Proofpoint, Inc.
Q1 2018 Earnings Call Transcript

Published: 27 Apr 2018

[Operator:]

Good day and welcome to the Proofpoint's First Quarter 2018 Earnings Results Conference Call. Today's conference is being recorded. At this time, I'd like to turn the conference over to Jason Starr, Vice President of Investor Relations. You may begin.

[Jason Starr:]

Thanks, Kathy. Good afternoon and welcome to Proofpoint's first quarter 2018 earnings call. Joining me on the call are Gary Steele, Proofpoint's Chief Executive Officer; and Paul Auvil, Proofpoint's Chief Financial Officer. We'll be discussing the results announced in our press release that was issued after the market closed today, a copy of which is available on the Investor Relations section of our website. During the course of this call, we'll make forward-looking statements regarding future events and future financial performance of the company, which are subject to material risks and uncertainties that could cause actual results to differ materially. We caution you to consider the important risk factors contained in the press release and on this conference call. These risk factors are also more fully detailed under the caption Risk Factors in Proofpoint's filings with the SEC, including our most recent Form 10-K. These forward-looking statements are based on assumptions that we believe to be reasonable as of today's date, April 26, 2018. We undertake no obligation to update these statements as a result of new information or future events. Of note, it is Proofpoint's policy to not reiterate or adjust the financial guidance provided on today's call, unless it is also done through a public disclosure, such as a press release or through the filing of a Form 8-K. Additionally, we will present both GAAP and non-GAAP financial measures on today's call. These non-GAAP measures exclude a number of items as set forth in our release. These non-GAAP measures are not intended to be considered in isolation from, a substitute for, or superior to our GAAP results, and we encourage you to consider all measures when analyzing Proofpoint's performance. A reconciliation of GAAP to non-GAAP measures and a list of the reasons why the company uses these non-GAAP measures are included in today's press release. I would also like to remind everyone that we have adopted ASC 606 as of January 1, 2018 under the full retrospective approach. And as such, all of the comparisons to prior financial periods as discussed on today's earnings call and outlined in today's press release are made in reference to our retrospective financials as revised in accordance with the 606 accounting standard. As a final point, please recall that on March 1, in connection with the closing of the Wombat Security acquisition, we issued a press release and filed an 8-K that provided our view of the expected impact from the acquisition of Wombat on our financial outlook for both the first quarter and the full year 2018. As such, all references to our historical guidance will be with respect to the figures that we provided as part of that update. So with that said, I'll turn the call over to Gary.

[Gary L. Steele:]

Thanks, Jason. I'd like to thank everyone for joining us on the call today. The first quarter marked a strong start to the year for Proofpoint. Our ability to once again exceed expectations was driven by the ongoing migration to the cloud, the rapidly evolving threat landscape and our proven ability to identify and block advanced threats. Attackers increasingly target people often through socially engineered methods as opposed to infrastructure-based attacks. As recently indicated by Proofpoint's annual threat research report, The Human Factor, email continues to represent the top attack factor with ransomware and banking Trojans representing over 82% of all malicious email messages. Additionally, our research suggests that approximately 80% of businesses have experienced an email fraud attack often delivered via spoofed email addresses or fraudulently registered domains. Attackers are also increasingly using new vectors, such as cloud-based collaboration applications like Dropbox or SharePoint to send malicious messages and host malware to compromise end users. The damage can occur quickly as 30% of clicks in malicious mails happen within 10 minutes of delivery and over half occur within one hour. Placing people at the center of our approach, Proofpoint can tell organizations not only who their adversaries are, but also who in the organization is being targeted and how that compares to industry peers. This unique visibility changes the lens, showing customers how they appear from a bad actors point of view. Armed with this data and insight, Proofpoint can then put together actionable recommendations on what organizations can do to mitigate that risk to improve their overall security posture. Proofpoint enables organizations to better understand their greatest risks, their people, providing them the most comprehensive and effective protection, prevention and response capabilities for targeted threats to their data and the users themselves across email, social and cloud vectors. Now turning to some of our key operating results during the first quarter. Our suite of advanced resolutions, including Targeted Attack Protection, or TAP, offering continues to be important contributor to the growth of our business. We had a number of noteworthy TAP wins this quarter, including a Global 2000 contract manufacturer that purchased Protection and TAP for 92,000 users, a Fortune 500 healthcare company that purchased Protection, TAP, Privacy and Threat Response for 60,000 users, and a Fortune 500 airline that purchased Protection, TAP and Privacy for 21,000 users. Beyond the broader threat landscape, the ongoing transition to the cloud and the shift to Microsoft Office 365, in particular, continues to be a long-term catalyst that is helping to drive demand for Proofpoint's broader security compliance solutions. Examples of deals won this quarter where we displaced legacy on-premise security appliances as part of the migration to Office 365 included a Fortune 100 healthcare company that purchased Protection, TAP, Privacy, Email Fraud Defense, or EFD, and Threat Response for their 60,000 users, a Fortune 500 energy company that purchased Protection and TAP for 9,000 users, and a global specialty chemical and material company that purchased Protection, TAP and Threat Response for 4,700 users. We also continue to effectively demonstrate the strength of Proofpoint's products when compared to the Baseline Security solutions provided by Microsoft as part of their Office 365 bundles. Examples of customers who had moved to Office 365 and subsequently decided to upgrade their security compliance capabilities with Proofpoint during the first quarter included a Fortune 500 auto manufacturer that purchased Protection, TAP and Threat Response for 40,000 users and a global staffing company that purchased Protection and TAP for 30,000 users. Overall, the competitive environment remains favorable and we continue to experience high win rates, coupled with a world-class renewal rate that continues to exceed 90%. As a reminder, this renewal metric is derived by considering the total annual recurring revenue that is up for renewal during the quarter and calculating the percentage of that amount that is renewed. And note that this calculation excludes any additional services that are purchased by these customers at the time of renewal. That said, add-on sales to our existing customers provide a significant contribution to our growth and continues to represent approximately half of the new and add-on annual recurring revenue that is closed in a given quarter. We also remain very encouraged by the ongoing strength and demand for our emerging products. As we have mentioned in the past, these new offerings have meaningfully expanded our TAM and are proving to be an excellent source of growth. They also provide an important competitive advantage as they uniquely enable us to holistically defend the enterprise from rapidly evolving attack methods across email, cloud, social and mobile vectors in a way that is unmatched by the competition. The growth contributed from our emerging products continue to meaningfully outpace the rest of our product portfolio and contributed over 20% of the total new and add-on business closed during the quarter, up from over 15% last quarter, roughly doubling year-over-year. During the first quarter, we're pleased to close the acquisition of Wombat Security, a leader in phishing simulation and computer-based security awareness training, and expanding our emerging products portfolio. We are pleased with the progress we've made in the integration, and are excited that Wombat was recently named Best IT Security-Related Training Program at the SC Awards held as part of RSA. We have a compelling roadmap of integration points between the Wombat solution and our other product lines with several capabilities expected to be available here in Q2. One recent example of this is our new Abuse Mailbox Monitoring feature, which is being built into Threat Response and was announced last week at RSA. This will integrate Wombat capabilities into our security, orchestration and automation platform, Threat Response, and will provide fast and automatic processing of emails that users lag as potentially malicious through Wombat's PhishAlarm capability. Unlike current manual processes, Threat Response, Abuse Mailbox Monitoring orchestrates the proper remediation actions for malicious emails and services valuable threat intelligence, saving time and energy for security and messaging teams. A few of the key emerging product wins in Q1 included a Fortune 100 technology firm that added EFD for 138,000 users, a Fortune 500 real estate company that added Threat Response for 65,000 users, a Fortune 100 clothing manufacturer that added Threat Response for 50,000 users, a Fortune 100 pharmaceutical company that purchased our Social product, a Fortune 1000 industrial supply company that purchased EFD and Domain Discover for 168,000 users, and a North American airline that purchased Protection, TAP, Threat Response and the Wombat anti-phishing suite for 13,000 users. As a reminder, when incorporating the capabilities gained from our acquisition of Wombat, we now have over a dozen distinct product offerings, providing us with a tremendous add-on opportunity across our installed base, an opportunity we believe represents well over $1 billion in recurring revenue. Turning to our ecosystem partnerships with Palo Alto Networks, CyberArk, Imperva and Splunk, we remain very excited about these relationships as these partners continue to be very engaged during the quarter. In particular, our integration with Palo Alto's WildFire offering continues to resonate with customers who value best-in-class solutions when compared to other alternatives. Our teams are aligned at all levels and the broad cooperation in our go-to-market resulted in a number of new customers this quarter, including the two large wins in healthcare that I highlighted earlier. Another effective leverage point in our go-to-market has been the momentum we have seen with the channel, which extends our reach into new accounts, given their existing local relationships. We have made significant progress in our efforts to build these out over the past few years. For example, our largest deal booked in the quarter was channel-led and overall the channel again represented over 60% of the new and add-on business booked during the quarter. Finally, we continue to make progress towards further expansion abroad and are pleased with the uptick in our international business, which grew 59% year-over-year and represented 18% of total revenue and driven in part by the revenues generated from our recent acquisitions. Notable international deals closed during the quarter included a Global 2000 steel and mining company that purchased Protection, TAP and Threat Response for their 130,000 users, a Global 2000 multinational that purchased TAP and Threat Response for 128,000 users and a Global 2000 insurance company that purchased EFD for 20,000 users. We've also recently expanded our footprint internationally with operations in Italy and the Nordics. Given the success we're seeing and our belief that the addressable market in both EMEA and Asia-Pacific represents a compelling future growth opportunity for Proofpoint, we plan to continue to increase our investments in these regions. So, in summary, I am very pleased with our strong start to the year and the ongoing momentum we're seeing across our entire business. As a result, I believe we are well-positioned for growth and to gain share in the over $12 billion total addressable market. With that, let me turn it over to Paul.

[Paul R. Auvil:]

Thanks, Gary. Before discussing our results, I'd like to start with some observations in terms of how the new ASC 606 accounting standard impacts the reporting of our activity on our balance sheet as well as how it affects the calculation of our billings metric. Recall that during our earnings call last quarter, I had indicated that the adoption of the new standard would effectively accelerate revenue into earlier periods that would have otherwise been recognized in 2018. These accelerated revenues are now reflected on the retrospective ASC 606 income statements in the form of an increased revenues recorded in the years 2017 and prior as compared to the financial statements under the historical accounting standard. The corollary to this acceleration of revenues is in equal and offsetting impact to the deferred revenue balances carried on December 31, 2017 balance sheet as reported under the historical standard. As such, the balance sheet under ASC 606 as of December 31, 2017 reflects a direct reduction to the deferred revenue balances when compared to the amounts reported under the historical standard on December 31, 2017. The total deferred revenue adjustment is $23.9 million with the short-term deferred revenue balance declining from $381.9 million to $364.5 million. And the long-term deferred revenue balance declining from $69.9 million to $63.3 million. It is these new lower opening balances that should be used when evaluating Proofpoint's financial results for the first quarter of 2018 and for all future operating periods. In addition to these changes in deferred revenue, as we discussed on our last earnings call, the new standard dictates that the commission expenses associated with new and add-on business be amortized over the expected life of the solution, which we estimate to be five years for Proofpoint. This new accounting standard stands in contrast to our accounting under the historical standard, where commission expenses had been amortized over the contract term for each individual order with our historical average contract term as measured in months being in the mid to low-teens over the last few years. In updating our balance sheet to reflect this new standard, we have added $45.2 million to the opening balances of our deferred commissions here at the start of the fiscal year to be amortized in accordance with the new standard with the offset being lower commission expense reported on the retrospective ASC 606 income statements in the years 2017 and prior, as compared to the financial statements under the historical accounting standard. Beyond this change to the opening balance sheet, ASC 606 has also introduced a few changes in terms of how the billings metric is calculated. Under the historical standard, our billings for any given quarter could easily be derived by simply calculating the change in the deferred revenue balances over the course of the quarter and adding this amount to the revenue recorded during the quarter. However, under ASC 606, there are two new accounting elements that impact our balance sheet reporting, thus, introducing the need to refine our methodology for calculating the billings metric, so then it continues to tie to the actual amounts that we've invoiced to our customers during the quarter. The first element is the accounting associated with unbilled accounts receivable. Under the standard, in certain situations, revenues are recognized on the income statement prior to the customer actually being invoiced for them. As an example of unbilled accounts receivable, it'd be the case where a customer has executed a two-year contract paid in two equal installments, where the agreement includes both subscription services as well as a one-time professional services engagement. Under the revenue guidance, we're required to allocate an appropriate amount of revenue to the professional services activity and for this revenue to be recognized when the work is completed, which is likely within the first month of the contract period. As a result, the revenue recognized under the contract in the first year is greater than the revenue recognized in the second year, despite the fact that the amounts invoiced in the first and second year are equal. As such, by definition, a certain amount of the revenue recognized in the first year is unbilled, pending the invoicing at the start of the second year of the contract, at which point, the full value of the two-year contract has been invoiced, and hence there is no longer an unbilled element. Given this accounting dynamic, in order to properly reconcile to our true underlying invoicing activity, the historical approach to calculating the billings metric needs to be adjusted to reflect the unbilled accounts receivable activity during the quarter. The second element is the accounting associated with refund liability, also referred to as customer prepayments. Under the new standard, certain deferred revenue amounts are removed from the deferred revenue balance to reflect situations where a customer has been invoiced, but under certain conditions may have the right to a refund. In this case, the amount that is subject to a right of refund is reclassified from deferred revenue and instead considered a customer prepayment until this right of refund lapses. While the concept of a right of refund is not a Proofpoint contracting standard, we do have clauses of this nature in a handful of legacy contracts that were assumed by Proofpoint as part of our historical merger and acquisition activity. While we've never had a customer exercise their rights to a refund under any of these agreements, nevertheless, ASC 606 dictates that these amounts be adjusted out of our deferred revenue balances until the right of refund is lapsed. And as such, in order to properly reconcile to our true underlying invoicing activity, the historical approach to calculating the billings metric needs to be adjusted to reflect the impact to the deferred revenue balances driven by the customer prepayment accounting. Here in the first quarter of 2018, for example, when adjusting for the $14.7 million in deferred revenue added to the balance sheet derived from the Wombat acquisition, if we apply our historical method to derive billings, it would suggest a figure of $186 million. If we then adjust for these two accounting elements, the net of these two effects serve to increase the calculated billings metric by $240,000, bringing the total to $186.2 million, which properly ties out to the amounts invoiced to customers during the first quarter. As another point of reference, in the first quarter of 2017 when working from the retrospective income statement and balance sheet as restated under ASC 606, the adjustment associated with these two elements is roughly $700,000 in order to bring the calculated billings metric in line with the amounts invoiced to customers during that period. The detailed derivation of billings metrics under ASC 606 for Proofpoint are included in our billings reconciliation table as part of today's press release. So with all that as backdrop, let's get on to the results. As a reminder, given the many moving parts associated with the new ASC 606 accounting standard, combined with our acquisition activity, when providing guidance during our last earnings call, we chose to take a particularly thoughtful approach to projecting the overall effects on both revenues as well as expenses. And as a result, our performance for the quarter in terms of both revenue and profitability meaningfully exceeded our guidance. First quarter revenue totaled $162.5 million, up 40% year-over-year and above our updated guidance range of $151 million to $153 million. Note that our recent acquisitions contributed approximately 800 basis points to our growth during our quarter, and as such, our organic growth here in Q1 was roughly 32%, nicely ahead of our earlier guide of 30%. Billings for the first quarter were $186.2 million, an increase of 35% year-over-year and above the high end of our updated guidance range of $182 million to $184 million. Contract duration across our new, add-on and renewal business set a record low, coming in at the absolute low end of our historical range of 14 to 20 months and 10% lower than the duration that we recorded in the first quarter of 2017. Had our duration in Q1 been consistent with the past several quarters, we would have recorded billings that were at least several million dollars higher. That said, we were pleased to deliver the aforementioned billings of $186.2 million when viewed in this context. This trend in terms of duration is reflected in our deferred revenue balances, which ended the quarter at $466 million, up $25.5 million sequentially when adjusted for the $12.7 million that the Wombat acquisition contributed to the ending balance with short term growing by $40 million and long term falling by $1.8 million due to the exceptionally low duration of bookings recorded this quarter. As indicated in today's release, following our recent acquisitions, we have updated the naming conventions for the two revenue segments that we report. The first segment, formerly known as Protection and Advanced Threat, will now simply be referred to as Advanced Threat. The second segment, formerly known as Archiving, Privacy and Governance, will now be referred to as Compliance. The Cloudmark and Weblife product lines will be included in the Advanced Threat segment and the Wombat product line will be added to the Compliance segment. During the first quarter, our Advanced Threat segment grew 48% year-over-year and represented 76% of revenue. Our Compliance segment grew 21% year-over-year, consistent with the growth expectations that we outlined during past earnings calls and represented 24% of revenue. We expect growth in this latter segment to remain at these levels in the near term as the larger archiving deals in the pipeline continue to mature. Also note that the growth in the Compliance segment faced a difficult compare on a year-over-year basis, given the favorable adjustments to the retrospective results in the first quarter of last year under ASC 606. Turning to expenses and profitability for the first quarter, on a non-GAAP basis, our total gross margin was 77%, which was above our expectations, primarily driven by our strong revenue performance. During the first quarter, total non-GAAP operating expenses increased 41% over the prior-year period to $108.5 million, representing 67% of total revenue. Growth in spending was primarily driven by hiring, both in R&D and sales, as we added talent to both broaden and deepen the capabilities of our product offerings along with sales resources to build quick pick capacity. In terms of profitability for the quarter, we reported non-GAAP net income of $16.6 million, well above our updated guidance range of $7.5 million to $8.5 million, driven by our significant revenue outperformance during the quarter. Moving onto EPS, non-GAAP earnings per share for the quarter was $0.30 per fully diluted share, above our guidance range of $0.14 to $0.16. Note that the EPS calculation does apply the If-Converted method to our convertible notes, and as such, adds back the $431,000 in cash interest associated with convertible debt and uses 56.3 million fully diluted shares for the quarter. We've included a section in our press release entitled Computational Guidance on Earnings Per Share Estimates, which is intended to provide additional details on this topic and to explain the resulting differences in share count used in these calculations based on our results. On a GAAP basis, we recorded a net loss for the first quarter totaling $12.2 million or $0.24 per share based on 50.5 million shares outstanding. In terms of cash flow, we generated $34.9 million in operating cash flow and invested $8.5 million in capital expenditures, resulting in free cash flow for the quarter of $26.4 million, above our guidance range of $22 million to $24 million. We ended the first quarter with $117 million in cash and short-term investments and $201 million in debt compared to $332 million in cash and short-term investments and $198 million of debt as of December 31, 2017. This sequential decrease in cash during the quarter was driven primarily by the $224 million in cash used for the acquisition of Wombat, offset by both the cash generated from operations as well as the contributions to capital from stock option exercises and our employee stock purchase plan. Now turning to our financial outlook, starting with the second quarter of 2018, given the record low duration that we saw in the first quarter, we believe it is prudent to assume that this duration persists for the remainder of the year, and as such, we are adjusting our estimates accordingly. With this in mind, we currently expect billings to be $194 million to $196 million, resulting in a year-over-year growth of 34% at the midpoint. Regarding our revenue outlook, we are targeting a revenue range of $168 million to $170 million, or 38% growth year-over-year at the midpoint, and we expect the acquisitions to contribute roughly 800 basis points to our growth during the second quarter, and as such, this suggests an organic growth rate included in this guidance of 30%. Also, as I noted last quarter, we plan to eliminate Cloudmark's historical practice of selling perpetual licenses as well as wind down several legacy OEM relationships that were part of their historical business model, which will have the effect of reducing the revenue contributions to our results over the course of 2018. As it relates to ASC 606, it is important to note that under the new accounting standard, we will likely see some greater variability in terms of the growth rates recorded each quarter across the arc of 2018 as compared to the historical standard since the accelerated revenues under the new standard will vary from quarter-to-quarter based on the mix of business close during each period. As a result, these accelerated revenue elements, when considered in combination with our hardware and services, suggest that revenues that are derived from business that is booked and recognized in period can now be as high as 5% to 6% of revenue in any given quarter, which stands in contrast as compared to under ASC 605 where this in-period revenue was typically around 2%. Additional detail regarding these accelerated revenue elements will be included as a footnote in our 10-Q filing and denoted as Subscription Software, while the revenues amortized over the contract duration will be denoted in the same footnote as Subscription Service. We expect second quarter non-GAAP gross margin to be approximately 76% as our spending continues to catch up with accelerated revenue delivered during the past several quarters and we continue to carry some redundant costs associated our next-generation SaaS cloud system throughout the second quarter. We expect second quarter non-GAAP net income to be $8 million to $9 million, or $0.15 to $0.17 per share. As we had indicated in our updated guidance associated with the acquisition of Wombat, we expect the largest negative impact to net income from the acquisition to be realized during the second quarter as we take on a full quarter's worth of expense with a limited contribution to revenues. This guidance assumes an income tax provision exclusive of discrete items of $0.7 million to $0.8 million during the quarter, depreciation of approximately $8 million and a share count of 56.6 million fully diluted shares outstanding and adding back $431,000 in quarterly cash interest expense for our convertible notes as prescribed by the If-Converted method. In terms of free cash flow, as discussed during our call in February, we expect this year to follow a similar pattern to our results in 2017 with the majority of the cash flow delivered in the second half of the year. This asymmetrical timing of cash flow is somewhat more pronounced here in 2018, given the increase in acquisition-related spending during the first part of this year. Here in the second quarter specifically, we currently expect free cash flow of $15 million to $17 million. The second quarter guidance includes capital expenditures of roughly $10 million. From a full year perspective, as mentioned earlier, we believe that it is prudent to assume that this new lower duration persists for the remainder of the year, and as such, we've adjusted our estimates accordingly. Specifically, we now expect billings to be in the range of $866 million to $870 million, which represents an annual growth rate of 36% at the midpoint of the range. This compares to our previous guidance of $864 million to $869 million. In terms of revenue guidance, we are raising our estimates to a new range of $702 million to $706 million as compared to our most recent guidance of $691 million to $696 million. This new range implies an annual growth rate of 35% and takes into account the $10 million headwind for the transition to ASC 606, as discussed on our last earnings call, which, as we indicated last quarter, represents a 200 basis point headwind to our growth rate this year. It also now reflects the increase in our 2017 revenue as reported under ASC 606, which now stands at $519.7 million as compared to the $515.3 million under ASC 605. Note that our three recent acquisitions are expected to contribute just under 800 basis points to our growth rate for the full year, and as such, on an organic basis, our 2018 growth rate is 28%. Breaking this down, we had previously indicated that the Cloudmark and Wombat acquisitions are expected to contribute $50 million to $55 million to our revenues here in 2018. To provide some additional color, these expectations included $10 million to $15 million of organic revenue, driven by new sales of these products post the completion of these acquisitions. As such, roughly $40 million of these revenues in 2018 are inorganic, hence, contributing just under 800 basis points to our growth when measured against the $519.7 million in revenues that we recorded in 2017 under ASC 606. These inorganic contributions take the form of both deferred revenue written out of the balance sheet to be recognized during 2018 as well as the renewal of their respective historical customer bases over the course of the year. In the case of Wombat, for example, we will be filing an 8-KA in early May that includes their income statement for 2017, when they recorded revenues of $38 million under the historical accounting standard. With that as a point of reference, note that the deferred revenue brought over from the acquisition was only $14.7 million, of which $12.2 million will be recognized here in 2018. And with that as a starting point, the sales teams will work to renew the subscriptions of their historical customer base over the course of the year and in doing so rebuild the original revenue base over time. But with that said, the total revenues recorded in 2018 on the Proofpoint income statement from the existing Wombat installed base as of the time of the acquisition will be a fraction of the $38 million that they recorded in 2018. We continue to expect full year 2018 non-GAAP gross margins to be approximately 77%, at the low end of our 2020 target range of 77% to 79%. As a result, we expect full year 2018 non-GAAP net income to be $55 million to $60 million or $1.00 to $1.09 per share, an improvement from our updated guidance of $46 million to $50 million or $0.84 to $0.91 per share. Our new non-GAAP EPS guidance for 2018 is based on approximately 56.8 million fully diluted shares outstanding and adding back the $1.7 million in cash interest expense, as prescribed under the If-Converted method. Finally, despite our record low duration, we are raising our free cash flow guidance for the full year to the range of $141 million to $143 million or 20% of revenue at the midpoint, with the majority of this cash flow delivered in the second half of the year. This includes capital expenditures of approximately $45 million. A reconciliation of our GAAP to non-GAAP guidance for both the second quarter and the full year 2018 can be found in the press release that we issued this afternoon. In summary, we continue to execute well, delivering strong top and bottom line results in the first quarter and believe that Proofpoint remains well-positioned to maintain this momentum and operating discipline throughout 2018, given our proven capability to defend enterprises against today's advanced security and compliance threats. Before turning it over to the operator for questions, I would like to request that everyone limit themselves to just one question to help reduce the duration of our call and to ensure that everyone has a chance to be included in today's discussion. Thank you for taking the time to join us on our call today. And with that, we would be happy to take your questions now. Operator?

[Operator:]

We'll go first to Matt Hedberg with RBC Capital Markets.

[Matthew George Hedberg:]

Hey, guys, thanks for taking my question. I guess, for either Paul or Gary, with 12 new products now and the success you're having with some of these emerging products like TAP, EFD and others, when you look at the billings growth that you expect this year, how do you think about the contribution from existing customers when they add on some of these emerging products versus just sort of an organic net new customer coming into the franchise?

[Paul R. Auvil:]

Yeah. I mean, I think, as we look at it – it's a good question. I expect that given the way we built out our sales organization, which has a balance of team members that do nothing but go and hunt net new customers as well as customers to take – sales reps to take care of the existing customers and drive add-on sales and renewal activity. Historically, we've seen about a 50/50 balance between net new customer acquisition contributing to the new and add-on business in a quarter and about 50% that comes from the add-on activity. So, just as I look at the model, what we delivered in Q1 and our current estimates for the full year, I'd expect us to stay in that range of roughly 50/50 plus or minus. Now I do think that the emerging products that we talked about are likely to be a meaningful contributor to helping propel growth, particularly growth on the margin when you look at how some of these new products are received by our existing installed base and helping to deliver growth for the year. But, overall, I think we're looking for a 50/50 balance. Gary, is there anything else you want to add?

[Gary L. Steele:]

No, I think that's exactly right. I think the 50/50 balance is a very healthy way to continue to drive long-term growth of the business.

[Matthew George Hedberg:]

Great. Super helpful. Thanks, guys.

[Operator:]

And we'll go next to Jonathan Ho with William Blair.

[Jonathan F. Ho:]

Hi. Good afternoon and congrats on the strong results. I just wanted to ask for a little bit of additional color in terms of the seasonal billings pattern. I know there's a lot of moving parts here with the acquisitions and 606. Is there any way we can maybe get a sense from you of how that's going to maybe move around a little bit, just given the revenue recognition – I mean, just given the shifts that are there?

[Paul R. Auvil:]

Yeah. And I think you said it and didn't mean it. It doesn't affect the – the billings are not affected at all by ASC 606 other than the puts and takes that I talked about on the call in terms of how to drive the billings metric with regards to unbilled accounts receivable and this notion of customer prepayments. But with that said, if you just look, again, at the invoicing we expect to do over the course of the four quarters, I think it's reasonable to assume that you'll see something that's not inconsistent with our past couple of years. We do tend to have more activity in the second half of the year, both in terms of the renewal of existing customers and for whatever reason the velocity of new customer sales and add-on activity. It just seems to be the nature of the industry as we've experienced it in the sales of securities. So, as you think about kind of relative timing of activity this year, it probably won't look overly dissimilar to last year, albeit there is a benefit that we're getting from both the inorganic contributions from both Wombat and Cloudmark. But I think that will sort of roughly uniformly just lift everything up a bit from where we would have been otherwise in each quarter.

[Jonathan F. Ho:]

Great. Thank you.

[Operator:]

We'll go next to Sarah Hindlian with Macquarie. Frederick Havemeyer - Macquarie Capital (USA), Inc. Hi. This is Fred Havemeyer on for Sarah Hindlian. Doing our work, we were picking up that Microsoft actually leverages Cloudmark for some of its anti-spam technology within its email suite. So we are wondering if you could tell us what sort of licensing agreement Cloudmark has with Microsoft?

[Paul R. Auvil:]

Yeah, that's a good question. We don't comment on any specific customer arrangements, but you might have noted in the perhaps overly lengthy prepared commentary that I had. I reminded everybody that there were some OEM relationships that Cloudmark had established when they were operating as independent business that we plan to phase out. So any research that anybody might have done where you might find that there is a competitor using the Cloudmark technology, we do plan to phase those out, and that's part of what we'll put declining – a little bit of pressure to drive declining revenues on the Cloudmark business itself over the first several quarters that we own Cloudmark because those revenues will be phased out as those agreements are not renewed. Frederick Havemeyer - Macquarie Capital (USA), Inc. Thank you.

[Operator:]

And we'll go next to Melissa Franchi with Morgan Stanley.

[Melissa Franchi:]

Great. Thanks for taking my question. I just wanted to dig into the billings guide just a little bit more. So the billings guide moves up, but a little bit less than what you've been in Q1. Is that all from just the duration impact or is there something else in there? And if you're looking at it on a like-to-like basis, like contract duration adjusted basis, what would the organic growth be implied in your guidance?

[Paul R. Auvil:]

Yeah. So, to your point, this exceptionally low duration that we saw here in the first quarter, as I noted, our long-term deferred revenue actually declined by almost $2 million and with our typical duration over the last several quarters tends to grow by a couple million, so that's like a $4 million swing in Q1 in terms of what we would have seen with a somewhat more normalized duration versus what we saw in Q1. So, then think about that accumulating over a full year period, on the margin, it's a pretty meaningful number. And so, to your point, the guidance that we provided assumes this lower duration persist throughout the year since I don't have any information that suggests anything to the contrary. In terms of actually breaking out organic and inorganic billings, ultimately, what I've included is it's too complicated of a calculation to do and provide. But I feel like by taking the time to dissect and provide the details around organic and inorganic revenue, it gives you that sense for, as you think about how the billings are coming together and how that's driving revenue, you get some pretty clear visibility on the organic revenue contributions that our core businesses are creating. And, again, remember that those organic numbers do face about 200 basis point headwind as a result of the switch to ASC 606. So the net of it is we're really pleased with the revenue growth rate we put up in Q1. We feel like the guide right now at 30% organic for Q2, again, adjusted for a couple of hundred basis points, it's more like 32% under the old 605 standard. We feel like we've got some good momentum off here in the first part of the year.

[Melissa Franchi:]

Okay. Thank you very much.

[Operator:]

And we'll go next to Andrew Nowinski with Piper Jaffray.

[Andrew James Nowinski:]

Great. Thanks. Congrats on a nice quarter. I want to go back to some of your comments on the competitive environment. I think you said it remains favorable, which is consistent with your previous comments on other quarters. But I was wondering if you noticed a change in sales motion from Microsoft and whether they are getting any easier to beat and perhaps less focused on security now.

[Gary L. Steele:]

Yeah, a great question. We saw the competitive environment remain relatively stable from previous quarters and we didn't really see any big shift in the posture that Microsoft was exhibiting out in the marketplace. I think when I look at our win rates competitively across all the various competitors, our win rates stayed incredibly consistent.

[Andrew James Nowinski:]

Thanks.

[Operator:]

And we'll go next to Philip Winslow with Wells Fargo.

[Philip Winslow:]

Hey, guys. Thanks for taking my question. Congrats on a good start to the year. Just wanted to circle in on the emerging products. Obviously, you saw a big uptick year-over-year and even sequentially. I mean, is one of those emerging products really starting to break out? Or is this just some success you are seeing across the breadth of the portfolio?

[Paul R. Auvil:]

Yeah. I think we are seeing good strength across a variety of those. If you go back and listen to the prepared remarks where we noted customer wins, we did see a lot of EFD and Threat Response in the quarter. So there's been a pretty nice response from the market as it relates to dealing with the issues around email authentication that's driven demand on EFD. And then broadly speaking, in the orchestration and automation space, more and more customers are looking to automate specific use cases and I think that has driven our success on Threat Response. And as we look forward, I think the one that we are excited about is even in the very short time we own Wombat, we saw a lot of synergy across the deals we were doing and interest broadly speaking on the Wombat side. So those are things I'd highlight as – I don't know that I'd call it break out, but obviously, demonstrating incredibly good performance and it's what has driven the growth in that segment.

[Philip Winslow:]

Great. Thanks, guys.

[Paul R. Auvil:]

You bet.

[Operator:]

We'll go next to Alex Henderson with Needham.

[Alex Henderson:]

Super. I was hoping you could just talk a little bit about the cash flow commentary that you made. You said that you expected the bulk of the better cash flow to be coming in, in the back half of the year. I assume that that's a function of some of these acquisition costs that you are absorbing with Wombat. Is the back half rate more of a normalized rate that we should be using as a base as we look out into the following year with the lower base in the first half somewhat of an anomaly? Is that the right way to think about it?

[Paul R. Auvil:]

Yeah. And that's a really good question. So, if you go back and look at last year, for example, our rates tend to be a little lower in the first half, a little higher in the second half, and then you get an average overall that's obviously by definition in the middle of those two. I think that the same thing will be true this year, which is we are lower in the first half, but a little more pronounced as a result of acquisition-related spending, and will be higher in the second half. But I wouldn't take the second half run rate and then use that as a projection going into next year. We'll, as usual, have a bit of a step down Q1, in particular, we have a lot of cash flow items that happen in the first quarter uniquely, including paying out the company bonus plan, which is paid out annually. We have somewhat higher commission expense associated with accelerators. There's often kind of a kick-off for the sales team that's expensive and one-time items. So cash flow does tend to take a bit of a dip in Q1 and then work its way back up each year.

[Alex Henderson:]

Super. Very clear. Thank you.

[Paul R. Auvil:]

Thanks.

[Operator:]

We'll go next to Anne Meisner with the Financial Group.

[Anne M. Meisner:]

Hi, everyone. Thanks for taking my question. Paul, I'm curious to know if there's anything you can sort of point to that is specifically driving the lower invoicing duration. Is there a big difference in durations, maybe between the core email and archiving deals versus the emerging solutions? So that would be just a natural shift as you just book more new business with emerging products. Or do you think there's something sort of changing in procurement practices in the industry? I guess, anything specifically that you would point to that would lead you to believe this would persist.

[Paul R. Auvil:]

Yeah. So I would just say that our comp plans continue to be successful and the sales team tends to execute around things that help them get paid the most dollars on any given transaction and the comp plans that we literally established back in 2011 haven't change since then. Put a fine point on the notion of you get paid more if you do shorter duration deals where the customers ultimately pay more per user per year rather than getting a discount by paying for multi-year in advance. And so we have seen over the six-plus years we've been public now gradual decreases each year in that duration and we just hit a unique low point here in the first quarter. And, again, it's always hard to predict what your duration is going to be as you look into the pipeline for the coming quarter. Customers do often ask for a multi-year quote to contrast it with the one-year quote, so we can't really predict that mix. But I just felt, as Gary and I talk through, what forecasted models should we use for the year at this point, it just was prudent to use this number set at the low end of the range. But I would say that – Gary meets with a lot of customers, so maybe I'll let him comment on what he's seeing in the overall buying environment, but the read I have is there really isn't anything different.

[Gary L. Steele:]

Yeah. And I don't think there's anything different from a market point of view. I think the quarter that we just have represents the journey that we've been on to drive continued duration. And I would point out that this is in contrast to what a lot of the other vendors in the security industry are doing right now where they're increasing duration. We fundamentally believe with a really high renewal rate that the low duration is a great benefit for shareholders. So we've been on this journey and I think that our quarter just reflects the point we are in this journey.

[Anne M. Meisner:]

Okay. Perfect. Thank you very much.

[Operator:]

And we will go next to Gur Talpaz with Stifel.

[Gur Yehudah Talpaz:]

Great. Thanks for taking my question. So, Gary, I was hoping you could comment on some of the other acquisition in the space in Q1, namely Splunk's purchase of Phantom and then the acquisition of PhishMe I believe now called Cofense. Do you see this validation of your strategy or does this change the competitive dynamic in your view? Thank you.

[Gary L. Steele:]

Yeah, a great question. I think they're each very different. I think the acquisition of Phantom by Splunk, I think it shows there's this broad interest and demand in the orchestration and automation space. We have seen no competitive issue today with Splunk. We view them as a very good partner. And while yes, there will be some – probably some competitive friction with Phantom, it hasn't changed anything for us from a competitive point of view. And then on the PhishMe side, I think that change in ownership reflects the level of interest and momentum in this particular segment of phish simulation and security awareness training. We feel great about Wombat. We've seen really good early demand, and we feel like we executed that transaction at a perfect time to help drive growth in our business. So we're super excited about it.

[Paul R. Auvil:]

Yeah. I think the only thing I'd add is given the recent award that Wombat won, we're really proud of the team and what they have accomplished there. And I think for us it just put an exclamation point on the choice that we made to pursue the acquisition of Wombat and bring them in and make them part of the Proofpoint family. And it's not to say that PhishMe is not a good business, but it's a different business and one where – we just felt Wombat was a better fit. And, quite frankly, the purchase price that we paid was somewhat lower than I think what the PhishMe takeout price was. So we got a great company, great people, great products at a great price.

[Gur Yehudah Talpaz:]

Thanks. Congrats on the quarter.

[Paul R. Auvil:]

Thank you.

[Operator:]

We'll go next to Ken Talanian with Evercore ISI.

[Ken Talanian:]

Hi, guys. Thanks for taking the question. Just wondering, could you give us a sense for how you're tracking against your international growth plans and what might drive some upside to that during the year?

[Paul R. Auvil:]

As we noted, we were pleased with the growth rate that we put up in Q1 as it relates to our international expansion. We continue to believe that there is a significant amount of opportunity out there. And while we have been very focused on expansion in Europe, we noted the expansion in Italy, the expansion into the Nordics, we're going to continue to put more sales and marketing dollars in Europe specifically to continue to drive growth. And we feel good about where we are relative to our plan and the opportunity ahead of us.

[Ken Talanian:]

Great. Thank you.

[Operator:]

And we'll go next to Jayson Noland with Baird.

[Jayson A. Noland:]

Okay. Thank you. I wanted to ask Paul about the platform rollout. You've been rolling out a new system, I believe, in parallel with an old system to prove efficacy. So maybe an update there. And then the expected impact to second half gross margin.

[Paul R. Auvil:]

Yeah, good question. So this platform we've been working on now for several quarters, it's at full scale and running in parallel, and we continue to do extensive testing. We're actually really pleased in that the overall efficacy scores are better than the ones in the legacy platform. And so we're using that better scoring to improve efficacy immediately for all of our customers. But we've got some additional shake, rattle and roll we want to make sure that we put it through to ensure that when we switch over and we turn the other system off, that we don't end up with any sort of service disruptions for our customers. So we decided to extend that by another 90 days as compared to our original plan, which is why we're going to carry these redundant costs through the end of the quarter. But with that said, I think as you can see, we had strong gross margins in Q1 at 77%, primarily because of the strong revenue upside. We're bringing it down 100 basis points in Q2. And then I would think in Q3 and Q4, again, since we're calling 77% for the full year, you just see an offset where you'll see it move up into the 77% and hopefully a bit over 77% by the time we get to the fourth quarter.

[Jayson A. Noland:]

Okay. Thank you.

[Operator:]

We'll go next to Walter Pritchard with Citi.

[Walter H. Pritchard:]

Hi. Thanks. Gary, I wonder if you could update us on archiving. I know that market is a large one. Some of the legacy players haven't been investing, but it is still growing below your Protection business. Anything you see in the pipeline that might change that?

[Gary L. Steele:]

Yeah. It is interesting. While the security products have, obviously, grown faster, emerging products are growing fast, archiving has lagged somewhat. And I think what is interesting is there's been a lot of changes in the competitive dynamics with the changes going on at Micro Focus, the changes that went on at CA, with their Orchestria product, which is used by many financial services firms for supervision. The changes that have gone on with the spin-out of Enterprise Vault out of Symantec into The Carlyle Group and under private equity ownership. There really is a lot of change happening and we do see a very nice pipeline build where we continue to be extremely optimistic about the long-term opportunity with archiving. The question is, as we noted in the prepared remarks, there are larger deals there and we'll have to see how those surface into revenue. But we feel very optimistic about it, given the broad sweeping changes that are going on in the industry.

[Walter H. Pritchard:]

Great. Thank you.

[Operator:]

Okay. We'll go next to Steve Koenig with Wedbush Sec [Securities.

[Steve R. Koenig:]

Hi, there. Wedbush Securities. Hey, guys.

[Gary L. Steele:]

Hey, Steve.

[Steve R. Koenig:]

Hey. I want to ask you on Wombat. Talk to us a little bit about – we have your guide already, but I think your sales reps are very eager to get their hands on Wombat and the Wombat salespeople are very eager to sell into the core base. What's the potential for revenue synergy beyond what you guided or into next year? And also, just maybe a little color on the CASB product announcement too.

[Gary L. Steele:]

Yeah. So on the Wombat side, we basically had ownership for roughly a month where we had it in the hands of all of our sellers. And in that period of time, we saw significant uptake across the traditional Proofpoint sales reps going into either Proofpoint prospects or Proofpoint installed base. We also saw broad interest across the Wombat prospect base. So we feel good about that longer term opportunity. There is obviously lots of integration points which we're working hard on. We accomplished a lot in the quarter. We do believe that this segment of phish simulation and security awareness training is one that is very important, and we think that as we take this product capability globally, there's a lot of opportunity there. We need a little bit more experience to gauge how quickly that manifests itself in pipeline and turns to revenue, but we feel really good about that opportunity. On the CASB side, what we're seeing today is increasing synergy between the threats that are coming in over email and how malware and other threats spread across broader Office 365 environments. And so we're starting to see nice pipeline synergy between deals that we closed with Protection and TAP and those with our CASB offering. So we're excited about the potential there as well.

[Steve R. Koenig:]

Great. Thanks, guys.

[Gary L. Steele:]

You bet. Thanks.

[Operator:]

And we'll go next to Erik Suppiger with JMP Securities.

[Erik L. Suppiger:]

Yeah. Some of our discussions suggest social networking is getting to be more of a concern out there. Can you comment a little bit about what you saw from your Social Protection or Social Messaging Protection?

[Gary L. Steele:]

You bet. I agree with you. I think there continues to be broader and broader awareness as it relates to the concern around malicious activity as organizations more broadly engage on social. One of the things that has been consistent about our business is we continue to close incredible marquee customers. What we haven't seen yet is super broad deployments. So while we're winning to big marquee customers, we're just getting started in those customers. So there's lots of future potential as the social footprint grows. But definitely it's becoming a higher priority and we continue to win great marquee customers.

[Erik L. Suppiger:]

Does that have prospects for getting to be big revenues or meaningful revenues compared to something like EFD?

[Gary L. Steele:]

Yes and we believe that, but I would say that market is relatively early.

[Erik L. Suppiger:]

Very good. Thank you.

[Operator:]

Okay. We'll go next to Patrick Colville with Arete Research.

[Patrick E. Colville:]

Hi, there. Thanks for taking my question. On the Email Fraud Defense product, can you help us understand what penetration could go to? Is it just a product for the largest enterprises or could a smaller mid-market company also need to use Email Fraud Defense and Email Authentication? Thanks.

[Gary L. Steele:]

Yeah. It's a great question. It's interesting. We see interest at adoption basically all the way down our customer base. And so even in Q1, we actually historically had done – had basically levels with which we just didn't even want to pursue the deals and we've – actually we decreased those levels and gave our lower end of our sales organization access to the product and it seems to be doing quite well. So we've got very good success across the board. So it's not just the top of the enterprise; it really is a broad problem and we're seeing adoption of EFD across our installed base.

[Patrick E. Colville:]

Thank you.

[Operator:]

And we'll go next to Gabriela Borges with Goldman Sachs.

[Gabriela Borges:]

Great. Good afternoon. Thanks for taking my question. Gary, just a high level question on the conversations that you're having with customers today versus maybe a year ago. Have you noticed any change in the level of sophistication of the customers? Meaning, are they willing to engage more across the problem? Do they have a higher awareness of the types of things they need to be doing in email security, which maybe helping the emerging products group? And then if you could just comment on the customer size? The average customer that's coming to Proofpoint today, is there any change in the seats or is it pretty consistent versus a year ago or a couple of years ago? Thanks.

[Gary L. Steele:]

Yeah. I would say, to answer your last question first, I would say we've seen great consistency in terms of the kinds of customer we close that have been closing the profile from this year to last year and previous years. In terms of overall buyer sentiment and interest across our product line, we see a couple themes. One is there's this broader and broader understanding within the customer base around the risk associated with phishing and customers are allocating more dollars to this problem today. And as a result of that, they're looking to consolidate their spend. And so I think we are the benefactor as organizations think about what they're using to identify and block these kinds of phishing attacks, drive more visibility. We see ourselves taking share across a variety of vendors simply because our customer can go to one vendor and so that consolidation spend has been a big message that we've been hearing and I think it was really accentuated at RSA.

[Gabriela Borges:]

Thank you.

[Operator:]

And we'll go to Gray Powell with Deutsche Bank.

[Gray Wilson Powell:]

Great. Thanks for taking the question. So maybe a higher level one. How do you feel about the pricing environment for your core Email Security and TAP products? And then do you see any opportunity to increase prices on customer as they come up for renewal?

[Gary L. Steele:]

Yeah. So, a couple things. So one is pricing between Protection and TAP has remained pretty consistent. And the one thing that we – although we have the ability to do uplifts for our customers, we're always sensitive to ensure that we are not uplifting them above where we think the market is. So we're always assessing a customer how much they're paying relative to where we think actual Street prices are, where a customer – where we got in with a deeper discount with a customer will likely exercise that option to increase their pricing at the renewal time. If we've got a customer that's right on top of market pricing, we'll likely not increase their pricing at renewal time.

[Gray Wilson Powell:]

Got it. Thank you very much.

[Gary L. Steele:]

You bet.

[Operator:]

Okay. And our final question comes from Tim Klasell.

[Tim Klasell:]

Yeah. Hey, good afternoon, guys. Congrats on the quarter. Quick question, high level. Have you given any rethinking or revisit maybe to product bundling? You're giving a very broad product line and customers, as s you mentioned, are looking to consolidate vendors. What's your thinking about that? Does that change at all?

[Gary L. Steele:]

A couple of philosophies that I think are important. One is we don't over-bundle. So as a SaaS offering, if you're providing a bundle to a customer, they're not using all the capabilities, they will come back to you at renewal time and ask for a discount because they will claim that they are not using all of that bundle. So we're sensitive of that. But having said that, I think what we're doing a pretty good job of today is identifying the core capabilities that are of interest to a customer and bringing those capabilities together with a compelling price. And so while that's not a formal large bundle, it is creating the opportunity to create economic value for the customer and bring in multiple products. And I think it's reflected then if you look at the success we've had with our emerging products, as an example. I think that's one of the things that has been driving our success. And we're typically selling multiple products in that initial sale.

[Tim Klasell:]

Okay, great. Thank you very much.

[Gary L. Steele:]

You bet.

[Operator:]

And that concludes our question-and-answer session for today. I'll turn the call back over to Gary Steele.

[Gary L. Steele:]

Thanks. I want to thank everyone for joining us on the call today. We are pleased with our results and look forward to talking to you on our next call. Have a great day.

[Operator:]

And this does conclude today's call. We thank you for your participation. You may now disconnect.