Mandiant, Inc.
Q3 2019 Earnings Call Transcript

Published: 29 Oct 2019

[Operator:]

Ladies and gentlemen thank you for standing-by and welcome to the FireEye Third Quarter 2019 Financial Results Conference Call. At this time all participants lines are in a listen-only mode. I would now like to hand the conference over to your speaker today Ms. Kate Patterson. Thank you. Please go ahead Ma’am.

[Kate Patterson:]

[Kevin Mandia:]

Thank you, Kate, and thank you to all of you the investors, employees, customers and partners joining us on this call. We appreciate your interest and support in FireEye as we continue to transform from our origin as a network security product vendor to a comprehensive security platform company.

[Grady Summers:]

Thank you, Kevin. It's been a busy few months since I've taken responsibility for the FireEye products team. We took immediate steps to realign the organization for more speed and accountability, improve our cost structure, refocus our customer retention efforts and accelerate new product introduction. While we will continue to refine the new organizational structure, I'm very pleased with the renewed energy that this reorg has delivered.

[Kevin Mandia:]

Thank you, Grady. Everybody's impressed with what the team has done in the last 90 days and we're really excited to hear more. As we continue to evolve into a comprehensive security platform. I believe our innovation cycle uniquely qualifies us to define and lead modern cyber defense. And we will do so in four ways

[Frank Verdecanna:]

Thanks Kevin and hello to everyone on the call. Since we just hosted our analyst day a few weeks ago where we discussed our Q3 performance for billings, revenue and ARR, as well as our long-term target model, I'm keeping my remarks relatively brief. For those of you who are unable to attend analyst day, the slides are posted in the Investor Relations section of our website. We also have included the long-term model slides in the appendix to the Q3 2019 financial results slides. Before we move on to the details of our Q3 results and our guidance for Q4 and 2019. Let me remind you that I'll be referring to non-GAAP metrics except for revenue and operating cash flow. Our non-GAAP measures exclude stock-based compensation, amortization of intangibles, non-cash interest expense on our convertible debt, restructuring charges and other nonrecurring items. Turning to our Q3 results, billings of $249 million were near the middle of our guidance range up 13% from a year ago. We have now posted double-digit year-over-year billing growth rates in three of the last four quarters. We achieved this sustained growth while diversifying our customer base beyond the 1A enterprises and reducing our dependency on large deals. To be clear, our business was 1A enterprise customers remain strong globally and our sales with Global 2000 customers expanded in both dollars and number of transactions. However, a meaningful proportion of our billings growth in the third quarter was driven by non-Global 2000 customers. Our increased traction with medium-sized enterprise customers is evident in a 30% year-over-year increase in a number of customers transacting in Q3 and by double-digit growth in new logo customers. We added 276 new logo customers in the quarter. We added new logo customers in every product, family and across every major geographic region. Notably, approximately one-third of these new logo customers adopted multiple products or services in the initial transaction. This multi-product adoption was a key factor in a year-over-year increase in the average transaction size for new logo customers. Taking a closer look at our billings performance and the related ARR metrics by the portfolio categories; first, platform, cloud subscription and managed services billing exceeded product and related subscriptions and support billings for the first time in our history. Platform, cloud subscription billings increased 43% year-over-year, excluding Verodin year-over-year growth in this category was 35%. This growth resulted in an 11% sequential increase and a 32% year-over-year increase in platform and cloud ARR to a total of $263 million. While Verodin contributed to this growth, our cloud security solutions, including e-mail, endpoint, helix, managed defense and Intel accounted for the majority of the increase. Mandiant professional services billings grew 40% year-over-year to an all-time high of $55 million. Services deferred revenue was also at a record level, increasing 14% sequentially to $76 million. Finally, our appliance-based product and related ARR stabilized following the end-of-life of the third generation appliances that had impacted our first half 2019 results. Turning to revenue, revenue of $226 million exceeded the high-end of our guidance range by about $5 million. The over performance was driven by a strong services quarter as well as a few million more of up front revenue than we had forecasted related to network forensics appliance sales, where the majority of that revenue is recognized upfront. Approximately 86% of non-services revenue was recognized from current deferred revenue on the balance sheet. Platform, cloud subscriptions and managed services revenue was at a record $62 million in the quarter. The growth rate accelerated to 27% year-over-year reflecting the growth and billings, ARR and deferred revenue we have experienced since early 2018. Mandiant professional services revenue of $46 million was also at an all-time high. The services revenue growth accelerated in Q3 to 28% year-over-year, reflecting the continued strong demand and the capacity we had added in 2018 and for the – and 2019 year-to-date. Product and related subscriptions and support revenue decreased 7% from Q3 2018 to $118 million. The year-over-year decrease in revenue reflected the $23 million year-over-year decline in current deferred revenue opening balance sheet for this category. As we've discussed in the past, we recognized appliance revenue ratably over four years under the 606 accounting standard. This means product revenue is directly correlated to deferred revenue and specifically to current deferred revenue. Since we sell fewer appliances today than we have in the past, and 75% of all new appliance sales are added to non-current deferred. We are recognizing more revenue from current deferred revenue than we are adding back. This results in a net decrease in the current deferred for product and related subscriptions and support, which translates to lower product and related subscription revenue. This headwind to revenue impacts both the absolute dollar amount of product and related revenue recognized and the year-over-year growth rates. The good news is that the accelerating growth in platform and cloud subscriptions and managed services line should more than offset this backward looking dynamics in product and related subscriptions. Revenue gross profit margin as a percentage of revenue was 73% in the quarter, down from our Q3 2018 gross margin of 76%. The majority of the year-over-year decrease as a percentage of revenue was related to higher hosting costs for our cloud-based products compared to a year ago, which we discussed in detail on our last call. We have already made progress managing these costs and costs of goods sold for non-services was flat sequentially even with substantially higher sales of our cloud-based solutions. Overall gross profit increased by about $7 million sequentially from Q2. Total operating expenses increased about $1 million sequentially reflecting in full quarter of Verodin operating expenses. Operating expenses as a percentage of billings declined from 67% in Q3 of 2018 to 64% in Q3 of 2019, demonstrating continued leverage in our business model as we execute on our long-term growth plan. The increase in gross profit was greater than the increase in operating expenses allowing us to generate operating profit of $4 million or 2% of revenue. With other income offsetting taxes, operating profit translated to net income of $4 million and earnings per share of $0.02, which was at the high-end of our guidance range. Included in the quarter was a GAAP restructuring charge of $6.5 million for an optimization and reallocation of resources which occurred late in Q3. Turning to the balance sheet and cash flow, we continue to maintain a very healthy balance sheet with cash and short-term investments of about $1 billion. We ended the quarter with receivables approximately $154 million, an increase of $26 million from the end of Q2. DSOs calculated on billings were 57 days, which is at the low-end of our target range of 55 to 65 days. Growth in our billings combined with timely collections continues to drive our cash flow performance. We generated $18 million from operating activities in the quarter. This was within our guidance range of $15 million to $25 million and included approximately $6 million in restructuring payments. We ended the quarter with total deferred revenue of approximately $935 million, an increase of $23 million sequentially and $48 million from the end of Q3 2018. Product and related deferred declined $26 million year-over-year, and platform, cloud subs and managed services increased more than $50 million. With the improving performance in Q3 as a backdrop, we are making some adjustments to our prior implied guidance ranges for the fourth quarter, which also drives some adjustments to our guidance ranges for the full year. We currently expect fourth quarter revenue to be between $224 million and $228 million. This calculates the 2019 revenue in the range of $878 million and $882 million, an increase of $10 million at the midpoint from the midpoint of our prior guidance range. This increase reflects the revenue overperformance in Q3, as well as higher platform cloud ARR and an increase in services revenue. We expect fourth quarter billings in the range of $285 million to $295 million. This calculates to a range of $937 million to $947 million for 2019. While we usually don't guide billings or revenue mix between the portfolio categories, it’s worth noting that we expect platform, cloud subscription and managed services category to contribute most, if not all of the year-over-year growth in Q4 billings. This is because we expect continued momentum in Helix, managed defense, Intel and cloud e-mail and cloud endpoint. Additionally, any incremental billings for our new AWS hosted network security and detection on demand solutions will be captured in the platform and cloud category. Recall that we saw a large increase in services billings in Q4 of 2018 and we have continued to build a backlog of services yet to be delivered. As a result, we expect services billings to be relatively flat with Q4 of 2018 and with Q3 of 2019. Finally, our billings guidance for Q4 assumes product and related subscription and support billings to be relatively flat with Q4 of 2018. For revenue, we expect services to be flat to slightly up compared with Q3. This is because we have already been operating near capacity in terms of billable hours and there are fewer potential billable hours in Q4 due to the holidays. Revenue for the other portfolio categories is correlated to our current deferred revenue ending balances, implying growth in platform and cloud subscriptions and a year-over-year decline in product and related subscriptions and support revenue. We expect gross margin of 73% for both the fourth quarter and the full year. We expect fourth quarter operating margin to be between 3% and 5%, which implies a sequential decline in operating expenses of $4 million to $5 million. The implied sequential decline reflects the usual seasonal decrease in payroll tax as well as the cost optimization exercise we completed in Q3. This calculates to an operating margin for the full year between breakeven and 1%. Earnings per share is expected to be between $0.03 and $0.05 for Q4 and between $0.01 and $0.03 for the full year. Operating cash flow for Q4 is expected to be between $57 million and $67 million, an increase of approximately 100% from Q4 of 2018 at the midpoint. This calculates to full year operating cash flow of between $85 million and $95 million, implying growth of approximately 50% at the midpoint. Our updated annual cash flow expectations for 2019 include the approximate $6 million of restructuring payments recorded in Q3. Finally, we expect CapEx for the year to be between $48 million and $50 million. We continue to expect our CapEx to decline modestly next year as we have completed all our major planned facility moves. That concludes my prepared remarks. We'll now take your questions. Operator?

[Operator:]

Our first question comes from Saket Kalia with Barclays Capital. Your line is now open.

[Saket Kalia:]

Hi, guys. Thanks for taking my questions here.

[Kevin Mandia:]

Hey, Saket.

[Saket Kalia:]

Hey, Kevin. Hey, Frank. Frank, maybe just to start with you, nice performance on the platform billings. Can you just dig into the makeup of that line a little bit more? Meaning, how much of that is more product related with things like endpoint and e-mail and Helix versus other types of subscriptions like Verodin for example? So what sort of product-related, what sort of platform-related inside of that line?

[Frank Verdecanna:]

Yes, Saket. I think what really drove – really the stellar performance with 43% year-over-year growth in that category, it was really across that category and that's because we had a really solid quarter and the cloud solutions of both e-mail and endpoint, and then also on managed defense, Intel, Verodin and Helix all performed really well. So, it wasn't one specific product within that category that drove it. It was really year-over-year solid growth across the category.

[Saket Kalia:]

Got it. Got it. And Kevin, maybe for you, when you think about obviously a really successful split between sort of the products and the platform organization done in just 90 days to your point, when you think about the go-to-market and just general kind of platform organization, can you just talk about the cut – the typical customer profile for platform customer? How do deal sizes look in sort of that segment? Anything that you would call out in the platform business specifically just as we sort of get to know these two a little bit more independently?

[Kevin Mandia:]

Yes. So, for the majority of our customers, the avenue in and its services are endpoint or e-mail or network or Intel. And we're looking at platform to kind of be the bridging function between all of it so that if you want to experience FireEye, you get platform. And so what you're going to see in most buying experiences, the avenue in is one of those ways I mentioned and platform comes along with it and platform opens up a fusion of all of our capabilities. So if somebody buys endpoint and they're consuming endpoint in platform, the avenue in was endpoint, platform shows added value because it shows an introduction to our Intel, our expertise on demand, and then some of the other services that we can do as well as the integration into network or e-mail. So I see – for now the point of the spear is sometimes the spokes in the services and I think over time you'll see a rotation too. We want the suite, but right now the reality of buyers, they're not here to buy the whole suite of everything. They're here because they have one need. We meet that need and then platform is the glue that shows the value of everything else. So I gave you one example, one spoke leading to everything we've got with platform as the way they consume the spoke and see the fusion of all our capabilities.

[Saket Kalia:]

Understood. Very helpful. Thanks guys.

[Kevin Mandia:]

Thank you.

[Operator:]

Thank you. Our next question comes from Sterling Auty with JPMorgan. Your line is now open.

[Kevin Mandia:]

Sterling, how are you?

[Sterling Auty:]

Hey, guys. I'm good. I'm good. So listen, there's been a number of news reports recently in terms of what you guys might be thinking in terms of strategic alternatives. I know sometimes it's tough to comment, but just so in a public record you can at least give us some insight in terms of your thinking. Any comments or ways that you would answer that question?

[Kevin Mandia:]

Yes. Sterling, this is Kevin. Just as a matter of policy, we don't comment on rumors. And then just a matter of personal habit, I don't get distracted by rumors. So I generally show up every day not thinking about how do we exit. I show up everyday thinking how do we execute and that's just what we do around here. So we're building this company to be the best security company it can be.

[Sterling Auty:]

I really appreciate that. And then in terms of looking at the subscription, the non-product related subscription, how much of that is coming from existing customers that you've already had relationship with from NX et cetera versus how much are you starting to tap into new customers?

[Frank Verdecanna:]

So I think, yes, with the growth in that category is really coming from both, new customer logos and then also just cross-selling and up-selling within the existing customer base. I think we've seen a really nice kind of land and expense strategy. Again, like Kevin mentioned earlier, the tip of the spear often could be e-mail, network or endpoint or services. But ultimately, I think we get our customers involved in that category in a lot of different ways.

[Sterling Auty:]

Thanks guys.

[Operator:]

Thank you. Our next question comes from Ken Talanian with Evercore ISI. Your line is now open.

[Kevin Mandia:]

Ken, how are you?

[Ken Talanian:]

I'm doing well, thanks. Thanks for taking the question. So I was wondering, could you discuss your net retention rate, some of the factors driving it in the quarter? And then maybe related to that, can you just talk about how much variability there might be in your forecasting at this point given uncertainty in terms of purchasing patterns between physical appliances and virtual sensors?

[Frank Verdecanna:]

Yes. So Ken, I think one of the things we're really excited about in the quarter is that we did see a nice bounce back in our retention rates. If you remember in Q1 and Q2, we had the end-of-life for our third generation appliances. So we saw a pretty big hit on ARR and the retention rate relating to some of those customers. We saw a nice bounce back in Q3 guided above 100% again. And I think it kind of hit exactly where we expected to do, which was a really nice bounce back because we only had $3 million left in ARR as of the end of June 30 related to the third generation. And then your second question with respect to, yes, the visibility within those categories, I think we still continue to see kind of that general kind of migration to the cloud. So I think we feel very confident in the long-term growth in the platform cloud subscription category. In any one quarter the larger deals could go on-premise versus the cloud. So we don't obviously have perfect visibility into which way the customer will prefer to purchase. But I think you can see with the growth in the platform and cloud subscription category that is generally heading towards the cloud direction and that's why we're so excited about a lot of the innovations we've done in the cloud.

[Kevin Mandia:]

Yes. And Ken, just to be clear, we don't incent one way or another to our customers. They'd pick whether they want to go with on-prem solutions or cloud-based solutions. So we don't steer it any way. We provide the menu to the customer and let the customer choose, and that does probably create a little bit of variability there. But ultimately we're letting the market pick the form factor. We're not gaming it in any way.

[Ken Talanian:]

Great, thanks. And if I may, just a quick follow-up, how are you thinking about linearity in 4Q given the holiday schedule this year?

[Frank Verdecanna:]

Yes, typically Q4 has got probably the best linearity of any of the quarters just because I think people try to get the tail end of the December off. So we typically have a much better cycle of purchases within kind of the earlier part of the quarter and definitely the earlier part of December versus other quarters tend to be very back-end loaded.

[Ken Talanian:]

Great. Thanks so much.

[Operator:]

Thank you. Our next question comes from Gregg Moskowitz with Mizuho. Your line is now open.

[Kevin Mandia:]

Gregg, how are you?

[Operator:]

Gregg, please check your mute button.

[Gregg Moskowitz:]

Hi, guys. Sorry, I was on mute. Hey Kevin, how are you?

[Kevin Mandia:]

I'm great.

[Gregg Moskowitz:]

I believe you mentioned a 30% year-over-year increase in the number of customers transacting in the quarter, which is pretty impressive. I would assume this is at least in part due to broader traction with the channel, but any additional color there would be very helpful.

[Kevin Mandia:]

Yes, definitely more traction with the channel, and Frank, you can expound on it. But I think we've seen this trend, maybe not to that percentage, but we've seen this trend for the last few quarters of just greater transactions velocity.

[Frank Verdecanna:]

And I think it's also the fact that we've now got multiple products that are – that is really the tip of the spear. If you think back a year or two ago from a product perspective, network was typically the way we got into customers. If you look at the last couple of quarters, actually e-mail and endpoint has been higher proportion of new customer logos than network. So I think we're seeing a nice kind of broad base customer adoption across our product portfolio.

[Gregg Moskowitz:]

Okay, perfect. And then also you guys always give good color around the particularly large deals. And so I'm just wondering if there are any very significant ones that might be in the pipe or if you're expecting any of those to what to actually close in Q4?

[Kevin Mandia:]

Yes, I think you're referring to $10 million bigger deals. I'm not aware of any.

[Frank Verdecanna:]

We don't have any built into the guidance for Q4 and we didn't have any in the third quarter.

[Gregg Moskowitz:]

Perfect. Thanks very much guys.

[Kevin Mandia:]

Thank you.

[Operator:]

Thank you. And our next question comes from Gur Talpaz with Stifel. Your line is now open.

[Kevin Mandia:]

Gur, how are you?

[Chris Speros:]

It’s actually Chris Speros on for Gur. Hi, Kevin. How are you doing? For Kevin, obviously, demand from the Mandiant Services continues to be at record levels here. Can you talk about the nature of the current breach in the environment and how we should think about this growth in terms of sustainability?

[Kevin Mandia:]

Yes, the sustainability is high because the growth is actually coming in what we call strategic services. One of the things about responding to breaches is you learn what you need to be strategic. In other words, as we show up to what people perceive as a tactical moment, we've had a breach. What happened, what to do about it. In reality, during that moment over the years, you learn what technology works, what technology does, and what technology is hard to implement, what technologies when glued together and integrated, how does it work? What processes are necessary? So we're taking the skills we've learned over the years during that moment of duress. And we're expanding our strategic services under Carmichael and other very experienced folks who have had their, decade long run of responding to breaches because you're just really well versed at that point in advising. Remember that every time we respond to a breach, the outcome of that are remediation plans. So now we're starting to get more into that proactive selling motion of selling strategic assessments, strategic reviews of people's security programs. We have a red team business, which is – we sell that and that's not responding to a breach, that's – that simulate the breach and see how good you are. And then in Verodin that purchase was literally meant to augment the red teams because I believe in security validation, everybody wants to know, hey does my security stuff work. We're the best company out there to figure that out for you and say, we've launched real attacks and we've proven it. So we are expanding and these are logical adjacencies based on our core competencies. We are expanding into these adjacencies and that's why you're seeing services grow. It's because we're just doing more with the skill sets that we have.

[Chris Speros:]

That's great.

[Kevin Mandia:]

Yes, we are responding to thousands more breaches. We do generally respond to more breaches every year, but anecdotally you never want to get on a call like this and say hey, but they're all small because somewhere out there we are actually helping customers and to them this is the biggest darn problem they're going to have in their careers. But it feels to me that in general the breaches are a little bit smaller, but far more frequent.

[Chris Speros:]

Okay. That's a great color there. And one other one for Frank. It sounds like Verodin has performed quite well since the acquisition is closed with a couple million dollar deals in Q3. Can you talk about how it's performance is tracking against the $17 million, the billings target for 2020.

[Frank Verdecanna:]

Sure. Yes. The first milestone is actually $20 million for 2019 and I think we're tracking very well to that. I think everything that we've seen in the integration and the enablement would lead us to believe that the $70 million is absolutely tracking for 2020 as well. I think we're, we've been really encouraged by the sales team and the consulting team's ability to latch onto this product and how excited they are about it. And I think we've been able to integrate the teams really well. So, I think it's tracking as planned, but we have pretty high expectations for them. So, I think it's great news that they're tracking to it.

[Kevin Mandia:]

One of the things that I mentioned in my script, and I'll kind of call it out here is a thing we call purple teaming, where we do a red team exercise and we've worked with a winning customer and we kind of go through, here's the alerts that were generated when we attacked your network and let's kind of, let’s instrument your network to stop these attacks or detect them in a manner where your processees can eliminate impact. And we've already sold that service. And so you can see our services folks are building Verodin into that motion, let's use it during the engagements. But I see this and you go out a few years, I think what really will happen here, and we were going to have it before then, but a managed service similar to vulnerability management where people want to subscribe to the concept of vulnerability management. I think the motion here will be over time, they'll always be customers that want to run the technology of Verodin themselves. But we are also going to have a fully managed capability of it that we can provide. We're the closest to the attacks with our the response we do with all the global threat intelligence we collect and the red teaming we do. Why not have us run that for you. And with our orchestration capabilities instrument defects as well. So, I have a strong sense of urgency to get a managed version of this to market and we'll update you on that. But that's the, that's what I’d buy a FireEye. So I could add someone on my front line plugging in tax and trying it out. But boy what I love to have that FireEye Mandiant team continuously assessing my security posture with real attacks and then instrumenting the fixes. So stay tuned on that. But we're going to work hard towards having a nice managed approach to this.

[Chris Speros:]

Great. Thanks guys.

[Operator:]

Thank you. Our next question comes from Walter Pritchard with Citi. Your line is now open.

[Walter Pritchard:]

Thanks. Two questions. First, Kevin on the endpoint side, it sounds like you're talking a better about that business, seen improved performance there. And I'm wondering how much of that is tied to a manage defense service on the back-end where you were able to differentiate there and that's helped to drive the performance.

[Kevin Mandia:]

Yes, I'm not sure as I sit here right now, I can't really answer that question. I mean, there's always a relationship there. I just don't have the numbers to quantify for you. Certainly that, that is the technology that our consultants use and a lot of the value in our end point is the recognition that, we can send the expertise to assist and do full forensic capability with it. But I really can't comment Frank, do you know the answer to that?

[Frank Verdecanna:]

But I think, most of the end points, the sales are standing on their own. They're not coupled with Managed Defense. I do think, there are some larger deals that have managed defence and endpoint together, which has been a nice boost to end point. But overall I think we see a lot of standalone end point deals. And like I mentioned earlier in the last couple quarters end point has been the tip of the spear of new customer acquisition.

[Grady Summers:]

So we just had qualitatively we're seeing more and more – this is Grady, by the way, more and more endpoint deals that start because of customer concerns of our ransom ware and a desire to replace legacy antivirus. And so we're seeing more, much more traction there than we were a year ago.

[Kevin Mandia:]

Yes Walter, I went right through, like total billings numbers on that and don't have that broken out. Definitely from quantity end points stands alone. If you still get the number of transactions endpoint get sold more than endpoint plus Manage Defense. But one of the things that I've always felt people really liked and was always comfortable with is knowing there's a second layer of defense when they have endpoint plus manage defense. They know we're looking at the same alerts they're looking at and we have expertise on all their problems. So that if they feel they lack the internal staffing to deal with things we can do it for them. So I see there's definitely a relationship. Can't quantify it on the phone today.

[Walter Pritchard:]

Great. And then Frank, on your end, on the OpEx, you took some actions in the quarter, you talked about OpEx run rate will be down in Q4. Can you help us understand sort of the steady state, maybe OpEx base of the companies you head into next year or some ways you have the M&A costs from Verodin that came in and then this – and it was quite a few moving parts for us to track.

[Frank Verdecanna:]

Yes, I think, the reorganization or reallocation of resources, help probably about 20 million annually. But yes, we did reinvest some of those dollars in the platform cloud area. So yes, I think as we look at the 2020 from a run rate perspective, you'll see a little bit of an increase in the sales and marketing side given the growth and billings. But for the most part, G&A and R&D I think will be relatively flat year-over-year from a head count perspective and probably slightly up from a dollar perspective, just given kind of inflationary costs.

[Walter Pritchard:]

Great. Thank you. That's helpful. Thanks.

[Operator:]

Thank you. Our next question comes from Patrick Colville with Arete Research. Your line now open.

[Patrick Colville:]

Thank you for taking my question. Just quick question on the third generation appliances, is that headwind over and also, within that customer base you mentioned in the past that the churn and mostly being around smaller customers. I mean, is that still the case? Did I understand it correctly?

[Kevin Mandia:]

Yes, it's over. So we started transitioning Q4, Q1 and Q2. I think we had 3 million left in renewable

[Frank Verdecanna:]

At the end of June.

[Patrick Colville:]

Yes. So Frank, where are we at on that?

[Frank Verdecanna:]

So we completely flushed it through in Q3 and that's why you saw kind of a stabilization after two quarters of same product and related ARR go down. We actually thought relatively flat quarter-over-quarter. And you saw, a really nice, up-tick in overall ARR. So it was nice to see that flush through. And, generally it really has been kind of the smaller customers that have churned off, the larger customers from a retention perspective, the stay remarkably consistent. Ultimately those customers are very sticky and believe in our products.

[Patrick Colville:]

Got it. Can I switch to – I mean if I look at your numbers this quarter and also year-to-date, it has just been an unbelievable business, real acceleration. I mean, what's driven that? Is it, an increasingly hostile threat environment is that you guys distancing yourself from competitors? Is that new innovation? Just any color help us understand would be really valuable.

[Frank Verdecanna:]

I think there's a lot of different factors, it is the broadening of services. Back when we were added to the FireEye team in 2014 or 2015, there's always, a little bit of getting to your feet wet, learning how to work together. So it was usually when you first do an acquisition, sometimes there's a little bit of slowing of growth and then you kind of recharge it over time as you get a comfort with the culture. So this thing stabilized and grew, steadily and then right around 2018, we started broadening the services that it did. And that's what you're seeing. I mean we knew we had a lot more capability than the niche that people know us for responding to breaches. And it was time to advertise that a little bit and venture out from it.

[Grady Summers:]

And Patrick, after a few years of having billings in excess of the revenue deliver, we really kind of ramped up capacity in the services org over the last six quarters, which has really helped us well. And then broadening the service portfolio to include things like Expertise On-Demand and some of the strategic consulting services is really helped us well.

[Patrick Colville:]

Okay. That's very useful. Thank you very much.

[Operator:]

Thank you. And our next question comes from Melissa Franchi with Morgan Stanley. Your line is now open.

[Melissa Franchi:]

Thank you. Kevin, you noted strengths on the endpoint business and there certainly has been some shifts in that landscape over the past few quarters with some acquisitions, particularly with Symantec. Just wondering if that was a positive driver for you all, this quarter or do you think that opportunity for more competitive displacements largely on the come?

[Kevin Mandia:]

The bottom line is I think endpoint is right for displacement. And when you look at what we do, I love the idea of combining tech with people and when we do Expertise On-Demand, it is not to sell more expertise. It's really to differentiate the products. And that's what I think you need an endpoint. So that's the one place where if there's a lack of cybersecurity talent, it is in the ability to do deep dive forensics and triage from alert to fix. So our endpoint, what's unique about that is if combining our endpoint with Expertise On-Demand, you get the expertise there. So all things being equal on the protection side of the house, I think people gravitate towards, well, I get endpoint protection and access to experts should I have questions that that just differentiates. But the bottom line is the whole market has been ready for a long time for replacement of the first generation solutions. And I think the modern endpoint companies are all doing pretty well right now.

[Grady Summers:]

This is Grady. I would just say I think generally we're starting to see more questions from customers on what Symantec acquisition means for them. I think if there's increased replacement opportunities on the come, those questions are just starting to pop up now.

[Kevin Mandia:]

And welcome back, Melissa.

[Melissa Franchi:]

Thank you very much. And just one follow-up question. Maybe this is for Frank or Kevin. So I'm just thinking about sales and marketing spend over the past few years. You all have done a really great job and optimizing that line item. As we're looking ahead to calendar 2020, I know that you're not guiding to that, but how do you feel about sales capacity and the trends you're seeing in sales productivity?

[Frank Verdecanna:]

I think we feel really good about sales capacity. I think we feel really good about some of the new products that we've introduced. So I think the sales team's going to have a lot more to sell in 2020. But I think as we look at capacity, I think we've got the right number of sales people in the right regions. And I think we've been doing a really good job on continued enablement of the newer products. So I think we feel pretty good about being able to keep the cost on sales and marketing, relatively flat.

[Melissa Franchi:]

Perfect. Thank you very much.

[Operator:]

Thank you. And our next question comes from Fatima Boolani with UBS. Your line is now open.

[Fatima Boolani:]

Good afternoon. Thank you for taking the questions. Maybe I'll start with Kevin, as I drill into strengthen the Mandiant business, I want to revisit that and then drill into it a little bit more. I'm wondering if you can comment on or delineate between the strength domestically versus internationally because I do understand the capacity additions did skew more international. So that's Part A. And then Part B, if you can qualitatively speak to sort of billable rates and the capacity utilization of existing personnel as it relates to billable rates. That would be super helpful. And I have a follow-up for Grady, if I may.

[Kevin Mandia:]

Sure. Yes, so a couple of anecdotes, in general, because I don't have the exact on this quarter and geographies. We haven't growing internationally, but we've also been growing domestically. A couple of quarters you see a bounce in maybe the composite being a little more growth internationally. Our utilization rates are high, our chargeability is high. We don't keep people on the beach. I learned a long time ago managing a bunch of professional services folks. You just got to keep everybody busy. So we don't hire ahead of the power curve much and our folks are feeling pretty strange right now at the amount of effort they're putting in. So from a utilization, they're above the line from a effective rate, they're above the line and their hiring is right on par. So we have a very performant business there.

[Frank Verdecanna:]

Yes, Fatima. I think the effective rate being pretty consistent I think is a really strong sign given that we have kind of broadened the base of services to include a lot more strategic services, which are typically a little bit lower than our IR services. So it's really been great to be able to maintain that high effective rate even though we've grown that organization and expand into different types of services.

[Grady Summers:]

Yes. When you look at utilization and the gaps there between any number and 100%, nobody can operate at 100% chargeability. But when you look at our delta that delta is, and people not having work, those people doing sales and marketing functions or engineering functions to support the practice. So it's – we're operating at a full steam ahead there.

[Fatima Boolani:]

That's super helpful detail. And Grady for you, you referenced the partnership with iboss in terms of having the FireEye capabilities embedded in their cloud secure web gateway. I'm wondering, A, if there are other partnerships that you have sort of at play just from an OEM and your capability standpoint. And secondarily, and maybe this is a better question for Frank, if there is any revenue attribution or rev share or any economic arrangement that you can talk to as it relates to this partnership? And that's it for me. Thank you.

[Grady Summers:]

Sure. Yes, you're right. We're really excited about the iboss relationship lets us get into an area where we hadn't been able to play in the past, which is that increasingly popular secure web gateway in the cloud. I talked about Detection On Demand and we see tremendous partnership opportunities there. At the Cyber Defense Summit, we announced launch partners of Corelight, Accellion, which is two need examples, Accellion being a content collaboration platform with a real focus on security. And then Corelight being a commercial package when open-source network sensor called Zeek. So just two kind of diverse customers that shows how quickly we can plug our analytic capabilities into third-party products and I can tell you, you'll see a lot more of that from us in the quarters to come. And from a revenue kind of attribution and modeling perspective, we are going to market in different ways and depending on, who's the lead on that, there's different revenue ramifications. But ultimately, both iboss and FireEye would be seeing nice growth and nice business from any of those joint combined deals.

[Operator:]

Thank you. And our last question comes from Michael Turits with Raymond James. Your line is now open.

[Eric Keith:]

Hey guys, this is Eric Keith on for Michael?

[Kevin Mandia:]

Hi Eric.

[Eric Keith:]

Kevin, I guess for you, I just wanted to follow up on the prior question on Baird and could you maybe elaborate on the sales process for these large Verodin deals? Maybe how you guys got brought into the deal – the structure of the deal. And was there any other existing solution that they might have been looking at?

[Kevin Mandia:]

I can't – so for the two that close, they were most likely emotion before we purchase them and I know where they were at and they were in, the financial services and the government buyer and the bottom line…

[Eric Keith:]

Because of the 270 figure deals that close.

[Kevin Mandia:]

Yes, sorry, well, good point. There's more than those. And the way I look at it is every time I meet a CEO or speak at a board, it is just relevant right now to the discussion, how good is my team, how good are my security safeguards that I have? And this is the way you test it. So I like in all the sales we've seen to those early adopters that have recognized this is the only way to get on varnish truth launch and attack that FIN7 does – did last week and see how well do you do? We live with it here at FireEye and we're going to see people adapt it. It's highly relevant. And that's what led to these sales. And it doesn't surprise me by the way, and that's why I mentioned it. Government does believe it or not, when it comes to security, they are early adopters in a lot of technology. And the same with the financial services. So those deals were at but I expect that the sales cycle and the discussions I have it's at a C-suite level because it's so easy to understand. We run a tax and we tell you how you did, that simple. And that's a lot easier to comprehend than we have 11,000 vulnerabilities and we're trying to rack and stack the prioritized order of what we're going to do about them all. So that's the relevance. And I find it, it's probably, and I can't speak for it, is it relevant to the network security operator. My gut tells me though, from the SISO on up, it resonates. Validate your security posture with real attacks. So that's the selling motion.

[Eric Keith:]

Got it and if I could squeeze one more in for Frank. I'm just wondering, you can quickly maybe drill down or rank order, maybe what's leading to that billings acceleration on the cloud and platform deals to kind of meet your long-term framework.

[Kevin Mandia:]

Yes, I think – like I said earlier, it really was driven across that whole portfolio set. So we had a near record quarter in Managed Defense. We had a record quarter on cloud endpoint and then you look at Intel, cloud, e-mail, Verodin and Helix, all very strong quarters. Now obviously, burdens new to that category. It performed exactly where we expected it to, but obviously it's a much smaller piece of that overall category.

[Eric Keith:]

Thanks.

[Operator:]

Thank you. Ladies and gentlemen, this concludes our question-and-answer session. I’d now like to turn the call back over to Kevin Mandia for any closing remarks.

[Kevin Mandia:]

Yes, I'll make these brief. We've talked about our innovation cycle for years and the importance of having that front-line expertise, that innovation cycle is real. And we will continue along the theme of delivering the best layer of detection because at an innovation cycle, we see the attacks, we adapt to the attacks. We have a learning system that can defend our customers. We are going to deliver the best security validation. I think we're uniquely positioned as a company so that people can run the Verodin platform, attack their networks, measure the results and instrument the fixes so they can feel peace of mind in cyberspace. We're going to deliver seamless Expertise On-Demand and we already have a version of that in our Helix platform. You can click and get chat with an expert and interact with us immediately and we'll continue to refine that and bake that in. And we'll always work to automate the complex things that we do for our customers with humans today and computers tomorrow. I appreciate your interest in FireEye. I look forward to speaking to many of you over the next 24 hours or in 90 days. Take care now.

[Operator:]

Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect.