Palo Alto Networks, Inc.

Good day, everyone, and welcome to Palo Alto Networks' Fiscal Third Quarter 2024 Earnings Conference Call. I am Walter Pritchard, Senior Vice President of Investor Relations and Corporate Development.

Please note that this call is being recorded today, Monday, May 20, 2024 at 1:30 P.M. Pacific Time.

With me on today's call to discuss [second] (ph) quarter results are Nikesh Arora, our Chairman and Chief Executive Officer; and Dipak Golechha, our Chief Financial Officer. Following our prepared remarks, Lee Klarich, our Chief Product Officer, will join us for the question-and-answer portion.

You can find the press release and other information to supplement today's discussion on our website at investors.paloaltonetworks.com. While there, please click on the link for quarterly results to find the Q3 '24 supplemental information and the Q3 '24 earnings presentation.

During the course of today's call, we may make forward-looking statements and projections regarding the company's business operations and financial performance. These statements are made today are subject to a number of risks and uncertainties that could cause our actual results to differ from those forward-looking statements.

Please review our press release and recent SEC filings for a description of these risks and uncertainties. We assume no obligation to update any forward-looking statements made in the presentations today.

We will also refer to non-GAAP financial measures. These measures should not be considered as the substitute for financial measures prepared in accordance with GAAP.

The most directly comparable GAAP financial metrics and reconciliations are in the press release and the appendix of the investor presentation. Unless otherwise noted specifically, all results and comparisons are on a fiscal year-over-year basis.

We also note that management is scheduled to participate in the Bank of America Global Technology Conference in June. I will now turn the call over to Nikesh.

Thank you, Walter. Good afternoon, everyone, and thank you for joining us today for our earnings call.

I hope everybody enjoyed our new marketing campaign teaser featuring Keanu Reeves that goes live on national media. Let's start at the beginning and I'll update you on what we have experienced in Q3.

First and foremost, cyberattacks continue unabated. We're seeing a consistent stream of nation-state activity that is systematically looking for software supply chain and hardware zero-day vulnerabilities and attempting to exploit them at scale.

Additionally, there continues to be a robust stream of attack activity targeted at large enterprises and pieces of critical infrastructure. We continue to see high-profile breaches, some of which were widely reported in the press again this quarter.

Most organizations face the challenge of an ever-shrinking time window for a bad actor to enter their environments, find valuable data, and exfiltrate it. The window is now measured in hours.

In comparison, the time it takes for an organization to discover a breach and stop the malicious activity continues to be measured in days and weeks. While not a new phenomena, with new disclosure mandates, this challenge is now clearly out in the open.

With AI, we expect the attacks to come at an even faster pace. I don't need to elaborate on the current enthusiasm around AI.

Almost every one of our customers is either experimenting with AI or plans to deploy some use cases in the near future. As usual, their employees are way ahead.

Almost 50% of employees of most companies are using some sort of AI application, LLM or co-pilot, to explore, learn and make themselves more productive. Whilst this is great for the evolution and adoption of AI, this is introducing a whole new set of threats.

As some of you are aware, we have recently announced a suite of products which are aimed to secure this AI usage by design. More about this later, but I expect this to continue to provide a tailwind to the cybersecurity industry.

On spending for cybersecurity, we see no change of pace or trajectory. Most customers have a series of projects they want to get done, and the only limiting factor seems to be their execution capability.

Customers continue to focus on zero-trust transformations, coupled with the need for new network architectures to adapt to a more hybrid infrastructure. The resurgence of cloud migrations is being driven by the need to get their data in the cloud to be AI-ready, causing discussions around the cloud security platform.

And as you may all have noticed with all the M&A activity, the security operations space is getting rejuvenated, which is something we've been preparing for with XSIAM. At the accelerated pace of change in cyber, even with healthy increases in cybersecurity funding, many organizations aim to simply keep pace with the volume of threat activity they see.

Most cannot do this and are increasingly receptive to a better way of tracking their security challenges -- tackling their security challenges, windows sprawl and architectural complexity. We firmly believe that answer is platformization of cybersecurity over time.

I'm delighted to report, despite the concerns around our platformization approach after our last quarter, the customer feedback has been nothing but encouraging. We have initiated way more conversations on our platformization than we expected.

If meetings were a measure of outcome, they have gone up 30%, and a majority of them have been centered on platform opportunities. In short, demand is robust, and my expectation is that we will continue to see it be that way for the next many quarters.

With this backdrop, we are pleased with our strong Q3 results. As you can see, we delivered top-line growth ahead of the market and continue to drive growth while improving profitability.

Our performance was highlighted by 47% growth in our next-generation security ARR. As we continue to transform our business to a security software business, we saw 23% growth in RPO, an uptick from last quarter.

This translated into 15% revenue growth and 3% growth in our billings. As we have articulated earlier, we don't see the billing metric as a true indicator of business strength.

It continues to be impacted by payment terms where more and more customers prefer annual billing plans. However, if you impede implied bookings, you will note that we saw an uptick over that in the last two -- over the last two quarters.

We actually ended up billing – booking backlog -- billing backlog this quarter. We continue to operate our business efficiently.

Our operating margin expanded by 200 basis points year-over-year, driving 25% growth in operating income and 20% in our EPS to $1.32. Our cash generation was strong and again our GAAP net income grew substantially year-over-year.

Before I continue with highlights from Q3, I'm aware that our accelerated consolidation and platformization strategy created significant conversation last quarter. We have also had questions from analysts and investors on this topic since we reported our Q2 results in February.

I thought I'd share more background on how we got here to provide context and also offer a platformization framework for you to help understand why we're convinced that we can build a much larger business over the next several years and platformization is key to achieving that. When we embarked on our journey to transform our company, we were keen to create interest and convince our customers that we could solve their problems not just with our next-generation firewalls and the associated subscriptions, but also with a set of best-of-breed products across 20-plus categories organized across three platforms.

That strategy was hugely successful and saw us achieving nearly $4 billion in NGS ARR. The majority of focus of our teams was landing multiple products across our three platforms and our customers.

Whether we were able to land at a brand new customer for Palo Alto Networks or we added products from new platforms to our existing customers, we were happy. Landing could range from a single product used in part of the organization to broader usage across the organization.

From that lens, if you look at our top 5,000 customers, we have landed two or more of our platforms at about half these customers, and these customers contribute just over 80% of NGS ARR. If you look at it by -- this by platform, we have landed 97% of these top 5,000 network security, over 20% of them in Prisma Cloud, and over 40% with Cortex.

By all means, our land-the-platform strategy was extremely successful. In landing with multiple platforms, many of our customers have leveraged our capabilities across key cybersecurity buying centers, such as network security, cloud security, and security ops.

Most of this cross platform adoption has happened more organically with customers adopting incremental products on Palo Alto Networks at their own pace. Governed by the complexity of the environment and the friction of dealing with contracts with multiple vendors, not many of our landed customers are fully platformized.

And the ones that are fully platformized, we saw encouraging results. We realized that for fully platformized customers, while they saw better security outcomes, our ARR profile was also very different.

While our average next-generation security ARR for our landed customers ranges from $200,000 to $800,000, for our land strategy, we discovered that our ARR for fully platformized customers ranges from $2 million to $14 million, depending on how many platforms the customers are standardizing on. This drove us to accelerate the rollout of our platformization strategy at the end of the last quarter, following successful pilots earlier in the year.

We created interest in the market, we started conversation with customers looking to begin their platformization journey, and spurring existing sales cycles to a more strategic outcome. Having personally reviewed over 500 of our top customers in detail this past quarter and having had a few hundred conversations with CSOs, CIOs and CEOs, I continue to be convinced of our opportunity to deliver full platformization to our strong -- to our top customers.

We're still early in the results from full platformization. Across these top 5,000 customers, we have completed about 900 through Q3 2024.

Our Q3 efforts resulted in approximately 65 incremental platformization sales in Q3, which is up 40% since Q2. It was this framework that was the foundation for our goal of $15 billion in next-generation security ARR by fiscal year 2030 that we first discussed last quarter.

With our incremental momentum in platformization, we see a runway to delivering approximately 2,500-plus platformizations sales, up from the current 900, while continuing to land our multiple platforms in our customer base and adding new customers. I showed you the benefits we see in our ARR from our success-driving platformization.

Our customers also see significant benefits as they adopt our full platforms. We have talked to you in the past about reduction in median time to resolution with XSIAM, which takes less than one-tenth of the time it took before XSIAM was deployed, as customers platformized on Cortex.

IDC recently validated the benefits platform customers see in a study published earlier this year, independently proving much of what we have talked about. Customers saw productivity benefits, as much as 30% to 40% efficiency improvements and significant improvements in security outcomes.

I could talk further about the benefits, but what really brings us to the forefront is some examples of our significant transactions in Q3. A U.S.

county agency signed a seven-figure transaction, landing our firewall subscriptions as well as Cortex XDR and becoming a Palo Alto customer for the first time. We displaced a competitor that had sold both of these capabilities to the customer and competed against on -- us on an appliance vendor that could not offer best-of-breed capabilities across these two categories.

A large U.S. financial services company that was an existing platform customer faced significant challenges in their SOC.

Despite a staff of 40 in the SOC, they were not achieving their goals and sought a transformation plan. We signed an eight-figure deal including XSIAM, our ITDR, or identity threat detention and response, offering, and our managed detection and response service.

A global data services provider was unhappy with his incumbent SASE provider facing outages that created lost productivity. It was also never able to integrate its VPN and URL filtering capabilities fully.

The customer selected our SASE capability for approximately 65,000 mobile and branch office users, including CASB, DLP, enterprise browser, and ADEM capabilities for many of them. This was a highly competitive situation, but our ability to deliver consolidated capabilities through a platform across a half a dozen areas as well as our superior security versus incumbent won us the business.

Finally, a large healthcare company experienced a breach and engaged our Unit 42 Incident Response Services. After we helped the customer remediate and get back online, we were able to educate the customer on the benefits of platformization.

The customer fully platformized with us, standardizing on network security, Prisma Cloud, and Cortex. This transaction was the largest in the history of Palo Alto Networks at nearly $150 million of TCV.

Beyond these showcase deals, our overall large deal activity was healthy in Q3, as shown by significant increases in our accounts with transactions over $1 million, $5 million, and $10 million in the quarter. We also recently announced our partnership with IBM.

IBM and Palo Alto Networks have done what in my mind is a one-of-a-kind partnership. This partnership involves migrating the QRadar customers of IBM to XSIAM, where IBM will be able to deliver industry-specific capabilities on XSIAM using watsonx.

Given their leadership position on the Gartner Magic Quadrant, now we can collectively deliver an even better solution to both their existing and new customers. Enabling over 1,000 IBM security consultants on the entire Palo Alto Networks portfolio will allow us to drive platformization in an accelerated fashion.

We will be IBM's preferred cybersecurity partner across network, cloud, and SOC, while driving a significant book of business for IBM. Additionally, IBM will platformize on Palo Alto products.

It will extensively leverage watsonx across both our operations and products. And lastly, but not the least, we will work on co-developing solutions for cloud security.

Last quarter, when we rolled out our accelerated consolidation platformization strategy, we also activated our AI leadership strategy. Leading up to this, over the last year, we've oriented an increasing portion of our R&D investments towards AI.

We have seen growth in customer interest and adopting AI to drive business value and bad actors using AI, as I discussed earlier. In early May, we announced our comprehensive suite of AI security offerings and believe we will be first to market the capabilities to protect the range of our customers' AI security needs.

We rolled out three products to safely enable the use of AI from employees using AI to enterprises building AI into their applications. AI Access Security, AI SPM, and AI Runtime Security put us at the forefront of securing AI adoption.

We also believe our co-pilots across our three platforms, which are context-aware, can perform and automate user action, surface alerts and best practices, and provide in-product support all with near-perfect accuracy. Furthermore, we announced our Precision AI Security Bundle to leverage inline AI to counter AI attacks with AI Defense.

We have had strong early customer engagement with these offerings, which you expect to be made generally available beginning of July. As you heard from our teaser trailer with Keanu, this isn't sci-fi, this is precision AI.

More broadly than AI, it has been a busy last three months from an innovation perspective. On our SASE 3.0 launch, which we rolled out early this month, debuted with several unique industry-defining capabilities.

We announced industry's only secure enterprise browser integrated into SASE, and as end-user engagement with AI applications grow, the browser becomes an important defense layer against AI threats. Additionally, it is becoming clearer that the browser offers a better way to secure contractors, mobile devices, and managed devices, with SASE integration providing a simpler and more secure approach to adoption.

We launched AI-powered data security integrated into SASE, leveraging industry's first LLM-powered data classification. This new classification engine combines the strength of context-aware machine learning models with the power of LLMs, understanding how to increase classification accuracy.

Lastly, as part of our SASE 3.0, we launched application acceleration, which understands each user's journey within an enterprise SaaS and cloud applications and optimizes performance for these applications. Customers see performance up to 5 times faster than the user experience in the general Internet.

This rapid cadence of innovation in SASE has enabled us to maintain SASE ARR growth above 50% for the sixth quarter in a row. At Prisma Cloud, we have completed the first phase of rollout of data security posture management, which came from the Dig Security acquisition.

We also added support for more than 100 new APIs across the major hyperscalers to stay ahead of our customers by securing the cloud services [they were talking] (ph). Based on our Cortex Xpanse technology, we did launch Cloud Discovery and Exposure Management, leveraging our Xpanse data natively in Prisma Cloud.

Over 100 customers now use this capability to evaluate Internet exposure risks and discover unknown Internet exposed cloud assets. Also during Q3, we launched CDR, Cloud Detection and Response, which extends our XDR capability into the cloud and give customers a unified view of their entire environment from cloud to endpoint to network.

CDEM and CDR show the power of having both Cortex and Prisma Cloud platforms, as we can leverage these sophisticated capabilities to benefit cloud customers. Last but not least, on Cortex, we launched XSIAM about 18 months ago, and this offering has already elevated the profile of Cortex in the market.

We see steady demand for XDR, the foundation of Cortex, where we are landing many new customers, and now we have north of 5,800 customers on XDR. With $400 million in cumulative XSIAM bookings coming out of Q3, this offering is really going mainstream with customers understanding the value proposition versus the traditional SIEM.

XSIAM has accelerated our Cortex ARR growth and we continue to see a strong pipeline of opportunities. We are converting our innovation into recognized leadership, adding two new positions this quarter.

One was in managed detection and response, the other in data security posture management, leveraging our Dig acquisition and demonstrating our ability to acquire technology and rapidly integrate into our platforms. As many of you have undoubtedly seen, our rollout of platformization has stoked a long-standing debate within the cybersecurity industry about whether customers desire a platform or best-of-breed cybersecurity.

From the Palo Alto Network's perspective, we've proven it is possible to deliver best of platform. This is why we have invested in building leading products and we have now recognition for product leadership in 23 categories while also delivering on the benefits of integration across all three platforms.

To summarize, before I pass off to Dipak, please take away a few conclusions from my prepared remarks. One, we put out strong Q3 results in a positive spending environment where cybersecurity priorities are well funded.

Beyond the continuation of a challenging threat environment, new threat vectors from AI are starting to surface as the usage of AI grows. We've been pleased with the initial traction of our accelerated consolidation platform strategy.

This drove an increase in bookings, with deferred payments and impact on our billings, something we expect will continue. We had a big quarter of innovation, especially as it relates to AI, where we strive to lead the industry in securing this powerful productivity medium while also doing so comprehensively.

As we look forward, we have significant pipeline heading into our largest quarter of the year. We're just beginning to see the benefits of platformization accrue to our business.

We will continue to make further investments here while balancing delivering profitable growth and have chartered a path with conviction towards being a $15 billion NGS ARR company. With that, let me pass you on to Dipak.

Thank you, Nikesh, and good afternoon, everyone. To maximize our time spent on Q&A, I will provide highlights and you can review results available in our press release and the supplemental financial information on our website.

Within our revenue of $1.98 billion, product revenue grew 1%, while total service revenue grew 20%. Within services revenue, subscription revenue grew 25% and support revenue grew 11%.

Moving on to geographies, we saw revenue growth across all theaters, with the Americas growing 15%, EMEA up 20%, and JPAC growing 8%. This quarter, our lower JPAC revenue growth was driven by lower product bookings in the region, offset by higher subscription bookings, which benefit revenue over time.

We reported Q3 billings within the range we guided, although as Nikesh and I have noted several times in the past few quarters, we continue to focus less on this metric. We saw an increase quarter-over-quarter in business transacted with deferred billings, which was also higher than we forecasted.

The impact on our financials from platformization this quarter was in line with what we expected 90 days ago, and our expectations around the impact in Q4 and beyond is unchanged from what we talked about in February. First, we saw a greater volume of large deals with some of these customers opting for deferred payments over the term of their purchase, instead of paying upfront as they grapple with the higher cost of money.

This drove the quarter to quarter increase in periodic billing plans that I noted. Also, this level of periodic billings was higher than we forecasted 90 days ago.

We also saw an uptake in the array of our platformization programs we launched early in the quarter. These programs continue to ramp up as we roll them out broadly.

Within our RPO of $11.3 billion, our current RPO was $5.4 billion. Our average duration of new contracts increased slightly year-over-year, but remained at approximately three years.

On our balance sheet, you will see that our debt balance came down by $659 million. The driver for this was early conversion, which occurred at the option of the debt holders and was settled by us in cash.

Our remaining debt matures in June 2025, although we may continue to see early conversions. During Q3, we spent $500 million to repurchase 1.7 million shares of our common stock.

Our buyback strategy remains opportunistic. I know that billings has been a significant focus for investors.

As you're all aware, remaining performance obligation, or RPO, captures the full value of our contracts, independent of customer billing terms. As we have explained to you over the last year, with an increase in factors impacting payment terms on a quarterly basis, there's been significant volatility in our billings.

With this volatility in mind, we've been increasingly focused on driving high-quality bookings, which add to RPO and maximize our NGS ARR in contracts. Focuses on these metrics provides a more relevant view of the business.

If we look at the history of these metrics for our company, you see that NGS ARR has consistently grown ahead of our other metrics and as it continues to contribute a higher proportion of our revenue. You also see the correlation between RPO and total services revenue growth is high.

Our RPO is mainly comprised of contracts for offerings that carry ratable revenue, which are recognized through our total services revenue. Billings, on the other hand, is significantly influenced by the invoicing terms on contract signed, which adds significant volatility.

In Q3, we saw RPO growth tick up, along with strength in NGS ARR, including us raising our guidance here. This is in contrast to billing trends which went the other direction, thereby showing the divergent trends in action our Q3 results.

Nikesh talked briefly about our first-of-a-kind IBM partnership that has multiple facets that touch each of our platforms and include significant devotion of resources from both companies. I'd like to provide more details on the financial impact we expect to see.

As part of the partnership, we've agreed to acquire IBM's QRadar SaaS assets, certain QRadar intellectual property, and IBM's on-premise QRadar customer list. The total consideration is $500 million plus earn-out consideration based on successfully migrating QRadar on-premise customers to our XSIAM offering over the next several years.

We anticipate closing the transaction by the end of September 2024, subject to regulatory approvals and other customary closing conditions. The calendar year 2023 QRadar SaaS revenue was on the order of $100 million.

However, as we work through details of the customer contracts we are acquiring and the deferred revenue associated with this business, we expect our recognized revenue could be much lower than this in our fiscal year 2025. We will provide more information on the financial impact closer to the close of the transaction.

We will invest to fuel this partnership and ensure a seamless experience for QRadar customers purchasing and migrating to XSIAM. As part of the partnership, we have entered into an agreement with IBM whereby they will operate parts of the business on our behalf on a medium-term basis.

We expect we can make these investments within the profitability framework we spoke of previously. Specifically, we continue to expect 28% to 29% non-GAAP operating margin in fiscal year 2026 and 37% or greater free cash flow margin through fiscal year 2026.

Before I provide Q4 guidance, I wanted to remind you of what we talked last quarter when we introduced platformization and discussed the top-line headwinds we expected it would have. We continue to expect platformization-related drivers, both larger deals with associated cost-of-money impacts and acceleration in platformization programs, will impact our billings over a total of a 12- to 18-month period.

Consistent with what we noted in February, we expect that this will persist through fiscal year '25 as we anniversary the rollout of these programs and resulting in lower billings and, to a lesser degree, revenue. Beyond this period, we expect to grow faster than we discussed in August and sustain this growth for longer.

Now moving on to our guidance for Q4 and the year. For the fourth quarter of 2024, we expect billings to be in the range of $3.43 billion to $3.48 billion, an increase of 9% to 10%.

We expect revenue to be in the range of $2.15 billion to $2.17 billion, an increase of 10% to 11%. We expect non-GAAP EPS to be in the range of $1.40 to $1.42 a share, a decrease of 1% to 3%.

For the fiscal year '24, we expect billings to be in the range of $10.13 billion to $10.18 billion, an increase of 10% to 11%. We expect NGS ARR to be in the range of $4.05 billion to $4.10 billion, an increase of 37% to 39%.

We expect revenue to be in the range of $7.99 billion to $8.01 billion, an increase of 16%. For fiscal '24, we expect operating margins to be in the range of 26.8% to 27.0%, an increase of 270 basis points to 290 basis points year-over-year.

We expect our non-GAAP EPS to be in the range of $5.56 to $5.58 per share, an increase of 25% to 26%. And we expect adjusted free cash flow margin to be 38.5% to 39%.

In the interest of time and to get as many of your questions as possible, we've included the modeling points in the appendix of our earnings presentation. With that, I will turn the call back over to Walter for the Q&A portion.

Thank you, Dipak. To allow for broad participation, I'd ask that each person only ask one question.

The first question will be from Brian Essex at JPMorgan, followed by Brad Zelnick at Deutsche Bank. Go ahead, Brian.

Brian, you're muted. Brian, you're muted.

Brian, looks like you're on mute.

There we go. Yeah, it wasn't letting me unmute myself.

So, thank you. Thank you for letting me take the question.

Yeah, I guess for Dipak, as we look at your efforts of incentivizing platform consolidation or platformization, I mean, obviously you've talked about the pressure on the last two quarters of this year. Can you maybe help me understand the duration that you anticipate pursuing these efforts?

Is this going to be a more temporary type of effort where it kind of just lasts through this fiscal year, or do you expect it to stretch into next year? Thank you.

Yeah. So, thanks for the question, Brian.

Look, I think we will -- I mean, platformization is something that is now our strategy, so I think in that sense it will continue for a while. But at some point, it just becomes a normal motion, and then we're lapping a period where we've been doing platformization already.

So, really, what you're seeing in the financial metrics is the difference when it wasn't the normal motion and then it becomes the motion, and then in the future, it will just become lapping what is a consistent motion.

I think in that context we said last quarter that this should persist till the end of Q2 next year. We currently started Q2 this year.

That's helpful. Thank you for the clarification.

Thanks, Brian. Next question is from Brad Zelnick followed by Hamza Fodderwala from Morgan Stanley.

Go ahead, Brad.

Thanks very much. Thanks for taking the question.

Nikesh, I was hoping you can give us an update on the state of the channel. There's a lot of noise from the traditional VAR channel.

I wanted to get your sense on how they're acclimating to platformization, but you're also doubling down with the GSIs. You announced this super special deal with IBM.

You also signed a deal with Accenture, too. We'd just love to hear your latest thinking in a particular more on the GSI strategy.

I mean, how many more can you add that are up at that level of an Accenture and an IBM? Thanks.

Well, first of all, thanks for the question. Look, I don't think there is contention between the two channels.

We still do IBM deals with a traditional VAR involved. Very often the VAR has -- represents the customer, helps to clear the deals, helps them work through all the financing, et cetera.

So, there is a role for both. What we are discovering is in platformization deals, customers require consulting effort to re-architect the entire security stack.

And typically, they engage with the SI community or GSI community first to try and do that transformation and partnering with them hand in glove allows us to be part of that story. As I gave the example, when we did the most recent, let's just say, re-architecture, which we had to do in a hurry in the case of a recent hack, we were working with SI partners as well as other incident response teams to make sure that we build an architecture that's consistent with what the end state needs to be.

And that's where partnerships like Accenture and IBM become really worthy and important because the customer is relying on them to do the heavy lift and doing the one-time transformation. So, I think both these strategies will co-exist.

As you know, we still have a substantive hardware business, which we also work through the traditional channel. We also have -- actually to be fair, many of the VARs have transferred or translated their businesses into a part consulting model where they also work with customers of transformations.

I don't think they're contentious. I think it becomes harder for the analyst community to be able to track what the channel status of a company is because the SIs are not as sharing as the traditional VAR channel is.

Thanks very much for the color, and I love the pullover. That's a good one, Nikesh.

Thank you. I appreciate it.

I need some color in the day.

Thank you.

We had a great quarter.

Thanks, Brad. Next, we'll go to Hamza Fodderwala from Morgan Stanley, followed by Matt Hedberg from RBC.

Go ahead, Hamza.

Hey, good afternoon. Thanks for taking my question.

Nikesh, in the earnings presentation, you mentioned you see significant pipeline heading into your fiscal Q4. I was wondering if you could give us a little bit more color into that pipeline?

Because the Q4 billings guide does suggest a big sequential uptick as is usual, but I think this year a little bit higher than normal. But any color you can give will be helpful.

Yeah, Hamza, look -- first, thanks for the question. As I mentioned in our prepared remarks, we have been reviewing all of our customers.

We have been through 500 of them with the account teams. And every customer, there is an opportunity.

There's an opportunity to deliver a platform, there's an opportunity to consolidate. And just that gives us hope and sort of some degree of conviction that there's a lot of business to be converted out there.

It's really limited by the customers' speed and desire to execute or the resources to execute. So, we have a robust pipeline across most of our platforms to see, question is can we go out and convert as quickly as we need to, and that's what we're guiding to.

Thank you.

Great. Thanks, Hamza.

Next question is from Matt Hedberg, followed by Tal Liani from Bank of America. Go ahead, Matt.

Thanks, Walter. Yeah, and Nikesh, I think we are on the same wavelength here on the color.

Good choice. I wanted to ask about the federal side.

Last quarter you mentioned Thunderdome. Any update on that transaction?

And just kind of how we're thinking about federal into 3Q -- or excuse me, your 4Q?

Yeah, that's a good question. Look, the Thunderdome contract got activated last quarter because of the zero-day vulnerability we found in certain VPNs out of the market.

So, they wanted to quickly replace some of the VPNs because they were required to replace them in the classified agencies and non-classified agencies. So, we saw some activity around Thunderdome and that contract was activated where people used that contract that we have with DISA to be able to execute some transactions.

But we still maintain. These are going to get one at a time, each of these missions are going to execute one at a time.

So, we haven't changed our expectations in terms of how Thunderdome will evolve vis-a-vis how we will see it in our financials.

Thank you.

Great. Thanks, Matt.

Next question from Tal Liani at Bank of America, followed by Saket Kalia at Barclays. Go ahead, Tal.

Hi, guys. I know we don't focus on billings, but I have a question.

Just first to clarify...

You do.

Just to clarify, you -- if you won -- you said in the prepared remarks you won a $150 million deal. Does it include -- does it go through billing and should we exclude it from billing on a normalized level?

Just to understand the impact on billing this quarter. And then, billing is -- it's going to recover because I'm going to ask it, not say it, but how -- what's the path for recovery for billing?

If investors are looking at it and you look out into the next year or two years, what's the path for recovery of billing's growth?

Well, Tal, I think if you listened carefully to what I said, we actually built backlog this quarter, which means we booked a lot more business than we built, which is the difference between contracts where we chose not to take their payment terms and just do annual billing. So, we're signing big deals.

We have a lot of business that we're signing, and the way it gets reflected is in RPO. It depends on what we choose to either take as annual billings or to take through PANFS, right?

It shows up in billings. What we choose not to take ends up in future or deferred payment plans or deferred billing.

So, I think if you look at the implied bookings, you'll see there's a double-digit number in there in the quarter. I just think billing is an artificial metric.

I think I understand you guys like it because it's been around for a long time. I think the cost of money has changed the quality of that metric.

To me, a quality metric is implied bookings or RPO. And in both those, as I mentioned, we saw an uptick this quarter.

So, we actually believe we saw a recovery faster than we expected this quarter. That's why we're surprised at the reaction of the market.

Great. Thanks, Tal.

Next up is Saket Kalia from Barclays, followed by Gabriela Borges from Goldman Sachs. Go ahead, Saket.

Okay, great. Thanks, guys, for taking my question.

Nikesh, maybe the follow up is on that point.

I like your color. That blue is very nice.

Thanks, buddy. I appreciate it.

So, just to that point, it was great to see RPO bookings, I think, actually accelerated year-over-year in this quarter, right? So, last quarter, I think we talked about more flexibility for customers with platformization, right, just consolidating and creating some of those [ramp] (ph) contracts.

How much did that sort of play into the difference between bookings and billings?

Well, remember, the acceleration -- the ramp contracts really impact us in the way that we have higher exit ARRs than many of our newer contracts, right? So, with year one ARR may be lower than the year three ARR for a contract.

But that is not visible to you yet in the numbers because there's no way to represent that, right? The only way you'll see it, you'll see it in a consolidated TCV deal which is going to show up in RPO.

So, the ramp contracts show up as a total wholesome in the RPO number and you're seeing an uptick in the RPO number which tells you that business is stronger this quarter than we expected it to be. I think the only difference is we chose not to take -- remember, when a customer says I don't want to pay you upfront, you have no choices, you can take annual billings or you can get them financing through PANFS, right, where it takes away from revenue and becomes interest income.

And then, we decided we didn't want to take so many of these deals. So our quantum of deferred billing went up compared to last quarter.

Got it. Very helpful.

Thank you.

Great. Thanks, Saket.

Next question, Gabriela Borges from Goldman Sachs, followed by Gray Powell from BTIG. Go ahead, Gabriela.

Hi, good afternoon. Thank you.

I'm going to ask on the $15 billion NGS target for fiscal year '30. Either for Nikesh or Dipak, a little bit of color on how you arrived at that number?

There's an interesting footnote here on assuming 5% annual growth per customer. And then, within that target, how do you think about cyclicality?

Any comments on the cyclicality of firewall or the cyclicality of platformization impacting the linearity of getting to that target? Thank you.

Yeah, two things. One, the firewall is not in there.

That's hardware. That's not next-generation security.

The services that work on top of firewalls are obviously in there, because they're all now AI enabled and next generation. Cyclicality is consistent with our cyclicality of our quarters, right?

We see more business in Q4. You should expect more platformization deals in Q4, hopefully higher growth in NGS ARR, which you're used to.

I think the cyclicality of that slide is no different than the cyclicality you've seen in the growth of NGS ARR over the last three years that we've been sharing that number with you. Yeah, sorry, was there another part?

Yeah. Just on the footnote here on the 5% within...

Yeah. So, what we've discovered...

Yeah, benchmark that for us.

Well, what we've discovered is as platformization grows for a customer, as renewals come up, we're able to upsell them more capability. For example, in SASE, now we can sell them ADEM and AIOps.

For example, in our firewalls, we can send them 10 subscriptions. For example, in Cortex, now with XDR, ITDR, we can sell them CDR.

In Access, we will be able to sell them in AI Access. So, every time these deals will come up for renewals, we will have the opportunity to present more services and capability onto the platform with the customer driving NRR for us.

So, we've made a simplistic assumption that the combined effect of NRR is approximately a 5% increase in ARR or the course of those years.

Got it. Thank you.

Thanks, Gabriela. Next question, Gray Powell from BTIG, followed by Gregg Moskowitz from Mizuho.

Go ahead, Gray.

Okay, great. Thanks for taking the question.

And it was good to hear the 50% growth on Prisma SASE this quarter. So, a question on Secure Service Edge.

If I look at industry analysts estimates there, I think Secure Service Edge is probably about 25% of the network security market today. Give or take, that's rough.

I'm just kind of curious, where do you think that penetration goes in maybe three or four years? Or maybe said differently, how should we think about the growth profile of that market going forward and your ability to grow at or above that?

Yeah. Look, I think it's important to start with a view on this that the market will be hybrid for a very long time, meaning customers will need a combination of hardware form factors, software form factors, and SASE.

And the reason for that is campuses still exist and hardware is still the fastest approach to this and public and private cloud software-based approaches are the best. SASE comes in with all of the remote users and branch offices.

And so that hybrid nature from our perspective means that the customers will increasingly choose to go with a platform-based approach where they can shift traffic across those different form factors as is optimized for that form factor. And so, some of the SASE growth that you've seen, and you've seen it with us, where 50% growth with SASE over the last several quarters, is showing that that portion of the architecture is going to grow faster for some time, and then ultimately see this come into the total growth of the platform being what really matters.

And then, on top of that, we can deliver the security services, such as the newly announced AI Access Security, across all of those form factors.

Okay. Thank you.

Thanks for the question, Gray. Next up, Gregg Moskowitz from Mizuho, followed by Fatima Boolani from Citi.

Go ahead, Gregg.

Okay. Thanks, Walter.

Thanks for taking the question. Nikesh, in order to reach your fiscal '30 goals, it looks like you'll need to sign an average, give or take, of around 75 new platformization deals per quarter, a little higher than what you did just in Q3.

But if we're in the early days of this strategy and if you're just now building your go-to-market muscle around this, why shouldn't new platformization customers be a lot higher than that on a multi-year basis? Thanks.

Look, we told you last quarter we're going to do a platformization. I have to say, I have to commend our team.

We spent a lot of time over the last 90 days working hard on analyzing all this data to make sure we could give you a framework so you can look at it and measure us over the next few quarters as we show you the benefits of platformization. So that's one part.

The other part is like it's positively surprised, a good thing that we've got 60-plus deals done in this quarter. We'll see what happens in Q4.

We've just started going down this journey, and of course, if prospects get better, we'll be happy to update our targets in the future. But for now, that seems like a robust goal that will still make us the first company in the history of cybersecurity to ever get anywhere close to that kind of aspiration and number.

Thank you.

Great. Thanks, Gregg.

Next up, Fatima Boolani from Citi, followed by Shaul Eyal from Cowen. Go ahead, Fatima.

Thank you. Good afternoon.

Thank you for taking my questions. Nikesh, you talked a lot about the multiplicative impact and the monetization acceleration you can get from platformization.

I'm curious if we can put a profitability lens on this, because you are driving between $2 million and $14 million of the ARR you mentioned from a platformized customer. But from a contribution margin perspective, can you share with us what that incremental profitability impact would be like?

And why should we sitting here not think that's structurally your business as it moves towards being increasingly consolidated can see 30%, 35%, maybe even 40% operating margins?

Look, Fatima, in concept, principally, I have no argument against what you're saying. Because remember, if you look at an average enterprise company's P&L, the largest cost is sales and marketing, right?

Gross margins are, give or take, 75% to 80%, take your favorite enterprise company. That leaves you most of your costs are -- majority of the costs are sales and marketing.

If you can consolidate and concentrate your sales and marketing costs to very large deals and be able to generate large amounts of ARR or ACV/TCV, those customers, the cost of sales, the proportion of your revenue goes down. As you are constantly upselling into the same customer base, it also makes it a little easier.

So, I think our opportunity is to first create enough breadth in our sort of coverage to make sure that we can actually go address all these landed customers. We've only done 900.

We said we've got to get north of 2,500, which means we have to go address a lot more customers than our existing landed base. We don't have to go make new friends, we just have to go work with our existing friends.

But yes, in the long term, I have no argument against your thesis that this should allow us to continue to aspire to higher profitability, not counting the impact of AI, which should get us to be a much more productive organization over the medium term.

Thank you.

Great. Thank you, Fatima.

Next question, Shaul Eyal from Cowen, followed by Andy Nowinski from Wells Fargo. Go ahead, Shaul.

Thank you. Good afternoon, guys.

Question for Dipak or Nikesh on finance receivables. So, finance receivables up 34% sequentially.

I know you don't guide, cannot guide this metric. If we look into next quarter and take into account your commentary about the strong pipeline, will we be seeing the finance receivables still expanding?

Or maybe asked differently, will there be a point where would you like to see that this metric actually decelerating to a degree? What's the thinking along these lines?

Yeah. So, I think -- thanks for the question, Shaul.

I think as a business grows, like having tools like PANFS can only help you. And if that's what the customer is looking for in terms of deferred payment plans, I think -- I don't have a problem if it goes up because it just ends up giving you even more like knowledge of what your cashflow will be in the future.

Like, so all of that receivable, we can collect it eventually. Honestly, I think more of it is related to the cost of money than anything else.

So, I think this becomes a larger issue in the current environment where interest rates are higher, I think if we're in an environment where the interest rates would go down, that's when I would expect this to potentially ratchet down.

Great. Thanks, Shaul.

Next up is Andy Nowinski from Wells Fargo, followed by Joe Gallo from Jefferies. Go ahead, Andy.

Okay. Good afternoon.

Thank you for taking the question. So, I wanted to ask you about the IBM deal.

What was the impetus for acquiring those assets? Because it looks like their SaaS revenue is pretty small at $100 million.

And given how well XSIAM is doing, couldn't you just capture those on-prem customers for free over time?

Hey, Andrew, there's more than that. Remember, we explained to you that part of platformization is going to be able to transition customers of their existing contracts.

Now the good news is we can transition these customers irrespective of term when they expire. That's great option value.

I don't have to wait for three years to migrate them. I don't have to wait for an RFP.

I can just walk up to them saying, "Listen, you're already my customer now, because I've acquired the contract. Why don't you come, we work on transitioning to XSIAM?"

Not only that, it also allows the opportunity not just to go after the SaaS customer base, but also allows us to transition the on-prem customer base, which is a much larger prize, where IBM has economics from us, where they're able to transit -- they will get earn out based on how many of those customers transition to us. So, I mean, honestly, I think it's an amazing deal for us.

I'm just delighted that IBM agreed to do this deal with us and partner with us. And also it gives me access to -- look in the history of IBM, they have not sold anybody else's cybersecurity portfolio with the enthusiasm we hope we can generate together for the thousand cybersecurity sellers.

Until now they would sell one portfolio that was IBM. And today, this deal allows us to train all of them, all thousand of them, work with them on XSIAM and get it out to customers.

I think it hopefully cements our place in the SIEM/SOC category at a pace that nobody would have anticipated, right? Until yesterday, there were three players in the Magic Quadrant, which was not us.

This allows us to participate with one of the biggest players in the space and migrate as many of these customers based on merit and based on great proposition as quickly as we can.

That makes sense...

That's [$5 million] (ph), and I didn't have to spend, what was the number? Never mind, I won't quote a large number.

I didn't have to sell many, many, many billions of dollars and transition to the customers then.

Got it. Thank you.

Great. Thanks, Andy.

Next up, Joe Gallo from Jefferies, followed by Ben Bollin from Cleveland Research. Go ahead, Joe.

Hey guys, thanks for the question. I want to follow up on Fatima's question.

I don't think many disagree with the strategic long-term potential of the platform or the ensuing financial strength, but when you look at fiscal '25 specifically in free cash flow being 37%-plus margin there, how should we think about the visibility or durability of that free cash flow margin, given what's impacting you now with deferred payment terms, discounting, fatigue, hardware digestion should in theory impact you for a couple of quarters next year? Thanks.

First of all, do not introduce the word fatigue in our conference call. Secondly, as it relates to the free cash flow margins, I'll let Dipak jump in in a minute.

But it's the fine balance of making sure that we can let our annual billings continue to grow as a proportion, because we think this interest rate environment is here to stay and we can manage our free cash flow margins at the same timeframe. The good news is because of nicely increasing profitability that allows us to have the capability to let our annual billings continue to get bigger and bigger, because eventually that's what gets you.

Take the extreme example on either side. The other side extreme example is a SaaS company with annual billings, which can go back to the same degree of free cash flow margins that they have.

So, our opportunities to see if we can migrate our customers to more and more annualized billings and continue to maintain the margins without creating a kink in there. That's what Dipak is very focused on.

I don't know if there was something you want to add to that, Dipak.

No, the only thing that I would add is like, look, the more that you do deferred payments now, the more you actually understand your waterfall of what will come afterwards. So, as long as the shift doesn't happen all at once and it's a gradual shift that you're managing, it actually gives you even more certainty than less certainty in your ability to deliver.

So, happy to talk offline about how we see that and why we believe that, but I think the data doesn't lie there.

Thank you.

Thanks, Joe. Next, Ben Bollin from Cleveland Research, followed by Jonathan Ho from William Blair.

Go ahead, Ben.

Thanks, Walter. Good afternoon, everyone.

Thanks for taking the question. Nikesh, one of the initial attributes around platform seems to be the potential for free use periods and as companies displace other vendors.

Could you talk about what you've seen from the use -- those free use periods in those first 60-plus deals? And then maybe Dipak, could you talk through a little bit about what it means for revenue, RPO, ARR, billings, and like how that waterfalls over time?

Thanks.

Yeah. So, in the first 50 or 60 deals, I think we've got a little sort of portfolio of all kinds of stuff that's happened.

There are some customers we've had to basically wait for six months to be able to charge for our services because they have an existing contract and we start implementation, so we wait that period out. Typically, those deals where we end up waiting out, end up with longer duration, because we don't want to give away that period over a shorter period time.

So, you'll see that those deals are north of three years, in the case we end up giving some sort of free use period. In smaller situations, sometimes we'll provide migration services, which allows them to get off an existing solution and move to Palo Alto as quickly as possible.

And remember because most of these implementations have some sort of ramp element, nobody goes and deploys 65,000 endpoints and turns them on in one day. Typically, it takes them three to four months internally to deploy those.

So that actually doesn't impact us from a COGS perspective as much. It allows them to have that execution flexibility which you've always talked about as part of platformization.

So, I think we've seen all variants, and I'll say right now, we're seeing more of an impact on our business from deferred payment than we are from the free periods, to be honest, right? In every case, we're trying to make sure the exit ARR is what we want from that customer.

So, ARR we expected to ramp in some of these deals, which are three to five year duration where we provided free periods. But we're still, as I said, more impact is from the billing's deferral and annual billings than it is from free periods right now.

And we'll know better after Q4 because you'd expect the volume of Q4 business given the expectations on numbers should be substantially more than Q3.

Great. Thank you, Ben.

Next question, Jonathan Ho from William Blair, followed by Joel Fishbein from Truist. Go ahead, Jonathan.

Good afternoon. As you add more AI capabilities to your platforms, what are customers looking to benefit from, and how do we think about the monetization opportunity here?

Thank you.

So, I think if you look at some of our products as we articulated, there are three specific products we announced at RSA. And then, we said all of our co-pilots will be available and already are available to customers for beta reasons.

And then, we have underlying capabilities in our products which are AI enabled. Now, in most of our advanced services on firewalls, and I'm making a broad statement here, so we've increased prices from 20% of the cost of firewalls to the sub to 30%.

So, we have had an uptick in AI-delivered services on the firewall, and the customers see the value and majority of customers have opted into that capability which we've had for the last two or three years and today we've just launched the most recent one, which is Advanced DNS which will also be uptick to a 30% instead of 20% subscription. AI Access will be sold as an incremental capability and incremental subscription for all of our VPN and for our SASE customers.

So, you will have monetization capability there. AI Firewall would be, again, an uptick on our virtual firewalls where you have AI capabilities so you'll pay a premium to protect AI installations over a traditional VM.

We're still debating whether we provide AI SPM to the market, which is effective in security posture management capability as part of our firewall optionality or we charge for it separately. We will do that closer to when we launch the actual product towards July.

Our co-pilots are for the most part available to our customers as a productivity tool, as an enhancement tool. In certain cases where we require them to ingest data to get advanced telemetry, they would have to buy the advanced telemetry module to make the co-pilot even more useful for them.

So that's roughly the lay of the land. But one should expect that there should be three capabilities.

One, better productivity for our customers, so they don't have to understand more complex UI. Two, they will have to pay certain more -- some on more in certain use cases where they are getting incremental value and we're making incremental effort from them.

Then three, they might require to upgrade their underlying capabilities from base to advanced because we need the telemetry to make AI useful.

Great. Thanks, Jonathan.

We'll take our last question from Joel Fishbein from Truist. Go ahead, Joel.

Thanks, Walter. I have an AI question, too, Nikesh, just to follow up on that.

In terms of, can you talk about the customer appetite for AI security and maybe a couple of comments about the competitive landscape around companies that are delivering products around AI security as well?

Yeah. Look -- so, we had an amazing reception to our AI -- precision AI, sort of preview at RSA.

We have in north of a few hundred customers who signed up to have discussions with us and engage in the beta of these products. That's very good, A.

B, as you'll appreciate, AI Access is an overlay product on all of our Access customers. So, it's a good thing because our customers say, I don't have to go somewhere else and get something add on and go make that happen, because I expect Palo Alto will have it in six weeks' time, so I'm just going to wait for Palo Alto.

And those who are keen to deploy sooner, we are able to discuss with them, show them the beta, and continue to have design discussions with them. So, it sort of reduces any risk of competitive activity into our customer base where somebody else is providing AI Access Security in our own cases, one.

Two, in the case of AI firewalls, I think what is unique is we are possibly the only security vendor which has a native integration. I say native, not on top, but native integration with AWS, Azure, GCP, and Oracle in their public clouds, which means our firewall sits in their cloud, you can activate it from their UI, not just from our UI, and you can launch it natively in all those cloud providers.

AI firewalls will be built into that capability so that you get a native capability in most large cloud service providers, or a VM that you're going to deploy in your data center. So again, for somebody to compete with us, they would have to have that native capability first, then build it.

So, do we expect that Google will have it? Possibly.

Microsoft? Possibly.

AWS? Possibly.

So, the cloud providers might have that capability because they have native firewalls. But again, if you had a multi-cloud infrastructure with an LLM running in one cloud, another one running the other cloud, and some running in a data center, we hopefully are the only option that allows that capability to happen.

So, we're trying to make sure that we do the early innovation in this space so our customers don't have to, or we don't create more fragmentation without the people having to deploy point products in that outcome.

Great. Thank you.

All right. Thanks, Joel.

With that, we'll conclude the Q&A portion of the call. I'd like to turn it back over to Nikesh for his closing remarks.

Well, I just want to thank all of you for joining our earnings call. I appreciate your attention.

I also want to thank all of our employees for all the hard work that goes into delivering great quarters and all the innovation that they've delivered. And last but not the least, thank you for all of our customers for their trust in us.

See you guys next quarter.