Proofpoint, Inc.
Q4 2017 Earnings Call Transcript

Published: 7 Feb 2018

[Operator:]

Good day and welcome to the Proofpoint's Fourth Quarter 2017 Earnings Results Conference Call. Today's conference is being recorded. At this time, I'd like to turn the conference over to Jason Starr, Vice President, Investor Relations. Please go ahead.

[Jason Starr:]

Thanks. Good afternoon, and welcome to Proofpoint's fourth quarter and full year 2017 earnings call. Joining me on the call are Gary Steele, Proofpoint's Chief Executive Officer; and Paul Auvil, Proofpoint's Chief Financial Officer. We'll be discussing the results announced in our press release that was issued after the market closed today, a copy of which is available on the Investor Relations section of our website. During the course of this call, we will make forward-looking statements regarding future events and future financial performance of the company, which are subject to material risks and uncertainties that could cause actual results to differ materially. We caution you to consider the important risk factors contained in the press release and on this conference call. These risk factors are also more fully detailed under the caption, Risk Factors, in Proofpoint's filings with the SEC, including our most recent Form 10-Q. Additionally, please note that while all the results that we're reporting today for the fourth quarter of 2017 and the full year of fiscal year 2017 are in accordance with ASC 605, the company is adopting ASC 606 as of the start of our new fiscal year, beginning January 1, 2018. With this in mind, all forward-looking guidance provided on today's call will be presented in accordance with this new accounting standard. These forward-looking statements are also based on assumptions that we believe to be reasonable as of today's date, February 6, 2018. We undertake no obligation to update these statements as a result of new information or future events. Of note, it is Proofpoint's policy to not reiterate or adjust the financial guidance provided on today's call, unless it is also done through public disclosures such as a press release or with the SEC on Form 8-K. We will present both GAAP and non-GAAP financial measures on today's call. These non-GAAP measures exclude a number of items as set forth in our release. These non-GAAP measures are not intended to be considered in isolation from, a substitute for, or superior to our GAAP results, and we encourage you to consider all measures when analyzing Proofpoint's performance. A reconciliation of GAAP to non-GAAP measures and a list of the reasons why the company uses these non-GAAP measures are included in today's press release. And finally, I've already received a few questions in e-mail regarding how Wombat figures into our 2018 guidance. As Paul will discuss during his prepared remarks, the potential contributions from Wombat are not included in our current 2018 guidance, as the deal is still subject to HSR review and other customary closing conditions. Contingent upon closing, we will issue a formal update to our guidance at that time. So with all that said, I'll turn the call over to Gary.

[Gary L. Steele:]

Thanks, Jason. I'd like to thank everyone for joining us on the call today. We were very pleased with our fourth quarter results, which capped off another strong year for Proofpoint. This was the 24th consecutive quarter of meeting or exceeding expectations, which highlights our ability to drive execution with a high degree of visibility and predictability. For the full year 2017, we delivered revenue growth of 37% and increased our free cash flow margin to approximately 21%, all of which represented significant progress towards our 2020 targets. We continue to benefit from the ongoing migration to the cloud, the rapidly evolving threat landscape, and our proven ability to identify and block advanced threats. I believe that Proofpoint remains well positioned to maintain this momentum, as we expect to see these secular trends to remain firmly in place over the course of 2018 and beyond. Furthermore, I believe that the company's unique visibility into critical threats targeting individuals within the enterprise will continue to represent a significant competitive advantage, given the huge amount of data that runs across our Nexus platform. As we mentioned at our Analyst Day in September, on a daily basis, we process over 1 billion messages and collect approximately 300,000 unique malware samples. And cumulatively, we have scanned over 210 million social accounts and over 25 million mobile apps, with the counting continuing to grow every day. With the addition of our recently released Domain Discover service, we now scan over 300 million domains daily, enabling us to identify lookalike and fraudulent domains that can be used by cyber criminals to launch e-mail spoofing attacks against the target's employees, customers and supply chain partners. Our recent acquisition of Cloudmark further bolsters the reach of our data intelligence, monitoring and analytics. Specifically, as a leader in messaging security and threat intelligence for Internet service providers and mobile carriers worldwide, Cloudmark processes over 4 billion e-mails and SMS messages daily and protects over 400 million in user accounts. This incremental threat intelligence sourced from Cloudmark's consumer-oriented service provider customer base will complement our predominantly enterprise-oriented data set. We believe that this extensive collection of threat intelligence that we will integrate into the Nexus platform will further improve our visibility and insight into the activities of malicious actors and enable us to further differentiate our Nexus platform from the competition, allowing Proofpoint to continue to gain share across an addressable market that exceeds $11 billion. Now, turning to some of our key accomplishments during the fourth quarter. Our suite of Advanced Threat solutions, including Targeted Attack Protection, or TAP offering, continues to be an important contributor to the growth of our business. We ended the year with approximately 3,100 TAP customers, an increase of 1,000 over the past 12 months, putting our installed base penetration at 48%, representing excellent progress for the year. And yet, these results still leave us with plenty of opportunities to sell TAP into our ever-expanding installed base. We had a number of noteworthy TAP wins this quarter including two Fortune 100 financial services companies, one of which purchased Protection, TAP and Threat Response for 300,000 users, and the other which added Protection, TAP, Privacy, Threat Response, TAP SaaS Defense and Continuity for 66,000 users. And a Fortune 200 global retailer that purchased Protection, TAP, Privacy, and Threat Response for 94,000 users. Beyond the broader threat landscape, the ongoing transition to the cloud and the shift to Microsoft Office 365 in particular continues to be a long-term catalyst that is helping to drive demand for Proofpoint's broader security and compliance solutions. Example of deals won this quarter where we displaced legacy on-premise security appliances as part of the migration to Office 365 included a multinational conglomerate that purchased Protection and TAP for 60,000 users and a Fortune 100 technology company that added Protection and TAP for 75,000 users. We also continue to effectively demonstrate the strength of Proofpoint's products when compared to the baseline security solutions provided by Microsoft as part of their Office 365 bundles. Examples of customers who had moved to Office 365 and subsequently decided to upgrade their security and compliance capabilities with Proofpoint during the fourth quarter included a large global and privately-held manufacturer of critical infrastructure that purchased Protection, TAP and Privacy for 20,000 users; and a Fortune 100 energy company that purchased Protection, TAP, Privacy, Threat Response and EFD for 25,000 users. Overall, the competitive environment remains favorable and we continue to experience high competitive win rates, coupled with a world-class renewal rate that continues to exceed 90%. We are also encouraged by the ongoing strength and demand for our emerging products, which include EFD, Social, Mobile, Threat Response, Threat Intelligence, TAP SaaS Defense and Domain Discover. As we had mentioned in the past, these new offerings have meaningfully expanded our TAM and are proving to be an excellent source of growth. In fact, our emerging products achieved a new milestone by contributing over 15% of the total new and add-on business closed during the quarter, and again represented an increase of over 100% year-over-year. A few of the key emerging product wins in Q4 included a Fortune 50 diversified technology services company, which added EFD for 214,000 users; a Fortune 500 information and technology company that added EFD and Threat Response for 120,000 users; a Fortune 100 insurance company, which added our Social and Threat Response solutions for 80,000 users; and a Global 2000 specialized chemicals company that purchased TAP SaaS Defense for 55,000 users. During the fourth quarter, our Archiving, Privacy and Governance segment grew 21% year-over-year, consistent with the expectations that we outlined during our earnings calls over the course of 2017. We expect growth in this segment to remain at these levels in the near term as the larger deals in the pipeline continue to mature. As we announced in November, we are positioned as a leader in Gartner's 2017 Magic Quadrant for Enterprise Information Archiving for the sixth consecutive year. We view this as further confirmation of the company's proven ability to execute in the archiving market, enabling organizations to significantly reduce costs, comply with regulations and streamline e-discovery for regulatory and compliance purposes. I'd also like to note that our opportunity in this segment remains attractive and we continue to make significant investments in our product roadmap. For example, we're encouraged by the early demand we've seen for the new supervision solution that we introduced in mid-2017. We believe that this type of innovation, coupled with our unique cloud-based architecture, positions us well when compared to the incumbent players and other legacy architectures. In terms of our ecosystem partnerships with Palo Alto Networks, CyberArk, Imperva and Splunk, we remain very excited about these relationships as all of these partners continue to be very engaged during the quarter. In particular, our integration with Palo Alto's WildFire offering continues to resonate with customers who value best-in-class solutions when compared to other firewall vendors. Our teams are aligned at all levels and the broad cooperation in our go-to-market resulted in a number of new customers this quarter, including a Fortune 200 insurance company that purchased Protection, TAP, Threat Response and EFD for 85,000 users. Another important factor in our growth is our success in driving additional sales to our existing customers through our broadening product line. As we discussed at Analyst Day, this represents an incremental opportunity of over $1 billion in recurring revenue, and our progress is well demonstrated by the continuing increase in customers with more than one product. At the end of 2017, 56% of our customers were using two or more products, up from 50% at the end of 2016. And within that set of multiproduct customers, just over half, or 31% of our total customer base, had three or more products at the end of the year, up from 24% in 2016. This is even more compelling when viewed in light of our growth in total customer count, which now stands at approximately 6,400 customers at the end of 2017, up over 20% from 5,300 a year ago. Note that these customer counts exclude the Proofpoint Essentials customers that are serviced through our MSSP partners, a customer count that's separately measured in the tens of thousands of individual SMB businesses that are served by these partners. We ended 2017 with over 390 customers in the Fortune 1000, each of whom has a significant enterprise scale deployment. It is important to note, however, that it represents only 39% of the Fortune 1000, still leaving us with the substantial opportunity to further grow our revenues through our best-in-class security and compliance solutions. Note that we now have 12 distinct product offerings, including the browser isolation solution that we recently introduced through the acquisition of Weblife. We believe that Weblife's browser isolation technology, when paired with Proofpoint's industry-leading threat detection and compliance capabilities, represents an industry's first, uniquely enabling enterprises to better protect their employees from advanced threat and compliance risk as they interact with the accelerating growth in content beyond the firewall. Our initial focus is helping organizations to protect their employees when they're accessing their personal e-mail accounts on their work devices, something which we have found to be a growing need across our customer base. In the short time since the transaction's closed, we have seen encouraging customer interest in this new capability with several opportunities already in the pipeline. Finally, we continue to make progress towards further expansion abroad and we were pleased with the uptick in our international business, which grew 43% year-over-year and represented 17% of total revenue. Notable international deals closed during the quarter included a Global 500 multinational bank that added TAP for 85,000 users; a European-based Fortune 500 energy company that added TAP for 90,000 users; and a European-based global consumer brand which added EFD for 43,000 users We ended the year with 18% of the Global 2000 as customers, which is up from 15% at the end of Q2, further highlighting that the addressable market outside the United States in both EMEA and Asia Pacific represents a compelling future growth opportunity for Proofpoint, and we plan to continue to increase our investments in these regions given our international momentum. Before I turn it over to Paul, I want to mention that we have entered into a definitive agreement to acquire Wombat Security for $225 million. Wombat is a recognized leader in the Leaders quadrant of their Magic Quadrant for the Security Awareness Computer-Based Training market. With this acquisition, our customers will be able to use real examples from the most current phishing campaigns for more realistic simulations, and as a direct result, gain insights into their employees' actual vulnerability to enable them to more effectively train employees in their real-time e-mail environments. The ever-changing threat landscape, coupled with today's compliance requirements for end-user training, has made this a mandate for most mid and large enterprises and is the top capability that our customers request. We also believe that this integration between market-leading protection and awareness solutions represents another industry-first. So, in summary, our strong fourth quarter performance capped yet another year of delivering exceptional operating results with meaningful progress towards achieving our 2020 objective of generating over $1 billion in annual revenue and 24% to 26% free cash flow margins. Looking to 2018, we believe that the company is well-positioned to maintain its momentum as enterprises continue to select Proofpoint's cloud-based solution to meet their advanced threat protection and compliance requirements. With that, let me turn it over to Paul.

[Paul R. Auvil:]

Hey, thanks, Gary. We were very pleased with our ability to once again exceed expectations across all of our key financial metrics during the quarter. Fourth quarter revenue totaled $145.4 million, up 36% year-over-year and above our previously announced guidance range of $138 million to $140 million. This result included approximately $3 million in revenue contributed by our two recent acquisitions, predominantly Cloudmark. Excluding this impact, we still exceeded the high end of our guidance range by over $2 million and delivered year-over-year organic growth for the quarter of 33%. Billings for the fourth quarter were $188.6 million, which excludes the $16.1 million in deferred revenue contributed from the Cloudmark and Weblife acquisitions. This was an increase of 36% year-over-year and also above the high end of our previously announced guidance range of $180 million to $182 million. As expected, contract duration remained at the lower end of our historical range of 14 to 20 months, and this was reflected clearly in our deferred revenue balances, which ended the quarter at $451.8 million, up $59.3 million sequentially with short term growing by $56.9 million and long term growing by only $2.4 million. Turning to expenses and profitability for the fourth quarter, on a non-GAAP basis, our total gross margin was 77.6%, which was in line with our expectations. During the fourth quarter, total non-GAAP operating expenses increased 33% over the prior-year period to $96.2 million, representing 66% of total revenue. Growth in spending was primarily driven by hiring, both in R&D and sales, as we added talent to both broaden and deepen the capabilities of our product offerings, along with sales resources to build quota capacity to drive both new customer acquisition as well as add-on sales to our existing customers. In addition, G&A included some onetime items, including the cost for the accounting and audit activities related to the adoption of ASC 606, as well third-party implementation services work for an upgraded ERP system to be deployed later in 2018. In terms of profitability for the quarter, we reported non-GAAP net income of $15.5 million, well above our guidance range of $9.5 million to $10.5 million. It is important to note that our acquisitions contributed less than $0.5 million to net income in Q4, as their revenue contribution was offset by their contribution to expenses for the quarter and, as such, the upside was driven by Proofpoint's organic revenue performance during the quarter without commensurate increase in spending. Moving on to EPS, non-GAAP earnings per share for the quarter was $0.29 per fully diluted share, above our guidance range of $0.19 to $0.21. Note that the EPS calculation applies the If-Converted method to both series of convertible notes and, as such, adds back the $1 million in cash interest associated with convertible debt and uses 55.8 million fully diluted shares for the quarter. We've included a section in our press release entitled Computational Guidance on Earnings Per Share Estimates, which is intended to provide additional details on this topic and to explain the resulting differences in share count used in these calculations based on our financial results. On a GAAP basis, we recorded net loss for the fourth quarter totaling $11 million or $0.24 per share based on 45.4 million shares outstanding. This included a tax benefit of $13.4 million primarily from a $12.3 million deferred tax benefit for a change in Proofpoint's valuation allowance on its federal and state deferred taxes related to the acquisitions of Cloudmark and Weblife as required by ASC 805 and also a $1.7 million deferred tax benefit related to the impact of the recent tax reform here in the United States. In terms of cash flow, we generated $42.5 million in operating cash flow and invested $12.2 million in capital expenditures, resulting in free cash flow for the quarter of $30.3 million, which was above our guidance range of $25 million to $27 million. As we mentioned on the last earnings call, the company decided to transfer the intellectual property related to the FireLayers acquisition from Israel to the United States, which resulted in a onetime tax payment of approximately $3.6 million. And excluding this payment, free cash flow as a percentage of revenue, would have been approximately 23% for the quarter. Turning to a quick summary of financial results for the full year 2017, total revenue was $515.3 million, an increase of 37% compared to 2016. Billings for the full year were $638.8 million, up 38% year-over-year and above the high-end of our final guidance for the year. Non-GAAP net income for the year was $42.1 million or $0.83 per share based on 55.4 million weighted average diluted shares outstanding, well above our guidance range of $0.73 to $0.75. On a full year basis, we generated $153.7 million in operating cash flow and invested $47 million in capital expenditures, resulting in free cash flow generation of $106.7 million for the year or 21% of revenue, up nicely from the 16% recorded in 2016, highlighting the company's ability to generate strong free cash flow growth, while at the same time delivering compelling top-line results. We ended the fourth quarter with $332 million in cash and short-term investments and $198 million in debt, compared to $460 million in cash and short-term investments and $381 million in debt as of September 30, 2017. This sequential decrease in cash during the quarter was driven primarily by the $155 million in cash used for the acquisitions of Cloudmark and Weblife, offset by both the cash generated from operations, as well as the contributions to capital from stock option exercises and our employee stock purchase plan. The decline in debt was a direct result of our decision to call the 2018 convertible notes, with a face value of $199 million, which converted into 5.1 million shares of stock towards the end of the quarter. As a reminder, there are still 2.8 million shares related to the 2020 convertible notes still outstanding. Now, turning to our financial outlook, we entered the year with good momentum and believe that we are in a position to increase market share and extend our technology leadership, as we continue to invest in new product development and expand our sales and marketing resources worldwide. As a result, we are increasing our outlook for the full year 2018. Now, prior to discussing the details of our guidance, I would like to touch on the new accounting standard known as ASC 606, which we're adopting at the start of our new fiscal year starting on January 1, 2018. The guidance on today's call and all future calls will comport with the new ASC 606 Accounting Standard. While we are still in the final stages of assessing the impact, our current work would suggest that for the full year 2018, the new standard will have an unfavorable impact to revenue of approximately $10 million, and note that this revenue impact falls dollar-for-dollar directly to net income, since the new standard only impacts the timing of revenue recognition and has no impact to any elements in cost of revenues. In terms of operating expenses, we expect ASC 606 to have a favorable impact to sales and marketing expense of approximately $10 million for 2018 and, as such, given that these two effects are roughly equal and offsetting, we expect that the new standard will have no material impact to net income in 2018 for the full year. And note that the new standard has no impact on the calculation and reporting of cash flow. In terms of some additional background on how ASC 606 impacts our financials, let me start with revenue. The adoption of this new accounting standard will result in the acceleration of revenue into earlier periods for subscription revenue associated with legacy deployments of our mail transfer agent and our data loss protection solutions that are running in the customer's data center rather than our cloud. Under the historical accounting standard known as ASC 605, these subscription revenues have been recognized ratably like any other subscription business. Under the new standard, the majority of the revenue for these types of deployments will be recognized at the time the order is booked, effectively accelerating revenue into earlier periods as compared to the historical accounting standard. The majority of the impact of this rollback will be felt in 2018 results, with an estimated impact of roughly $10 million or 200 basis points of headwind to our growth rate, as these legacy customers migrate these solutions to our cloud with the impact being relatively uniform across all four quarters of the year. In terms of how ASC 606 affects our sales and marketing expenses, the new standard dictates that commission expenses associated with new and add-on business be amortized over the expected life of the deployment, which we estimate to be five years for Proofpoint. This new accounting standard stands in contrast to our accounting under the historical standard where commission expenses have been amortized over the contract term of each individual order, with our historical average contract term being in the low- to mid-teens in terms of months over the past few years as discussed on our prior earnings calls. Hence, under the new standard, the commission expense for new and add-on business will be amortized over a period that is several years longer than the historical standard. The result of this change will be the lower sales and marketing expenses in current periods by shifting that expense into future periods. As a result, we currently estimate that ASC 606 will have a favorable impact to our 2018 commission expense of roughly $10 million in 2018 as compared to our historical accounting standards, with the impact mostly weighted towards the back-half of the year. Note that Proofpoint plans to adopt ASC 606 under the full retrospective standard and, as such, we do plan to publish the details regarding historical impact of this new standard as part of our 10-Q that will be filed in connection with our first quarter 2018 reporting period. We've included a table in today's release that summarizes the previous guidance for 2018 that we provided during our earnings call in October of last year and the appropriate adjustments discussed on today's call to account for the impacts of both ASC 606 as well as our acquisition of Cloudmark. Please note that all the guidance that we'll provide on today's call is compliant with the new ASC 606 Accounting Standard and, as such, we will measure our actual results in 2018 against these guidance figures. As one final point, it is important to note that our estimates related to Cloudmark's contribution to our 2018 guidance reflect our plan to eliminate their historical practice of selling perpetual licenses, as well as our plans to wind-down several of their legacy OEM relationships that were part of their historical business model. So with all that said, let's get on to the 2018 guidance. Our noteworthy fourth quarter results marked a strong finish to the year and, as a result, raised the bar on our year-over-year comparisons for 2018. Nevertheless, we are excited to start the year by raising guidance for all of our key metrics as compared to our guide from last year. In terms of revenue, starting with the guidance that we provided on the October earnings call and then taking into account not only our guidance of $20 million to $25 million related to the Cloudmark acquisition provided on November 21, but also the $10 million impact from the adoption of the ASC 606 just discussed, our previous guidance for 2018 translates to $654 million to $663 million. Today, we are raising the midpoint of that guidance by $4 million, while also tightening the range modestly to $660 million to $665 million. This represents 29% growth year-over-year at the midpoint. Note that Cloudmark is contributing approximately 400 basis points to our annual revenue growth, offset by the aforementioned 200 basis point headwind from our adoption of ASC 606. And when taking these two factors into account, our baseline organic rate of growth is roughly 27%, a nice start for the year given the strong finish to 2017, and consistent with the low end of the range required to achieve our 2020 targets that we shared at our Analyst Day in September. In terms of billings, starting with the guidance that we provided on the October earnings call and then taking into account the guidance of $20 million to $25 million related to the Cloudmark acquisition, our previous guidance for 2018 was $818 million to $827 million. Today, we are raising the midpoint of that guidance by $8 million, while tightening the range modestly to $828 million to $833 million with the preponderance of this $8 million increase expected to benefit our performance in the fourth quarter of 2018, driven by the strength to the upside to billings that we just delivered here in Q4 of 2017. This represents 30% year-over-year growth at the midpoint. Note that excluding the contributions for Cloudmark, our baseline organic growth rate is roughly 27%, again, a very nice starting point to the year given the upside that we just delivered in Q4. We expect full year 2018 non-GAAP gross margins to be approximately 77%, and hence, we are already operating at the low-end of our 2020 target range of 77% to 79%, two years ahead of plan. We expect full year 2018 non-GAAP net income to be in the range of $52 million to $56 million or $0.95 per share to $1.02 per share, using 56.6 million fully diluted shares outstanding, and adding back the $1.7 million in cash interest expense as prescribed under the If-Converted method. This is up from our previous guidance of $50 million to $54 million or $0.90 per diluted share to $0.97 per diluted share. As I noted earlier, the beneficial impact to commissions' expense and the adoption of ASC 606 is more weighted towards the back-half of the year and, as such, we expect total net income in the first half of the year to be in the range of $18 million to $20 million, with the rest delivered in the second half of the year. We believe that this marks a very strong outlook at the start of the year, keeping in mind that our 2017 profitability benefited from very strong revenue performances delivered throughout the year, outpacing the rate at which we could productively invest in R&D, cloud infrastructure services and sales, and hence this guidance reflects the fact that we do expect some degree of catch-up in terms of our rate of growth in spending versus our growth in revenues over the arc of 2018. I would also like to remind investors that this 2018 guidance also absorbs the operating cost associated with the newly acquired teams from Cloudmark and Weblife for the full year, which aren't fully reflected in our 2017 operating results, given that these deals closed late in 2017. In terms of cash flow, we are raising our 2018 free cash flow guidance to $138 million to $140 million or 21% of revenue at the midpoint up from our previous guidance of approximately $135 million. Similar to past years, we expect the majority of this cash flow to be delivered in the second half of the year, with roughly $45 million in the first half and the remainder in the second half. We believe that this outlook is particularly compelling given our commitment to innovation and ongoing investments to pursue the key opportunities in the market, and demonstrates continued progress toward our target of 24% to 26% free cash flow margins that we outlined as part of our 2020 operating model during our Analyst Day in September of last year. Also, I would like to note that we are producing this cash flow with an average billed contract duration in the mid-teens, which highlights the high quality of the recurring cash flow that our business can create as it scales. This 2018 guidance assumes capital expenditures of $45 million, depreciation of roughly $30 million to $32 million, cash interest expense associated with the convertible debt of approximately $1.7 million, and an interim tax provision exclusive of potential discrete items of approximately $2.7 million to $3 million. Finally, we are not including in our guidance the anticipated results from the acquisition of Wombat, since the deal was subject to regulatory review and other customary closing conditions. Assuming that the transaction were to close on March 1, under ASC 606, we estimate the full-year 2018 billings and revenue contributions to both be in the range of $30 million to $32 million. While the business is running roughly breakeven today, given the write down of their deferred revenues as part of the acquisition accounting, we do expect an unfavorable impact to net income of $1 million in the first quarter and a total of $5 million to $6 million for the full-year of 2018, with the business returning to breakeven in early 2019 in terms of its contribution to Proofpoint overall. In terms of cash flow, we expect it to be modestly additive to the tune of roughly $2 million for the full-year of 2018. Given that the transaction still needs to complete the associated regulatory approvals, we do not recommend including these figures in your financial models until the transaction is completed, at which time we will formally update our 2018 guidance with an 8-K filing. Now, turning to the first quarter; we currently expect billings to be $180 million to $182 million, implying a year-over-year growth rate of 32% at the midpoint of the range. This guidance assumes duration in the mid-teens consistent with 2017. And as a reminder, our billings tend to be relatively flat from the fourth quarter through the first two quarters of the following year, given the cyclical nature of demand inherent across the technology industry, as well as the timing of our renewal activity across the four quarters of the year. Excluding Cloudmark, the billings growth rate for the quarter will be roughly 28%. Regarding revenue for the first quarter, given that this is our first quarter reporting under the new ASC 606 Accounting Standard, we are going to be particularly thoughtful about how we set guidance. In this case, we are targeting a range of $149 million to $151 million. This represents 33% growth year-over-year at the midpoint and when considering the puts and takes of Cloudmark and ASC 606, our organic growth rate is roughly 30%. As a reminder, on a sequential basis, revenue growth tends to be a bit lower from the fourth quarter to the first quarter, given that we employ a daily revenue recognition methodology with respect to releasing subscription revenues from our deferred revenue accounts. More specifically, given that Q1 has only 90 days of revenue to recognize as compared to 92 in Q4, the results is a sequential decline in subscription revenue from existing business of approximately 2%, which equates to roughly $3 million at our current size and scale for the quarter, working as a headwind against the net new and add-on business closed over the course of the fourth quarter. We expect the first quarter non-GAAP gross margin to be approximately 76%, a modest decline from the 77.6% recorded in Q4, as our spending begins to catch up with the accelerated revenue delivered during the second half of 2017. More specifically, as we discussed on prior calls, we plan to deploy our next generation SaaS cloud system in Q1, which will initially run in parallel with our existing system, and thereby, we expect to incur some redundant cost during this transition, while ultimately driving additional efficiencies over the course of the remainder of the year. We expect first quarter non-GAAP net income to be $8 million to $9 million or $0.15 to $0.17 per share, almost double the figure recorded in Q1 of last year, but a decline from Q4 as our level of spending in R&D, cloud infrastructure services and sales catches up with our accelerated level of revenue combined with the aforementioned impact from the sequential decline in subscription revenue as a result of our daily revenue recognition methodology. This assumes an income tax provision exclusive of discrete items of $0.6 million to $0.7 million during the quarter, depreciation of approximately $7.5 million and a share count of 56.1 million fully diluted shares outstanding. As a reminder, since we called the 2018 convertible note, in applying the If-Converted method to each of the four quarters in 2018, the quarterly interest expense associated with the outstanding 2020 convertible notes is now $431,000 and should be added back to net income along with 2.8 million shares to the share count when calculating non-GAAP EPS. In terms of free cash flow, we expect to generate $22 million to $24 million during the first quarter, which marks a strong start to the year coming on the heels, an exceptional result in the fourth quarter. This guidance assumes capital expenditures of roughly $10 million. Note that the first quarter is always a step backward in terms of profitability and free cash flow when compared to the fourth quarter as our operating expenses include our typical increase in costs associated with payroll taxes, sales kickoff and initial sales and marketing investments for the year, while cash flow includes the payout of the company's annual bonus program as well as the accelerated commissions earned by the sales team during the month of December. A reconciliation of our non-GAAP guidance for both first quarter and full-year 2018 to GAAP can be found in our press release that we issued this afternoon. So, in summary, we continue to execute well, delivering strong top and bottom line operating results throughout 2017 and believe that Proofpoint remains well-positioned to maintain this momentum and operating discipline throughout 2018, given our proven capability to defend enterprises against today's advanced security and compliance threats. Before turning it over to the operator for questions, I would like to request that everyone limit themselves to just one question to help reduce the duration of our call and to ensure that everyone has a chance to be included in today's discussion. Thank you very much for taking the time to join us on our call today. And with that, we would be happy to take your questions now. Operator?

[Operator:]

And our first question will come from Melissa Franchi from Morgan Stanley.

[Melissa Franchi:]

Hey, thank you. I guess, maybe I will start with Wombat. Gary, just a question for you on that, as you're looking across the space in terms of consolidation in the security industry, just would love to hear your views on what makes security awareness training so compelling. And then just looking at the landscape of vendors, it seems like there's a good amount of vendors in that space, so maybe it would be helpful if you can elaborate on why Wombat specifically relative to maybe some of the other smaller vendors.

[Gary L. Steele:]

You bet. No, great question. So, one of the things that we were hearing consistently from customers is that security awareness and phish simulation have been sort of integral to everyone's program. And it's been the view of customers and we share the view that there's no one better to deliver those kinds of capability than someone that's in the market helping customers protect themselves from phishing attacks. It's something that we consistently heard across the entire customer base about midsized and large customers. So it felt like a natural extension to the product line where we could capitalize on the opportunity associated with that growing market. In terms of why Wombat and why not another vendor, a couple of things. So one is we like the breadth of their product lines. So not only do they do phish simulation, but they do offer security awareness training, which we think are both critical to solving customer's problems. Secondly, we like the fact that they are positioned as a leader in the Gartner MQ and they clearly stand out in terms of their leadership role there. And then finally, we spend a lot of time in diligence and we felt like they were the best in line in terms of company culture, people and what we thought we could do. We're also excited about the location at Pittsburgh given the proximity to CMU.

[Paul R. Auvil:]

Yeah. And I think I'd just add, we did look at a number of the other vendors as part of our overall process of evaluating the space and making a decision and I think, hands down, the team was uniformly excited about the capabilities that Wombat brings to the table and their ability to fit hand and glove with our business operations.

[Melissa Franchi:]

Thank you.

[Operator:]

Our next question will come from Philip Winslow with Wells Fargo.

[Philip Winslow:]

Hey, thanks, guys, for taking my question and congrats on a great quarter. Just a question to the team here on just the competitive and pricing environment, any changes that you saw in the second half of 2017 versus your expectations of the first half? And along those lines, one of the questions I'm getting was there some sort of competitive change that actually drove sort of the M&A that we saw at Q1 and Q4 and then Q1, or was this just sort of happen to be timing, so to speak, of when you guys found the right acquisitions?

[Gary L. Steele:]

Yeah, great question. So from a competitive perspective, we saw the competitive environment very consistent in the second half than we saw in the first half. We continue to have great success replacing incumbent solutions, very consistent with what we saw in the first half. So there was really no change in the competitive landscape. We also didn't see any change on the pricing side. We didn't see any forms of price compression across the various products that we deliver. It was actually quite consistent first half to second half. With respect to the timing on these acquisitions, they really were deal-specific. And while I think aspirationally, we would have hoped that Cloudmark and Weblife could have done earlier, it's just when these deals come together. And so, we view the opportunity to be significant across all those products and we're super excited. We've made tremendous progress already on integration with both Cloudmark and Weblife. We feel like we have that behind us. And with Wombat, we think it just fits so nicely in our go-to-market that we feel like it will just be a nice acceleration to our overall business opportunity.

[Philip Winslow:]

Great. Thanks, guys.

[Operator:]

And next we'll go to Matt Hedberg with RBC Capital Markets.

[Matthew George Hedberg:]

Hey, guys. Thanks for taking my questions. I had a question on pricing. With the three new acquisitions acknowledging Wombat hasn't closed yet, how should we think about per user for your pricing for these three? And I guess, maybe looking back more holistically, if you were to sell all these products now into a customer, what sort of opportunity is there for an all-in pricing? Thanks, guys.

[Paul R. Auvil:]

Sure. Couple of things. So with Cloudmark, keep in mind that it's focused on the service provider market. We'll continue to drive a separate go-to-market there. They had a great tight-knit team of salespeople. We'll be adding a few more people to that team to broaden that opportunity. But as you can imagine, pricing in the service provider market is very, very different than enterprise pricing with the different set of capabilities delivered as well. But when you then look at, say, Weblife, for example, we're really excited about that product line and we're in very early price discovery. But as Gary mentioned on the call, our initial foray is really going to be focused on taking that technology, integrating with our TAP product line and enabling a really unique capability, tech people, employees when they're using their company-provided systems to go access their personal e-mail. It's something that we hear about constantly from our customers, the need to enable employees to be able to access those systems, but do it in a way that doesn't potentially contaminate their company-owned laptops that ultimately spread into their network. And so, that application-specific version of what Weblife delivers in combination with our products, we expect to price in the realm of our Protection Solution, so think $10 a user a year for a 5000-c account. To the question on the newly acquired Wombat capabilities and, again, it's still subject to closing conditions. But we were really impressed with what they've done and they've got a couple of different capabilities. One is a set of online training capabilities. The other is this Phish Simulation. Our sense is that each of those probably again 5,000 user account company would each separately be about $10 a user a year. Yeah, I know we're the $10-a-user-a-year company, but that's just what we're finding just in looking at their data and understanding their business so it's kind of interesting that it fits together into that paradigm. So when you really add all this up, we're now nicely over $100 a user per year in a 5000-c account if people were to buy all these solutions. And as Gary talked about, we're still just in the realm of half of our customers having two or more products and then little over 30% having three or more. So there's a lot of add-on opportunity, and we're excited to go explore that here as we work our way through 2018. And I do want to highlight for everybody's benefit, just like we did on this call, we will continue to call out the organic contributions from our business and the inorganic, including assuming that Wombat closes – Wombat contribution, so there's no confusion about how much of the business growth is coming from our core product engine and our sales go-to-market as compared to some of the acquired revenue that comes through these transactions.

[Matthew George Hedberg:]

Thanks, Paul. Well-done, guys.

[Paul R. Auvil:]

Thank you.

[Operator:]

Anne Meisner with Susquehanna Financial Group has our next question.

[Anne M. Meisner:]

Hi. Thank you. Nice quarter. Just a quick follow-up on the Wombat acquisition, just if you could share a little bit more about the strategy as it relates to the integrated offering that you mentioned in the press release. Maybe if you can just elaborate more on that. I assume that would be bringing, sort of, the Proofpoint threat intelligence mostly to the Phish Simulation offering to really, sort of, raise the bar there. Perhaps you can just, kind of, discuss the synergies in more detail? And then, any thoughts about – any more appreciation I guess in terms of when we would see that in the market. I think you said first half?

[Gary L. Steele:]

Yeah, so two, kind of, critical areas. So, one is leveraging our rich threat intel to integrate with their best Phish Simulation environment, so that you can effectively simulate where a real attacks versus fake attacks or made-up attacks. So, you're actually training on the true risk and vulnerability for the existing environment, and that was another thing that we've actually heard from customers. They are like, well, gosh, if we had something like this from you guys and you put it together, you could actually do very realistic training. So that's one. Two is, Wombat has a capability/product knows PhishAlarm where you can do reporting of phishing kinds of attack into a security operations center. We think that there's opportunity to integrate this with our Orchestration and Automation solution threat response. That's another interesting area of opportunity for us. Those are, sort of, the two key early technical capabilities that will be integrated and we look at, kind of, a mid-2018 integration timeframe. So, we're super excited about this and we think that the synergies are quite easy to exploit and take advantage of and we're looking forward to getting it out and into the hands of our customers.

[Anne M. Meisner:]

Great. Very helpful. Thank you.

[Operator:]

Our next question will come from Walter Pritchard from Citi.

[Walter H. Pritchard:]

Hi. A question for, I guess, both of you. Just on the M&A front, I think somebody asked earlier, the uptick in M&A. I think your cash balance will get actually reasonably low with this deal, assuming it's – I think it is all cash. How are you thinking about having to raise capital, do more M&A or, sort of, a piece of M&A from here?

[Paul R. Auvil:]

Yeah. No, it's good question. So, if you think about where we'll likely end, given the guidance we just provided, at the end of the first quarter we'll be, call it, $150 million of cash on the balance sheet, plus or minus. And then if you add to that, the cash flow that we'd expect to generate, given our current guidance over the remainder of the year, we have plenty of cash on the balance sheet, not only to operate the company, but to continue to do smaller transactions, as has been our historical norm. So, we'll see how things, kind of, play out over the course of the year, but we don't have any plans at this time to go out and raise additional capital. I think, again, we've had this, sort of, interesting confluence to these three deals coming together over the last handful of months. As Gary articulated, I think we would've preferred to have done a couple of them earlier in the year. But for various reasons, things don't quite come together in terms of timing. You need a willing seller along with a willing buyer. And we're just thrilled that we managed to get all three of these deals done, because we think each for their own reasons are an excellent fit for our overall product portfolio, go-to-market, Threat Intelligence strategies and how we look to go and execute in the market between here and 2020 and beyond.

[Walter H. Pritchard:]

Got it. Thank you.

[Operator:]

Our next question will come from Jonathan Ho from William Blair.

[Jonathan F. Ho:]

Good afternoon and congrats on the great results. Just relative to the investments that you've made on the international side of the business, where have you seen the most success geographically? And is this mainly just adding capacity to these regions? How should we think about those investments?

[Gary L. Steele:]

Great question. Our focus has been on EMEA, specifically, kind of, in the core anchor markets of UK, France and Germany. The investments really are expanding our broad footprint there. We're building a model that looks effectively the same as the U.S. with a combination of both inside sellers and deal sellers across those geos. We also have a reasonable footprint in – reasonable and growing footprint in Australia, and we think there will be additional investments in the overall APAC region in the coming year, given the success we've had.

[Jonathan F. Ho:]

Great. Thank you.

[Gary L. Steele:]

Thanks, Jonathan.

[Operator:]

Next, we'll take a question from Gur Talpaz from Stifel, Nicolaus.

[Gur Yehudah Talpaz:]

Can you talk about the cross-sell opportunities within the service provider space? And I think more broadly, how important is the data acquired here for the broader platform? Would you classify it as important as something like emerging threats or a little bit different? Thank you.

[Gary L. Steele:]

Yeah. So within the Cloudmark opportunity, our real excitement there was, well, two-fold, one is expanding into service provider to deliver capabilities there. But the richness of their data combined with ours gives us a very unique perspective. And that integration is actually extremely straightforward, so that's been beneficial. In terms of the cross-sell, the enterprise products that we have today into the enterprise – excuse me, into the end service provider market, we don't see that as a short-term opportunity, we do think there are additional capabilities that we can provide those customers but it will take some re-orientation of our current product line to do that.

[Gur Yehudah Talpaz:]

Got it. Thank you.

[Operator:]

Andrew Nowinski Piper Jaffray has our next question.

[Andrew James Nowinski:]

All right, thanks. Congrats on a nice quarter. It looks like the number of customers that deployed TAP in 2017 decelerated down to about 20% growth versus 32% in 2016. And it's also well below your total customer growth rate, despite the fact that breach activity and e-mail-based threats are becoming more sophisticated. And the fact that TAP is actually integrated with vendors like Palo Alto. So, why do you think customers are becoming, what appears to be more reluctant to purchase TAP?

[Gary L. Steele:]

We're not seeing that at all. We're seeing – when you look at it from a dollar perspective, we continue to see really good adoption of the TAP product line and it continues to be, quite frankly, the number one driver of growth. And then, of course, the emerging products that we've talked about have delivered very nice results as well. And so one thing that you might be seeing is that we're now at a point where we have a meaningful percent of the installed base that have bought TAP. And so if that installed base starts to sell out, that, kind of, rate of growth under an overall basis does start to slow. But on an absolute basis, its contribution to our growth rate continues to be significant. And quite frankly, almost any sales engagement where we're selling Protection we're also selling TAP. The two things go together like peanut butter and jelly.

[Andrew James Nowinski:]

Okay, got it. Thanks.

[Operator:]

And next we'll take a question from Gregg Moskowitz from Cowen & Company.

[Gregg Moskowitz:]

Okay. Thank you and good afternoon, guys. So, looking at Wombat today, what is the approximate user mix of Phishing Simulation versus Security Awareness Training? And then also, Paul, can you say about how fast Wombat grew in 2017?

[Paul R. Auvil:]

Yeah, you know, what I'm happy to answer specific questions on that, but I want to wait until the deal closes. It's not really appropriate absent the HSR review being completed to talk about specifics in their business. We will give you some more detailed stats on that in the April call. And again as I mentioned, we will formally update our guidance when the deal does close, assuming we get the regulatory approvals is an 8-K filing. So, I appreciate the question, hold that thought and let's come back around to it on the April call.

[Gary L. Steele:]

And we can answer...

[Gregg Moskowitz:]

Okay. Fair enough.

[Gary L. Steele:]

And we can answer that product capability question.

[Gregg Moskowitz:]

Yeah, yeah.

[Gary L. Steele:]

So from a product perspective, there's really two fundamental offerings. One is Phish Simulation, which means the organization can run simulated attacks on their users; understanding and trying to get those users to be more security aware and not click on malicious links or click on malicious files. That is distinctly different than classic security awareness training, which is an online set of training courses that most organizations now are putting their employees through to make them more security aware as they do their job every day. So, there's, basically, simulated attacks, and then there's – separate from that, there's training, and those both carry separate prices. They can be sold together, but they both carry separate prices. Does that help?

[Gregg Moskowitz:]

It does. And, yeah, look forward to more color, obviously, post the close. But thank you guys.

[Gary L. Steele:]

You got it.

[Paul R. Auvil:]

Yeah, we'll actually put a few things in the prepared remarks next quarter to make sure we cover off some of the questions like the one that you asked. And then if there are more refined questions that you may have, again we'll cover it in the Q&A sessions of the April call.

[Operator:]

Our next question will come from Gray Powell from Deutsche Bank.

[Gray Wilson Powell:]

Hi. Thanks for taking the question. So, we've heard that you've been having some success winning customers with EFD, they're not core Proofpoint e-mail customers. Roughly speaking, is there a way to say how often that is the case? And then do you see EFD as a way to get your foot in the door and displays legacy vendors over time?

[Gary L. Steele:]

Yeah. We've had a tremendous amount of demand for our E-mail Fraud Defense Solution. We see it coming in two forms, we see – actually three forms. We see it in – when we're working on new accounts selling it alongside Protection and TAP where customers understand the value of authentication and importance of buying something to stop spoofing. We see it as add-on sales motion, where we're going into our installed base, getting our installed base to adopt DMARC through the purchase of E-mail Fraud Defense. And we do see an independent sales motion going into customers who do not have our core Protection and TAP capabilities. So, we're seeing a variety of all of those. I think it simply speaks to the broader demand for that type of capability and the fact that we've seen success across each of those different sales motions.

[Gray Wilson Powell:]

Got it. Thank you.

[Gary L. Steele:]

You bet.

[Operator:]

Our next question will come from Ken Talanian from Evercore ISI.

[Ken Talanian:]

Hi. Thanks for taking the question. Given that you recently made some more sizeable acquisitions, I was wondering, if you could talk about the moving pieces that might impact your fiscal 2020 free cash flow margin targets?

[Gary L. Steele:]

Yeah. We haven't updated those at this time. For now, we continue to be committed to the numbers that we've put out in September at Analyst Day. We probably won't provide any update on that in the near term, but we may sometime later in 2019 do that. But we continue to feel good about getting to the numbers that we shared there, and to your point with some of the inorganic contributions that may enable us to get something above that range, but we'll provide a guide at an appropriate time. I think, we among other things, need to complete the formal closing on Whales (00

[Ken Talanian:]

Great. Thanks very much.

[Operator:]

And next we'll go to Sarah Hindlian from Macquarie. Sarah Hindlian - Macquarie Capital (USA), Inc. All right. Great. Thank you so much. Quick question for you guys on the Government business. What are you seeing there in relation to the Department of Homeland binding initiative? And how does it set up for fiscal 2018?

[Paul R. Auvil:]

Yeah. So it is interesting. So there has been a – Sarah, just want to make sure, I didn't quite hear the beginning of your question. You're talking about e-mail authentication? Sarah Hindlian - Macquarie Capital (USA), Inc. Yeah, that's right. Just related to Department of Homeland security binding initiative that they put out in October?

[Paul R. Auvil:]

Yeah, I just want to make sure I heard you correctly. So, what we have seen is Agency basically raising their hand trying to understand how they're going to meet specific dictate. We have seen pipeline pick up as a result of that. There's been a lot of dialogue, and we're encouraged by that early demand. We need to start to see that translate into bookings and revenues, but we feel encourage by the opportunity and broadly what I would say is even outside of Federal in specific verticals, you're seeing some of the security groups across verticals be much more – take a much stronger position as it relates to e-mail authentication. We saw it healthcare, we've seen it in financial services. Do you think this is a broader trend in the market? And we see it as – it happening in Federal as well as other verticals. So, we're enthusiastic about the opportunity there as we work our way into 2018. Sarah Hindlian - Macquarie Capital (USA), Inc. Awesome. Thank you very much.

[Paul R. Auvil:]

Thank you.

[Operator:]

Jayson Noland with Baird has our next question.

[Jayson A. Noland:]

Okay. Super. Paul, I just wanted to ask on the fiscal 2018 gross margin guide, 77%. You've trended that up the last few years. I assume it was an economy of scale. And the question is, why not more of a lift? And I was wondering, you mentioned the next-gen cloud SaaS platform, I was wondering if that played a role in the cost of goods sold?

[Paul R. Auvil:]

It does, and that's why you see the depressed level in Q1 because we've got this additional expense coming online associated with running the two clouds in parallel. Once we then get confidence that we've got full operating parameters on the new cloud we'll then wind the other one down over the course of Q2. And then you'll see leverage in the second half of the year. So we debated this internally and ultimately decided that to make sure we had zero rest of the customer that we needed to run both clouds at full scale in parallel for some period of time, and once the new cloud was fully stable and providing the exact same or better efficacy, likely better than the existing cloud, only then would we make the transition. And so that's what you see. What I'm excited about is our ability to, even with that flattish gross margin, between 17% and 18%, still deliver a really nice sequential improvement in net income as we pick up efficiencies in operating expense.

[Jayson A. Noland:]

Okay. That makes sense. Thanks.

[Operator:]

Our next question will come from Steve Koenig with Wedbush Securities.

[Steve R. Koenig:]

Hey, thanks guys for taking my questions. Yeah. So Gary, I was wondering on the M&A. So understand that, by its nature, it needs to be opportunistic, especially in terms of when these things come together. Maybe stepping back a minute though, could you elaborate on what strategic framework you are using for your M&A in terms of thinking about what types of acquisition you'll do, to the extent that you can tell us more without giving away the store competitively. I'd love to hear your thought process there.

[Paul R. Auvil:]

Yeah. Before Gary jumps in with his answer, the one thing I just want to clarify terminology. I wouldn't really call our historical acquisition process and the deals that we've closed as opportunistic, it's more – we have some very specific ideas of things that we'd like to buy. But then, of course, timing is everything. And so, some of these properties, like, I'll give you the example of Cloudmark, we were interested in acquiring them over a multiyear period. But there were different times and different discussions and we could never get a like-minded buyer and seller conversation going. So that's a deal we easily could have done a few years earlier had we found a way to come to a meeting of the minds. And so, while the timing of these three all seems kind of grouped, it's a little bit like flipping a coin. If you flip a coin a number of times, ultimately, it will come up heads three times in a row. In this case, we had a very long period of no acquisitions over the course of late 2017, early 2018. And then here at the – I mean, early – late 2016, early 2017. And then in late 2017, early 2018, we've got these three that all came together. So we have a pretty specific road map of things that we're always thinking about that we're interested in. As an example, with Wombat, I'll get it right this time, not their codename Whales (01

[Gary L. Steele:]

Well, I think the framework is actually pretty simple. Our framework for evaluating different M&A opportunities really comes down to – we look at our sales promotion and who do we think we can leverage our existing sales promotion to go expand the capabilities that we're currently delivering. And I look at – Wombat's a perfect example of that. These are capabilities that were being requested by customers every single day to our salespeople and to leadership here. And so, we collectively look at what customers are telling us and where our go-to-market is taking us. And those two things ultimately drive or inform the broader list of things that we're interested in. From there, we look at valuation. Clearly, there's been valuations that have been sort of unreasonable in the private market, and so we're very careful in terms of what we pay, and so that's a qualifying factor. And we look long term at where the company can go in terms of overall capability and we've established ourselves well in e-mail. We've expanded around that. We've expanded outside of that scope. But we've done it in a very careful way and we will continue to use M&A to expand our broader product footprint, but we do it in a very thoughtful and – with a very thoughtful and judicious process.

[Steve R. Koenig:]

Good. Thanks a lot, guys.

[Operator:]

Our next question will come from Tim Klasell with Northland Securities.

[Tim Klasell:]

Yeah, just a quick question here. I'm wondering if you could break out for us growth rates coming from – or your growth that's driven by existing customers versus new, so expansion with existing customers versus brand-new. Thank you.

[Gary L. Steele:]

No. Hey, Tim, that's a good question. We continue to see a really good mix of growth being driven by a combination of new business and add-on. And while each quarter varies a little bit, we built our quota capacity between the new and add-on teams where we would expect to see roughly 50/50 contribution. And I'll tell you, if you look at the four quarters of 2017, while there was a little bit of variation quarter-to-quarter, in total for the year, it was remarkably almost right on top of that number. And so, as we build our quota capacity in 2018, we'll be continuing to go for that same balance of new and add-on, which we think is the right mix because we need to be, of course, continuing to cultivate new opportunities that we can close and that creates new add-on space. But we also want to backfill the existing customers by selling more value to them. As we talked about it Analyst Day back in September, if you looked at our customers base at that time and the add-on opportunity across all of them, think of it as what we call the white space there, there's over $1 billion of recurring revenue opportunity in that installed base. And so striking the right balance between those two is important and something we think about in our planning literally not only on an annual basis, but even as the business is growing quarter-to-quarter.

[Tim Klasell:]

Great. Thank you very much.

[Operator:]

Our next question will come from Gabriela Borges from Goldman Sachs.

[Gabriela Borges:]

Great, good afternoon. Thank you. This is a question on pricing. I'm curious as you look at the set of products that you're now selling into Protection and Advanced Threat, is there a scenario where you would consider bundling or looking at taking some of the more popular products and putting them together and essentially formalizing that go-to-market process either for the channel or for your direct sales folks? Thanks.

[Gary L. Steele:]

Yeah. So we are always looking at bundling options. We haven't, frankly, done a lot of bundling in the past, because we honestly don't want to give up too much value in driving customer adoption. And so it's something we'll consider over time but we pretty much have been selling à la carte which I suspect we'll continue to do.

[Gabriela Borges:]

Thank you.

[Operator:]

And next we'll go to Patrick Colville with Arete Research.

[Patrick E. Colville:]

Hi there. Thanks for taking my question. Could we double click on the Cloudmark acquisition, I'd like to better understand exactly what that brings. Still a little bit confused there. Thanks.

[Gary L. Steele:]

You bet. So it's really – it's two-fold for us. Cloudmark brings access to the service provider community that is providing consumer e-mail services, and they're using the Cloudmark e-mail security capabilities protect those consumer end users and it gives us incredibly rich threat visibility and threat intel, and that threat visibility and threat intel gets incorporated with our Nexus platform that ultimately helps us increase overall efficacy of our solution. The Cloudmark set of data is probably one of the richest data sets out in the market today, and that is something now we're actively leveraging to bring into the Proofpoint Nexus platform. So it's really those two things that we think are interesting and critical.

[Patrick E. Colville:]

Okay. Thank you so much.

[Operator:]

Our next question will come from Catharine Trebnick from Doherty.

[Catharine Trebnick:]

Thanks for taking my question. Mine's on GDRP (sic) [GDPR] is there any proper way you could quantify the strong tailwind for that in 2018? Thank you.

[Gary L. Steele:]

It's interesting. While there is a lot of conversation around GDPR today, I don't know that there is demonstrable pipeline being created from GDPR. Many customers today are quite confused about the impact GDPR will have on them as organizations. I do think that what GDPR will do though, having said all that, I think that it will create a level of accountability across organizations all the way to the boardroom, making organizations much more accountable to security issues, security incidents. And I think that over the long haul, it will create a nice tailwind for security vendors like Proofpoint. I do not think it has a short-term impact.

[Catharine Trebnick:]

All right. Thank you.

[Operator:]

And Erik Suppiger from JMP has our next question.

[Erik L. Suppiger:]

Yeah. Thanks for taking the question and congrats on a good quarter. Two maintenance questions, one, just can you confirm Wombat does not have any professional services? And then secondly, was your mix between channel and direct still 50-50 in the quarter? And then I've got a follow-up.

[Paul R. Auvil:]

Yes. So Wombat has a de minimis amount of professional services similar to Proofpoint. So remember in our model, 3% of our revenues are non-recurring. They appear to be operating kind of in that same range. In terms of channel mix, yeah, so just to clarify, if you look at our business in total, something over half the business went through the channel in the quarter, probably closer to something north of 60%. For new and add-on business, we continue to see really good drive by the channel to push business, and so well over 70% of our business was touched by the channel. So again, we have a whole bunch of business before we became channel-centric that we developed and continued to run direct. And so that mix in the total business coming through the channel, it was evolving as more and more of it is contributed by the channel. So we're really pleased with the channel performance. We had a lot of what we call pull business where they are register deals and actually brought the opportunity to the table and so we feel like things are clicking quite nicely there.

[Erik L. Suppiger:]

Okay. Then on the customer count, I think your total customer count grew 20% year-over-year, which is considerably less than your total revenue growth. Is that a level of growth in customers that you are comfortable with? Or how do you look at that new account growth rate?

[Paul R. Auvil:]

Yeah. A couple of things. We're seeing ongoing strong productivity of account growth in larger accounts, which is obviously exactly where we want to be. The churn rates are demonstrably lower the larger the account is, and so there is that piece. The other is that for our lower end accounts, we're increasingly running those through the service providers that are serviced with the Essentials platform. And as Gary had mentioned, the Essentials customer counts, we don't count in our overall number. There are just too many of them to keep track of. It's tens of thousands of customers. And so, the addition of customers at the lower end user counts, kind of, aren't getting included in the enterprise number that we count when you think about that 20% growth year-over-year compared to historical standards where the Essentials platform was less of the contributor at the low end of our market.

[Operator:]

Our next question will come from Shaul Eyal from Oppenheimer.

[Shaul Eyal:]

Thank you. Good afternoon, guys. Congrats on the quarter, the acquisition. A quick question on Wombat, do they have a different go-to-market strategy, a different sales process into the Enterprise, or maybe in other words, once they come onboard, will there be probably some training period for the Proofpoint salespeople? Will they be talking to the same counterparts on the Enterprise front?

[Gary L. Steele:]

Yeah. So the go-to-market for Wombat is similar to Proofpoint's but they utilize – they're more heavily utilizing an insights selling model, which we think is obviously very complementary. And they've very effective selling across – selling over the phone to all sizes of the organizations. The plan is to fully enable all the Proofpoint sales folks to be able to sell the Wombat solution. And we will have a coordinated go-to-market where the Wombat team is working hand in glove with the Proofpoint sales team, but everyone will be trained. And we will use some number of the Wombat team to help the Proofpoint team sales, so use some of those folks as overlay.

[Shaul Eyal:]

Got it. Thank you.

[Operator:]

Our next question will come from Michael Kim from Imperial Capital.

[Michael Kim:]

Hi. Good afternoon, guys. Just on the emerging products category, nice to see it cross the 15% threshold. But could you call out any particular products that saw a nice momentum exiting the year? And I think Threat Response seems to be doing well; any of those products also opening the opportunity here for Protection orders?

[Gary L. Steele:]

Yeah. I think the standouts in the quarter, one was Threat Response, which is our orchestration and automation solution. There seems to be this growing momentum from a market standpoint around that capability, which we're super excited about. And then, E-mail Fraud Defense which we talked about earlier on the call that helps organization get through the process of authentication. We've seen really good demand there as well. And then that really is additive to the broad capabilities that we see on social, which we had another good quarter. And even some of the earlier products where we're starting to see good pickup. So we're very happy with the composition that we see within the emerging products cohort, and we're encouraged with respect to the growth that that cohort delivered in Q4 and the momentum it's bringing into 2018.

[Paul R. Auvil:]

Yeah. I think the only thing I'd add to that too is that we now have the Weblife capabilities that are tumbling into that as well, and so I think that will give even more accelerating power to how we see these emerging products drive growth for the company. And then, of course, Wombat separately is at – would contribute, assuming that the deal closes, starting in the – later in 2018.

[Michael Kim:]

Got it. Great. Thank you very much.

[Operator:]

Alex Henderson from Needham & Co. has our next question. And sir, we're not able to hear you. Please check your mute function.

[Gary L. Steele:]

Okay, let's go to the next question please.

[Operator:]

Okay. And our final question today will come from Howard Smith from First Analysis.

[Howard S. Smith:]

Yes, thank you for squeezing me in here. I wanted to talk about the archiving business you mentioned. It's kind of on plan and the big deals continue to mature. But I wanted an update on kind of some of the competitive changes, divestitures, et cetera, and if you've seen that develop as you expected into the pipeline or not? Any color there would be helpful.

[Gary L. Steele:]

Yeah. I think the competitive environment in the archive space continues to be quite favorable. And I think there is this growing concern across the customer base, those incumbent solutions about what kind of investments are being made. And so that actually is creating more pipeline for us. These deals do move much more slowly than the security deals, but we feel really good about longer-term opportunity there. And I would say the competitive environment has significantly improved over the last 6 months, so we feel good about this broader opportunity in that particular segment.

[Howard S. Smith:]

Great. Thank you.

[Operator:]

That does conclude our question-and-answer session. At this time I'd like to turn the call back over to Gary Steele for closing remarks.

[Gary L. Steele:]

Great. Thanks so much. I wanted to take a moment and thank everyone for joining us on the call. We're excited about the results that we delivered and the acquisition that we announced, so we feel like we've got a great start to 2018. We look forward to talking to you on our next call. Thanks so much for joining us today.

[Operator:]

That does conclude our conference for today. Thank you for your participation.