Ping Identity Holding Corp.

Thanks, everyone, for joining us today, and welcome to the Ping Identity conference call, where we'll discuss results for the first quarter, provide outlook for the second quarter and update our outlook for the full year 2021. Shortly after the market closed today, we issued a press release announcing our first quarter 2021 financial results.

In addition to those results, we'll be presenting a live supplemental set of slides through the webcast portal. These will be published to our website following the call.

You may access the press release and presentation on the Investor Relations section of pingidentity.com. With me today is Andre Durand, our CEO; and Raj Dani, our CFO.

Today's discussion may include forward-looking statements. Please refer to our annual report on Form 10-K for 2020 and our quarterly report on Form 10-Q for the quarter ending March 31, 2021, filed with the Securities and Exchange Commission.

There, you will see a discussion of factors that could cause the company's actual results to differ materially from these statements. I would also like to remind you that during the call, we will discuss some non-GAAP measures related to Ping Identity's performance.

You can find the reconciliation of those measures to the nearest comparable GAAP measures in our first quarter press release and the slides we're posting on our website. [Operator Instructions].

With that, I'll turn the call over to Andre.

Thank you, David. We had a strong start to the year with a solid performance against all our key financial metrics.

Annual recurring revenue grew 16%, a growth uptick from Q4, to $266.3 million. Revenue of $68.9 million grew 12% year-over-year.

Our dollar-based net retention rate improved to 109% from Q4, and we generated $19.5 million of unlevered free cash flow, our best quarterly performance ever. In short, we feel good about these improving metrics, which Raj will get into in more detail later in the call.

This performance was underpinned by a strengthening demand environment and a noticeable return of optimism amongst enterprises. Our pipeline has improved, and with it, we've improved our outlook.

As I shared in prior quarters, identity has become the new perimeter and is now recognized as the heart of security. As a result, we see companies beginning their journeys to Zero Trust with identity at the core.

We're also seeing an acceleration of all things digital, cloud and a desire to achieve frictionless and passwordless user experiences. Having spoken to hundreds of our largest enterprises in the past few quarters, we have increased conviction that our vision and platform strategy are the right focus to fulfill the growing requirements for enterprises looking to secure access through identity.

To deliver on our vision, you'll recall we're focused on 4 core themes: number one, delivering our entire platform in the cloud. For our customers, this allows them to deploy Ping in the public or private cloud or consume the entire Ping platform-as-a-service from our PingOne SaaS offering; number two, delivering frictionless identity solutions for the customer identity use case; number three, enabling the migration of legacy identity systems to Ping; and lastly, embracing our partner network to help us deliver our solutions at scale.

Today, I'd like to focus on our unified cloud platform and provide a progress update on our partner network. We recently held Ping YOUniverse, our conference for customers and partners.

During this event, we laid out our vision for the Ping Intelligent Identity platform and how we will help companies achieve their cloud, Zero Trust, customer use case and passwordless aspirations. I hope some of you were able to listen in, and if you missed it, please reach out to our IR team for a link to the replay.

Our message was simple. Ping's platform and vision has never been stronger, and we're now in a position to transform the way people view security and identity through our unified cloud platform.

We're helping companies make the journey into the cloud in a way that allows them to transform their workforce and customer experiences while staying true to the Zero Trust mandate. With over 3.5 billion connected individuals and more than 350 billion digital identities connected to millions of applications, the challenge for enterprises to connect the right users to the right applications with speed and ease has never been greater.

Today, Ping secures over 2 billion identities through our platform, and we're pushing the boundaries of what's possible to secure the most complex enterprises wall-to-wall across their hybrid and multi-cloud environments. As our platform and capabilities have grown, we're more focused than ever on our mission to be the very best provider of real-time access management from initial verification through log in, to log off and everything in between.

We believe this is the largest and fastest-growing segment of the identity landscape, and it's critical we meet the growing demands of our enterprise customers as their challenges continue to grow. To achieve our mission, we're delivering our platform with more speed, automation and flexibility than ever before, allowing companies to run Ping in their cloud of choice or consume Ping as SaaS through PingOne and our newly available Advanced Services, which now provide 100% feature parity with our core software capabilities.

To continue our commitment to being the most mission-critical provider of identity, we also recently announced that our PingOne SaaS offering is now available with four nines of availability, a major milestone as our services have deployed active/active around the globe. Another announcement we made at Ping YOUniverse was the trend we're seeing towards a converged platform to solve both the customer and workforce use cases.

Companies are looking for leverage in their strategic vendor relationships. They're looking to simplify their vendor and technology landscape and are seeing identity as a core to both workforce security but also digital customer experiences.

As a result, while our business has been roughly split between workforce and customer use case since our inception, we're seeing a growing number of customers leverage Ping for both use cases, and we expect this trend to continue. In pursuit of frictionless identity solutions, we continue to invest in our SaaS offerings to make it easier for those with cloud-first or cloud-only mandates to choose Ping; in our risk and intelligence services to reduce friction and improve security of our authentication and authorization solutions; in a new no-code experience designer to speed integration; in our dynamic authorization solutions to help companies centralize access to every resource and across their entire hybrid enterprise; and lastly, in our passwordless technology to reduce friction for users.

Long term, we're reimagining identity to be more personal, more privacy enabling and more efficient than ever before. Our aspirations are to give individuals more control over their own identities and to completely reinvent how you engage with companies across your employment and customer relationships.

More to come on that later in the year during our Investor Day. In addition to the strides we've made on our cloud platform, we continue to make progress expanding and embracing our partner network.

It remains core to our operations and vital to our customers' success and is now, from a channel standpoint, taking on a more critical role in sales. Our channel partners had a strong quarter, influencing about half of our sales.

One of them, Optiv, consistently ranks among our best strategic partners. This quarter was no exception as they were involved in nearly 1/4 of our influence sales, 60% more than, on average, each quarter for the last 12 months.

Increasingly, we see these part partners as critical to increasing our reach, particularly among the portion of the Global 3000 outside of the Fortune 1000. Later this month, we're launching our partners sales certification program to enable hundreds of partners to sell all of our offerings.

For years, we've had extensive technical certification to ensure quality of delivery. But this is the first concerted partner sales certification effort, a clear sign of the progress our new channel leader and her team are making.

Now I'd like to switch gears and highlight a few Q1 customer wins. Much of the success this quarter was driven by existing customers who are moving all in with Ping.

We upsized the relationship with one of the largest managed health care companies in the U.S. With more than 12 million members, this customer leverages Ping for both workforce and customer use cases, and in Q1, added PingOne Risk and PingIntelligence for APIs to its portfolio.

The Ping solution will allow this health care provider to maintain a strict compliance-based security posture while driving a better authentication process for employees. This is a great use case for one of our first PingOne Risk customers.

One of the world's largest and most beloved retailers expanded its relationship in the quarter. With operations in multiple countries and 275,000 employees, the customer had been leveraging Ping in concert with their Microsoft solutions but weren't getting the full value out of those offerings.

Employees were experiencing disjointed log-in processes for workforce applications, sometimes requiring 6 to 7 log-ins per day with disparate user names and passwords. To improve user experience, the customer went all in with Ping to offer a passwordless experience for their employees, realizing significant savings in help desk cost, improved security and a better user experience.

Another new customer win was GBG, an international provider of location intelligence, identity verification and fraud & compliance management solutions, serving 20,000-plus customers in more than 80 countries. GBG verifies the identity of more than 4.4 billion people globally to AML and KYC standards, ensuring the businesses can trust that consumers are who they say they are and restrict fraudulent account openings.

GBG's software brings together global identity data for its customers. As such, it was seeking a comprehensive solution that would provide a standard for multifactor authentication and role-based access controls in all of its solutions.

GBG evaluated the market as an expert buyer and, following a comprehensive evaluation of other leading vendors, chose PingOne for customer single sign-on and MFA, with a multiyear contract that creates future opportunity for both companies. Another win for us was the Foschini retail group, which is a South African publicly listed retail clothing group that goes to market under various brands and has more than 3,000 stores within its portfolio, offering a comprehensive portfolio of 18 retail brands that include clothing, footwear, jewelry, sportswear, mobile phones, technology products and home stores.

The customer was seeking a comprehensive solution that would provide a standard for multifactor authentication and role-based access controls in all of its solutions. TFG evaluated the market and, following a comprehensive evaluation of other vendors, chose PingOne for customer single sign-on and MFA.

In addition to the quarterly sales, we've also had some notable go-live events. Southside Bancshares, $7 billion bank operating branches throughout Texas, went live in Q1.

During the implementation, we successfully deployed Ping in a highly secured environment to eliminate log-in friction for their workforce. This was a competitive win in which the customer opted for Ping due to the robustness of our solution and our transparency.

In April, we had 2 notable go-live events, first, with a customer that we featured last quarter, VIZIO. VIZIO's mission is to deliver immersive entertainment and compelling lifestyle enhancements that make their products the center of the connected home.

Two weeks ago, we brought them live, replacing their legacy identity system, allowing them to reinvent the way services and advertisements are delivered through smart TVs. VIZIO now uses Ping SaaS solution for the entire authentication and user management system, allowing them to extend their into royalty-based services, with video on demand providers, food providers and consumer entertainment partners.

Also in April, Volvo Cars successfully went live with Ping in their European Union environment. Volvo's mission is to continue delivering vehicles with the highest level of security and the best in-car experience.

We have enabled Volvo to authenticate, secure and manage customer identities and securely build out the connectivity features, which will ultimately serve and support, entertain and guide the people who drive their cars. Before I turn it over to Raj, I'd like to share my excitement in announcing that later this month, we will welcome our new Chief Revenue Officer to Ping.

This gentleman checks many boxes and has significant enterprise sales, international channel and cloud expertise. We anticipate formally introducing him at our Investor Day.

Building a strong leadership team is critical to our future success, and I'm thankful to have recently added Peter Burke as Senior VP of Research & Development. Peter is an accomplished business leader with more than 25 years of technology experience, as well as a published author in the field of artificial intelligence.

And notably, he brings his undeniable Scottish brogue to every Zoom call. In closing, I'd like to thank our incredible team of Identions.

More of them are showing up in person around the offices every day as we slowly emerge from the pandemic, and it's truly energizing to feel things returning to some level of normality. And with that, I'll now turn the call over to Raj to walk through the Q1 results in more detail and update our outlook for Q2 and the full year.

Raj?

Thanks, Andre. We had a fast start to 2021.

We ended Q1 with ARR of $266.3 million, up 16% year-over-year. Q1 net ARR of $7.2 million grew by 63% compared with the midpoint of our guidance, and 42% compared with the $5.1 million of net ARR added in Q1 of 2020.

We feel good about this reacceleration. Growth was driven by continued adoption of our SaaS solutions and solid sales, particularly among our strategic North American accounts, where we have seen an improvement in the overall enterprise spending environment.

First quarter total revenue grew by 12% to $68.9 million, of which 93% was subscription-based. Growth was driven primarily by continued cloud adoption, with SaaS revenue, again, growing by multiples of our total revenue and overall strong performance in Q1.

Our ratable subscription SaaS and maintenance & support revenue grew by 23% in Q1 and represented 36% of our total subscription revenue, up from 33% in Q1 2020. Also within the subscription category, our 1-year term-based license revenue grew 23% in Q1 to $17.3 million, with multiyear term-based license revenue roughly flat compared with the year ago period.

Given the impact that deployment mix and contract duration have on GAAP revenue, we continue to believe that ARR is a key growth metric of a subscription business. As was the case last quarter, our ARR once again outpaced the trailing 12-month revenue, a phenomenon we expect to continue for several quarters before the 2 metrics converge more closely.

This reflects the ongoing SaaS transformation we've been calling after several quarters. Our Q1 dollar-based net retention rate was up slightly to 109%, calculated on a trailing 12-month basis and again tracking consistently with improving ARR growth.

We ended the quarter with 265 customers of more than $250,000 in ARR, up 10% year-over-year. Unless otherwise stated, for the remainder of the P&L, I will refer to non-GAAP metrics.

You can find a reconciliation of non-GAAP to GAAP numbers in the accompanying press release. Gross margin for the first quarter was 80%.

And comparatively, our GAAP subscription gross margin was 85%. Our SaaS solutions continued to grow faster than the rate of the overall business, and as a result, we saw slightly lower subscription gross margins than in Q1 of 2020.

Total operating expenses in the first quarter were $46.8 million. Unlevered free cash flow was a very strong $19.5 million in the quarter, our best result to date.

Q1 is historically one of our stronger cash flow quarters due to the timing of collections based on Q4 deal activity. Operating cash flow was also strong at $24.1 million in the quarter.

Our annualized operating cash flow margin was 12% based on a trailing 12-month operating cash flow of $33 million divided by ARR. This is a notable improvement from our 2020 annualized operating cash flow margin, which averaged just 7.6% across the quarters.

We remain in a strong cash position at the end of the quarter with $55 million of cash on hand, a $91 million reduction driven by paying down $110 million of our revolver in the quarter and putting us in a stronger net cash position. These funds remain available to us and may be reborrowed in future periods as necessary.

Before I turn to the guidance, I'd like to provide an overview of stock comp impacts this quarter, which were more pronounced due to awards initially granted to certain employees under our legacy long-term incentive plan or LTIP. In Q1, we offered employees who held awards under our LTIP the option to convert their awards into restricted stock units, with half of the units vesting on April 1, 2021, and the other half vesting when Vista realizes a $1.491 billion return of its investment in Ping.

All LTIP holders elected to convert their awards to RSUs, resulting in the grant of approximately $950,000 used. As a result of the conversion, the compensation expense associated with the awards was converted from cash-based compensation to noncash stock-based compensation.

This resulted in incremental stock-based compensation expense recognized in the quarter for the time-based units of $12.4 million, with another $400,000 that will be recognized in Q2. We expect to recognize an additional $9.5 million in future periods as the performance-based portion of the awards become probable in vesting.

As a result of these awards, we anticipate our 2021 annual stock comp will represent between 18% and 20% of our ARR versus about 8% normalized. Moving now to guidance.

For the second quarter, we project ARR of $272 million to $274 million, growth of 16% at the midpoint compared with Q2 of 2020. We expect Q2 revenue of $65 million to $67 million, up from our Q1 guidance range, implying growth of 12% at the midpoint.

We expect unlevered free cash flow of $2 million to $4 million in Q2. We are raising our full year 2021 ARR estimate to between $298.5 million and $300.5 million, up 16% at the midpoint compared with full year 2020.

We now project annual revenue of $264 million to $272 million, growth of 10% at the midpoint. Recall that it's typical for Q3 revenue to be slightly lower than Q2, with a typical seasonal uptick in Q4.

We now expect unlevered free cash flow for the year of $11 million to $15 million, up 48% at the midpoint relative to our 2020 performance and despite ongoing investments we expect to make throughout the year. We continue to expect total expense growth to track ARR growth as a result of these investments, which is reflected in our unlevered free cash flow guidance.

In closing, we feel encouraged about the start to 2021 and the sequential improvements we've seen in just 90 days. We believe we can sustain and build upon this momentum as the year progresses.

With that, I'll turn it over to the operator for your questions.

Okay. Great.

Excellent. Andre, maybe for you.

As more of the business starts to move to Saas, can you just maybe talk about how the sales cycle is perhaps different versus traditional term subscription and maybe related to sort of the sales process overall? Congrats on hiring a new Chief Revenue Officer.

What were some of the qualities that you were looking for when recruiting for that replacement -- for that position, rather?

To your first question, I would expect that we see 2 things as a result of the shift to more Saas. First, I would say that we will land faster in new accounts as companies look to take the first step with Ping in the cloud and the motion is simply easier and simpler for those customers.

The second thing I would expect to see is that the expands from existing customers taking the cloud journey with Ping, I would expect that those expands are larger. So on the one end, I would say, faster lands.

And on the other, I would say, larger expands. The second part of your question, with respect to what we were looking for.

I mentioned this one a little bit, but we had a lot of requirements for the new CRO position. I think, first and foremost, we operate in the enterprise in the Global 3000, we wanted to see significant enterprise scale.

Secondly, as more of our solution set is now offered as SaaS and in the cloud, we wanted pretty significant cloud experience. Additional growth vectors for us and points of investment were the international experience, the channel experience and federal experience.

So pretty excited about this individual. They start at the end of May.

That's great. That's great and very helpful.

Raj, maybe for my follow-up for you, understanding it's still very early in this journey to SaaS, can you just go through some of the broad brushes on the economics of SaaS versus term subscription? Meaning, how different is a SaaS deal from a traditional term subscription deal, particularly from an ARR perspective?

Does that make sense?

Sure, Saket, happy to take that. So generally, I'll answer the question in broad brushes, as you said.

Generally speaking, SaaS prices -- SaaS does price at a premium because of the support and hosting costs that we have to incur, right? So -- but ultimately, competitive situations are what they are, and the market dictates the price but, in generality, SaaS would price at a premium.

We are seeing that.

Congratulations on the strong results. I just wanted to maybe start out with your comments around maybe some improved buying cadence that you're seeing from enterprises and just general environmental improvement.

Can you give us a little bit more color on what you're seeing there and maybe what that general pace of deal closures is looking like?

Jonathan, so Andre speaking here. Yes, Q1 was a strong quarter.

As I also stated in earnings, we are -- we do have a healthy pipeline. It is tracking to plan.

We are seeing strong interest in PingOne Advanced Services, which is the feature parity of our software, of our core software platform. And we're also seeing some of the phased deals that we've spoken to in the past.

We're seeing some of those close now at a quicker pace. So I would say the energy and the tone of our conversations, almost across the board, have improved.

There is a level of urgency in many of the conversations as the fog of COVID begins to lift on the budgets and the plans for many of these companies. And to some extent, they had things on hold in 2020, yet the business requirements haven't changed.

And so we're seeing -- maybe the urgency represented in a lot of conversations was as a result of things not progressing as quickly as companies wanted in 2020. So all of that is very encouraging.

Excellent. And then as a follow-up, can you maybe give us a sense -- like you mentioned sort of the advanced services, like how did that sort of impact your win rates?

And can you talk a little bit about how that potentially improves your competitive position as well?

I would say that there were deals in the past, prior to having the availability of advanced services, that we were simply not in a position to win. We deal with the largest, most sophisticated enterprises.

If they had a cloud-first or cloud-only mandate, wanted to consume identity as Saas, not deploy it in their own cloud, we, prior to this, did not have an answer for those enterprises. Now we're in a position where, leveraging our strongest capabilities, we can say yes to those enterprises with a SaaS solution.

So I think we're -- number one, we're winning deals that we would not have won prior to this. We are more competitive in deals that have a cloud-first mandate but fairly sophisticated requirements.

And I'd say, lastly, for existing customers looking to take the journey to the cloud and stay with Ping, we're offering them, really, the easy button for them to continue that journey with Ping.

Congrats on the ARR acceleration. It's certainly exciting to see.

Andre, it was great to hear that the channel is now influencing, I think you said, half of your sales. I'm curious, that's a pretty big uptick from even a couple of years ago.

What do you attribute that to? Is it easier to use, easier to deploy?

And if we look forward, I mean, where could that mix go to? I mean is there a ceiling on where you think that channel impact could go?

I don't suspect it will ever go to 100%, nor that that's the healthy long-term resting position, but I do see it moving north of 50%. I would say the uptick that we've seen is in direct relation to the investment and commitment that we gave to the channel at the beginning part of this year.

We now have a full channel team under new leadership that we've spoken about in the past. And we've done a number of things as we entered this year, substantive things, to demonstrate our commitment to the channel.

And the channel is feeling and seeing that. And they're returning, they're returning the investment that we're making in them.

That's great. That's great.

And then, Raj, I believe you said last quarter, SaaS was about 15% of the ARR mix. And obviously, it's growing a lot faster.

So I assume it's higher even after just one quarter here. Can you remind us, though, there is a headwind to reported revenue with an increasing SaaS mix.

You still beat Q1 revenue. I'm just sort of wondering if you could sort of remind us on that dynamic and how maybe that mix may continue to increase throughout the year.

And perhaps maybe even when you think about the full year guide, what sort of a mix are you anticipating?

Yes, Matt. So the original guidance that we provided last quarter did imply that there was a $30 million revenue impact from this ongoing cloud transformation.

And that really -- that still holds today. Q1 SaaS ARR did grow at multiples of the total ARR growth rate of the company.

In terms of the Q1 revenue upside, we did see strong demand for software that was deployed in the customer's cloud, so in a DevOps manner, and that's what drove some of that upside in Q1. But it was also a result of overperformance of ARR in the quarter.

But absolutely, the SaaS story holds, it's still growing at multiples of the overall growth rate of the business. And it was always envisioned that most of that impact would be in the back half of the year simply because of the maturity of our SaaS offering as we continue down this journey, and now we're just leaning much harder into it, as are our customers.

Great. Maybe to kind of pile on to some previous questions about the revenue mix.

Andre, could you remind us maybe what the renewal environment looks like, particularly with regards to multiyear, 1 year? And how you -- maybe if you can help us level set our expectations as we look forward to 2021, what that mix might look like, particularly as kind of SaaS is also kind of added into that mix?

Thanks for that question, Brian. I'll have Raj answer that one.

Yes. Brian, so our growth in Q1 was driven by ratable subscription revenue, right?

So when you look at -- I think I mentioned in the prepared comments that we were -- we continue to see that mix shift towards ratable. And so when you think about Q1, ratable revenue really grew -- really drove the revenue growth, and that was -- the ratable revenue grew at 23%.

Embedded in that is SaaS and M&S, and the SaaS business grew significantly faster than the 23%, and it was sort of offset by a lower M&S growth. In terms of your question on renewal, specifically, most of the revenue in any given quarter is driven by renewals.

And we did have a handful of multiyear renewals, but nothing way out of the ordinary for us in terms of any quarter in particular.

Okay. Okay, that's helpful.

And then maybe to follow-up on PingOne Advanced. I think you've kind of previously talked about hitting kind of feature parity in 4Q.

So how should we expect SaaS to kind of work its way through the pipeline, both with regard to sales force incentives and whether they're kind of direct- versus indirect-driven sales? Is -- now it's kind of hitting its stride in the pipeline, selling and making it away on maybe one-for-one basis in each quarter?

Or does that still have another quarter or 2 to go before it hits kind of, I guess, full run rate through your sales channels?

I would expect that to take the remainder of this year to hit a run rate. It is new.

Our own teams are learning how to sell it. Following that, we will obviously train and certify the channel to not only sell it, but also to deploy it on behalf of our customers.

So nothing in our space happens overnight in a quarter. It's a pretty significant advancement for us to be able to make that statement and then live up to it.

Some of the customers that I spoke to on the go-live were customers of our PingOne Advanced Services. So those are big names and big customers and big deployments, and we wanted to get to a point to where we saw that success before we really started to turn the crank.

Suffice it to say, it is a journey for us, it's a journey for the customers. Expect that to develop throughout the course of this year.

Got it. And maybe just one quick follow-up.

Are those faster deployment cycles as well?

Well, let's see. On some -- one part of the answer is yes, they are faster deployment cycles because we stand up -- the infrastructure is us, and so there's less reliance or dependence that customers have to have on their own teams.

The second part of that question is it depends on how large the scope is of the deployment. And so there's always an initial deployment phase, and then there is a configuration and application on-boarding phase.

The initial part of that question is absolutely faster for customers. The on-boarding of applications to the PingOne Advanced Services still requires that enterprises or our partners go through that configuration in that onboarding phase, and the speed of that is determined by the number of resources that the company puts behind it and how well-coordinated the program is.

Nothing of our SaaS services changes that requirement.

Okay. Great.

Have you seen any material change in deal activity on the customer identity side of the equation so far this year? And then just how should we think of growth there versus your total ARR growth target of, call it, 16% for 2021?

The customer pipeline and the customer ARR contribution is both growing at a faster clip, and it is contributing more to the ARR. Now a lot of that is by design as we've leaned into the customer use case, and we have a pretty differentiated solution there proven at pretty significant scale.

So we see the market -- the market has historically been smaller as measured by the analysts but growing faster. We are seeing all of those dynamics also play out in both our pipeline and ARR.

So growing faster, our pipeline is growing faster, and our ARR and the customer use case is growing faster. Again, all by design.

And we would expect that, that continues.

Got it. That's really helpful.

And then I hate to ask the question about a competitor. But just how do you see Okta's acquisition of Auth0 impacting the customer identity space this year?

Well, a durable strategy -- I would say a good strategy is also a durable strategy. And I'd say now more than ever, we have the conviction in our strategy as tested by that move, shall I say.

It is an interesting acquisition. The price does suggest that it was defensive.

We did know that Auth0 competed down market with Okta. We focus on the enterprise.

Auth0 focuses on developers, which is a different buyer center than Ping normally sells to, which is probably one of the other reasons that we did not come across Auth0 that much. I would say the other places that our strategy now begins to diverge after some convergence in the last couple of years, it's our belief one platform should serve both use cases.

That's where companies are going to achieve leverage, not just in their vendor relationship, but in their technology choices. Okta now has 2 platforms as well as two buying centers.

So it is an interesting move. We're moving in a different direction.

I do believe, with respect to the future of identity, that the future is no code. Everyone wants to move faster, and so engineering out complexity and moving the value creation higher in the organization so that they can consume identity services faster, it's not that developers are not important, it's that the world wants to move faster, and that's where we're going to take Ping.

Can I also ask about the ARR guide both for next quarter and for the fiscal year? I mean the rhetoric on the call, thus far, has been pretty bullish.

You were saying faster lands, larger expands, the channel kind of firing more cylinders. So just help me understand, I guess, why when we look at the numbers -- next quarter, your forecast, I think, 16% ARR growth at the midpoint, it's the same for the fiscal year.

So just maybe there could be a disconnect between the rhetoric versus the actual guidance. Is there anything that we should be aware of?

Yes. Patrick, this is Raj.

I'll take that. Our philosophy, in general, has always been to guide to what we can see in front of us.

And while we're seeing the early indications of a stabilizing environment, i.e., more RFPs, some pent-up demand coming back, we still think it's too early to call "normal" albeit with encouraging signs, right, in the environment. So the Q1 strength that we showed gave us confidence to raise guidance across all the key metrics.

But again, I think it's too early to kind of call victory yet.

Okay. Appreciate it.

And then I guess in terms of net retention rate, that kind of ticked that up 1 percentage point. I mean I presume you can't guide quantitatively, but just help us understand qualitatively how you see that kind of shaping out.

Yes. That's fairly straightforward, Patrick.

If you track our growth rate in ARR and our NRR over the quarters, you'll see that there's a pretty natural correlation of about 7 to 8 points between the two, so that held again in Q1. We had 16% ARR growth and 109% net retention rate.

Qualitatively, I would say, gross retention remained strong. We are mission-critical to these enterprises.

And as ARR growth stabilizes, NRR should track accordingly.

Okay. Andre, since Okta was already brought up, I just thought I'd ask, they're going to bundle IGA and PAM in the coming quarters.

Just curious, talk about your conversations with best-of-breed partners in these areas and also what you're hearing from customers. Does it make sense for you to double down with the partner strategy?

Or would it make more sense for you to kind of replicate that strategy and build your own products in these areas?

Well, competitive moves always have influence and shape our thinking, but I've always been a believer that you don't lead by following. Okta's announcements after we've analyzed it don't change anything significant in our strategy.

You can't be the best at everything. We're focused on being the best at real-time access management, which is the largest and fastest-growing segment of the market.

You can't be broad and shallow in the enterprise, serving the world's largest enterprises. Our belief also is that one platform to serve all identity types, in and of itself, is a strategy.

And doing that well so that companies can achieve leverage and economies of scale of their investments in the actual technology requires investment and focus. So yes, I would say partnering with the best-of-breed providers, focusing on real-time access management, bringing intelligence to our control plane is a significant effort and no small feat.

And doing that well at scale for the world's largest enterprises is something that our customers expect us to do and expect us to do it well.

Got it. And maybe as a follow-up, just on the management changes.

Feedback on the broader orientation on the sales transition. I know that sometimes, that can lead to turnover or changes across the sales force and cause some disruption.

It doesn't look like it's implied in your guidance, but feedback you've gotten? And if you could touch on key metrics for new CRO that he'll be tasked with.

Dave Packer has been a wonderful leader for several years and certainly has built a world-class organization under him. The transition with Dave has been orderly and smooth, and Dave will parallel with this new leader for a period of time here in Q2.

Culture is a big deal here at Ping. So it's not just are you competent for any new leader?

And do you have a track record and the skills that we're looking to grow into? It's -- do we feel that you're a good culture fit for the organization?

It's not a secondary requirement. It's a primary requirement.

So I would expect that this new individual ticks the box on that dimension as well, not just the experience side of the dimension. So yes, as I kind of said before, very excited about this individual.

I do expect that there will be an orderly transfer over the course of Q2 as the new individual starts, and I'm not expecting any major surprises there. On the second -- repeat the second part of your question, please.

Key metrics and how this will be different.

You mean outside of ARR growth and channel contribution? I was just kind of joking there a little bit.

I would say there's -- as the company transitions to cloud, they're both as a higher velocity to the selling motion in cloud. There is also probably some experience in cloud transformation that this individual will bring and how we can make that transformation faster, and I would look to track that transformation.

There's also growth and investment in new markets, like the international market. So tracking the growth of our investment in international is important.

We're entering a new segment in federal, so I would want to see his expertise applied to the penetration of federal here in the U.S. So really kind of what we described as ticking the box in all the key areas.

Those would all be -- we would have KPIs associated with growth in all of those areas.

Great. It feels like the technology portfolio is really starting to meet customers where they won't mind.

So I guess with the uptick that you guys are seeing, is that a function of increasing competitive win rate, and you think that's more indicative of a market lift that's happening as we're coming out of COVID? And then I guess, secondarily, what are your thoughts about leaning in on sales and marketing, especially given your spend relative to some of your competitors out there, especially as the market is starting to open up.

To the first part of your question, I believe that we are -- it's my expectation, and I also believe historical fact, that we are going to see both, okay? So there is, I do believe, a confidence returning to enterprises and, appetite for some of the projects that we saw pre-COVID now and, in some cases, may some urgency around those projects that did move in 2020.

I would also expect that, and you are seeing this, Ping's investment in our platform is -- has been a multiyear journey, and it will -- and it continues. But I would say a lot of the heavy lifting, things that we had to do that you just don't see any market or sales uplift or win rate changes through the early parts of that platform investment, those investments are now beginning to meet the market.

And that's making us more competitive for companies that are transforming themselves to the cloud as well as new customers that are evaluating their options. So I -- we are seeing, in some segments, win rate changes.

I do expect that, that will continue.

I can take the...

On the sales and marketing...

Yes, Rob, I can take that. This is Raj.

So as you know, this is an enormous market, and Ping has full position in the enterprise in this market, and so we have been investing and leaning into that sales and marketing opportunity. However, our philosophy is not growth at all costs.

It's focused on the ideal customer profile in the Global 3000. So we have -- we are in pretty good shape now in terms of our sales capacity, and we've been seeing great early returns on our brand awareness campaigns and our lead gen activity, et cetera.

So you'll see us continue to lean into that investment and expect it to track more -- the growth of sales and marketing and track more closely with the ARR growth rate, going forward.

I want to ask about something you said at the beginning. I'm trying to understand the drivers for the change of tone, change of rhythm this quarter.

It's clearly better than the trends we've seen before. And I want to focus on one thing that you said at the beginning, which was feature parity of the new product -- of the cloud-based solution versus on-prem.

Can you take us through the product evolution just to understand. When did you reach feature parity?

What were the kind of key aspects that were added to make it more attractive to invest -- to customers? I'm trying to understand how important is the fact that you reach feature parity, how important is it to the overall performance, the good performance?

And second, timing of it? When did you reach feature parity?

We've been investing in our cloud offerings, and I say that plural, now for several years. There's been a couple of components to it, Tal.

The first is the SaaS platform that is delivering many of these brand-new services that we're rolling out. Risk, MFA and verify as an example that I spoke to last quarter, 3 new services -- 3 new SaaS services that came out in 3 quarters.

The speed with which we're able to deploy those new services is as a direct result of several years of investment in our -- in essentially re-architecting our SaaS platform around the most recent architectures of micro services and other things like that. It turns out that the architecture in SaaS in the last 5 years has undergone its own transformation.

Recognizing that, that transformation, if we made the investment, would speed our ability to roll out new services, we bit the bullet. You didn't see anything for 2, 3 years, and then all of a sudden now, you're starting to see us roll out new SaaS services.

That's part 1 of the answer. Part 2 of the answer is, simultaneously, we've had a number of customers, growing number of them, especially new ones, who are deploying the Ping software capabilities in one or more public or private clouds.

Some of our largest customers who are deploying today are deploying in the public cloud. Now it's the public cloud, but it's within their control.

They fully control the environment in the cloud. And for those customers, we've been developing in our DevOps program.

This is our Docker, Kubernetes, Helm and other automation capabilities of our software. It's been about a 2- to 2.5-year investment that we've been maturing our software to take full advantage of cloud deployment.

And on the heels of having made those investments now, that has given us the wherewithal to deliver Advanced Services on PingOne. So we are leveraging the same technology that we have delivered to customers when they want to deploy Ping in Amazon or Azure or the private cloud.

I think I shared we had one bank recently deployed Ping in the IBM private data center and Azure and AWS in a triple cloud deployment. We leveraged that same technology to deliver Advanced Services.

Now where does that have impact? It has impact for large, complex enterprises that have advanced requirements, but they also have a cloud-first mandate.

Now we can say yes to them, and we can say yes to them with SaaS. That's the first part.

The second part is we have customers, who are happy Ping customers, who are starting their cloud journey, would like to do it with Ping but don't want to give up any of the capabilities that they currently have in their Ping deployment. For those customers, we can also say yes.

So closing that gap has been a big deal, but it hasn't happened overnight.

Did it something happen recently that drove you closer to the ability to say that now your solution is complete? I'm trying to understand the timing of it.

For example, if I ask you the same question 2 quarters ago or 3 quarters ago, did you have the same answer? Or would you say back then that you're missing certain features or something?

I'm just trying to understand the delta, the change recently.

Right. Well, we were certainly working on it two quarters ago.

But I would say that it became real in Q4 of last year. So Q4 of last year was really -- so 2 quarters ago, it was really the first time we started selling customers on the new Advanced Services.

And then as we just noted, Q1, several of those customers went live. So you kind of see building confidence in a new solution.

The solution is non-trivial. We didn't build it overnight.

And we won't verify and validate it overnight either. And so I would have given you the same answer, but maybe with a less of the conviction that comes with several, large, successful deployments on the new platform.

The conviction that you're hearing now is that we have several of those check boxes behind us.

So just a quick follow-up. So we hosted expert calls in the past.

And one of the common themes that came back was Ping solution is not complete, meaning that the SaaS solution or the cloud solution is not complete. The on-prem is still way more complete than the SaaS.

And now I understand, we passed this threshold. What do you do on the marketing side?

Do you -- first of all, do you think that, that's the notion in the market, or that might be something you need to work on when it comes to positioning and understanding of customers of your solution? Is there anything you have to do on the marketing side to change the perception?

Do you think there's a perception? And if not, does it mean that the sales cycle is very technical and clients don't care about perception?

They care more about, show me the product, I'm okay with it.

Tal, there is work that we have to do in the market to evolve the perception so that companies, when they think cloud or cloud identity or SaaS identity, that Ping is in the top 2 or 3 companies that they will look to reach out to, to evaluate their solutions. Historically, we did not have that reputation for all the reasons that you mentioned.

It's not for lack of investment in our SaaS offerings, but it was for lack of having full parity with the capabilities that built the reputation as being the leader in the Global 3000. So now that we've delivered that, and now that we've delivered several deployments and we have growing conviction that the platform is now approaching a level of maturity where we can send that message to the market, you will see us do that.

All right. I'll just ask one.

I thought it was interesting, Andre, that earlier, you mentioned you're seeing a growing number of customers leverage Ping for both workforce and customer identity use cases. Are you able to provide a little more context around this, including why you think that's occurring?

If you go back to the beginning of Ping, we always had the vision that one identity platform should serve both use cases. Consistent with that belief system, our business for the large part of our history, was always split.

Roughly 50% of the business was workforce, roughly 50% of the business was customer. Some -- at some point in the last 4 or 5 years, we -- as identity was maturing, the groups were maturing, the expertise was becoming a little bit more strategic rather than tactical in the deployments, we started to see a certain amount of cross-pollination between what was our workforce deployments and our customer deployments.

Now we had always seen the security traverse both. So meaning, security was always implement -- instrumental in technology selection on the workforce side, whereas the customer side was driven by a line of business or an application owner.

But as identity and privacy and the security breaches have become more visible, even the customer side started to consult the security organization and say, "Hey, do you endorse the technology choice that we're making here for our customers? Do you feel that choice is going to keep our customers secure and our brand out of the headlines of a breach?"

And so we began to experience a cross-pollination of our champion, the security organization, having a stake and some decision into that customer use case. That has only accelerated.

And I would say, in the last 6 to 12 months in particular, I now have a growing number of conversations where stand-alone identity groups are being built and they are asking themselves whether the company is getting the most out of their technology choices if they don't leverage a single vendor and a single platform to sit underneath both use cases. So it is a trend that started several years ago but has been accelerating.

And my expectation is that, driven on cost and technology leverage, that conversation will continue to accelerate. I don't think it will ever be 100%, to be clear, like I don't think every deployment is going to look for some sort of converged platform.

But I think that is -- we're going to see more, not less, of that going forward.

I look forward to providing updates as the year progresses, including our second half Investor Day. Thanks, everyone.