customers are taking advantage of that? And is there a way to kind of think about the monetary impact from the Accelerator Pack?

So yes, Matt, let me explain it in the 2 different thoughts there. One is kind of the impact on the rollout, because a lot of our focus here was to accelerate our customers' ability to get value at a faster pace. I mean, the truth is, in these very large complex enterprises, sometimes getting these apps onboarded is tricky because of the nature of the application. And sometimes it was true that we required for technical expertise than we wanted. And so what the Accelerator Pack does is basically help a business analyst answer a few simple questions that allow them to quickly roll that next app on board. And literally cut -- kind of on the -- particularly like an order of magnitude, like from weeks or even a month or 2 to days or occasionally hours. And so I think our goal there is to really help our customers, who are already committed and in the process of rolling out, to roll out much faster. So that was kind of the thrust of it. Now that said, obviously we're positioning it in pretty much all of our new business, particularly to those large complex enterprises because we know they'll get a good advantage from that. I'll probably flip back to Cam. I don't think we would say that's going to noticeably show up in the financial results because it's a nice little add-on to the business, it's not like a significant financial mover for us.

Yes, Matt, so -- this is Cam. Just to follow on, a couple of comments I'd make. One, first of all, I think importantly, and you and I have talked about this out-of-band from this call. The Accelerator Pack I think is an important addition to the overall solution set we can deliver to our vendor -- to our customers, excuse me, because it represents an accumulation of all the knowledge of now having installed in literally hundreds of large enterprises across the globe across many verticals. And so what it does is it takes all of the deployment knowledge, all of the architecture knowledge, all the vertical industry knowledge and brings it into a new solution that a customer can use to help accelerate rollout of the application across their internal environment. From a financial perspective, the way I think about it is much like, you hear us talk -- spoken previously about PAM module for instance or service pack integration modules, all kinds of things like that. So it won't be a large contributor overall to revenue, it will be a positive contributor. What we think more importantly is, it will accelerate the customer's ability to get real value from the solution and therefore, as you well know, because we are a land-and-expand business model, that as we don't sell the entire enterprise up front, it gives us a chance more readily to capture the next wave of buying from that customer because they'll be more readily able to address the first phase of implementation and therefore that second phase will come more quickly, is our expectation.

Our next question today is coming from Rob Owens from KeyBanc Capital Markets.

If we look at the CDM program, it actually seems like December and March quarters could actually see kind of reasonable spend. So I guess it begs a couple of questions relative to your results. Number one, why do you think that your segment was accelerated maybe relative to the rest of the market? And number two, if this moves from directive to law, where do you think the opportunity is relative to some of that government spend?

Yes, so again -- first, Rob, good to talk to you. Thanks for the question. I'd comment that our market read was that the federal buyer was, as a result of the progress they've been making along other implementation cycles of our compliance manager product, that some agencies wanted to go ahead and buy compliance manager through the CDM program, others began buying life cycle manager. Again, we -- our read of the market and our customers is that they are more urgently addressing the -- what they saw to be their identity governance requirement in order that they have better control over who has access to what applications and they can manage that life cycle more effectively than they can today. And we saw that across many different departments and agencies in the way buying played out in Q3. We do believe -- to address what I believe was your second question or portion of your question, we do believe that there is additional buying opportunity in front of us. We have not fully addressed this segment, and expect it will see business going forward, the timing of which is always a little difficult to project for you. As we think in the first half of the year, we -- as I mentioned earlier to a prior question, we do have business in our pipeline for Q4 that we would expect to close. We did -- as we looked at the totality of performance in Q3 and the expectation for Q4, what I would tell you is that overall, our belief is that the federal government business contribution will be in line with our expectations that underpinned our guidance back in the summertime for the second half of the year. Across '19, we think there's additional opportunity, but we're watching and work with our partners in the federal government to make sure that we're supporting the rollout of all the agencies that have bought today knowing that we haven't fully addressed that segment and we expect there to be future buying behavior there.

The other part of Rob's question -- yes, Rob, I was just amplifying, I think the other part you asked about was kind of moving from guidance into law?

Yes, directive to law. Yes.

Yes, Rob, I don't know that we could speculate on exactly the impact that kind of thing might have. I think we're watching a lot of things in the legislative realm, everything from how GDPR kind of snuck across the pond this way and showed up in California and probably will show up in other states and maybe show up federally at some point. That's a factor we're watching. We're certainly watching, like you said, the directive around -- again, in our minds, the Fed response was largely because of the OPM breach way back, whenever that was now, 3, 4 years ago. And interestingly enough, although the federal government doesn't always lead the commercial market in technology, in security, they kind of do in some respects. And so I think to the extent that the federal government starts to move more aggressively on some of these things, we would anticipate that would have a generally positive impact for us not only in the Fed, but also in commercial. But again, I certainly couldn't try to speculate on that, on some kind of percentage impact there.

Okay, great. And to ask my second leading question then, I guess. Relative to the federal surprise, was it all timing-related or was it -- some of it scale-related as well?

Largely timing-related, Rob. I think we feel like, as we've looked at both the contribution that is reflected in the Q3 results as well as our expected Q4 contribution, that overall the business is, as we looked at Q3 and guided for Q4, that our expectation is the second half will be largely in line with what we had anticipated the business would be when we guided back in the summertime for the third and fourth quarters.

Our next question is coming from John DiFucci from Jeffries.

This is Julian Serafini on for John. Two questions probably for Cam actually. One, I want to circle back on the Q4 guide as well, just look at it from a different angle, I guess. Beyond the federal though, was there any commercial business that might have also been pulled from 3 -- into 3Q from 4Q? And then bigger picture too, was there like any shift in business momentum, positive or negative, beyond federal? Just to clarify.

Yes, Julian. So I'd say overall, we didn't see any meaningful business move out of Q3 into Q4 on a commercial basis. There are always puts and takes from -- basically out of Q4 into Q3, excuse me. So we didn't see a pull forward. There's always, as you well know, puts and takes. Deals move in, deals move out. That's a normal course activity. But overall, there was not a meaningful commercial effect like we saw the very large federal government effect in the way Q3 played out. In -- to the macro question that you asked, I think as we look at the market, we continue to see good health, good buying trends, good demand, continuing strong interest from the -- from, if you will, the target customer sets that we're addressing, both at the large enterprise size -- side of the market as well as the mid enterprise. So we're very comfortable that we've got a healthy market moving forward based upon all the interaction that we're having with prospective buyers as well as with the success of our existing [implementation-like] cycle, a continued healthy contribution from -- in the business from upsell, cross-sell activity for existing implementations. So we think those 2 factors portend well as we look forward for future business performance.

Okay. And just one more question. On the gross profit, on the subscription business -- the gross margin really. That has been ticking up sequentially quarter-after-quarter. What -- I guess, how should we start thinking at going forward for the gross margin on subscription? Is that a low-80s number going forward? Like, what's the right way to think about that really? Does it keep going up sequentially from here or what's the right way to think going forward?

So Julian, I'll give you some general comments overall on a gross margin basis for subscription. The 2 factors that we've highlighted for you previously continue to play out. First, we continue to find good operating leverage on the maintenance side of the business by virtue of the increasing scale of that business and the efficiencies that our internal team are really driving. It's been gratifying to watch our internal team be more efficient as we've scaled in terms of number of customers and global coverage and footprint. So that I think is a testament to the team's work that they've done to find ways to deliver high-quality maintenance and support services with, if you will, more scale and more complexity of support. That -- we think that's an important overall piece of the mix. In addition, with the continued growth of the SaaS business, we are seeing improving scale and gross margin performance there. And that has been a trend we've highlighted for you previously. So now on to the substance of your question, I think we believe we can continue to improve gross margins at its -- not at a rapid pace, but at a steady modest pace much like you've seen in prior quarters. There's room on both revenue lines within the subscription line to in fact make improvements still. The larger improvements, given the relative scales of those 2 revenue contributors, the relative growth will be more on the SaaS side of the business than the maintenance side, but there is room to improve on both.

(Operator Instructions) Our next question is coming from Melissa Franchi from Morgan Stanley.

I wanted to hit on the international strength in the quarter. Cam, I think you mentioned that it benefited from large deals [if it] takes sort of a multi-quarter view. But it doesn't sound like, based on your commentary, that there was necessarily pull-forward happening in Q3 internationally. So I'm just wondering if you could comment on what's working well for you internationally. I guess related to that, are you seeing any traction in governments outside of the U.S. that may be contributing to international strength?

Yes, so I'll tackle your second question first. I think we've had success outside of the U.S. in selling to governments at the federal level and at the equivalent of U.S.-state level across the globe. That's been part of our contribution. I would not say the recent couple of quarters represented an atypically large contribution from those non-U. S. governmental entities, Melissa. They are solid ongoing contributors and we're seeing an ability to go address needs in those countries similar to what we're addressing in the U.S. So on to the first part of your question, the health in our international business we've highlighted for a couple of quarters now. I think we fundamentally are pleased by that. As we've highlighted for you previously, we have been making investments to expand both in EMEA and in APAC and for that matter, other countries of the world because we saw that the identity governance problem really is a global problem. That large enterprises, wherever headquartered, really have the same identity governance challenge, and we've shown an ability to sell to them now for many years. And what's really working well, to answer your question, is that we've taken our best learning really from especially the U.S. markets, translate it into our selling approaches and adapt it for local market conditions across the globe and it's working productively. And that includes a very experienced direct sales force; a very tight coupling to our partners in those local markets; and, quite frankly, a very razor-sharp focus on customer success as they bought the product and deploy the product. We think those are key variables that really contribute to our overall global success in the business.

Okay. And one follow-up on the competitive environment. I know we've talked about -- Mark talked about displacing Oracle and other legacy vendors. Particularly interested to hear if you've seen any sort of benefit from the CA transaction in particular, if that's presented more opportunities for you over the past few quarters?

Yes, Melissa, I'd say nothing dramatic that we would point to. I think a lot of those customers -- existing customers, right? So there's kind of 2 categories there, right? When we're going in to complete on a new deal, the CA show up to complete. And in general, we don't see them as a real strong player in kind of a net new environment. It's more about their installed base. And I think a lot of those customers have been kind of in a wait state to see exactly how this would play out as the deal closed, number one. And the rumors had been all over us to whether there will be any significant movement in or out of Broadcom of all the various assets they got with CA. So I think until people see how that settles out, they're mostly kind of in a wait-and-see mode. I think we are certainly trying to engage in customer situations like that where the customer is at least considering making a change and try to position what we think is our superior offering and point to the hundreds of displacements we've already done with CA and then watch and see if there is probably more of a pickup of movement in 2019. I think -- I'd say we're hopeful for that. I wouldn't tell you we're forecasting it yet. I think we're hopeful there may be a little more unsettledness, if that's a word, to that customer base in 2019 and we'll just have to see how that plays out.

Our next question is coming from Alex Henderson from Needham & Company.

I was hoping you could talk a little bit about the international market in the context of the [softening] conditions on a macro basis versus the benefits from GDPR and maybe parse between those 2 variables and your international build. Have you seen any slowdown in the international market in terms of your pipelines going into the fourth quarter because of the economy decelerating? And can you parse between those 3 factors a little bit?

Yes, Alex, this is Cam. I'll start and let [maybe] Mark jump in. I think -- firstly, let me start with GDPR. I think we said previously we continued to, as we assess our business, to believe that GDPR for us is still an opportunity that's in front of us today. That we are interacting routinely with many organizations about how they're planning to address their GDPR obligations. And we believe, as they think about what they're going to do from a systems perspective, that both our compliance managers solution within the IIQ and IdNow families as well as our SecurityIQ solutions, that we can add real value to their overall effort to address GDPR. But I can't point you today to any meaningful business contribution and we had not expected there to be any and hadn't reflected any real contribution of significance in our business for 2018. As it relates to economic impact, I would say, in terms of the international markets, we haven't seen any impact to date in the outlook of our business for -- as a result of changing economic conditions. That is softening, as you've used the phrase. I think our pipeline has continued to be healthy there. We are seeing good business across the geographies. I won't point to any particular country. There are always puts and takes because of deal timing given the scale of our business. But in general, we haven't seen any softening of the outlook as a result of what looks to be a somewhat less attractive GDP growth opportunity outside the U.S.

Great. Just to clarify, when you book a sale to a U.S. company but it's the international arm of that U.S. company, is that booked as an international sale or a U.S. sale? That's an international sale, I would assume.

Well, so our general approach always has been we reflect revenue based upon the headquarter's entity that we're selling to because usually it is a corporate buying vehicle that's getting bought. So take a large enterprise that's domiciled, from a headquarters perspective in the U.S., we would report that as domestic business. Because in general in that case, they're going to deploy that solution, both in the U.S. and for all their operating units across the globe. And likewise, if a business is domiciled in the EMEA region or in the APAC region, we'll report it there in terms of the numbers that we're sharing with you, even though it's going to be deployed in the U.S. or deployed in EMEA -- if you will -- if you're thinking about it from an APAC perspective. So we look at it in terms of where the headquarter's entity is domiciled. That's -- for the most part, that is how people buy.

Yes, the only add I'd give you there, Alex, is obviously sometimes there's variability in corporate structure as how independent a wholly-owned sub is. And so if the business is really being driven by a wholly-owned sub and it's not an enterprise deal, and that wholly-owned sub is in the geo, we're going to probably reflect it there, right? So I think, just to be clear, it does kind of depend on the buying structure and the scope of what the customer is actually purchasing.

Our next question is coming from Gabriela Borges from Goldman Sachs.

The first one is for Mark, which is generally speaking outside of the federal vertical, when you are successful in displacing some of your incumbents, what is the catalyst for that initial engagement and ultimately that displacement? Because it sounds like it's not GDPR yet to the extent that it might be. So what do you think it is that catalyzes that [interest] displacement?

Thanks Gabriela, good to talk to you. I'd say it does really kind of come from at -- all 3 of the kind of core value propositions we have reflected in some of our prior conversations, meaning sometimes it is a compliance-driven issue, where they are either failing or fear of failing audits and they are responding to that need and they feel like their current solution is inadequate to address it. Sometimes, it is a security-related value proposition, either again an actual breach or a threat of breach or a breach in a significantly similar vertical -- I always like to say retail got caught for us after Target, right? And then the third is probably quite more common than you might think, and that's just the fundamental IT efficiency in operations, particularly the life cycle management side of our offering. If you think about it, all these large organizations do have a tremendous volume of turn, right? Of identities coming and going and moving, right? We call it that Joiner-Mover-Leaver phenomenon. And quite often, these older legacy solutions that -- they simply run out of gas, their ability to continue to keep up with the rapid change, particularly in the application infrastructure, which is shifting to more SaaS than cloud. And sometimes that's a catalyst for dialogue. As I've pointed out in a couple of calls in the past, no matter which of those doors, to call them a door for a second, that we enter through, we end up having a conversation about all 3 value props. But the impetus really can come from any 1 of the 3.

Very good. The follow-up is for Cam, which is on the medium-term outlook for margin. Can you give us a sense of where you are in your cadence of investment for enabling the channel, system integrators, partners, all of that good stuff? I'm just wondering if there's a scenario where given the outperformance on EBIT this year, we may be in a medium-term period where margins trend flat to maybe down a little bit before you start executing on the longer-term leverage of the model?

Yes, thanks, Gabriela. The answer is we've certainly outperformed on a profit contribution basis, that is operating profit on a non-GAAP basis -- margin basis this year. That's largely due to the outperform we've seen in the top line business. We will continue -- as we've said historically, our business model is to drive top line growth first and then expansion in margin second. We are, in fact, investing in all of the things you talked about across all of the geographies. So that would include additional sales representatives in each geography. It would include technical sellers, partner managers across our internal selling organization. It also importantly includes bringing on and enabling additional partners, especially for us today in the middle enterprise market. That's a new market for us on a -- if you will, on a long-term basis, that's relatively new to us. And while we have a very strong stable of partners in the large enterprise category of our business, we have a smaller stable of partners in the middle enterprise part of our business. And we are recruiting and onboarding partners across the globe to help us address that middle-enterprise class customer, which is largely a SaaS customer as we've talked about. So yes, I would tell you, as you think about the go-forward outlook for margins, I would not anticipate expansion and in fact, you might see a bit of -- given the outperform this year relative to the guide that we gave you early in the year, you might see some, if you will, margin contraction into next year. Not of any meaningful nature, only that we want -- as we've said previously, we want to keep overall operating profit performance in and around the range we are today so that we can continue and invest across the globe in building real scale to capitalize on what we see to be the attractive market opportunity.

Our next question today is coming from Shaul Eyal from Oppenheimer.

Maybe building on Gabriela's question, specifically on your hiring plans. How do you look at it? Are you guys running in line, running a little behind or a little ahead with 1 quarter to go through year-end?

Yes, Shaul, first of all, thanks for the question. Appreciate you joining the call today. So I'll take a first cut at this, then Mark will potentially add some additional color there. As we've highlighted for you earlier in the year, we were a bit behind in our hiring. No real overall concerns there, just pacing. As we came through Q3, we were pleased with the overall net hiring position, it did pick up across really all activities within the company. And I think as we think about hiring going forward, I think what we generally believe is that continued healthy pace of hiring in the sales organization will give us the incremental capacity and scale that we need to sustain overall growth rates. As we think about that company-level hiring, you've heard me say previously, we're looking to get a bit of operating leverage out of the business from the rest of the business to help sustain the investment we're making in sales and marketing. And we'll continue to do that because, especially as we look into next year a bit, one of the things you've seen this year is we made a big investment in G&A especially. As we become a public company, there's been a lot of -- an incremental spending there. We think that spending growth will moderate into next year and we'll have some opportunity to redirect that, if you will, that spending expansion for going forward back into the rest of the business, which we're excited by that possibility. So I think we're happy with where we are overall. Believe we're on track in hiring, and we'll continue to focus first on growing capacity to sell across the globe and then the rest of the business incrementally. As we've talked to you about, we've got 4 product lines, we want to continue and invest in all 4 and to continue to invest, we're going to make incremental investment in people resources to expand and extend the leadership that we have across the product portfolio.

Yes, just a quick addition there, Shaul. I'd say, kind of tying back to Gabriela's point and question, part of our goal, obviously, is to continue to invest in channel and partner coverage, particularly as Cam said, in that middle enterprise market. That kind of 1,000 to 7,500 segment that we've highlighted since the IPO. And in particular there, we would hope over time to continue to see a bit more leverage, right? As we have pure SailPoint people required to support the efforts of those partners, right? So I think we are seeing a good opportunity to create more leverage, particularly in that middle enterprise segment. So we'll kind of keep you apprised on that as we go into 2019.

Got it. This is helpful. And how would you characterize the current pricing environment, regardless of this $6 million pull-forward phenomenon?

You mean kind of a -- pricing competitively, Shaul, just to be clear?

Yes, yes.

Yes, well, this is Cam. I think overall, we see the pricing environment continue to be healthy for us. We're able to get -- or to secure the kinds of pricing we want in selling both the -- well, all -- really, all the product lines. So I think the pricing environment globally has been strong for us. Nothing in what you saw on the federal government buying dynamic reflected any changing our pricing approach for those deals. We've had a pretty established philosophy in the sector -- the government sector for a number of years now. As you well know, Shaul, we've been selling into that sector, both on the, if you will, the defense and DOE side of the business -- or the government as well as the civilian agency side for a number of years. And so that pricing philosophy has not changed and the pricing dynamic or environment for us across the globe has remained very good, we think, in terms of our ability to secure the kinds of pricing that we think are appropriate as the market leader.

Yes. I'd say as the leader, quite often, we feel attacked by a "lower price" alternative that a competitor will often use as kind of the last-ditch effort to win, and if the customer is very responsive to that, we will generally not chase them down, as we like to say. And sometimes those deals do come back, if we do lose on a pricing situation. We've seen a number of customers who thought they wanted to save money and take the "cheap" alternative and 2, 4, 6 quarters later, they recognize that might not have been the right approach. So I think in general, we feel confident that our pricing reflects the value we're delivering to our customers, as Cam said. So I don't think we're feeling any tremendous -- not tremendous, any significant price pressure at this point.

Our next question is coming from Andrew Nowinski from Piper Jaffray.

I just wanted to ask about the enterprise space. So if we normalize for the deals that pulled into Q3 from the Fed, it looks like your seasonality through the first 3 quarters of the year were pretty similar to last year. But just wondering what you're expecting with regard to an enterprise budget flush in Q4? Do you think enterprises are sitting on a lot of projects? Or has the pipeline largely converted as you expected so far year-to-date?

Yes, so I think, Andy, first of all, thanks for joining the call. Appreciate the question. Yes, as you understand, we have a seasonality to our business that really reflects, if you will, kind of an up-ramping as we go through the year. That is, the early part of the year is somewhat overall less strong. Overall, in its contribution, the second half with Q4 always being our seasonally strongest quarter of the year. What we have seen is a little bit of flip-flop in the second half of the year in terms of the seasonality contribution. I think you can attribute that largely to the federal highlights that we've given you previously. In terms of the opportunity for Q4 commercial business, it is -- as I said a number of times, that it is our seasonally strongest period. It is the period generally when corporate America and the rest of the world are buying to complete their budget years. And as we look at the outlook and the way we have assembled the guide for Q4, I think what we see is a similar buying pattern from an expectation perspective as we've seen in prior Q4. So no real fundamental change, good health, good industry vertical separation or segregation, if you will. And then good strength across the 3 major regions of the world that we generally talk to you about.

I think just to be clear, not seeing any indicators at this point of what ended up being in our minds at least partially a bit of a budget flush phenomenon last Q4. I mean, we would be happy to see that happen unexpectedly again, but we don't necessarily see any indications of it. I think last year, there was a lot of reaction to the tax code changes and all that stuff. But I think this year, unless we get a little bit of a freed up spending in the U.S. as people take a deep breath after the election or something, I don't know that we would say -- this will be -- this will be more like prior Q4s than last Q4, which we highlighted was a fairly strong conversion and close rate, historically.

Okay, understood. And then I wanted to ask about the partnerships with the Active and CyberArk. Now how has that impacted your win ratio on deals that you go into alone versus going into with partners? And has that helped you in the federal market as well?

I'd say it's too early to point to any of that federal result on that. These federal deals have been in process for a long, long time and our kind of active market partnering with both those 2 has been more in the last few quarters. So I wouldn't point to the federal results as particularly tied to that phenomenon, Andy. I think we would hope to see that in the future. I think what's happened with that go-to-market partnership where we're kind of going into various marketing events, webinars, seminars with the 2 and/or 3 of us in many cases, it just helps clarify in the minds of the customers that we are all solving fundamentally different core parts of the problem. But I think it's just early in the pipeline building stage for us with that partnership in the market. We're seeing a lot of interest [and] activity. I wouldn't point to a significant portion of the pipeline yet that's driven by that.

Our next question is coming from Richard Davis from Canaccord.

If you think about it, kind of at a fundamental level, identity is really -- is security, right? Because if you know who someone is, you don't need arguably firewalls, antivirus, bunch of other stuff. So here's my speculative question. Why is it not possible for you guys to pitch your technology as not only kind of identity governance, but as a way to help your customers decommission at least some of their redundant technology stack? Do you see what I'm getting at? Because it just feels like when I talk to CSOs, they're like, "Dang, I know I'm overspending, I just don't know where."

No, that's a great observation, Richard. I think, we -- a couple of years ago, we were probably a little bolder and we'd say, "Oh, you know, the perimeter is dead." And the truth is, I think customers are never going to stop trying to protect the perimeter at some level, right? I mean, Google went to the edge with their whole zero trust approach. Most customers today are still fairly traditional and they are going to put up some level of network defense, right? To your point. And then worry about a lot of other dynamics, particularly, notably identity. I can't point you to a study. Our anecdotal gut feel at times is that there has been a diminishing spend in other parts of security to make room for identity. Now budgets have been expanding in general and security, and I think identity is getting its more-than-fair share of that. If you look at the performance of Okta and CyberArk and SailPoint, we're all growing and doing quite well. I don't think we would say customers have said, "I'll stop spending in those other areas," particularly firewall or perimeter defense and shift all that spend. I think we're getting maybe some benefit there, maybe things get deferred, an upgrade gets pushed out for a quarter or 2 to make budget room, that kind of thing, Richard. But I -- it's a great case you make. I just think we're almost more taking the stance now that the perimeter, while not being irrelevant, is not sufficient, and this concept of layers of defense is important and that customers need to ensure they have both a good understanding of how to protect their perimeter, but also a very rich understanding of identity as a core control point in protecting their enterprise.

Yes, and I think -- Rick, this is Cam. I'd follow on with one other thought that Mark hit earlier relative to our value propositions, right, because one of the benefits we see in our selling is, is that because, in general, for the large enterprise where we're replacing some encumbered system, almost without exception we're replacing, our experience is that we can reduce the cost of operating their identity program by deploying IdentityIQ or IdentityNow, but generally IdentityIQ in the large enterprise. And that benefits the CIO and the CISO in the sense that they don't have to take budget necessarily away from other parts of their business in order to extend their identity governance program. The benefit that we deliver from an operational standpoint helps them fund a more comprehensive identity governance program. And I think that's somewhat unique if you think about identity relative to other security spend, and that's certainly one of the value propositions and value elements that we see come to the fore in our selling with our prospective customers. And we think in that sense, it can be very valuable in terms of our overall ability to -- given the heightened awareness that identity governance is important, to keep growth rates high.

We reached the end of our question-and-answer session. I'd like to turn the floor back over to Mark for any further or closing comments.

I don't think we have any additional comments, operator, but I would thank everyone again for your interest in SailPoint, for your time this afternoon and for the insightful questions. And we'll look forward to seeing you out in the market.

Thank you very much.

Thank you. That does conclude today's teleconference. You may disconnect the line at this time, and have a wonderful day.

We thank you for your participation today.