Mandiant, Inc.
Q4 2017 Earnings Call Transcript

Published: 9 Feb 2018

[Operator:]

Good day, everyone, and welcome to FireEye Fourth Quarter 2017 Earnings Results Conference Call. This call is being recorded. With us today from the Company is CEO, Kevin Mandia; and Chief Financial Officer Frank Verdecanna, and Vice President of Investor Relations Kate Patterson. At this time, I would like to turn the call over to Kate Patterson. Please go ahead.

[Kate Patterson:]

Thank you, Jonathan. Good afternoon and thanks to everyone on the call for joining us today to discuss FireEye's financial results for the fourth quarter of 2017 and the full-year 2017. This is call is being broadcast live over the Internet and can be accessed on the Investor Relation section of FireEye's website at investors.fireeye.com. With me on today's call are Kevin Mandia, FireEye Chief Executive Officer; Frank Verdecanna, Executive Vice President, Chief Financial Officer and Chief Accounting Officer. After the market close FireEye issued a press release announcing the results for the fourth quarter of 2017 and full-year 2017. Before we begin, let me remind you that FireEye's management will make forward-looking statements during the course of this call, including statements relating to FireEye's guidance and expectation for certain financial results and metrics, FireEye's priorities, initiatives, plans and investments, drivers and expectations for growth, the expansion of FireEye's platform, and the capabilities and availability of new and enhanced offerings, competitive position, market opportunities and go-to-market strategies. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today and you should not rely on them as representing our views in the future, and we undertake no obligation to update these statements after the call. For a detailed description of the risks and uncertainties, please refer to our SEC filings as well as our earnings release posted an hour ago. Copies of these documents may be obtained from the SEC or by visiting the Investor Relations section of our website. Additionally, certain non-GAAP financial measures will be discussed on this call. We have provided reconciliations on these non-GAAP financial measures for the most directly comparable GAAP financial measures in the Investor Relations section of the website as well as in the earnings release. Finally, I'd like to point out that we have posted the supplemental slides and financial statement on the Investor Relations section of the website. With that, I'll turn the call over to Kevin.

[Kevin Mandia:]

Thank you, Kate, and thank you to everyone joining us today, the investors, the employees, the customers and partners. We appreciate your continued interest and support in FireEye. In February of 2017 we said FireEye was committed to achieving non-GAAP operating profitability in the fourth quarter and a return to growth by the end of the year. And I'm proud to tell you we accomplished what we said we would do. With Q4 billings of $242.2 million record revenue of $202.3 million and a positive non-GAAP net income for the first time ever, we had a strong finish to 2017. To put this performance into context from Q1 of 2014 through the second quarter of 2016, we posted 10 consecutive quarters of non-GAAP operating losses between $45 million and $80 million. We worked hard over the last six quarters to be much more efficient and to return to growth. And our Q4 accomplishments our direct result of the hard work and determination of all the employees here at FireEye and I want to thank each one of you. It takes great people working with the intention of purpose to deliver the kind of results we are reporting here today. Now today I'd like to discuss two topics. I want to provide some Q4 highlights and an update on FireEye’s innovation. In regards to our Q4 performance, we exceeded our guidance ranges for all of our key financial metrics. Our Q4 billings of $242.2 million was the second highest in our history, and it was 9% increase year-over-year. Our quarterly revenue exceeded $200 million for the first time ever representing double-digit growth year-over-year. FireEye Endpoint Security had its best quarter ever. Mandiant Services had their best quarter ever. Our Threat Intelligence business had its best quarter ever. Our client sales increased year-over-year for the first time since Q3 of 2015 and we had more million dollar transactions than any other quarter in our history. With regard to regional sales performance, all regions met or exceeded our expectations with Europe and the Middle East or EMEA posting particular strong performance as we continue to build our business in that region. Over the past year the productivity morale of our sales team has improved dramatically under the leadership of our Head of Sales, Bill Robbins and his new team. We entered 2018 with an energized execution oriented field of sales professionals, supported by a new marketing machine that I will talk more about later. We also did a great job maintaining our focus on operating efficiently in Q4. For the full-year of 2017, we reduced our non-GAAP operating expenses by $94 million year-over-year and we reduced our non-GAAP operating losses by approximately $130 million in comparison with 2016. We have also worked hard to improve our channel relationships, which is enabling us to reach new markets and achieve gains in our operating leverage. I am pleased to see our channel business increasing and believe we will see continued improvement in our channel as a result of our commitment to our strategy around the three P's; product, price, and process. We continue to innovate to provide better products to the channel. We continue to price more appropriately for the channel and we are also adhering to a consistent process with our channel and partners to provide better enablement and make doing business with FireEye simpler, more profitable, and consistent. I would now like to discuss how FireEye innovate and why I believe we innovate faster and better than any of the other security companies. We have created a platform that incorporates a hub and spoke model. We are innovating our network, end point, and e-mail security products were the spokes in this model and we are also driving innovation with Helix, our hub and brain that integrates data from the FireEye spoke products as well third-party solutions to automate the detection response process. Based on our investments in Mandiant services and our threat intelligence capabilities as well as the ability of our products to detect unknown attacks, I believe we know more about the evolving threat landscape and cyber attackers than any other security company. We spend hundreds of thousands of hours annually on the front lines of cyber security both responding to breaches and performing analysis of what attackers are doing and how they do it. Because of our position on the front lines, we also learn which products are being evaded and how and what capabilities are needed to detect and stop these attacks. FireEye uses this knowledge to fuel our continuous innovation cycle and this cycle allows us to adapt sooner and innovate faster, keeping our products relevant and our customers protected. Now let's talk specifically about the innovation in the FireEye platform. Helix gained momentum in Q4 as we added 116 customers to the platform up from 57 customers adopting Helix in the third quarter. We were especially pleased to see customers adopting Helix across a wide range of geographies and industries. In addition to the Americas, we now have Helix customers in Denmark, France, Switzerland, Italy, Saudi Arabia, South Korea, and the Philippines to name just a few countries. In fact, after only three full quarters of availability, Helix has been adopted by customers in 14 countries and in 11 different industries. In some of these regions, cloud-based products might face challenges due to privacy concerns and data sovereignty issues. It is true that the selling motion can be more complex in some international deals. The success of Helix in these markets is a validation of our infrastructure and operations and how we have made our cloud operations relevant to a widespread and global market. Our next major release of Helix who had extensive case management capabilities better hooks into our managed defense offering and better support for hybrid deployment options. And on January 11, we completed our acquisition of X15 Software, a technology start-up with a big data platform capable of monitoring, searching, and analyzing data on a massive scale. The X15 platform allows us to extend Helix to on-premise deployments into a more diverse range of cloud platforms such as AWS, Microsoft, Oracle, and others. The X15 technology will be a large part of the foundation for our platform and analytics capabilities going forward, and I'd like to welcome the X15 team to team FireEye. Like Helix, our endpoint security product had its best quarter ever. To understand why our endpoint business keeps growing, you only need to review the progress we made in 2017. In the last year, we entered the EPP market. We created our cloud and virtual form factors. We continued to adapt our behavioral engines to improve our detection efficacy and we increased our coverage beyond Windows to include both Linux and Apple's OS X operating system. We were able to get a lot of endpoint security feature shipped last year and I want to discuss the impact some of them had. FireEye entered the endpoint protection market at the end of the third quarter, when we added signature-based network detection and prevention features to our EDR features and only a single full quarter of availability, we saw more than 35% of our active customers turn on our endpoint AV capability. And FireEye’s endpoint solution is much more than just an endpoint prevention platform we consolidate functions in the areas of EPP and the ER space and we offer solution that is designed to first detect what signature based anti-virus detects. Second detect what anti-virus misses, which unique behavioral based engines. And third we want to enable security experts to perform forensics at scale with our best-in-class EDR capabilities. On June 14 of 2017, we made our cloud form factor for FireEye’s endpoint security available. In just two quarters given its ease of deployment, sales of our cloud form factor over to those of our on premises form factor. In Q4 over 80% of our new endpoint customers chose our cloud form factor for deployment. This was the first quarter, our cloud endpoint security deployments were higher than our appliance base deployments and we expect this trend will continue. During Q4, FireEye continue to protect its customers with behavioral based futures such as exploit guard. The South Korean computer response team recently published an alert about an Adobe Flash zero exploit and this zero to exploit had not been seen in the wild before and it was deployed by North Korean threat actors or it's believed have been deployed by North Korean threat actors since mid November 2017. And it's not unusual, but I just wanted to use as an example. FireEye’s endpoint security stop this of Q&A on security stop this attack with our behavior based prevention without ever seeing it before. On February 15 of 2017, we made our OFX endpoint agent generally available. Within weeks we're detecting attacks in the wild while also providing the forensic capabilities our consultants and customers need to investigate incidents similarly or Linux agent was generally available to our customers near the end of last June bringing our EDR capabilities to yet another platform. In Q4 we saw strong growth in our cloud based email protection product or ETP as well as well as better than expected performance in our appliance based email product. Our advance malicious URL detection engine continues to improve in efficacy as we tune our machine learning models. As an example over the last three weeks, even though our e-mail security products are often deployed behind a secure email gateway solution, we looked at over 70 billion URLs and down selected to analyze over 450 million URLs contained within the emails to our customers. We alerted our 1.45 million malicious links and our email security solutions performed with a false positive rate of only four URLs, that's four, not 4%. FireEye products have always had the reputation of providing high fidelity alerts and our machine learning models are helping to contribute to and up hold that reputation. We are also making progress integrating broader security mail gateway capabilities into our email security solutions, specifically we are improving our anti-virus and anti-spam capabilities, our content analysis capabilities and our ability to prevent business email compromises when attackers masquerade as the CEO or CFO or other positions to exploit trust, which is a very common a fact factor today. With these broader features, we are transitioning our email security from a second layer of defense to a primary secure email gateway. And network security, our innovation over the past year has increased our detection efficacy, we've introduced new cloud and virtual form factors and we expanded the potential uses for NX. We continue to detect and prevent threats and exploit that other vendors miss and we make our customers security operations more efficient by delivering actionable, high fidelity alerts, network endpoint correlation of threat data and forensic data capture. Perhaps the most significant new innovation for NX is smart vision, which detection box attacks and internal, east west network traffic, including a tax related to the propagation of ransomware and smart vision opens up yet another growth opportunity for FireEye. Now as you can see we are innovating at FireEye. For the first time we have cloud on premise and virtual versions of all our spoke products. We continue to add legacy features to pursue market share while constantly adding new innovation for future markets and future opportunities. We can continue to deliver our intelligence led advance allusions to security mature enterprises. And we compete in a more price sensitive mid-market while offering compelling economics for our channel partners. Our innovation allows us to simplify our go-to-market strategies on multiple fronts including pricing, packaging, and messaging. Our new Chief Marketing Officer, Vasu Jakkal and her team our leisure focused on simplifying our messaging and getting the FireEye story out to our customers partners and our prospects. I believe their initiatives are already producing results and we're just getting started. We previewed many of our new marketing initiatives that are momentum sales and partner event a few weeks ago and we are looking forward to sharing more details that are upcoming Analyst Day on March 1. Looking back over the past year we continue to operate efficiently and we return to growth. I'm very encouraged by the progress we have made. In FireEye’s entering 2018 with the strongest alignment I have witnessed amongst our team. We are aligned in our mission to relentlessly protect our customers. We are aligned in our vision of continuous innovation driven by the lessons in the intelligence we gather on the front lines. And we are aligned in our commitment to build our company for the long-term with growth and profitability. I’ll now turn the call over to Frank for a view of our detailed Q4 financial results and our Q1 in 2018 outlook. Frank?

[Frank Verdecanna:]

Thanks, Kevin. Q4 was a great quarter for us across all our metrics. We exceeded all of our key guidance ranges for the quarter achieved 9% year-over-year billings growth and posted positive net income on a non-GAAP basis for the first time in our history. We also delivered positive operating and free cash flow for the quarter and positive operating cash flow for the full-year. These are major milestones for the Company and demonstrate our significant progress over the last year. Sales growth was diversified across our entire portfolio with every major product group and region posting sequential in the earlier growth. We had a record number of million dollar plus transactions and our commercial business was up more than 90% from a year-ago and our channel metrics improved as well. During my prepared comments I will discuss additional details on our Q4 results as well as our outlook for Q1 and all of 2018.We are reporting Q4 and full-year 2017 results under ASC 605. However, our guidance for Q1 and the full-year 2018 is based on the new 606 standard which we adopted on January 1 of this year. Additionally, I want to remind you that will be referring to non-GAAP measures when discussing gross margin, expenses, operating income, and EPS. Our non-GAAP measures exclude stock-based compensation, amortization of intangibles, non-cash interest expense on a convertible debt, acquisition expenses and other non-recurring items. Let's jump into the details of our Q4 results. Billings of $242.2 million increase 9% from Q4 2016 and we're $22 million or 10% above the midpoint of our Q4 guidance range. These results reflect improved sales execution under Bill Robbins and his leadership team as well as record Mandiant billings and growing momentum for Helix, iSIGHT Intelligence and Endpoint. Improve sales execution is immediately evident when you look at our large scale metrics. We booked a record 52 transactions greater than $1 million plus two transactions greater than $5 million. One of these $5 million plus transactions was with an entirely new customer. This compares to 34 transactions greater than $1 million last year with three transactions greater than $5 million all three with existing customers. All but four of the $52 million transactions in Q4 2017 included multiple products and half of these included four or more product families. Notably, after just three, four quarters of availability Helix contributed meaningful dollar uplift in more than 20% of the deals. Strong results for iSIGHT, Helix, ETP and TAP recorded – resulted in record products subscription billings of $117 million. The mix within product subscriptions continues to shift to our strategic cloud subscription offerings which accounted for approximately 60% of product subscriptions. Overall, the recurring components subscriptions and support accounted for 67% of total Q4 Billings. The average contract length was 24 months consistent with our expectation and recent trends as we discussed last quarter. Product billings of $39.4 million were above our expectations in Q4 growing 18% from Q4 2016 as we continue to execute on the NX refresh opportunity and gain momentum in the international regions. This is the first quarter since Q3 2015 that product billings have grown year-over-year. Last quarter, I said there were several indicators that the detail metrics were suggesting we are starting to build momentum in our business and these indicators continue to improve in Q4. We added 298 new logo customers in the quarter, up from 234 in Q3. This was the third sequential quarter this metric has increased. Transaction velocity also increased with total transactions up over 20% year-over-year as our existing customers continue to renew and expand their deployments of FireEye solutions. The number of customers purchasing multiple products continue to increase as did the average number of products for active customers. Our renewal rate which represents our customer retention rate remained consistent with the first three quarters of 2017 at approximately 90%. The dollar-based yield remained above 100% on a rolling four quarters basis, reflecting strong cross-sell and up-sell. Translating billings into revenue to strengthen appliance sales which under ASC 605 are recognized upfront help drive record revenue in Q4 and we broke the $200 million mark for the first time ever. The recurring component of our revenue which includes product subscriptions and support increased 10% year-over-year to $130 million. Recurring subscriptions and support accounted for 64% of revenue compared to just 46% of revenue two years ago in the fourth quarter of 2015. Our strong performance on the topline was accompanied by continued discipline on the cost and expense lines and we translated our strong billings and revenue result to the bottom line. This resulted in positive operating income of $2.9 million, positive net income of $1.3 million, and operating cash flow of $33.6 six million. Operating cash flow was reduced by net payment of $12.5 million to sell our patent litigation. Looking at the income statement on a more detailed level. Gross margins improved on both a sequential and year-over-year basis. Product gross margin increased by more than 4 percentage points from a year ago, reflecting both the higher volume of product sales and cost efficiencies associated with their fifth generation appliances. Subscription and services gross margin was consistent with Q4 2016. Total operating expenses of $149 million increased $10 million or about 7% from Q4 2016. The year-over-year increase was due to higher sales and marketing expenses which increased $13.3 million compared to Q4 2016. Remember that in Q4 2016, we reversed approximately $12 million in accrued commission expenses which had the effect of reducing Q4 2016 sales and marketing expenses. On a sequential basis, total operating expenses increased by just 3% or $4.5 million due primarily to higher commissions expenses on higher billings. This was partially offset by seasonally declined in R&D and G&A as expenses for employee-related taxes declined. We ended the year with just under 3,000 employees compared to about 2,900 employees at the end of last year. For the year, operating expenses were $576 million, a decrease of more than $94 million from 2016, reflecting the work we've done to right size our cost structure and our investments with the market opportunity. We expect our current level of operating expense to be sufficient to support the growth and profitability throughout 2018. We continue to maintain a very healthy balance sheet as we ended the quarter with $897 million in cash and short-term investments, an increase of $18 million sequentially. We added approximately $40 million in deferred revenue compared to the end of Q3 2017, primarily in current subscriptions and services reflecting the growth we saw in Helix, FireEye-as-a-Service, ETP, and iSIGHT Intelligence. Current deferred subscription and services are up almost $46 million from the end of 2016, an increase of 12% year-over-year. Non-current deferred revenue declined by almost $29 million as the average contract length has declined. Based on what we know today, I believe we will see the average contract length for subscriptions and support remain in the 20 to 24-month range for 2018 with some variability due to seasonality. Accounts receivable increased by $20 million from the end of Q3 and higher billings and dates outstanding calculate on billings decrease to 53 days from 55 days. Our target range for this metric remains 50 to 60 days. With strong billings and strong collections, we generate $33.6 million in operating cash flow and fifteen point $15.7 million in free cash flow for the fourth quarter. Q4 operating cash on free cash flow reduced by non-recurring that payment of $12.5 million for legal settlement costs. Executing this payment, our operating cash flow would have been $46 million for Q4 and approximately $30 million for the full-year exceeding our guidance range of $1 million to $10 million. Those are the highlights of our Q4 financial performance reported under ASC 605. We adopted ASC 606 on January 1 and we are guiding to Q1 2018 in the full-year 2018 under the new accounting standard. At a high level of the biggest changes under 606 for FireEye R1, revenue from appliances will be recognized ratably typically over four years. Revenue from the related attaches subscriptions and support will continue to be recognized ratably over the contract. The only exceptions are for the PX network friends except clients and our CMS management appliances, because these appliances do not rely on our dynamic threat intelligence subscription, revenue from the sales of these products will continue to be recognized upfront, along with the revenue from tech fees and FireEye Security Orchestrator, which are considered term licenses. In 2016 and 2017 these products combined averaged about 20% of our products, billings, and revenue with dollar contributions ranging from a low of about $5 million to a high of about $10 million per quarter. Please note that based on the guidance under 606 our DTI. Enabled appliances and related subscription support contracts are considered a single performance obligation and must therefore be reported as a single unit of accounting. This means we will be recasting the supplemental metrics for billings and revenue into three categories instead of the current four. The three new categories will be one, product and related subscriptions and support. Two, cloud subscriptions and managed services, and three professional services. Slide 525 maps the changes for you and we'll provide more detail when we file our 10-K. The new categories will give you visibility into the billings and revenue associated with our cloud base subscription including iSIGHT intelligence, Helix, ETP, fire and FireEye-as-a-Service. Revenue from these subscriptions we reckon as ratably over the contract term, the same as it was under ASC 605. Because of the transition to our subscription product is such an important part of the story. We will be introducing some ARR related metrics at our Analyst Day to give you greater visibility into the trends driving this growth segment of our business. From an expense perspective, product cogs will be deferred and recognize over the as over the same term as the appliances. Sales commissions will be deferred and recognized ratably as well creating a better match between revenue and the related expenses. We are adopting ASC 606 on a full retrospective basis, which means we'll recast our full 2016 and 2017 years as well as our quarterly 2017 results under 606, so you'll be able evaluate our performance on an apples-to-apples basis going forward. As you can see from the high level comparison of our operating results under 605 and 606 for 2016 and 2017, the actual impact on our operating results is minimal. Our preliminary analysis shows 606 adoptions has small negative impact on 2016 operating margin and a small positive impact on 2017 operating margin, even though the revenue increased. Historical billings changed slightly due primarily to different treatments for contracts that renew early under 605 and 605. Implementing 606 has been tremendous effort for the financing and accounting teams that I want to thank those folks for an incredible work they've done getting us to this finish line. We will be including full recount financial results in our 10-K, which we are planning to file near the end of February. We will also host a conference call at that time to walk you through all the details and answer any questions on the adjusted results. We will let you know on the exact data value. Okay, with that as context for 2018, we expect billings in the range of $810 million to $830 million. From a linearity perspective, we expect to generate 40% to 45% of the billings in the first half of 2018 and 55% to 60% in the second half of the year. We expect 2018 revenue in the range of $815 million to $825 million which includes approximate $20 million in additional revenue due to the adoption of 606. Based on the billings in revenue outlook we expect to generate positive non-GAAP operating income of between 1% and 2% for the year and operating cash flow of $45 million to $55 million. We expect total capital expenditures of approximately $35 million to$ 40 million, which includes approximately $12 million on expenditures for the move of our headquarters to newbuilding in January 2018. We had originally expected to incur all CapEx associated with the move in 2017, but because we did not move into earlier this year about half that CapEx will fall into 2018. For the first quarter of 2018 we expect Billings in the range of $165 million to $175 million. We expect Q1 revenue in the range of $192 million to $197 million which reflects an increase of $5 million to $7 million due to the adoption of 606 compared to what our revenue forecast would have been under 605. We expect operating margin to be in the range of negative 2% to negative 4% reflecting the seasonal decrease in revenue and a modest seasonal increase in operating expenses and as employee related taxes kick in for 2018. Using a weighted average share count of $186 million, we expect the loss per share to be between $0.03 and $0.06. Note that the share count excludes the impact of stock options in RSU’s as well. Our shares associated with the convertible notes because they are anti diluted when the net income is negative. That's it for my prepared remarks. Before I turn the call back over the operator to begin our Q&A. I wanted to remind you to join us for our 2018 Analyst Day on March 1 at the NASDAQ Entrepreneurial Center in San Francisco. That I'll turn the call back over the operator for Q&A.

[Operator:]

[Operator Instructions] Our first question comes from the line Ken Talanian from Evercore ISI. Your question please.

[Ken Talanian:]

Hi, guys, thanks for taking the question. So I was wondering what assumptions around the NX refresh are factored into here fiscal 2018 billings guidance. What kind of visibility do you into that pipeline?

[Kevin Mandia:]

So Ken, we expect to continue to execute on the refresh opportunity as we did all of 2017. I think as we enter 2018 we now have the fifth generation appliances out for full quarter. So we're a little bit more bullish on our ability to refresh those appliances and continue the strong renewal rates.

[Ken Talanian:]

Okay. Great thanks very much.

[Kevin Mandia:]

Thanks Ken.

[Operator:]

Thank you. Our next question comes from the line of Andrew Nowinski from Piper Jaffray. Your question please.

[Andrew Nowinski:]

Yes, thanks for my talking and nice quarter. And I know you guys talked this before this before but given the strong product revenue results we saw this quarter are you seeing more customers refreshing to an appliance form factor versus your Virtual Solutions?

[Frank Verdecanna:]

In Q4, we actually had a significant amount of folks actually opting for our cloud solutions, but we still did have a really good flow of refresh appliances as well. So I would say you know both the cloud deployments picked up but we also did have you know a fair amount of folks actually refreshed their hardware.

[Andrew Nowinski:]

Okay. And then just the fall on U.S. that's I know it's not typically a strong quarter in Q4 for U.S. said demand, but just wondering if you could provide any colors to what the Fed had impact this quarter. Thanks.

[Frank Verdecanna:]

Ye, I think Fed actually had a really good quarter in the fourth quarter and we had talked about two deals greater than $5 million both of those were actually in the Fed space.

[Andrew Nowinski:]

Got it. Thanks guys.

[Kevin Mandia:]

Thank you.

[Operator:]

Thank you. Our next question comes from the line as Sterling Auty from JPMorgan. Your question please.

[Sterling Auty:]

Hi, thanks guys. I hate to do this to you but I want to continue the refresh line of questioning. There was a big refreshing the fourth quarter in terms of expectations through the channel. What does that look like in the first half of 2018 does it continue at or even above that pace or did any of that kind of renew early?

[Frank Verdecanna:]

Well, Q4 is always a strong hardware refresh quarter because there's a lot of people actually doing some leveled budget flash, but when we look at our Q1 and Q2 pipeline you know we still we see a fair amount of product sales and you know we expect the refresh operated opportunity continue to be executed really well.

[Sterling Auty:]

Okay. And Frank, you are absolutely right, the 606 transaction result has a lot of work and I really like the way that you laid it on the slides. That's really helpful for us. Can you remind us what the full retrospective change you mentioned you're going to recast the financials in the 10-K, is that all three financial statements full restatement or is it just kind of highlights just so we can anticipate how we're going to change our models?

[Frank Verdecanna:]

It's just really the P&L.

[Sterling Auty:]

Okay. And then last question, Kevin you talked about the three P's into the channel, it’s great to hear you guys really focused on the channel. Are you finding that the channel partners that are really heavily engaging with you at this point based on the products and the product kind of roadmap are different than what you saw a year or two ago? Or is it same people they’re just invigorated by kind of the roadmap?

[Kevin Mandia:]

I don't know how much specificity I can get into on that, but I routinely meet with our channel partners and I think there's a lot of folks who have stuck with us for many years and I think we're seeing just the increased performance Sterling because we got the pricing and we got the endpoint product to me is our most channel ready product and we got that out to market at the end of Q3. So I think we're – and another thing is just consistently following the process with our partners and the channel a little bit less direct and a lot more teamwork.

[Sterling Auty:]

Got it. Thank you.

[Operator:]

Thank you. Our next question comes from the line of Gregg Moskowitz from Cowen and Company. Your question please.

[Gregg Moskowitz:]

Okay. Thank you very much. Congratulations guys on a really good Q4. Endpoint sounded clearly from your comments, Kevin, as though there was a fairly meaningful uptick and just kind of wondering how much of your next gen endpoint traction so to speak is replaced as opposed to being deployed in parallel if you happen to have that visibility.

[Kevin Mandia:]

Yes. So couple quick comments you gave me, you opened the door, Gregg, I'll talk a lot even more about endpoint. One of the amazing vantages we have as a company as we have over 300 services professionals that are using our technology every single day and a lot of that technology isn't generally available to our customers yet. They get the benefit of it through our consultants. So that's one of the reasons why endpoint can innovate as fast as they can as we've got folks on the front lines of the cyber battle field every day using our next gen version, written by real engineers if not consulting. So you'll see – we did a lot of innovation in 2017. I anticipate that pace will continue in 2018 and the endpoint that we had in 2017 will be just far better by the end of 2018. So we continue to improve it because we can do things other product companies can't, roll out, prototypes, learn from the market months before you can GA something, so our endpoint is going to have a lot of changes in the near-term and I'm excited about it. In regards to rip and replace, I put on my consulting cap. When you're in a huge environment a lot of folks will run the endpoint in parallel. We have the EDR capabilities, the frenzy capabilities and we're kind of the endpoint behind a lot of other people’s endpoints, so when the breaches occur and investigation needs to take place, we have only just added the ability to go into that legacy spot and I just think it's too soon to tell. But I think we will see that pattern or maybe over time. I know couple instances where it happened, but it's too early to say we got a pattern. But right now, what I've observed on the front lines is most customers are running legacy and the new endpoint technology side by side.

[Gregg Moskowitz:]

Okay. That’s very helpful Kevin. And then just getting back to the Helix, have you decided how pervasive you plan for it to be across your installed base, meaning FireEye customers that renews a regular maintenance or subscription contract, get the new UI automatically. How are you sort of thinking about adoption going forward?

[Kevin Mandia:]

Well from an adoption standpoint, Frank can talk about how we monetize and we're going to go in a lot more detail to on March 1, but I wanted to be the interface for all our products and that's were we aimed towards. We have an e-mail security platform. We have – not platform, but we have e-mail security spoke, endpoint security spoke, and network security spoke and all those need to come together. It can't be 11 interfaces, it can't be eight, it needs to be one, it needs to be Helix. And we're working hard towards that. All our software does the same things, bought bad stuff or detect bad stuff and help you go from alert to fix as fast as possible. So I think over the next few quarters, we are going to start looking at Helix as being a part of all the spoke sales.

[Gregg Moskowitz:]

Great. Thanks very much.

[Frank Verdecanna:]

Thanks Gregg.

[Operator:]

Thank you. Our next question comes from the line of Shaul Eyal from Oppenheimer. Your question please.

[Shaul Eyal:]

Thank you. Hi. Good afternoon, guys. Congrats on the quarter as well as the 2018 outlook. Kevin, so great performance in the EMEA region this quarter. Do you think or do you see GDPR this quarter as we start thinking about the first half of 2018 have some sort of a driver behind this that improved performance?

[Kevin Mandia:]

No, I don't I think leadership. We brought in Kevin Taylor and he's brought on some folks and we just – we have better consistency and better productivity and Bill Robbins and his experience being a leader of global sales at numerous organizations. We're just better at it, so that that's how I see it. This is sales performance.

[Shaul Eyal:]

Got it and I might have miss that, recall that in prior quarters we did provide some metrics, I think new Helix related, new customer. Did you provided earlier this in the call?

[Kevin Mandia:]

Yes, in Q4 we added 160 new adopters of Helix and the prior quarter I believe we had 57 in Q3. And we started really – I think we had a few deals, the last day Q1, is that right Frank?

[Frank Verdecanna:]

Yes, four deals.

[Kevin Mandia:]

Like only four. I don’t remember Q2, the 10 in Q2, so goes 10 [indiscernible]. Correct, yes, 4 10, 57…

[Shaul Eyal:]

57, good numbers. Thank you so much. Appreciate it.

[Operator:]

Thank you. Your next question comes from the line of Melissa Franchi from Morgan Stanley, your question please.

[Melissa Franchi:]

Thank you. I just wanted to delve into the product's description right around that, I saw some growth this quarter and there's a lot of items that are in there, you talked about some of those components and I'm just wondering Kevin if you could maybe just talk about what's the most meaningful contributor to growth right now in product descriptions? And what do you think has in most area for upside in 2018?

[Frank Verdecanna:]

This is Frank. I think a couple of big drivers there is we talked about having a record endpoint quarter and surprising this was the first quarter that we saw a cloud endpoint over take on premise endpoint by quite a bit amount. So that was a big driver on the product subscription line as well as a record, iSIGHT intelligence quarter as well, and so that was a big driver. ETP had a great quarter as well as Fire-as-a-Service. So I think it was really kind of across the product subscription portfolio.

[Kate Patterson:]

Next question please.

[Operator:]

Thank you. Our next question comes from the line of Gabriela Borges from Goldman Sachs, your question please.

[Gabriela Borges:]

Good afternoon and thanks for taking my question. The Helix customer additions, the 116 number, I'm assuming that includes folks upgraded to NFA as we as folks that board across the platform, across multiple starts. Can you give us a sense of what the composition of those new customers look like? Is the interface driving towards other product that we expected? Thanks.

[Frank Verdecanna:]

Hey, Gabriela, one of the things that I talked about in my prepared remarks were of the greater than $1 million deals, 20% of those 52 deals, actually had Helix contribute doing a significant dollar amount to them. So I think what we're seeing is our large platform buys from our customers, people are including Helix in that as well and then also drove the number of customers that continue to buy multiple products. So I think we're seeing that pull through from kind of the initial early Helix customers and it's playing out how it as we had kind of hoped and then I think we're seeing a lot more of the platform deals include Helix as well.

[Kevin Mandia:]

Yes, and Gabriela this is Kevin speaking. I see a correlation I think we will get more empirical data around between the purchase of FaaS and Helix as well, where it seems like folks who are saying, hey listen take care of the security problem for me. Look to have those do that with the Helix platform as well as our people. And so I think there's a correlation there. We'll see emerge over the next few quarters.

[Gabriela Borges:]

Okay, great. That’s helpful. And follow-up to Kevin, on your comment being able to address the primary way of email security, I would think that maybe that opens up any opportunities for you, may be a little more discussion around that and is the secondary layer that you’ve already been doing technically little bit harder than doing the first layer?

[Kevin Mandia:]

Yes, if you look at our spoke products, I always like saying that the best line of defense, but their second line of defense you'll have something before NX product or NX detects with the first layer misses, our email security products is behind a security email gateway and we detect with they miss, our endpoint was EDR and we investigated with someone else missed and for each one of our products, we're looking for ways to get into the adjacencies that are part of layer one. So we did a acquisition I believe it was in Q4. Time flies, I'm trying to remember when we did and I'm looking around the room for nods, but Q4 we did an acquisition of combat more what I call the e-mail hygiene, the antivirus, the anti-spam, the archiving, the data leakage prevention type things that you find in a security email gateway that we didn't have years ago somebody called us the firewall helper and I'd say that's right. We have to detect all the things the firewalls miss. We have been with the security mall gateways, but I think we move into the adjacencies of doing some of the blocking and tackling legacy features that they do, And that's what I meant by that comment is we went as the second layer of defense now we want to kind of start working our way into the primary layer of defense.

[Gabriela Borges:]

That’s helpful. Thank you.

[Frank Verdecanna:]

Yes.

[Kevin Mandia:]

Thank you.

[Operator:]

Thank you. Our next question comes from the line of Michael Turits from Raymond James. Your question please.

[Michael Turits:]

Hey, guys. Two questions. One, it seems of the feedback from the shelf a while has been that they're a little bit unclear about exactly what FireEye’s becoming what the breadth of your products are versus what’s you have been in terms of your originally price. Is that changed because it seems that you're being in terms of how you gone about messaging because it seems that you're being much more successful we wonder that has to do with marketing.

[Kevin Mandia:]

Yes, this is Kevin speaking. I mean we've been saying for quite a while, we want to simplify or go-to-market our pricing our packaging our positioning and we've done a great job on that I left out the details on this caucusing want to hijack the call with what we're doing there nets what we're going to be doing on March 1st is laying it out. But the highest of all abstraction we have an email security product. We have an Endpoint security; we have net security, all being down together by the hub call Helix. And that sounds a heck of a lot easier to me then NX, EX, IX, PX Ajax blank name NX I think ran out of the alphabet. So we're going to get more detail on that but I can assure you we are simplifying how we package, we are absolutely simplifying the whole dialog about FireEye and we’re just getting started and I think it's going to pay dividends throughout the year.

[Michael Turits:]

And second question could you just clarify where exactly Helix is being bundled in and has a free product exactly where you're monetizing it?

[Frank Verdecanna:]

So any new customer that adopting Helix is being monetized there some renewals where we are including Helix as the user interface. But I think you can expect Helix going forward to pretty much be monetized in all cases we're just going to have it be part of you know basically the user interface for every new spokes sale and we're going to bundle it in with renewals that but it will have a price and specially new customers adopting Helix there's absolutely a price of the products subscription.

[Michael Turits:]

Okay. Thanks Frank. Thanks Kevin.

[Kevin Mandia:]

Thanks Mike.

[Frank Verdecanna:]

Thank you.

[Operator:]

Thank you. Our next question comes from the line of Gur Talpaz from Stifel. Your question Please.

[Gur Talpaz:]

Great. Thanks for taking my questions. So Kevin first half congrats on a nice quarter. I want to start up asking about the macro picture from my vantage point it looks like there is a shift here in the national data attacker environment or leasing than what you're talking about in news. Okay talk about what you seen from a threat perspective out there and if that having any sort of effect in the business?

[Kevin Mandia:]

Yes, so you know third investment in quarter in a row it shows a trend and that trend is we're busy. And so there is some changes and I have so many different ways to answer that but in regard to the threat landscape or see new countries emerge we're probably going to kind of devote some of that in the upcoming weeks. And I just believe that if you have been you know at the impact just going up and that's just the way it is right now. So that's kind of the landscape in every geography and we're just getting more visibility into the international landscape we did a lot every year we're doing a lot more breaches internationally and learning from that. But in different regions there's different hot zones and different adversaries but we're busier than ever in that regard.

[Gur Talpaz:]

That’s helpful. And then in terms of specific product I talk a lot about end point here? Would you attribute the success you saw in the quarter to legacy EDR customers upgrading to the new more complete solution to Endpoint 4.0 or actually seeing greater traction here with net new customers as well? And if it is indeed the latter. What are you doing to differentiate yourself there from the myriad of other you know Endpoint solutions out there in a marketplace?

[Kevin Mandia:]

So yes first of both I'm pretty sure it's only see we've got a lot of net new in a lot of folks kind of upgrading to it. The differentiation first off you're now on it I mean obviously there's a need on the Endpoint to detected AV misses in the legacy products are being assaulted by dozens of new Endpoint companies. But we've been in this business a long time. I member at Mandiant starting to work on our Endpoint technology in 2005. So we've got well over decade working on this. And then we have the privilege of being trusted to respond when the Endpoint Technologies fail. So I feel very confident of what the market needs are there. You got to detect what AV detect, you need to detect what AV misses and you need to scale experts and front indicators to go search. And there's not a lot of endpoint tech that can do all of that, but ours can. So I think that's why we're seeing the success of it and we're going to keep building on that success.

[Frank Verdecanna:]

And Gur existing customers that upgrade to the EPP portion of our product don't actually have to pay for that. So the new dollars and billings is really driven by new endpoint customers within our existing customer base and new customers overall too far right.

[Gur Talpaz:]

Got it. That's very helpful. Thanks guys.

[Kevin Mandia:]

Thank you.

[Operator:]

Thank you. Our next question comes from the line of Walter Pritchard from Citi. Your question please.

[Walter Pritchard:]

Hi. Thanks. Kevin, I’m wondering there was a Bloomberg article, it hit right between the time you reported and you help us call here and it was – I guess, started out talking about a lot of people interested in the company, and I didn't know sometimes these are misquotes, but they seem to lead with that and it sounds like and that was the quote you gave. I just wondered if you could characterize what the situation is there and had a follow-up.

[Kevin Mandia:]

So I haven't seen that article, so I don't know if I can comment on whatever quotes are said in that article specifically. I can just tell you, we’re heads down trying to execute a company, I mean that's what we're doing. So I don't know what the quote is, I don’t know what the article is, so sorry Walter I couldn't comment.

[Walter Pritchard:]

Okay. They let off with that quote. You might want to check it out. And then just, you literally said a lot of that, there is a lot of people interested in us and then they followed up with what you just mentioned there that your heads down executing. So sorry, you can answer the second part. Just for Frank on – as we think about this sort of substitution of subscription for product and I know that's been a – at times there's been a trend there, could you talk about what you – you've quantified I think a way long ago, but I'm wondering if you could look into 2018, is that sort of stabilize, you're not really seeing a headwind from people looking at FireEye-as-a-Service or spending budget on some of your subscription base products versus the stuff that's recognized upfront. Just trying to – so a lot of moving pieces in the 2018 guidance, I think you quantified the 606 pretty well, but wondering on that other factor?

[Frank Verdecanna:]

Yes. Absolutely Walter, I think if you look at 2017, we did have that product headwind really throughout the year except for in Q4 where we actually saw year-over-year growth on product billings. So I think we got to a point where it moderated, that headwind moderated. Now people still maybe moving to the cloud faster and so I think you're still going to see more significant push on the product subscription than on the product line by itself. But I think the important thing is at the end of day, we're still getting the dollars, they're just shifting to product subscriptions which are reoccurring in nature. So I think it helps our overall model going forward.

[Walter Pritchard:]

Okay, great. Thank you very much.

[Operator:]

Thank you. Our next question comes from the line of Fatima Boolani from UBS. Your question please.

[Fatima Boolani:]

Good afternoon. Thank you for taking the question. Maybe the first one for Kevin. Kevin, the competitive landscape is certainly a lot different for you today than it was five years ago – two years ago. And can you just help us level setting and to characterize what type take off you are participating in today given that portfolio have seen so much evolution and then growth in the last few years?

[Kevin Mandia:]

Yes. So a lot of ways Fatima to answer that, but it depends on what we are doing. When we have an e-mail opportunity, it might be against some companies maybe have the network-based security opportunity might against others and then when we have the endpoint that’s against the third collection of folks. So what we look at is for the buyers in the enterprise who are looking to consolidate from dozens and dozens of vendors down to fewer, I think that's our sweet spot. It's either grew all this together with 85 different purchases of the small companies or you try to go to a few folks that can do the job and just manage fewer vendors. By the way your question great question, I could spend an hour on it and maybe will get a chance to do that someday, but the bake off specifically it's dependent on the opportunity and the buyer and sometimes the industry. The good news is when there's an incident there's really not a bake off. That's one business I've been in where few have got a house on fire, call fire departments, same thing here so and that the services for the most part, I don't see a bake off environment.

[Fatima Boolani:]

Fair enough. And a quick follow-up for Frank. Frank last year you put some parameters around the inputs you expected to help you drive towards growth in the fourth quarter and then you called out the renewal savings and endpoint traction. I am wondering if you can sort of provide a similar view on 2018 as simply put, what's going into your guidance? And what could help your guidance achieve and have growth outperform into the low teens and that's it for me. Thank you.

[Kevin Mandia:]

Sure. That question is really kind of what drove the out performance in Q4. So if you look at pretty much all year that the endpoint of the refresh opportunity and Helix were going to be the big growth drivers of the year and really get us back to growth in Q4. And the things that is going to continue to drive growth in 2018 and that could drive our performance on top of our guidance really is Helix endpoint and the refresh opportunity. Again we don't need to knock not on park in all three of those, but those are going to be the major drivers for us.

[Operator:]

Thank you. Our next question comes from a line of Anne Meisner of Susquehanna, your question please.

[Anne Meisner:]

Yes, hi thanks for taking my question. First one is for Frank. The ARR metric that you referred to that you will provide at the Analyst Day. I just want to clarify, are these metrics that you in 10-Q provide in an ongoing basis because I assume with the new GAAP revenue disclosure, it might be tricky for us to get to the recurring revenue number alone. So I’m wondering if that's going to be an ongoing metric.

[Frank Verdecanna:]

Exactly Anne, so we will introduce a couple new metrics at Analyst Day and those will be ones that will continue to update you on quarterly.

[Anne Meisner:]

Okay, great. And will that ARR number be broken out between product subscription and maintenance?

[Frank Verdecanna:]

We’ll probably put all the recurring line items in that one subscription.

[Anne Meisner:]

Got it, okay. And then a quick question for Kevin. I was hoping we could get an update on the customer reaction to the SmartVision feature for NX and whether you're seeing actually new purchases of NX that are specifically targeting that east west traffic use case.

[Frank Verdecanna:]

Yes, I can only comment to our internal consultant reaction to with the folks that have worked on it. So I think it’s too soon for me I've heard a customer reaction to it.

[Kevin Mandia:]

Yes, I think when we talk to the field and we talk to customers, the sales team really just got brought up to speed on it recently and I think they are introducing in it and we expect that's going to be one driver on the NX side. But I think people are generally pretty positive on it.

[Anne Meisner:]

Okay, great, thank you.

[Operator:]

Thank you. Our next question comes from the line of Saket Kalia from Barclays, your question please.

[Saket Kalia:]

Hey guys, thanks. Thanks for taking my question. I'll just keep it to one, just in the interest of time. Frank, maybe for you, we're lapping that duration headwind that we had in 2017 on product subscription and maintenance of course can you maybe remind us how you're thinking about the duration on billing in 2018? And how much have you stress tested that assumption based on the mix because as you know I mean customer offs for MVX in the cloud versus maybe appliance with an attached subscription maybe those could have different kind of duration of occasions. How do you kind of thought about that duration and have you stress test between across those makes us?

[Frank Verdecanna:]

Sure. Yes, if we look at the full-year 2016, the average contract length was 27 months; if you look at it for 2017 it was 24 months. So that's why we were expecting the quarter's throughout 2018 and the full-year to land in the 20 to 24-month range. So I think we could still see a couple months headwind from the year-over-year look backs. But we feel pretty confident that’s going to be in that range and that's just because if we take a look at all the products in all our cloud products, they are all kind of following in that range. And so we're not seeing any one type of subscription drive a significantly lower contract term.

[Saket Kalia:]

Got it. That's very helpful. Thanks.

[Kate Patterson:]

Take one more question please.

[Operator:]

Certainly, our final question comes from the line of Gray Powell from Deutsche Bank, your question please.

[Gray Powell:]

Okay, thanks for waking me in. I’ll make it a quick one. So you highlighted the $20 million benefit to revenue in 2018 with 606, I just want to make sure – I want to make sure I have a correctly. I assume that's all hitting the product line? And then did you say anything about how we should think on the mix between product and subscription revenue in 2018? Thanks.

[Kevin Mandia:]

Thanks Gray. Yes, we didn't comment on the breakup. But we did talk about how revenue will be recast between those three categories and so the impact of the $20 million will hit on the product and product related subscriptions and support line. End of Q&A

[Operator:]

Thank you. This does conclude the question-and-answer session of today's program. I'd like to hand the program back to Kevin for any further remarks.

[Kevin Mandia:]

Now I'd like to thank everybody for making the time to join us on this call and reiterate. We're really excited about 2018, but the biggest thing I'm most proud of is looking at the last six quarters how we did a balanced of our growth and profitability and we did what we said we would do in February of 2017. We said we'd get the non-GAAP profitability and we get it. So I thank the whole team here at Fire and I think everyone on this call for their interest.

[Operator:]

Thank you, ladies and gentlemen for your participation in today's conference. This does conclude the program. You may now disconnect. Good day.