Mandiant, Inc.
Q4 2018 Earnings Call Transcript

Published: 7 Feb 2019

[Operator:]

Good day, everyone. And welcome to the FireEye Fourth Quarter 2018 Earnings Results Conference Call. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session, and instructions will follow at that time. [Operator Instructions] Also, this call is being recorded. At this time, I would like to turn the call over to Kate Patterson. Please go ahead.

[Kate Patterson:]

Thank you, Chelsea. Good afternoon, and thanks everyone on the call for joining us today to discuss FireEye's financial results for the fourth quarter of 2018 and the full year 2018. This call is being broadcast live over the Internet and can be accessed on the Investor Relations section of FireEye's Web site at investors.fireeye.com. With me on the call today are Kevin Mandia, FireEye's, Chief Executive Officer and Frank Verdecanna, Executive Vice President, Chief Financial Officer and Chief Accounting Officer of FireEye. After the market closed today, FireEye issued a press release announcing the results for the fourth quarter of 2018 and the full year 2018. Before we begin, let me remind you that FireEye's management will make forward-looking statements during the course of this call, including statements relating to FireEye's guidance and expectations for certain financial results and metrics; FireEye's priorities, initiatives, plans, and investments; drivers and expectations for growth; the expansion of FireEye's platform and the benefits, capabilities, and availability of new and enhanced offerings; competitive position, market opportunities and go-to-market strategies. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future. We undertake no obligation to update these statements after the call. For a detailed description of the risks and uncertainties, please refer to our SEC filings, as well as our earnings release posted an hour ago. Copies of these documents may be obtained from the SEC or by visiting the Investor Relations section of the Web site. Additionally, certain non-GAAP financial measures will be discussed on this call. We've provided reconciliations on these non-GAAP financial measures to the most directly comparable GAAP financial measures in the Investor Relations section of the Web site as well as the earnings release. We'd also like to remind you that the results included in this call and the earnings release are using the ASC 606 revenue standard. Finally, I'd like to point out that we have posted the supplemental slides on the Investor Relations section of the Web site. With that, I'll turn the call over to Kevin.

[Kevin Mandia:]

Thank you, Kate, and thank you to all of you the investors, employees, customers and partners who are joining us on this call. We appreciate your continued interest and support in FireEye. Today, I would like to discuss three things

[Frank Verdecanna:]

Thanks Kevin, and hell to everyone on the call. Over the last year and on every call, I said that I believe that our best in class products, services and intelligence, simplified pricing and packaging and energized sales team set us up for renewed growth and improving financial metrics. This has certainly proved to be true and we ended 2018 with very strong Q4 results. Our performance in Q4 and 2018 underscores the ongoing transformation of our business and our business model. Not only did our billings growth accelerate in Q4 growth, the growth was driven primarily by increased sales of our new products and our Mandiant Services. I view both as positive leading indicators for our future. Before I review the detailed metrics, let me remind you that I'll be referring to non-GAAP metrics except for revenues. Our non-GAAP measures exclude stock-based compensation, amortization of intangibles, non-cash interest expense on our convertible debt and other non-recurring items. Also note that prior period results have been adjusted to reflect the adoption of ASC 606 as of January 1, 2018. Turning to our results. Total billings were $265 million, $10 million above the high end of our guidance range of $245 million to $255 million. Billings for professional services were at a record $53 million, reflecting continued strong demand for our services and the launch of expertise on-demand in Q4. We continue to operate at or near capacity in this area of the business and most of the hiring this quarter was from consultants in both the U.S. and internationally. By the way, Q4 sales of expertise on-demand are included in the current deferred revenue for services. Product and related subscriptions and support billings were up 3% year-over-year as the increase in subscriptions more than offset the continued decline in appliance hardware sales. To provide some visibility to the trends within this category without breaking the single performance obligation under ASC 606, there is a slide showing the mix of appliances, support and subscription for the year of 2016 through 2018. It is clear that the trend towards subscription billings accelerate in 2018 with the introduction of our subscription pricing model for network email and Endpoint security. This helped drive double-digit growth in network, email and Endpoint security, even though sales of appliance hardware declined by 11% in Q4 and 10% in 2018. The final breakout category, cloud subscriptions and managed services increased 31% sequentially and 12% year-over-year. The growth reflected strength in managed defense, standalone threat intelligence, Helix subscriptions and our cloud email solution. We achieved this growth even though Q4 '17 billings included a $10 million plus transaction. If we exclude the large deal from Q4 '17, cloud subscriptions and managed services would have grown more than 30% year-over-year in Q4. With the strong performance in both product and related and cloud subscriptions, recurring billings grew 12% year-over-year, an acceleration from 11% in Q3. Taking out the big deal in Q4 '17, recurring billings grew more than 20% year-over-year in Q4. The weighted average contract length for recurring billings was just under 26 months in Q4 '18, compared to about 24 months in Q4 '17. The $10 million plus deal in Q4 '17 was 12 month transaction and reduced the average contract length by about one month in Q4 '17. On a rolling four quarter basis, which excludes any seasonality, the average contract length for recurring billings was about 24.5 months, within the same range it has been in the past couple of years. The continued stability in the recurring billings averaged contract length suggests that contract length is not a meaningful headwind or tailwind to our overall billings growth. For the same reason, ACL trends tend not to indicate any meaningful change in customers' preferences or commitment to FireEye's technology. Our customer retention rate remained approximately 90%. We added 354 new logo customers in Q4, which was up 19% year-over-year. Transaction volume was at record levels for both greater than $1 million transactions and transactions less than $1 million. This reflected both the growth in new logo customers and strong follow on purchases by existing customers. Our enterprise customers are spending more with us and we are extending our reach into the mid-market through the channel, both positive trends for the business overall. Our performance on retention, cross sell and new business are all reflected in our annual recurring revenue or ARR metric. We ended the quarter and the year with $553 million in annual recurring revenue, an increase of $44 million or 9% year-over-year and $15 million or 3% sequentially. ARR for subscription for both breakout categories increased. ARR for cloud subscriptions and managed services increased more than 19% year-over-year for both the quarter and the year, reflecting the momentum we are seeing in the segment of the business. Recall that ARR growth for cloud subs had a tough rollover this quarter due to the $10 million increase on a large deal in Q4 of '17. Turning to revenue and the income statement. Revenue in the quarter was $218 million at the high-end of our guidance range of $214 million to $218 million, and up 6% year-over-year. Approximately 90% of our non-services revenue or $159 million was recognized from current deferred revenue associated with prior quarter billings. Our strong revenue performance was accompanied by continued discipline on cost and expense lines. Total COGS increased modestly, reflecting higher cloud hosting costs. Sales and marketing expense increased in absolute dollars due to the higher sales activity and R&D expense increased slightly based on some incremental hiring in engineering to support the new product roadmap and the innovations Kevin discussed earlier. This was partially offset by a decrease in G&A associated with lower payroll taxes as we ended the year. Turning to the balance sheet and cash flow. We continue to maintain a very healthy balance sheet with cash and short-term investments of $1.1 billion, an increase of $28 million from the prior quarter. We ended the quarter with receivables of $158 million and DSOs calculated on billings of 55 days at the low-end of our target range of 55 to 65 days. Ending deferred revenue was approximately $935 million, up $48 million sequentially and $25 million from the end of Q4 '17. The increase in both current and total deferred revenue was due to increases in deferred revenue for cloud subscriptions and managed services category and to a lesser extent, an increase in deferred revenue associated with professional services, including expertise on-demand. Deferred product and related subscription revenue decreased by $47 million from the year ago as we recognize more product and related subscriptions and support revenue than we built. This decrease reflects a decline in new appliance sales that began in mid-2016. Since about 90% of our non-services revenue is recognized from deferred revenue. The decline in our product and related subscriptions current deferred revenue creates a headwind for revenue in this category in 2019. This is reflected in an lower overall growth rate for total revenue than for billings in 2019. With this as a background let's turn now to our 2019 guidance ranges. Our 2019 guidance range for billing is $910 million to $930 million, representing growth of approximately 8% at the midpoint. We do not currently anticipate any greater than $10 million deals in 2019. If we exclude the two greater than $10 million deals from the first half of 2018, the underlying growth rate for 2019 at the midpoint would be approximately 10.5%. The revenue we are guiding between $880 million and $890 million, implying a growth rate of 6.5% at the midpoint. This growth rate reflects the headwind of $28 million less in beginning product and related current deferred revenues. We expect operating margin between 4% and 6% and earnings per share in the range of $0.17 to $0.21, based on average diluted shares outstanding of $210 million. We expect operating cash flow in the range of $90 million to $110 million for a cash flow margin of 11% on our expected 2019 billings. CapEx is expected to be in the range of $40 million to $50 million. For Q1 guidance, we expect billings in the range of $170 million to $180 million. The midpoint of our Q1 range represents approximately 90% of the 2019 billings guidance range and is consistent with historical annual linearity. The year-over-year growth rate at the midpoint is flat with Q1 '18. You'll recall that Q1 '18 billings included the one greater than $10 million plus transaction, but also included two transactions greater than $5 million. These three transactions alone accounted for approximately $25 million. We are currently not anticipating any deals greater than $5 million in Q1 of '19. Excluding the three large deals from Q1 '18, the growth rate at the midpoint shows an acceleration in growth rate from Q4. We expect revenue in the range of $208 million to $212 million, implying 6% year-over-year growth at the midpoint. The sequential decline from Q4 reflects two fewer days of revenue recognition and typical Q1 seasonality in the portion of our billings that were recognized upfront. This year we are expecting revenue to exceed billings this will have the effect of the sequential decrease in both current and total deferred revenue. Given the revenue range, we expect operating margin between negative 3% and negative 1%. This implies sequential growth in OpEx of about 5% to 6%, about the same as the sequential growth in operating expenses in Q1 '18. The increase reflects employee related costs that kick back in at the beginning of year and an increase in our ending Q4 headcount. We also expect interest income to offset cash interest expense. And we expect cash taxes of between $1.5 million and $2 million consistent with prior quarters. This yields a loss per share between $0.02 and $0.04 based on a share count of $198 million shares. Operating cash flow is expected in the range of $10 million to $15 million, and CapEx of about $10 million. Before I turn the call back over the operator, I want to make the final comment on the variability large transaction cause in our year-over-year growth rates. These transactions are huge positive for our business and demonstrates the trusted partner relationship we established with our customers. They typically include multiple products and services, and make sense for multiple years, giving us increased visibility into our revenue stream. But they are difficult to forecast with precision and they don't come along every single quarter. Since they are somewhat extraordinary, we have tried to give you a sense of the underlying growth rates and the sustained progress we have made. Near-term headwinds from 606, 605 we remain confident in our ability to achieve our long-term operating targets. That concludes my prepared remarks. We will now take your questions. Operator?

[Operator:]

[Operator Instructions] And our first question will come from the line of Andrew Nowinski with Piper Jaffray. Your line is open.

[Andrew Nowinski:]

Maybe just to start with a clarification, I know you had some large deals in Q1 of '18. So is that why the billings growth decelerates in Q1 of '19 given the strong results you saw in Q4?

[Frank Verdecanna:]

Yes Andrew, exactly. If you look at -- you take out the $10 million deal that we closed in Q1 of '18, the midpoint of our guidance range would be 7% year-over-year growth. And then if you were to take out the three greater than $5 million deals in Q1 of '18, your growth rate would be 17% at the midpoint.

[Andrew Nowinski:]

And then as I look at your 2019 revenue outlook, growth basically remains somewhat unchanged from what you just delivered in 2018. So I was wondering if you could maybe paint a picture of what it would take to get your revenue growth to double digits in 2019 in a very optimistic scenario.

[Frank Verdecanna:]

Yes, revenue is the trailing indicator. Obviously, if we exceed our billings guidance plan that will help increase the overall growth rate. But revenue is going to lag a little bit on billings because of the headwind we see from the declining appliance sales that the amortization that will recognize in '19, it's going to be less than the amortization we recognized in '18.

[Andrew Nowinski:]

I guess, I was just looking more from which product would stand out that you think could potentially outperform to move the needle?

[Frank Verdecanna:]

So from the billings, if we were going to overachieve the billings guidance, I would say the three areas that will likely be driven by will be the Helix platform sales, our subscription based network, email and endpoint and then services, including expertise on demand.

[Operator:]

And our next question comes from the line of Rob Owens with KeyBanc Capital Markets. Your line is open.

[Rob Owens:]

I guess to start up on the revenue side, and I understand there's lots of puts and takes with the shift to subscription. But maybe on the products side and I do see product billings being a little weaker this quarter. But maybe you can address just the sequential growth in product being one of the floors that you have seen for a Q4. And is it really come down to the predictability of what comes-in in product versus what comes in with subscriptions? I know that back in Q3 that was tough to predict. Or maybe just a little help in terms of maybe why that number was a little more robust this quarter.

[Frank Verdecanna:]

Rob, we talked about how the customers are purchasing and their preference. We have had a lot of success on that movement to subscription and movement to cloud. And so in any one quarter, again, there is going to be variability depending on the personal preference of the customers. I think we did see sequential growth in product billings, but it wasn't as significant as Q4 '17. But again, I think if you look at the growth in the attached subscriptions, we went from $59 million to $78 million.

[Rob Owens:]

Is there anything to be read into that number from certain verticals with Q3 being a heavier fed quarter versus Q4? And then I guess as an adjacent question. Your thoughts on any impacts from federal shut down in the fourth quarter, or anything that might carry over into Q1 results?

[Frank Verdecanna:]

So Q3 obviously did have a much bigger fed impact than Q4, and so product tends to be a little bit stronger during a fed quarter. In Q4, we did have a very successful fed quarter. And I think our expectation is that we will continue into 2019. The good thing is if you look at the breakup of our federal sales, most of them coming from agencies that were fully funded even during the shutdown.

[Operator:]

Thank you. And our next question comes from the line of Gur Talpaz with Stifel. Your line is open.

[Gur Talpaz:]

So Mandiant had a really, really strong quarter here. I was hoping you talk about the puts and takes there, what ultimately drove that strength. And how much upside you saw from expertise on demand, whether that contributed or whether it's really organic growth than the Mandiant Services business?

[Kevin Mandia:]

Just quite frankly just hired faster in Q4, we brought in more folks. And when you have more folks, one of the levers moves up on how you can grow your business. Second thing is it's growing internationally as well Mandiant was primarily U.S. brand three years ago, four years ago. And so we are seeing increased sales in other geographies. And we are just getting into -- we still have that core competency of responding to the breaches that matter. So we can learn on the front lines but we are doing more red teaming some more strategic consulting. So, it's just had a good quarter…

[Frank Verdecanna:]

And I'll add on the billings side a bit. We did launch and limiting availability expertise on demand. And so we did have some very nice traction in expertise on demand. And we're really encouraged by the fact that the fun will actually be on Helix in Q1, and so we think that will continue to drive momentum in that category.

[Gur Talpaz:]

And maybe a product centric question. Kevin, you and talked about this last quarter, the potential for Helix to serve as a placement. And you saw some traction with that last quarter. I was hoping you could give some commentary as to whether that persisted again this quarter. And then maybe some color around Endpoint, you talked about being able to service most anything around there. Anything you are seeing around there from a traction standpoint too would be helpful?

[Kevin Mandia:]

So the first thing when we talk about SIEM takeout, that’s just along the course of our Helix vision that we have always had. Our true IP is determining unauthorized, unlawful unoffered or unacceptable behavior in a big pile of data. So we are building Helix to be able to ingest that data and figure out, hey what's bad in there. And building Helix so that you automate that tier one and tier two decision-making process, in the natural course of building Helix, you kind of move down. You just say, hey, listen we need the dashboards we're getting the data and people need to compliance for that. So we got to do a log aggregation as well and we got to create the compliance dashboard. So it wasn’t like we sat down three years ago and said how we are going to take on the SIEM market. We really just sat down said how we are going to build the best security product. And just happen to be when you are aggregating the data we are aggregating, you end up building some of the SIEM components. So we saw orchestration in there as well, their intelligence management in there, the ability to click a button and get the human expertise. And we are going to constantly keep laying models on top of it. As this company grows and as Helix gets more adopted, you will see us talk more about the data that we are collecting and our ability to make use of more data to answer and solve people's problems. So the bottom line, SIEM takeout was just, we looked at it and said, you know what, a lot of folks built their whole operations around SIEM. We want them to build it around SIEM plus, that’s Helix. And in regard to Endpoint, we had some ground to cover. We started our Endpoint as a forensics tool. Nothing could do what our Endpoint did. And it enabled our services to do the incident response work that they did. So we are still the agent that we deploy when we do all our investigations to figure out is there any compromise anywhere. And I consider our endpoint the best forensic ultrasound you can give a computer to figure out if it's got a problem or not. We didn’t build it originally for Endpoint protection, and we start to getting into the Endpoint protection market late in 2017. And every company starts and goes into adjacencies. We started as forensics endpoint getting into endpoint protection. We did Windows first and/or we got to get Mac and Linux done. We have the Linux EDR capabilities coming out now. And we will have all the OSs covered by the end of the year in regards to Endpoint protection. On the forensics front, we need to get that to market sooner with our technology enabled services folks. They usually have an agent out that VGA oftentimes six months to a year later, because as less guardrails for our folks. But the bottom line is that's what I meant by those comments, Gur, is we got to get to the other platforms on endpoint protection. We have a great forensic Endpoint and EDR endpoint already.

[Operator:]

Thank you. Our next question comes from the line of Melissa Franchi with Morgan Stanley. Your line is open.

[Melissa Franchi:]

Kevin, you continue to have very good new customer adds and we saw that in Q4. I was wondering if you could just comment on what's working well for you in terms of adding new customers. Do these customers look different in terms of their size, vertical exposure? And are they engaging with different areas of the product portfolio that you have seen in the past?

[Kevin Mandia:]

So we have seen quite frankly the similar pattern, it's services is often the most net new logos and behind that its network, for some quarters its email, on-prem and off-prem combined on how we get the new logos. What I noticed and I'm speaking anecdotally right now, because I eyeballed the statistics. The Hermes pricing that we did, the bundled pricing has helped us get down market. And I would make the assumption now. We get a lot with the endpoint through into the SMB market once we got into endpoint protection. But we look at most net new customer adds realize when you show up to a new logo, when it’s a product sell a lot of times it's a longer sales cycle, you have a bake-off between multiple products. But services, if they want to a Red Team, we can do it in a few days. So you will see a lot of the times most of our quarters, its services led but that establishes a strong relationship with that customer and makes them a good prospect for a product sale. So I would say most of the time net new logos is the services.

[Frank Verdecanna:]

And Melissa I'll add to that that this quarter the one thing we did see was a record quarter of customers coming from the channel, sourced from the channel. So that’s something that really encouraged by and that was across really all the different products. But it was definitely a pretty big uptake in the quarter.

[Melissa Franchi:]

And just my question for you, Frank, on operating margins. So over the past few years, you guys have done a good job in terms of optimizing cost and we've seeing margin improvements. As we are looking forward to FY '19, it seems like you are guiding to an acceleration in operating leverage relative to what we saw in FY '18. So I'm wondering if you can just talk about what's driving that. And then what gives you confidence that you can sustain growth while also being disciplined on cost?

[Kevin Mandia:]

The big driver there is the fact that we did have a pretty big ramp up getting ahead of the expertise on-demand in Q4 and in 2018. As you look at 2019, we will have some growth in services and we will have some growth in engineering. But for the most part, the rest of the company is relatively flat from a headcount perspective. We believe that we will be able to achieve the 2019 guidance without adding significant amount of heads across the business. So we are very confident that we will see revenues grow significantly faster than our OpEx.

[Operator:]

And our next question comes from the line of Steve Koenig with Wedbush Securities. Your line is open.

[Unidentified Analyst:]

This is Ahmad on for Steve. First, I wanted to ask where are we in terms of market adoption for security orchestration, and how would you say Helix is playing competitively in that?

[Frank Verdecanna:]

I couldn’t speak to the whole market adoption of it. As you would view it, I think it's still early stages for orchestration. We bought the Invotas asset in I believe 2016, so it's been about 2.5 year run. I see orchestration is really a plug-in to whatever you are operating your security on, most likely a SIEM product at this point. And we see a convergence that is in its early stages of SIEM threat intelligence management and orchestration, and investigative platform all mushing into one and that's what we're trying to build with Helix is that center nerve cell or brain for security operations. I would say market adoption is in the first inning. I mean, everybody needs to go into this direction and very few people have adopted at this stage.

[Unidentified Analyst:]

And then my follow up, with your hub and spoke model I guess for next year. What components would you expect to be the most important drivers for growth, would you say it's attracting new customers or would it be mostly expansion?

[Kevin Mandia:]

I think where the tip of the spear, I think is going to continue being the different spoke. If you looked at 2018, network, email and endpoint all grew double digits. I think the expectation for 2019 is going to be the same. We are going to see growth across all three of those email security vectors. And then obviously we will continue to expect growth in helix and expertise on-demand as well.

[Operator:]

And our next question comes from the line of Sterling Auty with JPMorgan. Your line is open.

[Sterling Auty:]

Frank, I want to circle back just on the margin and the margin outlook. You mentioned I think some of the hiring that’s done. Is the hiring really front end loaded? And is there any other investment that's not headcount related that's driving the margin profile as we think about how the first quarter relates to the full year guide on margins?

[Frank Verdecanna:]

Yes, the first quarter has a couple of things going. It has the kickback in payroll taxes, which is a significant sequential increase. That also happens now of our annual sales conference in RSA in Q1 as well. And then we did have growth in Q4 and headcount really to help frontload the support on the expertise on demand. And so I think those are the big Q1 sequential increases. As we go out through the year, there is some nominal increases across R&D and services, but nothing significant.

[Sterling Auty:]

And then one other in terms of follow-up and you talked about fed. But any other commentary in terms of the vertical experience in the quarter and what pipeline? So any particular industries that are jumping out to you being particularly stronger or weakened in the fourth quarter.

[Frank Verdecanna:]

No, if you look at the business across deals, across the industry and across products, we are pretty well diversified. I think one of the areas little bit more of an uptick than normal is the midmarket. And I think you see that coming from the new logos sourced from the channel.

[Operator:]

And our next question comes from the line of Shaul Eyal with Oppenheimer. Your line is open.

[Shaul Eyal:]

Frank, I think you've mentioned in your prepared remarks a growing focus also on the middle market. Does that generate a need or even a different channel strategy, new partnerships, new compensation plans? Just curious how you guys think about it.

[Frank Verdecanna:]

Shaul, I don’t think it really has a change in our strategy. We've actually invested and signed up a fair amount of customers or service in midmarket over the last few years. I think one of the major changes in 2018, which is now really playing in our favor, is the simplified pricing and packaging process we went through. That really has resonated with the channel. And if you look at the new customer logo source from the channel, they are almost all buying on the new pricing model. And so I think we really put a lot into 2018 from a sales enablement and changing of the pricing to really enable both our internal sales team and the channel to just be able to reduce the friction in the selling process. And I think that we are just starting to see that really pay off.

[Shaul Eyal:]

And also if I may ask. How would characterize the current pricing environment versus maybe last quarter versus the fourth quarter of '17, any change?

[Kevin Mandia:]

Yes, I haven't felt any change at all. This is Kevin speaking. Yes, I think it's the same. I haven’t felt a contraction on it.

[Operator:]

Our next question comes from the line of Tal Liani with Bank of America Merrill Lynch. Your line is open.

[Tal Liani:]

This is Dan on for Tal, thanks for taking my question. So a strategic one to start for, Kevin. It seems like the managed defense part of business, one of the brightest areas, or it's at least driving a lot of the differentiation potentially in the Helix too. So when you look out a few years. How much of FireEye's success is dependent on becoming more of a managed security company? And then how do you guys balance those efforts in growth with the channel partners that are also using this strategy?

[Kevin Mandia:]

Couple of things. One, we are not really a replacement for an MSSP with our managed detection and response. So the genesis of managed defense was we would respond to breaches and people did not have the security expertise we had. But we never intended nor are we in the business of we are going to tweak your firewall, we are going to be your Windows security folks, we are going to update patches. We always felt that's not the task that we are in the business we are doing. When you look at MSSPs, they do staff augmentation they manage other people's software. We do not do that. When we do managed detection and response, it's the ability to collect logs, it's the ability to manage our software and detect when other safeguards have failed, I mean naturally it. And when I look at a couple years out, I have always said this should have happened a decade ago but it still hasn’t happened yet. There is got to be a seamless integration between the products people buy to secure their networks and the experts. And that's why we have expertise on demand. And over time, you are not going to see a difference between our expertise on-demand and our managed defense package, because I think it passes the, hey, I'd buy that test when I talk to CSOs, they don’t want to have 10 malware analysts that they only three days a month, they don’t want to have a whole threat intelligence unit that they maintain, but they do want those expertise when they need them. And I see over time as we build more expertise on-demand into our products, you can imagine a future where our customers are inside of Helix, saying, oh, I need an Endpoint to forensically examined and just click a button and we've got a cadre of experts, or our partners have experts that can go do it. So that’s why Helix will be built for the MSSPs, it will be federated. It will have expertise on-demand that others can use Helix to provide the expertise. It's just we happen to have it here. Our customers have learned to trust it. And they may prefer to use our expertise on-demand. But we are not going to tweak people's firewalls. We are not going to manage their SIEM. That’s what MSSPs do. What we do is we find if something bad is happening and we ask if people want us to fix it.

[Tal Liani:]

And then a quick follow-up on the Helix customer additions. Can you just talk about the mix between existing customers and new customers? And what I'm getting at there is, is Helix actually becoming a real driver for new customers coming onto the FireEye platform?

[Frank Verdecanna:]

Yes, it generally is primarily new customers adopting Helix as part of the platform with other spoke products, or it's in existing customer that has one or two folks that’s adding the overall platform. And so we see a pretty good mix of both new and follow-on purchases in Helix. And in the quarter, we had 143 new Helix adds and again, that's driven from both brand-new customers and existing follow-on customers.

[Operator:]

And our next question comes from the line of Gabriela Borges with Goldman Sachs. Your line is open.

[Gabriela Borges:]

This one is for Kevin. I'm hoping you can describe for us how your opportunity to expand on the network security side has changed with the additional things like cloud and VX, network forensics, some of the internal segmentation or visibility things you might be doing. As customers go from classic FireEye appliance on the network side to adopting some of these broader technology suites. What happens to order value and how the conversation is changing? Thanks.

[Frank Verdecanna:]

Well, so complex question in some ways. When I look at our network product, we have to do more with it. It’s a second line of defense. We are not building it into the first line. So one difference between that and our other spokes is Endpoint we are building into the first line of defense with Endpoint protection. With email, we build a security email gateway we are in the first line. But on network, we're the second line in defense behind the firewall. And the good news firewalls missing up that, you need a second line of defense. But it also means if there's a whole buyers' market out there that will buy the firewall and buy the plug-ins and buy the subscription to it and that will be good enough for them. What we really want to do and that's why for every product that I mentioned at the spoke is share how it's feeding Helix. Helix is -- we want to our IP -- when you talk about countermeasures, we will put the IP into the spokes, but we want to put a lot of the detect-bad stuff and do something about it and manage it with workflow and process in the Helix. The future that I see and what we're doing in 2019 is building our network into the adjacencies of let's just detect bad east-west traffic, so we launched what we call SmartVision. So let's start collecting metadata so that we can find things, and we already do this as well. Let's find data exfiltration or data set, let's find other things that you can't always use a border router or your firewall to constantly look for. And so we are going to build into those niches and have it feed Helix over time. But we still want -- another way to answer that question is we also want to go from spoke to a product a platform sale. And I know that’s overused, platform, platform, platform, but we have got Endpoint email and network. And we are making all work together better and better every single quarter. And overtime, that's going to matter to people that synchronicity between, hey, I detected something on the endpoint and the network already did a countermeasure, that’s pretty cool. And we can deliver that, because we make all those products. So rather than duct taping it with personnel, and scripts and your own expertise, we are just going to be building that here at FireEye. And that benefits all our products when they all work in union together. So I'm going to be five different tracks. So I'm going to give you five different tracks here, but we do know this. Our network is a layer two defense we're not going to be building a firewall. So we just got to get better at detecting a lot more things that the firewall can't detect and is now positioned to detect.

[Gabriela Borges:]

When you look at your customers that around the Helix interface versus those who are not. Can you just compare and contrast the willingness of the folks on Helix to adopt the platform versus the folks of yet to migrate?

[Frank Verdecanna:]

Yes, Gabriela the continued thing we see with our Helix customers is that they tend to add more spokes and more additional subscriptions than on Helix customers. And so strength in iSIGHT intelligence and in managed defense is often bolstered because of Helix customers. And I think that's just the value of the synergies of having multiple products all working together.

[Operator:]

Thank you. And our next question comes from the line of Ken Talanian with Evercore ISI. Your line is open.

[Ken Talanian:]

I guess first one for Frank. What assumptions around your Annex refresh are factored into your fiscal '19 billings guidance? And how does that renewal base in 2019 compared to 2018?

[Frank Verdecanna:]

So the renewal book is actually a little bit bigger in 2019 than in 2018. And so if you look at the refresh opportunity, it obviously is a larger opportunity in '19 than '18. Our expectation is that we'll continue to execute really well in that. And so in addition to the refresh that happens on the network side alone, I think we'll continue to add additional spokes as part of those refreshes.

[Ken Talanian:]

And as we think about 2019 and the trend for billings, I know you mentioned that there is some to tougher comps versus 1Q '18. But are there any other big deals that we saw through '18 that we should be thinking about relative to the year-over-year compare for '19?

[Frank Verdecanna:]

If you look at 2018, we had two quarters where we have a greater than $10 million transaction, which was Q1 '18 and Q2 '18. In Q3 and Q4, we did not have any transactions greater than $10 million. So the grow over is obviously much bigger and much tougher in the first half.

[Operator:]

Thank you. Our next question comes from the line of Jonathan Ho with William Blair and Company. Your line is open.

[John Weidemoyer:]

This is John Weidemoyer for Jonathan, thanks for taking our call and squeezing us in. My questions is internationally, I want to get a sense of the adoption maturity of international relative to U.S. or with two dimensions, product description but also your managed services. Is international any more likely less likely or about as likely to be interested in those two dimensions relative to the U.S. market?

[Kevin Mandia:]

On managed defense, we're much more adopted, Continental U.S. and international, and it's going -- it's emerging in the international market.

[Frank Verdecanna:]

Yes, I think we've seen that really across our entire business and products and subscription and services. The U.S. tends to be the early adopters and then we see follow-on growth internationally. And so I would say were still early days with some of the newer products internationally, but those will ultimately be the growth engines in the out years. In the U.S. we've seen obviously Helix and some of the newer products to be adopted much faster. But I think if you look at the business overall, we're growing very nicely internationally and a lot of that is because those customers are now just starting to buy some additional products in addition to still buying network email and endpoint.

[John Weidemoyer:]

And my last question is on sales cycles, with your growing product suite and your recent transition. And it seems like you are pretty much through, I'll call it, a re-prioritization or your pricing strategy and naming and such. Do you see sales cycles? Are they maintaining? Are they getting any longer given you have got more stuff going on?

[Frank Verdecanna:]

I think the sales cycles have actually remained pretty much the same. There is a couple of things that we have added like expertise on-demand is that -- because of the breath of different services and intel that you can buy with expertise on demand. We had seen some pretty short sales cycles in Q4 with the limited launch that we did. So I think that that will likely be a shorter sales cycle, because you can use stuff right out of the gate. But I think general, the sales cycles have been remain relatively stable. Some of the things we've done on the ability to proof of value some of the products like fireproof that we did for email and now endpoint, really gives the prospect and easy way to try and buy our products. And so we are hopeful that that will lead to a shortening of the sales cycles with some of those spoke products.

[Kevin Mandia:]

One of the things I have said numerous times, we have six different ways into a new customer. We have got network security, email security, endpoint security, services, threat intelligence and Helix, which some people look at to just be how they operationalize their security and get our intel and some people may look at it as a SIEM replacement at this stage. And I probably got too specific and granular in your question. But the sales cycle can be dependent on which one of those products are the ones that are a foot in the door or avenue to a new customer. But it’s a great portfolio to carry with you if you're a salesperson.

[Operator:]

Our last question will come from the line of Saket Kalia with Barclays. Your line is open.

[Saket Kalia:]

Two part question and I'll leave it at that and so on expertise on demand, because it sounds like there is a lot of excitement around it. So maybe the first part for you, Kevin. How long is it going to take your broader customer base to get access to that? And do we have to have Helix together, that’s the first question. And the second question for you Frank is. Can you talk about how would price -- I mean, is it a price per interaction, is it a subscription price you pay for? And how does the rev-rec work?

[Kevin Mandia:]

Yes, absolutely. Frank has got question number two since you directed to him, and he doesn’t want me to answer it. The reality on how do we get that out to all our customers we got to let them know it, so we are going to do big launch at RSA. We're going to let the world know about it. You can get it through a myriad of ways right now. So you can call us, you can email us, it's in a button in Helix and it's going to be through our customer support portal. And that's what we have to do. We got to give you many avenues in, pick up the darn phone. But ultimately when you go into the out years and Helix is the interface to all our products that's how I prefer it to go. But you got to have more than that as the avenue. And we are building the framework for all FireEye products where customers over time will have an experience where they know the products they have, the licensing to those products and they will have a single FireEye identity if you will to do it. And we will be able to give them a bridge to our expertise in that portal as well overtime. So bottom line, we've got to come up with and we will approach all our customers to make sure they are aware of the expertise on-demand. It to me is -- and I said it earlier, it passes the, I'd buy that test. Just so many customers that I meet that they are supporting really good security experts, first there's not enough of them. So then you're paying a lot of money for the ones you have. And you don't always need them all every day. And so we want to be there when you need us or create the platform where our partners can be there when their customers need them. So that's why we're so excited about it. We'll make sure all our customers are aware of it as fast as possible.

[Frank Verdecanna:]

From a pricing perspective, Saket, it will be prepaid units bought on a subscription basis. So basically, when a customer pre-purchases the units, it will be sitting in deferred revenue until they actually utilize the catalog of services. So there is good to be some level of automated Intel reports that are delivered as part of the expertise on-demand package. And so that will be amortized over the 12-month period and then the rest of it's going to be drawn down based on usage of the actual units.

[Operator:]

Thank you. And this concludes today's question-and-answer session. I would now like to turn the call back to Kevin Mandia for closing remarks.

[Kevin Mandia:]

Yes, first, I'd like to thank everybody for joining us today. I want to put 2018 into some context. Coming into the midpoint of 2016, we had 10 straight quarters with over $40 million in losses in under five quarters, we went to non-GAAP profitability. We had decelerating products, now we have growing products. We have stabilized the business. We have become much more efficient. We have had two years of delivering on the plan that we're sharing with The Street. And we believe strongly that we're building the right products to increase the growth rate in the future. So we're excited about our plan. We're very confident in our plan. And I look forward to speaking with you at our -- I think we're having an event at RSA. So I hope to see you all of you there.

[Unidentified Company Representative:]

Tuesday morning, March 5th 8

[Kevin Mandia:]

Thank you very much.

[Operator:]

Ladies and gentlemen, thank you for participating in today's conference. This does conclude the program. You may all disconnect. Everyone, have a great day.