Mandiant, Inc.
Q4 2016 Earnings Call Transcript

Published: 3 Feb 2017

[Operator:]

Good day, everyone and welcome to the FireEye Fourth Quarter 2016 Earnings Results Conference Call. This call is being recorded. With us today from the company is Chief Executive Officer, Kevin Mandia; Chief Financial Officer and Chief Operating Officer, Mike Berry; and Vice President of Investor Relations, Kate Patterson. At this time, I would like to turn the call over to Kate Patterson. Please go ahead.

[Kate Patterson:]

Thank you, Candice. Good afternoon, and thank everyone for joining us on the call today to discuss FireEye's financial results for the fourth quarter of 2016 and full year 2016. This call is being broadcast live over the Internet and can be accessed on the Investor Relations section of the website at investors.fireeye.com. With me on today's call are Kevin Mandia, FireEye's Chief Executive Officer; and Mike Berry, Executive Vice President, Chief Financial Officer, and Chief Operating Officer of FireEye; Frank Verdecanna, Senior Vice President of Finance and Chief Accounting Officer is also with us in the room. After the market closed, FireEye issued a press release announcing the results for the fourth quarter of 2016 and the full year 2016. Before we begin, let me remind you that FireEye's management will make forward-looking statements during the course of this call, including statements relating to FireEye's guidance and expectations for certain financial results and metrics; FireEye's priorities, initiatives, plans and investments; FireEye's path to profitability; the expansion of FireEye's platform and the capabilities and availability of new and enhanced offerings, growth drivers, market opportunities and opportunities of partners, the evolving threat environment and management appointments and executive transition. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future as we undertake no obligation to update these statements after the call. For a detailed description of the risks and uncertainties, please refer to our SEC filings, as well as our earnings release posted a few moments ago. Copies of these documents may also be obtained from the SEC or by visiting the Investor Relations section of our website. Additionally, certain non-GAAP financial measures will be discussed on this call. We have provided reconciliations on these non-GAAP financial measures for the most directly comparable GAAP financial measures in the Investors Relations section of the website as well as in the earnings release. Finally, I'd like to point out that we have posted the supplemental slides and financial statements on the Investor Relations section as well. With that, I'll turn the call over to Kevin.

[Kevin R. Mandia:]

Thank you, Kate and thank you to all investors, employees and customers who are joining us on this call. We deeply appreciate your interest and your support. Before we go into the details, I want to say that I've never been more excited for FireEye. We've outlined a bold vision for our future and I believe we have all the ingredients we need to succeed. We have best-of-breed technology, world-class cyber security expertise and military grade threat intelligence. I would like to thank all of our employees. It is through your dedication and hard work that we have become the trusted company by most security conscious organizations in the world. Our mission is to relentlessly protect our customers from cyber attacks and based on your efforts, we do that better than anybody else. And we must never lose sight of this identity and purpose. We need to view our Q4 and 2016 results in the context of transitions that we are going through. And this includes the following transitions, from disparate products to a single platform, from an APT or advanced threat solution company to comprehensive prevention, from on-premise appliances to more cloud and hybrid solutions, from product revenues to subscription revenues. And as we manage our business through these transitions, we have maintained our focus on two significant priorities. The first priority is rightsizing our cost structure to support a balance of growth and profitability. And the second priority, evolving our product portfolio to a comprehensive security platform delivered as a service on-premise in hybrid environments or in the cloud. We made good progress on both of these priorities in 2016 and we remain committed to each in this year. I believe our dedicated pursuit of both profitability and innovation will result in growth and will enable us to fulfill our mission to our customers and it allows us to provide increased value to our shareholders. Now, I'd like to turn to our fourth quarter results. And I've structured by comments around two key topics. Q4 business highlights and actions we are taking now to deliver balanced growth and profitability in 2017. On the first topic, our Q4 results, our financial metrics show we successfully drove efficiencies across our organization. We narrowed our non-GAAP operating loss by more than $50 million year-over-year to an operating loss of only $1.4 million, or negative $0.03 net loss per share. We were also cash flow positive versus our expectations of negative cash flow of about $25 million. We have clearly accelerated our progress on the path of profitability and we are a much more efficient business today than one year ago. In fact, we almost achieved our goal of breakeven operating performance on a non-GAAP basis a full year ahead of our plan. There are many positive indicators that our business is strong and customers continue to turn to us as a trusted advisor and security partner. First, we responded to more security breaches in Q4 than in any prior quarter in our history. I've always believed that security innovation begins at the breach, and FireEye's Mandiant team owns that moment when an organization understands that it has in fact been breached. We get to witness firsthand how attackers evade other security safeguards and we continue to innovate to defend against these attacks. Second, sales of our unattached subscriptions were up more than 40% year-over-year. This includes our cloud e-mail security, FireEye as a Service and iSIGHT Intelligence. Revenue related to our cloud-based and cloud delivered solutions was up 60% year-over-year. Third, the number of transactions in Q4 was at an all-time high as existing customers expanded their deployments of FireEye technologies and we also added 330 net new customers. Fourth, we closed 34 deals greater than $1 million, including one of the largest FireEye as a Service deals in our history, and finally, we introduced multiple innovations with strong initial customer response. We formally launched Cloud MVX and Smart Grid in November and 22 customers purchased the Smart Grid private cloud upgrade or Cloud MVX in the quarter. Many of the Smart Grid transactions also included additional sensors that increased the overall value of the transaction. We introduced new hardware appliances aimed at midmarket customers as well, specifically the NX 2500 and NX 1500. Although these appliances were shipping for just about half the quarter, the NX 2500 was the second highest number of unit shipments for the quarter. While our improved efficiency and innovations were quite positive in Q4, our billings and revenue were below our expectations. For the fourth quarter, billings came in at $221.8 million compared to our guidance range of $230 million to $250 million. Revenue was $184.7 million, also below our guidance range of $187 million to $193 million. We had several internal and external factors that influenced our top line performance and let me step you through each of them. They relate to some sales leadership vacancies, sales capacity and lastly some targeted limited releases of our new products. First, despite great efforts by the sales team and our field organizations, vacant positions in key leadership roles had a significant impact on our Q4 results. As a reminder for you, most of the second half of 2016, FireEye had no head of worldwide sales, and no head of sales in Europe. We also underwent sales management transitions in the Middle East and Japan. I'm very pleased to announce, we have addressed all of these key sales leadership roles with top-notch professionals. Bill Robbins started as our Head of Worldwide Sales in November and Kevin Taylor starts next week as our Vice President in EMEA and we are very close to appointing our new leader in Japan. Second factor internally was sales capacity. Following our Q3 restructure we lost a number of fully ramped sales reps and this reduced our sales capacity during the fourth quarter. Now, historically, we have booked 30% to 35% of our business in the fourth quarter, so Q4 is the most impactful quarter to be down on sales capacity. In 2016, Q4 billings accounted for only 27% of our annual billings. Our new sales leadership has already taken steps to stabilize the field, increase productivity and ensure proper capacity, training and enablement in 2017. And a third internal factor was a decision to release several major innovations on a limited basis and focus on a set of targeted customers. These releases included new virtual appliances, Smart Grid, Cloud MVX and new endpoint features. These are all technologies that allow our customers to transition to hybrid and cloud infrastructures. A limited launch intentionally yields fewer opportunities but allows us to ensure early customer success and referenceable accounts. As a result of our limited release, we did not broadly advertise these new products or fully trained our field and partner organizations. Following our sales kickoff a few weeks ago, these innovations have now been fully launched and the entire sales team, as well as many of our partners have been enabled to take our new products to market. From an external perspective we continue to see perceived changes in the threat environment, less in the sense of urgency in some buyers. Although, we witnessed an increase in attacks from Russia and the emergence of many new threat actors, the size and scale of the breaches we are responding to remain smaller than those in our past. In this evolving threat environment, the sales motion is changing from a fear, uncertainty and doubt motion to one of evaluating the effectiveness of security solutions with an emphasis on the total cost of ownership of these solutions. Now we are making great strides responding to this shift in the buyer's mindset with our innovation and by pivoting our selling and marketing motions. We are focused on simplifying security operations through integration and automation and that will improve the total cost of ownership for FireEye products. Now, I would like to discuss the actions we are taking now to accelerate the transition to our new products while continuing to improve our operating model. These actions fall into three broad categories, our product strategy, our go-to-market strategy and organizational changes we have made and I'm going to speak to each one in turn. In product strategy, the first pillar of our product strategy is to deliver the best protection at a competitive price point. We believe the industry will continue to move towards cloud and virtual delivery models. Something we have been anticipating and working toward for the last two years. We released Cloud MVX in November along with five new virtual appliances and two new physical appliances. These new appliances are priced competitively and offer new channel incentives allowing us to expand our reach with current customers and it gives us access to the less security mature market segments. They also position us to execute on FireEye's first major refresh opportunity in 2017 and we conservatively estimate this refresh opportunity at more than $2 million this year. We also made significant enhancements on the endpoint with Exploit Guard, which offers both protection and prevention of attacks on Windows endpoints. And we have delivered our Mac OS agent (12

[Michael J. Berry:]

Great, thank you, Kevin. Good afternoon, everyone on the call. On today's call I will provide some additional color on our fourth quarter 2016 financial results including billings, revenue, gross margin, operating expenses and of course cash flow. I'll provide some details around our guidance for the first quarter 2017 and I will wrap up with some commentary on the CFO transition. As usual, when I go through our gross margin, expenses, operating income and EPS amounts, I will be referring to the non-GAAP measures. Okay, moving onto the fourth quarter 2016 results, as Kevin mentioned we exceeded our expectations for operating income, earnings per share and cash flow from operations. We continue to make great progress on our path to profitability, as we came within a few million dollars of being non-GAAP operating income positive in the fourth quarter 2016. We were also operating cash flow positive in the fourth quarter even with $14 million in cash payments associated with restructuring and non-recurring items. We ended the quarter with $935 million in cash and short term investments, more than enough to fund our innovation initiatives and future growth. The strength of our balance sheet is one of the many reasons I'm confident FireEye has a bright future. That said, we did come in a little short of our expectations for billings and revenue which was mainly driven by lower than expected product sales. Billings finished at $221.8 million, a year-over-year decrease of 14%, which resulted in a 3% increase for the full year 2016. Product billings declined by 50% and product subscription billings grew by 4%, both on a year-over-year basis. We saw a few trends in the quarter that are important to highlight. We were tracking on our expected billings linearity throughout most of the quarter but we saw several large deals failed to close, particularly in the last week of the quarter. Several of these deals had large product components which contributed to a greater than expected decline in product billings and revenue. We do not believe there is any particular pattern to the deal that didn't close in the fourth quarter in terms of specific products and the distribution was consistent with our overall product mix. We believe the majority of these deals were pushed into 2017 versus being lost. While we expect some of these transactions to close in the first quarter, some of these larger deals may also extend into the second quarter of 2017. From a geographical perspective, the largest shortfall relative to our expectations was in our Asia-Pacific region which we believe was largely related to the management challenges Kevin referenced in his comments. The shortfall in product billings resulted in lower than expected attached product subscriptions and support, even though renewals were strong. This resulted in a higher mix of renewals versus new business in the quarter than we expected. The growth in product subscriptions was mainly driven by growth in the unattached subscriptions, including ETP which is our cloud e-mail product, as well as a strong quarter from iSIGHT. Although we closed several significant FireEye as a service transactions in the fourth quarter, most of these were renewals. The strong renewal billings performance is certainly a good trend, but our new billings for this offering were below our expectations. From a metrics perspective, we completed 34 transactions greater than $1 million versus $47 million in the fourth quarter 2015 and total transactions grew by 8% on a year-over-year basis. We added 330 new customers and our average contract length finished at 24 months. The average contract length of 24 months was below the 27 months in the third quarter 2016 and 28 months in the fourth quarter 2015 largely due to a higher mix of renewals which have a lower average contract term than new business. We did not complete any transactions greater than $10 million in the fourth quarter and our customer renewal rate was over 90%. Our subscription and support billings performance resulted in a $37 million increase in deferred revenue from September 30. On a year-over-year basis, total deferred revenue increased by 24%, or $127 million to finish at nearly $654 million as of December 31. Total revenue finished at $184.7 million, basically flat on a year-over-year basis. Product subscription revenue grew by 43% and support revenue by 27%. These results reflected the strong growth in deferred revenue we've posted in prior quarters, as our model shifts to a higher mix of subscriptions. Recurring subscriptions and support accounted for 64% of total revenue in the fourth quarter and 62% for the full-year 2016. As I mentioned last quarter, we continue to see an increasing portion of our revenue coming from products that are delivered from the cloud or in the cloud. For the fourth quarter 2016, over a third of our total revenue was delivered from the cloud or in the cloud. This cloud related revenue increased year-over-year by over 60% in the fourth quarter 2016. Okay, now let's move onto our cost structure. Our cost of goods sold came in close to our expectations with our total gross margin of 74%. Product margins of 64% were lower than expected due mainly to the lower absolute level of product billings, but this decline was largely offset by stronger than expected support and services gross margins of nearly 77%. We have launched several initiatives to manage product COGS going forward including aggressive inventory management, a focus on reducing lead-times, and vendor and supply chain management. An example of these initiatives is that as a part of the hardware refresh currently underway, we are reducing the number of hardware SKUs by half and the number of platforms by a factor of 70% from 22 down to 6. Similar to the third quarter 2016, the big story in the fourth quarter 2016 was our lower than expected operating expenses. Total operating expenses finished at $138.7 million which was well below our implied guidance and more than $50 million below the same measure for the fourth quarter 2015. This reduction is even more impressive when you consider the added expenses of the iSIGHT and Invotas acquisitions, which both closed in the first quarter 2016. Certainly, we saw the benefit of the third quarter restructuring program roll into the fourth quarter, but expenses were even lower than our expectations mainly from three areas. One, lower salaries and benefits as total head count finished at 2,921, or almost 100 heads lower than the end of the third quarter. Two, sales commissions which were much lower than last year due to lower than planned billing, a higher mix of renewals versus new business and a one-time $15 million benefit in the fourth quarter 2016. This mix impacted the overall commission rate since renewals are commissioned at a lower percentage than new business. And three, lower overall spending across the rest of the company as we continued to benefit from the efficiencies that resulted from the restructuring activities. Even excluding the one-time benefit of lower sales commissions, operating expenses were still lower than the fourth quarter 2015 by over 20%. We have been targeting non-GAAP operating income profitability by the end of 2017 and we are very pleased to have come close to this goal almost a year earlier than planned. Everyone at FireEye played a role in achieving this and should be proud of our progress on the path to profitability. Our much lower than expected expenses resulted in non-GAAP operating loss of approximately $1.4 million, or negative 1% of revenue versus the midpoint of our guidance range of negative 12% of revenue. This translates to a decrease in operating losses of more than $25 million on a sequential basis versus the third quarter 2016, and $51 million from the fourth quarter of 2015. This resulted in a non-GAAP loss per share of $0.03 versus our guidance range of $0.16 to $0.18 and a loss per share of $0.36 in the fourth quarter of last year. This is the best operating margin and earnings per share performance in the history of FireEye. Okay. Let's move on to our fourth quarter 2016 cash flow results which were also quite a bit better than our expectations. We generated positive cash flow from operations of approximately $7 million and free cash flow of negative $1 million in the fourth quarter 2016. Included in the cash flow from operations were cash payments of $8 million from restructuring activities and $6 million from the payout of our PTO balance in the U.S. Adding back this $40 million of cash flow from operations would have been approximately $22 million in the fourth quarter. Please see slide number 21 in our financial presentation for more detail on this reconciliation. Sometimes it's hard to say two words with S's in them. Similar to the third quarter 2016 results, we exceeded our cash flow expectations mainly due to strong collections of in quarter billings and also our lower-than-expected expenses. The strong collections performance resulted in a quarter end receivables balance of $121 million, slightly lower than the receivable balance as of September 30. Our days sales outstanding, as measured by billings, came in at 50 days. Okay, let's move onto our guidance. Although our fourth quarter results were impacted by multiple factors, it is clear our subscription business is growing faster than the on-prem appliance business. With the many new cloud and virtual product introductions, new sales leadership and other management transitions, as well as an increased emphasis on channel partners, we have decided to differ on providing annual guidance until later in the year. We are planning on rescheduling our Analyst Day and anticipate that we will provide a 2017 outlook at that time. Thus, we will be providing detailed guidance for the first quarter 2017 only, although, I will make some qualitative high-level comments about 2017 in a few moments. At this time, we still believe we will be able to achieve our objective of non-GAAP profitability in the fourth quarter 2017 and we expect to generate positive operating cash flow for the full year. Before going through the first quarter 2017 guidance, I would like to make some high-level comments about 2017. While we are not providing formal detailed guidance for the full year, we do expect to show improving top and bottom line performance as the year progresses. By the second half of 2017, we expect that growth from our new innovations including Helix, Cloud MVX and Cloud HX should begin to contribute meaningfully to billings. Because these are all sold on a subscription basis, the impact will be evident in billings and deferred revenue before rolling through revenue. From an operating expense perspective, we expect that the fourth quarter 2016 expense level after adding back the $15 million impact of lower commissions will be the new run rate for the year. We expect that the first and fourth quarters will be above the fourth quarter 2016 run rate due to the seasonal factors we've discussed and the second and third quarters to be slightly below that same run rate. We currently expect to generate positive operating cash flow for the year even though cash flow will be impacted by our billings and expense performance, as well as the historically low level of receivables entering the year. Keep in mind also that our operating cash flow in 2016 included approximately $50 million in cash payments that we do not expect to recur in 2017. Let's move onto the first quarter 2017 detailed guidance. First on billings, we are currently expecting that the trends we saw in the fourth quarter related to product billings and the associated impact on subscription and support will continue into the first quarter 2017 and we are guiding the billings in the range of $130 million to $150 million. While at some point in 2017, we expect that the "law of lower numbers" will help with the year-over-year percentage changes, given the product pipeline entering the first quarter and the lower conversion of the pipeline in the fourth quarter, we are currently expecting product billings to continue to decline by approximately 50% in the first quarter, which is consistent with the year-over-year percentage change in the fourth quarter 2016. Also keep in mind that we will anniversary the iSIGHT and Invotas acquisitions in the first quarter, which will impact the year-over-year growth specifically in product subscriptions. Moving on to revenue. We currently expect revenue in the range of $160 million to $166 million and that product revenue will mirror the expected growth profile for product billings. We expect the combination of our recurring subscription and support revenue to continue to show year-over-year growth in the first quarter with an increase of approximately 12% reflecting the historical growth in deferred revenue resulting from the higher mix of subscription and billings. Please keep in mind the anniversary of the iSIGHT acquisition. We noted on our first-quarter 2016 earnings call that iSIGHT contributed $9 million in product subscription revenue in the first quarter 2016. Professional services revenue is expected to be relatively flat on a year-over-year basis. Before switching to the bottom-line view, I do want to note that largely due to the expected ramp in the second half from our newer products and the addition to the sales leadership team, we do expect our quarterly billing seasonality to be more similar to what we experienced in 2015 versus 2016. As I mentioned on the third quarter 2016 earnings call, we do have some significant expenses that come back into the cost structure in the first quarter 2017 as we have several larger events that fall into the first quarter including Momentum and RSA. As a result, we expect non-GAAP operating expenses to increase on a sequential basis from the fourth quarter by approximately $15 million. However, as operating expenses are expected to decline by more than $35 million from the first quarter 2016, we expect continued operating leverage to result in non-GAAP operating margins of between negative 24% and negative 26% in the first quarter versus negative 44% in the first quarter of last year. We expect weighted average shares of approximately 172 million and a loss per share in the range of $0.26 to $0.28 versus a loss of $0.47 in the first quarter of last year. Lastly, as it relates to cash flow from operations, I discussed earlier that we significantly exceeded our collections forecasts in the fourth quarter 2016 largely as a result of higher than expected collections of in-quarter billings. As a result, we are entering into the first quarter 2017 with an accounts receivable balance of $121 million, which is more than $50 million below the same measure entering into 2016. Additionally, please note that the accrued liabilities balance as of December 31, 2016 includes approximately $41 million related to the iSIGHT earnout which was achieved in the fourth quarter and we expect to pay this amount in cash during the first quarter 2017. Of the $41 million, approximately $38 million will flow through the investing section of the cash flow statement and the remaining $3 million will hit operating cash flow. Adding all that up, we currently expect cash flow from operations in the first quarter to be between negative $30 million and negative $40 million versus negative $22 million in the first quarter 2016. Okay, let's recap the guidance expectations for the first quarter 2017. We currently expect billings to be between $130 million and $150 million. We currently expect total revenue to be between $160 million and $166 million. We currently expect gross margins of approximately 70%. For operating expenses, we are forecasting total non-GAAP operating expenses of between approximately $152 million and $156 million, which yields non-GAAP operating margins between negative 24% and negative 26%. All of this adds up to a loss per share of $0.26 to $0.28 assuming approximately 172 million shares outstanding. And finally, we expect reported cash flow from operations to be between negative $30 million and negative $40 million. In closing, I do want to take a few minutes to discuss the announcement that I'm leaving FireEye to take another CFO role. While this has been a very difficult decision, I feel it is the right time to take another position that aligns better with my personal and professional goals and that I truly feel is a once in a lifetime opportunity. While it is never a good time to announce a CFO change, I feel very good about the progress we have made over the past few years, especially related to our discipline and focus around cost management as we continue our march on the path to profitability, as well as our focus on the importance of generating cash flow. I feel I'm leaving FireEye with a strong financial foundation and I have absolute confidence in Frank and the management team's ability to make further strides on the path to profitability. I do want to take the opportunity to thank the people who have been such a big part of my time at FireEye. To all the employees of FireEye, the operations teams that I was proud to lead and especially the great accounting and finance team, thank you for doing just a wonderful job with an amazing culture of teamwork. I want to thank the management team and the board of directors for supporting me in my role at FireEye, especially the audit committee for your dedication, support and great counsel. I have had the great pleasure to work with Frank over the past few years and I am very confident that under his leadership the FireEye financial future is in very good hands. To Kevin, I have really enjoyed working for you and have nothing but the utmost respect for you as an expert in cyber security, but more importantly, as a person. You are one of my role models of a leader who has amazing passion for the business, but also an incredible amount of integrity. And lastly to Kate, you have been recognized by a lot of folks on this earnings call as one of the best IR professionals in our industry. I can only say that the recognition is very well deserved because you are truly a great IR professional and I thank you for all of your support and wonderful assistance. And to all the investors and analysts on the call, I sure hope our paths cross again in the future. Okay, with that, thank you for your time. And, Candice, we are now ready for Q&A.

[Operator:]

Thank you. And our first question comes from Gur Talpaz of Stifel. Your line is now open.

[Gur Talpaz:]

Sure. Thanks. And first off, I was hoping you'd walk the mechanics of the Q1 billings guide. What's been factored in here as it relates to various moving parts? You talked about product billings, so what about the other pieces within that line item? Then taking it one step further here, you noted an expectation for renewed (43

[Michael J. Berry:]

Hey, Gur, it is Mike. I will start it and then I will hand it to Kevin. So, specifically on Q1 and really for the first half, we have not baked much into the billings expectations for the newer products. I think the one thing that we learned especially last year, and I learned very specifically, is to not be, shall we say, overoptimistic on the ability for newer products to get out into the sales force more importantly once they build into pipeline, progress through that and get to close deals. So what we're really saying is for the first half, we're not going to bake a lot for the newer products. We do expect product billings, as I noted to be down again approximately 50%. I know we've been kind of chasing that number down. At this point, sometime in 2017 we think that percentage will start to modulate a little bit. And then of course, with the product revenue being – if it declines by 50% you do get the accompanied tax subscriptions and support that go with that. Services we expect to be pretty consistent with what we've done, and if we think it's going to be relatively flat in the first half, billings should be as well. So that's the first half. The part about the second half is, again, confidence in being able to reinvigorate growth based on the new solutions. Kevin also talked about we're excited about HX and gosh darn, we expect Mr. Watters in his Texas cowboy boots to get that FaaS business growing as well. So with that, I'll hand it to Kevin for more detail.

[Kevin R. Mandia:]

Yeah, Gur. I wrote down, given the transitions, we don't want to lean forward too much in our guiding here, and I've guided in my opinion conservatively. When I look at 2017, I want to stress we needed new sales leadership. We have that team in place now, and they've only been here about a month. So I didn't want to lean too forward there. We have a lineup of a lot of new products and I know you've personally seen them and the interest in Helix, but we've got to give these products time to develop the pipeline, get our sea legs under and moving them. But when you look at our new products, our channel excitement and our interest in Helix, the campaigns we're doing, the $200 million refresh opportunity that we're laser focused on, and new sales leadership and John Watters taken that role, all those things that's good inertia, that's the right things, but again, we didn't want to lean too forward in the guide.

[Gur Talpaz:]

Yeah, that makes a lot of sense. And Kevin, maybe walk us through some of the feedback you've gotten initially here for Helix and also for Cloud MVX. You've done a lot in terms of product roadmap and any color there would be really helpful.

[Kevin R. Mandia:]

Yeah, I think for a lot of folks on this call you don't know how hard it is to replicate what we've built with Helix, but it is really hard. We are responding to breaches every day. We see how other safeguards are circumvented and with the visibility we have on the network, on the endpoint, and with our threat intelligence bringing all that visibility in situational awareness together, our products update all the time. We innovate all the time based on what we see. And you bring Helix to market, it really is a technology and a platform that gives you network visibility, endpoint visibility, and it empowers anybody who is looking at the alerts generated to leverage all the intelligence we have from the breaches we respond to, the 230 threat analysts in 19 different countries speaking 32 languages. That is a hard thing to replicate. And I sometimes refer to our threat intelligence as kind of like the Bloomberg terminal, but it's even more than that for cyber security because the information we have is not publicly available. It is hard to get and you don't always want to when you have an alert have the only tool at your disposal, let's just Google and see what the Internet knows and get a bunch of blanks. This is a tremendously powerful platform, I hope that all of you can come and see it at RSA and it's something that integrates all our technologies into one place. It's fantastic. We've just got to get it out there. We've got to train our folks on it. We've got to get momentum behind it.

[Gur Talpaz:]

That's good color, Kevin. Thanks a lot. And, Mike, thanks for all the help over the years. It's been a great pleasure working with you.

[Michael J. Berry:]

Gur, you too. Thank you very much.

[Gur Talpaz:]

Thank you.

[Operator:]

Thank you. And our next question comes from Andrew Nowinski of Piper Jaffray. Your line is now open.

[Andrew James Nowinski:]

Okay. Thanks for taking the question. I apologize for all the background noise here, but I had a question on the deals that pushed. I guess if we look back and what we've seen so far, Check Point, Symantec, Fortinet, all put up solid quarters and they weren't impacted by any deals pushing out. So just wondering if you could provide any insight on why your customers might be delaying some deals and in some cases for more than one quarter and whether it was related to your restructuring you did in Q3.

[Michael J. Berry:]

Yeah, so, Andrew, it's Mike. As we talked about, we couldn't really figure out a specific pattern in terms of why. It was across a good number of the regions, although I did mention Asia Pacific came a little bit short. I think a lot of it relates at the end of the day to the focus that we were providing and really the lack of sales management. I think that's where those come in to make sure that those land. We felt good about the pipeline. It was tracking all along and we just got to the end of the quarter and some of those ended up pushing. Now we've closed a handful of them already, but we do expect some of them to probably push into the second quarter. And, again, it wasn't any specific product or any specific trend in those, but it was very, very different in terms of the way we saw the last month or the last week of the quarter behave. It had never behaved like that in certainly the three years as we look at our data.

[Andrew James Nowinski:]

Okay, got it. And then I understand you're not providing guidance for 2017, but if you look back at 2016, you went through a big product transition, the virtual solutions, you didn't have Cloud MVX, you didn't have a head of sales for most of the year. So given all the changes that you've – and the other ones that you mentioned, do you think your platform revenue can grow at least in line with the 11% you just did in 2016?

[Kevin R. Mandia:]

So, keep in mind – well, so this is where I think the – as I referenced in my script, the law of smaller numbers comes in. If products revenue continues to drop in terms of what it is, that has a big pull down on the platform revenue. What we have really talked about is even with product coming down, we still have been able to grow our product subscriptions. So, hopefully, we can continue to grow that platform revenue numbers. The biggest driver to that I believe, Andrew, will be the unattached subscriptions. How fast can we grow FaaS? ETP continues to be one of our best products and it's getting to be product of scale. That's important and, of course, iSIGHT as well. So my answer to that would be without providing a specific number, I think the linchpin to be able to get that thing growing again from a platform perspective is the unattached subscriptions, because from a percentage growth perspective, product just gets to be a smaller portion every quarter. It's less than 20% of the revenue this quarter.

[Andrew James Nowinski:]

Okay, thanks a lot. Nice working with you, Mike

[Michael J. Berry:]

You too, Andrew.

[Kevin R. Mandia:]

Hey, Andrew.

[Operator:]

Thank you. And our next question comes from Saket Kalia of Barclays. Your line is now open.

[Saket Kalia:]

Hey. Thanks for taking my questions here. And Mike, congrats on the move. Sorry to see you go.

[Michael J. Berry:]

Thank you.

[Saket Kalia:]

So just first for Kevin. It feels like you're cleaning up so much on the product and pricing front, but that third P in terms of people just, specifically salespeople, should we think about you backfilling some of that sales capacity or do you expect to really lean on the channel a lot more to replace some of that sales capacity lost in 2016?

[Kevin R. Mandia:]

Well, we're going to do both. So we've got the docket open. We want to hire unique account reps. We want to bring them into this company, we want to train them on our products and get them working for us. And at the same timeframe, we know we can do a better job working with our channel. And that's why I said we're going to train our channel, we're going to give them tools, and we're going to give them the techniques, and we're going to give them our new products. So both of them, obviously, we're looking at balancing growth with profitability, but we're doing both.

[Saket Kalia:]

Got it. Got it. And as my follow-up, Mike, can you just remind us if some of those new products like Cloud MVX and Smart Grid are now generally available? I know that they had limited availability during the fourth quarter. But are we now fully available? And then as those ramp, will that be a pure benefit for the product subscription line or is there going to be some splitting apart that happens?

[Michael J. Berry:]

Yeah. Great question. So MVX and Cloud MVX are generally available. They are being sold. Cloud HX will be this year, so it is not as of yet. And we kind of walked through this, Saket, at your conference is for Cloud MVX, yes, that will be product subscription, for Cloud HX as well. A good bit of Helix will be as well. For the MVX portion to the extent, and those will always have some product appliances. You will hopefully see some of that flow through product as well. But the majority of the new products are going to flow through product subscription, Saket.

[Saket Kalia:]

Got it. Very helpful. Thanks, guys.

[Kevin R. Mandia:]

Thank you.

[Michael J. Berry:]

Thank you.

[Operator:]

Thank you. And our next question comes from Melissa Gorham of Morgan Stanley. Your line is now open.

[Melissa A. Gorham:]

Great. Thanks for taking my question and, Mike, best of luck and congratulations to Frank.

[Michael J. Berry:]

Thank you, Melissa.

[Melissa A. Gorham:]

I just wanted to follow-up, Kevin, on your comments on the refresh opportunity. I'm just wondering if you could maybe elaborate on what exactly is up for refresh. And then assuming you have seen some activity, what are you seeing in terms of customer buying behavior when that stuff comes up for refresh?

[Kevin R. Mandia:]

Yes. So first, you heard from Mike, we have over 90% renewal rate on our products, but specifics were, there were somewhere in the neighborhood of about 6,000 appliances that when we looked at 2017, folks have subscription renewals for those appliances or in fact a hardware refresh for those. And so we've recognized we've got so much new capability, so many new form factors, and these things – we held them in the four walls of FireEye right up until November. We need to get back into our installed base and show them there's an easy path to migrate at a better value, both in the form factors, the throughput we can handle, and then the additional features that we have. So we're going to do a targeted campaign on that. Most people don't realize how many – when people hear MVX, they think, 'Wow, they do dynamic inspection or sandboxing.' There's over 200 patents pending or granted already in what we do there. There's machine-learning capabilities, there's dynamic inspection, there's so much more that we do, and we need to get back into our installed base and give them that value. So we're doing that very – in my opinion, when you look at the FireEye, 2012 to now there's been such tremendous growth. That's why I referred to this as this is our first real big refresh opportunity. When you look at the sales in 2012 or 2013, the ramp was exceptional and we get the benefit from that. And with that 90% plus renewal rate, I'm confident better value, more features, better form factors, new sales leadership, better enablement, all this going together gives us tremendous momentum during those opportunities.

[Melissa A. Gorham:]

Okay, thanks. And just one quick follow-up. In terms of the new head of worldwide sales, it's great that you have someone onboard. And I know he's relatively new, but do you anticipate any major changes that he's going to make to the sales force? And how are you thinking about potential disruption? How that factors into the outlook for 2017?

[Kevin R. Mandia:]

That's a good question. So, first and foremost, I want to make sure that our sales force is the best trained and most enabled sales force on the planet in regards to what we do. We innovate so fast here that's actually been complex. Our engineers come up with something, they show it to me, I go that's amazing. Now you got to be able to scale that and get it through the NPI process, get it to the sales team, get them trained. And I feel that we're just going to have better discipline and rigor on how we do that now. So we're going to be faster to market with our innovations. I think that we've always had the opportunity to be more clear with our partners, to go deeper with our partners, and I'm going to look to build and continue to improve that as well. So I see those two changes. Better sales enablement, faster to market with what we've done, and at the same timeframe more productivity and leverage from the channel.

[Melissa A. Gorham:]

Okay. Sounds good. Thank you so much.

[Kevin R. Mandia:]

Thank you.

[Operator:]

Thank you. And our next question comes from Sterling Auty of JPMorgan. Your line is now open.

[Sterling Auty:]

Yes, thanks. Hi, guys. You talked about the 90% renewal rate on subscriptions, but I'm curious. You mentioned the 330 net new customers. Can you talk to us about customer retention or customer churn rather than product renewal?

[Michael J. Berry:]

Yes, hey, Sterling, it's Mike. As we talked about in the past, the 90% that we've disclosed going way back is actually a customer retention rate, so it is a trailing 12-month customer retention rate. It is not specific product. So that says, did you have a customer at that time and do you still have them. And that is a measure that we've provided consistently, Sterling.

[Sterling Auty:]

And then just as a follow-up, as you go through the refresh cycle, Kevin, that you talked about, what's the sense in terms of people trading in physical for more virtual versus layering on incremental virtual on cloud to what they already have?

[Kevin R. Mandia:]

That's a good question. First and foremost, if they have hardware, they can upgrade it to our new virtual appliance and it's going to get better throughput. It depends on the circumstances of those folks and how they want to do their business. With the virtual they can get potentially greater reach. They may want to buy some of our newer appliances. It's pretty early to tell, so, Mike, I don't know if you have other thoughts on that, but right now from what I've observed, I don't see a pattern yet.

[Michael J. Berry:]

Yeah, and I think the key there, Sterling, is if they want to stay on-prem, certainly they can upgrade to the box. And as I talked about, we are going through a hardware upgrade cycle. So we'll have better throughput there as well. The virtual side gives them the chance, as we've talked about, to really expand our presence within them as well. So we look at a lot of those as net positive, which is why Kevin talked about how important that refresh and upsell really into our base is.

[Sterling Auty:]

Got you. Thank you.

[Michael J. Berry:]

Thank you.

[Operator:]

Thank you. And our next question comes from Ken Talanian of Evercore ISI. Your line is now open.

[Ken Talanian:]

Hi, guys. Thanks for taking my question. Just another way to think about your renewal rate. I was wondering, could you give us a sense of what the dollar value of attrition you're seeing? And then, what gives you confidence that your recurring revenue stream from existing clients is sustainable?

[Michael J. Berry:]

Yes. So I'll take those in order. So Ken, it's Mike. We do not disclose the renewal or the dollar churn rate. What we've always talked about is the customer renewal rate and we're going to stick with that. As you look at the existing customer base, and even though billings in Q4, when you take a look at product and product subscription, you see a little bit of difference. We have, in the past, been able to continue to drive additional product subscription in the base through upsell and cross-sell and that is offering new opportunities. ATI, which is our Advanced Threat ATI+, and I would encourage you to look at one measure and actually everybody on the phone. We haven't talked too much about it, but the numbers are there and available for you. If you take a look at our subscription and support billings on a quarterly basis and you divide it by the total average contract length, that's going to give you MRR, right, monthly recurring revenue. That actually increased year-over-year by 15% this quarter. And so as you look at that, we do the majority of our business still with our existing customers. We'd love to, obviously, sign more new. But FireEye has really done great within its space and that's cross-sell, upsell. It is new deployments, it's additional expansion, it's additional products on top of them. So you can see that every quarter, Ken, in terms of how we're doing in that subscription and support line, that very important revenue stream.

[Kevin R. Mandia:]

Yeah. And, Ken, just to give you some specifics. So we launched the on-prem version limit in Q3, the Cloud MVX was Q4. We've only got 22 deals so far, which I think is great, and they all show uplift. And the subscriptions renew when you upgrade to these new form factors. So we've got the uplift there so far and we'll keep an eye on it.

[Ken Talanian:]

Okay, thanks.

[Kevin R. Mandia:]

Thank you.

[Operator:]

Thank you. And our next question comes from Shaul Eyal of Oppenheimer. Your line is now open.

[Shaul Eyal:]

Thank you. Hi, good afternoon. Thank you for taking my question. Kevin, question on iSIGHT.

[Kevin R. Mandia:]

Yes.

[Shaul Eyal:]

Are the opportunities you're seeing are all greenfield or are you seeing some displacing opportunities as well?

[Kevin R. Mandia:]

Yeah, it's both. At the end of the day, iSIGHT – what I've seen and you can see this in our Microsoft partnership that we had, for the security mature conscious organization, they love having the iSIGHT threat data and the iSIGHT context to it. Mike, you might be able to speak to more the details on the specifics. But I've got a unique view on it because when I'm out meeting with customers, it's usually a $1 million deal, and I have almost (1

[Michael J. Berry:]

Yeah. Hey, Shaul, it's Mike. I think the one thing is we see not only good renewals in iSIGHT, the renewal rate that we expected when we did the acquisition came in quite close to where it ended up. We also are starting to see a lot more of the inclusion of iSIGHT in other deals. Some of those are existing customers, but some of those are new as well. So we see both of that. I do think iSIGHT probably will be similar in terms of a mix in terms of new versus existing as the current base that we have at FireEye, which again, the majority of that is through our existing base.

[Shaul Eyal:]

Got it. Maybe just as a follow-up, Kevin, really looking at a high-level view here, how do you think about unlocking shareholder value here near-term? Is it strictly through continued operational improvement or would you consider some additional options?

[Kevin R. Mandia:]

Right. We're a public company and at the end of the day, we'll always do what's best in regards to our fiduciary duty. And that's how I approach that. It's my role to make sure we build the best innovation we can, that we are capable to operationalize it and sell it, that we have the best services possible that our customers want. And at the end of the day, I think if you're the best security company, you've created tremendous shareholder value.

[Shaul Eyal:]

Got it. Mike, it was a pleasure working with you. Good luck going forward.

[Michael J. Berry:]

Thanks, Shaul. You as well.

[Kate Patterson:]

I think we have time for one more question.

[Operator:]

Thank you. And our final question comes from the line of Walter Pritchard of Citi. Your line is now open.

[Walter H. Pritchard:]

Hi. Thanks. Question for Kevin. You talked about the refresh here and there is quite a bit of consolidation in the industry and I'm wondering is how do you balance the opportunity on the refresh with making sure that you've got the firewall vendors and so forth offering some of your functionality as add-ons? What is the strategy there around making sure you get your refresh but also defend your base from what's some more pressure in the industry?

[Kevin R. Mandia:]

First off, you start with the good enough versus what I consider best in the business at it. And when you look at the amount of breaches we respond to, the intelligence we have, people know, in my opinion, that we have better detection. But also we have features that are coming into our network sensors that are also working with our endpoint, also working with our intelligence in ways that it will be hard for perimeter firewall companies to actually replicate. They may just pop a little sandbox onto their firewall, but we've gone way beyond the sandbox. We've got – again, I always talk about we have heuristics, we have machine-learning capabilities, we can be in line, we can send expertise when you need it most, we are coming up with a new interface for all our products that makes it seamless to get our context and our intelligence right onto the dashboard with the alerts, because a lot of people just sit there and say, "Yep, we've got 4 billion alerts. What are the five that matter today?" And then we're working hard to get what I call the click-to-chat feature into this. I don't see a single firewall company being able to replicate that, which is does this damn thing matter? Is this malware? What is this? Who normally uses it? What should I worry about? What are the countermeasures? This is a full-service. I always say this, we're Patrick Wahl and goal (1

[Walter H. Pritchard:]

And then just a question for Mike on the cost side. It sounds like you've positioned the performance here as something where there was some sales – some sales halts (1

[Michael J. Berry:]

Yeah, so Walter, it's Mike. So as I talked about, we're really looking at Q4 2016. Once you add back the commissions that we were able to take the credit for in Q4 for what we had expensed throughout the year. When you look at that in Q1, at that point, what we're saying is that is the new run rate. We're comfortable with where we are from an expense perspective. Now as we go through the full year, we've talked a lot about – the next step is the reallocation of expenses versus the reduction of them so that we are really funding the growth areas. And as I said, it's really hard to do a restructuring, but it's sometimes even harder to really allocate those expenses and move money between groups, and that's really the focus now versus reduction, Walter, is how do we make sure to fund growth areas and some of the areas that aren't growing, they are just not going to get as much investment, but all kind of within that same envelope of expenses as we go through 2017.

[Walter H. Pritchard:]

Okay. Thank you.

[Michael J. Berry:]

You're welcome.

[Operator:]

Thank you. And that concludes our question-and-answer session for today. I'd like to turn the conference back over to Kevin Mandia for closing remarks.

[Kevin R. Mandia:]

Well, I just want to say thank you to all of you for your support, and I look forward to providing regular updates on our progress in the future. Thank you.

[Michael J. Berry:]

Thank you.

[Operator:]

Ladies and gentlemen, thank you for participating in today's conference. This does conclude the program, and you may all disconnect. Have a great day, everyone.