Mandiant, Inc.
Q1 2016 Earnings Call Transcript

Published: 6 May 2016

[Operator:]

Good day, everyone, and welcome to the FireEye First Quarter 2016 Earnings Results Conference Call. This call is being recorded. With us today from the company is Chairman and Chief Executive Officer, Dave DeWalt; Chief Financial Officer, Mike Berry; and Vice President of Investor Relations, Kate Patterson. At this time, I would like to turn the call over to Kate Patterson. Please go ahead.

[Kate Patterson:]

Thank you, Candice. Good afternoon, everyone, and thank you for joining us on today's conference call to discuss FireEye's financial results for the first quarter of 2016. This call is being broadcast live over the Internet and can be accessed on the Investor Relations section of FireEye's website at investors.fireeye.com. With me on today's call are Dave DeWalt, FireEye's Chairman of the Board and Chief Executive Officer; Mike Berry, Executive Vice President and Chief Financial Officer of FireEye; and Kevin Mandia, FireEye's President. After the market closed, FireEye issued a press release announcing the results for the first quarter of 2016. Before we begin, let me remind you that FireEye's management will make forward-looking statements during the course of this call, including statements relating to FireEye's management succession; FireEye's guidance and expectations for the second quarter of 2016 and the full year 2016; FireEye's continued innovation and new and enhanced offerings; growth drivers, market opportunities and opportunities with partners; customer demand for and adoption of FireEye's products and services; continued growth and momentum in FireEye's business and the ability to expand growth opportunities; changes in the threat landscape and the security industry; changes in customer buying preferences; FireEye's priorities and future plans; FireEye's competitive position in the marketplace; expectations regarding the timeframe to achieve cash flow and operating targets; the expansion of FireEye's platform and the availability of new offerings; and FireEye's path to profitability. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future. And we undertake no obligation to update these statements after the call. For a detailed description of the risks and uncertainties, please refer to our SEC filings as well as our earnings release posted an hour ago on the website. Copies of these documents may be obtained from the SEC or by visiting the Investor Relations section of the website. Additionally, certain non-GAAP financial measures will be discussed on this call. We've provided reconciliations of these non-GAAP financial measures to the most directly comparable GAAP financial measures in the Investor Relations section of the website, as well as in the earnings release. With that, I'll turn the call over to Dave.

[David G. DeWalt:]

Okay. Thank you, Kate. Good afternoon, everyone, and thank you for joining us on our call today. Today, we have some very exciting news to share. As many of you might have read by now, we've made three exciting announcements that I really believe strengthen and solidify the future of FireEye. First of all, we continued our progress in building the most comprehensive Global Threat Management Platform. We believe the combination of intelligence, services and technology enables FireEye to advance cyber security protection around the world. Earlier today, we announced multiple enhancements to our platform, including our new FireEye security orchestration product, which came from our Invotas acquisition we did in the first quarter. We also had enhancements to our advanced network security products, called NX, that enables high availability and automatic failover. This enables FireEye to be one of the only providers that can detect and prevent in-line and real-time. Other enhancements include updates to our email threat management platform, which is now fully integrated to our FireEye security orchestration product, or FSO. We also announced enhancements to our network forensics product, as well as enhancements to our Threat Analytics cloud product. The breadth of this announcement demonstrates the tremendous progress we've made over the past few years. We've gone from a single appliance based solution to a complete platform that can be managed by the customer in a self-service model, or delivered as a service through our FireEye as a Service capabilities. We've also come a long way with our customers, growing from just a handful to now more than 4,700 in 70 countries; and these customers include some of the most important companies and governments around the world. We've also come a long way growing our business, from a company of less than $100 million to a company on the path to do more than $1 billion this year. I'd like to thank the nearly 3,500 employees for their continued hard work, determination and conviction that FireEye will become the most important cyber security company ever. The second major announcement is about strengthening our management team for the future. Today, we're announcing that Kevin Mandia will be succeeding me as CEO of FireEye, effective June 15. This is the day following our annual shareholder meeting. Kevin and I, together with our board, have discussed and anticipated this change for quite some time. With a solid foundation of people, technology, partners and customers in place, this is exactly the right time to make this move. We're so fortunate to have Kevin step into this role. He is the industry's global thought leader on cyber security; and no one knows more about the threat landscape than Kevin, and he's passionate about our mission. He'll be a great leader for FireEye, as we continue our journey onward. I'm looking forward to my new role as well as Executive Chairman, in which I'll remain active, very active, in shaping FireEye's future. In this new role, I'll be working with Kevin, the leadership team and everyone at FireEye to increase adoption of the FireEye Threat Management Platform, with a focus on the company's multichannel go-to-market strategies. I will continue to speak to investors, partners and customers about FireEye's unique position in the market, as well as lead FireEye's board of directors. I'm also excited to announce that Travis Reese, who many of you met at Analyst Day and who has done a remarkable job as President of Mandiant, will step up and become President of FireEye. Kevin and Travis have worked together for more than 20 years. As a team, they've established Mandiant as a leader in security, incident management and response, and grew the company to nearly 500 employees and more than $100 million in revenue before the acquisition. I'm also very pleased to announce that Mike Berry, who has had an incredible impact strengthening our business since joining us as Senior Vice President and Chief Financial Officer last year, will now take on broader responsibilities as our Chief Financial Officer and our Chief Operating Officer. Mike, who led finance and other operations for a number of technology companies before joining us, will play an essential role that continue to optimize our financial infrastructure and the global operations that will allow us to evolve and scale our business as we enter the next phase of FireEye's journey. We move forward in 2016 with a very strong senior management team and outstanding leaders across all of our functional areas. Please join me everybody in congratulating Kevin, Travis and Mike. With our management succession assured and transformational products on our road map, I believe our future is very bright, which is the perfect segue to a discussion of our Q1 results and the important platform announcements we made earlier today. I want to share with you a few things, including the details behind our strong Q1 billings performance, and I'll also give you an update on our progress on our platform road map, including the virtual and cloud-based MVX products we discussed in Analyst Day, as well as some of our other recently announced partnerships. And then finally I'll review our platform integration and launch plans for iSIGHT threat intelligence and Invotas orchestration and automation technologies. Our Q1 billings of $186 million exceeded the high end of our guidance range, driven by growth in our cloud-based solutions and especially our threat intelligence and cloud email and our FireEye as a Service capability. The higher mix of recurring product subscriptions, which are recognized ratably, resulted in revenue of $168 million, toward the lower end of the guidance range, but we still delivered earnings per share ahead of expectations and $0.04 ahead of the midpoint of our guidance. Our Q1 billings performance and our customer-related metrics all point to growing demand for our advanced security solutions and continued strength in our business. We added 261 new customers in the quarter, including more than 50 of the Global 2000. We closed 28 deals greater than $1 million, the same number as in Q1 2015, but in a far different threat environment. More than 80% of these included multiple-products, and more than half included three or more products. Additionally, more than half included FireEye as a Service or cloud products and about one-third included endpoint. The number of platform customers with three or more product families continues to grow both in absolute numbers and as a percentage of the installed base, and demand was diversified across vertical markets and geographies, demonstrating the breadth and depth of our total addressable market. Thank you to everyone in the FireEye family, our employees, our partners and our customers, for their contribution to these outstanding results as the threat landscape and our market continues to evolve. If you're viewing our Q1 performance in the context of the powerful forces that are shaping the security landscape showcases, our ability to adapt to customer needs and pivot to the evolving threat landscape is imminently apparent. We see three macro trends driving change in our industry. First, the migration of the cloud-based and cloud-enabled security solutions is accelerating and mirrors the trends in the broader software industry. At the same time, the shortage of security talent has reached crisis levels. The lack of talent is driving growing demand for services and as-a-service solutions; and growth in outsourced security is expected to be the fastest growing segment of the security market going forward. Finally, the threat environment continues to evolve as the attack surface expands and new threat actors emerge. Although we've seen temporary declines in attacks from the Chinese government threat actors on U.S. targets on U.S. soil, we've seen an increase in hacktivism and ransomware around the world, as well as increased activity from new threat groups in Iran, Syria, North Korea, among others. Attacks on critical infrastructure are a growing concern in the wake of the Russian attacks on Ukrainian targets, and the Internet of Things is creating new attack vectors everywhere. The need for continued vigilance, better threat intelligence and faster response times remains; and customers are increasingly looking beyond point products and demanding best of suite solutions, as well as the flexibility to deploy on-premise, in the cloud or as-a-service. FireEye is well-positioned to do within any of these environments. No other security company has the combination of technology, expertise and intelligence to deliver protection from these emerging threats. And we've combined a unique set of assets into intelligence-led security platform that reduces risk, masks complexity and lowers the total cost of ownership for our customers. The shift from appliance-based solutions to subscriptions and cloud-based security is happening faster than even we anticipated; and our Q1 results show we are nimble enough to move with and, in fact, drive the market to a more effective cloud-centric security model. I think a couple examples will show you what I mean. Our largest transaction in Q1 was an eight-figure cloud email deal in the U.S. federal region, protecting more than 100,000 mailboxes. A year ago, this deal would've been an appliance-based solution, with at least half of it recognized as in-period product sales. In another example, a well-known luxury retailer is replacing their legacy SIM product with our Threat Analytics Platform based TAPs to ability (12

[Kevin R. Mandia:]

Dave, thank you very much. And I'm going to begin this the same way as I'm going to end it. I am absolutely excited and honored by the opportunity I have to be CEO of FireEye. Dave is an incredible leader. He's been a mentor of mine for four years. I've always admired his intensity, his passion for our mission, his respect for our employees and his commitment to our customers. And working together with Dave and with our entire leadership team, I'm eager to continue the journey we're already on. Dave and I share the same vision for FireEye. We're on the journey to build the best security company in the world. And we've worked together for two-and-a-half years, and that whole time the imperatives there has been alignment; what we need to accomplish there has been an alignment. And the good news is we've assembled the technology, the intelligence and the expertise our customers need to defend themselves against the myriad of threats facing corporations and governments around the world. And while we've made great progress, and I'm very happy with the progress we've made, our mission is far from over. So I'm going to touch on a few things that I could probably talk for four hours, but I would like to just touch on the five things that I think are absolutely important and dear to me. First, we have to continue to focus on our innovation. This is a company that is always transforming itself. We recognize that in security you have to move fast, you have to think fast and speed counts, because the threats are ever-pressing. So we're going to always focus on innovation, we're always going to evolve, we're always going to transform. And I know that demands on our engineers will be significant, but I know we're up for the task. We're going to continue to extend and strengthen our capabilities. We've done a great job assembling the puzzle pieces required to defend our customers. We started with FireEye. We brought in Mandiant, nPulse, iSIGHT, and now Invotas security orchestration into the FireEye family. Travis' leadership has been a major reason for bringing these companies together, and we will see even greater integration and coordination across these business signs with him as President of FireEye. We will continue on our path to profitability. The efficiencies introduced by additional integration, our recent efforts to optimize across the company and our general shift towards a meaner, leaner, finer FireEye, all demonstrate our commitment to arriving at profitability quickly. And with Mike leading our efforts in his dual role as CFO and COO, I'm absolutely confident in our ability that we will accelerate this progress. We have to continue our international expansion. I've gotten to travel the world over the last two-and-a-half years, and even though the United States was one of the earliest countries attacked in cyberspace, this is a worldwide problem. There are hot zones on the Internet in Asia, in Europe and all across the globe. Local presence is key to trusted customer relationships, and we're going to continue to expand our global presence to meet the growing demand for our products and services around the world; and we need to work with partners to strengthen our ecosystem relationships with our customers. FireEye is an ambitious company with ambitious goals. What we want to achieve cannot be done without strong partners; and we are focused on establishing and strengthening these relationships that will ultimately enable us to become the best security company in the world. I am honored by this opportunity. I am excited by this opportunity. But now, I have to step back and turn it over to Mike for the CFO update.

[Michael J. Berry:]

Thank you, Kevin, and very good afternoon to everyone on the call. Before we turn to the Q1 results and our updated outlook, I want to take a moment to thank Dave for the opportunity to serve as FireEye's CFO under his leadership. Although it's been less than a year since I joined FireEye, I have learned a tremendous amount about business, leadership and, quite frankly, life in general while working for Dave. I have really enjoyed our CEO-CFO partnership and look forward to continuing to work with Dave when we transition to our new role in mid-June. I also want to congratulate Kevin and Travis on their new roles, and I appreciate the support and confidence from the board of directors in adding the COO responsibilities to my role. These are exciting times as we expand our platform and extend our reach into new markets; and I am looking forward to working more closely with Kevin and Travis as we move into the next chapter of growth for FireEye. I'm also very excited to work hand-in-hand with the different operational teams to help drive our growth initiatives, while continuing the journey on our path to profitability. Okay. Let's turn to the review of the first quarter results and our second quarter and updated full year 2016 outlook. I want to remind you that except for revenue, which is a GAAP metric, I will be using non-GAAP metrics to discuss our financial results and guidance ranges. I will go into more detail on each of these items, but, overall, we were pleased with our strong billings results, the performance of our subscription offerings and the positive impact of our continued focus on cost optimization. Importantly, we are maintaining our full year guidance for billings, non-GAAP EPS and cash flow from operations. Our non-GAAP loss per share was $0.04 better than the midpoint of our guidance range, even though revenue came in at the low end of our range. While cash flow from operations was a bit lower than expected, this was primarily due to some one-time items related to pre-acquisition expenses of iSIGHT and Invotas, plus a slight decrease in working capital. Billings finished above our outlook at $186 million for a year-over-year growth rate of 23%. Our billings performance reflected the continued strength of our subscription products and the overall industry trends Dave discussed during his comments. I am pleased to tell you that we've been able to integrate iSIGHT's offerings into our go-to-market and sales motions. Because of this synergy, we saw several deals that included multiple products, including iSIGHT, which resulted in better than expected contribution to our billings in the first quarter. Looking at platform billings, which is product plus product subscription and is a measure of the growing adoption of our platform. Regardless of form factor, we continue to see strong performance in our cloud email, endpoint, forensics, FaaS and advanced threat intelligence products. As a result, product subscriptions billings grew 39% from Q1 2015. Additionally, although appliance sales declined overall, our renewal rate remained strong at approximately 90%. Our total average contract length, which includes renewals, as well as new sales, was approximately 31 months, consistent with the 30 months we experienced in the first quarter 2015. Total revenue finished at approximately $168 million, a 34% increase versus the first quarter 2015. The acquisitions contributed approximately $7 million in – I'm sorry, $9 million in product subscription revenue in the quarter. Let me do that again. The acquisitions contributed approximately $9 million in product subscription revenue in the quarter. Even if you exclude revenue from the new acquisitions, revenue still grew by nearly 27% on a year-over-year basis, reflecting the increasing adoption of our cloud and subscription products. Total platform revenue, which comprises product and product subscription revenue, grew by 29%. Product subscription revenue growth of 71% more than offset the 16% decline in product revenue. We saw customer preference for cloud and subscription offerings pick up theme in the second half of 2015, but the acceleration in the first quarter 2016 caused a more dramatic mix shift than we expected when we entered 2016. Since this is an important inflection point in our business model, let me expand on this trend a little bit. As you know, we were expecting product billings and revenue to be basically flat on a year-over-year basis. Based on where we stood at the end of February and more importantly our pipeline for March, we were tracking close to our expectations. However, during the last few weeks of the quarter, we saw a fairly significant change in the composition of the first quarter product pipeline, as many of the product-heavy deals pushed into future quarters. While we expect some of these transactions to ultimately close as product deals, we also expect that some will switch to FaaS and other subscription offering. While it is not uncommon to see changes in the composition of our pipeline in the last few weeks of a quarter, the impact on product-heavy deals was greater in the first quarter than in previous quarters, and the mix of subscription and total billings was higher than we expected when we first issued our Q1 guidance. As a result, we finished towards the low end of our total revenue range, even though we overachieved on total billings. While the near-term revenue impact of changes in the pipeline composition can be difficult to forecast, as we saw in the first quarter, we believe the trend on recurring subscriptions is positive for us in many ways. Not only do we believe the initial deal sizes tend to be larger and the lifetime value of a customer higher, but the expanded pool of recurring business creates a solid foundation for future growth. Okay, moving on down the income statement. Total gross profit margin finished at 70% in the first quarter, basically flat on a year-over-year basis and consistent with the expectations we outlined on last quarter's call. We continue to see strong gross margin expansion in subscription and services, as we begin to achieve economies of scale with the expansion of our customer base. Compared to the first quarter of 2015, the gross profit margin from subscription and services increased by approximately 2 percentage points. On a sequential basis, the decrease from the fourth quarter 2015 reflected the addition of iSIGHT cost of goods sold and normal first quarter increases in payroll expenses for our threat researchers, security analysts and consultants. Although we were still able to achieve a total gross profit margin in line with our guidance, product gross margin was below our internal expectations by about 8 percentage points. This variance in product margin from our expectations was due to the combination of fixed costs being spread over a lower appliance sales volume and also approximately $800,000 of one-time cost of goods related expenses, mainly due to higher-than-normal inventory cost adjustments and write-downs. We expect product margins to rebound to the upper-60% range in the second quarter, as product billings and revenue increase sequentially. As I mentioned earlier, we continue to implement operating efficiencies to accelerate our path to profitability. Even with the addition of approximately $8 million of operating expenses from the two acquisitions, we were able to keep operating expenses basically flat to the fourth quarter 2015. At approximately $191 million, this was $7 million to $8 million below the $197 million to $199 million we outlined on the February call. The big puts and takes on a sequential basis versus the fourth quarter 2015 were a reduction in commissions, which was partially offset by the additional cost of our sales and partner kickoff, as well as RSA, which took place in the first quarter this year. The additional costs from the acquisitions were balanced with better cost management across the remainder of the FireEye business. All three expense lines saw improvement on a year-over-year basis, as measured as a percent of revenue, with R&D and G&A improving by between 300 basis points and 150 basis points respectively, and sales and marketing improving by nearly 900 basis points. Again, these amounts include the impact of two-and-a-half months of iSIGHT and two months of Invotas expenses. The combination of lower operating expenses through optimization and a favorable FX adjustment that reduced other expenses allowed us to deliver non-GAAP loss per share of $0.47, better than our expected loss of $0.49 to $0.53 per share. The FX adjustment reflected the revaluation in our cash balances held overseas to pay operating expenses in our international regions. Turning to the balance sheet. I don't think there are any real surprises, but I want to walk you through a couple of acquisition-related items. First, we brought over approximately $21 million in deferred revenue from iSIGHT and Invotas, which shows up primarily in current subscription and services deferred revenue. Although this amount is not material to total deferred revenue, if your model calculates billings as revenue plus the change in deferred, you will need to make this adjustment to your first quarter billings number. Excluding the acquired deferred revenue, we ended the quarter with total deferred revenue of $544 million, an increase of 44% compared to the ending balance on March 31, 2015. The mix between current and long-term was consistent with the mix at the end of the first quarter of 2015 and with the fourth quarter 2015, reflecting stability in the average contract length. The acquisitions reduced our cash balances by approximately $205 million, representing the net cash purchase price; and we ended the quarter with just over $921 million in cash and short-term investments. In addition to the adjustment to deferred revenue and cash decline relating to the purchase price, we recorded accrued compensation of approximately $35 million for the cash portion of the iSIGHT earn-out. We ended the quarter with billings based DSOs of 69 days. This is near the midpoint of our targeted range of 65 days to 75 days, but is a little higher than we expected in the first quarter, reflecting linearity within the quarter. Slightly higher cash payments of accrued expenses plus the payment of approximately $8 million of iSIGHT's and Invotas' deal-related expenses impacted our operating cash flows in the quarter, and we finished at a negative $22.5 million. Please note that these expenses are different than the operating expenses we just discussed. These expenses represent iSIGHT and Invotas' banking and legal fees associated with the transaction. They were incurred before the acquisition closed and thus are not included in the FireEye P&L. However, from an accounting perspective, these expenses were classified as FireEye liabilities when the financial statements were consolidated, instead of inclusion as part of the purchase price. As a result, we were required to show the payment as an outflow in the operating section of the cash flow statement rather than the investing section. So that you can readily identify this cash payment, we have broken it out on a separate line item in the cash flow statement. Excluding these deal-related expenses, operating cash flow would have been just under $15 million and modestly below the range we discussed on our February call. It is always hard to forecast quarterly cash flows precisely due to the timing of inflows and outflows and changes to working capital, so I encourage you to focus on the annual number instead. For the full year, we still expect to generate operating cash flows of $75 million for the year, give or take $5 million. Okay, before moving on to the outlook for 2016, I want to discuss the impact of the ongoing cost optimization activities we previewed at Analyst Day. We are serious about accelerating our path to profitability, and we continue to look at overlapping functions, infrastructure investments and discretionary spending to ensure that we're optimizing our cost structure while still funding our growth initiatives. To that end, we implemented several cost savings initiatives in the first and second quarters, including a net reduction of approximately 200 existing and planned positions company-wide. We also reduced discretionary spending throughout the company; and these savings are already flowing into our operating expense performance for the first quarter. At Analyst Day, we projected our optimization activities would reduce our 2016 operating expenses by approximately $8 million to $10 million, primarily in the second half of the year. I'm happy to say that through the great work of everyone at FireEye, we have exceeded those projections and now expect the optimization activities to yield more than $30 million in real life savings during 2016, including the approximately $7 million of savings already realized in the first quarter. These savings are reflected in our second quarter and updated 2016 guidance ranges. We will continue to fund our growth initiatives, but this reduction from our previously provided expense outlook will be a key factor in our drive towards profitability. These activities resulted in a restructuring charge of $1.7 million in the first quarter; and we are expecting additional restructuring charges of at least $3 million in the second quarter of 2016. With that discussion as a background, let's move on to the revised outlook for 2016. Our billings range remains the same in $975 million to $1.055 billion, but we now expect a higher mix of subscriptions than we did in February. Since billings helped drive cash flow, our full year cash flow projections also remain the same at $70 million to $80 million. Moving on to revenue, we're revising our outlook downward by about 4% or $35 million at the midpoint to reflect the lower product billings, which are largely recognized in period. We now expect 2016 total revenue to be between $780 million and $810 million or a year-over-year growth rate of 25% to 30%. Within the revenue line, we currently expect 2016 platform revenue to increase over 2015 by approximately 25% to 30%, driven by continued strong growth in subscription and support revenue and a decline in product revenue of 10% to 12%. The impact of lower product and total revenue on the income statement is offset by increased cost savings from optimization; and thus, we are maintaining our full year EPS range for a loss of $1.20 to $1.27. This includes net interests and other expense of approximately $10 million and a provision for taxes of $6 million to $7 million. We continue to expect full year gross profit margins of about 73%, with product gross margins in the high-60% range and services margins in the mid-70% range. Total operating expenses are expected to be between $765 million and $770 million, or an increase of about $75 million at the midpoint compared to 2015. For the full year 2016, we currently expect the following as a percentage of total revenue. R&D at 30% to 32%; sales and marketing, 52% to 54%; and G&A 13% to 14%. This brings full year operating margins to between negative 22% and negative 24%. We still expect to exit the fourth quarter of 2016 with operating income margins of approximately negative 10%. Okay, let's shift to our guidance for the second quarter. We currently expect total billings to be between $200 million and $215 million for a growth rate of 12% to 21%. We expect total revenue to be between $178 million and $185 million or a year-over-year growth rate of 22% to 26%. Embedded in this guidance is the year-over-year decrease in product revenue of about 15%, reflecting trends in customers buying behavior, as well as the grow-over impact of the large product deal one year ago. We expect total gross margins to be in the range of 70% to 71% and total operating expenses between $188 million and $190 million, as we continue to realize the benefits of our cost optimization efforts. On a percentage of total revenue, we expect operating expenses to be 33% to 34% for R&D; sales and marketing at 55% to 57%; and G&A at 14% to 15%. This results in an operating margin between negative 31% and negative 33% and a non-GAAP EPS loss per share between $0.38 and $0.40. We expect operating cash flow in the second quarter to be negative, largely reflecting the seasonality as you begin with a lower AR balance from first quarter billings and the first half interest payment on our convertible debt. Remember that since the majority of collections within a quarter are from the prior quarter's billings, cash flow seasonality lags billings seasonality by a quarter. This means that the second quarter operating cash flow is typically the lowest of the year. Cash flow is projected to turn positive in the second half of 2016, as the sequential growth in billings is expected to be well above the projected sequential growth in cash expenses. As I mentioned before, it can be difficult to forecast cash flow for a quarter with accuracy due to timing of in-flows and out-flows, but this is a very high-level way to think about our quarterly cash flow pattern. The important number here is the annual guidance of $70 million to $80 million. Before I conclude, I want to make a few comments about the second half 2016 guidance implied by the net of our second quarter and annual guidance ranges. From a top line perspective, our billings guidance is consistent with our historical seasonal pattern, which has been about 35% to 40% of billings in the first half of the year and 60% to 65% in the second half. We have several good reasons to believe the pattern will be the same for 2016. Our pipeline of business remained strong, with a growing contribution from international markets, as well as our partnerships with F5, HP, Visa and others. We are well-positioned against the fundamental market trends, including the trend from self-service to as-a-service and the migration to private and public clouds. Our investments in FaaS and cloud mean that these trends represent a billings tailwind rather than a headwind for us. Additionally, the launch of the new MVX products Dave discussed represents an incremental opportunity with both new and existing customers. We are very excited about the potential for these products. As you flow the operating expense guidance through your models, you will see we feel very good about our ability to realize operating leverage. As we said at Analyst Day, I am confident we have the cost structure to support our 2016 growth targets. And as a result, we expect the majority of the top line growth in 2016 to flow directly to cash flow and operating margin. Finally, and I mean it this time finally, I want to give you a heads-up that as part of our cost optimization efforts we are looking at several options to consolidate our five buildings here in Milpitas into one building sometime before these leases expire at the end of 2017. We are still evaluating our options, but believe that a facility consolidation would create a better working environment for our employees and give us a better cost structure over time. As of today, we still expect our capital expenditures to be approximately $35 million in 2016. In conclusion, I'll reiterate that overall we were pleased with our strong billing results, the performance of our subscription offerings and the positive impact of cost optimization in our P&L and operating cash flow. We view the increased mix of product subscriptions in our billings and revenue as a positive for the future for all the reasons Dave and Kevin discussed. And we look forward to realizing the long-term benefits. I'll now turn the call back to Dave.

[David G. DeWalt:]

Okay, everybody. Thank you very much. And as we saw from Mike's report, and Kevin's and mine, Q1 results really demonstrate our ability to adapt, particularly, in this evolving market dynamic and new threat environment and still deliver the top line billings growth and bottom line EPS; just a huge credit to the FireEye employees. I'm very proud of you all. Thank you for your hard work and your dedication. We have a lot of opportunities in front of us. I think the future is incredibly bright. We've got a great product road map. We've got a great team. We've got a great intelligence-led offering model, and I really think the future is going to be much better as we go forward. So with that, I'll turn it back over to Candace for questions and we can open up the line. Candace?

[Operator:]

Thank you. And our first question comes from Shaul Eyal of Oppenheimer. Your line is now open.

[Shaul Eyal:]

Thank you. Hi. Good afternoon, guys. So without a doubt, FaaS, good quarter, certainly becoming a growth driver. Did you think that the customers opting for the FaaS rather than the product could be behind maybe the slightly lowered revenue for the quarter? Is that the case?

[David G. DeWalt:]

Shaul, David DeWalt here. Absolutely. I mean we've talked about that a little bit. You have these two major security drivers in the industry that I think really has FireEye well-positioned. Number one is you have all this premise to cloud sort of transformation that's occurring. We continue to see the acceleration. I alluded in my script, we had our largest single transaction come from email cloud, over 100,000 mailboxes. We're also seeing clients want to go from kind of a self-service or manage-it-themselves to an as-a-service; and we fit really well in that model. We see accelerated product subscriptions in that area of our platform. And I think we're the largest and fastest growing company for FaaS or Security as a Service and cloud security. So we're doing very well in that. But what does that do is it drives more product subscription and more billings in that area versus revenue in period; and hence why we confirm the billings for the full year, but had to lower the revenue a bit. So absolutely, to your question, it's driving it. And honestly I think we've now accounted for it. But at the same time, this is a fast transformation across a lot of applications and workload moving to the cloud; and I think it's a pretty fast transformation to a managed service model for security as well. So we talked a lot about our FaaS offerings and what we're doing in that area and they continue to be the biggest driver of the company's growth. Thank you. Good question.

[Operator:]

Thank you.

[Kate Patterson:]

Next question, please.

[Operator:]

And our next question comes from Sterling Auty of JPMorgan. Your line is now open.

[Sterling Auty:]

Yeah. Thanks, guys. First, congratulations to Kevin, Mike and to Tyler (sic) [Travis] (48

[David G. DeWalt:]

Sure, Sterling. So I'll be blunt right back. I think we've come a long way, I'll start out by saying here, with FireEye. I can't tell you how proud I am. We started with really just small clients and grew this business. We're well on track for $1 billion here. One of my goals – as the fourth time around here as the CEO, now 17 years doing this, 30 years in IT, four years here at FireEye – was to get the company IPO-ed and get the company to $1 billion track; and a lot of those accomplishments we've been able to achieve here at the company. I think we're assembling the most powerful cyber security company in the world. It just is. Firewall vendors and anti-virus vendors really aren't nearly as capable and important and strategic as this company is, particularly with its Mandiant and iSIGHT capabilities, with its detection capabilities. I mean, really what we've got to do now is put it all together. Part of my goal here was to assemble the strongest team in the industry. I think Kevin Mandia is that individual. He has many, many years in cyber security; most of his career. Nine years building Mandiant. Not easy to build a company from zero to $100 million in revenue; not easy to build the reputation and brand that Mandiant's had. Travis Reese, his cohort and cofounder, now being President of the company; Mike Berry now as Chief Operating Officer; me as an executive and employee of the company, as Chairman. Enrique Salem, as you might read in the press release, is moving to the LID or the Lead Independent role. And with Enrique's background with Symantec; my background with McAfee and FireEye; Kevin's, Travis', Mike's, we've really put together a management team of the future, a board of directors of the future. And it is really a good window. And when is a good window to do this? Probably either at the annual shareholder meeting, which is once a year, or maybe at the end of a fiscal year. So this was good timing for us all. Kevin's been here two-and-a-half years now at FireEye as part of the company. He knows and integrated with everything we're doing. And I think this really sets us to the future. So I'm excited about my roles going forward here with the company. I'm excited about how far the company's come. But I really believe the best is yet to come for the company as we get to the other side, and we really show the world what we can do here with all the pieces this company has created. So good question, Sterling. Thanks for asking it.

[Operator:]

Thank you. And our next question comes from Gur Talpaz of Stifel. Your line is now open.

[Gur Talpaz:]

Great. First off, Dave, thanks for all your help over the past few years; and Kevin and Mike, congratulations on the promotion; and Travis as well. Given the growing emphasis here on the as-a-service models, can you talk about the response you've gotten for FireEye as a Service 2.0? Are customers willing to feed other security product alerts into your solution? And then perhaps talk about your growing role here as a security orchestrator? Thank you.

[David G. DeWalt:]

Yeah. I'll take the first part and maybe, Kevin, you have a lot of passion for security automation and orchestration and helped us lead the Invotas moves. I really see the future of security as as-a-service model. I mean when you look at all of the industries around us, whether it's helpdesk, with what ServiceNow has done, or CRM, or HR, as-a-service models are the future. And FireEye as a Service is really developing well. We've got the products. We've got the capabilities. We've now got a complete set of delivery now across the world. And now what we're able to do is really automate some of the capabilities. And, Kevin, maybe just spend a second, how important is iSIGHT and Invotas to all of this and what do you see.

[Kevin R. Mandia:]

Yeah, great. Absolutely. People want to be able to leverage their prior spend, and we show up in FaaS as an overlay. If people want to send alerts to us, what they want to tap into is our ability to apply analytics, apply threat data, apply our expertise, apply dynamic analysis of executables, is that good or bad or not. And this is all nerdy language for people want integration and efficacy and simplicity. And as we expand this FireEye security orchestration platform, that's exactly what we're doing. We're saying give us the events and we're going to tell you which ones are bad, and we're going to do that with those three things

[David G. DeWalt:]

Thank you very much, Gur. Next question, please.

[Operator:]

Thank you. And our next question comes from Gabriela Borges of Goldman Sachs. Your line is now open.

[Gabriela Borges:]

Great. Thanks so much for taking my questions. Mike, just a quick one. You mentioned how it's difficult to forecast the mix shift between product and subscription in any given quarter. So just curious if you look out to the full-year guidance what your assumptions are in terms of that transition occurring? And maybe just on the customer side, when a customer's choosing between taking a product (53

[Michael J. Berry:]

Sure. So I'll answer the last one first. And there are certainly economics that may depend on do they have capital budget, do they have operating budget. That's a big piece of it. A lot of it too really depends on can they run it themselves or do they need us to run it. So there's both, I think a financial and an operating piece of that. So, Gabriela, what we included in the guidance for the full year is product revenue down, call it, around 10% or 12%. And really the difference between that and what we thought would be flat is really again that shift that we're seeing. And as I said in my prepared remarks, we view this long-term as a good thing. We continue to think that those deals are actually larger, as well as have higher long-term value for the customer. So we do expect that to continue. And we haven't talked about 2017 yet, but as we go through the rest of the year, the rollout of the cloud and the virtual solution for MVX is going to accelerate it as well. So as we look into next year, we're super excited about the ability to drive incremental billings from that and expand into an incremental TAM. Those will also be subscription likely as well.

[Operator:]

Thank you. And...

[Michael J. Berry:]

Hope that helps.

[Operator:]

Thank you. And our next question...

[Gabriela Borges:]

Yes, it does. Thanks.

[Operator:]

Ken Talanian of Evercore. Your line is now open.

[Ken Talanian:]

Hi, guys. Thanks for taking my question. Just following up on the mix shift in your business. I was wondering directionally how should we think about cash flow growth in 2017 and beyond. Let's assume that your billings are up versus 2016, and the trends that you're seeing right now remain as expected.

[Michael J. Berry:]

Yeah. So I think, one of the things – Ken, this is Mike by the way – one of the things that we included in the slides is a reconciliation of our Q1 cash flow. So how I would look at that is I would look at billings growth, assume that certainly some percentage of that is going to convert to cash. It varies by quarter depending on those collection cycles, and linearity plays a big role in that. I think I said at Analyst Day that we expected somewhere between 90% and 95% of billings typically to convert to collections. And then when you take a look at OpEx, we certainly haven't guided for 2017 yet, but as we continue down that path to profitability we will be mindful of the incremental dollars that we spend. So as you model your cash flow, I would focus on billings, and then I would focus on non-GAAP operating expenses as the key drivers.

[Ken Talanian:]

Okay, great. Thank you very much.

[Michael J. Berry:]

You bet.

[Operator:]

Thank you. And our next question comes from Gregg Moskowitz of Cowen & Company. Your line is now open.

[Gregg Moskowitz:]

Thanks very much, and good afternoon everyone. Just wondering if you could elaborate on the go-to-market challenges around Essentials in Q1, and what you've done to hopefully fix that going forward?

[David G. DeWalt:]

Yeah. Sure, Gregg. Dave DeWalt here. So – and I guess a couple of things. Essentials in our power launch was very recent. So we weren't expecting a whole lot for Q1. We announced it really late January, early February, as we went into our sales kickoff and training event. Subsequently, we trained a lot of the partners in Q1, got the motivations and Reward for Value programs that we've had. So we've started to see some pickup. We're encouraged by what we're seeing here with the Essentials line now in Q2. So it just takes a little bit of time. And while you always like something to happen pretty quickly, obviously segmentation like that takes a bit of time. But having said that, something that I alluded to, Gregg, that we're launching here in the second half is important too, further segmentation of our sort of NX product line, and that's both with a virtual sensor as well as a cloud sensor. So you'll see even more product subscription growth opportunity for the company as we move into kind of the MVX everywhere. And we're right on track for that. We think during the Q3 quarter we can deliver most of that product line, at least in form factors of virtual and then cloud in the fourth quarter. So the nice part is it really lets us get into the edges more, gets into down market more, expand our total addressable market. So the combination of the hardware segmentation with Essentials and power, further segmentation with software and cloud really gives us a pretty wide scale model for our front-end detection tools. Good question. Thank you.

[Operator:]

Thank you. And our next question comes from Gray Powell of Wells Fargo Securities. Your line is now open.

[Gray W. Powell:]

Great. Thank you. Thank you very much for working me in. I have a multipart question here. Hopefully, it's not too complicated. But can you help us think through the dynamics of an existing customer refresh? Specifically if a customer is, call it, four-year-old, they come up to refresh an appliance, are they typically buying something that's more expensive today versus that initial purchase? And then how does that refresh look if a customer replaces an old appliance with a new appliance versus replacing that old appliance with a cloud form factor? Thanks.

[Kevin R. Mandia:]

Sure, Gray. This might take a while, but I'll make it brief. Certainly, there is a lot of flexibility for a client base. I think the good news that we're seeing is the renewal rate and the adoption and cross-selling has never been stronger for our – even our flagship NX product the renewal rates were fantastic in the quarter. They continue to grow. One of the limitations that we've had with that flagship NX product is really it goes into the biggest egress points that are the datacenter egress points; and we've only had hardware for those big egress points. So the first segmentation with Essentials is an option for people. They certainly can renew the, quote-unquote, classic version to a power edition, which would be more. They can also add on some subscriptions to their appliance. And now going forward, they'll be able to upgrade those capabilities to back end cluster product, as well as a virtual sensor product. So a long winded way of saying there's a lot of options for our clients to refresh. I think the good news is they're very satisfied with our products. They were renewing those products and we're seeing a lot of cross-sell opportunity when we do the renewal. So it's given us more and more options as we talk to our almost 5,000 customers now with what we're doing. Thank you.

[Operator:]

Thank you.

[Gray W. Powell:]

Got it. Thanks

[Operator:]

And our next question comes from Jonathan Ho of William Blair. Your line is now open.

[Jonathan F. Ho:]

Hey, guys. I just wanted to get a little bit of sense around your comments regarding linearity for the quarter. And is there anything that we should read into in terms of a shift more to services at the end of the quarter. Does this potentially indicate some slowing or softening in terms of spend or was that more sort of operational decisions to switch more to the subscriptions?

[Michael J. Berry:]

Yeah. Hey, Jonathan. It's Mike Berry. I wouldn't read anything into the overall demand environment. Q1, the calendar year, always is relatively back end loaded. People do all their budgeting and stuff in January. So it wasn't something that we did not expect. And candidly, from a service or product perspective, it's not like one of those are different from a linearity perspective. It's really all wrapped up into that customer decision-making process.

[Operator:]

Thank you. And our next question comes from Rob Breza of Wunderlich. Your line is now open.

[Robert Breza:]

Hi. Thanks for taking my questions. Just, Kevin, as you are now stepping into the new role...

[Kevin R. Mandia:]

Right.

[Robert Breza:]

...if you could talk about how you think about restructuring, thinking about placing people in their respective positions. How do you think about – 12 months, 18 months from now, where do you think the structure of people and placements are? Thanks.

[Kevin R. Mandia:]

Well, I get the job in a month and 15 days, so I'll probably adjust a lot of that then. But in fairness I also want to sit down with my leadership team; and this company is going to continue to evolve. The strength that I bring is I know our marketplace really well. I've traveled the world. I do over 100,000 miles on airplanes every year. I do, not hundreds, but probably in the last few years, thousands of customer visits. And what basically it comes down to is what does the market need, we're going to provide that as fast as we can, continue to evolve as market needs evolve, but we're going to stay within our core competence as well, is what we're good at. We know how to find evil on networks, but we've got to find evil everywhere, in the cloud, on mobile, across enterprises are getting more multi-national. So we're going to increase that reach. Right now – I don't like the word restructure. We've got the team in place. I'm excited about the team that we have. Dave and I have worked together really about four years. He assembled this team. We've had a like-minded vision. I've been excited about the vision all along. So give me some time, but at the end of the day, restructure's the wrong word. But we will continue to evolve and do what we got to do to build what the market needs.

[Robert Breza:]

Perfect. Thanks.

[David G. DeWalt:]

Great question. Next question, please?

[Operator:]

Thank you. And our next question comes from Melissa Gorham of Morgan Stanley. Your line is now open.

[Melissa A. Gorham:]

Great. Thanks for taking my question, and congrats to everyone on their new roles. Mike, I just wanted to particularly address your new role as COO. I'm just wondering if you could maybe talk about why it made sense to kind of carve out the COO role and put it alongside your responsibilities. And then, what are your current top priorities as you're taking on that position?

[Michael J. Berry:]

Sure. So, I am happy to take that, although Dave may want to jump in as well. So as we looked at going forward, and with the changes that we've announced today, one of the things that we have, Melissa, is we are trying to spend a lot of time around our different operations groups, be it all the infrastructure that supports the business, all the planning and operations. And we're trying to, call it, blow through some of those silos and really have a consolidated view of the business. So that's really, in your last question, my goal is to bring to Kevin and Dave and the rest of the management team a very nimble and cost effective way to deliver our products, to make sure that we understand looking forward – not just looking back, but looking forward, what we see in the business from pipeline, all the demand gen and everything, and then, really make sure that we set up that structure so that our people can succeed. So, I'm really excited about it. It's something that again, as Kevin said, I won't get that role for about 40 days. So I get a little bit of time after going to chat with all of you folks for the next five weeks. But I think, as we go through 2016, I'm going to focus on the goals that I just went through.

[David G. DeWalt:]

And, Melissa, I'll just add on – this is Dave DeWalt's voice, but Mike has really proven himself since he's come to the company. I hope you see that as you interact with him; very honest, very hard working, very humble man. He's learned our operations here, he's learned the business. I was listening acutely to his customer answers as well and he's learning the products real well. And the great part about what we have with Mike now is we can really unify our operations under him, we can streamline those operations. And candidly, we've got a lot of opportunity to optimize here at the company. We've been a company focused, as part of our journey, on growth and really taking market share and we also can balance that with being a strong efficiencies company and optimize our infrastructure at the same time. So, in the next phase we're in, I think, we've got great leadership with Kevin in vision. I think we've got a great leadership in Mike and Travis on operations. And that's the platform you want to look at, if you're a Chairman like me now. And one last comment, Kevin and I have worked together as Chairman and CEO before with Mandiant. Great to be back in that capability and we've had quite a few years working together, so I think we'll be pretty seamless as we go forward. And I think the whole team is as excited about some of the new things that we're embarking on. Thanks, Melissa. Good question.

[Operator:]

Thank you. And our next question comes from Brent Thill with UBS. Your line is now open.

[Brent Thill:]

Thanks. Just on the product revenue, you're seeing a trend that many others aren't seeing. And it seems like a conscious initiative to deliver more as-a-service and subscription. But just curious, how you're thinking about this even further out. Are products really going to be as relevant? Or do you feel like you're just going make the pivot a lot more to services? And if so, Dave, if you feel like you're leaving the sales team kind of in the right train, in the right comp plan, all the things that you've been doing for so long, getting these guys oriented around the shift, just trying to understand the dynamic here.

[David G. DeWalt:]

Sure, Brent. This is Dave. So, I'm a big believer that we're seeing – we're just in the first and second, maybe third inning of a significant transformation of the security industry. I'm just convinced – I know Kevin sees it the same way. Traditional defense-in-depth on the perimeter, with now six layers, seven layers, eight layers, 10 layers of defense, is really changing. And we're now seeing those workloads cycles move to cloud. We're seeing the perimeter change dramatically. What's traditional egress points for the firewall and IPS and a DLP solution, APT solution is changing. And it's just a fact. It's just a matter of time for all those other companies to feel the same change I'm seeing. It's just a fact. Firewalls won't sell on-premise like they are today. E-mail gateways, web gateways, they're just changing. And a lot of our consumerization models are forcing that. So whatever company gets to the other side and has a cloud and security-as-a-service model will win the next game. And so I believe that this company has put those pieces in place. And when you look at our trends, yeah, they're away from product, they're consciously away from product. We've built almost every form factor that we've developed from beginning now in virtual and cloud form factors in subscriptions and as a service, so that's the power I believe of the next generation company. And I think a lot of CISOs and security professionals around the world are just inundated with alerts, they inundated with vendors. The average company gets millions of alerts a day, has hundreds of security vendors, is drowning in these things and they're still getting breeched all the time. So how do we solve the next generation thing? I'm a big believer that this company is putting those pieces in place. I really believe most of those other vendors that you all track aren't. I believe this company is far ahead of them in the thinking of the next generation. And yeah, we're in a middle of a transformation as we go from product to product subscription, and from premise to cloud, but I think we're racing to it much faster than anybody else is doing. So, Kevin, you want to comment? You see this thing as much as I do.

[Kevin R. Mandia:]

Yeah. This has been a trend, Brent. And in my opinion, it's been happening for years. You saw firewalls came out. They couldn't do deep pack inspection, so you had IDS. And then, that missed everything all the time or you had to create rule sets and manage thousands of rules. And then FireEye creates this virtual execution engine that could detect with high fidelity. That was one trend on the network. People who get SIMs (01

[Brent Thill:]

Kevin? Kevin, I appreciate that view. I guess just from what we've seen the product component miss, where the Street numbers are at, so I guess just from a perspective of the guidance now, and I know Mike has left much more conservative guidance on product for the second quarter. But do you feel now that you've de-emphasized that a lot in the pipeline at least in the Street numbers now that that number is more accurately set now versus what we've had in the past?

[Michael J. Berry:]

Hey, Brent. This is Mike. Yeah, so I mean, look, as we talked about, this is – we felt good going into the year in terms of where we thought we were. We continue to see that evolution. What we've done for Q2 as we've looked at the pipeline, we've spent a lot of time with the sales team, the product team, understanding the new launches, what's in there, so we certainly hope that we set it at an appropriate number. We've done the best we can with the information that we have in front of us at this time.

[Brent Thill:]

Okay. Thank you.

[Michael J. Berry:]

Thanks, Brent.

[Operator:]

Thank you.

[Kate Patterson:]

I think we have time – just one more question, please.

[Operator:]

And our final question comes from the line of Saket Kalia of Barclays. Your line is now open.

[Saket Kalia:]

Hey, guys. Thanks a ton for fitting me in here, and congrats to all of you on the changes. One question for you, Mike. I think it's an important one, but based on the mix shift that we're seeing do we still expect profitability for all of fiscal 2018 and also still think about that 15% to 20% long-term operating margin, given the mix shift?

[Michael J. Berry:]

Yeah. So in terms of what we provided, Saket, for the long-term model, as I think you remember I baked in a pretty significant continued shift where product revenue would continue to decrease, as a percent. So, as we sit here today, we still feel good about it. I certainly don't have any different view of the operating margin. I still feel good about that. How fast it goes, when we get there. Is it 2017, 2018, 2019, 2020, we'll certainly have to take a hard look at it, but I don't have any reason now to have any doubt on the long-term operating model number.

[Saket Kalia:]

Got it. Very helpful. Thanks, guys.

[Michael J. Berry:]

Yes.

[David G. DeWalt:]

Okay. Well, thank you, everyone, for joining us on our Q1 earnings call today. I appreciate it. We'll look forward to seeing you again at some of the investor conferences coming up in the second quarter. And with that, Candice, thank you, and it concludes the call.

[Operator:]

Ladies and gentlemen, thank you for participating in today's conference. This does conclude the program, and you may all disconnect. Have a great day, everyone.