Mandiant, Inc.
Q1 2019 Earnings Call Transcript

Published: 30 Apr 2019

[Operator:]

Good day, everyone. And welcome to the FireEye First Quarter 2019 Earnings Results Conference Call. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session and instructions will follow at that time. Also, this call is being recorded. At this time, I would like to turn the call over to Kate Patterson. Please go ahead.

[Kate Patterson:]

Thank you, Lauren. Good afternoon, and thanks everyone on the call for joining us today to discuss FireEye's financial results for the first quarter of 2019. This call is being broadcast live over the Internet and can be accessed on the Investor Relations section of FireEye's website at investors.fireeye.com. With me on the call today are Kevin Mandia, FireEye's, Chief Executive Officer and Frank Verdecanna, Executive Vice President, Chief Financial Officer and Chief Accounting Officer of FireEye. After the market closed today, FireEye issued a press release announcing the results for the first quarter of 2019. Before we begin, let me remind you that FireEye's management will make forward-looking statements during the course of this call, including statements relating to FireEye's guidance and expectations for certain financial results and metrics; FireEye's priorities, initiatives, plans, and investments; drivers and expectations for growth; the expansion of FireEye's platform and the benefits, capabilities, and availability of new and enhanced offerings; competitive position, market opportunities and go-to-market strategies. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future and we undertake no obligation to update these statements after the call. For a detailed description of the risks and uncertainties, please refer to our SEC filings, as well as our earnings release posted an hour ago. Copies of these documents may be obtained from the SEC or by visiting the Investor Relations section of our website. Additionally, certain non-GAAP financial measures will be discussed on this call. We have provided reconciliations on these non-GAAP financial measures for the most directly comparable GAAP financial measures in the Investor Relations section of the website as well as the earnings release. Finally, I would like to point out that we have posted the supplemental slides and financial statements on the Investor Relations section of the website. Finally, save the day for our 2019 Analyst Day. We have scheduled it for October 8th during this year’s Cyber Defense Summit in Washington D.C. More details to follow. With that, I'll turn the call over to Kevin.

[Kevin Mandia:]

Thank you, Kate, and thank you to all the investors, employees, customers and partners who are joining us on this call. As always, we deeply appreciate your continued interest and support of FireEye. The first quarter of 2019 marks the ninth straight quarter in which we did what we said we would do. We met or exceeded our guidance range for billings, revenue, operating income, operating cash flow, and earnings per share.

[Frank Verdecanna:]

Thanks Kevin, and hell to everyone on the call. First, I want to frame my comments with a quick summary of my takeaways from our Q1 results and forward outlook. Our business is diversifying across multiple vectors, customer size, product families, geographic regions and verticals. After excluding $10 million plus deals in Q1 of 2018 and Q2 of 2018, the underlying year-over-year billings growth rate is 11% for Q1 2019 and 15% at the midpoint of our Q2 guidance. Productivity is increasing, which will drive continued operating leverage in the future. Before I review the details, let me remind you that I'll be referring to non-GAAP metrics except for revenue. Our non-GAAP measures exclude stock-based compensation, amortization of intangibles, non-cash interest expense on our convertible debt and other non-recurring items. Diving into the details of Q1 2019, total billings were $182 million, $2 million above the high-end of our guidance range of $170 million to $180 million. We closed 33 deals greater than $1 million compared to $29 deals greater than $1 million in Q1 of 2018. As expected, our Q1 2019 billings did not include and transactions greater than $10 million. As we’ve noted before, transactions greater than $10 million are relatively rare for us and we closed only a handful of them in our entire history. We did have one transaction upsize to slightly more than $5 million in the quarter, but overall billings were less concentrated than in Q1 of 2018. The top three transactions in Q1 of 2019 accounted for about $12 million or 7% of total billings. This is less than half of the $25 million contributed by the top three transactions in Q1 of 2018 when these transactions accounted for about 14% of total billings. We are providing this comparison to help illustrate the dynamics impacting year-over-year comparisons for the first quarter. Moving on, billings for our Mandiant Professional Services were $38 million, a record for the first quarter of the year and an increase of 38% from Q1 of 2018. This reflects continued strong demand for Mandiant Expertise and the formal launch of Expertise On Demand in the quarter. We continue to operate at or near capacity in this area of the business and view our growth in Professional Services as the use positive for our business. It validates our continued leadership in cyber security expertise and is a leading indicator for future sales of our solutions. A majority of customers who purchase new services from us purchase additional solutions in the next 12 months often spending much more the original value of the services engagement. The strength we saw in Mandiant Services in the second half of 2018 is already beginning to show up in the sales of our network, email and Endpoint security, as well as Managed Defense. Product and related subscriptions and support billings were up 11% year-over-year with strong refresh activity in appliances as well as good growth in subscription. We continue to see a growing adoption of our simplified subscription pricing model and many customers also attached an appliance. Cloud subscriptions and managed services declined on a year-over-year basis as expected. The decrease was primarily due to the mix of the top three deals in each quarter. In Q1 of 2018, the top three deals accounted for $25 million in billings, of which $20 million flowed into the cloud subscriptions and managed services category. In Q1 2019, for the top three deals, the mix shifted back to its products and related subscriptions category with zero dollars going into the cloud and managed services category. This $20 million decline for the top three deals more than accounts for the year-over-year decrease in cloud and managed services. This dynamic illustrates how large deals can create volatility in the year-over-year growth rates between categories and you should not overfocus on the mix when evaluating our results. For example, the top three transactions included large email security transactions in both years, but in Q1 of 2018, they were cloud email and in Q1 of 2019, they were server-based. The important point is that email security overall was up year-over-year and we are protecting our customers based on their security preference and needs. That said, I want to remind you that the difficult year-over-year comparisons for the cloud subs and managed services will continue in Q2, as Q2 2018 also included one large $10 million plus transaction in this category. Given the ongoing positive developments in Managed Defense, the Helix platform and threat intelligence, we expect to see growth rate to reaccelerate in this category in the second half of the year. The weighted average contract buying for recurring subscriptions and support billings was approximately 24 months in Q1 of 2019, about the same of Q1 of 2018 excluding the $10 million plus transaction. Please note that although appliance revenue is recognized ratably is not considered reoccurring in the same was the subscription or support contract is. We therefore exclude appliances from the calculation of average contract length. The important point is that changes in the average contract lengths were not material to our billings performance in Q1 of 2019. Turning to revenue and the income statement. Revenue in the quarter was $211 million, an increase of 6% year-over-year. Approximately, 92% of our non-services revenue or a $156 million was recognized from current deferred revenue associated with prior quarter billings. Cloud subscriptions and managed services categories as well as Mandiant Professional Services posted record revenue in Q1. Cloud subscriptions and Managed Services revenue increased 16% year-over-year to $51 million reflecting the growth in billings and deferred revenue in this category in 2018. Mandiant Professional Services revenue increased 21% year-over-year to $40.6 million. Products and related subscriptions and support revenue declined almost $3 million or about 2% from Q1 2018. This reflected the lagged effect of the decrease in appliance sales that occurred in 2016 and 2017. As a reminder, appliance hardware is effectively recognized over four years under the 606 revenue accounting rules. So a change in the billings growth rate is not immediately reflected in revenue. Even the relatively strong appliance billings we saw in Q1 of 2019 had only a minimal impact on the quarter’s revenue and current deferred revenue since the majority of the appliance billings were allocated to non-current deferred. We continue to actively manage our expenses and margins as we work through this headwind to our revenue growth. Since our operating margin is based on revenue, but expenses are driven by billings, I encourage you to look at the ratio of expenses to billings or our operating cash margins as a percentage of billings as a leading indicator of our operating leverage potential. Gross margin was 74% in the quarter consistent with Q1 of 2018 in our guidance. Products, subscription and support gross margin was flat compared to a year ago at 79%. While gross margin for Professional Services increased to 53%, about two points better than Q1 of 2018. We have maintained this higher gross margin in our Services business for three consecutive quarters reflecting consistently high chargeability levels and continued advances in our enabled technologies to drive productivity. As expected, total operating expenses increased sequentially reflecting higher payroll taxes and other employee-related expenses that are seasonally higher in Q1 as well as a full quarter of expense associated with recent hiring. On a year-over-year basis, operating expenses increased 6% consistent with revenue growth. This resulted in operating margin of negative 3% consistent with a year ago and within our guidance range. Although excluded from our non-GAAP metrics, we did take a restructuring charge of approximately $4 million related to a small reorganization to align resources with our strategic growth initiatives. Other income and taxes largely offset each other resulting in a loss of $0.03 per share, which was the midpoint of our guidance range. Turning to the balance sheet and cash flow statement. We continue to maintain a very healthy balance sheet with cash and short-term investments of over $1.1 billion, approximately $14 million higher than Q4. We ended the quarter with receivables of about $111 million and DSOs calculated on billings of 55 days within our target range of 55 to 65 days. Ending deferred revenue was approximately $906 million, down $29 million sequentially, but up $20 million from the end of Q1 2018. This reflects the different seasonal patterns in billings and revenue. Current deferred revenue was $542 million at quarter end, down approximately $15 million sequentially and up $8 million from the end of Q1 2018. The sequential decline was primarily due to the $12 million sequential decline in current deferred products and related subscriptions, which is associated with the recognition of product revenue from prior appliance sales. Deferred revenue from product and related subscriptions and support decreased by $34 million from a year ago as we continue to recognize more revenue from past appliance sales, than we are adding back with current billings. We generated more than $24 million in operating cash flow, well above our guidance range of $10 million to $15 million. CapEx was $13 million resulting in positive free cash flow of about $11 million. With this as background, let’s turn to our Q2 and updated 2019 guidance ranges. Starting with 2019, we are increasing our 2018 guidance range for billings to $915 million to $935 million reflecting our Q1 billings performance above the guidance range. This represents growth of approximately 8% at the midpoint. If we exclude the two greater than $10 million deals from the first half of 2018, the underlying growth rate for 2019 implied by our guidance at the midpoint is approximately 11%. Because billings drive our receivables and collections, we are also raising our expectations for operating cash flow by $5 million to a range of $95 million to $115 million. This represents a cash flow margin of approximately 11% on our expected 2019 billings and approximately 12% on our expected 2019 revenue. Our guidance for the remaining metrics remains unchanged. For revenue, we are guiding between $880 million and $890 million implying a growth rate of approximately 6.5% at the midpoint. This differential between revenue growth rate and billings growth rate reflects the headwind of lower current deferred revenue for the products and related categories. Expectations for operating margin remain between 5% and 6% and our earnings per share is expected to be in the range of $0.17 to $0.21 based on a weighted average diluted shares outstanding of 210 million. CapEx is expected to be in a range of $40 million to $50 million. For Q2, we expect billings in the range of $205 million to $220 million. The midpoint of the Q2 range represents growth of 8%. We do not expect any $10 million plus transactions in the quarter. If we exclude the $10 million plus transactions from Q2 of 2018, the midpoint of our guidance represents an acceleration to approximately 15% year-over-year growth. Our Q2 billings guidance range represents 22% to 23% of our updated 2019 billings guidance range, which is consistent with our historical annual linearity for the quarter and in line with the linearity of 2017 and 2018. Looking at the combination of Q1 billings plus Q2 guidance implies first half, second half linearity of approximately 43% of the full year billings in the first half of the year and 57% in the second half, implying - improved linearity compared to both 2017 and 2018. We have provided the historical billings linearity for the reference in the guidance section of the slide deck. We expect revenue in the range of $212 million to $216 million implying approximately 6% year-over-year growth at the midpoint. Given this revenue range, we expect gross margin between 74% and 75% and operating margin between 1% and 3%. This implies a sequential decrease in operating expenses of between $6 million and $7 million. The decrease is primarily related to lower payroll-related expenses in Q2 and less events expense in Q2 as Q1 had our sales kick-off and our savings in there. We expect interest income to offset interest expense and cash taxes to be between $1.5 million and $2 million, both are consistent with prior quarters. This yields earnings per share between $0.01 and $0.03 based on weighted average diluted share count of approximately 207 million. Operating cash flow is expected to be in the range of negative $5 million to negative $10 million and CapEx of about $10 million to $15 million. That concludes my prepared remarks. We will now take your questions. Operator?

[Operator:]

Thank you. Our first question comes from Andrew Nowinski with Piper Jaffray. Your line is open.

[Andrew Nowinski:]

Great. Thank you and congrats on a nice quarter. Good start to 2019.

[Kevin Mandia:]

Thank you, Andrew.

[Andrew Nowinski:]

First question, may be if you could just provide any more color relating to your headwinds from the decline in your legacy business that you are facing and when do you think those will diminish. Is it still sort of second half of 2019?

[Kevin Mandia:]

Well, it will be a headwind for 2019 and 2020, and it starts to dissipate a lot more in 2021. The good news is obviously we expect to be able to grow through that headwind as we have in the last year.

[Andrew Nowinski:]

Okay, got it. And then, with regard to Mandiant, given the strong growth we saw in Q1 and then combined with the launch of Expertise On Demand, do you think Mandiant could actually maintain these growth rates for the remainder of the year?

[Kevin Mandia:]

Yes, I think it was 38% billings growth. I am not convinced we will maintain that growth, but it can certainly grow for the remainder of the year and our intention is to do so. Right now, our services have never been more relevant. Demand is high, and quite frankly, we are at a full burn right now. So I am confident in the growth, but a healthy growth rate for services is probably closer to 25% somewhere around there.

[Frank Verdecanna:]

Andrew, it grew 21% year-over-year from a revenue perspective.

[Kevin Mandia:]

Yes.

[Frank Verdecanna:]

And just to remember, yes, just to recall, in Q1 of 2018, we had a pretty low Mandiant Services billing. So, the compare was pretty low and therefore the growth rate a little bit higher than normal.

[Andrew Nowinski:]

Got it. Thank you.

[Operator:]

Thank you. Our next question comes from Gabriela Borges with Goldman Sachs. Your line is open.

[Gabriela Borges:]

Good afternoon. Thank you. I wanted to follow up on some of the commentary on normalized billings being over 10%. And it looks like acceleration on the TS stack. Either for Kevin or for Frank, do you feel that the portfolio is now at the point where you can sustainably put up 10% billings growth meaning, beyond just 2019, and independent of any kind of plans to refresh cycle, and do you think that’s a scenario where you could actually get to something closer to 2015? Thank you.

[Kevin Mandia:]

Frank, do you want to go first?

[Frank Verdecanna:]

Yes, so, Gabriela, I think if you look at our long-term guidance model, the expectation is that we will continue to see less of a headwind from a product decline perspective. I think, we are very encouraged with the fact that we continued to grow kind of the core products as we continue to innovate and transform the business into a platform company. So, I think, we feel very good about the fact that we had growth in Endpoint, email, and network even as we have significant investments and innovation on the platform.

[Gabriela Borges:]

That’s helpful. Thank you. And the follow-up is for Kevin on Helix. Maybe just give us a little bit of color on how customers are engaging with the augment strategy on the SIEM side and anymore conversations happening around full-on displacement on SIEM? Thank you.

[Kevin Mandia:]

Yes, so, right now, the Helix, the cloud Helix has a SIEM component in it, and it is really built for the capability to have widespread visibility with many sensors coming in from many different geographies and quite frankly to leverage the cloud for those sort of services. And what we see it being used at is, a platform that can bring in our events and events from anybody’s technology and manage you through the orchestration in playbooks for there would be remediation steps. So, we also – and I wanted to expand on the question, Gabriela as to where that’s going, because, I’ve always said, our IP is our ability to adjudicate good from bad. That’s our true IP as a company, and so we are constantly looking to automate that adjudication process into Helix. And the other thing that we want to do with it and why we are getting the data capabilities into it that we purchased a year ago is the, the investigative phase to me is large and unaddressed. And when you look at the security market, everybody is doing prevent, prevent, prevent, detect, detect, detect, yet there’s never been a higher demand for our services to go out to figure out what happened after a security breach and what to do about it. So, we are expanding what to do about it, but in the what happened, that investigative phase, we are building that capability into Helix as well and I think that’s going to be wholly unique to us. You have all these platforms being built out there that are nothing but the near, the first inning of security, preventing the breach or this first inning and a little bit of a second inning. But there is nobody there, but if third, fourth, and fifth innings of a breach across the kill chain, so when I look at Helix, I wanted to be comprehensive. We can prevent with our spokes. We can detect, but then with Helix, we are building into and you can investigate and remediate. And so, I want to lay out the whole picture of how comprehensive that is, because when I think Helix, there is the Helix of today with a SIEM app, and then there is the Helix that we are building with Security-as-a-Service, Expertise on Demand, and the ability to prevent, detect, investigate, and remediate in a single place. And that’s something that we are well on our way to building and I feel we will be the first to do it.

[Gabriela Borges:]

Very good. Thank you.

[Operator:]

Thank you. The next question comes from Gur Talpaz with Stifel. Your line is open.

[Christopher Speros:]

Hi, this is actually Christopher Speros on for Gur. It sounds like the launch on Expertise On Demand has been success so far. Can you speak to what’s driving attraction and provide some color on how these customers adopted the product in Q1?

[Kevin Mandia:]

Yes, I think what’s driving is, I can go back 20 years in my history and I was sitting as Security Operations Center at the Pentagon, I wish, I had a button for every alert, I thought to say, hey, let’s get a thousand experts to take a look at this thing. It’s to be a seamless extension of our customers’ security step. That’s what’s driving demand. It’s always been there. All these security products are creating a lot of noise and every once in a while you are sitting there as an operator going what there is anybody else know about this? While I can Google for it and maybe I’ll get a hit. Or I can just click a button and get experts to look at it. And I’ll tell you I’ll buy the back stop and that’s what’s – the demand has always been there. This has been a requirement inside our features on the software since November of 2005. So, it took a while. But it’s arrived. It’s in our software now. And we are going to look for ways to make it more available to folks, so that that security operator, whether at a large company or small company is presented with confusion at what they are looking at. They can click on it. And when I look at the first couple clicks, where people are interested. The first couple invocations of Expertise On Demand, it was built to be there when you need it most. It’s not, hey, I need an expert and five days later, you get a phone call, it’s very timely. I need a threat briefing on this because I think I have a problem. I need a forensic review on this, because I think I have a problem. So, we are not generating the demand. It’s been there. My entire career in security is just nobody delivered it. So, we are going to do that.

[Christopher Speros:]

That’s great. It kind of in our arm and could you speak to the potential for Expertise On Demand to serve as a bridge to sell more to FireEye’s product?

[Kevin Mandia:]

Yes, I think, so, the goal in Expertise On Demand was to sell more services. It was genuinely approaching what does the market need? We need a back stub. There is a skill shortage and we are going to put it into all our products through the Helix interface and maybe even directly in some of our spoke products over time. But it’s certainly, it’s a differentiator with our products. All things being equal. You can buy an Endpoint technology that gives you alerts, or you can buy an Endpoint technology that gives you an alert and says, click here if you want additional help or a forensic review, and I just buy the second one. So, I want to be clear here though, Expertise On Demand doesn’t always have to be people. We are always trying to automate what we are learning on the front-lines. We are trying to codify our threat intelligence, codify the TTPs used by attackers and many of the requests coming in will just be, what do you know about this? And can you help? And we’ve already got it in a system. So, a lot of times as we automate what we do and streamline what we do, we are going to provide the expertise people need and there may be no human involvement. It will literally be a system that can answer the questions. And we’ve kind of relied on the technologies similar to that internally for probably a decade now and we just want to make it more available to our customers.

[Christopher Speros:]

Great. Thanks.

[Operator:]

Our next question comes from Sterling Auty with JPMorgan. Your line is open.

[Sterling Auty:]

Yes, thanks. Hi guys. Want to dive into a little bit, we’ve heard a lot of positive commentary about the SKU reduction and you guys are easier to work with coming through the channel. Can you give us a sense of the magnitude of the SKUs reduction that you’ve actually done? And kind of follow-on to that is, you talked about fish up your subscription pricing initiatives. Can you remind us what was it before and what is it now and maybe where it’s headed?

[Kevin Mandia:]

Yes, so, in regards to the SKU reduction, it was so significant. I took the numbers out of the earnings call. Quite frankly, I mean, we have email security. We have Endpoint security. We have network security. We have a platform called Helix. We have services. We have Managed Defense. We have Intel. I think that’s seven things. That’s what we have. And so, let’s simplify and then we got a new product marketing on board about a year, year and a half ago that speaks my language of keeping it simpler. So the bottom-line is showing that indirectly answers your dramatic reduction of SKUs, because I even found it confusing. So, we did a lot better there and we got it to a very manageable amount. And the second question, Sterling, sorry, that was in regard to our campaign. It was in regards to FireEye campaign?

[Sterling Auty:]

You mentioned the subscription pricing initiative that you had completed. I didn’t know if that was separate from the SKU reduction and just what is that and what kind of impact may be?

[Kevin Mandia:]

Sterling, it was that broke from that and we got – we really implemented the subscription-based pricing in basically the tail end of, sorry, the tail-end of the first half of 2018. And we increased the number of products that we now sell and we now sell all products via subscription basis. But that was pretty much a 2018 initiative that we continue to expand on. But that has definitely had an impact on the channel, because it really has simplified the pricing.

[Sterling Auty:]

Got it. Thank you.

[Operator:]

Our next question comes from Melissa Franchi with Morgan Stanley. Your line is open.

[Melissa Franchi:]

Thanks for taking my question. Kevin, you talked about having the technology in place to now be the first-line in defense for Endpoint and for email. I guess, just focusing on email specifically, are you already starting to see customers bring in FireEye as the first-line of defense? And if that’s the case, what are you seeing in terms of competitive win rates?

[Kevin Mandia:]

Yes, so, right now, I am starring at the original person who created our ETP software. I believe we have hundreds of customers that uses as a single line of defense in email. And I am getting nods of affirmation. The numbers that I heard the first time quite frankly were higher and I didn’t want to – I haven’t validated it, but it’s hundreds and sometimes, you don’t always know clearly, just by looking at sales force and the data we have. But we have hundreds of customers that rely on us as a single line of defense in email.

[Melissa Franchi:]

Okay, that’s great. And then, one follow-up for Frank on Expertise On Demand. Kevin talked about how some aspects of that product is automated, it’s just not purely people-oriented. So how should we think about the margin profile of Expertise On Demand? Does it look more like a services offering or does it look more like a products and subscription offering?

[Frank Verdecanna:]

Yes, I think, right out of the gate, Melissa, it’s going to look very similar to – well, it’s going to look pretty much in the middle. I would say of services and our typical 75% gross margin and the reason why we think over time that can increase as we continue to automate a lot of the service delivery components of it. And right out of the gate, there is an Intel subscription component that obviously is at a much higher margin. So we feel pretty good that it’s going to be somewhere in the middle of the 53% services margin and the 75% kind of product and subscription margin.

[Melissa Franchi:]

Very helpful. Thank you.

[Operator:]

Our next question comes from Saket Kalia with Barclays. Your line is open.

[Saket Kalia:]

Hey guys. Thanks for taking my questions here.

[Kevin Mandia:]

Hi, Saket.

[Saket Kalia:]

Hey, Kevin. Hey, Frank, maybe just start with you, we’ve got the first full quarter of Expertise On Demand under your belt. Maybe just to ask the question rightly, can you talk about how big that might have been from a billings perspective. I know that it had a pretty successful run in Q4 and limited availability. But curious how much that did here in Q1? And then, maybe related to that, can you just remind us how the revrec around Expertise On Demand will work?

[Frank Verdecanna:]

Sure, so for Q1, it did exceed our expectations and we saw nice growth from the number of customers signing up for Expertise On Demand from Q4 to Q1. And one of the things though, I think we are really excited about is, when you look at Expertise On Demand, we continue to add to that catalog of services. And even though, you think of services as typically having a lower gross margin, from an operating margin perspective, it’s actually pretty strong, because of the fact that a lot of it’s in-bound and so, you don’t have the same sales and marketing cost that you would have with a traditional kind of product or subscription sale.

[Saket Kalia:]

That makes sense. Maybe Kevin, for you for my follow-up. How do you think about staffing in that business? In terms of the amount of headcount that you need to sort of support. How big you think kind of Expertise On Demand can be? And just related to that, you’ve got so much great talent in the Mandiant part of the business, can you actually leverage some of that talent for Expertise On Demand as well?

[Kevin Mandia:]

Absolutely. I was just on the phone this morning with one of our teams that have been deployed for weeks and weeks and have families at home. I’d much rather walk across the hallway and answer an Expertise On Demand investigation and get in a Boeing 737 and fly and solve it. The best security company of the future has the traps in the technology in place that they can send their expertise in 30 seconds, not on an airplane. So, I think we get great response on this. We are really good at what I call the all points bulletin. If we get an Expertise On Demand enquiry, we know how to form that thing out and find the most appropriate expert amongst our Intel analyst as well as the Mandiant consultants. And quite frankly, I’d be racing down the hall to get that one before I get the phone call that puts me on the next plane. So, I feel very comfortable that as we modernize security, we can investigate and do full blown investigations remotely at speed, full blown back stop to your security expertise for the needs that you have at that moment from a remote location and it will actually make the life of the consultant and Professional Services folks easier. So, that’s what we’ve always wanted to design at that way. And that’s what we intend to do.

[Frank Verdecanna:]

And Saket, the full resources we are able to use to deliver on Expertise On Demand is both the Mandiant experts, but also our Intel analysts that our Managed Defense personnel as well.

[Saket Kalia:]

Very helpful. Thanks guys.

[Frank Verdecanna:]

Thank you, Saket.

[Operator:]

Our next question is from Tal Liani with Bank of America. Your line is open.

[Kevin Mandia:]

Tal, how are you?

[Tal Liani:]

Hey guys.

[Kevin Mandia:]

Hearing now.

[Tal Liani:]

And now I know how to press the unmute button. A question I have on growth acceleration throughout the year. There are many puts and takes this quarter and things that are doing better than expected and others that are less. But you sound very bullish and you are implementing some initiatives in order to accelerate the growth. So, I want to ask you the same question I am kind of asking myself looking at the quarter results and the outlook is, what are things that you think that need to be fixed or need to be addressed in order to accelerate the growth? Because at the end of the day, the billing growth is nice and you will increase the range. But it’s still in the single-digit level touching the double-digit level. What do you need to do in order to accelerate the billing growth more meaningfully in the next three years?

[Kevin Mandia:]

How I think it’s – you know, it’s kind of staying on the path we are on. I think, one of the first things we had to do was kind of stabilize the core. And I think we’ve done a really good job of doing that and we are showing in the quarter and in the year. We showed growth in network, email and Endpoint. So, I think, that was step one. And step two is really to just getting the acceleration and the continued innovation on the platform which will ultimately drive the biggest share of growth.

[Tal Liani:]

When you say, innovation on the platform, do you feel that you need other solutions to increase the TAM of the platform?

[Kevin Mandia:]

The current platform doesn’t have any major holes and I think you are always looking for opportunities to add on to the platform as things that could be synergistic to it. But I feel really good about the platform as it is. I think it’s our roadmap and the enhancements we do every quarter, I think has come a long way. And so, we are really excited about kind of the evolution.

[Tal Liani:]

And lastly, you touched on the go to market. Can you elaborate on the areas where you want to improve with your go to market strategy?

[Kevin Mandia:]

Yes, this is Kevin speaking. I think a lot of it was on technology. I think we have channel account managers and we have good programs in place. We have good marketing in place. We were always a company tell that’s solve the hardest security problems. We think we were that second-line of defense and always got us the best line of defense. When the firewall missed something, we detect it. When your Endpoint missed something it was our Endpoint that investigated why did other Endpoint technology missed something. When you had an email gateway in front, we were behind that email gateway detecting what it has missed. And I think the best thing we could do with channel is build more into that first line of defense and that’s why we took our email, security and we’ve built into a security mail gateway and we are taking Endpoint and doing the same thing. And I think that’s the best thing we can do to get more performance and leverage to the channel is get those product features and then at layer one. Large enterprises they are fighting with two to three layers of defense But the small to medium businesses where the folks that have a skill shortage just want to buy a technology and that technology does a lot of different things. So we're moving into layer one and that's why I continue to give folks the update on that. And then on your first question, why we sound bullish, it's hard not to be when you get a couple hundred thousand of hours of response, we are behind everybody else's products. I mean, we see what they miss. We know exactly what to build to have the best detection efficacy. So we always have a pretty good confidence on what we got to build. But we still got a roadmap that we got to deliver on. But I look at the next three quarters of our plan of record and I think they are all meaningful that if we deliver to our products plan of record, our sales teams can be pretty damn pleased with what they've got in the back.

[Tal Liani:]

Yes. Thank you.

[Operator:]

Our next question is from Jonathan Ho with William Blair. Your line is open.

[Jonathan Ho:]

Hi. Can you hear me?

[Kevin Mandia:]

Yes, Jonathan, loud and clear.

[Jonathan Ho:]

Sounds good. So, I just wanted to maybe start with the Mandiant Services side and whether you could give us may be some rules of thumb or some thoughts around how the Mandiant Services can translate into products over time.

[Kevin Mandia:]

Sure.

[Jonathan Ho:]

Which products are typically adopted more quickly, that sort of thing?

[Kevin Mandia:]

Yes, well, it depends on the problem we are solving, right? That's the – the thing about services is you show up, it can solve a problem. And when you look at the breaches, we've shown up and we've used other people's technology to respond to breaches and you have to. You got to house on fire, you can't say wait nine days and install our stuff. But what we have found is our Endpoint technology is genuinely the best suited for what we've got to do to uncover what happened and what to do about it. So one motion, and there is many motions, I'll just give you a couple. First, motion is the Endpoint motion. We have to deploy our tech to do the forensics we need to do at scale to figure out how will someone breach. When will they beach. What was taken and what to do about it. So, virtually every single time we have to do that. Another thing we do, we call it a Compromise Assessment and I think we invented this market. You have assessments out there called vulnerability assessments. That's a great market. But what you learn is everyone is vulnerable all the time. What you actually want to answer if you are a Chief Information Security Officer is am I currently compromised right now and I don't even know it. We have found, we scale that best with our Endpoint technology as well. So there is two services, incident response and compromise assessments, we find we performed far better ultrasounds of your network to find bad stuff with our Endpoint. And we just - we are just we're honed in on how to do that. So those are two examples where the customer see how we use our Endpoint. And nine times out of ten, they're saying hey we want to able to do that. We want to have that capability and sometimes that leads to Managed Defense where we are going to provide some augmentation to their staff remotely to solve some of more complex issues, sometimes adds us training them in our technology. Well, a lot of times during the breach, people got spear-phished and they've learned that their current solution is constantly being circumvented and they recognize that we actually have a feedback loop to improve our Email Security. And so they'll purchase the Email Security product right then and there. So, those are three examples. But ultimately, our services folks show up to solve problems. It just happens to be that they're enabled by some of the technologies we great and that's very intentional.

[Jonathan Ho:]

Got it. That's a great color. And then, just in terms of Office 365 transition, it was just a positive driver for your business. I was a little bit surprised to hear sort of the strength on the appliance side investor services. Just want to get a little bit of color on what's happening there?

[Kevin Mandia:]

I'll answer first and then give it up to Frank. But we let our customer pick. It's that simple. We just say hey, you can have it on-prem, you can have it off-prem. And there is still folks that would prefer the on-prem solution to it, so.

[Frank Verdecanna:]

Yes. And I think, again, Jonathan the key point there is, because people can see a migration path to the cloud and they know that we have a great cloud offering as well, it's a really easy migration for them to go ahead if they're not yet ready for the cloud, go ahead, buy our on-premise appliance and then migrate to the cloud whenever they are ready. So I think because we've outlined that path for them, we still have a fair amount of strength on the email appliance side as well.

[Jonathan Ho:]

Great. Thank you.

[Operator:]

Our next question is from Robert Breza with Northland Capital. Your line is open.

[Robert Breza:]

Hi, good afternoon.

[Kevin Mandia:]

Hi, Robert.

[Robert Breza:]

Two questions. One for you, Frank. As you look at the new SKUs and the new pricing model that's in place, does that have any, call it, collateral damage to any other pricing of contract per se? So, collateral damage would be one question. And then, Frank, as you think about new pricing model, can you talk a little bit more in depth about some of the changes you are making to the sales operations to make sure that these incentives are being properly incented and use cases created et cetera? Thanks.

[Frank Verdecanna:]

Sure. We don't actually see any collateral damage from the new pricing. I think one of the reasons that we actually implemented was really because one of the challenges we were seeing in not getting the channel leverage we were looking for was that our products were very complex and they were much more difficult to buy than some of our competitors. When we went to the simplified pricing, it's very easy for our sales team and the channel teams to go to market and go with a simplified per user pricing rather than trying to figure out how many appliances they need and what the attached subscriptions look like. So I think, from our perspective, it should be a nice boost to channel leverage. It should be a nice boost to productivity. And I think it already has been to a certain extent. So we are really excited about kind of the impact from that.

[Robert Breza:]

Got you.

[Kevin Mandia:]

Yes. Robert, I mean, it was a simple challenge I always thought you should be able to buy something without viewing a four dimensional spreadsheet. So we really simplified it.

[Robert Breza:]

Yes. And then I guess, Kevin as you think about the sales force and the incentives, I mean, I am assuming the packages that are put in place and all of that is set in motion, I am guessing any early feedback that you're getting from your sales changes and SKU changes? Thanks.

[Kevin Mandia:]

Yes. I think it will be - first we did it to get leverage but second it’s to streamline the sales process to, you want to eliminate some of the drag and complexity there and I think it does the same thing. It makes the conversation easier. So, I think our sales force is well-versed and hey, how do we go from this? The model we had so you can buy our things as subscription over time. And they are well-versed at this. We just got to train them on the new ones that we just completed. But I am confident we'll get that done. The best thing about it is just the menu for our customers. How do you want to – there is, you can subscribe to whatever service we have and I just love the simplicity. We did a bundle we call Hermes internally and it was just Endpoint, Email, priced by user. That's how you should think about it. You shouldn't be thinking how many different geographies? How many different servers? How many different things? It's just subscribed price by user. It just makes you more understandable and that will increase sales.

[Robert Breza:]

Great. Thank you very much.

[Frank Verdecanna:]

Thanks, Robert.

[Kevin Mandia:]

Thank you.

[Operator:]

Our next question comes from Ken Talanian with Evercore ISI. Your line is open.

[Ken Talanian:]

Hi, thanks for taking the question.

[Kevin Mandia:]

Ken, how are you?

[Ken Talanian:]

Doing well. Thank you. So, you saw solid growth on the Cloud Subscription and Managed Services ARR. Could you give us a sense for the trends you are seeing with your net retention rate there?

[Frank Verdecanna:]

So, if you look at the products or solutions that fall in the Cloud Subscriptions category, it's our Managed Defense, it's Helix, it's Intel and it's our ETP solution. And historically, and recently, we've had very strong renewal rates in that area. And I think some of those areas we've actually improved quite a bit over the last, I'd say four to six quarters.

[Ken Talanian:]

Great. And it sounds like you've done a number of things to help enable the channel from a product and packaging perspective and pricing of course. Could you give us a sense for whether you are seeing an inflection in contribution from the channel or where we are in that process?

[Frank Verdecanna:]

Ken, I think it's still really early days. A lot of that changes that’s kind of just happened over the last couple quarters. We see an early signs of traction there. But I think from an opportunity perspective, I think we are still really early in the process of getting true channel leverage.

[Kevin Mandia:]

We just had our first quarter of security email gateway capability for the outbound email. So I think we got to give that time. On Endpoint, we have the Endpoint Prevention on Windows. We got to expand it to another OS. And I think you'll see more traction there and we got to simplify. But all these things are on the roadmap. So I think as we get those layer one features, and substantiated and embedded in our technologies, that's when we'll see more leverage in the channel.

[Ken Talanian:]

Great. Thank you.

[Operator:]

The next question comes from Fatima Boolani from UBS. Your line is open.

[Frank Verdecanna:]

Fatima? Hello?

[Frank Verdecanna:]

No answer.

[Frank Verdecanna:]

Hello.

[Operator:]

Fatima, if your phone is on mute, could you ummute your phone?

[Fatima Boolani:]

Sorry, I just muted. My apologies. Thanks for taking the question. Kevin, maybe to start with you and actually just jumping off on the last topic of discussion just around channel relation. In your prepared remarks, you did mentioned that working – continuing to work with the channel is going to be an important growth avenue for you going forward. So I am wondering how we should see the success from your ongoing initiatives with the channel manifest? Should we see that in – an inflection in your customer count? Should we see that in terms of more operating leverage? I just want to better understand how we can sort of gauge your success…

[Kevin Mandia:]

It's a great question.

[Fatima Boolani:]

As programs unfold?

[Kevin Mandia:]

Yes, so what we always measure? We measure multiple things internally but I think you would see it in customer count. You would see it in operating leverage. You know - and we're fervent about it because we are just so – we love our detection efficacy but we don't believe we’ve made it available to us effectively as possible and we're still working to do that. So, we got closer every single quarter, we've made the relationships happen and we just got to get our detection to be available for all companies and that's what we're trying to do. We track it internally in multiple partner source versus partner work. I can't remember the exact category names now. But we have three categories kind of the ones we do ourselves and fulfill through partners and channel and then there is the ones where the partners actually source it. They find the deal and we wouldn't have gotten it otherwise. And we always look for increasing performance there. And then it's like partner – I forget the middle category. But the partners are working hand-in-hand with us and we do that. We review that every 90 days. But in short, it will be customer count, because if we're looking for leveraging the markets we don't traditionally sell into. And you will see it quite frankly in top-line performance as well as bottom-line performance, it will impact everything.

[Fatima Boolani:]

That's really helpful. And Frank, if I can sneak one in for you, appreciate, there's a lot of moving parts in sort of the billings and the billings trajectory for the year as we think about for the large deals you did last year. But as I think about your pro forma billings growth this quarter, the acceleration in pro forma billings growth you're expecting next quarter and through the implied deceleration in the back half relative to the midpoint of your guidance, how do I reconcile that sort of deceleration in the back half with some of the commentary around Expertise On Demand just really exceeding expectations and the reacceleration that you are expecting on the cloud subscription side on the second half? If you can step through those, that's super helpful. Thank you.

[Frank Verdecanna:]

Sure, Fatima. So we are not actually guiding specifically Q3 and Q4. But obviously we're implying the second half growth rate. I think, we haven't made any adjustments to that. It's obviously early in the year. But we are very encouraged by what we saw in Q1. We are very encouraged by our outlook for Q2 and we'll obviously update Q3 and Q4 as we get closer to the midpoint in the year.

[Fatima Boolani:]

Thank you.

[Kate Patterson:]

I think we have time for one more question.

[Operator:]

Our last question comes from Michael Turits with Raymond James. Your line is open.

[Michael Turits:]

Hey, guys. Good evening. Kevin, as you talked about going layer one or level one on Endpoint in particular, can you talk about how much demand there is for Endpoint replacements and upgrades? Where you are fitting in? And whether or not pricing is stable or you are seeing pricing pressure?

[Kevin Mandia:]

I don't feel too much pricing pressure, but there is – we've got ourselves priced competitively there. I do believe there's a need for it and I think that there is kind of like a land rush for it right now. We've been on this journey for a lot longer than people realized. Just started building Endpoint tech in 2005, 2006 recognizing that the legacy AV companies from my perspective were barely security companies. They were just looking for signatures and that's it. There was an arms race. So we knew there is going to be a second-generation. Right now, the second-generation is having its day, but really all of them have different gaps somewhere in them in my opinion. So, the market is that there is a need for next-generation Endpoint Detection, signature list-based detection, as well as signature-based or at least the equivalent of that, so that you can be compliant with different standards, legislation or regulations across the globe. And then, what we like to differentiate is investigative capability as well and then the Expertise On Demand capability that you can have in there. So, bottom-line, people are evaluating it, what's the best Endpoint, what do we need, what best fits with us. And what I've observed in my opinion, in my first-hand experience, right now, the one enterprises are going with multiple Endpoints for different reasons.

[Michael Turits:]

Great. Thanks.

[Operator:]

Thank you. And this ends today's question-and-answer session. I would now like to turn the call back to Kevin Mandia for any closing remarks.

[Kevin Mandia:]

I would like to thank everybody for making time to join us on the call today and I look forward to speaking to everybody in 90 days. As a quick follow-up, the high-level themes that I felt, we are delivering growth, we are delivering growth profitably as we transform from the origins of this organization into a platform that can help prevent, detect, investigate, and remediate security incidents. Thank you very much for your time.

[Operator:]

Ladies and gentlemen, thank you for participating in today's conference. This does conclude today's program and you may all disconnect. Everyone have a wonderful day.