Q3 2019 Earnings Call
I'm all participants' lines are in listen only mode.
The speakers presentation, there will be a question answer session to ask a question. During the session you will need a press star one on your telephone please be advised that today's conference maybe recorded.
If you require any further assistance. Please press star Zero, Oh, notwithstanding the conference over your speaker today Ms. Kate Patterson. Thank you. Please go ahead.
Thank you Daniel good afternoon, and thanks to everyone on the call for joining us today to discuss virus financial results for the third quarter of 29.
This call is being broadcast live over the Internet and can be accessed on the Investor Relations section of Fireeyes website at investors Dot Fireeye Dot com.
With me on today's call, our Kevin Mandia Firefights, Chief Executive Officer, Frankfurt accounted Executive Vice President Chief Financial Officer, and Chief Accounting Officer, Fireeye, and Grady Summer Fireeyes executive Vice president of products and customer success.
After the market close today Fireeye issued a press release announcing the results for the third quarter of 2019 before we begin let me remind you that Fireeyes management will make forward looking statements. During the course of this call, including statements relating to Fireeyes guidance and expectations for certain financial results and metrics for rice priorities initiatives plans and investment.
Drivers and expectations for growth the expansion of Fireeyes platform, and the benefits capabilities and availability of new and enhanced offerings competitive position market opportunities and go to market strategies.
These forward looking statements involve a number of risks and uncertainties some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward looking statements apply as of today and you should not rely on them as representing our views in the future and we undertake no obligation to update these statements after the call Brady.
Detailed description of the risks and uncertainties. Please refer to our FCC filings as well as our earnings release posted an hour ago copies of these documents may be obtained from the FCC or by visiting the Investor Relations section of our website.
Additionally, certain non-GAAP financial measures will be discussed on this call. We have provided reconciliations on these non-GAAP financial measures for the most directly comparable GAAP financial measures in the Investor Relations section of the website as well as in the earnings release.
Finally, I'd like to point out that we have posted a supplemental slides and financial statements on the Investor Relations section of the website.
With that I'll turn the call over to Kevin. Thank you Kate. Thank you all of you the investors employees customers and partners joining us on this call. We appreciate your interest and support and Fireeyes. We continue to transform from our origins as a network security product vendor to a comprehensive security platform company.
We did what we said we'd do in the third quarter in fact, the third quarter of 2019 marks the 11th straight quarter, where we met or exceeded our billings and revenue guidance. In addition to strong topline performance in the third quarter, we returned to non-GAAP operating profitability and earnings per share where at the high end over guidance range, Let me begin by discuss.
And some Q3 highlights followed by some updates on the business and then I will turn the call over to greedy summers, our executive Vice president of products to discuss our product innovation.
First some highlights from the quarter, we generated total billings of $249 million, an increase of 13% year over year revenue for the quarter was 226 million an increase of 7% year over year and 5 million above the high end of our guidance range. What I'm. Most excited about a tower billings and revenue growth was led by our.
Platform cloud subscription of managed services category, which had a record quarter billings for this category grew 43% year over year and revenue grew by 27% year over year. This growth was driven by strong sales of our cloud endpoint in cloud email security solutions, our threat intelligence, the helix platform as well as a near record quarter for manner.
Defense Baird and also had a strong quarter and for the first time and Fireeyes history billings for our platform cloud and managed services subscriptions were greater than product related subscriptions and support billings strong billings growth for this category resulted in an 11% sequential increase in platinum cloud managed services annually.
Recurring revenue to a record 263 million.
Mandiant services had another record quarter billings for Mandiant services were $55 million, an all time high end up 40% year over year managed services revenue growth increased by 28% year over year. Many consultants have long been recognized as the premier experts to respond to security incidents as demand.
And for expertise has grown we've expanded our strategic services and expertise on demand offerings to accelerate this growth.
Now I'd like to discuss Fireeyes ongoing transformation within the context of our financial performance.
Three years ago, nearly two thirds of our business was appliance based and deployed on premise today. The on premise portion of our business represents less than half of our total sales and appliances represent about 15%. Other total billings, we have executed with purpose to this transformation achieving double digit billings grew.
In five of the last seven quarters.
The share some specific actions that I believe are responsible for this transformation.
First we did the work to decouple in unlock our exceptional detection capabilities and our intellectual property from our appliances, which gave customers greater deployment flexibility and enabled our new cloud offerings second we introduce subscription pricing impacts in cross all of our offerings, allowing customers to purchase are softer.
Option based on volume, we're number of users or rather than appliance. This was an important step two competing effectively in the cloud and as a service markets. We introduced new subscription services in our threat intelligence and our managed defense offerings, we made our expertise available on demand inside our products and.
We introduced helix and open cloud based security operations platform that serves as a portal to our intelligence and our expertise.
And during our transformation two related but different areas of focus emerged within fireeye.
Technology enabled solutions delivered through our consulting organization, whereas an intelligence or managed defense subscription and expertise based products, including our network email an endpoint security offerings. The two are linked through our innovation cycle and connected by the helix platform, but the development priority.
Some processes are different last quarter in an effort to accelerate or time to deliver new products and as a service solutions, we reorganized and streamlining our development teams under new leadership in these two areas just one quarter later, we are seeing the benefits.
Then fire I solutions, we expanded our security as a service portfolio with a number of new offerings, we introduced digital threat monitoring or de T. M. D. Chan monitors the dark web social media forms and other sites for threatening activity collecting and analyzing the data centrally and automatically delivering it to customers we can.
Hi, good public resources for election security, a state and local governments gear up for the 2020 election cycle in the United States, we're providing tailored threat intelligence and research, including the potential attack methods that could be used to impact elections and how to prepare for these attacks. We're also providing notification on this information campaigns as they emerge.
Communicating comprehensive security best practices, and providing election specific solutions help secure elections in United States and around the world in short Fireeyes doing its part depending of in defending a free and open election process.
We also expanded our managed defense subscription offerings with a nights and weekends offering and a U.S. government 24 by seven offering to address the critical talent shortage in cyber security. We also introduced our managed defense for endpoint security simplifying our go to market by combining managed defense and our endpoint security Tech.
Knowledge. He has a single combined solution managed defense for endpoint security customers. They gain more extensive capabilities, including alert management hunting investigation and response at a competitive price and these new offerings contributed to a great quarter for managed defense in Q3.
And we integrated our threat intelligence into varied and introducing new attack intelligence to allow customers to validate the effectiveness of their security infrastructure as well as their resilience to real world attacks.
We also integrated Baird into Mandiant services and enabled new service offerings like the purple team offering offerings that we announced that are cyber defense summit in early October .
It is early in the fourth quarter and we have already sold Mandiant services engagements powered by the varied and platform in the future. We expect to deliver a managed varied and capability through our managed defense. In addition to our professional consultants integrating buried in into their practices. We have other news about the acquisition in the third quarter we.
Close the largest varied in deal ever.
We also closed our first international Vera Didnt deal and we closed two varied and deals over seven figures and we accomplish all of this and Baird. Its first complete quarter as part of fire.
As you can tell we're excited about the opportunities to further integrate burdens capabilities into our subscriptions and services I believe there's no other technology at the same potential to fundamentally change the way organizations implement manage and measure their security infrastructures.
Our laser focused on products under leadership of greatest summers has accelerated or progress on that side of our business as well since taking on the role as our head of products on August Onest Grady has advanced our product innovation significantly and particularly in the areas of cloud security and our helix platform. We recently introduced several key cloud security.
Innovations and we demonstrated a renewed urgency to innovate I've asked grady to join us on the call today. So it can review his first 90 days as our executive Vice President of products Grady.
Thank you Kevin So it's been a busy few months since I've taken responsibility for the Fireeye products team, we took immediate steps to realign the organization for more speed and accountability improve our cost structure refocused our customer retention efforts and accelerate new product introduction.
While we will continue to refine the new organizational structure I'm very pleased with the renewed energy that this reorganize delivered.
Its energy and passion can be seen in our accelerated new product introductions upon assuming a new roles. The team immediately focus through efforts on designing and delivering new offerings for cloud security. This resulted in the launch at our cyber Defense Summit of Fireeye network security for Amazon Web services and fire I detection on demand.
Both of these offerings are available today through the ADW us marketplace I'm proud of our cross functional teams made this a reality through many nights and weekends of hard work.
To be clear this is not just offering fulfillment of our existing on premise network security technology Vws marketplace, rather with this new offering our network security and forensics products can now run natively in ADW us to protect workloads and traffic in the cloud.
We're looking forward to launch in the same cloud native solutions, and Microsoft Azure and the Azure marketplace in the first half of 2020.
Detection on demand is another major milestone for Fireeye.
For years as Fireeye, CTO I heard customers asking for a better way to leverage our detection outside of our core products. They wanted to integrate our analysis into their custom applications and into third party products.
Now the power of our MBX analysis is as easy and invoking as invoking in a pie.
This opens up thousands of new applications for us in our customers for example, integrating the pie the scan cloud based file stores and ADW us Asthree bucket, it's as simple as pointing and clicking from the helix dashboard a customer can now initiate a trial or purchase from the ADW us marketplace and use fire detection on demand minutes later.
I would like to note that as part of our R&D work on detection on demand, we challenge ourselves to make our technology more efficient and truly cloud native as such detection on demand was built as a serverless product and as auto scaling and truly elastic.
We also modified our MPX engine to achieve Pemex greater scalability as it runs in the cloud.
I mentioned these technical features as a few examples.
How we are embracing the cloud in new ways, not merely lifting and shifting our legacy technology into the cloud.
We also announced a joint solution between Fireeye and Ibis, making our network security capabilities available as part of you I boss cloud based secure web gateway.
Our customers desire to protect their employees, regardless of location plus a desire to consolidate their on premise web gateway infrastructure is what drives them to consider cloud based secure web gateways with our joint offering. These customers can take advantage of I bosses high performance scalable and secure service combined with the superior level of protection from threats that fire.
Right provides.
Early interest in the solution has been strong.
Also at our cyber defense and what we launched the next generation of our helix platform with a long list of new capabilities. This milestone version includes the ability to pull in and analyze telemetry from cloud hosted services with a few clicks or the mouse.
Includes self parsing capabilities for customers improved alert context improve reporting new analytics and modules improved integration with Fireeye products.
Federated instances to the msps or large customers can gain visibility visibility into all entities from a single view and new Onboarding and contextual helped to allow customers to realize value more quickly.
These new solutions are all indicative of the type of security products, we plan to introduce as we evolve our organization and our technology more open more extensible and more partner friendly.
To this end in the last three months, we envisioned design and launch the Fireeye developer hub at Fireeye Dot Dev and announced a new developer relations group.
Developer relations exists to enable our customers and their developers to build on fire a pie.
When customers integrate their technology deeply with our guys. They can get more out of our products make themselves more efficient and become stickier customers for five right.
We received positive early feedback on this initiative from our customers today. The hub features documentation forms and how to guides are fireeye detection on demand and over the coming month, we intend to expand with similar content for all Fireeye products.
We also know that growth is not just about adding new customers, but also retaining our valuable installed base.
Well, our Salesforce has always focused on securing renewals. We are now taking a more holistic approach to customer success. Our efforts include deeper participation from our product and customer success teams instrumentation of our products to better measure customer engagement.
And functionality improvements a simplified product interfaces.
We've also introduced prompt and on demand helped to guide users to their desired outcomes within our solutions.
With these efforts were already gaining new insights into customer behavior, and translating them into actionable product features to improve customer engagement.
We accomplished all this in the midst of a cost optimization and a reallocation of resources.
Such processes are never easy the team responded effectively I believe we're getting faster at the same time, we're getting leaner and were more strongly aligned for growth than ever.
Looking forward, we are reorienting, our product roadmaps, even more aggressive we embrace the cloud make our product easier to use more open and better integrated into our customers ecosystems.
As you continue the fast pace of innovation that our product teams have sat have set in the last several months I believe will expand our market and our customer community I look forward to updating you on our progress in future quarters.
Thank you Grady everybody's impressed with what the team has done in the last 90 days and we're really excited to hear more.
As we continue to evolve into a comprehensive security platform I believe our innovation cycle uniquely qualifies us to define and lead modern cyber defense and we will do so in four ways.
First delivering the best layer of detection, we provide this with our endpoint network E Mail and platform solutions that together form an integrated comprehensive security suite that dynamically adapt to new threats to our innovation cycle, our technology learns and it updates dynamically every day to meet emerging threats and to ensure our customers.
As our safeguarded second delivering the best security validation the varied and platform operationalize is our threat intelligence and expertise to help customers measure and test the resilience to real attacks and short varied and provides truth about cyber defenses. When organizations are uncertain about how good they are security is and how.
To measure it I believe in the process of attack measure fix ven repeat and fire on tends to make this process simple continuous and commonplace.
Third delivering seamless expertise on demand where experts are available at the point when customers need them. Most our expertise on demand will continue to be further integrated within our products to make our experts and a seamless extension of our customers security teams and finally, we will always strive to automate security operate.
Once we will continue to leverage our knowledge and expertise to automate the complex security operations required to protect organizations I want to thank all fireeye employees for their continued efforts and focus as we define and lead modern cyber defense I believe we have all the pieces necessary to change the game and security.
And I look forward to our continued progress there was a lot to be excited about and I'll turn the call over to Frank our CFO .
Thanks, Kevin and Hello to everyone on the call.
Since we just post at our analyst day, a few weeks ago, where we discussed our Q3 performance for building revenue an EMR.
As well as our long term target model I'm, keeping my remarks relatively brief.
For those of you who are unable to attend analyst day. The slides are posted in the Investor Relations section of our website.
We also have included the long term model slides in the appendix to Q3 19 financial results slides.
Before we move onto the details of our Q3 results and our guidance for Q4 in 2019.
Let me remind you that I'll be referring to non-GAAP metrics.
For revenue and operating cash flow.
Our non-GAAP measures exclude stock based compensation amortization of intangibles noncash interest expense on our convertible debt.
Restructuring charges and other nonrecurring items.
Turning to our Q3 results billings of 249 million, we're near the middle of our guidance range up 13% from a year ago.
We have now posted double digit year over year billing growth rates in three of the last four quarters.
We achieved a sustained growth while diversifying our customer base beyond the one a enterprises and reducing our dependency on large deals.
To be clear our business was one one a enterprise customers remained strong globally and our sales with global 2000 customers expanded in both dollars a number of transactions. However, a meaningful proportion of our billings growth in the third quarter was driven by non global 2000 customers.
Our increased traction with medium size enterprise customers is evident in a 30% year over year increase in a number of customers transacting in Q3.
And by double digit growth in new logo customers.
We added 276, new logo customers in the quarter.
We added new logo customers in every product family and across every major geographic region.
Notably approximately one third of these new logo customers adopted multiple products or services in the initial transaction.
This multi product adoption was a key factor in a year over year increase in the average transaction size for new logo customers.
Taking a closer look at our billings performance and the related air or metrics by the portfolio categories.
First platform cloud subscription and managed services billings exceeded product and related subscriptions and support billings for the first time in our history.
Platform cloud subscription billings increased 43% year over year.
Excluding buried in year over year growth in this category was 35%.
This growth resulted in an 11% sequential increase and a 32% somewhat year over year increase and platform and cloud air are to a total of 263 million.
While burden contributed to this growth our cloud security solutions, including E Mail and point Felix managed defense and Intel accounted for the majority of the increase.
Mandiant professional services billings grew 40% year over year to an all time high of 55 million.
Services deferred revenue, we've also had a record level, increasing 14% sequentially to 76 million.
Finally, our appliance based product and related a our stabilized following the end of life of the third generation appliances that had impacted our first half 2019 results.
Turning to revenue revenue of 226 million exceeded the high end of our guidance range by about $5 million.
The over performance was driven by a strong service this quarter as well as a few million more of upfront revenue than we had forecasted related to network forensics appliance sales, where the majority of that revenue is recognized upfront.
Approximately a 6% of non services revenue was recognized from current deferred revenue on the balance sheet.
Platform cloud subscriptions and managed services revenue was at a record 62 million in the quarter.
The growth rate accelerated to 27% year over year, reflecting the growth and billings air AR and deferred revenue we have experienced since early 2018.
Manny professional services revenue of $46 million was also on an all time high.
The services revenue growth accelerated in Q3 to 28% year over year, reflecting continued strong demand and the capacity we had added in 2018 and for them.
2019 year to date.
Product and related subscriptions and support revenue decreased 7% from Q3 18 to 108 team million the year over year decrease in revenue reflected the $23 million year over year decline in current deferred revenue opening balance sheet for this category.
As we've discussed in the past, we recognize appliance revenue ratably over four years under the six so six accounting standard.
This means product revenue is directly correlated to deferred revenue and specifically to current deferred revenue.
Since we sell fewer appliances today than we have in the past and 75% of all new appliance sales are added to non current deferred we're recognizing more revenue from current deferred revenue than we are adding back.
This resulted in net decrease in the current deferred for products and related subscriptions and support.
Which translates to lower product and related subscription revenue.
This headwind to revenue impacts both the absolute loot dollar amount of product and related revenue recognized in the year over year growth rates.
The good news is accelerating growth and platform and cloud subscriptions and managed services line should more than offset this backward looking dynamic and product and related subscriptions revenue.
Gross profit margin as a percentage of revenue was 73% in the quarter down from our Q3 18 gross margin of 76%.
The majority of the year over year decrease as a percentage of revenue was related to higher hosting costs for our cloud based products compared to a year ago.
Which we discussed in detail on our last call.
We've already made progress managing these costs and cost of goods sold for non services was flat sockets sequentially, even with substantially higher sales of our cloud based solutions.
Overall gross profit increased by about $7 million sequentially from Q2.
Total operating expenses increased about 1 million sequentially, reflecting a full quarter of aired and operating expenses.
Operating expenses as a percentage of billings declined from 67% in Q3 of 18% to 64% in Q3 of 19.
Demonstrating continued leverage in our business model as we execute on our long term growth plans.
The increase in gross profit was greater than the increase in operating expenses, allowing us to generate operating profit of $4 million were 2% of revenue.
With other income offsetting taxes operating profit translated to net income of $4 million.
Earnings per share of two cents, which was at the high end of our guidance range.
Included in the quarter was the GAAP restructuring charge of six and a half billion dollars for an optimization and reallocation of resources, which occurred late in Q3.
Turning to the balance sheet and cash flow.
We continue to maintain a very healthy balance sheet with cash and short term investments of about $1 billion.
We ended the quarter with receivables are approximately 154 million an increase of $26 million from the end of Q2.
Dsos calculated on a billings were 57 days, which is at the low end over targeted range of 55 to 65 days.
Growth in our billings combined with timely collection continues to drive our cash flow performance.
We generated $18 million from operating activities in the quarter.
This was within our guidance range of $15 million to $25 million and included approximately 6 million a restructuring payments.
We ended the quarter with total deferred revenue of approximately 935 million in.
An increase of 23 million sequentially and 48 million from the end of Q3 18.
Product and related deferred declined $26 million year over year.
And platform cloud subs and managed services increased more than $50 million.
With the improving performance in Q3 as a backdrop, we're making some adjustments to our prior implied guidance ranges for the fourth quarter.
Which also drive some adjustments to our guidance ranges for the full year.
We currently expect fourth quarter revenue to be between 224 and 228 million.
This calculates to 2019 revenue in the range of 870 882 million.
An increase of 10 million at the midpoint from the midpoint of our prior guidance range.
This increase reflects the revenue over performance in Q3 as well as higher platform filed a are an increase in services revenue.
We expect fourth quarter billings in the range of 285 to 295 million.
This calculates to a range of 937 to 947 million for 2019.
While we usually don't guide billings or revenue mix between the portfolio categories is worth noting that we expect platform cloud subscription and managed services category.
To contribute most if not all over the year over year growth in Q4 buildings.
This is because we expect continued momentum in helix managed defense, Intel and cloud email and cloud endpoint.
Additionally, any incremental billings for our new ADW S. hosted network security and detection on demand solutions will be captured in the platform and cloud category.
Recall that we saw a large increases services billings in Q4 of 18, and we've continued to build a backlog of services yet to be delivered as a result, we expect services billings to be relatively flat with Q4 of 18 and with Q3 of 19.
Finally, our billings guidance for Q4 assumes product and related subscription support billings.
To be relatively flat with Q4 of 18.
For revenue, we expect services to be flat to slightly.
Compared with Q3. This is because we have already been operating near capacity in terms of billable hours and there are fewer potential billable hours in Q4 due to the holidays.
Revenue for the other portfolio categories is correlated to our current deferred revenue ending balances, implying growth and platform and cloud subscriptions and a year over year decline in product and related subscriptions and support revenue.
We expect gross margin of 73% for both the fourth quarter and the full year.
We expect fourth quarter operating margin to be between three and 5%, which implies a sequential decline in operating expenses of four to 5 million.
The implies sequential decline reflects the usual seasonal decrease in payroll taxes as well as the cost optimization exercise we completed in Q3.
This calculates to an operating margin for the full year between breakeven in 1%.
Earnings per share is expected to be between three and five cents for Q4 and between one and three cents for the full year.
Operating cash flow for Q4 is expected to be between 57, and 67 million an increase of approximately 100% from Q4 of 18 at the midpoint.
This calculates to full year operating cash flow of between 85, and 95 million implying growth of approximately 50% at the midpoint.
Our updated annual cash flow expectations for 2019 include the.
Locksmith $6 million of restructuring payments recorded in Q3.
Finally, we expect capex for the year to be between 40 and 50 million.
We continue to expect our Capex the declined modestly next year as we have completed all our major plan facility moves.
That concludes my prepared remarks, we'll now take your questions operator.
As a reminder to ask a question you will need to press star one on your telephone to withdraw your question press the pound key please standby, while we compile the Q and a roster.
Our first question comes from Saket Kalia with Barclays Capital. Your line is now open.
Hi, guys. Thanks for taking my questions here.
Hey, Sackett, Hey, Kevin Hey, Frank Frank maybe just to start with you.
Nice performance on the platform billings can you just dig into the makeup of that have that line a little bit more meaning how much of that is more products related with things like endpoint and email and helix versus.
Other types assist subscriptions like varied and for example, so what sort of product related what sort of profit plot formulated inside of that line.
Yes, I think what really drove the really.
Stellar performance of with 43% year over year growth in that category was really cross that category and that's because we had a really solid quarter in the cloud.
Solutions, both E Mail standpoint, and then also on managed defense Intel varied and and helix all performed really well. So yes. It wasn't one specific product within that category that drove it was really year over year solid growth across the category.
Got it got it and.
Kevin maybe for you.
When you think about obviously, a really successful split between sort of the products and the platform organization done done and just 90 days to your point when you think about the go to market.
And just general kind of platform acquisition can you just talk about the cut the typical customer profile profile for platform customer how to deal sizes look in sort of that segment.
And that you would call out on the platform business, specifically just weeks as we sort of get to know these two businesses, a little and I love aren't and finally.
Yeah. So from the majority of our customers the Avenue in his services or endpoint or E mail or network or Intel and we're looking at platform to kind of be the bridging function between all of it. So that if you want to experienced Fireeye you get platform and so what you're going to see.
In most buying experience is the Avenue in is one of those ways I mentioned and platform comes along with it and platform opens up a fusion of all of our capabilities. So somebody buys endpoint.
And they're consuming endpoint in platform.
Avenue in was endpoint platform shows added value because it shows an introduction to our Intel our expertise on demand.
And then some of the other services that we can do as well as the integration into network or email so I.
I see the output from now the point of the spirit, sometimes as spokes in the services.
I think over time, you'll see a rotation to we won sweet but right now the reality of buyers. They are not here to buy the whole suite of everything here because they have one need we meet that need and then platform is the glue that shows the value of everything else. So I gave you. One example, one spoke leading to everything.
We've got with platform as the way they consume the spoke and see just the fusion of all our capabilities.
Understood very helpful. Thanks, guys.
Okay. Thanks.
Thank you. Our next question comes from Sterling Auty with Jpmorgan. Your line is now open.
Sterling how are you hey, guys.
Good good so listen there's been a number of news reports recently in terms of what you guys might be thinking in terms of strategic alternatives I know, sometimes it's tough to comment, but you're so in a public record you can at least give us some insight in terms, you're thinking any comments or our ways that you would answer that question.
Yes. So this is Kevin just as a matter of policy, we don't comment on rumors and then just a matter of personal habit I don't get distracted by rumors so I generally show up everyday not thinking about how do we exit I show up everyday thinking how do we execute and that's just what we do around here. So we're building this company.
To be the best security company can be.
I really appreciate that and then in terms of looking at the subscription the nonproduct related subscription how much of that is coming from existing customers that you've already had relationships with from and actually et cetera versus how much are you starting to tap into new customers.
So I think the growth in that category is really coming from both.
New customer logos and then also just cross selling it up selling within the existing customer base I think we've seen a really nice kind of land and expense expand strata Gerry strategy again like Kevin mentioned earlier, the tip of the sphere, often could be email network network were endpoint more services, but ultimately.
I think we get our customers involved in that category and a lot of different ways.
Thanks, guys.
Thank you. Our next question comes from Ken Talanian with Evercore ISI. Your line is now open.
Hello.
I've done well thanks, thanks for taking the question.
So I was wondering could you discuss your net retention rate some of the factors driving it in the quarter and then maybe related to that could you just talk about.
How much variability there might be and you're forecasting at this point.
Given certain certainty in terms of purchasing patterns between physical appliances and virtual sensors.
Yes, Ken I think.
One of the things we're really excited about in the quarter is that we did see a nice bounce back in our retention rates.
If you remember in Q1 in Q2, we had the end of life for of our third generation appliances. So we saw.
Pretty big hit on a are in the retention rate relating to some of those customers. We saw a nice bounce back in Q3 got it above 100% again.
And I think kind of.
Exactly where we expected to do which was a really nice bounce back because we only had $3 million left in a are ours at the end of June thirtyth related to the third generation.
And then with read your second question with respect to.
Yes.
Visibility within those categories I think we still continue to see kind of general kind of migration to the cloud. So I think we feel very confident in the long term growth in the platform cloud subscription category in any one quarter. The larger deals could go on premise versus the cloud. So we don't obviously have perfect visibility into.
Which way the customer will prefer to purchase but I think you can see with the growth in the platform and cloud subscription category that is generally heading towards the cloud direction and that's why we're so so excited about a lot of the innovations we've done in the cloud yen Ken.
The clear, we don't and sent one way or another to our customers they pick whether they want to go with on Prem.
Solutions or cloud based solutions. So we don't steer it any way we provide the menu to the customer and let the customer choose and that does probably create a little bit of variability there, but ultimately we're letting the market pick the form factor, we're not we're not gaming it in any way.
Great. Thanks, and if I may just a quick follow up how are you think about linearity in Fourq you given the holiday schedule this year.
Yeah, typically Q4's, Gupp, probably the best linearity of any of the quarters, just because I think people try to get the tail end of the December off. So we typically have a much better cycle of purchases within kind of the earlier part of the quarter and and definitely the earlier part of December .
Versus previous other quarters tend to be very backend loaded.
Great. Thanks, so much.
Thank you. Our next question comes from Gregg Moskowitz with Mizuho. Your line is now open.
Okay are you.
Greg Please check your mute button.
Hi, guys, sorry, I was on mute.
Hey, Kevin how are you.
Great I believe you mentioned, a 30% year over year increase and the number of customers transacting in the quarter, which is pretty impressive I would assume this is at least in part due to broader track traction with a channel, but any additional color there would be very helpful.
Yes, definitely more traction with the channel and Frank doing expound on it but I think we've seen this trend maybe not to that percentage, but we've seen this trend for last few quarters or just greater transaction velocity, yet I think it's also the fact that we've now got multiple products that are that is really the tip of the spear. If you think back a year or two ago from a product perspective.
The next network was typically the way we got into customers. If you look at the last couple of quarters actually E mail and endpoint.
Has been a higher proportion of new customer logos. The network. So I think we're seeing a nice kind of broad base.
Customer adoption across our product portfolio.
Okay Perfect and then also you guys always give good color around the particularly large deals and so im just wondering if there are any.
Very significant ones that might be in the pipe or if you're expecting any of those two what actually closed in Q4.
I think you're referring to $10 million bigger deals I'm not aware of any we don't have any built into the guidance for Q4 men. We didnt have any in the third quarter.
Perfect. Thanks, very much guys.
Thank you.
Thank you and our next question comes from her to help us with Stifel. Your line is now.
Good how are you.
That's actually Crispier Gore.
Hi, good on for Kevin.
Obviously.
Man's term Mandiant services continues to be at record levels. Here can you talk about the nature of the current breach in this environment and how we should think about this growth in terms of in terms of sustainable debt sustain building.
Yeah. The sustainability is high because the growth is actually coming in what we call strategic services one of the things about responding to breaches as you learn what you need to be strategic in other words as we should show up to what people perceive as a tactical moment, we've had a breach what happened what to do about it in reality during the.
Moment over the years you learn what technology works, what technology does and what technologies hard to implement.
What technologies when glued together and integrated how does it work what processes are necessary. So we're taking the skills. We've learned over the years during that moment of duress and we're expanding our strategic services under Charles Carmichael and other very experienced folks who have had their you know decade long run of responding to breaches.
Because you just really well versed at that point in advising remember that every time, we respond to a breach the outcome of that our remediation plans. So now we're starting to get more into that proactive selling motion of selling strategic assessments strategic reviews of people security programs, we have a red team business, which.
He is.
The we sell that and that's not responding to a breach that's about simulate the breach and see how good you are and then veritiv that purchase was literally meant to augment the red teams because I believe in security validation everybody wants to know hate as my security stuff work, where the best company out there to figure that out for you in say, we've launched drill attacks and.
Proven it so we are expanding and these are logical adjacent sees based on our core competencies. We are expanding into these adjacent sees and that's why you're seeing services grow.
It's because we're just doing more with the skill sets that we have.
That's great color there to yes, it's now today, we're responding to thousands more breaches, we do generally respond to more breaches every year, but anecdotally you never want to get on a call I guess, it say, hey, but they're all small because some are out there we are actually helping customers and to them. This is the biggest darn problem, they're going to.
Having their careers.
But it feels to me that in general the breaches are little bit smaller, but far more frequent.
Okay, Thats, great color there and.
One other ones for Frank.
It sounds like Verizon has performed quite well since the acquisition is close with a couple million dollars deals in Q3 can you talk about how its performance is tracking against the $17 million billings target for 2020.
Sure Yes. The first milestone is actually 20 million for 2019, I think we're tracking very well to that I think everything that we've seen in the integration and the enablement would lead us to believe that the $70 million is absolutely tracking for 2020 as well I think we've been really encouraged by the sales.
Team and consulting teams ability to to latch onto this product and how excited they are about it and I think we've been able to integrate.
The teams really well so I think it's tracking.
As planned, but we we have pretty high expectations form. So I think it's great news that they're tracking to it one of the things that I mentioned in my script and I'll kind of call. It out here is the thing we call purple teaming.
Where we do a red team exercise and we work with a wedding customer and we kind of go through here's the alerts that were generated when we attacked your network and let's kind of let's instrument your network to stop these attacks or detect them in a manner, where your processes can eliminate impact and we've already sold that service.
And so you can see our services folks are building veritiv into that motion of let's use it during the engagements, but I see that you go out a few years I think what really will happen here and we were going to have it before then but a managed service similar to vulnerability management, where people want to subscribe to the constant vulnerability management I think the motion here will be over.
Time, there will always be customers that want to run the technology, a varied and themselves. But we are also going to have a fully managed capability of it that we can provide where the closest to the attacks with all the response, we do with all the.
Global threat intelligence, we collect and the Red teaming we do why not have us run that for you and with our orchestration capabilities instrument the fixes as well so I have a strong sense of urgency to get a managed version of this to market and we'll update you on that but that's the that's what I'd biofire assists. So I could have someone on my frontline's plugging in.
Tax and and trying it out but boy would I love to have that Fireeye mandiant team continuously assessing my security posture with real attacks and then Instrumenting fixes so stay tuned on that but we're going to work hard towards having a nice managed approach to this.
Great. Thank guys.
Thank you. Our next question comes from Walter Pritchard with Citi. Your line is now open.
Thanks, two questions first Kevin on.
The endpoint side it sounds like you're talking a better about that business seeing improved performance there and I'm wondering how much of that is tied to a managed defense service on the back end, where you're able to differentiate their and.
And Thats helped to drive the performance.
You know I'm not sure as I sit here right now I can't really answered that question I mean, theres always a relationship there I just on the numbers and to quantified for you.
Certainly that that is the technology that are consultants use and a lot of the value in our endpoint is the recognition that we can send the expertise that to assist in do full forensic capability with it but I really can't comment Frank do you know the answer to that I think it's the most of the endpoints to sales are standing on their own yes or no.
Coupled with managed defense I do think there are some larger deals that have managed defense and endpoint together, which has been a nice boost to two endpoint, but overall I think we see a lot of standalone endpoint deals them and like I mentioned earlier.
In the last couple of quarters endpoints been the tip of the sphere of new customer acquisition just.
Just had qualitatively, we're seeing more and more this was greatly by the way more and more endpoint deals that start because of customer concerns of a ransomware and a desire to replace legacy anti virus and so we're seeing more much more traction there than we were a year ago.
Yes, So I went right to like total billings numbers on that don't have that broken out definitely from quantity endpoint stands alone. If you still get the number of transactions endpoint gets sold more than endpoint plus.
Managed defense, but wanted to things that I've always felt people really liked them as always comfortable with is knowing there's a second layer of defense when they have endpoint plus managed defense. They know we're looking at the same alerts they're looking at and we have expertise on other problems.
So that if they feel they lack the internal staffing to deal with things we can do it form so.
I see there's definitely a relationship can't quantified on the phone today.
Great and then Frank on your end on the Opex. It took some actions in the quarter.
Talked about a opex run rate will be down in Q4 can you help us understand sort of the steady state maybe a opex piece of the company's head into next year are somewhat some way because you have the M&A costs from varied and it came in and then this risks and just quite if youve any parts for us to track.
Yes, I think the reorganization or reallocation of resources.
Helped probably about 20 million annually, but we did reinvest some of those dollars in the platform cloud area. So I think as we look to 2020 from a run rate perspective, you'll you'll see a little bit of an increase in sales and marketing side given the growth in billings, but.
For the most part DNA and R&D I think will be relatively.
Ill flat year over year from a head count perspective, and probably slightly up from a dollar perspective, just given kind of inflationary costs.
Great. Thank you Thats helpful. Thanks.
Thank you. Our next question comes from Patrick Coalville RTT Research. Your line is now open.
Thank you for taking my question just quick question on the.
The third generation appliance is that headwind okay.
And also.
Within that customer base, you mentioned in the past the China, mostly being.
Around smaller customers I mean is it.
Still the case Dunstan it correctly.
Yeah. It's over so that we started that transition in Q4 Q1 in Q2, I think we had 3 million left in renewals of the end of June yes, So Frank where we add on I mean, so we completely flush that through in Q3 and Thats why you saw kind of a stabilization after two quarters of seeing product and related air our go down we actually saw.
Ultimately flat quarter over quarter, and you saw really nice uptick in overall air are so it was nice to see that flush through add generally it really has been kind of the smaller customers that have churned off the larger customers from a retentions perspective state remarkably consistent ultimately.
Those customers are very sticky and believe in our products.
Got it includes switch of demand I mean, if I look at your numbers.
This quarter.
So yes today.
Unbelievable business really acceleration.
What's driven that.
In an increasingly hostile threatened volume that you guys.
Single cell some competitive new innovation just any color.
Help us understand will be.
Hello.
I think theres a lot of different factors is to broadening of services you know back when we were added to the Fireeye team in 14 or 15, there's always you know a little bit of getting your feet wet learning how to work together. So there's usually when you first do an acquisition sometimes.
There is little bit of sloth slowing of growth and then you kind of recharge it over time as you get accumulate.
Comfort with the culture. So this thing stabilizing grew.
Steadily and then right around 18, we started broadening the services that it did.
And Thats, what Youre, saying I mean, we knew we had a lot more capabilities than the niche that people know us for of responding to breaches and it was and it was time to advertise that a little bit and venture out from it.
Patrick after a few years of.
Having billings in excess of the revenue deliver we really kind of ramped up capacity in the services or over the last six quarters, which has really helped as well and then broadening the service portfolio to include things like expertise on demand and some of the strategic consulting services is really helped as well.
Got it thoughts are useful thank you very much.
Thank you and our next question comes from Melissa Franke with Morgan Stanley . Your line is now open.
Thank you Kevin you noted strength.
And there certainly has been some shift landscape over the right corridors.
Symantec just wondering if.
As a positive driver for you all this quarter I do think that opportunities for.
Competitive displacements largely on the comp.
The bottom line is I think endpoint is ripe for displacement you and when you look at what we do I love the idea of combining tech with people and when we when we do expertise on demand. It is not to sell more expertise, it's really to differentiate the products and that's what I think you need an endpoint. So that's the one place where theres a lot.
Lack of cyber security talent and is in the ability to do deep dive forensics entry odds from alert to fix so our endpoint what's unique about that is if combining our endpoint with expertise on demand you get the expertise there so all things being equal on day protection side of the house I think people gravitate towards.
Hi, good endpoint protection and access to expert should have questions that just differentiates but the bottom line is the whole market has been ready for a long time for replacement of the first generation solutions and I think the modern endpoint companies are all doing pretty well right now, let's just Grady I'd just say I think generally we're starting to see more questions from can.
Summers on what the semantic acquisition means for them I think if theres or increase replacement opportunities on the calm those questions are just starting to pop up now and welcome back.
Yeah.
Thank you very much just one follow up question.
This is for sure I think Kevin So just thinking about sales marketing spend.
You all have done a really great job.
Yeah.
As we are looking ahead.
20.
But how do you feel about sales capacity and the trends you're seeing.
I think we feel really good about sales capacity I think we feel really good about some of the new products that we've introduced so I think the sales teams going to have a lot more to sell in 2020.
But I think as we look at capacity I think we've got the right number of salespeople in the right regions and I think we've been doing a really good job on continued enablement of the newer products. So I think we feel pretty good about being able to keep the cost.
On sales and marketing relatively flat.
Perfect. Thank you very much.
Thank you and our next question comes from the team in line with you. Yes. Your line is now.
Good afternoon. Thank you for taking the questions, maybe I'll start, which Kevin on as I drill into you need to strengthen the mandiant business I wanted to revisit that and drill into it a little bit more I'm wondering if you can comment on or delineate between real strength domestically versus internationally, because I do understand.
The capacity additions did skew more international so thats part a and then part B. If you can qualitatively speak to start as billable rates and the capacity utilization of existing personnel as it relates to build rates.
That would be super helpful and I have a follow up for great sharp.
Yes, so a couple anecdotes in general because I don't have the exacts on this quarter and geographies, we having growing internationally, but we've also been growing domestically.
A couple of quarters, you see a bounce in maybe the composite being a little more growth internationally.
Our utilization rates are higher charge ability is high we don't keep people on the beach I learned a long time ago, managing a bunch of professional services folks you just got to keep everybody busy. So we don't hire ahead of the power curve much in our folks are feeling pretty strange right now at the amount of effort, they're putting in so from utilization.
There are above the line from a effective rate there above the line and their hiring is right on par. So we have a very performance.
Business, there and for team I think the effective rate being.
Pretty consistent I think is really strong fine given that we have kind of to broaden the base of services to include a lot more strategic services, which are typically it a little bit lower than our IR services. So it's really been great to be able to maintain that high effective rate, even though we've grown that organization.
And just to different types of services.
Yeah. When you look at utilization in the gaps there between any number and 100% nobody can operate at 100% Chargeability, but when you look at our Delta that Delta as an people not having work. It's those people doing sales and marketing functions or engineering functions to support the practice. So it's we're operating at full steam.
Im ahead there.
That's super helpful detail and ready for you.
Referenced the partnership with fiber cost in terms of having the fire I capabilities embedded in their cloud secure web gateway I'm wondering if there are other partnerships that you have sort of at play just spending OEM in your capability standpoint, and secondarily and maybe this is a better questions as Frank if there's any.
Revenue attribution or Rev share or any economic arrangement that you can talk to you as it relates to this.
This partnership and that's it for me thank you.
Sure, Yes, you're right, we're really excited about the I boss relationship lets us get into an area where.
Hadn't been able to play in the passages that increasingly popular secure web gateway in the club.
Yeah, I talked about detects on demand and we see tremendous partnership opportunities there at the cyber Defense Summit, we announced launch partners of core light acceleration.
Going to need examples excel and being a content collaboration platform with a real focus on security and then.
Correlate being a commercial packaging when open source networks encircled Zeke, so just to kind of diverse customers that shows how quickly we can plug our analytic capabilities into third party products I can tell you you'll see a lot more of that from us in the quarters to come.
And from a revenue kind of attribution modeling perspective.
We are going to market in different ways and depending on who's the lead on that theres different revenue ramifications, but ultimately both my boss and fire I would be.
Yeah, nice growth and nice business from any of those joint combined deals.
Thank you and our last question comes from Michael Turits with Raymond James Your line is now.
Hey, guys. This is Keith on for Michael.
Hi, Eric.
Kevin I guess for you I just wanted to follow up on the part question on burden.
Do maybe elaborate on the sales process for these large large bird and deals maybe how you guys have brought into the deal.
The structure the deal or is there any other existing solution that they might have been looking at all.
I can't so for the two that close.
There were most likely emotion before we purchase them and.
And I know, where they were at and they're in the financial services and the government buyer in the bottom line.
The two seven figure deals that close yes, sorry, what well good point theres more knows and with the way I look at it is every time I made a CEO and or speak at aboard it is just relevant right now to discussion how good is my team how good our my security.
Safeguards that I have and this is the way you tested so I like and all the sales we've seen to those early adopters that have recognized this is the only way to get unvarnished truth launch an attack that fin seven does did last week and see how well do you do.
We live with it here at Fireeye, and we're going to see people adapted it's highly relevant.
And that's what led to the sales it doesn't surprise me by the way and that's why I mentioned that government does believe it or not when it comes a security. They are early adopters and a lot of technology and the same into financial services. So those were those deals were at but I expect that the sales cycle in the discussions I have.
It's at a C suite level, because it's so easy to understand we run a tax and we tell you how you did that simple and.
That's a lot easier to comprehend than we have 11000 vulnerabilities and we're trying to rack and stack. The prioritized order of what we're going to do about them. All so that's the relevance and I find it you know, it's probably and I can't speak for is irrelevant to the network security operator.
My gut tells me, though from the says so on up.
It resonates validate your security posture with with real attacks.
So thats the selling motion.
John if I get a squeeze on mine for Frank I'm, just wondering if you can quickly.
Maybe drill down or rank order, maybe the what's leading to the billings acceleration on the cloud platform deals.
To meet your long term framework.
Yeah I think.
Like I said earlier, it really was driven across that whole.
Portfolio set so we had a near record quarter managed defense, we had a record quarter on cloud endpoints and then you look at Intel cloud email varied and helix all very strong quarters, now, obviously veritiv new to that category.
It's.
Performed exactly where we expected it to but obviously a much smaller piece of that overall category.
Thanks.
Thank you ladies and gentlemen, this concludes our question and answer session.
Now I'd like to turn the call back over to Kevin Mandia for any closing remarks.
Yes, I'll make these brief.
We have talked about our innovation cycle for years and the importance of having that frontline expertise that innovation cycle is real and we will continue along the theme of delivering the best layer of detection because that innovation cycle. We see the attacks we adapt to the attacks we have a learning system that can defend our customers.
We are going to delivered the best security validation I think we're uniquely positioned as a company. So that people can run the varied and platform attack their networks measure the results in instrument. The fixes. So they can feel peace of mind in cyberspace, we're going to deliver seamless expertise on demand and we already have.
Version of that in our helix platform in quick and get chat with an expert in interact with US immediately and we'll continue to refine that and bake that in and we will always worked to automate the complex things that we do for our customers of humans today in computers Tomorrow I. Appreciate your interest in fire I look forward to speaking to many of you over the.
Next 24 hours or in 90 days take care now.
Ladies and gentlemen, this concludes today's conference call. Thank you for participating you may now disconnect.