Mandiant, Inc.
Q1 2018 Earnings Call Transcript

Published: 3 May 2018

[Operator:]

Good day, everyone, and welcome to the FireEye First Quarter 2018 Earnings Results Conference Call. This call is being recorded. With us today from the company is Chief Executive Officer Kevin Mandia; Chief Financial Officer and Chief Accounting Officer Frank Verdecanna; and Vice President of Investor Relations Kate Patterson. At this time, I would like to turn the call over to Kate Patterson. Please go ahead.

[Kate Patterson:]

Thank you. Good afternoon, and thanks to everyone on the call joining us today to discuss FireEye's financial results for the first quarter of 2018. This call is being broadcast live over the Internet and can be accessed on the Investor Relations section of FireEye's website at investors.fireeye.com. With me on today's call are Kevin Mandia, FireEye's Chief Executive Officer; and Frank Verdecanna, Executive Vice President, Chief Financial Officer and Chief Accounting Officer of FireEye. After the market closed today, FireEye issued a press release announcing the results for the first quarter of 2018. Before we begin, let me remind you that FireEye's management will make forward-looking statements during the course of this call including statements relating to FireEye's guidance and expectations for certain financial results and metrics, FireEye's priorities, initiatives, plans and investments, drivers and expectations for growth, the expansion of FireEye's platform and the benefits, capabilities and availability of new and enhanced offerings. We'll also discuss our competitive position, market opportunities, and go-to-market strategies. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today and you should not rely on them as representing our views in the future. And we undertake no obligation to update these statements after the call. For a detailed description of the risks and uncertainties, please refer to our SEC filings, as well as our earnings release posted an hour ago on the website. Copies of these documents may be obtained from the SEC or by visiting the Investor Relations section of our website. Additionally, certain non-GAAP financial measures will be discussed on this call. We have provided reconciliations on these non-GAAP financial measures for the most directly comparable GAAP financial measures in the Investor Relations section of the website. We'd also like to remind you that the results included in this call and the earnings release are using the newly adopted revenue standard ASC606. Finally I'd like to point out that we posted, or will post shortly, the supplemental slides and financial statements on the Investor Relations section of the website. With that, I'll turn the call over to Kevin.

[Kevin R. Mandia:]

Thank you, Kate, and thank you to all the investors, employees, customers, and partners who are joining us on this call. We appreciate your continued interest and support. We did what we said we would do in Q1, meeting or exceeding our guidance ranges for all key financial metrics. We exceeded the ranges for billings revenue and cash flow, and our earnings per share was at the high end of our range. Looking beyond our financial results, we continue to innovate across our product portfolio, and we greatly simplified our pricing model. Today is my eighth earnings call as FireEye's CEO, and I feel very privileged to hold this position, and I'm proud of the progress we have made in the last two years. We have driven countless incremental improvements, as well as made some fundamental changes. We redefined our mission and vision, establishing a built to last mentality. We took the appropriate steps to align our investments with our opportunity. We added depth to our management team with new leaders in sales and marketing. We invested in improving our Network, Email, and Endpoint Security products while reallocating resources to create Helix, our next-generation security operations platform, and we returned to a growth business. This is an exciting time to be at FireEye. The RSA Conference a week ago showed that the security industry is ripe for disruption and consolidation. There is simply too many vendors with too little differentiation to be sustainable. Our mission is to relentlessly protect our customers with technology and expertise from the front lines, and it has never been more relevant. In the current environment, the impact of a security breach is rising. There's a shortage of security professionals. Organizations are focused on product consolidation and more efficient and effective security operations, and customers are realizing that good enough security is simply not good enough. These trends are aligned with FireEye's mission and our competitive advantages, and we believe they provide a great opportunity for our Helix platform, as well as our services and intelligence. In my remarks today, I would like to discuss three things

[Frank E. Verdecanna:]

Thanks, Kevin. As Kevin outlined, FireEye has successfully navigated transitions in our product portfolio and our business model, including the transition to non-GAAP profitability from non-GAAP annual operating losses of more than $150 million just two years ago, and the transition to positive operating cash flow. With best-in-class products, simplified pricing and packaging and an energized team, I believe we are now on the path to sustained growth and leverage in our financial model. As we go through the details of our Q1 results, there are a number of leading indicators that we can sustain our momentum. My confidence in our opportunity and our ability to execute translates to an increase in our annual guidance for both billings, revenue and operating cash flow. In discussing our financial results, I want to remind you that I will be referring to non-GAAP metrics except for revenue and operating cash flow. Our non-GAAP measures exclude stock-based compensation, amortization of intangibles, non-cash interest expense on our convertible debt and other non-recurring items. Also note that all our financial results and guidance ranges reflect the adoption of ASC 606 as of January 1, 2018. We adopted ASC 606 on a full retrospective basis and we have posted the recast financials for 2016 and all four quarters of 2017 in the Investor Relations section of our website. Total billings of $175.1 million were slightly above our guidance range of $165 million to $175 million and grew 21% year-over-year. Billings decreased 27% sequentially from our very strong Q4 billings, which was slightly less than historical Q4 to Q1 seasonality declines. While this was very strong performance, this level of year-over-year growth was partially due to the recast of Q1 2017 billings under ASC 606 which reduced total billings in Q1 2017 by $7.4 million. We had strong renewal performance across all categories in Q1 and customer retention remained at approximately 90%. On a dollar basis, our renewal rate, including upsells and cross-sells, remained above 100%. We closed one renewal transaction slightly over $10 million which was included in our forecast when we guided to Q1 billings. By comparison, we had no transactions greater than $10 million in Q1 of 2017. Overall, we booked 29 transactions greater than $1 million, the same number as in Q1 2017. Contract length increased slightly in Q1 to 22.8 months from 22.3 months in Q1 2017, reflecting a slightly lower average contract length on product and related subscription and support and a higher average contract length on cloud subscriptions and managed services compared to a year ago. We ended the quarter with $500 million in annual recurring revenue or ARR, an increase of 14% from the end of Q1 2017 and an increase of 2% from the end of Q4 2017. We define ARR as the annualized value of all recurring revenue-related contracts in place at the end of the quarter. We added 230 new customers in the quarter compared to 237 in Q1 of 2017. Although we added slightly fewer new customers in the quarter than a year ago, we are already seeing a healthy increase in new customers so far in Q2 as channel partners begin to gain momentum selling our cloud Endpoint and cloud Email subscriptions. Since sales cycles are typically six to nine months in Security and we first launched our next generation Endpoint with antivirus at the end of Q3 2017, the timing of the inflection in new customer growth is consistent with our expectations. Transaction velocity increased 15% in Q1 compared to a year ago, another indicator of momentum in our business. Revenue in the quarter was $199 million, an increase of 8% from Q1 2017 and above our guidance range. Growth was evenly distributed across the three revenue categories, with products and related subscriptions and support up 8%, cloud subscriptions and managed services up 7% and professional services revenue up 8%. Looking at product and related subscriptions and support and cloud subscription and managed services revenue together, approximately 90% was recognized from deferred revenue on the balance sheet at the end of December 31, 2017, and approximately 10% was recognized from current Q1 billings. Our strong performance in the top line was accompanied by a continued discipline on the cost and expense lines and our operating margin and EPS were both better than the midpoint of our guidance ranges. Overall gross margin was approximately flat year-over-year and operating expenses increased 6%. The majority of the increase was on the R&D line, reflecting the acquisitions of Email Laundry in Q4 2017 and X15 in Q1 2018. We also saw the usual seasonal increase in payroll taxes and other employee-related expenses, some of which was due to higher employee stock sales, resulting in sequential increases in each of the operating expense lines. We ended the quarter with 3,031 employees, up slightly from the end of Q4. Turning to the balance sheet and cash flow, we continue to maintain a very healthy balance sheet. We ended the quarter with $886 million in cash and short-term investments and had DSOs based on billings of just 53 days. Ending deferred revenue was $886 million split 60/40 between current and long-term. The sequential decrease from the end of Q4 reflects the seasonality in Q1 billings. About 5% of total referred revenue was related to the timing of services delivery in our Mandiant consulting business. Overperformance on billings, coupled with good linearity in the quarter and strong collections resulted in positive operating cash flow of approximately $9 million compared to our guidance of breakeven to negative $10 million. Turning to our guidance, for 2018, we are raising our billings and revenue guidance range by the amount of our Q1 over performance, reflecting our continued confidence in the business. We now expect billings in the range of $815 million to $835 million, implying a growth rate of 8% at the midpoint of $825 million. We expect revenue in the range of $820 million to $830 million, implying a growth rate of 6% at the midpoint. We are raising our guidance range for operating cash flow by $5 million, which was the increase in billings guidance, and leaving guidance for operating margin unchanged. For the second quarter of 2018, we expect billings in the range of $180 million to $195 million, implying a growth rate of 8% at the midpoint; revenue in the range of $199 million to $203 million; and operating margin in the range of negative 2% to positive 1%; and earnings per share in the range of negative $0.03 to breakeven. Our guidance for operating cash flow of negative $50 million to breakeven reflects our strong Q1 collections, which resulted in operating cash flow above our expectations in Q1 and historic low in accounts receivable to collect in Q2. On a six-month basis, we are expecting positive operating cash flow of approximately $2 million at the midpoint compared to negative operating cash flow of $28 million last year. With that, I'll turn the call back over to the operator for questions.

[Operator:]

Thank you. And our first question comes from Andrew Nowinski with Piper Jaffray. Your line is open.

[Andrew James Nowinski:]

Great. Thanks and congrats on the nice quarter.

[Kevin R. Mandia:]

Thank you, Andrew.

[Andrew James Nowinski:]

I just wanted to, question on the enterprise pricing model that you talked about and how you combined some of your three core products with Helix. Can you just tell us whether those changes had an impact on your new customer growth rate, as well as the impact to your competitive win rate this quarter?

[Frank E. Verdecanna:]

You know, Andrew, we launched that at the tail end of Q1, so we didn't see much of an impact in Q1 relating to that, but we fully expect to see a nice impact in Q2. And I did mention that right now, we're seeing really strong new customer growth early in the quarter, and I think a lot of that's due to the new pricing and the new channel partner relationships on the cloud Endpoint and cloud Email solution.

[Andrew James Nowinski:]

Okay. Great. And then just as a quick follow-up, along the lines of the partner – your channel, at the Analyst Day you said partner-led sales had accounted for just over about $45 million in Q4 which I think was the second consecutive quarter it increased. I guess with the new pricing changes you announced here, do you think you'll see an increase in the partner-led sales or did you see one in Q1 and do you expect it to continue increasing in Q2?

[Frank E. Verdecanna:]

Yeah. I think we do definitely expect as we go throughout this year that the new pricing and packaging and the investments we're making in some of the channel partnerships that we're going to continue to see more and more channel leverage. The channel leverage story has been improving over the last year. I think we still have a long way to go and a lot of opportunity there. But we are starting to see some good signs there.

[Andrew James Nowinski:]

All right. Thanks.

[Kevin R. Mandia:]

Yeah and this is Kevin speaking. For like the last two years we've been talking about, I call them the three Ps

[Andrew James Nowinski:]

Thanks, Kevin.

[Kate Patterson:]

Next question, please.

[Operator:]

Our next question is from Fatima Boolani with UBS. Your line is open.

[Fatima Boolani:]

Good afternoon. Thank you for taking the question. I know something Bill mentioned during the Analyst Day was this bogey of 1,000 customers, but he'd be more enthusiastic to beat that target. So, with some of the momentum you're seeing in the new customer acquisition rate, Frank, I'm curious what sort of engagement in terms of new products or what type of products these new customers that previously weren't being targeted under the old pricing impacting plan are kind of coming into the roster here?

[Frank E. Verdecanna:]

Yeah. Fatima, I think that's a really good question. I think what we're seeing is a lot of the newer customers, especially in the mid-market, coming with cloud Endpoint and cloud Email. And one of the things that you can look at on the breakup of our billings and revenue, you can see that we had a really strong performance in the cloud subscriptions and managed services, with 62% year-over-year growth in billings. And a lot of that is we're seeing a significant traction on the cloud offerings. And like we mentioned in Q4, we had initially saw most on-premise Endpoint, but in Q4, we started seeing a big shift to cloud Endpoint and we're seeing the same thing in Q1.

[Fatima Boolani:]

And just a quick follow-up on the cloud traction that you are seeing with these new customers. What sort of implications does that have for your gross margin outlook?

[Frank E. Verdecanna:]

Yeah. We actually – it hasn't changed our gross margin outlook at all because for the cloud transition that we've been going through, it really hasn't had an impact on gross margin. We've been able to maintain or slightly better our gross margin even as we transitioned from on-premise to cloud.

[Fatima Boolani:]

Very helpful. Thank you.

[Operator:]

And our next question comes from Ken Talanian with Evercore ISI. Your line is open.

[Ken Talanian:]

Hi, guys. Thanks for taking the question. I was wondering if you could give us an update on the renewal yield you saw in the quarter and any thoughts on the trend for the remainder of the year.

[Frank E. Verdecanna:]

Sure, Ken. So, 2018 is a bigger renewal year than 2017 was, and we are seeing a significant amount of renewals. In Q1, we actually over-performed in renewals as well. And I think what we're going to see as we go throughout the year is continued ability to cross-sell and upsell during those renewal opportunities. And one of the metrics that Kevin mentioned in his prepared remarks was that of our Forbes Global 2000 customers, approximately 50% of them actually transacted in the quarter. And so, I think we're seeing a lot of customers that come up for renewal look to buy additional products from us, and that's why our number of products per customer continues to increase.

[Ken Talanian:]

Great. And I guess just a bigger picture question. Could you rank order the factors that might cause you to outperform your 2018 billings guidance?

[Frank E. Verdecanna:]

So, I think they're going to be the same growth drivers we really have been talking about over the last couple quarters. It's going to be the refresh opportunity. It's going to be Endpoint. It's going to be Helix. And then I'd probably put managed services and Email right behind that.

[Ken Talanian:]

Great. Thank you very much.

[Frank E. Verdecanna:]

Thanks, Ken.

[Operator:]

Thank you. Our next question is from Gabriela Borges with Goldman Sachs. Your line is open.

[Gabriela Borges:]

Good afternoon. Thanks for taking the question. Kevin, you mention in the prepared remarks how the Incident Response business can sometimes pull through sales of the cloud subscription. We've talked before about how this helps inform the product roadmap. Maybe you could just elaborate. Are there situations where a customer will decide that they want to buy Endpoint and you're able to be part of that conversation either earlier or in a more influential way because (32

[Kevin R. Mandia:]

Yeah. A lot of ways to address that, Gabriela, but great question. It's – right now, there's no question you can buy our Endpoint before you have a breach. A lot of people will back in endpoint protection or prevention in many different ways. First and foremost, we had to build a Forensics Endpoint, which is actually, in my opinion, the hardest Endpoint to build because we needed technology-enabled services. We had to go in and investigate the breaches that were at a scale and scope that our customers needed help with. And we went niche with forensics really back in 2007, 2008 timeframe. And like all start-ups over time as you get bigger, you go into adjacencies and the adjacencies that we've gone into include prevention. One of the comments we always used to get from customers when we did just forensics in our Endpoint is if you know what to look for, can you look for it ahead of time and stop it? So, obviously, we've been innovating into that direction for a couple of years now. And I would say the first step we took or leap into endpoint prevention was September of 2017. We have advanced forensics capabilities, and you're going to keep seeing us add multiple ways to find bad stuff on the Endpoint, not just signature-based but signature-less based and in my prepared remarks, I talk about machine learning models and some of the behavioral things that we do on the Endpoint. And what I like about our Endpoint is a lot of folks' Endpoint is just find malware. And we go a step further on our Endpoint and say, well, even if you don't find the malware, let's say you detect 99.999% of all malware but you miss 0.0001%. For that tiny fraction that gets by, what does an attacker do in the second inning of the breach, the third inning of a breach, the fourth inning? And we look for those things as well. So, I think over time, our Endpoint will be very formidable at prevention and already is absolutely great at the EDR and forensic capabilities. So, I was proud last year, too, Gabriela, since you gave me the platform to speak about it, we entered 2017 with a Forensics Endpoint for Windows. We exited 2017 with Windows, Mac, Linux and endpoint prevention capabilities. So, I think we've proven we can innovate fast, and we'll keep doing that. Second part of your question is how does IR help business? There's direct and indirect help there. But I've always positioned throughout my career you know the market best when you see the breaches occur. And there will be a lot of folks that will say well, we prevent them all. It's been my experience that there's a lot of things that unfortunately, we can't prevent in this world, and one of them is security breaches. They happen over time even when you do all the right things. And what we do is we get to see how other people's technology and any security technology gets evaded. We have that front row seat. And I genuinely don't know how to build great products at the velocity you need to build them at without that front row seat. We have it. We had a good amount of breaches in the first quarter we responded to. And it gives us a couple of things. It gives you a high level relationship with the customer because it's not just a technical challenge you're solving at that point. You're solving a business problem, but it, again, gives you a threat intelligence to see how attackers are remaining surreptitious on the network and evading detection, all things we learn from. So, bottom line, it's a fantastic innovation feedback that we've built here.

[Gabriela Borges:]

Appreciate the color. The follow-up is for Frank. So, that 62% growth number, could you give us a sense for what that would have been if contract length hadn't increased? And if you could just detail for us a little bit there are a number of things in there between iSIGHT, FireEye as a Service, Endpoint. Which of the product lines contributed more or less to growth? Thanks.

[Frank E. Verdecanna:]

Yeah, thank you. So, Gabriela, what's in that bucket, again, is really the cloud versions of all our different spokes, so Network, Endpoint and Email, and then it's the unattached subscriptions like iSIGHT and managed services. And all – they all had an impact in growing the business. I think, overall, that line item will continue to be helped with the transition from on-prem to cloud, so I think that'll be an area to keep focused on. And the contract length, I'm not sure if you saw the detailed slides yet, but we did have an increase in contract length in the cloud and managed services of close to two months. And so, that works out to probably around $6 billion of additional billings ...

[Kate Patterson:]

I think that's too much.

[Frank E. Verdecanna:]

Actually, yeah. When you take it for that specific line item, it's probably about half of that.

[Gabriela Borges:]

Okay. Thank you.

[Operator:]

And our next question comes from Anne Meisner with Susquehanna Financial. Your line is open.

[Anne M. Meisner:]

Hi. Thanks for taking my question. Question is for Kevin. I know it's early, but you mentioned the Oracle partnership that you announced a few weeks ago at RSA with the Email product available through the e-cloud marketplace. Do you have any sort of early indicators of tracking with that partnership and should we expect to see similar relationships with other public cloud vendors?

[Kevin R. Mandia:]

Well, I think we got to be where our customers are going to be. So, wherever our customers are, we're going to have to have relationships with those vendors as well. So, yeah. I would expect we will have relationships with other cloud vendors because our customers will require that. I think it's too soon to tell in the partnership as to how that's going to play out, but I'm glad we did it. I think that you want to give your customers choice as to what cloud you are performing in, and we just added another to that list.

[Anne M. Meisner:]

Okay. Perfect. Thank you.

[Kevin R. Mandia:]

Yeah.

[Operator:]

Thank you. Our next question comes from Sterling Auty with JPMorgan. Your line is open.

[Sterling Auty:]

Yeah. Thanks. Hey, guys. I want to broaden out the last question that Gabriela asked. So, lots of discussion around a lot of different technologies that you have; Helix, Endpoint, EX, Network, et cetera. Can you level set for us what's moving the needle? So, when you look at billings and bookings in the quarter, what were the big buckets of the contributors this quarter and how did that compare to the big buckets a year ago?

[Frank E. Verdecanna:]

Sterling, if you look at what the growth drivers have been, so NX, the refresh renewals and refresh hardware is doing better than we expected, or better than a year ago. The cloud versions of all our products are doing better. Because if you looked at Endpoint, for example, a year ago in Q1 2017, nearly all the Endpoint deals were on-prem Endpoint. And in Q1 2018, the majority of the deals were cloud Endpoint. ETP, that transition cut was beginning already, so that wasn't – we had a strong Email quarter, but from a ETP perspective or cloud or Email, that already had significantly transitioned to cloud in Q1 2017. Yeah. iSight...

[Sterling Auty:]

Great. And...

[Frank E. Verdecanna:]

iSight Intelligence continues to be very relevant and very important, and so that had a very quarter in Q1 as well.

[Sterling Auty:]

Great. And then, the one follow-up. You mentioned the $10 million refresh deal in the quarter. Is there any similar size type of items that are included in the second quarter guidance? And for the big deal that was closed in this quarter, can you just give us what industry was that?

[Frank E. Verdecanna:]

Sure. So the big deal this quarter was in FAD. (40

[Sterling Auty:]

Great. Thank you so much.

[Operator:]

Thank you. Our next question is from Gregg Moskowitz with Cowen and Company. Your line is open.

[Unknown Speaker:]

Yes. Hi. This is Mike on for Gregg.

[Kevin R. Mandia:]

Hey, Mike.

[Unknown Speaker:]

Thanks for taking the questions. I guess to start, what are the primary subscriptions that are being attached to the Helix thus far?

[Frank E. Verdecanna:]

So TAP, our Threat Analytics Platform, is one of the subscriptions that when customers are using Helix's user interface for FireEye products, if they want to add third-party alerts onto that, they have to add a TAP subscription or a Threat Analytics subscription. So that's an add-on. And then we have additional spoke sales. So once a customer is a FireEye Endpoint customer, they're more likely to then add Network and Email on top of that and vice versa depending on what they start with.

[Unknown Speaker:]

Okay. Great. And just as my follow-up, why did professional services billings significantly decline year-over-year? Thanks.

[Kevin R. Mandia:]

So on the PS side, if you looked at over the last four quart quarters, services billings has exceeded services revenue. So we had built a pretty big backlog of services contracts over the last year. And so Q1, we focused on delivering a lot of those engagements and I would expect we'll see an uptick in billings on Q2 on the services side.

[Frank E. Verdecanna:]

Yeah, Mike, ordinarily in the services business, you invoice after you've completed the work. So if you have a big Q4, the billings go out in Q1. And in reality, billings are sometimes a trailing indicator in services.

[Unknown Speaker:]

Great. Thanks.

[Kate Patterson:]

Next question, please.

[Operator:]

Thank you. Our next question comes from Melissa Franchi with Morgan Stanley. Your line is open.

[Melissa Gorham Franchi:]

Thank you. Frank, you talked about the refresh of the hardware being better or at least being up year-over-year relative to last year. I'm just wondering if you think that dynamic sustains through 2018, if that's embedded in your guidance. And is there any way to think about some sort of multiplier of when the appliances come up for refresh, what you're seeing in terms of greater spending with customers?

[Frank E. Verdecanna:]

Yeah, I think, Melissa, we're still pretty early in that refresh cycle. We came out with the refresh hardware at the tail end of Q3. So I would say we were pretty excited about what we saw in Q4 and Q1 as far as customers that came up for renewal. One, just renewing existing subscriptions but also adding to that. I think one of the things that we've seen is a lot of on-premise customers expanding deployment by adding the cloud MBX as well. And so previously they were not at all their egress points and now they're able to put virtual or cloud sensors in a lot more places. So I think that trend we expect to continue. I think some of that is obviously built into our 2018 guidance. If we see more of that, that will be an area that we may see an overachievement on.

[Melissa Gorham Franchi:]

Okay. Thank you. And then just one quick follow-up, can you maybe just comment on what you're seeing by Geo if you saw any outperformance maybe in Europe ahead of GDPR?

[Frank E. Verdecanna:]

From a revenue perspective, we did see our international come in with about 37% of our total revenues, which is a peak for international. I think that trend has been continuing as we continue to do better in EMEA and APAC. We've seen a lot of improvement in EMEA, but a lot of that I think is just due to kind of the revamped sales leadership and sales team there. I think GDPR is helping the conversation but I don't think it necessarily has had a huge impact yet.

[Melissa Gorham Franchi:]

Okay. Thank you very much.

[Operator:]

Thank you. And our next question comes from Gur Talpaz with Stifel. Your line is open.

[Gur Yehudah Talpaz:]

Okay. Great. Thanks for taking my questions. So you noted 14 million agents for Endpoint. How does that compare to the year ago period? And then I guess the follow-up to that is how important was the launch in September of Endpoint 4.0 and driving further adoption?

[Kevin R. Mandia:]

Gur, this is Kevin speaking. It's up from last year. And when you look at our Endpoint, one of the neat things about FireEye – I'm talking about the HX endpoints in the field. In our innovation feedback loop, we have innovation that occurs that our consultants can bring to the field before the UI catches up with it. And we may have over 1 million endpoints in that version out there in addition. And the features that our consultants use built by real software engineers but when you get the guard rails on them, find their way into HX. And what I'm getting at is we're probably understating the total number of endpoints that we have out there because we have multiple endpoints. And that's just unique to FireEye with the services component that can get stuff to the market quicker. But it's up and I think it's still early to tell what endpoint prevention does for us. And I'm observing that market and thinking, to some extent, it's table stakes. You've got to be able to do it. There's multiple arguments. Some will say, well you get AV for free, and some that will say what you get for free isn't good enough. But either way we've had machine learning models to analyze malware really since 2011 timeframe. We know how to find bad stuff. There is no reason for us to not automate that and get it into our products. So we're convinced we'll be great at endpoint prevention. We'll keep adding to it and we're new to it. So we'll see how it grows over the next few quarters.

[Gur Yehudah Talpaz:]

That's helpful. And then maybe continuing on that theme, it's obviously a crowded space. How important do you think the simplified go-to-market is as far as kind of creating broader awareness, easing the go-to-market and perhaps helping you rise above a lot of the noise that exists within the market itself?

[Kevin R. Mandia:]

Well, I think we're just at an interesting time on endpoint. You have endpoint prevention folks trying to get into EDR. You have EDR trying to get into prevention. You've got forensic capabilities out there that we have. And people are searching for one endpoint that can do everything, and right now I think that no one's arrived there just yet, and that's what's creating some of the confusion in the market. I think our roadmap is to consolidate and detect what AV detects, detect what AV misses, provide your experts with the capability to find things should our signature list-based detection miss, do exploit prevention. It's a roadmap that a lot of people are on, but we're going to execute to it.

[Frank E. Verdecanna:]

And, Gur, just to add on to that, this is Frank, the mid-market suite that we're selling now, I do think puts us in a unique position because a lot of those competitors are point products. They have a solution just for the endpoint. And being able to offer a solution both for cloud, Network, Endpoint, and Email under one package that's priced competitively I think is a unique opportunity for us to compete well there.

[Gur Yehudah Talpaz:]

That's helpful. Thanks, guys.

[Operator:]

Thank you. Our next question comes from Michael Turits with Raymond James. Your line is open.

[Michael Turits:]

Hey, guys. Good evening. I'd just like to drill down further on Endpoint. Can you just describe the deals that you have been in? Have they been more supplementing existing AV? Are you replacing existing AV? And who are you replacing the dynamics of those wins?

[Kevin R. Mandia:]

Michael, my opinion, this is Kevin speaking, it's all of those. Sometimes we get in because we're the endpoint that has to investigate when the other endpoint missed something, and that's an avenue in with the forensics capability. We have done AV replacement with our endpoint, and we are being supplemented. I mean, AV is free on several platforms, so you might as well take what you get for nothing. But people usually supplement free AV with additional AV. But it has been, Michael, a selling motion for all three of those paths that you just went through.

[Michael Turits:]

And if I could just follow up on that, where do you see the pricing dynamics around Endpoint right now? People are paying a lot more for let's call it a suite of next-generation endpoint than they were for straight AV. Is that stable? Is that starting to compress?

[Kevin R. Mandia:]

Do you have an opinion on that, Frank?

[Frank E. Verdecanna:]

Yeah, I think it's starting to compress a little bit. I think we've seen in the market a lot of the next-gen EDR players coming down quite a bit. We've obviously seen the EPP on the AV side going down for quite some time, but I do think kind of the EDR side is starting to compress a little bit. And that's why again, all these kind of play in our favor because now because we're able to package and bundle. We have a little bit more unique opportunities than some of our peers.

[Michael Turits:]

Okay. Thanks very much.

[Operator:]

Thank you. And our next question comes from Gray Powell with Deutsche Bank. Your line is open.

[Gray Wilson Powell:]

Great. Thanks a lot. Maybe focusing in on the Email side, so what needs to happen for you to be considered more of a front-line defense, like a secure email gateway versus that second line more advanced defense? And then when do you think you'll have the potential to move up directly into that market?

[Kevin R. Mandia:]

That's a great question. This is Kevin speaking. One, we're going to have to start scanning outbound emails. I also think there's electronic evidence discovery features that people expect in their email gateway that we don't have today. We've been expanding, and by the way, that's just general – every company goes through this. We had a niche, we could detect things nobody else could detect, and we could detonate email attachments and find spear-phishes that nobody else could find. Then we had to do it based on URLs, and now we have anti-spam capabilities. And we're going to get into looking at data leakage prevention capabilities. So we have to keep expanding. I saw the roadmap, and I'm forgetting it right now, and I saw it only six days ago. But I know that we're going to start scanning outbound emails in the near future, and we may have to partner here or there for a few of the gaps. But what I love about our Email product is we are behind secure email gateways at hundreds of customers yet we're still finding millions of attacks a week. That's just amazing to me. It shows the need for a multi-layer defense and how relevant we are. But I can't comment – I can't recall all the details in it, but I know EED features was one, scanning outbound email was another, and I'm blanking on a few of the other ones, but we're moving quickly in that direction.

[Gray Wilson Powell:]

Understood. Thank you very much.

[Operator:]

Thank you. Our next question is from Walter Pritchard with Citi. Your line is open.

[Walter H. Pritchard:]

Hi. Thank you. Two questions. First, for Kevin, just a follow-up there on the one (52

[Kevin R. Mandia:]

Yeah. That's a great question. There's no question right now. The buying patterns of our customers are I need Email right now, or I'm interested in Email, or I'm interested in Endpoint. If they're interested in more than that, then a whole bundle of things comes into play, and that's really nice. But right now when I look at our now when I look at the other Email products Email products and I had the privilege of sitting through a TVR and sitting with all our product leads and seeing them, you want to be as good or better than the folks that are in there. And with Email, for what it does, it does it exceptionally well. And when you compare us to a secured email gateway, we just need to do a few more features. But the bottom line is right now we've always made our claim to fame in high fidelity alerts and detecting what others miss, and we got to own that. A lot of times I refer to us, Walter, as like the second layer. We're the goalie in the net when the puck gets past the defenders. We have to go from Layer 2 into Layer 1 over time. So what that means is our comparisons change. Right now, I don't know who we're up against as a second layer in defense, because there's no other person that I'm aware of. There's just, but we got to work into Layer 1. We've done that endpoint. Layer 1 to me on Endpoint, it was EPP. We moved into that space. We're going to move into Layer 1 on Email as well. So...

[Walter H. Pritchard:]

And then a question for Frank. You, I think, were looking for duration to actually be a headwind this year. It sounds like it was a tailwind in Q1. Is there any changes to what you're expecting for duration for the year embedded in the guide, especially for billings?

[Frank E. Verdecanna:]

Yeah. We expected duration to actually be kind of flat to slightly down. So if it wasn't going to be a headwind, our expectation was it was going to be a pretty slight headwind. In Q1, overall contract length only increased half a month. So it wasn't a significant tailwind in Q1, but it definitely didn't go the wrong way, which is – I think the good news is what we're seeing is that even as we transition to cloud offerings, we are still seeing customers sign up for multiyear. And so that's a good sign because I think that means we're less likely to see a bigger headwind even if we accelerate to cloud quicker.

[Walter H. Pritchard:]

Got it. Okay. Thank you.

[Frank E. Verdecanna:]

Thanks.

[Operator:]

Thank you. And our next question comes from Saket Kalia with Barclays Capital. Your line is open.

[Saket Kalia:]

Hey, guys. Thanks for taking my question here and for fitting me in. I'll just keep it to one. Frank, the simplified pricing model sounds great and very compelling. What of your pricing studies maybe showed about how this can change deal size going forward? And what are just maybe some of the other sales operation metrics that the simplified pricing could drive in one way or the other? Does it make sense?

[Frank E. Verdecanna:]

Okay.

[Saket Kalia:]

Sorry. Did that come through?

[Kevin R. Mandia:]

No. Sorry, Saket.

[Frank E. Verdecanna:]

No. Saket, we missed it. Sorry about that.

[Saket Kalia:]

Okay. No. No worries. No worries. So I'll just keep it to one question. So the question is the simplified pricing is really interesting. What of your pricing studies showed about how it can change deal size going forward and kind of any other sales operations metrics? I'm thinking renewal rate, or customer adds. Any other kind of open-ended question. Any other metrics that that simplified pricing model could really impact in a big way going forward.

[Frank E. Verdecanna:]

Sure, Saket. I think what we saw in the study is that it would actually open up a new market for us. What we saw for our existing customer base in the large enterprise is it was kind of net neutral to slightly up. Because we can now offer the virtual and cloud sensors, it enables people to actually expand their deployment. So even though they may be buying less on-prem appliances, the overall ACB of that customer has typically been higher. So we introduced new pricing, we had deals in Q1. Those ACBs actually all increased. It's very early in the process, but the quotes that we have out all look to be net positive. So we're pretty excited about the impact. And again, the real impact ultimately is getting us into a market that we haven't been into before at the mid-market.

[Saket Kalia:]

That makes a lot of sense. Thanks very much for taking the question.

[Frank E. Verdecanna:]

Thanks, Saket.

[Kate Patterson:]

We're at the top of the hour, so we'll take just one more question, please.

[Operator:]

Certainly. And our last question will come from Erik Suppiger with JMP Securities. Your line is open.

[Erik L. Suppiger:]

Thanks for fitting me in. On the new pricing, what kind of effect has that had on your hardware?

[Frank E. Verdecanna:]

So I think again it's very early days because we just introduced it at the end of Q1. But I think what we're seeing is that we've had some customers opt for buying hardware on a subscription basis, that's new. But the ACB, and that's what we're really focused on ultimately has been at or higher than previous deals. And again, I think that's because folks are covering more of their network than they have in the past. So I think we'll be able to give obviously a lot more indication of the impact as we go through another full quarter of the new pricing.

[Erik L. Suppiger:]

And of the new customers that you added, can you give us any sense for whether you saw some shift towards more of the mid-market in the new customers?

[Frank E. Verdecanna:]

So we really just launched it at the end of Q1, and we are – I did mention in my prepared remarks that we are seeing significant traction on new customer logos compared to a year ago, and I think a lot of that is the new pricing in the channel.

[Erik L. Suppiger:]

Okay. Very good. Thank you.

[Frank E. Verdecanna:]

Thanks.

[Kate Patterson:]

So before we close out, I just want to let you know that they've informed me that the slides and the excel spreadsheet with the historical financials have been posted to the Quarterly Results section of the Investor Relations site if you're looking for them.

[Operator:]

Thank you. And this does conclude today's question-and-answer session. I would now like to turn the call back to Mr. Kevin Mandia for any closing remarks.

[Kevin R. Mandia:]

Well, I'd just like to thank everybody for their interest in FireEye and look forward to speaking with you over the next 90 days.

[Operator:]

Ladies and gentlemen, thank you for participating in today's conference. This does conclude the program and you may all disconnect. Everyone, have a great day.