Mandiant, Inc.

Thank you. Good afternoon, and thank you to everyone on the call for joining us today, to discuss FireEye's financial results for the first quarter of 2017.

This call is being broadcast live over the Internet, and can be accessed on the Investor Relations section of FireEye's website at investors.fireeye.com. With me on today's call are Kevin Mandia, FireEye's Chief Executive Officer; Frank Verdecanna, Executive Vice President, Chief Financial Officer and Chief Accounting Officer of FireEye; and Bill Robbins, FireEye's Executive Vice President of Worldwide Sales.

After the market closed, FireEye issued a press release announcing the results for the first quarter of 2017. Before we begin, let me remind you that FireEye's management will make forward-looking statements during the course of this call, including statements relating to FireEye's guidance and expectations for certain financial results and metrics; FireEye's priorities, initiatives, plans and investments; FireEye's path to profitability; drivers and expectations for growth, the expansion of FireEye's platform and the capabilities and availability of new and enhanced offerings, market opportunities and go-to-market strategy.

These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future, and we undertake no obligation to update these statements after the call.

For a detailed description of the risks and uncertainties, please refer to our SEC filings, as well as our earnings release posted a few moments ago. Copies of these documents may be obtained from the SEC or by visiting the Investor Relations section of our website.

Additionally, certain non-GAAP financial measures will be discussed on the call. We have provided reconciliations of these non-GAAP financial measures for the most directly comparable GAAP financial measures in the Investors Relations section of the website as well as the earnings release.

Finally, I'd like to point out that we've posted the supplemental slides and financial statements also on the website. With that, I'll turn the call over to Kevin.

Thank you, Kate, and thank you to all of you, the investors, the employees, our customers and our partners who are joining us on this call. We appreciate your interest in making the time joining us today.

On last quarter's call we described several of the transitions FireEye is executing through, from disparate products to a single platform; from APT prevention to comprehensive prevention; from on-premise appliances to more cloud and hybrid solutions; from product revenues to subscription revenues, and there's even other transitions we're going through. And as we execute through these transitions, we have maintained our focus on two significant priorities.

The first is, right-sizing our cost structure to support a balance of growth and profitability. And the second priority is, evolving our product portfolio to a comprehensive security platform delivered as a service, on-premise in hybrid environments or in the cloud.

We remain laser-focused on these transitions and our priorities, and we are committed to achieving non-GAAP operating profitability in the fourth quarter, and a return to growth by the end of this year. Today, thanks to the dedication and focus of the entire FireEye team, we are much closer to realizing each one of these objectives.

We did what we said we would do in Q1, exceeding our guidance ranges for every financial metric. In addition to exceeding on the financial metrics, we also positioned the company to better accelerate our growth in the future.

So today, I'm going to discuss two things: I want to review some Q1 highlights, I want to discuss important innovations for FireEye's future. In Q1, we continued to drive operational efficiencies across the company.

These improvements will allow us to achieve the balance of growth and profitability that is one of the foundations and hallmarks of all great companies. Frank will take you through the financial details, but I did want to highlight that, we reduced our non-GAAP operating losses by more than $60 million compared to Q1 of 2016.

Our operating margin improved by more than 36% year-over-year. Our non-GAAP losses were less than $14 million, representing our second best operating performance ever, second only to the last quarter or Q4 of 2016.

To put this performance into historical context, between Q1 of 2014 and Q1 of 2016, FireEye had operated nine straight quarters with operating losses between $50 million to $80 million. We have made significant improvements since then, and we fully intend to operate a more efficient company as we innovate and transform our offerings to power next-generation security operations.

This intention can only be fulfilled when all of our teams from sales, marketing, engineering, consulting and our support functions are all aligned in their purpose across the organization to relentlessly protect our customers with innovative technology and expertise learned on the front lines. I would like to thank all of our employees.

Not only are we trusted by the most security-conscious organizations in the world, but we have worked together to innovate even faster, while running FireEye more efficiently. Now, let me turn to the innovation that is driving the fundamental shifts in our business.

We are continuing the pivot from a network Sandboxing and ATP protection company to a comprehensive security company, enabling next-generation security teams. I've always believed that security innovation begins at the breach, and FireEye's Mandiant team continues to own that moment when an organization understands it has been a victim of a computer intrusion.

We get to witness first-hand how attackers evade security safeguards, and we are there when organizations need us most. We learn from and continue to innovate to defend against these attacks.

We also have a worldwide collection of threat analysts to help us better understand the attacker. And these two people assets, the technical threat intelligence gathered by responding to breaches; and second, our worldwide intelligence collections done by our threat analysts, both differentiate FireEye from traditional security product companies.

Our expertise are from the front lines, and these expertise allow us to rapidly innovate and maintain effectiveness as the market and the threat landscape continually change. In short, I believe we have built the best learning system to safeguard our customers.

I want to talk now about Helix, which we released on the last day of Q1. With the announcement of our Helix platform at the end of November of 2016, we marked a major milestone in our company's transformation.

Helix combines our network and endpoint protection technologies with a unified security console that centralizes alerts from FireEye solutions, and from all third-party products or nearly all third-party security products. The result is a single platform that combines our MVX detection technology, our nation-grade threat intelligence capability, and our consulting-derived rules and analytics to prioritize and validate security events.

Helix integrates the customers' security products. It simplifies their security operations, and it automates common security task, such as containment with packaged playbooks.

You can think of Helix in terms of a hub-and-spoke model, with point products with the spokes that connect to the Helix hub. And I like to call this hub, mission control, which is a centralized collection of capabilities designed by and for security professionals.

The cloud-based Helix console scales with customer requirements and can accommodate an unlimited number of spokes or sensors. We already have technology integrations for hundreds of popular security tools, including next-gen firewalls, legacy AV software and popular SIMs.

It is still very early in the Helix lifecycle, but we are already seeing positive signs. Even though we released Helix on the last day of the quarter, we closed Helix deals on that day in four different vertical markets, including an energy company and a leading apparel company.

Two of these customers are brand-new logos to FireEye. The Helix deals drove incremental product sales as well, in both new and existing customers, including NX sales, HX sales and cloud e-mail.

These incremental product purchases represent a substantial increase in our transaction sizes for those deals. We're also seeing early validation that Helix plus FireEye as a Service, is a compelling combination.

The customer can operate Helix on their own, or leverage FireEye's expertise with FireEye as a Service. And I keep saying click-to-chat is coming as we want to link our expertise directly to our customers through our technology.

I am excited by Helix providing a single platform that blends our technology, our intelligence and our expertise at FireEye as a seamless, on-demand extension of our customers' security teams. Turning to HX, our endpoint product.

In addition to Helix, we expect our next-generation endpoint product, HX, to drive our growth in the second half of 2017. We introduced HX with Exploit Guard an advanced malware detection in Q1.

We also expanded the platform to cover the Mac operating systems, and we are on track for full AV replacement in Q3 of 2017, when a wave of legacy endpoints subscriptions are due to expire. In short, during Q1, we significantly broadened FireEye's endpoint technology feature set to include prevention, detection capabilities, investigation capabilities and remediation, all in a single agent.

And that's what security professionals have been asking for from their endpoint security vendors for years. With the NX refresh, we had a strong execution on the first wave in Q1.

In fact, we exceeded our expectations for incremental total billings in Q1. It is still early on, but the number of NX renewal opportunities increase as we go through the year, and this is another reason why I remain confident in our ability to return to growth by the end of Q4.

Now, I also want to talk briefly about our Industrial Control System expertise. We continue to expand our offerings.

And into Q1, I would like to highlight that, we took our Industrial Control expertise, and we scaled it through monitoring both IT, security alerts and OT, or operational technology alerts for several of our FireEye as a Service customers. We now have several paying FaaS customers that are taking advantage of this capability, and FireEye [Technical Difficulty] (11:04) we recognize protecting the critical infrastructure, the utilities, the mining operations are critical to the businesses of this world.

Now, I want to transition to some sales dialog. Other key factors to FireEye growth will always be a strong commitment to our channel and our sales productivity.

Rather than having me speak to those points, I've asked Bill Robbins, our EVP, or Executive Vice President of Worldwide Sales to speak directly with you today, and answer any questions you may have for him during our Q&A session. Now, before I turn it over to, Bill, I just want to share some closing thoughts.

I wake up every day with the honor and privilege to represent the best security minds in the industry, who prove day-in and day-out that they are dedicated to relentlessly protecting our customers. Our mission extends far beyond our financial performance as the best brands in the world, constantly relying on FireEye to protect them.

And we own the moment on the front lines, responding to the breaches that matter. In Q1, we did what we said we would do, with improved operational efficiencies, a wave of recent innovations and growing channel support, I believe, we have a solid foundation to drive balanced growth and profitability.

I thank you again for your continued support. And with that, Bill, I'll now turn the call over to you.

Thank you, Kevin, and good afternoon, everyone. As noted in our release, and in Kevin's comments, we delivered solid results across the board in Q1, and I'm pleased that this was in part driven by improved sales execution.

While it's still early, this is an encouraging sign that the go-to-market changes we've made are starting to have an impact. I'm proud of the effort and commitment shown across the FireEye sales team, and I am also very appreciative of the collaboration and commitment we've seen in our work with FireEye's valued channel partners.

One of the keys to our success in Q1 was the strengthening of our sales leadership team. As we entered 2017, we committed to filling several critical management roles in the sales organization, and we made good on that promise in Q1.

In February, we brought on Kevin Taylor, an experienced sales leader, to head our EMEA team. That same month, we added Wes Simons from SecureWorks to run our global specialist sales team that is aligned with our new Global Services and Intelligence organization.

And on April 3, Takayuki Nishimura (13:26), who has more than 25 years experience in security and IT, joined us as President of our Japan business. These leadership moves are already making a difference with our sales team, our channel partners and our customers, and I'm highly confident that Kevin, Wes, Nishimura-san (13:46) and their organizations will have even greater impact as we move forward in 2017.

We also began this year with a renewed focus and commitment to working with our channel partners. A key first step was clearly communicating FireEye's channel engagement guiding principles, which are: one, to accelerate mutual growth and profitability; two, to invest in our partners to help them build their FireEye practice; three, to ensure consistent implementation and execution of channel strategies, programs and processes; and four, partnering with integrity and with respect for the channel's value add.

In addition to the go-to-market improvements for our channel partners, we have also focused on ensuring that product launches like Helix and HX are channel-ready from the start. This allows us to gain quicker and broader market reach, empowering us to solve our customers' needs and helping us enable our partner success.

And while we certainly have more work to do to build a world-class channel, we did see meaningful upticks in systems (14:55) in Q1. Qualitatively, the feedback that we're receiving, both directly and via industry surveys is that, our channel partners recognize our commitment, and we're earning their support.

Quantitatively, we saw increases in our partner source deal registration opportunities that contributed to both Q1 actuals, and to our pipeline for Q2 in the second half of 2017. This is an exciting development that leaves me optimistic, that with our continued focus on partner success, we will ultimately benefit from the productivity leverage that results from having a strong channel as a key part of our go-to-market strategy.

I also want to recognize the progress we have made in building a strong, high-performing sales culture here at FireEye. I am fortunate in that the team I joined five months ago has some of the most talented, passionate and driven sales leaders, account managers and sales engineers that I've ever worked with.

Look, our top sales people could work anywhere, but they choose FireEye because they believe in our vision of intelligence-led security, and they are champions of our mission to relentlessly protect our customers. So working closely with marketing and product management, we made significant progress in Q1 in creating and delivering enablement training and programs that empower our broader team.

This will help us to increase our productivity per head, and per dollar invested, driving down our expense-to-billings ratio, and contributing to our corporate goal of profitable growth. Additionally, this focus on sales enablement demonstrates our commitment to our sales team.

We are investing in their success, and we want to enable them to meet and exceed their annual quotas. We're still at the early stages of this initiative, but I'm encouraged by the initial signs of progress.

Our voluntary attrition rate across sales decreased, and we saw an increase in participation, with more people meeting their goals. And this is how you build the foundation for consistent execution throughout the year, and we will continue to focus on fostering a strong, high-performing, customer-oriented culture that will pay dividends for our employees, our customers and our shareholders.

I'm very pleased with the progress to-date. While there's still much to be done, I'm appreciative of my team's efforts, and proud of our accomplishments in every region over the past quarter.

Our APJ team rebounded from a tough Q4, and executed extremely well in the first quarter. EMEA welcomed a new leader, and they never missed a beat turning in a strong performance.

And our Americas business, including our federal and SLED teams delivered on their commitments, and did a really solid job building pipeline for Q2 and the second half of 2017. So to summarize, Q1 maybe only one step on our journey, but it was a positive one.

I'm convinced we're on the right track, and I'm encouraged by the prospects for the remainder of 2017 and beyond. And with that, I'd like to turn it over to Frank, to walk you through our financial performance.

Thanks, Bill. Kevin and Bill have discussed our vision, and the evolution of our business from the product and go-to-market perspectives.

For my first call as FireEye's CFO, I want to spend some time on the financial implications of this evolution, including the continuing shift to subscriptions as well as seasonal patterns as we move throughout the year. I will also provide some detail on our better-than-expected Q1's billing and operating performance, as well as our guidance for the year.

Before we begin, let me remind you that, when discussing gross margin, expenses, operating income and EPS, I will be referring to non-GAAP measures. I will start with billings, since billings reflect current business trends, and because they drive our deferred revenue and operating cash flow.

Total billings of $152.4 million were above the high-end of our guidance range as our sales execution improved across the board. We saw good uplift on the first wave of renewals associated with the NX refresh opportunity, closed several Helix transactions, as Kevin had mentioned, and improved our performance in EMEA and APJ.

The underlying metrics reveal some positive trends in the business, that we believe, position us to meet our targets for the second half of 2017, and deliver continued growth next year. First, we continue to broaden and diversify our base of customers.

We added 237 new customers, including 18 new Global 2000 customers, and transaction velocity continued to trend upward. The total number of customers transacting in Q1 increased double-digits compared with Q1 2016.

We're also starting to see some traction in the mid-market customer segment, defined as organizations with fewer than 5,000 employees. New business with this segment was up 9% year-over-year in Q1.

Although, the transaction size is smaller than that of our large enterprise customers, I believe, this metric validates the potential of our new offerings targeted at this market segment. At the same time, our large enterprise customers continue to rely on FireEye to protect their organizations, which is demonstrated by our continued strong retention rates, increases in the multi-product attach rates, and very good upsell and cross-sell metrics.

Global 2000 customers contributed approximately 35% of our total sales, about the same percentage as in Q1 2016. Specifically, the number of customers with three or more product families continued to increase, and is now more than 35% of our installed base.

Additionally, customer retention has remained consistently high at approximately 90%, and the dollar yield is over 100% on a rolling four quarter basis as customers add capacity and additional products. Finally, our results were less influenced by a large multi-million dollar deals than in the past.

While we closed 29 transactions greater than $1 million in Q1 2017, one more than in Q1 2016, we did not book any transactions over $5 million. In Q1 2016, we had three transactions greater than $5 million, including the eight figure five-year cloud e-mail transaction with a federal agency that we had mentioned in our Q1 2016 call.

Since we didn't have any mega deals in Q1, our average contract length declined to 22 months compared to 31 months a year ago and 24 months in Q4. In addition to fewer larger transactions, the decline in contract length reflects a higher mix of renewals compared to a year ago.

As expected, the shift towards ratable subscriptions continued in Q1, with growth in both attached subscription renewals and new unattached subscriptions. For product subscription billings, we saw a greater than 20% increase in the annual contract value.

We expect the trend to continue through 2017 with the introduction of the Helix platform, and more cloud-delivered endpoint and network security. Q1 product subscription billings were $73.5 million.

The year-over-year decline was largely due to the large deal we talked about earlier. And even though renewals were strong on the attached subscriptions, the year-over-year decline in new appliance sales was also a factor.

Product billings were $23.4 million, down 30% year-over-year, but above our expectation. The relative strength in appliance sales was primarily the result of good upsell of our new appliances, as well as pull-through of additional appliances with the Helix transaction.

While one quarter isn't a trend, these results suggest the pace of decline in client sales may be moderating. Our professional services billings of $31.7 million were consistent with the services billings in Q1 of 2016, and accounted for 21% of our total billings.

The increase in the services mix is driven by seasonality more than anything else, and we expect to return to our target range of 15% to 20% of billings in Q2, and for the full year. I won't spend a lot of time on revenue, but I do want to highlight a couple of points.

Product subscriptions and support revenue, each grew 17% year-over-year, and totaled $120.3 million, or 69% of total revenue. Both categories grew sequentially as well as we continue to transition to a ratable subscription model.

While product and professional services revenue declined on a sequential basis due to seasonality, both came in above our expectations. Total revenue of $173.7 million was up 3% year-over-year as growth in subscriptions and support revenue offset the decline in product and professional services revenue.

Increased operational efficiency and sales productivity resulted in a $60 million improvement in our operating loss compared to Q1 2016. As a percentage of revenue, operating margin was 37 percentage points better than a year ago, and improved to negative 7% versus negative 44% a year ago.

This is outstanding performance and reflects the continued focus in every area of the company. We ended the quarter with 2,868 employees worldwide, slightly less than our Q4 ending head count.

Our balance sheet remains strong, with $875 million in cash and short-term investments, and a total of $632 million in deferred revenue. I want to point out that, while our total deferred revenue increased 12% from a year ago, current deferred revenue was up 21%.

Just under $400 million is sitting in the current deferred revenue on the balance sheet, and will be recognized in the next 12 months, giving us increased visibility into future revenue. This is one of the benefits of the increasing mix of subscriptions.

Better operating performance also allowed us to outperform our cash flow guidance. Operating cash flow was negative $17 million in Q1 versus our expectation of negative $30 million to negative $40 million.

You may notice that the cash is down by more than the negative cash flow, due largely to a $39 million payment on the iSIGHT earn-out that shows up in the financing section of our cash flow statement. Those are the highlights of our Q1 performance.

It's clear, we're better positioned at business today than a year ago, and the many positive indicators in Q1 gives us confidence to issue full-year guidance along with the Q2 guidance. For Q2, we are now expecting billings in the range of $155 million to $175 million, and revenue in the range of $173 million to $179 million.

Given our new product introductions, the shift to subscriptions and the growing renewals opportunity, it is difficult to give specific guidance on the mix, but I think you can expect both product billings and product revenue to continue to decline between 38% to 40% year-over-year in Q2, and to decline between 20% and 30% for the full year 2017 as we get better compares in the second half. I expect the sequential trends in professional services billings and revenue to track to 2016.

We're targeting a non-GAAP operating margin of negative 9% to negative 10% for Q2. This does imply modest expense growth of a few million dollars, primarily due to higher commissions as well as increase in head count as we prepare for the seasonally-strong second half of the year.

We would normally expect Q2 to be our lowest cash flow quarter of the year as we collect on seasonally low Q1 billings, and we expect this to be the case for Q2 2017 as well. This is why we're guiding to negative operating cash flow in the range of negative $17 million to negative $27 million for Q2.

As billings increase sequentially, so do our receivables and this sets us up for positive operating cash flow in the second half of the year. Using shares outstanding of approximately 176 million for Q2, this results in an EPS range of negative $0.10 to negative $0.14.

For 2017, we expect billings in the range of $745 million to $775 million, and revenue in the range of $724 million to $736 million. We continue to target operating profitability in Q4, along with renewed billings and revenue growth.

We also think we will generate positive operating cash flow for the full year. In summary, I'm very pleased with our results in Q1, and I believe, we are on the right path.

We did what we said we would do and then some. The initial response to Helix has been strong.

We're executing well on the NX refresh opportunity, and we've made substantial progress on our path to profitability. That's it for my prepared remarks, and I will turn the call back over to the operator to begin Q&A.

Sterling, how are you?

Sterling?

Yeah. This is Ugam Kamat on for Sterling Auty.

Yeah, I just wanted to ask a question on the duration. It's trickled down since the first quarter of 2016 from 31 months to 22 months.

Should we expect this to be the new level for the contract duration? And like until the billings actually kick-start again in the second half of the year?

Yeah. I think, the contract length decline really was a result of lack of the larger mega deals, and then also a mix shift of a little bit more renewals.

I would expect, we'll see probably a little bit of an increase there. But generally, I think, if you think about the shift to more subscriptions, contract length over time will probably be roughly around two years.

Okay. Thank you.

And secondly, on your expense structure, we saw a massive leverage on sales and marketing expense despite billings beat, sales and marketing expenditure came in lower than our expectations. Has there been a change in the commission structure or sales and marketing policy that you have seen over the past few quarters?

We've continued to make efficiency changes within the sales group. I think, Bill, coming aboard, he was very focused on bringing in the right sales leadership and filling some roles there.

But we also did look at some changes to the comp plan to really incent the right behavior. But I think, the overall reduction in sales and marketing expense is really just the company getting more efficient there, and really focusing on driving kind of the new products and subscriptions.

All right. Thank you so much.

That was really helpful.

Thank you.

Good afternoon. Thanks for taking the question.

Great to see the business starting to stabilize. May be a little more detail on the product revenue upside that we saw in the quarter.

Maybe Kevin, if you could just expand a little bit on how those conversations with customers are going. What are they doing to expand the footprint of the appliances in the data centers?

Is it a function of MVX 2.0? Is it a function of network primarily or endpoint and e-mail as well?

Any additional color would be appreciated.

Yeah. Gabriela, when I look at the growth areas, obviously, we're known as a great Sandboxing technology.

We do in-line blocking. We did a lot of work to make sure we're not just an appliance company, but we can have software form factors for those features.

But I see endpoint in what we're doing there, and Helix bringing it all together. Helix is pretty cool.

The ability to see alerts from our products and your other security products in one interface is what people are reacting to. But again, security practitioners have been starving for a single endpoint agent that detects what AV detects, detects what AV misses, and scales experts to make sure even when you're 99% effective on the endpoint, with the amount of malware on the Internet, 99% sounds good, but isn't good.

And at the end of the day, you always want to scale your experts to take a sneak peek of machines when alerts are coming in, and we have a tech that can do that. So I look at Helix and our endpoint.

And then I look at NX, and our products that got us here, kind of a spokes or sensors on our new system. And as Helix becomes the interface for those technologies that we've been selling for the last seven or eight years, you'll see us go from network Sandbox company to truly a holistic comprehensive security operations platform.

And that's what we're trying to migrate and become.

Great. I appreciate the color.

And the follow-up for, Frank, if I could. And I think, back to 90 days ago, lot of moving pieces in the model that prevented the full-year guidance number from being put out there.

So maybe if you could just compare and contrast for us, the visibility that you have into the business today, versus a quarter ago and your confidence in hitting that full-year number? Thank you.

Sure, Gabriela. Yeah, I think a couple of things changed from Q1.

One, a lot of our second half growth was dependent on Helix and our next-generation endpoint product. And so, we wanted to get a quarter in, make sure Helix was released on time, make sure the road map of endpoint was progressing as planned.

And so both those, we were able to launch Helix the last day of the quarter, and our endpoint road map actually progressing really nicely. So I think – that gives us the confidence in the growth drivers for the back half of the year.

Additionally, the NX refresh opportunity was a big opportunity we're looking at for the year as well. And our first quarter out of the gate, we did little bit better than we expected there.

So I'd say, those three things on the growth drivers for the second half of the year, and then also, I think, product, we got a little bit more visibility and a little bit more moderation. As you recall, in Q4, we had a pretty big spike in the product decline, and that seems to have moderated in Q1 and in the pipeline for Q2.

Sounds good. Thank you.

Thank you.

Hi, guys. Thanks for taking my questions here.

You bet.

Maybe first for you, Frank, first of all, welcome to the call.

Thank you.

Can you just talk about the $15 million benefit you got in expenses last quarter? And whether that reversed this quarter?

I guess, we were expecting expenses to be up by more from just that alone, and so did that reversal happen? Or were you just able to cut more?

Maybe just a little bit more color on how that sort of transpired from Q4 to Q1?

Sure. In Q4, we did have some one-time kind of benefits on the expense side, that didn't reoccur in Q1.

But we did have some further kind of cost reductions just on making the business more efficient. We also had a slight decline in overall head count from Q4 to the end of Q1 as well.

And so those were the big drivers of the operating expense side.

Okay. Got it.

(34:05) from a gross point of view, obviously, when billings go down in a seasonally weaker Q1, and you see some reduction there.

Sure. And so just to clarify, that $15 million benefit actually didn't reverse in Q1?

Or did it? Just to make sure we're all clear.

It reversed, but then we found some additional cost reductions. And we said in the guidance that we do expect Q2 expenses to pick up a little bit.

Got it. Got it.

Okay. And then, for my follow-up, again for you, Frank, can you just talk about the mix of product subscription billings at this point that are coming from attached subscriptions versus unattached?

And maybe how that compares to last year at this time?

Yeah. So the attached is about 40%, and the unattached was about 60%.

Okay. I'm assuming that, that's probably – that ratio was probably flipped, right, at this time last year or how do you sort of think about it?

Correct. As product goes down, you lose some of the attached subscriptions.

But if you look at our newer products, and Helix is a good example, that's going to be an unattached subscription, so you'll see growth in that area.

Got it. Very helpful.

Thanks guys.

Thank you, Saket.

Awesome. Thanks, guys, and congrats on the quarter.

So with Helix now GA and Cloud MVX having gone GA in Q4, can you talk about early customer feedback here for both these products, especially with Helix now launching at the end of Q1. I mean, you touched on refresh earlier.

Are you seeing traditional NX customers convert to the Cloud MVX product upon refresh? Or they perhaps adding Cloud MVX as additional virtual sensors across their network?

Thank you.

Yeah. So I think, I heard about two or three questions in there.

I'm going to answer one, and then I'll pass it off to others for color. One of the things, when we did Cloud MVX, we had to do it.

It's going to be a critical component for our high-fidelity alerts in the Helix system. So other technologies will leverage it.

What I saw in refresh opportunities in Q1, realizing it's our smallest quarter for refresh opportunities to take the data for what it's worth in the first quarter. But most people still chose the appliance form factor and went back in on those renewals.

It's up to them. We like to have a menu that's versatile.

But at the end of the day, I was a little surprised, but the appliances were chosen during those renewals. And I don't know, Bill, do you want to add color to that?

No, I think you hit it right, Kevin. It's certainly from a choice perspective, they are looking at the different alternatives.

They're looking at what do they have in place already if they have appliances, which obviously is, what they're coming from a renewal, refresh perspective. They seem to be comfortable with that.

It really kind of depends on where they are in their architecture perspective. If they're looking to maybe build out larger architecture, more sites, expand their business, little more interest in virtual.

If it's more of a one-for-one replace, we are seeing a lot of the appliances just straight-up replacement.

That's helpful. And then maybe one more, if I might.

If I look at your annual guidance on billings, you're implying a pretty big ramp here in the back half. How much of that is related to the Helix launch?

And what you're seeing from there early on? Or perhaps other products you've recently rolled out or you're planning to roll out like endpoint?

Yeah, Gur, I would say, the three growth drivers for the back half of the year really are Helix. And with launching it at the end of Q1, we'll see continued traction in Q2 there, but most of that growth is going to be in the back half.

And then, on the endpoint, we'll have kind of the full AV replacement out in Q3, and so that's going to be one of our significant growth drivers there. And then the timing of the NX refresh opportunity, most of those renewals happen in the third and fourth quarter.

Okay. Great.

Thanks a lot. Congrats guys.

Thank you, Gur.

Great. Thanks for taking my question.

I just have another follow-up on the product refresh opportunity. So it's interesting that you said that, a lot of customers were choosing the appliances in the quarter.

But I'm wondering, as we're thinking about the refresh moving forward, would you assume that, most customers are going to opt for Helix? Or is that assumed in your expectations for the full year?

Or do you still see some appliance refresh in the outlook?

I think, we're going to get a mix of both, Melissa. And one of the things we're working on hard right now, and we're hoping for a Q3 release of is, is the interface of Helix will become the interface for the NX product line if our customers choose that.

And that way, we can help walk our customers from a network security investment in FireEye to more of a comprehensive security investment in FireEye, because we give them an interface that overlays our intelligence, and also is the same interface for other third-party alerts to include our endpoint products. So I think that's the selling motion that we want to add to the mix.

Right now, the selling motion on the refresh is, you now have choices on form factors. You can get better throughput and do Cloud MVX, and you can get more geographic coverage as well.

But I'd like to have a second selling motion come in sometime in Q3 with that additional Helix interface and see if we can walk our customers to more of the full platform story.

Yeah. And the one thing I'll add to that, Melissa is that, if we look at those four Helix transactions in the first quarter, two of them actually brought along with it some appliance revenue as well.

So I think we're going to see a lot of customers that are still going to have a hybrid environment where they'll have kind of the Helix cloud solution and maybe the endpoint in the cloud. But then, they still may have some appliances, and so we still may see some product sales there as well.

Okay. That's helpful.

And then, just one quick follow-up in terms of sales capacity, with the new products that are ramping in the second half of the year, I'm wondering if you can comment how comfortable you are with the sales capacity that you have today or do you need to invest additional dollars to increase feet on the street?

From a capacity perspective, there's a couple of things we're looking at. I mean, first and foremost, I hit in both of these in my opening remarks is, continued leverage of the channel.

I mean, getting that channel leverage, enabling the channel, getting them to lead with FireEye products, and improving the partnership certainly gives us more reach in a more cost-effective way. And frankly, faster than we could wrap up ourselves.

So we're putting a lot of effort there. And I think for the second half of the year, specifically with the launch around HX, I'm really excited about what we can do with our channel partners.

Now, the second thing, and I also mentioned in my opening remarks, was around enablement. We have a really good strong team here.

And as we roll out these new products, it's incumbent upon me and my leadership team and the marketing team and product management and the company to make sure that our teams really understand how to best position the technology, they understand it technically, they understand the business value, they understand the competitive positioning. And so we're spending a lot of time and effort on trying to get a – kind of a one to many lift, right?

So taking something that's repeatable, scalable in terms of the selling motion and the value and making sure that every FireEye sales professional can take that into their customer base. And then the third part is more of the brute force adding capacity, feet on the street.

And there are some place that we're doing that. We certainly like any company are always looking for good talent, and there's markets that we think we can invest in going that make a lot of sense.

So we will continue to do that. But those are the three things we're focused on, and frankly, probably in that order getting channel lift, enabling our existing sales team to get more productivity and then augmenting our actual sales capacity when it more makes sense.

It's very helpful. Thank you.

Hi, guys. Thanks for taking the question, and congrats on the quarter.

So you noted that the dollar yield on renewals is over 100%. I was wondering if you could rank order the primary drivers for upside above the dollar-for-dollar renewal portion of that?

Yeah. Sure, in most cases, Ken, it's basically customers that are adding to their current platform.

And so they could be an existing web customer that is adding ETP or they could be an existing web customer that's just adding capacity. With some of the new appliances and some of the lower cost sensors, we're seeing people add to different branch offices and subsidiaries that in the past was too cost prohibitive to do so.

Okay. And then for my second question, are you seeing any extension to the sales cycle as you push towards more of a platform offering?

I don't know. My initial response to that, Ken, is that it's too soon to tell on the Helix thing, and the way we sell it is relatively modularized.

I can only know if that's a word. But we go in and just look for a need.

The key is the interface to it, because it brings the legacy products in or our products in. But once we show, Helix, I don't sense it's elongating the sales process, because people see the value of the interface, and then they recognize, we can put endpoint into this thing, we can put other network technology, sending data to this thing.

And once they embrace the mission control interface of it, that just gives us greater opportunity to talk about endpoint or talk about some of our product sets. But that's why we pushed out the analyst meeting, as we need to get our sea legs behind Helix.

We released it March 31, and we're going to keep an eye on that pipeline and grow it and learn a lot over the next few quarters.

And Ken, two of the four deals we closed for Helix were new customers, and those sales cycles were actually very quick. But again, it's a very small base to make any assessments there.

I think, we have to kind of progress through Q2 to come back to you on that.

Okay. Great.

Thanks very much.

Let me build on that last question on Helix. And what we're hearing is that, Helix presents a pretty compelling economic value.

Can you maybe talk about what the opportunity is to pull-through additional product sales over time when somebody gets on to the Helix platform? And do you see any sort of cannibalization risk that comes from the product?

Yeah. So this is Kevin speaking.

First, the reason Helix matters is that, I've done my thousands of hours looking at log files, personally. And the biggest frustration when you're inundated with data is, what alerts matter.

And then for the alerts that matter, give me some context about it, besides bad dot back door, and those AV messages we've gotten for last 20 years that don't enlighten us in any capacity. So first and foremost, we see great value in overlaying our threat context on the alerts from our products and other people's products.

But one of the under spoken things about Helix is, we're trying to automate the countermeasures or automate the defense. You can only automate with high-fidelity alerts.

And this is where FireEye products actually boast great success. We don't have a lot of false positives.

We've invested to make sure we have that fidelity. So I see a Helix sale.

If we sell Helix, and people are trying to leverage legacy technology into it, it is far harder to automate the countermeasures with legacy technologies that don't have the fidelity of the FireEye product suite. So that's where I see it as – if they see the value in the interface and they see the value in our threat intelligence, our threat context and the integration of all these products, it's going to come down to what do they want automate?

Can they do it with the fidelity of their prior technologies? And if they cannot, they'll start leveraging more of ours.

Got it, that's helpful. And then, just as a follow-up.

You guys spoke about a large endpoint renewal opportunity coming, I guess, later on this year. Can you maybe elaborate on that in terms of the cycle, and why you feel your solution is competitive relative to – there seem to be many next-generation endpoint solutions that are out there?

Well, I'll talk about why I feel it's competitive, and I'll let somebody else talk about to the source of that opportunity, but I know, it's there. And I heard, Bill Robbins speak that it could be our first most product-ready technology.

But I've been in this endpoint space since 2004 when I started Mandiant, and we started Mandiant to build the next-gen endpoint. So this has been a long time coming.

What people want on the endpoint is something that detects what AV detects, so you get a check mark in the compliance go box. But then they want to detect what AV misses.

And even the large AV companies over last few years have said statements like, AV is dead or AV isn't as effective as it needs to be. So you got to detect what AV detects, detect what AV misses, in multiple ways, one might be dynamic inspection, one might be machine learning, one might be some kind of other models or algorithms or analytics or even Indicators of Compromise.

But the third thing is that, EDR capability or forensics capability. And we're putting EDR and endpoint protection into the same agent.

And I think that matters. And again, it's because it allows people to inspect systems every time they get an alert.

And I'll expand for one more minute. Most companies that have modern security practices know that when AV triggers, that doesn't mean, Thank God, AV prevented the breach.

What it actually means is, we better take a look at that machine to see what AV misses. And no matter how good everybody gets on endpoint, there's always going to be that mature security operations that need to inspect the alerts to see if anything was missed, and we have that in our endpoint.

So again, we have endpoint protection and EDR and forensics capability and containment on one agent. And I'm not aware of any other organization that has that in one agent.

Bill, there's another part to that question, I thought you're better to answer, which is the second half opportunity for endpoint?

Sure. I think, what we've seen, this is maybe one of the advantages of really having been out there, pounding the pavement trying to strengthen our relationships with our channel community as we talk to a lot of the big distributors out there, I don't need to name them, you all know who they are.

They're the ones that have insight into this, right, because those contracts pass through them. And it's been very clear in those discussions that – that there's a – may be a disproportionate amount of AV business coming up in the second half of this year for whatever reason, the contracts are expiring and coming up second half of this year.

And there's an appetite, I think both within the channel community as well as within customers, too, to explore new technologies, to do more than just traditional AV, as Kevin just kind of walked us through. So when you put all that together, we see a market opportunity that's validated through working with our broad channel (51:05) from distributors all the way through the VAR (51:06) community and it's something that we're going to aggressively take advantage of.

And Jonathan, you gave me an opening, so I'm going to use it. The other reason, when you think you have competitive advantage, you got to look at your team.

And I look at our endpoint team over the last year, and what they've done, we've got a great team. When you have a great team, you get more bullish on it.

We've got some exceptional endpoint talent building that, and our customers have noticed it in the last year. So again, it's built on – I'm confident that we'll be highly-competitive because of the team and the leadership on endpoint as well.

Great. Thank you.

Okay. Thank you very much, and good afternoon, guys, and congratulations as well on a good quarter.

Given that the new strategy as well as the improved product portfolio and channel traction, I was a bit surprised that your new customer account wasn't a little higher.

Yeah.

Can you walk through what you saw there as well as kind of what you expect on new customer acquisition over the balance of the year?

You want to talk to that, Frank?

Yeah. So on the new customer, we did see an improvement in the less than 5,000 employee customer segment, so we are seeing an improvement on the transactional velocity.

I think, Q1 is just an always a tough quarter for new logos. I think we'll see, hopefully, in Q2 that number increasing quite a bit from here.

But I also think if you look at kind of the new product offering, Helix and advanced endpoint really get us into new market segments that I think we can really take advantage of. So we're very hopeful that we'll continue to see traction on the new logo side, especially as we progress throughout the year.

Yeah, Gregg, my conclusion on that was, and I noticed it just like you did, we got to continue all the efforts to improve channel leverage. We've got to get greater reach.

We got to grow broader, and that's why Bill Robbins is part of this call. But we noticed that number and we know, we got to open up more markets and that's why we're also doubling down on endpoint, have been doing that for the last year.

Okay. Perfect.

Thanks. And then just a follow-up on Helix.

It's nice to see it be GA, and I realize, it's extremely early in a very small sample size at that. But is there any more color that you guys can perhaps can provide on the economics for these early adopter customers, and how that perhaps compares with their prior spend with FireEye?

Do you want to comment on it, Frank?

Sure. Sure.

Yeah. Gregg, what we saw in those four Helix deals, two of them were existing customers, two were new logos, that the actual Helix subscription, the amount of pull-through from FireEye as a Service and additional products was even greater than the Helix subscription.

So I think, what you're seeing is that, if a customer were to buy à la carte, all the pieces, it would be about 30% to 50% higher than it is, the Helix subscription. But one of the things that we're really encouraged by is, it looks like customers are – when they're adopting Helix, they're also doing some add-ons on top of that.

So again, the sample set's only four customers, so it's still very early days. But I think, what we're going to see is additional pull-through on the FireEye as a Service and the appliance side as Helix continues to gain traction.

Okay. Terrific.

Thanks very much.

Thank you, Gregg.

All right. Thanks and congrats on the nice quarter.

Thank you, Andrew.

Maybe just a follow-up on Helix, can you just quantify the four Helix transactions and the pull-through as well that happened on the last day of the quarter? I'm just trying to understand whether you would still have exceeded your guidance if Helix was launched a day later?

We would have still exceeded our guidance if – we would have exceeded the midpoint of our guidance if Helix would have actually went GA in Q2. Helix, we were very encouraged that it did go GA in Q1, and it definitely was part of the outperform, but it wasn't the complete outperform.

Okay. Got it.

And then, Mandiant looks like it was down about 8% this quarter, but seems like breach activity is up pretty significantly year-to-date. I'm just wondering, why breach activity isn't necessarily yet for Mandiant?

Yeah, we're digging through all our papers now, Andrew. Thanks you asked the one question, we weren't ready for.

I can speak to some color as we're digging up, because I looked at the Mandiant performance as steady as it always is and we're responding to as many breaches as we always are. And I can tell you, towards the end of Q1, and into April, we were at full capacity.

We had a couple of things that popped up or even I got the inbound phone call for some emergencies. And we just didn't have the staff to work it.

So we're digging it up. Did you get the answer Frank?

Yeah, well, revenue is down a little bit year-over-year, billings is relatively flat year-over-year. And again, that's just timing of the size of the breaches and chargeability and number of consultants.

I wouldn't expect again, that's normally 15% to 20% of our billings, and we'd expect that to fall in that range for Q2 and the full year.

Got it. Keep up the good works guys.

Thanks.

Thank you.

We've got time for one more question, please.

Thanks. I guess, two questions, one for Frank, one for Kevin.

Kevin, on Helix, can you talk about – that product has the ability to pull in third-party information and alerts and so forth and inform it. Can you talk about, what you've seen, I guess, these four deals or what the pipeline looks like in terms of that product's – customers using the product to do that, and as it relates to that third-party role who do you feel like you're winning against?

Because there's other products out there that are doing the same thing?

Yeah. And so on your second part, Walter, I'm not convinced right now, we're winning against anyone in the pull-through of other people's alerts as an SIM, but when all things are equal, the experience that I have on Helix is actually being on the terminal in live environments.

It's too soon to tell for those four customers that they provision all the pieces and get it up and running. And it's been about a month.

And so I'm not sure exactly where they're at today. But I've done my hour-plus on Helix in the last week.

And it's what we can take, I don't know if you want me to nerd out right now, Walter, but we can take Common Event Format alerts. We can take net flow, we can take PCAP.

We can take file objects, we can take a lot of different things into Helix from whatever tech can provide those file formats and do analytics on it and apply threat intelligence to it. So what I see the value of it is, it's a single interface for all of the FireEye products, and just an added bonus, if you're looking at alerts for the FireEye products, it's kind of nice that in that same interface, you can look at alerts from many other product, and that's how you consume our threat context maybe even do some correlation in one interface, return alerts from a FireEye product and somebody else's endpoint tech.

We hope to make all the experiences best with our technologies, but we realize you can't go and rip replace platforms, when doing platform sales all the time. What I really like about Helix is, you can go into an endpoint opportunity, and you can edge out the folks that only have an endpoint in their back pocket.

We've got next-gen endpoint, and we got network sensors that can do in-line blocking. And as far as I know, the fastest dynamic inspection on the planet to detect things no one's ever seen before.

So we can kind of sell a portfolio of things when we're up against the point product organizations that have emerged over the last few months. But we're not replacing SIMs yet, that I'm aware of, and I think that's what you're alluding to, but we have an interface that because it can tap in Cloud MVX and another analytics capabilities, we take far more than just our own alerts.

Got it. And then for Frank, just on the second half I guess, I recall last year you were in a situation where you felt the second half would get better, and it was based on some new product traction that didn't materialize.

I guess, I'm a little bit surprised to hear that a product in Q3, the endpoint, the new endpoint is part of what you're pointing to. Is there something that gives you more confidence and the traction of that product, for example, that's not out or Helix that's a pretty early product in terms of getting to that ramp in the second half?

Sure, Walter. Really, it's the combination of all three.

I think, endpoint being kind of a full AV replacement in Q3. It's not something that we've had before.

And this is something that our current customer base is asking for, and has been asking for. It's a spend line item that they would love to kind of move over to us.

So I think, the timing of that release and the road map, and as we've kind of followed over last couple of months, I think that's given us confidence that, that will be one of the growth drivers. And I think Helix and the NX refresh opportunity are both pretty significantly growth drivers that we really didn't have at the back half of last year.

Back half of last year, we just kind of MVX separation, endpoint was still in the early days, and we didn't have Helix. So I think, the world's changed quite a bit in the last year.

And then also, the continued headwind of a product decline is just much smaller this year than it is last year.

Yeah, and Walter, I have two things to add to that, it's Kevin speak. In my forecast for last year's second half of the year was actually flat over the prior year.

And it was just more of an approach towards how we want to look at guidance. And the second thing is, and from that it takes a lot of appreciate it.

How long it takes to get a coalition and inertia behind a unified product road map. We have that at FireEye, now.

But it took months and quarters to get it when you're taking multiple teams and putting them together. And we got there by the end of last year.

So it took that amount of time. But now our confidence is higher that we're getting the productivity from the engineers because we have a true coalition of folks that believe in what we're doing, and that's just giving us growth in our confidence.

Thank you.

Kevin, would you like to make some closing remarks?

Yeah. In closing, you look at Q1, and I look at where we're at and where we're going, we're doing a nice bridge where we're operationally efficient as we're giving time for our new products to emerge and to build.

I'd like to thank all of you for your time on this call, and I look forward to chatting with you over the next 90 days. Thank you very much.

Thanks everyone.

Thank you, all.