Mandiant, Inc.
Q3 2015 Earnings Call Transcript

Published: 5 Nov 2015

[Operator:]

Good day, everyone, and welcome to the FireEye Third Quarter 2015 Earnings Results Conference Call. This call is being recorded. With us today from the company is Chairman and Chief Executive Officer, Dave DeWalt; Chief Financial Officer, Mike Berry; and Vice President of Investor Relations, Kate Patterson. At this time, I would like to turn the call over to Kate Patterson. Please go ahead.

[Kate Patterson:]

Thank you. Thank you all for joining us on today's conference call to discuss FireEye's financial results for the third quarter of 2015. This call is being broadcast live over the Internet and can be accessed on the Investor Relations section of FireEye's website at investors.fireeye.com. With me on today's call are Dave DeWalt, FireEye's Chairman of the Board and Chief Executive Officer; and Mike Berry, Senior Vice President and Chief Financial Officer. After the market closed, FireEye issued a press release announcing the results for the third quarter of 2015. Before we begin, let me remind you that FireEye's management will make forward-looking statements during the course of this call, including statements relating to FireEye's guidance and expectations for the fourth quarter of 2015 and the full year 2015; growth drivers, market opportunities and opportunities with partners; customer demand for and adoption of FireEye's products and services; growth in FireEye's business and ability to gain market share; changes in the threat landscape and the security industry; FireEye's competitive position in the market; FireEye's path to profitability; and FireEye's continued innovation and new offerings. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future. And we undertake no obligation to update these statements after the call. For a detailed description of the risks and uncertainties, please refer to our SEC filings as well as our earnings release posted a few moments ago to our website. Copies of these documents may be obtained from the SEC or by visiting the Investor Relations section of our website. Additionally, certain non-GAAP financial measures will be discussed on this call. We have provided reconciliations on these non-GAAP financial measures for the most directly comparable GAAP financial measures in the Investor Relations section of the website, as well as in the earnings release. With that, I'll turn the call over to Dave.

[David DeWalt:]

All right, Kate. Thank you very much. Good afternoon, everyone, and thank you for joining us today to discuss our Q3 2015 earnings results. Before I get started, I'd like to formally welcome you, Mike. Mike Berry, who joined us in mid-September here as our new CFO. This is his first earnings call with FireEye, but I think many of you know him from his days at Informatica and Solar Winds. Mike brings us just tremendous experience as a public company CFO, and he's already demonstrated just outstanding leadership and operational skills. I'm just very thrilled to have you Mike. Welcome to the team. All right. 2015 has been an incredible year for FireEye, and before I go into the details of Q3 specifically, I'd like to highlight some of the progress we've made in the first nine months of the year. First of all, we've made huge strides overall as a company, in my opinion, both in the breadth of our platform and the depth of our install base, which I believe sets us up for years of continued growth and market share gains. Specifically in the first nine months of the year we grew our top line billings 43%, our revenues 55%. We added more than 800 enterprise customers. We launched multiple innovative new strategic partnerships. And we responded to nearly every breach that mattered. And of course we took some major steps towards building the industry's first comprehensive global threat management platform, which can detect and respond to threats across all major attack vectors including endpoint, network, and cloud. The accomplishments of the past nine months as well as the last few years really secure FireEye's position in the elite group of technology disruptors that are changing the world. We've been the vanguard of our industry and our tireless efforts on cyber threat research, detecting the undetected, and naming major adversaries publicly is helping shape the threat landscape. I also believe our success in protecting customers has been a contributing factor to the new global peace treaties, cyber peace treaties, between superpowers such as the U.S., China, the UK, and Germany. I'm extremely proud of our people, our platform, and our company, as well as our role as industry leader in the war against advanced threats. I want to thank all of our employees sincerely for their dedication and hard work, and our partners and our customers for their continued support and trust. I believe the best is yet to come and I look forward to making the journey together. Okay. So let's turn to the highlights of our Q3 performance. Overall, we delivered solid results with revenue up 45% and non-GAAP operating margins and earnings per share well ahead of our outlook. We also demonstrated excellent working capital management and cash flow performance, ending the quarter in extremely strong financial position with nearly $1.2 billion in cash and investments. Clearly our overall business model is creating leverage for the business. While there were many indicators of continued strength in our results, such as growth in our new logo business, higher transaction volumes, multi-product platform sales, and growth in number of deals over $1 million, our billings performance fell short of our expectations and the guidance we set in late July. The shortfall, which was primarily the result of weakness in Europe, shorter contract lengths in the U.S., and lower average deal size in our large enterprise transactions. We began the quarter with strong momentum, and our linearity was consistent with historical trends in July and August. However, several factors converged to cause some weakness in our top line billings results. Europe, which has always lagged the U.S. in the adoption of advanced security technologies, was particularly weak. Growth in Europe has been below that of our total company for several quarters and we attributed this to the relatively young field organization we have, the strength of the dollar relative to European currencies, data privacy concerns, and economic turmoil in some of the regions. In prior quarters, slower growth in Europe was offset by our over-performance in other regions, particularly the U.S., which continue to drive our growth rates. Our European performance improved in Q2 and we have every reason to believe that we'll continue to move up the productivity curve in Q3. However, in Q3 the macro factors impacting our European business worsened and our Europe team missed their targets by a significant amount. At the same time in the U.S. contract lengths shortened and the average size of $1 million plus transactions declined. As a result, our North American region posted more inline billings performance than we experienced in quite a while. The net result was a shortfall in billings relative to the midpoint of our guidance range of about $20 million. As you would expect, we've analyzed the results from multiple angles. In fact, our win rates remain extremely high against the competition. this was evident in 35% year-over-year growth in the number of transactions overall, 70%-plus growth in the value of sales to new logo customers, and a 31% increase in the number of large enterprise deals over $1 million. Adoption of our platform continued to expand as the percentage of customers with three or more products increased, and our analytics, forensics, and as a Service solutions had very strong quarters as well. All-in-all, we had 10 major product lines achieve more than $10 million in billings. In addition, our renewal rates remained above 90% on a customer basis and our Net Promoter Customer Satisfaction Scores continued to lead the industry. Given the strength of these underlying metrics, I believe our adaptive defense approach to cyber security is resonating with customers and our business remains fundamentally strong. But after 18 months of elevated, what I call emergency spending on advanced cyber security, we're seeing customers take a more strategic approach to upgrading their security infrastructures. It's clear that cyber security remains a top priority for sure for customers and the industry will continue to grow, but I believe we're entering a new phase of the cyber threat cycle. As a result, we're seeing a return to more normalized overall year-over-year growth rates and this is reflected in our Q4 guidance. I believe this change in customer buying patterns is at least particularly due in changes in the threat landscape in the wake of the global cyber security agreements we've seen with China that is making headlines since September. We see these new cyber peace initiatives reflected in the climb in number of APT alerts detected in our DTI network in the U.S., in the number of threats captured in our worldwide hops (8

[Michael J. Berry:]

Great. Thank you, Dave. Thanks for that great introduction. That was very nice. And again, thanks, very good afternoon to everyone on the call. Since this is my first public communication as the new CFO at FireEye, I would like to start by thanking Dave and the FireEye Board for giving me this opportunity. I am very excited about joining FireEye and look forward to working with Dave and the rest of the management team as we continue to drive innovation in cyber security. I have been very impressed with the quality and commitment of all of the FireEye employees I've met so far, the dedication and sense of teamwork of the management team, and the company's relentless focus on customer success. I believe that these traits coupled with a continued focus on our path to profitability will help the company achieve great things in the future. I was really excited to join the FireEye team and after six weeks in the CFO chair, I can say that I'm even more excited about the company than when I started. With that said, let's move on to the financial results for the third quarter of 2015. I want to remind you that, except for revenue, which is a GAAP metric, I will be using non-GAAP metrics to discuss our financial results and guidance ranges. I believe there are several key takeaways coming out of the third quarter from a financial perspective. First, we were able to exceed our expectations for operating margins and loss per share, even though our top line billings were less than we expected. Operating margin improved year-over-year by 32 percentage points to negative 32% and on a dollar basis, operating losses improved by almost $20 million year-over-year. Second, we posted a solid quarter of year-over-year growth with total revenue increasing 45% and billings up 28%. The revenue growth was largely driven by continued growth in our subscription and service businesses. Third, our continued operating leverage comes through very clearly in our improved cash flow performance in the quarter and year-to-date. In the nine months – in the first nine months of 2015, we have generated positive operating cash flow of $28 million compared to $131 million used in operations for the same period in 2014. For those of you on the call that have followed my prior companies, you know that cash flow is one of my favorite subjects, so you can expect us to talk a lot more about that in the future. Using these three takeaways as a framework, let's jump into the details of the third quarter financial results. Total billings of $211 million increased 28% year-over-year. The shortfall relative to guidance was primarily due to weakness in our Europe business. Dave discussed at length in his opening remarks the overall macro environment and the specific items that were factors in the performance of Europe versus our expectations. We have relatively new sales teams in our core Europe countries and they had shown nice improvement in Q2 after a slower Q1. When the company gave guidance in late July, the expectations assumed that Europe would continue to deliver improving performance as the productivity of the sales team continued to ramp. This was not the case in Q3 and we came up significantly short of our targets in Europe. While we are happy to see some early signs of progress in terms of deal flow and pipeline in Europe, I'm going to be conservative in our forecast for this region and assume that it will not bounce back right away. We recognize that the team is still new and we will give them the time and support required to get the growth engine going again in Europe. Our billings performance was also negatively impacted by a decline in average contract length from 34 months a year ago to just under 30 months this year. You may remember that in Q3 2014 we closed an eight-figure, 5-year transaction with a federal agency, and while we knew that that was a headwind to growth, we did not expect the average contract length to slip below 30 months in Q3 2015, and it did have an impact on our aggregate billings result. Despite the shortfall in billings relative to guidance, several of the underlying growth drivers continue to trend upward and our business is more diversified across product offerings, geographies, and customer segments than ever before. We posted solid growth in the North American commercial, Asia-Pacific, and Latin American regions. Sales to new logo customers grew 16% on a year-over-year basis as we added nearly 300 new customers. Even more important than the number of new logos, the billings associated with new logos grew by 79% on a year-over-year basis in Q3 2015. We closed 34 transactions over $1 million compared to 26 in Q3 last year, and more than 60% included multiple products. Of the top 10 transactions in the quarter, six were new logo customers. Within total billings, product billings increased 33% year-over-year with notable strength in our HX Endpoint and PX packet capture products. Product subscription billings of $82.5 million increased 15% from Q3 2014 and accounted for 39% of total billings compared with 44% in Q3 2014. Both the year-over-year growth rate and the mix was impacted by the large 5-year federal deal in Q3 2014 and the drop in average contract length. The product subscription billings were driven by continued adoption of our cloud-based products including our cloud email, or ETP, and Threat Analytics, as well as renewals and upgrades to ATI and ATI+ subscriptions. Several $1 million transactions included ETP and sales of this solution increased six-fold from a year earlier. We saw more and more customers migrating their email solutions to the cloud, a trend we expect will continue. On a combined basis, products and product subscription billings increased 22% year-over-year in Q3 2015 and on a year-to-date basis increased by 41%. Since a growing percentage of our subscription offerings are not attached to an appliance, in our view the combination of products plus product subscription billings provide a better view of market adoption for our products than looking only at the product billings line item. To better illustrate this trend, year-to-date through Q3 2015 the percentage of product subscription billings that were not attached to an appliance nearly doubled from 2014 to approximately 16% in 2015. The growth in product subscriptions continues to drive a gradual shift to recurring subscriptions and support. Given our continued high renewal rates above 90%, we view this as a healthy trend for our business overall. Looking forward, I expect the average contract length will continue to decline slightly as we insure our pricing practices for multi-year contracts are balancing our growth and profitability goals. While a decline in the average contract length may put some pressure on the total billings amount and growth rate in the near term, it is a positive for our business overall and our progress on the path to profitability. You can see the impact of the modest decline in Q3 contract length in the record $105 million year-over-year increase in current deferred revenue. On a sequential basis, the balance of current deferred revenue increased $33.4 million, nearly three times the increase of noncurrent deferred revenue. Turning to revenues. Our total revenues grew 45% to $165.6 million in Q3 coming in very close to the midpoint of our guidance range. Our ability to deliver revenue within the guidance range and continued operating leverage, even with the billings shortfall, demonstrates the strength of our business model. Product revenue of $60.1 million included approximately $1.3 million of product revenue recognized from deferred revenue as we continue to recognize previously deferred product revenue from our pre-June 2014 email appliances. I am sure many of you remember that in Q2 2014 we made a change to our email appliance product that changed how we recognized revenue. The impact of the product change reduced the reported growth rate of product revenue by about nine percentage points in Q3 2015. Excluding the impact of the lower amount recognized from deferred revenue, product revenue increased 33% year-over-year, approximately the same as the products – product billings growth rate. We expect this year-over-year decline in the recognition of deferred email appliance revenue to have a similar negative impact in Q4 in terms of the absolute dollar amount. This is expected to represent approximately 5 percentage points of headwind to the product revenue growth rate. This difference will begin to taper off pretty significantly beginning in Q1 2016. From my earlier comment, I do want to highlight that the combination of product and product subscription revenue increased year-over-year by 40% in the third quarter and 52% on a year-to-date basis. Revenue recognized ratably off the balance sheet totaled $76.8 million, increasing 64% year-over-year and 10% sequentially. Finally, from a revenue perspective we had a very strong quarter in our professional services business as revenue finished at $28.7 million, an increase of 52% from a year ago. With total revenue up 45% and non-GAAP expense growth of just 13% year-over-year, we continue to generation operating leverage and exceeded our outlook for earnings per share in the third quarter. Non-GAAP gross margins increased from 71% in Q3 2014 to 73% in Q3 2015, at the high end of our guidance range. The increase was primarily due to improved margins on both subscriptions and services, as subscription and support revenue increases continue to drive margin expansion. The drop in product gross margin sequentially and year-over-year was a result of a nonrecurring product expense in Q3 2015 that represented a three percentage point negative impact to the product gross margin. Our total non-GAAP operating expenses increased just 13% year-over-year and 4% sequentially. As a result, non-GAAP operating margin as a percentage of revenue improved by 32 percentage points and non-GAAP operating losses on a dollar basis improved by more than $19 million from the year-ago quarter. This is the second sequential quarter of declining operating losses and our performance this quarter reinforces our confidence in our journey to the path to profitability. Sales and marketing and R&D expense were both below our guidance range and G&A was at about the midpoint of our expected range. While a portion of the lower operating costs were due to lower commissions and other variable expense items, a good bit of the operating leverage was from better overall expense management that we expect to continue in future quarters. This improvement relative to expectations allowed us to deliver a loss per share of $0.37 per share compared to the guidance range of a loss per share of $0.44 to $0.48. Our ability to demonstrate operating leverage coupled with good collections and working capital management resulted in operating cash flow of negative $8.3 million. This compares to negative $46.5 million in Q3 a year ago. As expected, our days outstanding, which we measure against billings versus revenue, increased sequentially and we exited the quarter at 62 days compared to 54 days at the end of Q2. Although our DSOs increased from Q2, they remain below our target range of 65 days to 75 days as we continue to actively manage this balance sheet item. Consistent with normal fourth quarter linearity, I expect DSOs to increase modestly in Q4, but remain within the range of 65 days to 75 days. CapEx for the quarter was $12.7 million, up slightly from Q2 2015, but down approximately $11 million over Q3 2014. Year-to-date operating cash flow remains in positive territory at $28 million compared with cash used in operations of $131 million in the first nine months of 2014, a swing of $159 million. Free cash flow on a year-to-date basis was negative $9.6 million compared with negative $186.5 million in the first nine months of 2014. This represents an improvement of a remarkable $177 million year-over-year. As a percentage of revenue, our free cash flow margin went from negative 66% in the first nine months of 2014 to negative 2% over the same period in 2015. Turning to the balance sheet. We exited Q3 in strong financial condition with approximately $1.2 billion in cash and short-term investment. Our net cash position, which I measure as our total cash balance of $1.17 billion less the face value of our convertible debt of $920 million, was approximately $250 million at the end of Q3 2015. We ended Q3 2015 with $455 million in total deferred revenue, of which $266 million is current and will be recognized over the next four quarters. The strength of our balance sheet creates a solid foundation for our growth and I believe gives us flexibility to continue to invest in the business while also serving as a competitive advantage for us against smaller, less well-capitalized companies. Looking forward to our guidance, we are adjusting our Q4 and full year guidance ranges to reflect our Q3 results. For Q4 2015 our guidance assumes that the macro environment that Dave discussed in his earlier comments and the softness we saw in Europe in Q3 2015 continues into Q4. Additionally, as I mentioned earlier, we expect the average contract length to be at or even slightly below the 29.9 months we saw in Q3 2015. The billings guidance largely drives our revenue expectation. We would expect product revenue to grow on a year-over-year basis in line with the billings growth expectation, excluding the year-over-year impact of the recognition of deferred product revenue from the change in email appliances, which we estimate will be a 5 percentage point headwind. We currently expect subscriptions and support to grow approximately 50% year-over-year and professional services to increase in the range of 25% to 30% versus a very strong Q4 2014. From an expense perspective and as a percentage of revenue versus Q3 2015, we would expect R&D and G&A to be lower and sales and marketing to be relatively flat to slightly lower, even with the higher commission from the higher billings expectation. To summarize the guidance, for Q4 2015 we currently expect the following

[David DeWalt:]

All right, Mike. Thank you very much and appreciate it. As Mike made clear, we've demonstrated our ability to progress on our path to profitability. I'm confident we'll keep on this path as we navigate the market shifts brought about by the continued evolution in the threat landscape. Our mission at FireEye is clear

[Operator:]

Thank you. And our first question comes from Gur Talpaz of Stifel. Your line is now open.

[Gur Talpaz:]

Great. Thanks for taking my questions. Can you talk a bit about the growth in product subscription billings? Was there any noticed slowdown here in FireEye as a Service? Or is the growth decel really sort of optical issue due largely to the tough government comp from last year? And then maybe going one step further, could you offer sort of any view into normalized growth if we ex out the impact of that one or two large contracts?

[David DeWalt:]

Yeah. I can start, maybe, Mike, you can add on. Feel free. To answer the first part there with FireEye as a Service, we had a very strong FireEye as a Service. I mentioned 59% year-over-year growth there. I think, we feel pretty confident with that business in that business area, particularly from service engagement conversions to the service. We've been expanding that service internationally. I feel like we haven't hit all cylinders on that as well to be honest because mostly it's coming from the U.S. market so far. We've just really gotten our Asian SOCs build. We're just building our European SOCs as well. So I hope more is to come on the FireEye as a Service. And if you look at product and product service – or product and product subscription overall, I think, Mike talked a little bit about some of the anomalies in there in terms of some of the large deal a year ago. Maybe you want to add on to that, Mike?

[Michael J. Berry:]

Sure. Thanks, Dave. So, Gur, yeah, so the big issue in Q3 was the comparison to the big deal last year. So that's why product subscriptions only grew 15% in the quarter. I would encourage you to look at the year-to-date number. So that's 43% on a billings perspective. Even more importantly you see that in the quarter product subscriptions grew by 64% and 74% year-to-date. So without giving you more as you call the normalized run rate, I'd encourage you to look at those numbers. I think that's more indicative of the future than Q3.

[Gur Talpaz:]

Great. And then, Mike, maybe one question for you. Can you talk a bit about your philosophy around balancing growth and profitability? Meaning, if we're entering sort of a new paradigm of growth sort of commenting on some of the comments that Dave made regarding just sort of what he's seeing out there in the marketplace. How much emphasis are you going to place on margin expansion and cash flow improvements versus growth acceleration? Thank you.

[Michael J. Berry:]

Sure. So I think that is the number one question that we are wrestling with right now. So the way I look at that is that FireEye has historically and I think in the future will continue to be a leader in the cyber security market. It is my job to make sure that we can continue to fund that innovation in R&D, have enough sales capacity while also keeping in mind we are on that path to profitability and we will stay on that. So this is really all about reallocation of dollars as well as we're funding those big initiatives. So we will keep our eye on both of those and I do think cash flow will just call it naturally occur as well because again, with the strong billings growth, even with the guidance that we've given for Q4, we expect that, that billings growth to continue to generate cash flow. Being positive this year is great and we're looking forward to increasing that in the future.

[David DeWalt:]

That's a great question, Gur, and I'll just add on to Mike before we go to the next question is I feel like we've set ourselves up well to create balance here of both growth and of path to profitability acceleration. And that's because we've really worked hard early on as the pre-IPO company and then after IPO to internationalize ourselves, get human capital into lower cost regions so we can continue to optimize capacity at a lower cost rate. We focused on moving our intellectual property to lower cost regions to do tax harvesting and effective tax management over the long haul, and so we've set ourselves up with an infrastructure that creates leverage. Mike talked to that leverage creation even in a quarter where the billings weren't where we expected we did get greater than expected leverage. And I think that's the positive part of the model that we now have and we got to continue to drive at that and we will, and I think, it creates opportunity for us going forward. Candice, can we get the next question, please?

[Operator:]

And our next question comes from Sterling Auty of JPMorgan. Your line is now open.

[Sterling Auty:]

Hi. Thanks. Hi, guys. Dave, I think there's going to be three hot button topics on investor's minds, and two of these might be a little bit awkward, but you know me, I'm the bull in the China shop, so I'm going to ask them. Given the miss, there's going to be a lot of talk. If I look at when you sold Documentum and when you sold McAfee, given the miss, is this going to be an indication that you would look to a possible exit strategy through sale of FireEye? Number two, I think, investors are going to be asking looking at the new guidance since you have a new CFO; a new CFO, who usually want to come in and reset the bar. So was there an extra level – I hate the word conservatism, but the resetting of the bar, was there a little bit more to it given that you have a new CFO? And the third hot button is a lot of talk through the quarter about the increased competition. You touched upon it in terms of your commentary, but anything that you could talk about in terms of win rates in the quarter. I think, all three of those things would be very helpful.

[David DeWalt:]

Yeah. Sterling, thank you. That does hit it right on. Appreciate it, and I don't disagree. I'll just answer them as best as I can and honestly as I can. I've said this before publicly. We do what's right by the shareholders. I spent a lot of time as CEO, Mike Berry has spent a lot of time as CFO of public companies. You're always focused on your fiduciary ability to drive shareholder value. We'll always do what's right for that. We see a tremendous opportunity in cyber security. There's no doubt about it. If you look over the last 10 years it's gone up and to the right. The cycles may not always be exactly up and to the right. If you look at some of the slides that we've prepared, you can see the threat landscape does evolve. Sometimes that evolution has its ups, straight up to the right, and sometimes it has its lulls, and sometimes you see those things. We're not perfect. Certainly the macro environment is not the only reason. There's always things humbly we can do to be better and we have to do those. I think you hit on some of these things. We've got to get sharper against the competition. I think some of the opportunities we have with our MVX architecture can really drive at product segmentation that enables us to go after the good enough with an entry product that can really compete, but allow upsell to our more advanced subscriptions. We have to get focused on that, make sure we incent the channel properly to drive that behavior and really go after it. I think over the last eight quarters we've had a great ride, we've driven the company, but competition is inevitable. Some of our success has breeded a whole lot of investment and we're going to respond. And I think, this is really an opportunity for us to roll up our sleeves, fight back and come out stronger than we have before. So the answer to that is we recognize competition. I will tell you a little bit when we look at win rates, particularly in the enterprise large customer base, our win rates are very strong. I mentioned that in the script. I feel good when we compete, especially when we can compete head-to-head. I don't think anybody quite has the value proposition that FireEye has when you look at true detection rates and you look at false positive management. And most of our competitors false at rates at a magnitude greater than us, and if you're looking at cost per alert at a couple hundred dollars, $600 per alert, and you start multiplying out by day, most of these products cost security enterprise not help them. And so we've got to do a better job telling that story, showing our value, delineating and segmenting our business, and we will. And I think, there's a real opportunity. I think, we've got to get Europe really working and fixed. We got a new management team in there and we're focused hard on that, and ultimately we'll get there. We do see some positive signs, but there is some headwinds with currency and privacy and things going on there that doesn't make it super easy. But having said that, we're very focused. As far as the conservative Mike, I hope he is. And I'm really proud to work with him. It's great to see him spin up so quick. I know, I speak for the whole management team and the employees here that it's great to have him on board as a partner. And I'll just leave it at that unless you want to comment, Mike.

[Michael J. Berry:]

I would stick with that answer.

[David DeWalt:]

Okay. Very good. Thanks, Sterling. Candice, can we get the next question?

[Operator:]

And our next question comes from Daniel Ives of FBR. Your line is now open.

[Daniel H. Ives:]

Yeah, thanks. I think another big question that I think everyone is looking to get answered is why does it seem like you're seeing a much different environment than most of the other cyber securities have seen over the last few months? I mean, do you think there's something that happened suddenly? Is this more execution and company specific issues, just being honest, looking in the mirror? I think that's a disconnect that I'd just be interested to get your view on.

[David DeWalt:]

Yeah, Daniel. I'll try my best. I mean, first of all, this is all balance. I mean, I believe that you have a cyclical nature to threat landscapes, and I'll talk about it in a second. But we have things to improve upon too. We had a lot of large growth comps to overcome. I tried to talk about Europe, and tried to talk about contract lengths and talk about executions, we were 18 months into the Mandiant integration. Not everything is perfect. We got a lot of things to keep improving upon. And certainly, we'll do that. But we also see some macro changes. And who was the company that saw the macro changes before too? It's FireEye and Mandiant. We see these things. We're on the leading edge of these things. I believe that we've seen some slight change in China policy, and I say slight change. I don't think we're seeing a massive shift or a secular change. What we're seeing is some pressure that the security community has been able to put on a particular adversary to make adjustments in their policies. And by the way, it'll probably pivot internationally. It'll probably pivot change. And we see these changes go quick. So nothing stays forever with the threat landscape, but it doesn't always go straight up and to the right. And some of the impacts that are happening that we see, particularly with U.S. American soil-based companies related to APT alerts, and infrastructure has had a lull in it. And does that have an effect sometimes on the appetite of clients to buy? Well, we can see that in size of deal and a little bit of contract length. But I'm not making them an excuse. We've always seen this. We've seen these periods over time. We'll have to get better. And we'll have to be better internationally as a company and we will. So take it with balance as best as we can. And know that we do see some things that I think a lot of other companies don't see. And we are partnered a lot that other companies aren't. So I'd just say it's a piece of the pie, and we'll work on that.

[Daniel H. Ives:]

Thanks.

[David DeWalt:]

Does that answer your question, Daniel?

[Daniel H. Ives:]

Yeah.

[David DeWalt:]

Candice?

[Operator:]

And our next question comes from Jonathan Ho, William Blair. Your line is now open.

[Jonathan F. Ho:]

Hey, guys. Just wanted to switch gears for a second. You mentioned that you had 10 products now that are over $10 million in terms of sort of the bookings run rate. I just wanted to understand, was there notable acceleration or deceleration in any of those lines? And could you maybe name the 10 products segments for us?

[David DeWalt:]

Yeah. I'll start with a little bit of color and you'll challenge me to name all 10 by their acronyms, which we're good at. But, Jonathan, the first thing I alluded to was a couple of the flagship products that grew really well, particularly the HX conversion to the MIR platform that we've been working on for some time. We talked at over 200% growth in that platform. That platform is getting meaningful and I think we see a very ripening opportunity in the Endpoint marketplace, particularly now with some of the enterprise search features that we put in place. The speed that we have, we have 28 languages now for HX platform, we have multiple operating system ports. We're getting in good position with that capability. We need to deliver detection and exploit management and ultimately prevention, but I feel like that platform is heading in the right direction. We'll have to keep working on it as we always did. I mentioned the FireEye as a Service 59% growth year-over-year on that platform. Pretty material, over $10 million platform as well. One of the other acquisitions we did a little more than a year ago paid off quite well for the company the last few quarters and that is the nPulse acquisition, what we call our PX product and this is the network forensics product. We have a very strong quarter again with that platform and that felt good. Some of the other areas that we continue to see and this is what's interesting about the security industry is these changes go swift, too. And some of the perimeter to cloud changes are evident that we're seeing. When you look at our EX platform where you count it in product you see some headwind. When you look at the ETP or the cloud product, you actually see some pretty strong tailwinds. And when you put the two together, it's a pretty solid growth but it moves from product to product subscriptions a bit and there's some changes that go on there. So rattling them off, our products are the network product, NX, our endpoint product HX, our email product EX, our network forensics product PX, our FireEye as a Service, our cloud component and then some of our service components, like our incident responding component, MPS, and then our threat cloud and then ultimately support. I think I got all 10, Mike, or close.

[Michael J. Berry:]

Yeah, very close.

[David DeWalt:]

So hopefully that answers it for you, Jonathan, on the 10 and 10, and that's been an improvement each quarter. And I think, Mike also alluded to some of the cross selling and the percent of deals we're doing with multi-elements, all positive. And I'd also remind you, Jonathan, I think what I see strong here is the number of transactions growth at 35%, some of the new logo growth that we had at 300, that was a very high number for us. The number of deals over $1 million at 34, and the growth that we had there, but offset a bit with contract length and then offset a bit with Europe and offset a bit with the size of the deal, especially compared to the hard comp we had a year ago. But when you look at color components, it feels pretty good, generally with transactions and things, just feels a little less urgent with some of the customer buying big. I hope that answered it. Thank you. Candice?

[Operator:]

Thank you. And our next question comes from Shaul Eyal of Oppenheimer. Your line is now open.

[Shaul Eyal:]

Thank you. Hi. Good afternoon, guys. Thank you for taking my question. Dave, when you look at this quarterly result, it's – if you can quantify, and I know really it's hard to quantify, but external macro issues versus internal issues, what would that breakdown or that impact would look like?

[David DeWalt:]

Shaul, it's a little hard. I haven't been able to quantify it. We've looked at this on a multitude of angles. What I can tell you a little bit is – and again, humbly, I'll just keep pointing we got to execute better as a company. There's no doubt about it. We continue to see things that we can do to execute better on. We've got to be a better channel company, we've got to get our product segmentation done, we've got to market better our value. There's things we got to go do and there's no doubt about it. Europe isn't helping us right now; when you look at the miss that we had in Q3, a lot of it is tied to a specific segment of the market globally. We've got to do better. So it's on us. We got to keep doing it and we got to improve. However, when you start to see some shifts, some changes in the threat landscape, particularly in that summer period, you got to change your game. And I alluded in the script there that we did and we adjusted and the top three transactions were really based on risk and remediation – potential evil finding problem versus actual threat and detection of a breach. So the game goes on a little bit. We'll see how long it goes but certainly macro trends have a bit to do with it. We have one view. A lot of other companies have other views on this, too. So we're not the only data point, but at least when you look at people and product we do see some change, at least on the U.S. critical infrastructure at least as it relates to some of the attack vectors we've seen from nation states. So we'll see, probably bounces back quick. I'm sure it has in the past and it will again, but at least that's the best way I could describe it to you. Good question. Thank you. Candice, can we get the next one?

[Operator:]

And our next question comes from Melissa Gorham of Morgan Stanley. Your line is now open.

[Keith Eric Weiss:]

Hey, guys. This is actually Keith Weiss sitting in for Melissa Gorham. Thank you for taking the question. I think I'm going to stick with a couple of prior questions. Do one inside and one outside. From the inside perspective, one of the things that has been concerning investors over the past couple months is the executive departures that we've seen at FireEye. I think you've lost – obviously Mike Sheridan left, I think the CTO left, I think the CMO left, and recently we saw the head of federal sales leave to go to Palo Alto Networks. So the question to you, Dave, would be on the internal side. Why isn't that pace of executive departures a problem that we should be worried about? And if it is a problem, what are you doing to sort of stem that and try to keep those executives on board? So that's the inside question. The outside question is, I was just hoping you could drill into that changing nature of spend that you're talking about. Is it a change in the overall level of spend, or is it a change on what people are spending on? Meaning, are we moving from, like you're saying, going after sort of the evil, going after the detection as more of a focus on remediation and forensics, or are you saying that the overall level of spend is just coming down on an absolute basis?

[David DeWalt:]

Yeah, thank you, Keith, I'll try my best here. And I know you've been with the Security industry a long time. So I'll do my best to describe this. I don't think it's ever a good thing when you have executive departures. Although, a company like us is probably going to expect some of that. I talked pretty openly when Mike Sheridan left. He was an IPO kind of CFO, he went back to do another IPO. I mean, these are natural phases that companies go through. We had a strong CFO. I think we have a stronger CFO now. And so you get a chance to upgrade. I mean, talent is a problem that you got to manage as an executive. And certainly, I'm sure you can see this, the Security industry has had one or two investments over the last year or two years, and there's a lot of companies building and trying to get talent. So we've got to do a good job. I will tell you that we're having no trouble hiring, and we're having no trouble replacing talent to come to FireEye, it's unbelievable. We had 30,000 plus applications again this quarter. We're seeing quick abilities to replace and upgrade. Most of you know I added David Ramirez before Nick Yurick had left, the head of Federal. We got a great upgrade, the President of L-3 Communications with global government. We hired Ryan Brichant that was based out of Europe prior who can really help us as a CTO. We've hired a number of executives. The Tesla CFO just joining our board. We've got upgrades all over that we continue to do. Record number of hiring in Mandiant. We ended up having 24 people who had left FireEye come back to FireEye in the last quarter or two quarters. We had multiple Mandiant incident responders, who had left earlier in the year come back to Mandiant. So guess what, the cycles change, and sometimes they come back into our favor too. And what once was a grass greener situation went suddenly, oops, it wasn't so green over there. And I think this is an opportunity for us to really take back a lot. And we are. And I think it's a great chance for us to upgrade our business. Would I be worried as an investor? Of course. It's never good to see adjustments like this. But I can tell you, we are focused on upgrading our talent. We're doing that. And across the board, we're constantly improving. So we had a strong quarter across the board with hiring and retention. And I would also tell you, this is the third quarter in a row where our attrition rates declined overall. So this is a positive. We're well below the industry norms. Sometimes when you see a high-profile exec departure, it's made into more than it is. And sometimes this is the case, and I think we can replace it. So sorry for the long-winded answer there, but that's the inside answer. The outside answer at least from my point of view, the level of spend in cyber security is amazing. I mean, the Enterprise IT segment in security is good. It's up and to the right. I don't see any change in that really. Cyber security is here to stay for our lifetimes and probably our kids' lifetimes, so that's the good news. What I am seeing is the emergency spend game, what's happening when there's a breach, what happens when there's an issue. In the years prior, it was this – I hate to call it an oh-shit moment, but it's kind of an oh-shit moment. And when it happens, they open up wallets and they change a little bit and the behavior changes, and we're getting a little more normalcy of a period of time here probably, because guess what? Customers are getting better at it too. And clients have responded to that and ultimately the risk factors have changed slightly than they were a little bit in the past. So, this is all part of the cycles of security in my opinion. Cyber security will continue to grow. I know it will. I think, there is some change afoot. We'll see how long that lasts. Maybe it's just 30 days until the next big headline changes it. I can already tell you, Keith, that the TalkTalk breach in Europe has got a lot of talk, and it's a lot of change and suddenly a swift change like that can move budget, so I'm optimistic that there's some things going on, especially when terrorist groups, like ISIL in North Korea, and some of the work in Syria and Iran come around, this is a new threat actors and they will replace some of the other threat actors. So overall I think their landscape is solid, will continue to grow. It may change a little bit which we have to change with. And overall I think it'll continue, but at least that's about as honest and transparent as I can give you. Candice, next question, please?

[Operator:]

And our next question comes from Brent Thill of UBS. Your line is now open.

[Brent John Thill:]

Dave, can you maybe provide a little color on what happened in the Federal business? Did it make expectations? Or were you below? And if you could also talk a little bit about the contract length? I think that is – especially in your industry, we've seen others' contact length go out, not come in. So what do you – what's the reason the customers are coming to you and saying, the contract length is shortening from your perspective?

[David DeWalt:]

Yeah, Brent. Great question and, Mike, feel free to add on here. First of all I'll answer the latter, and then go to the Federal sales. I mean just to be clear, the contract lengths overall are pretty consistent. We had a tough comp a year ago. Mike made specific note of an eight-figure deal that we had, a large transaction Q3 a year ago that was a five-year transaction that actually spiked, by quite a few months, our overall contract lengths. So if you normalize a little bit, yes, there was a change there and yes, it has some impact, and yes, we want to continue to work on that. But generally contract length was affected by a tough comp a little bit and we've got to continue to go. We got to make sure we continue to make that happen, but I think there's a little bit of the appetite thing I answered a little bit with Keith's question. On federal sales, when you look at it for a nine-month period, we're doing great. The federal sales model has been a shining star for the company. We're on plan, which is certainly a good thing. When you look at Q3, maybe not quite to where we had hoped it to be. Certainly some transactions and things didn't materialize quite the way we wanted, but I think in whole we feel pretty good with the leadership and the sales direction, especially when it relates to the transactions, penetration, especially in the civilian areas, state and local areas, and some of the other areas of the defense that we hadn't really gotten into prior. So, I kind, of look at that business pretty healthy overall and not much to look at there. Most of our issue really occurred in the Europe market.

[Brent John Thill:]

Thank you.

[David DeWalt:]

Mike, did you want to add on there?

[Michael J. Berry:]

Nope. That's good.

[Brent John Thill:]

Okay. Got it. Thank you.

[Operator:]

And our next question comes from Andrew Nowinski of Piper Jaffray. Your line is now open.

[Andrew James Nowinski:]

Thanks for taking the question. Maybe just a question on Mandiant. So you're clearly seeing really good growth with Mandiant. Billings are up about 83% year-over-year, and I certainly understand that product billings and subscriptions are difficult comps, but is there any evidence you can point to that Mandiant is actually pulling through your product revenue?

[David DeWalt:]

Yeah, Mike, do you want to start, Mike? Do you want to answer, or I can certainly do it too.

[Michael J. Berry:]

Yeah. So we had talked historically, Andrew, so Mandiant, to your point, had a very good quarter. And if you take a look at the billings, it was up 83% actually in the quarter. So they continue to do great. We had talked historically about this pull through in terms of it being somewhere around 80% or 90% at some point after a SCA (1

[David DeWalt:]

So maybe just adding on, Andy, a little bit was I feel the team, Kevin Mandia and Travis Reese have done an amazing job here in light of the acquisition and the strength and the synergies continue to get better and better there. And you can almost feel that with some of the billings that the Mandiant service group has had, the materiality of the breaches that they're getting into, the international expansion that we're on. These are pretty good lead indicators when you look at bookings and billings of the service model, because we know that does have high conversion rates, the product. So I think this creates some optimism for the future for the company as we really relate to that, because it's almost in a way a paid sales force a little bit when you're getting service engagements like that and helping to convert them. But nothing really alarming there on the Mandiant. If anything, quite positive for the company in a lot of respects, both U.S. and international. Thank you. Next question, please?

[Operator:]

And our next question comes from Saket Kalia of Barclays. Your line is now open.

[Saket Kalia:]

Hey, guys. Thanks for taking my questions and squeezing me in here. Just two quick modeling questions if I may. First, Mike, roughly how much does Europe contribute in terms of billings? And was the shortfall there more from maybe lower close rates reflecting a more maturing sales force? Or was pipeline lower there as well?

[Michael J. Berry:]

So at a high level our international business is about 30% of the total company and it moves around a little bit. Certainly in Q3 Europe will drop a little bit, but in general at 30%, Europe will typically be like other industry players a little bit more. So think somewhere typically 15% to 20% of the total company. And from a conversion perspective as Dave talked about, we went in, the pipelines looked good, they came off a stronger Q2 than Q1 in some of our main countries again, we still have newer groups there. So we were expecting at least that type of productivity. Unfortunately, they didn't close. Again, a lot of those macro factors came into play. The other thing with Europe is keep in mind we do bill in dollars but when that gets converted, especially through the channel that did put some pressure on us. So all of those factors contributed to the Europe issue.

[David DeWalt:]

Good question. Thank you. Should we take one more, Kate?

[Kate Patterson:]

Let's take a couple more.

[David DeWalt:]

Okay. Keep going. Thank you, Candice.

[Operator:]

You're welcome. And our next question comes from Walter Pritchard of Citi. Your line is now open.

[Walter H. Pritchard:]

Great. Just, Mike, maybe too new on this, but just wanted to make sure I understood the changes to guidance for Q4. So you talked about on the email deferral and you also talked about this quarter's in the duration difference. But I guess it would seem like at least as we model it we sort of knew those two things were happening as we moved into Q4. So I just want to make sure I understand how much of the change to Q4 guidance are those factors, which are kind of more mechanical (1

[Michael J. Berry:]

Sure, Walter. So the largest difference between the previously implied guidance for Q4 and the new guidance relates to our continued expectation that Europe will be soft. We do expect the contract length to slide a little bit. That's call it in the single millions of dollars, but if you take a look at the $40 million to $50 million that we've pulled it down, the vast majority of that is the reset of the expectations of Europe with some of the overall macro stuff that Dave talked about. Again, it's hard to parse how much is exactly which but those are the two main drivers.

[Operator:]

Thank you. And our next question comes from Erik Suppiger of JMP Securities. Your line is now open.

[Erik L. Suppiger:]

Yeah. Thanks. Geographically speaking, how when you talk about macro issues and slowing spending, how much of that is in the U.S.? It's not clear given the weakness was Europe how much of this is related to U.S. slowing?

[David DeWalt:]

Yeah. Good question, Erik. What we alluded to, Mike and I, was that typically what we've had in prior quarters was when we had a weakness in one particular geography, usually the U.S. kind of helped us overcome it, and we've been very strong both U.S. commercial and U.S. government. We certainly continue to see the U.S. be strong, but it wasn't as strong, and I alluded to this in a script that's kind of more of an inline results quarter for us in the U.S. as opposed to an overachievement of U.S., and sometimes that's what you're counting on a bit is the geographies have its ups and downs. But we've been really been able to rely on U.S. much more, and in there was a little of those comments I was making was a little bit of the threat landscapes and the little bit of the challenges we were seeing in there really seemed to have an effect on the emergency spend buckets and on the urgency and the appetite that we were seeing from clients prior to really – solve the problem, solve the problem immediately. And that resulted in a little of the lack of over performance for the U.S. that ultimately we've seen. Asia was generally in line, and Europe was clearly well below. So just not getting the overage that we had typically been getting with that model. So that's kind of where the weakness was, was just we'd hoped a lot more against plan. I alluded to the federal government there, not quite where we had hoped to be for Q3, not that it's bad for the full nine months, but not quite over performing. A couple other areas of our U.S. business not quite bringing all that in that we had a chance to. So it's a little bit of a tale of both Europe being weak and U.S. not being stronger than it's been. And so that's the best way I could tell it to you.

[Kate Patterson:]

We'll take one more question.

[Operator:]

Thank you. And our next question comes from Robert Breza of Wunderlich Securities. Your line is now open.

[Robert Breza:]

Hi. Just if you guys think about your past profitability, wondering if you could kind of talk to us, Mike or Dave, about how you think about head count? And talked a little bit about – in your prepared remarks – about where we're going from an absolute dollar perspective, but hopefully help us understand where you're going from a hiring point of view and how we should think about head count. Thanks.

[David DeWalt:]

Yeah, I can start. Mike, feel free to add on. Certainly, we know this business is head count intensive. So certainly our goal is to continue to increase head count and continue to invest in the business for innovation, for R&D, for sales capacity, and such. However, I think we see opportunities to redistribute some of our spend in an effort to continue to invest. And certainly this is something Mike has immediately made an impact on here for us is let's look at some things we can do to optimize and redistribute. And by the way, we're pretty well positioned to leverage offshoring and leverage some investments to enable us to really grow some of these areas respectfully. So we see a big growth opportunity in this company in the marketplace. We're going to continue to invest, but I think, you'll see us invest a little differently than we had been, and particularly trying to leverage some of the existing spend that we've got and make sure we highly prioritize that. Mike, did you want to add onto that.

[Michael J. Berry:]

Nope. Great answer.

[David DeWalt:]

Okay. Thank you very much for the questions, and thank you, everybody, for attending the call. I just want to maybe leave you with one or two comments before we go. Our Q3 results to me suggest that the broader market is just beginning to realize what I think some of the sophisticated customers have known for a long time, and that is gaining the upper hand on sophisticated attacks is an ongoing process, and it takes a lot more than just technology. It takes the combination of technology and people and intelligence, and really risk mitigation is going to continue to happen. I think FireEye is perfectly positioned for the threat realities that we're starting to see. I think we can claim realistically leadership in all three areas of technology and people and intelligence. And I'm really focused and really optimistic I think as we go through these phases as a company. We've worked extremely hard as a company. I'm proud of the employees. I'm thankful for the customers and the trust they put into us, and I really look forward to overachieving as we go forward. So with that, thank you very much for your support, and have a good afternoon. Bye.

[Operator:]

Ladies and gentlemen, thank you for participating in today's conference. This does conclude the program and you may all disconnect. Have a great day, everyone.