Palo Alto Networks, Inc. (NASDAQ:PANW) Q1 2024 Earnings Call Transcript

Palo Alto Networks, Inc. (NASDAQ:PANW) Q1 2024 Earnings Call Transcript November 15, 2023

Palo Alto Networks, Inc. beats earnings expectations. Reported EPS is $1.38, expectations were $1.16.

Walter Pritchard: Good day, everyone, and welcome to Palo Alto Networks’ Fiscal First Quarter 2024 Earnings Conference Call. I am Walter Pritchard, Senior Vice President of Investor Relations and Corporate Development. Please note that this call is being recorded today, Wednesday, November 15, 2023 at 1:30 p.m. Pacific Time. With me on today’s call to discuss first quarter results are Nikesh Arora, our Chairman and Chief Executive Officer; and Dipak Golechha, our Chief Financial Officer. Following our prepared remarks, Lee Klarich, our Chief Product Officer, will join us for the question-and-answer portion. You can find the press release and other information to supplement today’s discussion on our website at investors.paloaltonetworks.com.

While there, please click on the link for events and presentations to find the Q1 2024 earnings presentation and supplemental information. During the course of today’s call, we will make forward-looking statements and projections regarding the company’s business operations and financial performance. These statements made today are subject to a number of risks and uncertainties that could cause our actual results to differ from these forward-looking statements. Please review our press release and recent SEC filings for a description of these risks and uncertainties. We assume no obligation to update any forward-looking statements made in the presentations today. We will also refer to non-GAAP financial measures. These measures should not be considered as substitute for financial measures prepared in accordance with GAAP.

The most directly comparable GAAP financial metrics and reconciliations are in the press release and the appendix of the investor presentation. Unless specifically noted otherwise, all results and comparisons are on a fiscal year-over-year basis. We also note that management is participating in the UBS Conference on November 29. I will now turn the call over to Nikesh.

Nikesh Arora: Thank you, Walter, very good afternoon, everyone, and thank you for joining us today for our earnings call. Q1 was the first quarter of our three-year plan we presented in August. If I were to summarize the quarter I would say the following. We continue to execute amazingly well in what is a volatile environment. On the geopolitical front, we’ve been contending with what’s happening in Israel and Ukraine. On the hardware or product front, as you see, there has been normalization in the industry, it’s something we’ve been indicating for a while. Backlogs is being shipped, supply chain issues are behind us and product growth is normalizing in the industry, we continue to seize normal strength as we indicated in prior quarters in that category.

On the macroeconomic front, business practices continue to adapt and adjust to a new normal with higher interest rates for longer. Internally, on the product side, we’ve had one of the strongest start to our fiscal year. In addition to various recognitions, we have delivered strong innovation across all three platforms. We launched an AI-enabled Cloud Manager and Network Security to continue our consolidation platformization efforts towards Zero Trust. In SASE, we announced our intent to deliver enterprise browsers, the Talon acquisition, which will solve one of the critical issues that more access, which is not addressed today by any SASE vendor. We released the industry’s first integrated UI for Code to Cloud and Prisma Cloud and announced the acquisition of Dig Security, double-down on data security for Generative AI and Prisma Cloud.

See also 12 Best Low Risk Stocks to Buy in 2023 and Top 20 Countries With the Most Handsome Men in Africa.

Q&A Session

Last but not the least, in Cortex, we launched XSIAM 2.0 to bring your own AI. On-the-go to-market side, Q1 is seasonally a slower start as we kick off the new year, but the team delivered superior revenue and profitability and we had our highest cash collection quarter in our history. We continued to see steady execution – excuse me, in our firewall cloud and endpoint businesses and SASE, we continue to position ourselves in larger and more strategic deals, and XSIAM while in it’s early days, continues to garner tremendous interest, giving us more comfort around our long-term intentions. So in summary, a strong start in Q1 towards our three-year journey, early days, but confidence is fired. Let’s dig in the details. Our Q1 revenue grew 20% and our billings grew 16%, while our RPO growth of 26% exceeded both of these and was driven by our next-generation security capabilities.

I would like you to pay particular attention to RPO versus billings, Dipak will talk about the difference at plan and explain why the street might be confused with our future billings guidance. Our Q1 non-GAAP operating margins expanded by 760 basis points, driving 1.38 in non-GAAP earnings per share and we generated record $1.5 billion adjusted free cash flow in Q1. If you look at what’s going on from an overall cybersecurity perspective, we have never seen as much adversarial and consistent activity at scale as we have seen in the first quarter. Unfortunately, we don’t expect this to abate anytime soon. As a consequence of this increased activity and in recognition of our customer’s commitment to us, this week we announced the Unit 42 Rapid Incident Response Retainer at no cost to all of our strategic customers, and are providing additional support during this escalating threat landscape.

Ransomware attacks are increasing in frequency and severity, the ransom amounts being paid are also increasing. Bad actors are doing damage in a much shorter amount of time. As an example, in the recent engagement of our Unit 42 team, we saw an instance where bad actors extracted 2.4 terabytes of data in just 14 hours. There is also some evidence that the adversaries are beginning to leverage Generative AI as a tool to make attacks more sophisticated. Not just that, based on what we’re seeing in Unit 42, most attacks are not happening on the back of vulnerabilities in widely used software and APIs such as a widely exploited move it file transfer software. Unfortunately, these bad actors remain elusive with no apparent significant increase in convictions and high-profile attacks, and therefore not surprisingly this malicious activity continues.

At the same time, U.S. publicly listed companies in the Board are confronted with new SEC disclosure requirements that are on prompt public reporting a material cybersecurity incident, the enhanced oversight responsibility that comes with them. This result is a continued focus across organizations and understanding security posture, cybersecurity risks, and how to mitigate this risk effectively. This increasingly involves not only the CISO, but the entire IT organization, legal, finance, and the CEO and the full Board of Directors. This pace of malicious activity and the Board-level focus on cyber security risk is fueling a strong demand environment. Customers have often have multiple strategic priorities in cyber security and our broad portfolio enables us to align with these priorities.

In Q1, the cost of money remained a constant discussion and customers’ significant focus on this topic is becoming the new normal. The way it manifests itself in our business is that there’s always a payment in duration discussions in final negotiations. Given our strong balance sheet, we can use a mix of strategies to navigate the environment. This includes annual billing plans, financing through PANFS, and partner financing. Whilst this does not impact our business demand or the impact to annual revenue or annual metrics, it does create variability on total billings more than before depending on financing used or the duration of contracts. I’m not concerned about the demand for cyber security, for this quarter and upcoming quarters, though my concern about our ability to execute, the billings variability is a pure consequence of the payment conversation that we’re having with our customers and this is validated by the fact that we continue to see strong RPO and low churn suggesting this is a cosmetic impact to our business.

We continue to see strong interest across our next-generation security portfolio, and we’re making progress on our platformization journey. I’ll highlight a few deals to talk about the diversity of opportunity, cross-platform buys, as well as the geographical distribution of our deals. For example, the federal government agency signed a $25 million expansion transactions including adding Cortex XDR and Prisma Access in highly competitive situations, expanding the network security footprint. This customer has now spent over $100 million for its lifetime across SASE platform. A large global SaaS provider signed an $18 million Prisma Cloud transaction to consumer modules across the portfolio. The customer is already a customer for our network security and Cortex platforms.

A large education organization expanded its relationship with us in the first quarter in a $15 million transaction adding XSIAM, Prisma Cloud, and an expansion of its network security footprint. And lastly, a nation-state signed a $28 million deal that is a first-of-its-kind, standardizing on both SASE and XSIAM. This is a long sales cycle and represents our systematic approach to platformization. Storing these deals have been playing out across our large customers, as of Q1, 56% of the Global 2000 has transacted with us across Startup, Prisma, and Cortex. This continued focus on customer cyber transformation has fueled a 53% growth in NGS ARR we reported this quarter as we broke through the $3 billion milestone. Another exciting news, as of Q1, recurring revenue across Palo Alto is 83% of our total revenue from 77% a year ago.