Proofpoint, Inc.
Q1 2016 Earnings Call Transcript

Published: 22 Apr 2016

[Operator:]

Good day and welcome to the Proofpoint First Quarter 2016 Earnings Results Conference Call. Today's conference is being recorded. And at this time, I would like to turn the conference over to Paul Auvil, Chief Financial Officer. You may begin.

[Paul Auvil:]

Thank you. Good afternoon and welcome to Proofpoint's first quarter 2016 earnings call. Today we will be discussing the results announced in our press release that was issued after the market closed. I am Paul Auvil, Chief Financial Officer of Proofpoint, and with me today on the call is Gary Steele, Proofpoint's Chief Executive Officer. During the course of this call, we will make forward-looking statements regarding future events and future financial performance of the company. These forward-looking statements are subject to material risks and uncertainties that could cause actual results to differ materially from those in the forward-looking statements. We caution you to consider the important risk factors that could cause actual results to differ materially from those in the forward-looking statements contained in the press release and this conference call. These risk factors are described in our press release and more fully detailed under the caption Risk Factors in Proofpoint's most recent Form 10-K filed with the SEC and the company's other filings with the SEC. During this call, we will present both GAAP and non-GAAP financial measures. These non-GAAP measures exclude stock-based compensation expenses, acquisition-related costs, accretion of the debt discount and amortization of the debt issuance cost and interest expense associated with our convertible debt, additions to deferred revenue from acquisitions, costs associated with litigation, as well as the amortization of intangibles related to acquisitions, non-recurring income tax benefits, interest expense and other income and expense. These non-GAAP measures are not intended to be considered in isolation from, a substitute for or superior to our GAAP results, and we encourage you to consider all measures when analyzing Proofpoint's performance. A reconciliation of GAAP to non-GAAP measures is included in today's press release regarding our first quarter 2016 results which can be found in the Investor Relations section of our website. In addition, please note that the date of this conference call is April 21, 2016, and any forward-looking statements that we make today are based on assumptions that we believe to be reasonable as of this date. We undertake no obligation to update these statements as a result of new information or future events. So with that said, let me turn the call over to Gary.

[Gary Steele:]

Thanks, Paul. I'd like to thank everyone for joining us on the call today. The first quarter of 2016 marked a very strong start of the year for Proofpoint. Our ability to once again exceed expectations was driven by the strong ongoing demand for advanced threat solutions, continued high competitive win rates, robust add-on activity, and consistently high renewal rates. During the first quarter, the overall demand for our advanced threat solutions was driven by the fast-moving threat landscape. Cyber criminals continue to have success stealing sensitive data from companies by targeting individuals not infrastructure on e-mail, social, and mobile. Attackers commonly use large e-mail based phishing campaigns containing ever-changing forms of malware to bypass traditional defenses such as anti-virus. Throughout Q1, we saw high volume campaigns containing Dridex, a banking Trojan. In addition, we also uncovered a new form of ransomware called Locky which infects organizations and hold data hostage until a ransom is paid. This new form of ransomware recently made headlines were a hospital paid hackers to unlock their sensitive data. Furthermore, Proofpoint security researchers recently discovered a zero-day Adobe Flash vulnerability which affected all versions of – all Windows versions of Adobe Flash Player and have the potential to expose more than 1 billion connected desktops to ransomware. Throughout the quarter, we saw an increase of malicious mobile apps that are mining private data and sending that information to unauthorized servers around the world. Many of these applications are being downloaded from illegitimate app stores containing pirated and modified applications. In addition, we're seeing malicious actors use a combination of email and social media to target organizations in the form of malicious links posted on social media accounts or using impostor support accounts on social media that target banking and retail customers. As organizations look to solve these types of challenges, Proofpoint's Targeted Attack Protection suite, which includes solutions for e-mail, social and mobile, is ideally suited to address these threats. Underlying this suite of products is our proprietary graph database that correlates threat intelligence over hundreds of billions of nodes in real time and provides unparalleled visibility into advanced threat actors and campaigns worldwide. Now, turning to some of our key accomplishments during the first quarter. We were very pleased with the continuing momentum of our suite of advanced resolutions which represented roughly 50% of the company's new and add-on business during the quarter. The strong growth continue to be driven by the ongoing demand for TAP's next generation capabilities, a solution that uniquely combines the application of big data analytics and dynamic cloud based malware analysis to identify and block zero-day and polymorphic malware. In Q1, TAP grew just under 100% year-over-year, and we were particularly pleased with this performance, considering that by the end of 2015, we had almost doubled our active paying TAP customers to a little over 1,100 in less than a year. As a reminder, during the past few quarters, we have highlighted our belief that revenues from this business will continue to produce meaningful growth on an absolute basis, and our expectation for year-over-year growth when measured on a percentage basis will begin to moderate as these absolute comparisons become more difficult given the increasing scale of the TAP business. As a result, while the year-over-year comparisons will be less important going forward, we will, nevertheless, continue to provide some detail regarding the overall contribution of our advanced resolutions to our business. Some of the noteworthy TAP wins during the quarter included a leading European automotive company that added TAP for over 225,000 users; a global media company that added protection and TAP for 170,000 users; a Fortune 50 healthcare provider that added both protection and TAP for 20,000 users and bought privacy for 70,000 users; and a Fortune 500 toy manufacturer that purchased TAP and protection for 15,000 users. Another important trend we saw during the quarter was the rapid rise in what the FBI calls business e-mail compromise, BEC threats. In these attacks, an impostor sends an e-mail that appears to come from the CEO or another senior leader in the company directing a targeted employee to urgently wire funds or send valuable confidential information to the attacker. Often W-2 forms are personal records. While this type of attack is not new, the cyber criminals are now operating at an unprecedented scale and using new techniques to both avoid detection and personalized our e-mail to increase their success rate. In fact, according to the FBI, during the past years, these types of attacks have increased almost 300% in volume and caused enterprises more than $2 billion. Blocking these attacks requires deep expertise and core e-mail technology as the e-mails contain no malware and the attacker may send only a few messages per month to any given target. To this end, we are pleased, however, recently to announce the production rollout of our imposter classifier, a newly developed capability that is included as part of our standard email protection solution and is designed to identify and block these threats. During the first quarter, the demand for our core protection business was once again driven by our high win rates fueled by the need by many of these prospective customers to urgently address the new challenges brought by this rapid rise of imposter email. A few examples of protection wins during Q1 included a Fortune 50 bank that added protection for 250,000 users, a global professional services company and the energy industry which purchased protection and TAP for over 25,000 users, and a Fortune 500 pharmaceutical company that purchased protection, privacy and TAP for 12,000 users. In regards to our partnership with Intel McAfee, we continue to be very excited about having been chosen as the exclusive partner for Intel Security customers as the end-of-life, their email security product line. As a reminder, for some time now, we have had success displacing the Intel Security solution with our best of breed cloud-based platform and we expect that this partnership will help to accelerate this transition over the next 12 months and beyond. Many of these larger customers are developing their migration plans which we believe will come to fruition in the coming quarters. While the end-of-life program has yet to contribute materially to our financial results above our historical baseline level of activity. During the first quarter, we did see an overall an acceleration in this pipeline. With that said, I'd like to highlight that for a number of customers that we transitioned from McAfee during the first quarter, we are seeing the value of the recurring subscription business more than double as compared to the amount that these customers had historically paid to Intel. These customers only purchase a replacement for the baseline email security solution, but also bought additional Proofpoint solutions such as Targeted Attack Protection or privacy. This suggests an early validation of our thesis that the long-term value of the McAfee customer base may be quite a bit larger than the initial estimates since we have the opportunity to not only [indiscernible] the existing subscription revenues associated with the legacy back of the email security solution, but also leverage our broad suite of solutions to cultivate meaningful add-on revenue from this new set of customers. While we are pleased to see evidence of this broadening of the potential long-term value of this customer base, we do expect that many of these customers will initially choose to simply trade out their protection platform at first with the add-on business developing over the course of our relationship with the customer. During the first quarter, Proofpoint also continued to benefit from the overall transition to the cloud, driven by the shift to Microsoft Office 365. Examples of wins during the first quarter include a Fortune 50 consulting company that added protection for over 400,000 users; a large bank that purchased protection and TAP for 13,500 users; and one of the nation's leading SaaS companies that purchased protection, TAP, and threat intelligence for 6,000 users. Looking forward, we expect enterprise customers moving to Office 365 to continue to look for additional security capabilities to complement and enhance the baseline solutions provided by Microsoft. In addition, this move to the cloud is continuing to force the displacement of on-premise solutions and the need to replace the existing compliance infrastructure that had been deployed on premise in support of the legacy Exchange environment. As a result, we expect that this overall transition to the cloud will remain a catalyst that drives demand for Proofpoint's broader cloud-based security and compliance capabilities for a number of years to come. In regard to our social media security solutions, we were pleased with the progress during the quarter as this emerging market continues to evolve. A few of the key wins for the quarter included a Global 100 bank in Europe that purchased a solution to audit its social footprint for security and compliance issues and detect and report fraudulent social accounts. And the Fortune 500 retail food and beverage company that purchase the solution to stop targeted apps on a social account tackle high volume to social media spam, audited social footprint for security and compliance issues and detect and report fraudulent social accounts. Longer term, we continue to expect demand to track the overall development of this market and believe that Proofpoint remains well-positioned to take advantage of this growing opportunity. During the first quarter, our cloud-based archiving results were in line with our expectations as we closed a number of smaller, but important deals. We continue to have a solid pipeline of larger opportunities, and as we mentioned on the last earnings call, the sales cycle on this larger archiving opportunities tend to be longer than the classic security deal. As a result, we expect to see momentum develop over the course of the year as these deals come in. In terms of our recently announced technical partnership with Palo Alto Networks, we are excited about the relationship and the positive momentum that we saw during the first quarter resulting in a healthy pipeline of opportunities. As a reminder, Proofpoint and Palo Alto Networks work together to integrate best-in-class security intelligence from Proofpoint's TAP and Proofpoint's SocialPatrol with Palo Alto WildFire to enable an integrated fully automated protection solution across the network, the end point and the cloud. By integrating our products, our joint customers get the benefit of automated protection across their infrastructure regardless of attack factor and highlight the importance of our overall ecosystem. We are continuing to work on additional partnerships to expand our security ecosystem and look forward to updating you on our progress throughout the year. Also noteworthy is our ongoing momentum with the channel which contributed approximately 60% of our new and add-on business during the quarter, up from our historical average of approximately 50% over the course of last year. As well, the announcement of both the McAfee end-of-life program as well as the Palo Alto Networks partnership have brought new partners to our doorstep while looking to add the Proofpoint family of solutions to their line card. Finally, we continue to make progress toward further expansion abroad. During Q1, our international business accounted for 17% of total revenues and grew 27% year-over-year, reflecting a solid performance by our team overseas punctuated by the fact that they closed of the five largest deals for the quarter. In addition to the aforementioned TAP deal with a leading European automotive company for over 225,000 users, other examples of key international deals won during the quarter include one of Europe's largest insurance company which purchased TAP for over 80,000 users, a large European IT services company which purchased protection for over 50,000 users, and a large European retailer which bought TAP for over 30,000 users. The addressable market outside of the United States in both EMEA and Asia Pacific continues to represent a compelling future growth opportunity for Proofpoint, and we plan to further grow market share in these regions going forward. So in summary, I'm very pleased with our strong start to the year and the ongoing momentum we are seeing with our advanced threat solutions. Enterprises continue to select Proofpoint's cloud-based advanced threat protection solution over legacy alternatives given our proven capability in handling today's advanced security threats. As a result, I believe we are well-positioned to grow market share in the over $9 billion total addressable market. With that, let me turn it back over to Paul.

[Paul Auvil:]

Thanks, Gary. We were very pleased with our strong execution during the first quarter highlighted by our ability to exceed revenue, billings, profitability, and free cash flow expectations. Proofpoint continue to benefit from the combination of a healthy growth rate of new customers, a strong cycle of add-on sales to our installed base, and a world-class renewal rate that remains well over 90% across the approximately 4,000 Proofpoint customers that represent our target market. During first quarter, total revenue was $79 million, up 37% year-over-year and above our previously announced guidance range at $75.5 million to $76.5 million. These strong results were driven by a 39% year-over-year growth in our subscription revenue. In terms of our revenue reporting by segment, I first like to note that starting in 2016, our Privacy business is now being included as part of our Archiving and Governance segment, reflecting the fact that we have reorganized our product lines to better align with how we manage our product development and go-to-market activities. The annual growth rates that I'll discuss with these newly realigned segments reflecting approximately reclassification of the historical periods to ensure that they provide an apples to apples comparison for reporting purposes. And our press release includes a fully updated history based on these newly reorganized segments for the five quarters beginning Q1 of 2015. With this updated classification, during the first quarter, our protection and advanced threat segment comprised 71% of total revenues and grew 47% annually. The archiving privacy and governance segment made up the remaining 29% and grew 17% year-over-year as we saw a continuation of smaller deals closing during the quarter. We remain very excited about the prospects for our archiving, privacy and governance business over the course of 2016. As we mentioned on the Q4 earnings call, we do expect that the larger and somewhat more complex deals in our pipeline will find their way to the finish line later in the year as customers clean up their on-premises archives and move them to the cloud. In the near-term, we expect the sales team to be focusing most of its effort toward our security and advanced threat products where customers are deploying budgets at a faster pace and with greater urgency. Billings for the first quarter totaled $98.3 million, reflecting a growth rate of 48% on a year-over-year basis and exceeding the high end of our previously announced guidance range of $90 million to $92 million. Note that this performance included early renewals of approximately $5 million that were pulled into the first quarter from Q2. Even adjusting for this effect, we still delivered a nice upside to our billings performance that exceeded the high end of our guidance range for the quarter. With regards to duration, we continue to make progress on our ongoing initiative to lower the duration of our customer contracts. And here in Q1, we reached a new milestone with the average contract duration coming in just below the low end of our historical range of 15 to 22 months for the first time in our history. This was clearly reflected in our deferred revenue trends where short-term deferred revenue grew sequentially by $21 million over the prior quarter, whereas long-term deferred revenue declined slightly. Had our duration been consistent with last year's averages, we would have recorded an additional billings to the tune of roughly $3 million for the quarter. Normalizing this quarter's billings for the impact of both early renewals and duration, and considering the context of the impact of early renewals in the year-ago period, as noted on our earnings call in January of 2015, the overall growth rate for billings this quarter was roughly 35%, so consistent with our revenue growth rate recorded this quarter. Turning to expenses and profitability for the first quarter, on a non-GAAP basis, our total gross margin was 74%, which was slightly above our expectations and at the low end of our long-term target range of 74% to 76%. We were very pleased with our execution, particularly since it highlights the leverage we are starting to see from our cloud infrastructure investments to support growth. In terms of our operating expenses, we continue to invest in sales and marketing, as well as research and development, to support future growth. During the first quarter, total non-GAAP operating expenses increased to 42% over the prior-year period to $60.8 million, representing 77% of total revenue, up from 74% during the same period last year. Growth in spending was driven primarily by growth in personnel, both in R&D and sales as we added talent both to broaden and deepen the capabilities of our product offerings along with sales resources to build quota capacity and to drive new customer acquisition, as well as add on sales to existing customers. I'd also like to highlight that our non-GAAP G&A expense at just 7% of revenue represents the best-in-class performance in terms of administrative efficiency for SaaS companies of our size and scale and growth rate. First quarter 2016 adjusted EBITDA was positive $1.3 million and was well above our guidance range of a loss of $0.5 million to $1 million, primarily driven by the upside to revenue. I would like to note that during the earnings call last quarter, I indicated that our move to deferred commission accounting would have an unfavorable impact to our profitability for the first quarter of approximately $1 million. In fact, the final figure was an unfavorable impact of $1.5 million. So, under our historical method for commission accounting, we would have delivered an EBITDA figure of roughly $2.8 million, over twice the level of profitability recorded during the first quarter of 2015. Non-GAAP net loss was $3.5 million, or $0.09 per share, based on 41.1 million weighted average shares outstanding and was above the better end of our guidance range of a loss of $0.14 to $0.15 per share. On a GAAP basis, net loss for the first quarter totaled $31.7 million or $0.77 per share based on 41 million – 41.1 million weighted average shares outstanding. I also wanted to call out that our GAAP results included $1.2 million in litigation expenses related to our ongoing defense of patent litigation instigated by Finjan. In terms of cash flow, during the first quarter, we generated $17.4 million in operating cash flow and invested $7.8 million in capital expenditures, resulting in positive free cash flow for the quarter of $9.6 million, which was slightly above our guidance. The over performance was driven by a strong collection cycle during the quarter combined with linearity with the mid quarter that was notably above our historical averages. Turning to the balance sheet, we ended the first quarter with $409.8 million in cash and short term investments and $350.8 million in debt compared to $406.2 million in cash and short-term investments and $345.7 million in debt as of December 31, 2015. As a reminder, we carried two series of convertible notes on our balance sheet that are due in 2018 and 2020 respectively. The first series due in 2018 pays annual interest of $2.5 million in two equal installments during the second and the fourth quarter and the conversion price on the notes is $39.02 and if converted, 5.2 million shares will be issued. The second series due in 2020 pays an annual interest of $1.7 billion in two equal installments also during the second and the fourth quarter and the conversion price on the notes is $81.23 and if converted 2.8 million shares will be issued. I would like to highlight that you're currently generating a net loss, and as such, our weighted average share count of 41.1 million for Q1 of 2016 does not include the impact of vested stock options. If we were profitable today, our fully diluted share count would have been approximately 43.7 million shares when applying the treasury stock method to these vested options. Total deferred revenue increased $71.1 million or 41% year-over-year to $243 million during the first quarter, up from $172 million in the year-ago period. Before turning to financial outlook, I would like to remind everyone that our results in 2016 reflected change in how we account for commissions as discussed on our calls in both October of last year and then again in January of this year. We are moving from our historical approach of expensing commissions during the period in which they were incurred to the accounting policy used by most larger SaaS companies, including Salesforce, ServiceNow, Workday and Ultimate Software, where the commissions are amortized over the term of the revenue contract providing a better matching between revenue and expenses on the income statement. During the January call, we indicated that we were expected – that we expected the full year impact to sales expense to be a favorable benefit of approximately $4 million starting with a $1 million unfavorable impact in the first quarter and then gradually improving from there. As an update to those figures, the actual impact to the first quarter was an unfavorable effect of $1.5 million, so $0.5 million worse than originally expected. With that said, as we assess the rest of the year, we expect the impact to the remaining three quarters of the year to be consistent with our guidance provided in January, namely Q2 as a favorable impact of $0.5 million, Q3 as a favorable impact of $1.5 million and Q4 as a favorable impact of $3 million. Hence, the overall impact for the full year has been modestly reduced by $0.5 million to an overall favorable impact of $3.5 million. Now, turning to our financial outlook, starting with the second quarter of 2016, we currently expect billings to be $94 million to $96 million. When considering the $5 million of early renewal pull-ins reported here in the first quarter, combined with the fact that the billings in the second quarter of 2015 benefited from $5 million of early renewals, as noted on our call in July of last year, the effective underlying year-over-year growth rate is just over 40%, at the midpoint of the range. Regarding revenue for the second quarter, we are targeting total revenue of $83.5 million to $84.5 million or 32% growth year-over-year at the midpoint of the range. We expect second quarter non-GAAP gross margin to be approximately 74.5%, reflecting ongoing sequential improvement in the leverage in our operating model. With regards to adjusted EBITDA, we are currently targeting $2 million to $2.5 million for the second quarter. We expect second quarter non-GAAP net loss to be $2.9 million to $3.4 million or a loss of $0.07 to $0.08 per share based on approximately 41.6 million weighted average shares outstanding, and this assumes an income tax provision exclusive of discrete items of $0.3 million for the quarter. As a final point, we expect free cash flow during the second quarter to roughly breakeven as the strong collection performance and linearity during the first quarter resulted in collections being pulled into Q1 that would have otherwise been expected in the second quarter, hence accelerating cash flow delivered by the business for the first half of the year. We are quite pleased with the prospect of delivering roughly $10 million in free cash flow for the first half of the year, marking a strong start to attaining our goal to the full-year. From a full-year perspective, we are increasing our guidance above the over performance just reported in Q1, driven by the expected ongoing strength of the business. Specifically, we now expect billings to be in the range of $435 million to $438 million which represents an annual growth rate of 35%, at the midpoint of the range, and this compares to our previous guidance of $428 million to $431 million. With this billings performance, we are also increasing our total revenue guidance to $350.5 million to $353.5 million reflecting an annual growth rate of 33% at the midpoint of the range, and this compares to our previous total revenue guidance of $345 million to $348 million. We expect full year of 2016 non-GAAP gross margins to be improved to approximately 74.5% or just about the low end of our five-year target. With these effects in mind, adjusted EBITDA for 2016 is now expected to be in the range of $15.5 million to $16.5 million, up from our previous guidance of $12 million to $14 million, so a nice improvement when considering the context of our over performance during the first quarter. As a result, we expect full year 2016 non-GAAP net loss to be $5.4 million to $6.4 million or a loss of $0.13 to $0.15 a share, an improvement from our previous guidance of a net loss of $8.6 million to $10.6 million or $0.21 to $0.26 per share. Our new non-GAAP EPS guidance for 2016 is based on approximately $41.9 million weighted average shares outstanding and assumes depreciation of approximately $17 million, cash interest expense associated with convertible debt of roughly $4.2 million and an income tax provision exclusive of potential discrete items of approximately $1.2 million. We continue to expect to report positive non-GAAP net income and EPS for the fourth quarter of 2016. Finally, given our strong performance here in the first quarter, we are raising our free cash flow guidance to the full-year to a range of $32 million to $36 million with the majority of the cash flow delivered in the second half of the year. This 2016 guidance assumes capital expenditures of $28 million to $30 million, depreciation of roughly $17 million, cash interest expense associated with convertible debt of $4.2 million and ongoing patent litigation expense of approximately $4 million. In summary, we were very pleased with our strong execution and believe that our first quarter performance which bears compelling top-line growth with meaningful expansion of free cash flow puts Proofpoint in a unique category within the SaaS industry matched by only a few other subscription businesses of our size and scale. Before turning it to the operator for questions, I wanted to remind everyone again that we are hosting our Investor Day in San Francisco on Wednesday morning, June 8. In addition, we would appreciate it if you would each ask just one question and a follow-up and get back into the queue in order to allow everyone time to ask their questions. With that, I wanted to thank you for taking time to join us on our call today and we'd be happy to take your questions now. Operator?

[Operator:]

Thank you. [Operator Instructions] And at this time, we'll take a question from Rob Owens with Pacific Crest Securities. Please go ahead.

[Rob Owens:]

Good afternoon, guys, and thanks for taking my question. I wanted to drill down a little bit into your commentary on Office 365 and you mentioned a couple of enterprise customers using Proofpoint as they moved to 365. Talk about the experiences like do they go with the Microsoft free stuff first and then come back to you, are you part of the decision process upfront?

[Gary Steele:]

Yeah, Rob, great question. So, while we typically see as customers are making the decision to go to Office 365, they look at the overall security environment offered by Office 365 based on their capabilities and they typically test and look at other alternatives at that time when they're going. So what we're finding as that migration process begins and as the planning begins, they engage with vendors such as us to augment the capabilities delivered by Microsoft. And that's been pretty consistent with the – I mean very early days when basic capabilities were well-known. I think people would try it for a while then come back more commonly today. We see customers coming to us as part of the migration process.

[Rob Owens:]

Great. And then as a follow up and I think Office 365 may tie into it. But you mentioned it was a very linear quarter which I think about the trend from what a lot of other IT manager seeing in terms of what appeared to be somewhat backend weighted. So, just some color in terms of why you felt your quarter was more linear than usual here than some of the trends that might be driving that. Thanks.

[Gary Steele:]

Yeah. I think as you indicated, we did have very strong linearity throughout the quarter. We actually participated in an investor conference mid-quarter. We indicated at that time that we were seeing strong linearity. I think the key drivers there where the comments were tied to the comments that I've made relative to the threat landscape. The business email compromised challenge at many organizations are facing was the key driver for us. The continued evolution in the threat landscape whether it'd be ransomware or other types of threats was also key driver. And then I think there's this continued tailwind from Office 365 which I would say probably had a recently linear effect. But from a macro point-of-view, we saw no change in macro coming out of Q4 all the way through Q1.

[Rob Owens:]

Thank you.

[Gary Steele:]

Thanks, Rob.

[Operator:]

At this time, we'll move to Phil Winslow with Credit Suisse.

[Philip Winslow:]

Hi. Thanks, guys, and congrats on a great quarter. Obviously, you outlined a lot of incremental opportunities that you guys have this year so much you discussed in the past obviously the macro relationship and then the partnership with Palo Alto Networks that you guys talked about it at RSA. Seems a little bit deeper than just a business partnership, but actually on a technical side. So as you think about sort of the guidance that you gave for the rest of this year, how do you sort of just rank order this in terms of their potential contribution and also sort of what you've also just kind of baked in for the next few quarters from this just kind of on a relative basis would be helpful.

[Paul Auvil:]

Yeah. I would say that for now, Phil, we haven't baked much in. Again, we are seeing some pipeline contribution from both the McAfee-Intel migration, as well as our announced relationship with Palo Alto. And so they are certainly playing a role in helping to drive pipeline. But as Gary mentioned in his prepared remarks, the business that we actually saw for McAfee closed during the first quarter was at the high end of the range, but not outside the ordinary of what we've historically converted from the McAfee installed base. So, again, I don't see evidence of a meaningful change there. I'm really still operating under the characteristics that we'll continue to see pipeline conversion rates that are consistent with our historical norms, and that's what's reflected in the guidance. So, there's certainly still room for upside if we start to see some acceleration from the McAfee pipeline and the conversion rate there or something kind of unique happen with one of the channel partners in and around the Palo Alto relationship. There's certainly room for some potential upside above and beyond what we've talked about so far. And so we're excited about that, but we're not assuming any extraordinary effects in the guidance that I went through a few minutes ago.

[Philip Winslow:]

Got it. Thanks, guys, and congrats again.

[Paul Auvil:]

Thanks, Phil.

[Operator:]

At this time, we'll move to Jonathan Ho with William Blair.

[Jonathan Ho:]

Hey, guys. Congrats on the strong quarter. Just wanted to start out with the [indiscernible] classification for the impostor emails. I mean, it doesn't sound like this is something you're charging extra for, but can you talk about maybe what this means in terms of maybe more customers transitioning over from legacy systems and what this could mean in terms of further differentiation for your systems?

[Gary Steele:]

You bet. So the capability that we announced – we actually announced it in the last 30 days and it went into full production. And that capability is something that is a core feature of the product. Some people get that without any incremental charge. To your point though, we do view this as a key differentiator from many of the legacy solutions and a reason that people would move and move fast. I could give you a 1,000 anecdotal stories talking to customers the challenges that they see with this kind of e-mail that's coming in at a high frequent basis today. And although much of this doesn't land in the public because people don't have to report these kinds of things unless they're material to their financials, it's happening all over the place. So, we see this as a very important trend in the industry and an important tailwind to drive people off their legacy solution on to Proofpoint. We move quickly on this, develop this technology. We basically saw this growing trend in the fall and began to work rapidly to get something out in the market. So, we do think it will have an impact in our ability to convert legacy customers over to Proofpoint.

[Jonathan Ho:]

Got it. And then can you talk a little bit about the social product? And I mean, I know it's early days, but what sort of potential are you seeing out of this business? How does the growth rate compare with the other sort of newer solutions that you've come out with? Just trying to get a sense of what that can contribute.

[Gary Steele:]

Yeah. I'll start and then Paul would jump in as well. So, what we're seeing today and you heard in our prepared remarks is we are winning critical wins in large account. So, the organizations today that are most likely to buy are organizations in financial services, CPG, media and entertainment, all of those organizations have reasonably large social footprints. And strategically, social is playing a role in how they market and sell. We are very pleased with the results that we saw in the quarter, but we also had very realistic expectations. And so, we understand where this market is, and we see the full potential over time. We're still at the earlier stages in that market. And then I'll let Paul comment on magnitude.

[Paul Auvil:]

Yeah. I mean, in terms of growth rates, certainly, because it's working off small numbers, its growth rate is very high on a percentage basis. We don't specifically comment on it because it's not a really material factor yet in driving our business whereas the targeted attack product family is a material element and so we chose to start calling it out, I guess, a little over a year ago in the script. I think they may very well be a time in the future where we will do the same thing with social. But right now, we've got some great early adoption with Fortune 1000 brand names and some interesting international customers. So we're really pleased with the kind of business we're closing. And it is contributing to the growth, and it's more than covering the cash associated with the R&D investment, what have you. So we're pleased with its current status, but it's not quite material yet in the context of our business. But I think we felt like we've got a very good market position there. We've got very good technology, great team, and a great opportunity ahead of us.

[Jonathan Ho:]

Great. Thank you.

[Gary Steele:]

Thanks, Jonathan.

[Operator:]

And we'll move to Gray Powell with Wells Fargo Securities.

[Gray Powell:]

Great. Thank you very much. I just want to follow up on the McAfee side of the discussion. How quickly do you think the appliance side of the McAfee e-mail business migrates off and becomes an opportunity for you?

[Gary Steele:]

Yeah. Good question, Gray. So what we're seeing today and we indicated this in the new script is that the larger on-premise customers that have those appliance environments, they're beginning their planning process. We do think that it will – they've got five years from January of 2016 to move, so they've got a reasonable amount of time. I think it's fair to assume that – and it's our expectation that we'll see many of those customers move in the first half of that five-year period. But we don't necessarily have some imminent view that it happens in the next couple of quarters. And we're working hard to be in front of those customers, work with them on their migration plans as they begin to develop a process to move over.

[Gray Powell:]

Got it. That's very helpful. Then just one more. How fast is your core email business growing to – growing relative to total revenue?

[Gary Steele:]

Yeah. We don't disclose that specifically. We just have the protection in the advanced threat segment where we talked about the 47% growth rate there. Clearly advanced threat, specifically TAP, is a disproportionate amount of that growth rate. But that said, the protection business continues to grow well above the overall growth rate of that market, which is in low-single digits. So we're pleased with that market share aggregation we continue to see. And it kind of speaks to the great opportunity we still have well ahead of us, because our current market share in core protection, which is a couple billion-dollar market, is under 10% on a worldwide basis. And so we have plenty of opportunity to take share there, grow that, also drive the TAP add-on business and then of course sell the remaining portfolio of our products to those customers.

[Gray Powell:]

Got it. Okay. Thank you very much.

[Gary Steele:]

Thanks.

[Paul Auvil:]

Thanks, Gray.

[Operator:]

We now move to Walter Pritchard with Citi.

[Walter Pritchard:]

Hi. Thanks. Paul, can you talk about what drove the early renewals? I think you've seen that in Q4 in the past, and I'm just wondering in Q2 – Q2 and Q1, was there something specific? Do you expect that activity? I know there's all of the – somewhat of an undertone of that going on, but it was higher this quarter.

[Paul Auvil:]

Yeah. I know, exactly, which is why we felt we should call it out because it's an important factor, especially in understanding our Q2 billings guide. But we had about half of those customers where they decided to engage in an add-on cycle, and that naturally pulled in the renewal because they just felt it was easier to wind all that up at the same time. And with the other half, again, we just have customers who it's easier to get the debt cleared early in the year. Let's get the renewable done. They've got other projects they're working on. They know they're not going to renew given the relatively low interest rate environment, the time value of money or pay me a little bit sooner versus the convenience of just getting that [indiscernible] taken care of so their IT teams can go work on other things and other priorities. It just seems to be an amalgam of those specific effects. So, again, one thing that's very important for everybody to keep in mind is if I do an early renewal, it will no way accelerates the renewal from a revenues perspective. So, if the renewal, we'll do, let's just say, July 1 to make the math easy, and the customer will somehow do an early renewal on January for six months early, that renewal would book and go into deferred revenue. But we wouldn't begin to recognize revenue on it until July 1 when the original contract finished amortizing. So, early renewals have no impact on revenue, but they do have an impact on the timing of our billings and obviously seek to, to some degree, serve to accelerate cash flow.

[Walter Pritchard:]

Yes. Understood that. And then for Gary, just on the archiving side, I think we've heard you talk about this in the past and looking for the second half for things to pick up. Can you help us – just remind us exactly what you think the drivers are to that pick up in the second half? Is it still – I know there's some tools readiness you're working on. Are there certain customers that you see more visibility into? Just help us understand what might drive that in the second half.

[Gary Steele:]

Yes. I think, there's a couple of things. So, there's a couple of factors here. One is the on-premise vendors, legacy vendors continue to be distracted with other things. So, whether it's the spin out of the enterprise [indiscernible] solution to the Carlyle Group under Veritas. There's just a lot of changes in that market and so we've had some very good active engagement with some large accounts we will work in through what it looks like to get those environments to migrate it and that just takes some time. So, I think, if their competitive landscape continues to move in our favor, it's the technology to get folks moved over and that it's just a simple planning process required to make all that happen.

[Walter Pritchard:]

Okay. Thank you.

[Gary Steele:]

Thanks, Walter.

[Operator:]

And I'll move to Melissa Gorham with Morgan Stanley.

[Melissa Gorham:]

Great. Thank you and congrats on a good quarter. I just wanted to just drill into TAP a little bit. So I'm just wondering, can you maybe just give us an indication how far penetrated that solution is into your base today? And then I'm just wondering if the Palo Alto relationship maybe would change the pace and the magnitude of adoption within your base in 2016.

[Gary Steele:]

I'll let Paul start and I'll finish on Palo Alto.

[Paul Auvil:]

Yeah. So on TAP penetration, we'll provide some updated stats in June. We want to wait and do that as part of Analyst Day. There's still a significant opportunity to sell TAP to our installed base of customers as of today, that I will tell you. So while we're very pleased with the rate at which we've driven TAP as an add-on to our existing customer base, there's significant leverage still there. And, of course, we do find TAP to be the primary initial conversation point for almost all of our net new customer acquisition. And given the fact that we have 27%, 28% of the Fortune 1,000, just as one example, it's a great motivator for driving conversation at the remaining, call it, 72% who are not currently Proofpoint customers. So we're really excited about our targeted TAP product. And I think particularly in an environment as we hear other people describe, which is not something that we see in our business, but it seems like there's some issues in other aspects of security spend. I think one of the things that continues to really benefit us is we're an incredibly cost-effective way for you to deal with your advanced threat problem given our pricing and deployment model as compared to other products or solutions that you might buy. And I suspect that's just one more thing that enables us to continue to do quite well in this environment even though you're hearing some companies talk about things that the feel on the margin changed from last year's demand environment in terms of what they see. And then, with respect to Palo Alto, so we're very excited and encouraged by what we've seen in the early weeks of this relationship. So just everyone recalls correctly, we announced at the end of January what we've seen is sort of two things. One is very good customer interest, and then secondly, we're seeing very good channel interest as indicated in our script today. We also – we participated in the Palo Alto User Conference in Las Vegas at the beginning of April, and we just were thrilled with the level of momentum that we saw there and the level of engagement that we had with the Palo Alto customers. So while it's still early, it is difficult to predict how this will ultimately impact the bottom line for us. We are extremely encouraged by the momentum we're seeing, and at a very simple level, the value proposition is super compelling. The integration is free. So there is no charge to the customer. So if you own the Proofpoint TAP solution and you own WildFire, you get better security together, and that message is really resonating with customers. So, we'll have to see how it plays out and we'll keep you guys updated. But in the early weeks of this relationship, we couldn't be more excited.

[Melissa Gorham:]

Okay. Great. And then just I wanted to follow up quickly on Microsoft to an earlier question. So, Microsoft is, you could argue maybe, getting a little bit more noisy within security, really, with Office 365. So is that coming up at all in customer conversations, any of the new security functionality that Microsoft is coming to market with and is there any change in the degree to which you see them in competitive deals?

[Gary Steele:]

No, I would say the Office 365 generally as a tailwind continues to be a nice growth driver for us. And I think it's broadly recognized in the buying community today, that to adequately protect yourself, you need security capabilities from a security company. And while the Microsoft capability might be adequate for a very small-sized organization. We don't see that to be the case for larger-size organizations that we traditionally call on, the Fortune 1000, as an example.

[Melissa Gorham:]

Okay.

[Gary Steele:]

So we've seen no change in competitive, but the competitive environment we've seen no change in sales productivity as it relates to Office 365. We see no change in this.

[Melissa Gorham:]

Great. Thanks.

[Operator:]

At this time, we'll move to Matt Hedberg with RBC Capital Markets.

[Matthew Hedberg:]

Hey, guys. Thanks for taking my questions, and love to see the progress on any of your margin targets here. Gary, you mentioned the channel. I think they're doing quite well here. When you look sort of longer term, what is the ideal mix of channel to direct, and how should we think about the channel build-out internationally, like you've got a huge opportunity there. You're seeing some nice overall growth there, but should we see some disproportionate benefit there?

[Gary Steele:]

Yes. Because if you think about longer term as our mix tilts more towards international over the long term, you'll see a higher percentage of business go to the channel. There are a set of customers today that asked to work directly with us. That's not by our choice. That's by the customer's choice. We are driving a good percentage of the business to the channel. And probably the thing that I'm most encouraged by, which was mentioned in the script, is we're seeing very good channel interest as we begin to migrate the McAfee customer base because that was basically 100% channel business. And at the same time, we're getting interest from many of Palo Alto's partners who want to carry our solution in addition to the Palo Alto capability. So I think that is another driver that will push, not only create incremental opportunity for us, but also be incremental opportunity to the channel. So I would suspect that channel percentage goes up over time. It doesn't move quickly, but it will go up over time. And as our business internationally changes, that most likely will be a high percentage of channel business. So we feel great about it.

[Matthew Hedberg:]

That's great. And then maybe just a quick follow-up on Office 365. Have you guys done more analysis about what percentage of your base is actually on Office 365? I'm kind of curious about the progression there thus far.

[Gary Steele:]

We don't actually have a lot of data around that. And part of the reason is that with very large customers, they tend to actually route their traffic kind of through several hops before it actually ends up at Office 365 even when they move to the cloud off of on-premise. So, we can actually, in a simple way, look at the routing rules and figure out whether the email is still going to an on-premise solution, whether it's going to the cloud. So with that in mind, we don't spend a lot of time looking at that. We do know that there are a lot of customers who have Office 365 as part of the construct that they're thinking about as they engage with us or buying. But the timing of when they actually move over is, to some degree, not always visible to us.

[Paul Auvil:]

Yeah. And another piece of that is it's not uncommon for people to be hybrid, meaning that they've got a part of the organization in Office 365 and a part of the organization on-prem, and that then drives them – they basically have to do an independent solution. They can't use the Office 365 capability.

[Operator:]

And at this time we'll move to Gur Talpaz with Stifel.

[Gur Talpaz:]

Great. Thanks for taking my questions. So I know that you're saying McAfee customers adopt multiple solutions upon replacement. I was wondering if you're seeing a similar theme within the rest of your installed base and whether TAP is sort of now a de facto part of an initial engagement.

[Gary Steele:]

Interesting question, and I'll let Paul jump in on this as well. So, the basic sales notion that we pursue most predominantly is when we're selling protection and TAP together if we can in that initial engagement. And our attach rate is reasonably high. We simply hide between protection and TAP on the initial deal. But that only happens if the customer has budget. If the customer does not have budget or budget is not there at the time, it's often times [indiscernible] protection initially and then follow up with TAP.

[Paul Auvil:]

[Indiscernible] I think it was spot on.

[Gur Talpaz:]

Perfect. And then just one follow up here. You didn't mention in the script but I was hoping you'd give maybe an update on the threat response product whether you're seeing any initial traction there. I know it's sort of out of the realm of social and emails but it's pretty interesting product.

[Gary Steele:]

Yes. Super interesting product, very innovative. One of the things – one of the broad trends we're seeing in the industry today is organization is looking to drive efficiency in their security operation centers, that efficiency demand capabilities that allow them to orchestrate remediation events. We are winning good customers every quarter, it's not a material part of revenue yet or bookings yet, but we are very encouraged. I would say that market generally is quite early, but we're doing quite well in that space. And we think that that will play a bigger role and have greater opportunity for us in the coming quarters.

[Operator:]

At this time, we'll move to Imtiaz Koujalgi with Deutsche Bank.

[Imtiaz Koujalgi:]

Hi, guys. Thanks for taking my question. I have a question on the duration from this quarter, it went down you said below 15 months which has been I guess the lowest you've had ever level I think two or three years ago. It used to be 20 months and now it's down to 15 months. Can you talk about what's driving that duration turning down and if there's an impact on pricing consideration going down? Do you guys see an uplift in ASPs as the duration goes down?

[Gary Steele:]

Yeah. That's great question, and we actually even thought about adding a couple of more paragraphs in the script but it's already so long. We decided that we wouldn't do that. But yeah, as you remember since you've been involved with the company since essentially day one of the IPO. We've been purposely driving duration down because we do get an ASP uplift. When we do multi-year deals paid in advance, there's obviously discount involved for that prepaid contract. And so we've specifically aligned our incentives to our sales team to drive towards shorter duration deals because it drives higher revenue production. And, of course, with our very low churn rates, the lifetime value of the customer then is quite a bit higher as a result. So we're quite pleased with where we've gotten to. People would ask me in the past, do you think you could get to 12 months, and I've always said no. Now that we're down below 15 that may be possible at some point, which I think we would endorse. We'd never go below 12 months, but moving to annual contracts would be an ideal target for us and one that is kind of typical standard that you see in Salesforce and some of the larger players. So we'd like to drive toward that and we'll continue to do so. So to your point, ASP is higher. Recurring revenue value is higher. But, of course, the billings amount that I produce from that new and add-on business is definitely a bit lower since I'm only invoicing for a year, or in this case, on an average, 14 months as opposed to something quite a bit higher. But it's great news for us in terms of long-term cash flow, given our low churn rates driving the duration down.

[Imtiaz Koujalgi:]

But does it vary by products? Do you have some customer signing lower contracts for certain products versus other, or they're basically lower duration across the board for the entire product portfolio?

[Gary Steele:]

It's really across the board. There really isn't a pattern where it's different for one product versus another.

[Imtiaz Koujalgi:]

All right. Thanks. One last one. I don't know if I've – if you've mentioned this on the call, but do you guys give the TAP growth rate in the quarter? Maybe I missed it.

[Paul Auvil:]

We said it was just under 100% on a year-over-year basis.

[Imtiaz Koujalgi:]

Thank you.

[Gary Steele:]

Thanks.

[Paul Auvil:]

Thanks.

[Operator:]

Andrew Nowinski with Piper Jaffray has the next question.

[Andrew Nowinski:]

All right. Thanks. Just a question on your billings guidance for the – on an annual basis. You beat Q1 by about $6 million, but you raised your annual outlook by about $7 million. So I'm wondering if you give us any color on the back half of the year and what prompted you to take that even higher than what you beat by in Q1.

[Paul Auvil:]

Yeah. So couple of things. Keep in mind that that beat – so the range for Q1 was $90 million to $92 million. We ended up at $98 million, but about $5 million of that was early renewals. So we really beat the high end of our range by about $1 million in the current quarter. So a lot of that raise really is true raise for the remainder of the year with the midpoint of that guidance range now up 35%. So think of it as benefiting kind of meaningfully across the [indiscernible] second half of the year. You saw the guide that we gave for Q2 which – again, add $5 million to it, puts that around $100 million as a guide for Q2, which is kind of consistent with our Q1 to Q2 sequential growth, again, if you adjust Q1 for the $5 million of pull-ins and then adjust my Q2 guide for those pull-ins otherwise renewing in Q2 where they would normally been. So slightly convoluted right now, but we just feel like we need to provide that transparency so people can see how the pieces fit together.

[Andrew Nowinski:]

Okay. And then with regard to the competitive landscape, I'm wondering if you noticed any changes specifically when you compete against FireEye's new cloud-based email solution or Symantec's ATP solutions in Q1? Thanks.

[Paul Auvil:]

Yeah. We – operating throughout Q1, we saw no change in the competitive landscape from Q4. And so we did see FireEye probably the same amount that we have seen in previous quarters. And then I would say our win rate stayed consistent. We have a very strong win rate. It gives FireEye the e-mail deal. That doesn't mean that FireEye loses the business. They can oftentimes – they're oftentimes selling the network portion of their business at the same time. And then with Symantec, we really didn't see any change in the level of engagement.

[Andrew Nowinski:]

Got it. Thank you.

[Operator:]

Let's now move to Erik Suppiger with JMP Securities.

[Erik Suppiger:]

Yeah. Thanks for taking the question. First off, Paul, when we look to the second half of the year, can we model our billings outlook to assume about $100 million in the second quarter? And then secondly, did you say that half of the incremental new business in the quarter were customers that included TAP? And if that was the case, can you give us a sense for how that half compares to maybe a year ago type period?

[Paul Auvil:]

Yeah. So, to your Q2 question specifically again, if you look at the guidance, the point that I was making is our current guidance is the number that we expect to record. But that, of course, reflects the fact that $5 million of renewals that otherwise would have booked in Q2 actually got pulled into Q1. So, I didn't mean to change what the guidance you already saw on the script. But again, normalized for that pull-in effect, the overall guidance is around $100 million. But with the pull-ins, just take $5 million out. That's roughly the midpoint of that guidance range, right?

[Erik Suppiger:]

I was asking as we look to Q3, should we think of growing off of a normalized base of $100 million in Q2?

[Paul Auvil:]

Yes. Oh. Sorry. I think misunderstood your questions. Yes, I think that's the right way thinking about it, yeah.

[Erik Suppiger:]

Okay. And then on the new business, some 50% from TAP?

[Paul Auvil:]

Yeah. I'm not sure we efficiently commented on that. We did definitely see TAP continue to be a major contributor. As Gary had mentioned in his prepared remarks, we see it continue on an absolute basis to grow. So, to the question that you're kind of referring which is how did our TAP business compare to we saw in same period last year, we talked about the fact that growth rate was a little under 100% year-over-year. So, TAP continues to be a major impact to what's helping drive growth for the business. But we are seeing good production from the other product lines in protection of privacy, archive and social. All of those have nice wins in terms of new and add-on business.

[Erik Suppiger:]

Okay. Then lastly, with the next quarter, you actually have another 90 days to assess the Palo Alto and McAfee relationships and how those evolved, do you think at that point you'll be at a position where you'll be able to factor in some additional contribution from them?

[Paul Auvil:]

I guess, aspirationally, I'd say yes. But again, I'll let you know in 90 days.

[Erik Suppiger:]

Very good. Thank you.

[Operator:]

Steve Koenig with Wedbush Securities has the next question.

[Steve Koenig:]

Hi, guys. Thanks for taking my questions. So, I'm curious, the price environment and discounting, it sounds like you're observing, that hasn't changed. So, I'm wondering, given that competitors aren't standing still and you're not either, what are the opportunities to continue to innovate particularly in protection and TAP or in email more generally to stay ahead of competition? And then, I've got one follow-up.

[Gary Steele:]

Yes. I think from an innovation standpoint, I think you saw it actually [indiscernible] where we continue to innovate at a fast pace with respect to TAP where we're catching the latest threats that are coming in, ransomware being a big theme for the quarter. Also, the Windows-based Adobe Flash vulnerability was a zero-day find for our – through our research team which is frankly a big deal and being able to catch those kinds of things well ahead of all of the competition. It makes a big statement to customers. And then, if you look at core protection, I think the business seemed compromise that we discussed is going to be a broad theme for the coming quarters and our ability to get something out as fast as we did because it's really reached a very high priority in the middle of Q1. And so, basically, in a very short period of time, we started working in 2015 on it, but we got it out very quickly, and we actually pulled up our release date to ensure that we have something in front of customers to help drive those. But it's those [indiscernible] innovation that will continue to drive growth and outstrip the competitors in terms of what they can offer. So, we feel really good about the innovation engine and our ability to continue to deliver. And just stating the obvious, I mean, the south model allows us to do frequent releases. We're not in the old school cycle of 12 to 18 months of release cycles. Our release cycles on TAP, for example, are every six weeks. So, we're moving fast.

[Steve Koenig:]

Okay. Got it. Okay. Thanks, Gary. I'm wondering...

[Gary Steele:]

You got it.

[Steve Koenig:]

A follow-up. Maybe you could comment a little bit on how we might see your go-to-market strategy and tactic evolve as more of your customers and more of your prospects sort of deploy more Office 365. Maybe incrementally, what does that do to kind of your sales model as time goes on?

[Gary Steele:]

Well, I think that it really speaks to what we referenced in the script. So, if you think about that broader Office 365 ecosystem, a big part of that is the Microsoft channel. And so, as we think about the folks in e-mail moving up to 365, working through the partners that are selling them those capabilities, obviously, is going to be critical. I look at – an example would be CEW. They're a very large Microsoft partner. They're also a growing partner of ours, and we see lots of opportunity in bringing together best-in-class security capabilities along with the capabilities that CEW delivers to Microsoft on Office 365. So, I think channel plays a big role there.

[Steve Koenig:]

Got it. Great. Well, thanks a lot, guys.

[Gary Steele:]

Thank you.

[Operator:]

We'll move now to Craig Nankervis with First Analysis.

[Craig Nankervis:]

Thank you and congrats also on a great quarter, guys. Just wondering if you could discuss the tone of the environment as you look ahead. How do you think about the resurging trends of Dridex and ransomware sustaining themselves, whether it's current or future quarters? Any thoughts about that? Thank you.

[Gary Steele:]

Yeah. Thanks, Craig. So, again, we saw no change in the macro environment, and I think much of that was driven by this constant evolution from a threat standpoint. We see that the bad actors are continuing to move tactics. Many of these tactics have proven to be successful, so they keep – nothing is slowing them down. We see no change in the threat landscape whereby the bad actors, they're continuing to innovate at a rapid rate. And so it's incumbent upon us to keep moving at a fast pace as well and stay ahead of those guys, and frankly we think that is a key factor that will continue to fuel the growth of the company at the level that we've been operating.

[Paul Auvil:]

Yeah. And I think the one thing I'd add is it's just in the last couple years so interesting how given whether it's Dridex or anyone of these other campaigns that have innovated by the black hats, there's so much money involved that that innovation is almost guaranteed to continue on that side of the house because it's a great moneymaker for the people who, for better or worse, are involved in that business. And so it will drive a constant need for innovation on the part of companies like Proofpoint to stay one step ahead of them in order to block their desire to exfiltrate intellectual property and/or money directly out of businesses.

[Craig Nankervis:]

Right. It's a real business. I get what you're saying. Okay. Thank you.

[Paul Auvil:]

Thanks, Craig.

[Gary Steele:]

Thanks, Craig.

[Operator:]

And moving along, we'll go to Ryan Hutchinson with Guggenheim Securities.

[Nate Cunningham:]

Hey, guys. This is Nate Cunningham, on for Ryan. Paul, can you give us any clarity on the accounting for the fee that you're paying to Intel for referral business?

[Paul Auvil:]

Sure. I actually was thinking about including it in the script, but I'm glad you asked the question just for everybody's benefit. So, it's not a material item currently in that we have not closed a lot of business where there's a direct referral from Intel that then engages a fee payment to them. But the way the accounting will work is it's viewed as a commission payment, just like a commission payment I might pay a sales rep. So as a result, at the time that we book that order and incur that obligation, it will be capitalized and amortized the same way that we're handling our commission payments now here in 2016. So, it will be another element to deferred commission expense.

[Nate Cunningham:]

Okay. And any sense on magnitude of that relative to referral business.

[Paul Auvil:]

Not really. Again, it's very early. There are some registrations that are in the pipeline, but I don't anticipate right now for it to materially change the growth of our deferred commission balance and, as a result, affect the overall sales marketing expense that gets recognized as we amortize that deferred item over the term of the revenue contracts associated with those associated deals.

[Nate Cunningham:]

Okay. Thank you.

[Paul Auvil:]

Thanks.

[Operator:]

Moving along, we'll go to Catharine Trebnick with Dougherty.

[Catharine Trebnick:]

Thanks for taking my question. Mine is around Europe. It looks like you had a nice uptick in deals this quarter and growth of 27% year-over-year. Anything to do with the change in the privacy and the disclosure law in Europe facilitating more opportunities? Thank you.

[Gary Steele:]

Yeah. It's really a couple of factors. So one is the [indiscernible] landscape has been particularly tough on the European companies. So many of the [indiscernible] have directed their efforts again to European companies. You couple with that the changing of their privacy laws there. I think that both of those factors today are playing a role in driving buying behavior. We were particularly pleased, as we talked in our script that two of our five largest deals for the quarter came from Europe. And so, we were really encouraged by the result that we saw from the team and we clearly have a lot of opportunity ahead of us there.

[Catharine Trebnick:]

Are there any countries like Germany versus the UK that are more interested in making sure the data has to remain in-country? And is that affecting any sales?

[Gary Steele:]

Well, there's a number of factors that play a role. So in particular, in Germany, there is more hurdles to get over in getting German customers comfortable with U.S. cloud companies. So given that history of the U.S. as a supplier and the issues that have occurred with German data, you have to ensure that you're going to have people comfortable. But at the same time one of the tactics that we took many, many quarters ago and this has probably – isn't even public, is we put a data center in Germany. So we have a data center in Frankfurt. We have a data center pair that then operates between Frankfurt and Amsterdam. And so, there is data residency that a German customer can have by operating in our German data center. So we've taken some actions specifically to tackle those objections and they seemed to be working quite well for us.

[Catharine Trebnick:]

All right. Thank you very much.

[Gary Steele:]

Thank you.

[Paul Auvil:]

Thanks, Catharine.

[Operator:]

Moving along, we'll go to Michael Kim with Imperial Capital.

[Michael Kim:]

Hi. Good afternoon, guys. Can you talk a little bit about the opportunity to drive the channel in privacy and governance in addition to – it looks like [indiscernible] strongest momentum right now in protect and advanced solutions. At this point, have you got a better sense of [indiscernible] on the broader solutions?

[Gary Steele:]

Yeah. We continue to work hard with our channel to broaden the scope with which they sell our products. I do have to say that the channel always will gravitate to where there's the largest demand. And so, clearly, with TAP and in the advanced threat market, there tends to be the most interest and driving the transition of legacy customers over with our protection solution that also continues to be of interest. We're doing a lot of channel [indiscernible] right now, and we're optimistic about the opportunity in growing the footprint of products that our channel can sell.

[Michael Kim:]

Great. And as a quick follow-up on archiving with the longer sale cycles, does that sort of imply that the deal sizes would be also materially larger than some of your security opportunities? And with regards to the pipeline, are they primarily net new customers or cross-selling to existing customers?

[Gary Steele:]

Yeah. From a pipeline perspective, it's a little of both, frankly. We have some good net new as well as some interesting larger opportunities in our installed base. And they really range in size. They wouldn't necessarily be larger than our security deals, but they are nice anchor deals. Yeah.

[Paul Auvil:]

Think high six-figure, low seven-figure opportunities as part of that pipeline that we're referring to.

[Michael Kim:]

Great. Great. Thanks very much.

[Gary Steele:]

Thank you.

[Operator:]

This time we'll go to [indiscernible].

[Unidentified Analyst:]

Yeah. Hi. Thanks for taking my question. Just drilling on the international operation, so I was wondering, have you made any change to the [indiscernible] in EMEA just had an impact on the [indiscernible].

[Gary Steele:]

Yes. So we haven't made any short term changes in the team. Folks may recall that we brought in new European leadership about a year and half ago and I believe what you're seeing is the maturation of that leadership with the team there and so we're very pleased with the results. So the only changes we made is just growing head count in Europe.

[Unidentified Analyst:]

Good. Thanks.

[Operator:]

Final question in queue would be from Gabriela Borges with Goldman Sachs.

[Gabriela Borges:]

Great. Good afternoon. Thanks so much for squeezing me in here. A question that's a follow up on forecasting and modeling, as you get the largest scale in the billing side, is there a right way for us to be thinking about billing seasonality from a quarter-over-quarter, or second half over first half perspective or is it the case that some of the secular growth trends and one-time factors and positive contributions make that type of seasonality analysis a little bit less useful at this stage? Thank you.

[Gary Steele:]

Yeah. That's good question. We certainly had more market seasonality back in 2012 when we first went public. So as we've grown – actually, interestingly, the anniversary of our public offering was yesterday. That was the four-year anniversary. As we've grown, we are seeing a little less seasonality but nevertheless, we do see a disproportion amount of our business in the second half versus the first half of the year on the billings basis. So I would expect that to moderate a little bit as we grow over the next three to five years. I think we'll always have a disproportion amount of business that does book in the second of the year simply given how customers think about their budget cycles and inevitably budget flush in the fourth quarter drives incremental acquisition of net new capabilities, et cetera. And so we're subject to that same set of effect as really any other company and technology.

[Gabriela Borges:]

That's helpful perspective. And just sort of follow-up, if I could. During the prepared remarks, you mentioned secular awareness around TAP. If you look at the customers within your own installed base, say, that are taking TAP versus some of the earlier adopters from a year or two ago, are there any changes of patterns in the type of customers that's adopting today either in terms of vertical or size or breadth? Thanks.

[Paul Auvil:]

I would say somatically the customers are roughly the same. We're seeing very good distribution of wins across many verticals. And even in verticals where I think everyone would agree they're under financial pressure, they look to TAP as a good economical solution to solve these kinds of problems. I would say it's been pretty consistent.

[Gary Steele:]

Now, I think what's kind of interesting is we've, over the last several months, closed a number of important customers in the oil and gas industry, for example, which, as you can imagine, is under tremendous budget pressure, and yet they're buying TAP from us as a part of improving their defense and security posture as a company. I guess, the only other thing I might add anecdotally is the very early days, it was probably people like financial securities companies that had the greatest kind of early warning concern. So, the very early adopters, I'm thinking back a couple of years ago now, we're probably more concentrated in financial services than our broader average customer base, which is quite diversified across the industry. But at this point, in the industry, it's well represented in our TAP business in terms of the new add-on business that we're closing each quarter.

[Paul Auvil:]

Yeah. And I suspect that – we didn't do this. But I suspect that if we were to do a zero analysis of TAP wins across the verticals, it would look identical to what we've seen historically in terms of the verticals we saw out there.

[Gary Steele:]

Yeah.

[Paul Auvil:]

It seems that you fully referenced [indiscernible].

[Gabriela Borges:]

Great. I appreciate the color. Thank you.

[Paul Auvil:]

Thanks to you.

[Operator:]

This concludes the Q&A session. At this time, I'll turn it back over to management for any additional or closing remarks.

[Gary Steele:]

Well, great. Thank you very much. We do appreciate everyone joining us on the call today. We are very pleased with our results. And as a reminder again, we have our Investor and Analyst Day on June 8 in San Francisco and look forward to seeing you there. Thank you so much.

[Operator:]

Thank you. And that does conclude today's conference call. Thank you all for your participation.