Tufin Software Technologies Ltd.
Q1 2019 Earnings Call Transcript

Published: 13 Jun 2019

[Operator:]

Good morning. My name is Chris and I will be your conference operator today. At this time, I would like to welcome everyone to the Tufin First Quarter 2019 Earnings Conference Call. All lines have been placed on mute to prevent any background noise. After the speakers’ remarks, there will be a question-and-answer session. [Operator Instructions]. Thank you.Yuval Fessler, Tufin's General Counsel, you may begin your conference.

[Yuval Fessler:]

Thank you, operator. Hi, everyone. Before we get started, I'd like to read out the Safe Harbor statement. I'd like to remind everyone that any statements made on today's conference call that express the beliefs, expectation, projection, forecast, anticipation or intent regarding future event and the company's future performance may be considered forward-looking statements as defined by the Private Securities Litigation Reform Act.These forward-looking statements are based on information available to Tufin's management as of today and involves risks and uncertainties including those noted in this morning's press release and Tufin's filings with the SEC. Such forward-looking statements are not guarantees of future performance. Actual results may differ materially from those projected in the forward-looking statements. Tufin specifically disclaims any intent or obligation to update these forward-looking statements except as required by law.A telephone replay of the call will be available shortly after the completion of this call. You'll find the dial-in information in today's press release. The archived webcast will be available for one year on the company's website at tufin.com.Now, I would like to turn over the call to Ruvi Kitov, Tufin's CEO.

[Ruvi Kitov:]

Thanks, and good morning, everyone. I’d like to start by thanking you all for joining us today for our first conference call as a public company. Before getting into the results, I'd like to thank all of our customers, employees and partners for all of your support leading up to our successful IPO in April. I'd like to also welcome our new shareholders for joining us at the IPO and since then, and thank to our existing shareholders for their support in the growth of the company.This is an important milestone for the company, which will position us well, to realize our vision to enable enterprises to balance their security and agility. I realized that not everyone may be familiar with Tufin, and therefore I'd like to first introduce ourselves to you. We’ve built Tufin to fundamentally change the way organizations manage their security and network infrastructure. Enterprise networks are becoming increasingly complex and fragmented, spanning across many on-premise, private and public cloud environments. At the same time, digital transformation and DevOps practices are driving a significant increase in software releases, requiring frequent connectivity changes. And with each new connection, you can have a potential entry point for cyber attackers.Today, many businesses are struggling to keep pace with these changes, and find it difficult to efficiently and securely control information flows across their network. Tufin has pioneered a security policy management platform that brings automation and analytics to security and network operations, and enables true digital transformation. We believe that fundamentally your security is only as good as the policy that you define and enforce. Policy-centric security is core to our approach. Every organization needs a unified security policy for foundational controls, who can talk to whom and what can talk to what on the network. These are the core tenants of any network security architecture.With Tufin’s policy-driven automation, each network change can be implemented in minutes instead of days, removing the chance of human error. This can significantly accelerate the development and deployment of revenue generating applications, providing tangible business value in the near-term. We are a pioneer and a leader in our markets, and are in the early stages of capitalizing on significant, untapped market opportunity.Now, let's talk about our results in the first quarter. I'm pleased to report that we executed well and delivered strong results in the quarter. Total revenue was $22.5 million exceeding our expectations. We have about 15% of the Global 2000 as part of our geographically diverse customer base. We believe we have a significant opportunity to drive growth by expanding within our customer base, as well as by winning new customers within the Global 2000 and beyond. The main reasons customers choose Tufin are primarily our superior automation, with wider platform coverage and higher accuracy of changes, our ability to scale to large environments with thousands of devices and our unified security policy for both cloud and on-premise network environments.Our technological leadership and strong roadmap of innovation are key components of why we win. A key new logo that we won in the first quarter and highlights our market opportunity, is a seven-figure deal with a large cruise line company, which is undergoing a digital transformation project. They have a large network and cloud environment with no visibility over a growing number of network changes and a manual time consuming change process. They were looking to become more agile, while maintaining security compliance for both their on-premise and their cloud environment. They chose Tufin due to our unique ability to enforce a unified security policy across the hybrid network. We also saw continued strength in our land and expand model with over half of new business revenue coming from existing customers. One such customer is a large financial payment processor that owned SecureTrack for several years and has been using spreadsheets until now to management network changes. They merged with another company and needed to automate risk analysis and change provisioning without increasing their staff. They quadrupled their total investment in Tufin in the first quarter with the expansion of SecureTrack and the purchase of SecureChange for automation.We also won another large deal with an aircraft parts manufacturer where the complex network coupled with a manual change process which caused human errors that resulted in misconfigurations and network outages.We were the only vendor that was able to answer their policy control requirements and scale the solution to fit their needs. The biggest deal of the quarter was a large bank, which is building their next generation network using Cisco ACI, and several firewall vendors. They were looking to automate security policy changes across their entire network from the edge all the way to the data centers. They selected Tufin due to our comprehensive platform coverage and superior automation capabilities.On the product side, we've recently announced the general availability of Tufin Orchestration Suite R19-1 in which we've extended our lead in automation with policy-based automation for server cloning. This capability enables customers to duplicate the relevant security rules that are required for servers as they’re being migrated from automated error-free process. Organizations that are going for digital transformation can use R19-1 to migrate applications between data centers, without compromising the availability and security of mission critical services.Another strength of our platform lies in the extensible set of API's that we've built. Our customers and partners use the API framework to supplement the Tufin Orchestration Suite with additional functionality by integrating with third-party security ecosystem. Our Technology Alliance Program or TAP enables other vendors to use our APIs and gather intelligence under network topology in the configuration or to automate policy changes based on the incidents that they identify.In Q1, we expanded our technology partnerships with five new partners, Demisto, which is now part of Palo Alto Networks; Efficient IP, Fortress, Infoblox and Splunk Phantom. In many ways, we are the Switzerland of the network world, having built a vendor agnostic policy layer that supports all the major network vendors, as well as cloud platforms with an extensible API framework.In summary, I'm pleased with our first quarter results and what we've accomplished to-date. Our market opportunity is very significant and we remain optimistic about our growth outlook. We continue to progress by delivering our mission to help large organizations significantly improve their security and agility.Now, I would like to turn the call over to Jack Wakileh, our CFO to discuss our financials in more detail.

[Jack Wakileh:]

Thanks Ruvi. As you just heard, we're pleased with the results of our first quarter that continued to validate the strong demand for Tufin solutions. Total revenue was $22.5 million in the first quarter of 2019, representing a 25% increase over the first quarter of 2018. On a year-over-year basis, product revenue for this quarter increased 26% to $10.6 million, and our maintenance and professional services revenue grew 25% to $11.8 million.Looking at the geographic mix for Q1, we have a well diversified geographical distribution with Americas representing 53% of our revenue, EMEA representing 43% and the balance 4% coming from Asia Pacific. Given the size of our business and the fact that our revenue may comprise seven figure deals in any quarter, we may experience variability by geography on a quarter-by-quarter basis.Moving to margins and expenses, I will discuss our results based on GAAP numbers and where applicable, non-GAAP numbers. Non-GAAP numbers exclude stock-based compensation expense in the total amount of $1.1 million for Q1 2019 and $0.4 million for Q1 2018. Please note that the GAAP to non-GAAP reconciliation can be found in the tables of our earnings press release located on our Investor Relations section of our website.GAAP gross profit for the first quarter was $18.4 million compared to $14.7 million in Q1 2018, both quarters representing an 82% gross margin. Non-GAAP gross profit for the first quarter was $18.7 million compared to $14.8 million in Q1 2018, both quarters representing an 83% non-GAAP gross margin.Tufin is addressing the large market that is primarily greenfield with multiple factors driving an inflection. As a market leader, we plan to invest in this opportunity. To that end, total operating expense for Q1 2019 was $22.7 million, a 52% increase year-over-year from $14.9 million in Q1 2018.Looking at our operating expenses. Sales and marketing expense for Q1 2019 was $13.6 million or 61% of revenue, compared to $9.1 million and 51% of revenue in Q1 2018. This increase in sales and marketing expense is driven by our investments in expanding our sales organization and reach to land more Global 2000 customers and large enterprise customers as well as increasing demand and market awareness for our solutions.Our research and development expense for Q1 2019 was $6.5 million or 29% of revenue compared to $4.7 million and 26% of revenue in Q1 2018. The increase in R&D expense is primarily due to our investment in engineering talent as we continue to deliver on our roadmap and strengthen our technological leadership.General and administrative expense for Q1 2019 was $2.6 million or 12% of revenue, compared to $1.1 million and 6% of revenue in Q1 2018. The increase in G&A expense is associated with investments in infrastructure, and increased expenses related to being a public company. GAAP operating loss for Q1 2019 was $4.3 million, compared to an operating loss of $0.2 million in the first quarter of 2018. On a non-GAAP basis, operating loss for the first quarter of 2019 was $3.2 million, compared to an operating profit of $0.2 million in the same period last year. GAAP net loss was $4.5 million compared to a net loss of $0.7 million in Q1 of 2018. Net loss per share basic and diluted was $0.54 for Q1 2019 compared to $0.09 in Q1 of 2018 and that's based on 8.3 million and 8 million weighted average ordinary shares respectively.On a non-GAAP basis, net loss was $3.4 million, compared to a net loss of $0.3 million in Q1 2018. And net loss per share basic and diluted was $0.41 for Q1 2019 compared to $0.04 in Q1 2018.I should remind everyone that our preferred equity conversion into common shares came in effect in the second quarter of 2019 upon the IPO, and hence was not taken into our share count for calculating the net loss per share in the first quarter of 2019. I did notice that some analysts may have included those preferred shares in their Q1 share count for their EPS estimates.During the quarter, we had a financial gain of $40,000 due to foreign exchange, compared to a financial loss of $112,000 in Q1 2018 also primarily due to foreign exchange. Foreign exchange gains and losses can fluctuate and we do not try to estimate future movements in foreign currency.Turning now to our balance sheet. As of March 31, 2019, we had cash and cash equivalents of $28.6 million exclusive of the funds in our IPO that came in the second quarter, and that is compared with $17.6 million as of December 31, 2018. Deferred revenue on our balance sheet as of March 31, 2019, was $43.8 million, compared to $31.4 million as of December 31, 2018. These figures represent the deferred balance after netting off the portion of the deferred revenue that has not been collected as of end of March 2019 and as of December 2018, respectively.The gross deferred revenue as of March 31, 2019, was $58 million, compared to $56.6 million as of December 31, 2018. In the first quarter of 2019, we generated $11.9 million in cash flow from operating activities, compared with $15.8 million in the same period of 2018. The timing of when we close large deals within the quarter can impact our operating cash flow. This quarter, we had a record number of seven figure deals for our first quarter at Tufin.Turning to guidance, I want to share with those who may have not met or followed us during the IPO process, that we look at the next couple of years as investment years. We plan to spend on accelerating our technological leadership in the market and growing our sales and marketing organization.For the second quarter of 2019, we expect total revenue of $23 million to $25 million and we expect non-GAAP operating loss to range between $4.9 million to $6.4 million. For the full year 2019, we expect total revenue in the range of $105 million to $110 million and we expect non-GAAP operating loss to range between $10.7 million to $12.7 million.With that, I will take it back to the operator to open it for Q&A. Operator?

[Operator:]

Thank you. [Operator Instructions]. Your first question comes from Sterling Auty of JP Morgan. Your line is open.

[Sterling Auty:]

Hi, guys. Welcome to the public market. One question and one follow-up. First, Ruvi for you. When you look at the expansion deals, the follow on purchases from customers, how much of that is buying the same product for more used cases or in other words buying more SecureTrack just for using a broader part of the organization versus how much of what you saw in the quarter was actually upselling additional products like SecureChange?

[Ruvi Kitov:]

Alright. Hi, Sterling. Thanks for the question. So we're seeing expansion on both fronts. So we're seeing expansion both in SecureTrack for new environments, people expanding to new data centers and into new parts of the business, and also automation. Automation is definitely one of our strong growers. So we're seeing automation expansion deals and also new customers that are buying automation at the first time as soon as they become a customer.

[Sterling Auty:]

And one follow-up. We're seeing lots of moves in terms of people in our vendors and security trying to put together their portfolio of what they're going to do in the cloud. When you look at Orca and Iris and some of the things that you're positioned for containers, microservices, et cetera, is there going to be a change in terms of who you compete against in the cloud versus who you’re competing against traditionally on-premise?

[Ruvi Kitov:]

Yes, I think that's natural, because in the cloud world there are different vendors. And you're looking especially at Orca and Iris, which are unique solutions, our current competitors don't have anything that's close to that or any answer in that area. So there will be different competitors I assume. But when we look at what we provide, it's a Unified Security Policy Management Solution across your entire network, both the on-premise and the cloud and going to containers. It's for customers who have an environment in all those areas and no one does that better than Tufin.

[Operator:]

Your next question comes from Saket Kalia of Barclays Capital. Your line is open.

[Saket Kalia:]

Hi, guys, thanks for taking my questions here. Maybe first for you, Ruvi. I think one of your competitors in the space announced maybe some changes to the workforce during the quarter. It may be early to comment on this, but can you just touch on any changes that you saw in your competitive backdrop, competitive win rates or any thoughts on what that might mean for the overall space, if you will?

[Ruvi Kitov:]

Thanks, Saket. So, we can't comment on what's going on inside other companies. From our perspective, the demand that we're seeing in the market is very strong. And the competitive landscape has not really changed. We often see AlgoSec, Skybox or FireMon as competitive deals. And most customers actually don't have a policy automation solution yet. So in competition, we win due to the superior automation capabilities, better scalability, and our strong roadmap and history of innovation.

[Saket Kalia:]

Got it. That makes sense. Maybe -- so my follow-up for you, Jack. Thanks for the detailed guide for next quarter. I just want to touch on the implied revenue growth a little bit. Obviously, in a perpetual license model, things can be lumpy. But it looks like the implied revenue growth for the second quarter might actually accelerate just a little bit year-on-year. So is there anything you can touch on either from a comparability issue or a big deal perspective that might touch on that implied acceleration?

[Jack Wakileh:]

Yes, thanks for the question, Saket. So we’re not planning to go into a pipeline discussion, but I can tell you that you should be approaching this through the guidance. And you are right as a perpetual company the comparable part is the fact that we run a bottom up pipeline analysis, and we apply it in a consistent and disciplined methodology. And based on that, Saket, I can tell you that we feel comfortable with what we guided for Q2.

[Operator:]

Your next question comes from John DiFucci with Jefferies. Your line is open.

[Unidentified Analyst:]

Hey, guys, this is Joe on for John, thanks for the question. A follow up to that last question, Jack based off of Saket’s question. You're in a unique situation where you're reporting with only two weeks left in the next quarter. How much of that guidance is left to achieve? And I know most deals are back end loaded. But just trying to figure out how much is already in hand versus what's left to go get?

[Jack Wakileh:]

Thanks, John. So again, I mean, we're again going back and saying that the way we should approach is through the guidance. We have enough experience in running the bottom up pipeline analysis and we apply it consistently in a disciplined manner. So again, what I can tell you is, we do feel comfortable with the second quarter guidance.

[Unidentified Analyst:]

And then if I could just two quick model questions. So you had a strong first quarter on the top-line and bottom-line, the cash flow is a little light. And you had some comments there, I just want to make sure, I fully understand that. Was that timing of deals or was deferred revenue also like a little bit like lighter than I guess street would have expected?

[Jack Wakileh:]

Yes. Good point, John. So as we said, operating cash flow is influenced by the timing of large deals, as you mentioned. So based on the closing dates of those deals, we can see fluctuation between quarters. But nevertheless, we guided revenue and operating loss. And we believe these are better measures, if you want to look our performance for 2019.

[Unidentified Analyst:]

And then just a quick follow-up.

[Jack Wakileh:]

So I can add a little bit more color and share with you that we had a record number of large deals for our first quarter at Tufin -- for Q1.

[Unidentified Analyst:]

And then any sense that you can give us of the split between software product and hardware or maintenance and professional services, just trying to get a little more granularity in your results?

[Jack Wakileh:]

Yes, sure. So you've seen in the past couple of years we’re reporting 50%-50% split approximately. And we're going to be in line when you're looking on the annual basis. Within the quarters, you will see the first half of the year maintenance and services being ahead of product, just the way our model works. And then that’s going to be balanced off in the second half of the quarter, where product is going to exceed maintenance and services.

[Operator:]

Your next question comes from Shaul Eyal of Oppenheimer. Your line is open.

[Shaul Eyal:]

Congrats on the debut quarter and set of absolutely strong results. Ruvi, I want to go back to one of the wins you discussed in your prepared remarks, whereby the customer has gone through consolidation. I think you mentioned quadrupled, exists opportunity moving from SecureTrack and adding SecureChange. Are they also looking into SecureApp at the stage?

[Ruvi Kitov:]

Hey, Shaul, thank you for the question. So this customer right now is not yet looking at SecureApp but we see that in our land and expand model as people crawl, walk and then run as a natural step. So they just bought SecureChange, they need to automate their network, that can take a little bit of time. And once they do that, we expect to offer them SecureApp as well. So that's an opportunity for the future.

[Shaul Eyal:]

Understood, understood. And Ruvi or Jack, can you talk to us about some of the ASP trends you are seeing out there, clearly as Jack just indicated, the number of sizeable transactions and certain deals as they’re seeing, the good highs, but what's underlying that from a pricing perspective, from an ASP perspective?

[Jack Wakileh:]

Okay, so I'll take that Shaul. You’ve probably seen our F-1, the perspectives that we filed. We were talking about ASPs there. We said that ASP was around $200,000 for Global 2000 enterprise and 120 on the overall for Tufin. We do think this is an annual measure. It's going to be more valuable to look at it on an annual basis. On a quarterly basis, this may fluctuate given the size of our business, obviously. So we do recommend to look at this metric annually. I can give color saying that if you're going to compare Q1 2019 to Q1 2018, you're going to see increase in ASPs. And as I said before, that's largely also attributable to the fact that we have a record number of large deals for Q1.

[Operator:]

Your next question comes from Andrew Nowinski of Piper Jaffray. Your line is open.

[Andrew Nowinski:]

Alright, thank you. So if we look back at the results from the primary firewall vendors in Q1, most were relatively weak.Check Point’s product revenue declined about 4.5%, Fortinet’s product revenue was barely above street expectations. So can you just talk about how you can maintain your growth rate in what looks to be a slowing firewall market? And then I have a follow up.

[Ruvi Kitov:]

Hey, thanks for the question. I'll take that. So, when you look at Tufin and what we do, and the relationship to the firewall market, we're actually selling into a huge unpenetrated market, right. The vast majority of the customers don't have a solution for Tufin. And so, while we license based on number of firewalls, if you look at the TAM, there's actually about 12 million devices in the world out there, right. So we do have just a very, very small fraction of the number of firewalls in the world covered by Tufin, or any of the competitors for that matter. And if you look at the firewall vendors and how their results fluctuate over time, they have refresh cycles, they grow at different paces. For us, that doesn't really affect our TAM at this point. We have a huge market opportunity ahead of us. And we’ve penetrated very few accounts so far.

[Andrew Nowinski:]

Great, thanks, Ruvi. And then, if you look at Palo Alto, they also missed billings, due to a shift to the cloud. I think this was touched on earlier, but I was just wondering if you could provide any color as to what we should expect from Iris and Orca for the year given the increasing move to the cloud?

[Ruvi Kitov:]

So Iris and Orca, they are still in early availability. We're seeing a lot of interest from customers on both products. We have several customers that are testing them. And we're building our go-to market efforts under a new cloud unit now and recently appointed General Manager of Cloud to lead those efforts. So Orca and Iris are seeing a lot of traction. And we're actually seeing them impact some of our deals already, as customers are looking to future proof their investments. So they're looking for a vendor whose roadmap matches their cloud strategy.

[Operator:]

Our next question comes from Jonathan Ho of William Blair. Your line is open.

[Jonathan Ho:]

Hi, good morning. I just wanted to maybe start out with your R19 release. And could you give us a sense of maybe what customers are most excited about in terms of that offering?

[Ruvi Kitov:]

Sure. So in R19-1, one of the things that we announced is server policy cloning, and server policy cloning is where you take a server and you migrate it from one data center to another. Think of all of the network connectivity the firewall rules that need to be modified, you need to take down that environment in the initial data center, set it up correctly in the new data center. That type of change can take hours and days. We can do that in minutes and we can do that securely and accurately.So it's very interesting for customers as they are migrating to a new data center or as they're migrating applications to the cloud. On top of that, there's a lot of other functionality that we've added that relates to automation, extending our lead in automation. I'm not going to go into individual pieces, but you can read the press release and get some more details on that.

[Jonathan Ho:]

And then just with regard to the automation, you guys talked about some partnerships with SOAR vendors. And I guess just can you give us a sense of how you work with them, and maybe how your type of automation is different from what they're doing and maybe where the overlap might be?

[Ruvi Kitov:]

So SOAR -- SOAR vendors are primarily in the incident response cycle. So they're in threat detection. People use them in security operation center, they're integrated with sim frameworks. So think of it this way, those SOAR vendors, they get a feed, and when they see something go wrong, they go out, and they hook into various systems in order to allow security engineers to tackle a problem in real time, right. And if you think of Tufin we’re a security policy solution. So the way we integrate is twofold. One, is those sorts of solutions can connect to two things. Get a lot more intelligence on what's happening in the network. What is the network topology? Where can you get on the network? What is the current security rule based on every one of those firewalls? That's one piece. And the other piece is, if they identify a malicious activity, and they want to block or continue certain host or a network, they can call Tufin through an API and we will segment that and essentially install a rule in all the firewalls to effect that change and block off an attacker. And we can do that on the network.

[Operator:]

Your next question comes from Gur Talpaz of Stifel. Your line is open.

[Gur Talpaz:]

Ruvi, you talked about a large financial services win in the quarter within a Cisco ACI environment. I was hoping you could expand a bit on that? And then just more broadly, the opportunity you see in software defined networking?

[Ruvi Kitov:]

Sure. So Cisco ACI is gaining a lot of traction with customers. I think Cisco was very successful selling it. And early on a lot of customers bought it, because that's kind of the next generation of Cisco. But now they're starting to do a lot more software defined networking with it, where the vision for Cisco ACI is for an app developer to say I want to go from point A to point B in a gooey. And then for the network to reconfigure itself automatically, without actually anybody going to data center or opening SSH to [Sandbox.So that's the promise of software defined networking and Cisco ACI is building that. People want to be able to use Tufin with Cisco ACI in conjunction, right? So the question is, if you have firewalls that are plugged into Cisco ACI and various firewall vendors already have advanced firewalls that integrate Cisco ACI, how do you manage the rules on those? What are the ACI topology look like? The idea is that if you want to open a connection from point A to point B, beyond just the data center, let's say it's from a compute environment all the way up to the cloud, you're going to need to spam many firewalls, routers and switches, and maybe even touch the Cisco ACI routing itself. And therefore, customers asked us to add that integration and that's what we're building with the Cisco ACI support right now.

[Gur Talpaz:]

That helpful. And then with Orca, we saw Palo Alto acquire Twistlock a few weeks back. I think it'd be helpful to understand how you position Orca relative to sort of the pure play container security vendors like, Twistlock and like Aqua out there. But then I think more broadly, I know, it's early days here, and you sort of build out the policy automation inside of container environment. But how has customer response been in the Early Access Program for this solution? Thank you, Ruvi.

[Ruvi Kitov:]

Thanks, Gur. So on Twistlock, when we look at them their main use case is attack detection and prevention. You can think of it as IPS for the container world, and primarily at the OS level, not the network level. They also provide vulnerability scanning, that's another use case they have. And if you think of Tufin Orca, it's a network security policy solution, right? It's a policy of who can talk to whom or what can talk to what in the container world. And that's very different from what Twistlock and some of its direct competitors do. We have a very strong partnership with Palo Alto. In the future, Palo Alto will integrate Twistlock into Panorama, we see actually opportunities to support that as well. So that's the first part of the answer.And your second question was on Early Access Program. People are very excited about it, starting to play with it, look at their environment, some of them are testing them in their labs, the next phase is to move people into production. So we're seeing a lot of interest from our customers.

[Operator:]

There are no further questions at this time. I will now return the call to our presenters.

[Ruvi Kitov:]

Alright, thank you very much. Just want to conclude that we had a very strong Q1, very happy with the results. I want to thank everyone for all their efforts. And look forward to seeing you all next quarter. Thank you.

[Operator:]

This concludes today's conference call. You may now disconnect.