Mandiant, Inc.
Q1 2017 Earnings Call Transcript

Published: 3 May 2017

[Operator:]

Good day, ladies and gentlemen, and welcome to the FireEye First Quarter 2017 Call. At this time, all phone participants are in a listen-only mode. Later, we will conduct a question-and-answer session and instructions will follow at that time. I'd now like to introduce your host for today's conference, Ms. Kate Patterson, Vice President of Investor Relations. Ma'am, please go ahead.

[Kate Patterson:]

Thank you. Good afternoon, and thank you to everyone on the call for joining us today, to discuss FireEye's financial results for the first quarter of 2017. This call is being broadcast live over the Internet, and can be accessed on the Investor Relations section of FireEye's website at investors.fireeye.com. With me on today's call are Kevin Mandia, FireEye's Chief Executive Officer; Frank Verdecanna, Executive Vice President, Chief Financial Officer and Chief Accounting Officer of FireEye; and Bill Robbins, FireEye's Executive Vice President of Worldwide Sales. After the market closed, FireEye issued a press release announcing the results for the first quarter of 2017. Before we begin, let me remind you that FireEye's management will make forward-looking statements during the course of this call, including statements relating to FireEye's guidance and expectations for certain financial results and metrics; FireEye's priorities, initiatives, plans and investments; FireEye's path to profitability; drivers and expectations for growth, the expansion of FireEye's platform and the capabilities and availability of new and enhanced offerings, market opportunities and go-to-market strategy. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future, and we undertake no obligation to update these statements after the call. For a detailed description of the risks and uncertainties, please refer to our SEC filings, as well as our earnings release posted a few moments ago. Copies of these documents may be obtained from the SEC or by visiting the Investor Relations section of our website. Additionally, certain non-GAAP financial measures will be discussed on the call. We have provided reconciliations of these non-GAAP financial measures for the most directly comparable GAAP financial measures in the Investors Relations section of the website as well as the earnings release. Finally, I'd like to point out that we've posted the supplemental slides and financial statements also on the website. With that, I'll turn the call over to Kevin.

[Kevin R. Mandia:]

Thank you, Kate, and thank you to all of you, the investors, the employees, our customers and our partners who are joining us on this call. We appreciate your interest in making the time joining us today. On last quarter's call we described several of the transitions FireEye is executing through, from disparate products to a single platform; from APT prevention to comprehensive prevention; from on-premise appliances to more cloud and hybrid solutions; from product revenues to subscription revenues, and there's even other transitions we're going through. And as we execute through these transitions, we have maintained our focus on two significant priorities. The first is, right-sizing our cost structure to support a balance of growth and profitability. And the second priority is, evolving our product portfolio to a comprehensive security platform delivered as a service, on-premise in hybrid environments or in the cloud. We remain laser-focused on these transitions and our priorities, and we are committed to achieving non-GAAP operating profitability in the fourth quarter, and a return to growth by the end of this year. Today, thanks to the dedication and focus of the entire FireEye team, we are much closer to realizing each one of these objectives. We did what we said we would do in Q1, exceeding our guidance ranges for every financial metric. In addition to exceeding on the financial metrics, we also positioned the company to better accelerate our growth in the future. So today, I'm going to discuss two things

[Bill Robbins:]

Thank you, Kevin, and good afternoon, everyone. As noted in our release, and in Kevin's comments, we delivered solid results across the board in Q1, and I'm pleased that this was in part driven by improved sales execution. While it's still early, this is an encouraging sign that the go-to-market changes we've made are starting to have an impact. I'm proud of the effort and commitment shown across the FireEye sales team, and I am also very appreciative of the collaboration and commitment we've seen in our work with FireEye's valued channel partners. One of the keys to our success in Q1 was the strengthening of our sales leadership team. As we entered 2017, we committed to filling several critical management roles in the sales organization, and we made good on that promise in Q1. In February, we brought on Kevin Taylor, an experienced sales leader, to head our EMEA team. That same month, we added Wes Simons from SecureWorks to run our global specialist sales team that is aligned with our new Global Services and Intelligence organization. And on April 3, Takayuki Nishimura (13

[Frank E. Verdecanna:]

Thanks, Bill. Kevin and Bill have discussed our vision, and the evolution of our business from the product and go-to-market perspectives. For my first call as FireEye's CFO, I want to spend some time on the financial implications of this evolution, including the continuing shift to subscriptions as well as seasonal patterns as we move throughout the year. I will also provide some detail on our better-than-expected Q1's billing and operating performance, as well as our guidance for the year. Before we begin, let me remind you that, when discussing gross margin, expenses, operating income and EPS, I will be referring to non-GAAP measures. I will start with billings, since billings reflect current business trends, and because they drive our deferred revenue and operating cash flow. Total billings of $152.4 million were above the high-end of our guidance range as our sales execution improved across the board. We saw good uplift on the first wave of renewals associated with the NX refresh opportunity, closed several Helix transactions, as Kevin had mentioned, and improved our performance in EMEA and APJ. The underlying metrics reveal some positive trends in the business, that we believe, position us to meet our targets for the second half of 2017, and deliver continued growth next year. First, we continue to broaden and diversify our base of customers. We added 237 new customers, including 18 new Global 2000 customers, and transaction velocity continued to trend upward. The total number of customers transacting in Q1 increased double-digits compared with Q1 2016. We're also starting to see some traction in the mid-market customer segment, defined as organizations with fewer than 5,000 employees. New business with this segment was up 9% year-over-year in Q1. Although, the transaction size is smaller than that of our large enterprise customers, I believe, this metric validates the potential of our new offerings targeted at this market segment. At the same time, our large enterprise customers continue to rely on FireEye to protect their organizations, which is demonstrated by our continued strong retention rates, increases in the multi-product attach rates, and very good upsell and cross-sell metrics. Global 2000 customers contributed approximately 35% of our total sales, about the same percentage as in Q1 2016. Specifically, the number of customers with three or more product families continued to increase, and is now more than 35% of our installed base. Additionally, customer retention has remained consistently high at approximately 90%, and the dollar yield is over 100% on a rolling four quarter basis as customers add capacity and additional products. Finally, our results were less influenced by a large multi-million dollar deals than in the past. While we closed 29 transactions greater than $1 million in Q1 2017, one more than in Q1 2016, we did not book any transactions over $5 million. In Q1 2016, we had three transactions greater than $5 million, including the eight figure five-year cloud e-mail transaction with a federal agency that we had mentioned in our Q1 2016 call. Since we didn't have any mega deals in Q1, our average contract length declined to 22 months compared to 31 months a year ago and 24 months in Q4. In addition to fewer larger transactions, the decline in contract length reflects a higher mix of renewals compared to a year ago. As expected, the shift towards ratable subscriptions continued in Q1, with growth in both attached subscription renewals and new unattached subscriptions. For product subscription billings, we saw a greater than 20% increase in the annual contract value. We expect the trend to continue through 2017 with the introduction of the Helix platform, and more cloud-delivered endpoint and network security. Q1 product subscription billings were $73.5 million. The year-over-year decline was largely due to the large deal we talked about earlier. And even though renewals were strong on the attached subscriptions, the year-over-year decline in new appliance sales was also a factor. Product billings were $23.4 million, down 30% year-over-year, but above our expectation. The relative strength in appliance sales was primarily the result of good upsell of our new appliances, as well as pull-through of additional appliances with the Helix transaction. While one quarter isn't a trend, these results suggest the pace of decline in client sales may be moderating. Our professional services billings of $31.7 million were consistent with the services billings in Q1 of 2016, and accounted for 21% of our total billings. The increase in the services mix is driven by seasonality more than anything else, and we expect to return to our target range of 15% to 20% of billings in Q2, and for the full year. I won't spend a lot of time on revenue, but I do want to highlight a couple of points. Product subscriptions and support revenue, each grew 17% year-over-year, and totaled $120.3 million, or 69% of total revenue. Both categories grew sequentially as well as we continue to transition to a ratable subscription model. While product and professional services revenue declined on a sequential basis due to seasonality, both came in above our expectations. Total revenue of $173.7 million was up 3% year-over-year as growth in subscriptions and support revenue offset the decline in product and professional services revenue. Increased operational efficiency and sales productivity resulted in a $60 million improvement in our operating loss compared to Q1 2016. As a percentage of revenue, operating margin was 37 percentage points better than a year ago, and improved to negative 7% versus negative 44% a year ago. This is outstanding performance and reflects the continued focus in every area of the company. We ended the quarter with 2,868 employees worldwide, slightly less than our Q4 ending head count. Our balance sheet remains strong, with $875 million in cash and short-term investments, and a total of $632 million in deferred revenue. I want to point out that, while our total deferred revenue increased 12% from a year ago, current deferred revenue was up 21%. Just under $400 million is sitting in the current deferred revenue on the balance sheet, and will be recognized in the next 12 months, giving us increased visibility into future revenue. This is one of the benefits of the increasing mix of subscriptions. Better operating performance also allowed us to outperform our cash flow guidance. Operating cash flow was negative $17 million in Q1 versus our expectation of negative $30 million to negative $40 million. You may notice that the cash is down by more than the negative cash flow, due largely to a $39 million payment on the iSIGHT earn-out that shows up in the financing section of our cash flow statement. Those are the highlights of our Q1 performance. It's clear, we're better positioned at business today than a year ago, and the many positive indicators in Q1 gives us confidence to issue full-year guidance along with the Q2 guidance. For Q2, we are now expecting billings in the range of $155 million to $175 million, and revenue in the range of $173 million to $179 million. Given our new product introductions, the shift to subscriptions and the growing renewals opportunity, it is difficult to give specific guidance on the mix, but I think you can expect both product billings and product revenue to continue to decline between 38% to 40% year-over-year in Q2, and to decline between 20% and 30% for the full year 2017 as we get better compares in the second half. I expect the sequential trends in professional services billings and revenue to track to 2016. We're targeting a non-GAAP operating margin of negative 9% to negative 10% for Q2. This does imply modest expense growth of a few million dollars, primarily due to higher commissions as well as increase in head count as we prepare for the seasonally-strong second half of the year. We would normally expect Q2 to be our lowest cash flow quarter of the year as we collect on seasonally low Q1 billings, and we expect this to be the case for Q2 2017 as well. This is why we're guiding to negative operating cash flow in the range of negative $17 million to negative $27 million for Q2. As billings increase sequentially, so do our receivables and this sets us up for positive operating cash flow in the second half of the year. Using shares outstanding of approximately 176 million for Q2, this results in an EPS range of negative $0.10 to negative $0.14. For 2017, we expect billings in the range of $745 million to $775 million, and revenue in the range of $724 million to $736 million. We continue to target operating profitability in Q4, along with renewed billings and revenue growth. We also think we will generate positive operating cash flow for the full year. In summary, I'm very pleased with our results in Q1, and I believe, we are on the right path. We did what we said we would do and then some. The initial response to Helix has been strong. We're executing well on the NX refresh opportunity, and we've made substantial progress on our path to profitability. That's it for my prepared remarks, and I will turn the call back over to the operator to begin Q&A.

[Operator:]

Our first question comes from the line of Sterling Auty with JPMorgan.

[Kevin R. Mandia:]

Sterling, how are you?

[Frank E. Verdecanna:]

Sterling?

[Operator:]

Okay, we'll circle back...

[Ugam Kamat:]

Yeah. This is Ugam Kamat on for Sterling Auty. Yeah, I just wanted to ask a question on the duration. It's trickled down since the first quarter of 2016 from 31 months to 22 months. Should we expect this to be the new level for the contract duration? And like until the billings actually kick-start again in the second half of the year?

[Frank E. Verdecanna:]

Yeah. I think, the contract length decline really was a result of lack of the larger mega deals, and then also a mix shift of a little bit more renewals. I would expect, we'll see probably a little bit of an increase there. But generally, I think, if you think about the shift to more subscriptions, contract length over time will probably be roughly around two years.

[Ugam Kamat:]

Okay. Thank you. And secondly, on your expense structure, we saw a massive leverage on sales and marketing expense despite billings beat, sales and marketing expenditure came in lower than our expectations. Has there been a change in the commission structure or sales and marketing policy that you have seen over the past few quarters?

[Frank E. Verdecanna:]

We've continued to make efficiency changes within the sales group. I think, Bill, coming aboard, he was very focused on bringing in the right sales leadership and filling some roles there. But we also did look at some changes to the comp plan to really incent the right behavior. But I think, the overall reduction in sales and marketing expense is really just the company getting more efficient there, and really focusing on driving kind of the new products and subscriptions.

[Ugam Kamat:]

All right. Thank you so much. That was really helpful.

[Kevin R. Mandia:]

Thank you.

[Operator:]

Our next question comes from Gabriela Borges with Goldman Sachs.

[Gabriela Borges:]

Good afternoon. Thanks for taking the question. Great to see the business starting to stabilize. May be a little more detail on the product revenue upside that we saw in the quarter. Maybe Kevin, if you could just expand a little bit on how those conversations with customers are going. What are they doing to expand the footprint of the appliances in the data centers? Is it a function of MVX 2.0? Is it a function of network primarily or endpoint and e-mail as well? Any additional color would be appreciated.

[Kevin R. Mandia:]

Yeah. Gabriela, when I look at the growth areas, obviously, we're known as a great Sandboxing technology. We do in-line blocking. We did a lot of work to make sure we're not just an appliance company, but we can have software form factors for those features. But I see endpoint in what we're doing there, and Helix bringing it all together. Helix is pretty cool. The ability to see alerts from our products and your other security products in one interface is what people are reacting to. But again, security practitioners have been starving for a single endpoint agent that detects what AV detects, detects what AV misses, and scales experts to make sure even when you're 99% effective on the endpoint, with the amount of malware on the Internet, 99% sounds good, but isn't good. And at the end of the day, you always want to scale your experts to take a sneak peek of machines when alerts are coming in, and we have a tech that can do that. So I look at Helix and our endpoint. And then I look at NX, and our products that got us here, kind of a spokes or sensors on our new system. And as Helix becomes the interface for those technologies that we've been selling for the last seven or eight years, you'll see us go from network Sandbox company to truly a holistic comprehensive security operations platform. And that's what we're trying to migrate and become.

[Gabriela Borges:]

Great. I appreciate the color. And the follow-up for, Frank, if I could. And I think, back to 90 days ago, lot of moving pieces in the model that prevented the full-year guidance number from being put out there. So maybe if you could just compare and contrast for us, the visibility that you have into the business today, versus a quarter ago and your confidence in hitting that full-year number? Thank you.

[Frank E. Verdecanna:]

Sure, Gabriela. Yeah, I think a couple of things changed from Q1. One, a lot of our second half growth was dependent on Helix and our next-generation endpoint product. And so, we wanted to get a quarter in, make sure Helix was released on time, make sure the road map of endpoint was progressing as planned. And so both those, we were able to launch Helix the last day of the quarter, and our endpoint road map actually progressing really nicely. So I think – that gives us the confidence in the growth drivers for the back half of the year. Additionally, the NX refresh opportunity was a big opportunity we're looking at for the year as well. And our first quarter out of the gate, we did little bit better than we expected there. So I'd say, those three things on the growth drivers for the second half of the year, and then also, I think, product, we got a little bit more visibility and a little bit more moderation. As you recall, in Q4, we had a pretty big spike in the product decline, and that seems to have moderated in Q1 and in the pipeline for Q2.

[Gabriela Borges:]

Sounds good. Thank you.

[Kevin R. Mandia:]

Thank you.

[Operator:]

Our next question comes from Saket Kalia from Barclays.

[Saket Kalia:]

Hi, guys. Thanks for taking my questions here.

[Kevin R. Mandia:]

You bet.

[Saket Kalia:]

Maybe first for you, Frank, first of all, welcome to the call.

[Frank E. Verdecanna:]

Thank you.

[Saket Kalia:]

Can you just talk about the $15 million benefit you got in expenses last quarter? And whether that reversed this quarter? I guess, we were expecting expenses to be up by more from just that alone, and so did that reversal happen? Or were you just able to cut more? Maybe just a little bit more color on how that sort of transpired from Q4 to Q1?

[Frank E. Verdecanna:]

Sure. In Q4, we did have some one-time kind of benefits on the expense side, that didn't reoccur in Q1. But we did have some further kind of cost reductions just on making the business more efficient. We also had a slight decline in overall head count from Q4 to the end of Q1 as well. And so those were the big drivers of the operating expense side.

[Saket Kalia:]

Okay. Got it.

[Frank E. Verdecanna:]

(34

[Saket Kalia:]

Sure. And so just to clarify, that $15 million benefit actually didn't reverse in Q1? Or did it? Just to make sure we're all clear.

[Frank E. Verdecanna:]

It reversed, but then we found some additional cost reductions. And we said in the guidance that we do expect Q2 expenses to pick up a little bit.

[Saket Kalia:]

Got it. Got it. Okay. And then, for my follow-up, again for you, Frank, can you just talk about the mix of product subscription billings at this point that are coming from attached subscriptions versus unattached? And maybe how that compares to last year at this time?

[Frank E. Verdecanna:]

Yeah. So the attached is about 40%, and the unattached was about 60%.

[Saket Kalia:]

Okay. I'm assuming that, that's probably – that ratio was probably flipped, right, at this time last year or how do you sort of think about it?

[Frank E. Verdecanna:]

Correct. As product goes down, you lose some of the attached subscriptions. But if you look at our newer products, and Helix is a good example, that's going to be an unattached subscription, so you'll see growth in that area.

[Saket Kalia:]

Got it. Very helpful. Thanks guys.

[Kevin R. Mandia:]

Thank you, Saket.

[Operator:]

Our next question comes from Gur Talpaz with Stifel.

[Gur Talpaz:]

Awesome. Thanks, guys, and congrats on the quarter. So with Helix now GA and Cloud MVX having gone GA in Q4, can you talk about early customer feedback here for both these products, especially with Helix now launching at the end of Q1. I mean, you touched on refresh earlier. Are you seeing traditional NX customers convert to the Cloud MVX product upon refresh? Or they perhaps adding Cloud MVX as additional virtual sensors across their network? Thank you.

[Kevin R. Mandia:]

Yeah. So I think, I heard about two or three questions in there. I'm going to answer one, and then I'll pass it off to others for color. One of the things, when we did Cloud MVX, we had to do it. It's going to be a critical component for our high-fidelity alerts in the Helix system. So other technologies will leverage it. What I saw in refresh opportunities in Q1, realizing it's our smallest quarter for refresh opportunities to take the data for what it's worth in the first quarter. But most people still chose the appliance form factor and went back in on those renewals. It's up to them. We like to have a menu that's versatile. But at the end of the day, I was a little surprised, but the appliances were chosen during those renewals. And I don't know, Bill, do you want to add color to that?

[Bill Robbins:]

No, I think you hit it right, Kevin. It's certainly from a choice perspective, they are looking at the different alternatives. They're looking at what do they have in place already if they have appliances, which obviously is, what they're coming from a renewal, refresh perspective. They seem to be comfortable with that. It really kind of depends on where they are in their architecture perspective. If they're looking to maybe build out larger architecture, more sites, expand their business, little more interest in virtual. If it's more of a one-for-one replace, we are seeing a lot of the appliances just straight-up replacement.

[Gur Talpaz:]

That's helpful. And then maybe one more, if I might. If I look at your annual guidance on billings, you're implying a pretty big ramp here in the back half. How much of that is related to the Helix launch? And what you're seeing from there early on? Or perhaps other products you've recently rolled out or you're planning to roll out like endpoint?

[Kevin R. Mandia:]

Yeah, Gur, I would say, the three growth drivers for the back half of the year really are Helix. And with launching it at the end of Q1, we'll see continued traction in Q2 there, but most of that growth is going to be in the back half. And then, on the endpoint, we'll have kind of the full AV replacement out in Q3, and so that's going to be one of our significant growth drivers there. And then the timing of the NX refresh opportunity, most of those renewals happen in the third and fourth quarter.

[Gur Talpaz:]

Okay. Great. Thanks a lot. Congrats guys.

[Kevin R. Mandia:]

Thank you, Gur.

[Operator:]

Our next question comes from Melissa Gorham with Morgan Stanley.

[Melissa A. Gorham:]

Great. Thanks for taking my question. I just have another follow-up on the product refresh opportunity. So it's interesting that you said that, a lot of customers were choosing the appliances in the quarter. But I'm wondering, as we're thinking about the refresh moving forward, would you assume that, most customers are going to opt for Helix? Or is that assumed in your expectations for the full year? Or do you still see some appliance refresh in the outlook?

[Kevin R. Mandia:]

I think, we're going to get a mix of both, Melissa. And one of the things we're working on hard right now, and we're hoping for a Q3 release of is, is the interface of Helix will become the interface for the NX product line if our customers choose that. And that way, we can help walk our customers from a network security investment in FireEye to more of a comprehensive security investment in FireEye, because we give them an interface that overlays our intelligence, and also is the same interface for other third-party alerts to include our endpoint products. So I think that's the selling motion that we want to add to the mix. Right now, the selling motion on the refresh is, you now have choices on form factors. You can get better throughput and do Cloud MVX, and you can get more geographic coverage as well. But I'd like to have a second selling motion come in sometime in Q3 with that additional Helix interface and see if we can walk our customers to more of the full platform story.

[Frank E. Verdecanna:]

Yeah. And the one thing I'll add to that, Melissa is that, if we look at those four Helix transactions in the first quarter, two of them actually brought along with it some appliance revenue as well. So I think we're going to see a lot of customers that are still going to have a hybrid environment where they'll have kind of the Helix cloud solution and maybe the endpoint in the cloud. But then, they still may have some appliances, and so we still may see some product sales there as well.

[Melissa A. Gorham:]

Okay. That's helpful. And then, just one quick follow-up in terms of sales capacity, with the new products that are ramping in the second half of the year, I'm wondering if you can comment how comfortable you are with the sales capacity that you have today or do you need to invest additional dollars to increase feet on the street?

[Kevin R. Mandia:]

From a capacity perspective, there's a couple of things we're looking at. I mean, first and foremost, I hit in both of these in my opening remarks is, continued leverage of the channel. I mean, getting that channel leverage, enabling the channel, getting them to lead with FireEye products, and improving the partnership certainly gives us more reach in a more cost-effective way. And frankly, faster than we could wrap up ourselves. So we're putting a lot of effort there. And I think for the second half of the year, specifically with the launch around HX, I'm really excited about what we can do with our channel partners. Now, the second thing, and I also mentioned in my opening remarks, was around enablement. We have a really good strong team here. And as we roll out these new products, it's incumbent upon me and my leadership team and the marketing team and product management and the company to make sure that our teams really understand how to best position the technology, they understand it technically, they understand the business value, they understand the competitive positioning. And so we're spending a lot of time and effort on trying to get a – kind of a one to many lift, right? So taking something that's repeatable, scalable in terms of the selling motion and the value and making sure that every FireEye sales professional can take that into their customer base. And then the third part is more of the brute force adding capacity, feet on the street. And there are some place that we're doing that. We certainly like any company are always looking for good talent, and there's markets that we think we can invest in going that make a lot of sense. So we will continue to do that. But those are the three things we're focused on, and frankly, probably in that order getting channel lift, enabling our existing sales team to get more productivity and then augmenting our actual sales capacity when it more makes sense.

[Melissa A. Gorham:]

It's very helpful. Thank you.

[Operator:]

Our next question comes from Ken Talanian with Evercore ISI.

[Ken Talanian:]

Hi, guys. Thanks for taking the question, and congrats on the quarter. So you noted that the dollar yield on renewals is over 100%. I was wondering if you could rank order the primary drivers for upside above the dollar-for-dollar renewal portion of that?

[Frank E. Verdecanna:]

Yeah. Sure, in most cases, Ken, it's basically customers that are adding to their current platform. And so they could be an existing web customer that is adding ETP or they could be an existing web customer that's just adding capacity. With some of the new appliances and some of the lower cost sensors, we're seeing people add to different branch offices and subsidiaries that in the past was too cost prohibitive to do so.

[Ken Talanian:]

Okay. And then for my second question, are you seeing any extension to the sales cycle as you push towards more of a platform offering?

[Kevin R. Mandia:]

I don't know. My initial response to that, Ken, is that it's too soon to tell on the Helix thing, and the way we sell it is relatively modularized. I can only know if that's a word. But we go in and just look for a need. The key is the interface to it, because it brings the legacy products in or our products in. But once we show, Helix, I don't sense it's elongating the sales process, because people see the value of the interface, and then they recognize, we can put endpoint into this thing, we can put other network technology, sending data to this thing. And once they embrace the mission control interface of it, that just gives us greater opportunity to talk about endpoint or talk about some of our product sets. But that's why we pushed out the analyst meeting, as we need to get our sea legs behind Helix. We released it March 31, and we're going to keep an eye on that pipeline and grow it and learn a lot over the next few quarters.

[Frank E. Verdecanna:]

And Ken, two of the four deals we closed for Helix were new customers, and those sales cycles were actually very quick. But again, it's a very small base to make any assessments there. I think, we have to kind of progress through Q2 to come back to you on that.

[Ken Talanian:]

Okay. Great. Thanks very much.

[Operator:]

Our next question comes from Jonathan Ho with William Blair.

[Jonathan F. Ho:]

Let me build on that last question on Helix. And what we're hearing is that, Helix presents a pretty compelling economic value. Can you maybe talk about what the opportunity is to pull-through additional product sales over time when somebody gets on to the Helix platform? And do you see any sort of cannibalization risk that comes from the product?

[Kevin R. Mandia:]

Yeah. So this is Kevin speaking. First, the reason Helix matters is that, I've done my thousands of hours looking at log files, personally. And the biggest frustration when you're inundated with data is, what alerts matter. And then for the alerts that matter, give me some context about it, besides bad dot back door, and those AV messages we've gotten for last 20 years that don't enlighten us in any capacity. So first and foremost, we see great value in overlaying our threat context on the alerts from our products and other people's products. But one of the under spoken things about Helix is, we're trying to automate the countermeasures or automate the defense. You can only automate with high-fidelity alerts. And this is where FireEye products actually boast great success. We don't have a lot of false positives. We've invested to make sure we have that fidelity. So I see a Helix sale. If we sell Helix, and people are trying to leverage legacy technology into it, it is far harder to automate the countermeasures with legacy technologies that don't have the fidelity of the FireEye product suite. So that's where I see it as – if they see the value in the interface and they see the value in our threat intelligence, our threat context and the integration of all these products, it's going to come down to what do they want automate? Can they do it with the fidelity of their prior technologies? And if they cannot, they'll start leveraging more of ours.

[Jonathan F. Ho:]

Got it, that's helpful. And then, just as a follow-up. You guys spoke about a large endpoint renewal opportunity coming, I guess, later on this year. Can you maybe elaborate on that in terms of the cycle, and why you feel your solution is competitive relative to – there seem to be many next-generation endpoint solutions that are out there?

[Kevin R. Mandia:]

Well, I'll talk about why I feel it's competitive, and I'll let somebody else talk about to the source of that opportunity, but I know, it's there. And I heard, Bill Robbins speak that it could be our first most product-ready technology. But I've been in this endpoint space since 2004 when I started Mandiant, and we started Mandiant to build the next-gen endpoint. So this has been a long time coming. What people want on the endpoint is something that detects what AV detects, so you get a check mark in the compliance go box. But then they want to detect what AV misses. And even the large AV companies over last few years have said statements like, AV is dead or AV isn't as effective as it needs to be. So you got to detect what AV detects, detect what AV misses, in multiple ways, one might be dynamic inspection, one might be machine learning, one might be some kind of other models or algorithms or analytics or even Indicators of Compromise. But the third thing is that, EDR capability or forensics capability. And we're putting EDR and endpoint protection into the same agent. And I think that matters. And again, it's because it allows people to inspect systems every time they get an alert. And I'll expand for one more minute. Most companies that have modern security practices know that when AV triggers, that doesn't mean, Thank God, AV prevented the breach. What it actually means is, we better take a look at that machine to see what AV misses. And no matter how good everybody gets on endpoint, there's always going to be that mature security operations that need to inspect the alerts to see if anything was missed, and we have that in our endpoint. So again, we have endpoint protection and EDR and forensics capability and containment on one agent. And I'm not aware of any other organization that has that in one agent. Bill, there's another part to that question, I thought you're better to answer, which is the second half opportunity for endpoint?

[Bill Robbins:]

Sure. I think, what we've seen, this is maybe one of the advantages of really having been out there, pounding the pavement trying to strengthen our relationships with our channel community as we talk to a lot of the big distributors out there, I don't need to name them, you all know who they are. They're the ones that have insight into this, right, because those contracts pass through them. And it's been very clear in those discussions that – that there's a – may be a disproportionate amount of AV business coming up in the second half of this year for whatever reason, the contracts are expiring and coming up second half of this year. And there's an appetite, I think both within the channel community as well as within customers, too, to explore new technologies, to do more than just traditional AV, as Kevin just kind of walked us through. So when you put all that together, we see a market opportunity that's validated through working with our broad channel (51

[Frank E. Verdecanna:]

And Jonathan, you gave me an opening, so I'm going to use it. The other reason, when you think you have competitive advantage, you got to look at your team. And I look at our endpoint team over the last year, and what they've done, we've got a great team. When you have a great team, you get more bullish on it. We've got some exceptional endpoint talent building that, and our customers have noticed it in the last year. So again, it's built on – I'm confident that we'll be highly-competitive because of the team and the leadership on endpoint as well.

[Jonathan F. Ho:]

Great. Thank you.

[Operator:]

Our next question comes from Gregg Moskowitz with Cowen and Company.

[Gregg Moskowitz:]

Okay. Thank you very much, and good afternoon, guys, and congratulations as well on a good quarter. Given that the new strategy as well as the improved product portfolio and channel traction, I was a bit surprised that your new customer account wasn't a little higher.

[Kevin R. Mandia:]

Yeah.

[Gregg Moskowitz:]

Can you walk through what you saw there as well as kind of what you expect on new customer acquisition over the balance of the year?

[Kevin R. Mandia:]

You want to talk to that, Frank?

[Frank E. Verdecanna:]

Yeah. So on the new customer, we did see an improvement in the less than 5,000 employee customer segment, so we are seeing an improvement on the transactional velocity. I think, Q1 is just an always a tough quarter for new logos. I think we'll see, hopefully, in Q2 that number increasing quite a bit from here. But I also think if you look at kind of the new product offering, Helix and advanced endpoint really get us into new market segments that I think we can really take advantage of. So we're very hopeful that we'll continue to see traction on the new logo side, especially as we progress throughout the year.

[Kevin R. Mandia:]

Yeah, Gregg, my conclusion on that was, and I noticed it just like you did, we got to continue all the efforts to improve channel leverage. We've got to get greater reach. We got to grow broader, and that's why Bill Robbins is part of this call. But we noticed that number and we know, we got to open up more markets and that's why we're also doubling down on endpoint, have been doing that for the last year.

[Gregg Moskowitz:]

Okay. Perfect. Thanks. And then just a follow-up on Helix. It's nice to see it be GA, and I realize, it's extremely early in a very small sample size at that. But is there any more color that you guys can perhaps can provide on the economics for these early adopter customers, and how that perhaps compares with their prior spend with FireEye?

[Kevin R. Mandia:]

Do you want to comment on it, Frank?

[Frank E. Verdecanna:]

Sure. Sure. Yeah. Gregg, what we saw in those four Helix deals, two of them were existing customers, two were new logos, that the actual Helix subscription, the amount of pull-through from FireEye as a Service and additional products was even greater than the Helix subscription. So I think, what you're seeing is that, if a customer were to buy à la carte, all the pieces, it would be about 30% to 50% higher than it is, the Helix subscription. But one of the things that we're really encouraged by is, it looks like customers are – when they're adopting Helix, they're also doing some add-ons on top of that. So again, the sample set's only four customers, so it's still very early days. But I think, what we're going to see is additional pull-through on the FireEye as a Service and the appliance side as Helix continues to gain traction.

[Gregg Moskowitz:]

Okay. Terrific. Thanks very much.

[Kevin R. Mandia:]

Thank you, Gregg.

[Operator:]

Our next question comes from Andrew Nowinski with Piper Jaffray.

[Andrew James Nowinski:]

All right. Thanks and congrats on the nice quarter.

[Kevin R. Mandia:]

Thank you, Andrew.

[Andrew James Nowinski:]

Maybe just a follow-up on Helix, can you just quantify the four Helix transactions and the pull-through as well that happened on the last day of the quarter? I'm just trying to understand whether you would still have exceeded your guidance if Helix was launched a day later?

[Frank E. Verdecanna:]

We would have still exceeded our guidance if – we would have exceeded the midpoint of our guidance if Helix would have actually went GA in Q2. Helix, we were very encouraged that it did go GA in Q1, and it definitely was part of the outperform, but it wasn't the complete outperform.

[Andrew James Nowinski:]

Okay. Got it. And then, Mandiant looks like it was down about 8% this quarter, but seems like breach activity is up pretty significantly year-to-date. I'm just wondering, why breach activity isn't necessarily yet for Mandiant?

[Kevin R. Mandia:]

Yeah, we're digging through all our papers now, Andrew. Thanks you asked the one question, we weren't ready for. I can speak to some color as we're digging up, because I looked at the Mandiant performance as steady as it always is and we're responding to as many breaches as we always are. And I can tell you, towards the end of Q1, and into April, we were at full capacity. We had a couple of things that popped up or even I got the inbound phone call for some emergencies. And we just didn't have the staff to work it. So we're digging it up. Did you get the answer Frank?

[Frank E. Verdecanna:]

Yeah, well, revenue is down a little bit year-over-year, billings is relatively flat year-over-year. And again, that's just timing of the size of the breaches and chargeability and number of consultants. I wouldn't expect again, that's normally 15% to 20% of our billings, and we'd expect that to fall in that range for Q2 and the full year.

[Andrew James Nowinski:]

Got it. Keep up the good works guys.

[Frank E. Verdecanna:]

Thanks.

[Kevin R. Mandia:]

Thank you.

[Kate Patterson:]

We've got time for one more question, please.

[Operator:]

Okay. Our last question comes from the line of Walter Pritchard with Citi.

[Walter H. Pritchard:]

Thanks. I guess, two questions, one for Frank, one for Kevin. Kevin, on Helix, can you talk about – that product has the ability to pull in third-party information and alerts and so forth and inform it. Can you talk about, what you've seen, I guess, these four deals or what the pipeline looks like in terms of that product's – customers using the product to do that, and as it relates to that third-party role who do you feel like you're winning against? Because there's other products out there that are doing the same thing?

[Kevin R. Mandia:]

Yeah. And so on your second part, Walter, I'm not convinced right now, we're winning against anyone in the pull-through of other people's alerts as an SIM, but when all things are equal, the experience that I have on Helix is actually being on the terminal in live environments. It's too soon to tell for those four customers that they provision all the pieces and get it up and running. And it's been about a month. And so I'm not sure exactly where they're at today. But I've done my hour-plus on Helix in the last week. And it's what we can take, I don't know if you want me to nerd out right now, Walter, but we can take Common Event Format alerts. We can take net flow, we can take PCAP. We can take file objects, we can take a lot of different things into Helix from whatever tech can provide those file formats and do analytics on it and apply threat intelligence to it. So what I see the value of it is, it's a single interface for all of the FireEye products, and just an added bonus, if you're looking at alerts for the FireEye products, it's kind of nice that in that same interface, you can look at alerts from many other product, and that's how you consume our threat context maybe even do some correlation in one interface, return alerts from a FireEye product and somebody else's endpoint tech. We hope to make all the experiences best with our technologies, but we realize you can't go and rip replace platforms, when doing platform sales all the time. What I really like about Helix is, you can go into an endpoint opportunity, and you can edge out the folks that only have an endpoint in their back pocket. We've got next-gen endpoint, and we got network sensors that can do in-line blocking. And as far as I know, the fastest dynamic inspection on the planet to detect things no one's ever seen before. So we can kind of sell a portfolio of things when we're up against the point product organizations that have emerged over the last few months. But we're not replacing SIMs yet, that I'm aware of, and I think that's what you're alluding to, but we have an interface that because it can tap in Cloud MVX and another analytics capabilities, we take far more than just our own alerts.

[Walter H. Pritchard:]

Got it. And then for Frank, just on the second half I guess, I recall last year you were in a situation where you felt the second half would get better, and it was based on some new product traction that didn't materialize. I guess, I'm a little bit surprised to hear that a product in Q3, the endpoint, the new endpoint is part of what you're pointing to. Is there something that gives you more confidence and the traction of that product, for example, that's not out or Helix that's a pretty early product in terms of getting to that ramp in the second half?

[Frank E. Verdecanna:]

Sure, Walter. Really, it's the combination of all three. I think, endpoint being kind of a full AV replacement in Q3. It's not something that we've had before. And this is something that our current customer base is asking for, and has been asking for. It's a spend line item that they would love to kind of move over to us. So I think, the timing of that release and the road map, and as we've kind of followed over last couple of months, I think that's given us confidence that, that will be one of the growth drivers. And I think Helix and the NX refresh opportunity are both pretty significantly growth drivers that we really didn't have at the back half of last year. Back half of last year, we just kind of MVX separation, endpoint was still in the early days, and we didn't have Helix. So I think, the world's changed quite a bit in the last year. And then also, the continued headwind of a product decline is just much smaller this year than it is last year.

[Kevin R. Mandia:]

Yeah, and Walter, I have two things to add to that, it's Kevin speak. In my forecast for last year's second half of the year was actually flat over the prior year. And it was just more of an approach towards how we want to look at guidance. And the second thing is, and from that it takes a lot of appreciate it. How long it takes to get a coalition and inertia behind a unified product road map. We have that at FireEye, now. But it took months and quarters to get it when you're taking multiple teams and putting them together. And we got there by the end of last year. So it took that amount of time. But now our confidence is higher that we're getting the productivity from the engineers because we have a true coalition of folks that believe in what we're doing, and that's just giving us growth in our confidence.

[Walter H. Pritchard:]

Thank you.

[Kate Patterson:]

Kevin, would you like to make some closing remarks?

[Kevin R. Mandia:]

Yeah. In closing, you look at Q1, and I look at where we're at and where we're going, we're doing a nice bridge where we're operationally efficient as we're giving time for our new products to emerge and to build. I'd like to thank all of you for your time on this call, and I look forward to chatting with you over the next 90 days. Thank you very much.

[Frank E. Verdecanna:]

Thanks everyone.

[Kate Patterson:]

Thank you, all.

[Operator:]

Ladies and gentlemen, thank you for your participation in today's conference. This concludes the program. And you may now disconnect. Everyone, have a great day.