KnowBe4, Inc.
Q1 2021 Earnings Call Transcript

Published: 19 May 2021

[Operator:]

Ladies and gentlemen, thank you for standing by and welcome to the KnowBe4 First Quarter 2021 Results Conference Call. Please be advised that today's conference is being recorded. All lines have been placed on mute to prevent any background noise. After the speaker's remarks, there will be a question-and-answer session. Thank you. Now it is my pleasure to turn the call over to Ken Talanian, KnowBe4 Vice President of Investor Reporting.

[Ken Talanian:]

As a reminder, our commentary today will include non-GAAP financial measures. Information regarding our non-GAAP financial results, the limitations and reconciliations of our GAAP and non-GAAP results can be found in our earnings release, which was furnished with our Form 8-K today with the SEC may also be found on our Investor Relations website at investors.knowbe4.com. In addition, some of our comments today, including those related to our guidance, may contain forward-looking statements that are subject to risks, uncertainties, and assumptions. Should any of these materialize or should our assumptions prove to be incorrect, actual company results could differ materially from those projected or implied during this call.

[Stu Sjouwerman:]

Thank you, Ken, and thank you all for joining us today. We're pleased to share our results with you this afternoon. We had a record quarter with 40 plus percent annual recurring revenue growth, improving gross margins and strong cash flow. As many of you know, I started KnowBe4 to help organizations manage the ongoing problem of social engineering. We define social engineering as manipulating an employee in an organization to do something against the benefits of that organization that could be fishing or replying to a CEO fraud attack, or sending an attachment with W2 information to cyber criminals. We're the only public company dedicated to securing the human layer. The emphasis in cybersecurity has traditionally been on legacy controls. However, the exponential growth in cyber attacks and our relative success proves that we cannot solely rely on security infrastructure. Ignoring the human element of this equation, leaves organizations of all sizes vulnerable, which is why we are dedicated to helping organizations transform their employees into a successful last line of defense against cyber attacks. Recent events, such as the coronavirus pandemic and the mass migration to a work from home environment has only made the problem worse, further evidenced by recent high profile breaches. The ransomware attack on colonial pipeline is the most recent example of an attack that made it into mainstream media. Although the root of the attack is still under investigation, most ransomware attacks begin with social engineering. This is a problem that is not going away. Just last week, Verizon released their 2021 data breach investigation report. It is no surprise that social engineering remains a top threat for the last five years running. The human layer needs to be strengthened every day. This is why we are focused on building a strong human name point. I will start by summarizing my key observations. We continue to see strong momentum in our new business and continued strong retention within our existing customer base. Customers in both the SMB and enterprise see our platform as a critical element of their security stack. Prospects have strong focus on enhancing their security and the ability to manage the ongoing problem of social engineering.

[Krish Venkataraman:]

Thanks, Stu, and good afternoon to everyone. As a quick reminder, unless otherwise noted all numbers except revenue mentioned during my remarks are non-GAAP. Before I discuss the quarter's results, I want to remind everyone of the principles that we used to run the business. Our first pillar of focus is driving long-term growth. We continue to focus our investments on international expansion, enhancing capabilities in our core products, driving channel initiatives both domestically and internationally, and finally investing in our people and its skills development. I will touch on a few of these initiatives. On the international expansion, we continue to focus our investments on hiding key talent in marketing, sales, content, and customer support. We have made several key hires in the U.K., Germany, Australia, and Japan, and laying the foundation of talent to scale across the globe.

[Operator:]

Thank you. Your first question comes from the line of Brian Essex with Goldman Sachs.

[Brian Essex:]

Great, thank you. Good afternoon and thank you for taking the question and congratulations on emerging as a public company. Maybe, Stu, if I could start or maybe Krish if you want to take this one as you focused on leveraging your platform strategy to penetrate your markets, we saw a nice - it was nice to see the acceleration, not only in logo ads, but ARR per logo. How much of that was better penetration into larger enterprise versus better attach rate with the percentages of accounts that have multiple products?

[Stu Sjouwerman:]

That one for Krish?

[Brian Essex:]

Yes, please, Krish.

[Krish Venkataraman:]

Okay. Hi, Brian. Thanks for the question and thanks for your comment on becoming maybe as a public company. So I think the answer is both. What we have seen and this trend is not just Q1. This trend is we're seeing this across multiple quarters as we're seeing further expansion into, I would say, all the levels within the enterprise market and also in the megas. One thing to note that the mega expansion is not just a Q1 phenomenon, it's been happening month after month over the last almost year, year and a half. And your second point the cross product penetration has been extremely strong this quarter and last quarter. In fact, I talk about the Triple Crown, where we are seeing both PhishER and KCM GRC seeing considerable progress in terms of expansion. As I mentioned in my note also we almost saw a triple digit growth in logo as well as revenue. And if you look at the overall penetration of cross-sell both for PhishER and KCM combined, we almost doubled from Q1 of last year and remember that's on a large and substantially larger base of clients. Because last year we had Q1, we had about 32,000 customers, and now we have 39,000. So this is a win across both those key areas, i.e., lots more expansion into enterprise and significant traction in terms of cross-sell of our two key cross-sell products, which are GRC KCM as well as PhishER.

[Brian Essex:]

Right, that's helpful. Maybe just to follow-up with the housekeeping, do you - historically we have some data percentage of accounts with multiple products. I mean are you open to disclosing what that might be this quarter?

[Krish Venkataraman:]

No, but what I can definitely state, Brian, it almost, as I said, almost doubled from Q1 of last year.

[Brian Essex:]

For the number of accounts…

[Krish Venkataraman:]

The percentage as you requested.

[Brian Essex:]

Oh, got it. Got it. Okay, perfect. Very helpful. Thanks again. I appreciate it.

[Brian Essex:]

Thank you.

[Stu Sjouwerman:]

Absolutely.

[Operator:]

Your next question comes from the line of Shaul Eyal with Cowen and Co.

[Stu Sjouwerman:]

Hi, Shaul.

[Shaul Eyal:]

Hi, guys. Good afternoon. Congrats on a very strong set of results right out the gate. Stu or Krish, maybe trying to focus on Brian's question, maybe from a little bit of a different direction. When we take those 2000 new logos you've just discussed, can you maybe qualitatively kind of break it down for us between the SMBs and the nice traction that you're seeing within the enterprise arena? And I have a follow-up.

[Stu Sjouwerman:]

Yes, I can sort of comment on that in a general sense that I created the KnowBe4 platform knowing full well that I was going to go large enterprise, but I decided to take the SMB market first. We own that there is very little competition there. And over the last five years, we have successfully executed into the enterprise and large enterprise space. And at the moment, if you look at the pie charts, it's about 50/50. So it gives you a bit of an indication where we're at today.

[Shaul Eyal:]

Understood, understood. And maybe from a bird's eye perspective, clearly with Proofpoint is being taken out of the public domain, really from a near-term perspective, Stu, what do you guys have in mind in terms of maybe displacing some of their accounts, maybe a good opportunity to go and revisit some of those, given some potential integration disruption that…

[Stu Sjouwerman:]

Sure.

[Shaul Eyal:]

…could potentially be seen.

[Stu Sjouwerman:]

Yes. We all know the private equity playbook, the cost-cutting and to some degree not really investing a lot in existing features is an opportunity for us. We're continuing to invest heavily in both new features in the existing platform and new products that are coming down the pike. So for us that was the only good news really.

[Shaul Eyal:]

Got it. Good job. Good luck. Well done.

[Stu Sjouwerman:]

Thank you very much, Shaul.

[Operator:]

Your next question comes from the line of DJ Hynes with Canaccord.

[DJ Hynes:]

Hi, thanks guys and congrats on the great start here. Stu, one of the questions I've been asked by investors, so I figure I'll ask you in this forum is whether the secure email gateway vendors, just by virtue of all the inbound email traffic that they handle, if they're better equipped in terms of staying on top of the latest phishing threats, which I guess in theory would enable them to put out more relevant training content, any comments or thoughts there.

[Stu Sjouwerman:]

Sure. You kind of have to look at the bigger picture in the sense of there is billions of emails that are being sent every day, tens of billions, but that guys sent about 3 billion malicious emails every day. The additional advantage that they have is they can test those secure email gateways and make sure that their attacks actually get through before they send them. So the attacker always has the advantage in these types of situations. For a while Proofpoint and Mimecast reported on each others' failure rates, they stopped that, but that was like single digit percentages, five, seven. There is press releases that you can dig into. So there is a massive amount of emails that make it through all the security layers. And that is one of the reasons why I decided this was truly required to have this eighth layer, the human layer, if you will, and make sure that you create that strong last line of defense. Does that answer your question, DJ?

[DJ Hynes:]

Yes, it does. That's helpful color. And then if I think about the number of new skews that you have today and what you're playing in the future, how are you thinking about separating kind of the cross-sell motion from the renewal cycle? Like is that important, what's the means to that end? Any thoughts there would be helpful. And I don't know if that's better for you Stu or Lars.

[Stu Sjouwerman:]

Actually, Lars would be the best man to answer that one.

[Lars Letonoff:]

Yes, DJ. So, we have our - the minute we make a sale that sale gets passed over to our customer success team and their job is to onboard the customer, make sure they know how to use all the different features, keep them apprised of the new features that we come out with. And also get renewals at the end of their subscription. And then just ensure that they have the best possible customer experience they can, but built into that, all of that work is they're constantly looking at the customer wallet and determining where there's opportunity for an up-sell or a cross-sell. And we'll in some cases even partner with our direct team to get those cross-sells done. Does that answer your question?

[DJ Hynes:]

It does. Yes. Thank you guys and again congrats on a good start.

[Operator:]

Your next question comes from the line of Rob Owens with Piper Sandler.

[Rob Owens:]

Great and thanks for taking my question, I guess, first around MediaPro. Was there anything inorganic relative to either ARR contribution or to customer count in the quarter?

[Stu Sjouwerman:]

Actually, Krish has a few insights, as he is willing to share with us about MediaPro. The thing that I want to start with, as this was an opportunity that we could not pass by. Their library with compliance modules is the best way to put it, but something that helped us significantly to get faster to market with our compliance plus skew. And that was the main driving force to quickly get the transaction done. There are some financial details as Krish will share.

[Rob Owens:]

Great. Thank you.

[Krish Venkataraman:]

Thanks Stu. Hi, Rob, how are you doing? So Rob, let me actually start off from the ARR story to actually provide some more color around MediaPro. So if you look at Q1 of last year versus this year, our ARR grew almost all in excess of 40%, and the vast majority of this growth was organic in nature. We did see some upliftment in terms for MediaPro’s acquisition. But as I discussed in my prepared remarks, I expect the existing ARR to actually have some level of deterioration to about - we believe about $5 million by the end of the year. And as Stu mentioned, the primary reason for this deal was not only the technology, also the resource quality who have really strong experience around our compliance capability. And more importantly, as Stu mentioned in his remarks, it really helped us accelerate the launch of a Compliance Plus product that we were working behind the scenes on for the last year or so. So this was really the biggest driver for the MediaPro acquisition versus customer acquisition story or ARR story.

[Rob Owens:]

Great. And then I guess secondarily for Lars, how are you thinking about capacity additions this year relative to Salesforce, especially given the Compliance Plus module, and then just the success you're seeing overall, will you lean into it a little bit more in terms of hiring plans?

[Lars Letonoff:]

Yes, we have our headcount models just modeled out into the future. We don't really talk about that, but I think with launching the PhishER product, we've kind of already done that. So as we add the Compliance Plus, we'll have a pretty much exact sales motion going forward. And I don't think it'll require much more addition to the head count.

[Rob Owens:]

Great. Thanks guys.

[Lars Letonoff:]

Yes. Thanks Rob.

[Krish Venkataraman:]

Thanks Rob.

[Operator:]

Your next question comes from a line of Fatima Boolani with UBS.

[Fatima Boolani:]

Good afternoon. Thank you for taking my questions. Stu or Lars either for other one of you. I wanted to start high level with respect to you, kind of the threat environment backdrops to in your prepared remarks you did allude to the Ransomware environment, and certainly it seems to be at some of the worst levels, but it has been in recent memory. And so because the vast majority of Ransomware is propagated by email, you're very close to that dynamic. And so I'm wondering if that has had any quantifiable impact and maybe specifically colonial if that has had any quantifiable impact on your business in terms of sales cycles, in terms of pipeline, in terms of conversion rates, any sort of quantifiable detail there would be very helpful. And then I have follow-up for Krish, please.

[Stu Sjouwerman:]

Fair enough. It's early days, these types of compromises take months to actually - there is a whole bunch of research that needs to be done to find what the true cause was. So there was no immediate uptake in a whole bunch of people are subtly buying awareness training because of the pipeline, however, having said that, Ransomware has been a massive contributor to the realization in over time, the larger and larger customers that training those end-users is an absolute must. And did they really cannot afford not to do it now. The Biden administration recently came out with increased security requirements for Federal organizations that is going to filter down. And so a very visible pipeline, critical infrastructure incident works well for us and the media are essentially our PR agency Fatima.

[Fatima Boolani:]

Fair enough. I appreciate that perspective. Krish, for you, as we anniversary the pandemics onset and think about the investments you have in place to continue to chip away at the new logo acquisition of velocity and activity we've seen, and taking into consideration this quarter's performance as well, what are some of the things that we should keep in mind vis-à-vis the new customer growth cadence, as we progress through the year, and we reflect on some of the compares from the prior year, again as we anniversary pandemic and that's it for me? Thank you.

[Krish Venkataraman:]

Hi, thanks Fatima. I think it's fair to talk about last year versus this year, right? As said in Q2, we actually tend to actually sell to a layer in the organization, which is the data front lines of not only security vendors, but more importantly, those are the same people who we're bringing and taking all of us to work from home. Now, post that, in Q3 and Q4 last year, we were pretty much back to normal in terms of customer acquisition and logo addition. And we saw the same trend, I would say in the Q4 of last year and the Q1 of this year. And we're seeing the similar trend in terms of pipeline into Q2. So going back to your point in terms of how we think about customer logo, I think we are pretty much in business as usual for the last almost a year or so.

[Fatima Boolani:]

Fair enough. Thank you.

[Operator:]

Your next question comes from the line of Mike Cikos with Needham & Company.

[Mike Cikos:]

Hi, team. You have Mike Cikos on the line from Needham in place of Alex Henderson. How are you doing?

[Stu Sjouwerman:]

Great. Thanks.

[Mike Cikos:]

Terrific. So I did have two questions for you. The first, your gross margins actually came in well ahead of our expectations. And I was hoping you can talk to the drivers for both the year on year as well as the quarter on quarter expansion as well as the sustainability of gross margins in this 85% range as we look to the rest of the calendar ‘21, and Krish, maybe for you, but how should we expect MediaPro to impact your gross margin outlook? Thanks.

[Krish Venkataraman:]

Yes. Thanks a lot, Mike. So let me actually talk to you a little bit about overall gross margins. As we scale the business, we did see an improvement in terms of our gross margins from the mid-80s. Now to really understand gross margins, you want to actually break down the gross margins into really the components that drive that, the CSM teams, which our customer support teams are a big driver of the order cost associated with our gross margins. Now they are in two different phases of evolution. In the U.S., we are being driving significant lower additions as you know, and the CSM teams tend to be at a high utilization and capacity levels. Internationally, we're just building out our international expansion, given we seen the problem of social engineering really increased substantially around the world, and we are adding CSM teams around the world to help support new and existing customers as well as future customers, enhance it take some time before those CSM teams are fully utilized. That is why for 2021, we expect gross margins to be in the mid-80s as previously discussed. The second part of your question, hopefully that answered the gross margin question. The second part of your question is around on how MediaPro is going to affect gross margins. Right now, as I said before, MediaPro is not a massive client acquisition, right? It was largely the acquisition pieces was around us, actually expanding into a brand new category, which is compliance process. We don't expect MediaPro to create any compression in our gross margins.

[Mike Cikos:]

Terrific. Thanks for that. And then just two other small items if I could. The first, I guess building on MediaPro on it. I know that you guys discussed the ARR by the end of calendar ‘21, we touched on the gross margins, but is there any associated impact to OpEx based on MediaPro? And then secondly, I know we were talking about Proofpoint or Mimecast or some of these other email secure gateways, but maybe you could talk to the technology here. My understanding is that your AI engine for the KMSAT platform is almost at a privileged position, again because you were learning on all these emails that have already gotten through the email secure gateways, which really puts you in an advantage position as far as showing efficacy and proving out your ROI. But can you validate that latter point on the technology as well as come back to the OpEx impact for MediaPro and thank you guys. I appreciate it.

[Stu Sjouwerman:]

Yes, there is two questions there. One is, more Krish question. I'll be happy to go into the AI parts, and it's basically the PhishER product. So Krish.

[Krish Venkataraman:]

Yes, I'll be quick there. So we expect the OpEx impact of MediaPro to be anywhere between $5 million and $7 million for the full-year.

[Stu Sjouwerman:]

Very good. You were right. Mike, we have a unique data stream because those literally billions of malicious emails, they do get caught by employees who click on the facial or button. So we get in a stream of email that is either clean spam or its malicious. We are able to train PhishER with that data stream and create machine learning models that allow the very higher than 90% reliability score of these malicious emails. So what we're able to do with that, like I said, unique data stream is train our models to high levels and save the security operation center people enormous amounts of time because they can almost fully automate the process of handling emails that are reported by their users. The last thing that I would like to highlight for a second is the PhishFlip feature, because you can now fully automated, train the model to a point where it recognizes it's malicious, and then fully automatic change the malicious attachments and change any malicious links in the email to make it into a defanged training templates, which is a feature that has been extremely well received by our customer base.

[Mike Cikos:]

Thank you for the color guys. Keep up the good work. That's all.

[Stu Sjouwerman:]

Thank you very much, Mike.

[Operator:]

Your next question comes from a line of Hamza Fodderwala with Morgan Stanley.

[Hamza Fodderwala:]

Hi guys. Thank you for taking my question. Just two quick ones. First one for Stu and Lars. Just around the go-to-market, it seems like you're seeing strong attach rates between PhishER and KCM, and now sort of going after the compliance market in a more fully fledged way, I'm curious, are these buyers different relative to who you sell into for core KMSAT, and what type of go-to market investments either both from a direct sales perspective for a channel perspective, do you have to make to reach those different types of buyers?

[Stu Sjouwerman:]

I'm going to grab that one myself Hamza, good question. The buyer indeed is different in the case of Compliance Plus. The buyer for our security awareness platform is definitely the IT/director/CSO, the InfoSec team, because they get confronted with the pain of in fact it workstations and downtime and data breaches and Ransomware. But they are the same people that can help us refer to the correct people in the organization, which are senior executives compliance and risk officers, who are the actual first deciders on these compliance type training. HR is following that essentially decision-making unit. So - to begin with going after our existing 39,000 plus accounts and sell Compliance Plus in there. But certainly, we will grab our channel and help them get this sold as well. Maybe a large - tell us a little about the channel side of things and how we're going to approach that.

[Lars Letonoff:]

Yes, we'll approach the channel just like any of our other products. Here in the U.S. we have a hybrid model where we sell both direct and through the channel. And I think as we get into the larger and larger deals, more and more percentage here locally go through the channel. Internationally, we're actually 100% channel, but we have the exact same sales motion. We have full on direct sales teams and our marketing team generates the same leads, but the direct teams handle the entire sales process, but they never quote and they never accept a deal. And for the second part of your question with the go-to market investment, I think there is a little more investment when we're talking international markets and that's because of just specific localization and things we have to do and localized marketing to go after those different markets.

[Hamza Fodderwala:]

Makes sense. And this is a quick follow-up for Krish, if I may. Krish, I think, just to not to belabor this point, but just - so I'm clear the MediaPro ARR run rate, you mentioned 5 million by the end of the year. You're assuming some deterioration in that even. So it's safe to say it's above $5 million today. Any color you can give us as to what the ARR run rate is today?

[Krish Venkataraman:]

Yes. We are not going to be providing that color in terms of what the ARR is today, but you're right it's about 5 million, but it's not a meaningful impact in terms of when you look at our Q1 last year's versus Q1 this year's, 40% growth in ARR. Majority of the 40% Hamza was driven by the organic efforts of the KnowBe4 platform.

[Hamza Fodderwala:]

Okay. But it's at least $5 million ARR today, just to make sure.

[Krish Venkataraman:]

I'm sorry, Hamza, you broke up there.

[Hamza Fodderwala:]

I got to say it's at least $5 million in ARR today as well, right, or a little bit harder.

[Krish Venkataraman:]

That's true.

[Hamza Fodderwala:]

Okay, okay. Thank you.

[Krish Venkataraman:]

Thanks, Hamza.

[Operator:]

Your next question comes from line of Tyler Radke with Citi.

[Tyler Radke:]

Hi, good evening guys. Thanks for taking my question. I wanted to ask you about the domestic performance. I think you talked about 30% revenue growth there. I wasn't sure I talked this revenue ARR number. I think that might have come down a little bit from where that business grew in 2020. Maybe if you could just walk us through kind of the puts and takes there. And then just to follow up that somewhat related as you look out across your SMB base, kind of, where are we to return to kind of pre-COVID demand in renewal rates. Thank you.

[Krish Venkataraman:]

So - yes, I can take that on. So if you look at - I think the phenomenal part of this business, and I use the word phenomenally rarely, but I will use this case is how stable are our gross dollar retention as well as our logo retention has been. Of course, many of you guys have seen that over the last two or three years and we're seeing the same trend continue even in the worst periods of the pandemic and even to now. You're right. We don't talk about net dollar retention, but it's fair to assume that with further expansion of our cross-sell efforts, then it would be some positive momentum associated with that. Now, so that's - hopefully that gives a little bit color on that first point. Now, the second point in the U.S., it's I think Stu mentioned this also. Historically - grew in the U.S. markets, in the North American markets. And we have built a substantial share in the U.S. markets. So we are starting from very large base in terms of clients as well as revenue. But if you look at the overall Tam associated with - of our products, the Tam is substantially large globally, and that is very much greenfield right now, both on the SMB side as well as on the enterprise side. So there is ample opportunity for us to grow both domestically and internationally into the future.

[Operator:]

Okay. And your last question comes from the line of Joshua Tilton with Berenberg.

[Joshua Tilton:]

Yes. Hi, guys. Thanks for taking my question. Just the first one for me, I just wanted to touch on the net new ARR, which actually grew this quarter, which is kind of a solid turnaround from 2020. Can you just comment on this relative to the improving macro environment and also maybe what's baked into the full year guidance in regards to net new ARR growth?

[Stu Sjouwerman:]

That is definitely a numbers question for Krish.

[Krish Venkataraman:]

Absolutely, thanks for your question. As from a guidance perspective, there are two areas we actually provide guidance, which is, of course, in our earnings recording. One is revenue, and the second one is SCF margin. We do not provide any guidance on overall ARR for the rest of the year. Now, your second - you first point was, you're right. We did see a strong growth in ARR year-over-year and that's really driven by I would say three key factors. One a continued expansion into new logos and we have seen that trend over the last year and year and a half. The second key, which has mentioned, is the continued focus for the sales and the marketing teams to drive for the cross-sell of our products, both into new customers, where the attachment rates are much higher and now further into cross-sell our existing 39,000 customers. And the third thing that we're actually seeing further driving our ARR is the threat metrics, right. As Stu mentioned, the threat metrics continued to be very challenging, especially in international. And we're seeing further traction in international markets as you saw that our international revenue grew almost 88% year-over-year. So all three key pillars of our growth are really driving that ARR story.

[Joshua Tilton:]

That was helpful. And then if I could just follow up with one more, it seems as if some newer vendors are offering managed services or they're differentiating with additional value added features outside of just more content. So maybe can you guys just comment a little bit on where are you focusing your investments to ensure that you can maintain your competitive moat and market leading position?

[Stu Sjouwerman:]

I can take that one. There are a bunch of - the traditional story is there - there were 40,000 VARs, value added resellers, mainly U.S. All these people are trying to literally add more value and become managed service providers or even managed security service providers. Those are the organizations that are adding this additional security awareness platform because it helps them both in OpEx and in their revenues. The KnowBe4 platform is very well designed especially for those kinds of MSPs. And we have many hundreds of those that are actually using our platform. And we have a special pricing model and a go-to-market for those types of partners as well. So we feel we're in a good position to benefit from that particular trend in the market.

[Joshua Tilton:]

Thanks. That's very helpful.

[Stu Sjouwerman:]

Very good. Thanks, Josh.

[Operator:]

You have no further questions at this time.

[Stu Sjouwerman:]

Thank you very much.

[Operator:]

Ladies and gentlemen, this concludes today's conference call. Thank you for participating and you may now disconnect. Good-bye.