Q2 2020 FireEye Inc Earnings Call

In quite a 2020 earnings results conference call.

This time, all participants are not listen only mode.

We will conduct a question and answer session and instructions will follow at that time.

Good question dangerous session, you want needs a press star one on your telephone if you acquire any for their systems. Please press Star Zero I saw this call is being recorded at this time I would like to turn the call Kate Patterson. Please go ahead.

Thank you do well good afternoon, and thanks, everyone on the call for joining us today to discuss Virage financial results before the second quarter of 2020. This call is being broadcast live over the Internet and can be accessed on the Investor Relations section of my rights Web site at investors Dot Fireeye Dot Com with me on today's call arc.

Kevin Mandia Fireeyes, Chief Executive Officer, Frankfurt account, <unk> Executive Vice President Chief Financial Officer, and Chief Accounting Officer of Fireeye, and Brad My or you know Fireeyes executive Vice President and Chief strategy Officer.

After the market close today Fireeye issued a press release announcing the results for the second quarter of 2020.

Before we begin let me remind you that firings management will make forward looking statements. During the course of this call including statements relating to fight raised guidance and expectations for certain financial results in metrics.

The impact of the Cobot 19 pandemic by rights priorities initiatives planned and investments.

Drivers and expectations for growth and business transformation, the expansion of Fireeyes product subscriptions and services and the benefits capabilities and availability of new and enhanced offerings market opportunities and go to market strategies.

These forward looking statements involve a number of risks and uncertainties some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward looking statements apply as of today and you should not rely on them as representing our views in the future.

Undertake no obligation to update these statements after the call for a detailed description of the risks and uncertainties. Please refer to our SEC filings as well as our earnings release posted an hour ago copies of these documents may be obtained from the FCC or by visiting the Investor Relations section of our website.

Additionally, certain non-GAAP financial measures will be discussed on this call. We've provided reconciliations on these non-GAAP financial measures for the most directly comparable GAAP financial measures in the Investor Relations section of the website as well as in the earnings release.

Finally, I'd like to point out that we have posted the supplemental slides and financial statements on the Investor Relations section the website with that I'll turn the call every cabin. Thank you Kate I like to thank all of you for joining US today, all the investors the employees to customers in the partners that have such a strong interest in fire I hope all of you your families in your loved ones or.

Staying healthy during these unprecedented times.

Yeah, I'm proud of how Fireeye has responded to the current charges. The world is facing we made the pivot to work from home in March and it's working from home continued over the months, we maintain productivity. We delivered the results we set out to accomplishing the second quarter.

I'm going to begin todays call by discussing some Q2 highlights I'll provide an update on or innovation, both mandiant solutions in Fireeye products. I will then turn the call over to Brad May Arena, our new executive Vice President and Chief strategy Officer.

And then we will conclude our prepared remarks with the discussion of our financial results from Frank.

We did what we said we'd do in the second quarter, we exceeded our guidance range on both the topline metrics as well as the bottom line in fact revenues in the second quarter with the highest second quarter revenues in our history and our non-GAAP operating income was the highest we've ever had as a company. So let me share some additional highlights Q2.

Revenue was $230 million 15 million above the midpoint of our guidance range.

Our revenue growth was led by year over year increase of 30% in our platform cloud subscription and managed services category, which includes our validation threat intelligence and managed defense offerings as well as our cloud based security products, such as E. P. P and cloud endpoint annual recurring revenue for this category incur.

These 27% year over year.

I'm very proud about the performance of the many consulting services.

Revenue for the service grew 21% compared to the second quarter 2019.

This marks the ninth quarter in a row of record revenue for our professional services the sixth quarter of year over year revenue growth greater than 20% and the third quarter in a road that our services revenue exceeded $50 million.

Our threat intelligence annual recurring revenue grew 27% year over year, reflecting just how differentiated our front line knowledge in global threat intelligence real yes.

The composite of our revenue continue to shift from our appliance based heritage and our control products to our cloud based products and Mandiant solutions.

Combined revenue over platform cloud category, and our professional services category eclipsed our more mature appliance based business again in the second quarter and accounted for 55% of or total revenue.

This compares a 46% of our total revenue a year ago and 40% in the second quarter 2018. So we have the evolution in the right direction.

And then other major milestone our annual recurring revenue for platform cloud and managed services surpassed the product related category for the first time ever.

We achieved these results while significantly reducing our cost structure generating a non-GAAP operating margin of 10% and a record non-GAAP operating income net income and earnings per share.

We also added more than 200, new logo customers in the quarter and close 39 transactions greater than a million dollars well. Both these metrics are down from slightly a young down slightly from a year ago.

This performance is inline with expectations given the current environment.

We first mentioned a year ago that we were seeing two related but different areas of focus emerge within fireeye, which we referred to as platform and solutions business and a products business.

Since then we have optimized our investments reorganized our development teams in place new leadership in each of these two areas. We also created two separate brands Fireeye products and Mandiant solutions to better reflect our internal structure.

Doing so allows it to simplify our go to market strategies and to leverage the equity of each brand fireeye products as control technologies to best protect our customers.

Mandiant solutions as a product agnostic offering to enable him power all security technologies to be as effective as possible.

Our innovation cycle fuels and enables both the fireeye products and Mandiant solutions businesses. Each relies on incomes constantly improves from our frontline experiences in incident response, performing red team engagements and our global threat Intelligence network. So now I'll provide you an update on both these areas.

I'd like to begin or update with Mandiant solutions, which consists of mandiant consulting our threat intelligence are managed defense and our security validation capabilities and we'll start with consulting.

As I said earlier, our services business had its ninth straight quarter of record revenues, an increase of more than 20% over the second quarter 2019, we will continue to invest in consulting for at least three reasons first I believe are Mandiant consulting services will continue to deliver above market rate growth. This growth is.

Driven by two predominant factors threatened environment that remains elevated and our reputation as the recognized industry leader and incident response in cyber security consulting.

The second reason, we continue to invest in many in consulting is that our services drive strong long lasting customer relationships that lead to follow on business. As an example, our incident response is often the tip of the spear for new logo customers and more than 90% of or service customers purchase additional products or services.

Within 12 months following our initial engagement and third our services deliver one of the highest contribution margins in the company. Therefore, we are creating new services and adding the capacity to deliver these services in order to continue the momentum of the Mandiant consulting practice now I'd like to up to the.

The update you on the Mandiant intelligence and Mandiant validation.

[noise] customers and security operators routinely want to know everything we know about cyber threats and they want to answer two questions are they currently compromised by these threats or could there be compromised by these threats. Therefore under the leadership of Chris key and Sander Joyce we have modernized the delivery of a threat intelligence.

And coupled it with our validation capability to address this need.

We call combining both a threat intelligence and our security validation to Mandiant advantage and we plan to make it available to our customers during this quarter.

With the Mandiant advantage, along with our proprietary threat intelligence, we will also be including related open source information. So that customers will be able to know what we know in real time and apply that knowledge to their own security alerts coming from any source in short the mannion advantages like getting our threat intelligence team to our customers.

Security operations with results that network speed.

In addition, our customers will be able to seamlessly pivot from our threat intelligence to security validation.

This will enable our customers to simply and see if we execute real cyber attacks and hone their defense is based on the results of these attacks.

We believe the simplicity elegance and ease of the many an advantage is a major step in our transformation and that it will be instrumental and embedding our threat intelligence and validation capabilities into all security operations, whether they leverage fireeye control products or not.

We're also expanding our Mandiant managed defense offering starting later this year, we plan to offer our managed defense capability with third party endpoint technology for the first time.

Hi, offering managed defense without being exclusive to Fireeye products, we expect to expand our addressable market and enable new technical partnerships and alliances.

And now I'd like to provide you an update on or products business under the leadership of Bill Robbins Fireeye products leverage our frontline threat intelligence to provide the most up to date defense against cyber attacks protecting our customers from threats on the network and email on the endpoint and then the cloud remains a core part of our mission over last three years.

We have modernized our products business with new form factors simplified or go to market and we have a greater focus on customer success. We also continue to enhance the products with new features to support our customers.

Our endpoint annual recurring revenue increased more than 30% year over year with cloud endpoint air are up more than 100% for the second consecutive quarter. The investments we've made have driven above market growth as well as industry recognition for example for endpoint, we achieved the highest cumulative detects.

Wins across all categories. Among the 21 evaluated vendors in the 2019 Mitre attack assessment and most recently we won recognition that the best endpoint security in the 2020 SC Europe Awards, our launch of endpoint security five Dato in the second quarter was one of our best releases ever Akita.

This release was our innovation architecture, which represents the shift to a more modular design that results in faster innovation and new detection, New protection and enterprise readiness features.

We believe next generation cloud endpoint, including managed EDI, our continues to represent a growth opportunity for us and we are increasing our investment in our endpoint solution.

We continue to innovate network security raising the bar in detection leadership, while enabling customers to expand their deployments into public and private clouds are network security non Dod over released during the quarter included more than 40 customer requested features including support for Microsoft's Azure and bring your own license options for both.

You asked and Azure.

In May we added new capabilities to helix that further enhanced the safety and security of remote workers.

These and other product innovations are helping us deliver control technologies that better protect our customers with offerings available on premise and in the cloud that leverage our industry, leading threat intelligence obtained on the front lines.

In conclusion, we continue to accelerate Fireeyes transformation.

Our Chief operating Officer, Peter Bailey is helping lead this transformation, but focusing us on higher profitability and increased growth of our cloud category and EMR as our emerging key metric.

We are also transforming our back office from our appliance based heritage to a modern quote to cash process. We recently appointed day bomb Gartner as our CIO to facilitate the changes required and we are laser focused on changing our processes to better support our subscription businesses and delivering our solutions in a more modern and simple way.

I want to think all Fireeye employees for all the progress we have made toward our transformation and for their continued efforts and focus through these most unusual times and now.

About the turn the call over to Brad Marino, our new NVP I've known Brad for over a decade.

And during that time I got the watch him transform the security operations of target Thomson Reuters General Motors in General Electric he uses specific methods to create and measure security programs and we have the means to improve upon and institutionalize these practices.

I'm going to turn the call over to Brad who is going to shares perspective on the industry in the reasons why join Fireeye today.

Over to you Brad.

Thanks, Kevin and Hello to everyone on the call as Kevin said I was a few so for 15 years, leading the transformation of I T risk in security programs at some of the largest companies in the world.

And the playbook I used to do this always included one company every single time that company was Fireeye. So why as far I always been a key partner my transformation playbook. It all starts with the foundation of what makes this company. So special simply said I believe then and I believe even more strongly now that we have the world's best.

Cyber expertise and threat intelligence and that we know more about the bad guys than anyone in in the industry.

Our Intel's derived from an organization that's been operating for over 15 years and the knowledge gained from responding to over 800 incidents a year and that work is supported by a 180 analysts operating in 22 countries and monitoring in over 30 languages. This Intel xeon apply upstream into all.

Fireeye products and solutions from our employing cloud solutions, how we respond to influence how we hope for bad guys. Your network help build the manager Soc and test the effectiveness of your security program through Red teaming and automated validation the simply nothing else like fire high Fireeyes comprehensive set of cyber.

Expertise.

Intelligence and products and that is why I joined Fireeye.

So looking ahead.

Given the unprecedented rise in frequency and sophistication of attacks one of the areas I'm. Most excited about is the security validation business. If there's one thing all companies need to be doing a right now is the validate the effectiveness of their security programs and that's exactly what Matt Mandy Validations all about.

We have taken the power of varied in which we acquired last year and combined it with our global in breach intelligence to create a platform that helps companies entered two very simple questions. If I were attacked today would they detect it and how effectively could they respond to it.

And so one reads a headline about a company being shut down due to a ransomware attack. The first thing. They ask themselves is that could that happen to them, how ready or they for that companies want to know how effective the security program is not hope. It is effective hoping is never a good strategy.

And then also given where we are in the good Kobin World. We're all looking at ways to take costs out of our respective organizations Mandiant validation not only tells you what's working or what's not working it could also tell you what return you're getting on your security investments, giving you. The data you need to make decisions about where you.

Can effectively manage costs of ineffective security controls out of your organization and we're finding that more and more companies want this insight given the cost constraints faced by all companies in this code with world.

And there are number companies that do this but none of them have the combined power of the burden platform backed by man. The intelligence. So this is why I'm here and excited to be part of this world class team and help our customers combat this ever evolving threat landscape. So thank you and I'll turn the call over to Frank.

Thanks, Brad.

Hello, everyone on the call.

Before we move onto the details of our Q2 results and the guidance for Q3 and the remainder of 2020.

Let me remind you that I'll be referring to non-GAAP metric, except for revenue and operating cash flow.

Our non-GAAP measures exclude stock based compensation.

Amortization of intangibles noncash interest expense on our convertible debt.

Restructuring charges and other nonrecurring items.

As a high level summary, Q2 was a really strong performance for us across all key metrics.

I Echo Kevin's comments that we ex execute extremely well in this uncertain environment.

We delivered revenue of $15 million above the midpoint of our guidance range.

And reduced our operating cost by 17 million compared to Q2 of 19.

As a result, we delivered our highest ever non-GAAP operating profit of $22 million.

We also delivered positive operating cash flow of nearly 15 million and free cash flow of 9 million.

Now, let's turn to the details.

We remain focused on annualized recurring revenue and revenue as the most important indicators of our financial performance.

Error provides insight into the expansion of our installed base of recurring subscription.

Without regard to short term changes in average contract like or timing of large renewals, which as we've seen can cause volatility in the quarterly growth rates for billing.

Revenue reflects growth in our deferred revenue balances and drives our profitability.

For these reasons, we believe error and revenue are better indicators of the progress on our transformation journey, especially in the current environment.

Some color on our Q2 billing performance illustrate this point.

We delivered 203 million in billings during the quarter down 8% from Q2 of 19.

The year over year decline was the result of three factors.

First in Q2 of 19, we booked a large multiyear government appliance refresh and renewal deal.

It was entirely on premise email security.

While this deal did not reach the $10 million threshold that we typically disclose.

It was at the very up brand of applied the $10 million range.

We do not book any transactions approaching the size in Q2 20.

Interestingly when I looked at the details of large deals in Q2 of 20 compared to Q2 of 19.

The most significant difference was in deals greater than 3 million.

We booked five deals greater than 3 million in Q2 of 20 compared to nine in Q2 2019.

I believe the decline is most likely related to the uncertainties of the current environment as deals. This large are typically multiyear and paid up front.

Second the same trend as reflected in the decline in average contract length in Q2.

Overall Hcl declined by about two months.

The effective reducing reoccurring and total billings by about 12 million.

Finally recall recall that the appliance sales were relatively strong Q2 of 19 due to the refresh cycle associated with the end of life of our X 300 appliances.

Product in a related subscription billings were up 5% year over year in Q2 of 19.

Led by a 24% year over year increase in appliance sales.

This compare made that Q2 decline in product and related subscriptions category, let's look much sharper than longer term trends suggest.

And providing this details you can see how factors that have little do with our current operating performance can impact the optics.

Our sales have traditionally been weighted towards large enterprise and government customers and this can drive big deals and mix variation between quarters.

However, our air our metrics showed that these long term strategic customers.

While our products and solutions to protect their organizations as much as they always have.

Looking at our revenue in the air our by breakout categories.

Our shift to cloud based in cloud delivered solutions continued in Q2.

With platform cloud subscriptions and managed services revenue up 30% year over year.

This category accounted for 32% of total revenue compared with 26% of total revenue in Q2 of 19.

Platform cloud and managed services air our increased 27% year over year and 5% sequentially.

And accounted for more than half of our air are for the first time.

Revenue associated with on premise product and related subscription business was down 12% year over year.

Large portion of the decline was associated with appliance hardware as appliance sales from prior periods are fully amortized.

Air are for the product can related subscription category continues to stabilize with air are down just 2% sequentially.

This decline was more than offset by sequential increase in the era of the cloud version of our products.

Professional services revenue was a record 53 million and accounted for 23% of total revenue.

Compared with 20% of total revenue in Q2 of 19.

Strong demand for our expertise and a higher mix of our incident response services allowed us to maintain high utilization rates and Chargeability was translated into record gross margin of 57% for services.

Lower travel, which is charged back to customer at cost or zero percent gross margin was also a factor.

The increase in services gross margin helped drive our total gross margin to 72% consistent with Q2 of 19 at above our guidance range of 68% to 69%.

Operating expenses declined $17 million from Q2 of 19.

Reflecting our reduced cost structure following the first half 2020 restructurings.

As well as roughly eight to 10 million of lower travel and entertainment and lower facilities operating costs due to the worldwide shutdown related to covert Nike.

The combination of higher than expected revenue improved gross margin and lower cost translated into recker operating income of 22 million and earnings per share of nine cents.

Turning to the balance sheet and cash flow our balance sheet remains very healthy we ended the quarter with cash and short term investments of 914 million.

The cash balance reflects payment of a significant portion of the Q2 restructuring charge and the repurchase of 96 million of 120 million in series a convertible notes.

The total amount of convertible notes outstanding is now approximately 1.1 billion.

We ended the quarter with $120 million receivables a decrease of 20 million from 140 million in a are at the end of Q1.

Dsos declined to our historical range at 54 days a decrease of 20 days from the end of Q1 due to good bit billings linearity and collections of some of the outstanding receivables carried over from Q1.

Our strong collection performance resulted in operating cash flow of 15 million and free cash flow of nine.

Total deferred revenue at quarter end was approximately 893 million.

A decrease of 27 million sequentially and 20 million from the end of Q2 of 19.

Product and related deferred revenue decreased by almost 66 million from a year ago as appliance sales on the related subscriptions and support from prior periods are fully amortized.

The year over year decline in product and related deferred revenue was partially offset by a $20 million increase in platform cloud and managed services deferred revenue.

Note that deferred revenue associated with professional services projects declined about 3 million on sequential basis from the near record levels of Q1.

With increased capacity in our strategic consulting business from hiring over the last year, we were able to work through some of the backlog of committed projects.

Our topline results validate the resilience of the business and the relevance of our strategy.

While the improvement over operating profit and cash flow demonstrate our resolve to transform our operating model and deliver profitable growth.

Now, let's turn to our current outlook for Q3, and the second half a year.

As we discussed before changes in average contract length, the timing of large transactions and subsequent renewals customer preference for on premise versus cloud form factors and periodic fillings, all have the potential impact the quarter by quarter billings mix and growth rate.

This is especially true in the current environment.

As a result, we're not guiding to billings number for either Q3 or for the year.

However, with more than 90% of our non services revenue recognized from the balance sheet.

We have good visibility into our revenue and operating model and we are comfortable guiding to revenue operating profit and earnings per share.

I'm pleased to say that with the continue momentum we are seeing early in the third quarter.

As well the strong revenue and operating results posted in Q2, we're raising our guidance for revenue.

Operating margin.

Earnings per share for the second half of 2020 and the year.

For Q3, we expect revenue in the range of 225 to 229 million.

Gross margin of between 70 and 71%.

Operating margin of between seven and half and half percent.

And fully diluted earnings per share of between six and eight cents.

For 2020, we're raising our revenue guidance range to 905 to 925 million.

An increase of 25 million at the midpoint from the previous guidance.

We now expect gross margin of between 70 point, 571.5% compared to our prior period Act expert expectation of 69% to 70%.

This range assumes our services gross margin returns to a more sustainable range of 50% to 53% in the second half of the year.

We are raising our operating margin guidance range to six and a half the 7.5%.

Which reflects our increased revenue range and reduce cost structure as well as lower travel in facility operating costs as compared to 2018.

Embedded in this guidance or assumptions about the ongoing impact of the covert 19 pandemic on our operating metrics that you should consider as you build your models.

First we do expect TNT and facilities operating costs to increase from the lows in Q2.

Restrictions are lifted in certain international regions.

As we outlined in our Q1 call we expect to restructurings, we did in the first half to reduce our operating costs by about 25 million in 2020 compared to 2019.

And this remains our expectation.

We also expect to see a continued decline in the average contract length by about two months compared to a year ago.

And finally.

We remain somewhat cautious about the potential impact of the pandemic on services billings and revenue growth race.

More specifically our current outlook does not anticipate a sequential increase in services revenue in Q3.

Also.

We do not expect to see the same surge in prepaid services Bill as we saw in Q4 of last year when services billings exceeded 70 million.

As noted this is based on what we know and believe as of today. There's a lot of uncertainty that's been created because of the coven 19 pandemic.

But I believe we approve that proven the resilience of our business.

We do we're doing our best to provide you with guidance while operating in this uncertain environment.

And I'm confident in our ability to deliver on improved revenue and profitability outlook as we continue to transform our business.

Operator, we'll now open the call for questions.

Thank you as a reminder to ask a question you want me to press Star one on your telephone to withdraw your question touched upon key.

Please standby will be compile the Q1 day roster.

Our first question comes from Sterling Auty with Jpmorgan. Your line is now open.

Hi, guys not on drilling thanks for taking the quest.

With regard.

To the impacts you're seeing from Kogan on the business, which products are you seeing.

Did you see increased demand for throughout the quarter.

So similar to last quarter, we actually saw Intel and cloud endpoint performed very well in the coven environment.

Services, which is one area that we thought might be impacted more significantly by cobot actually had a incredibly strong quarter.

We saw very high mix of incident response engagements, which because of the elevated threat environment.

We were firing on all cylinders, there as well.

Got it that's very helpful. And then one one follow up on with regards to the services margin long term do you think that the that the current environment may be shifts how much of the deployment that you can do remotely and that that could potentially benefit.

You know the operating margin line. Thanks.

Yes, we really the only impact from a services margin perspective, there were two components to it. The first component was a higher mix of incident response, which is at a higher rate per hour. So that obviously benefited the services gross margin and then the fact that we're not doing a lot of on site travel and so.

So yes that help because we don't have a component of what we're charging at very low margin. So when we when we get reimbursed for travel that's basically at cost so that does bring down the overall gross margin.

I would expect that going forward.

The new norm will probably continue to deliver a lot of stuff remotely, but there will be occasions for.

On site engagements as well.

Great. Thank you Matt.

Thank you.

Thank you Sir our next question comes down Gregg Moskowitz with Mizuho. Your line is now open.

Okay. Thanks, very much and I'd like to talk with you guys. I guess my first question is just on varied in slash validation I think a strong argument can be made that.

The ability to implement them for security controls is more relevant in the current environment than ever which I think Pratt is talking about as well when I'm wondering is how much evangelism. If you will is required today in order to help customers understand the value out of that service.

Yes. This is Kevin speed I think there's still a little bit evangelism, there is not real space there yet so what I'm observing is a couple patterns and.

First it you know our Salesforce has warmed up to it so you're going to see in my opinion pipelines, increasing nicely and I like that we've got the behavior amongst our entire salesforce that it's irrelevant service.

The second thing, though is it depends on the state in maturity of the customer and what will happen is a lot of times. If you read team a customer and they have two years or remediation to do they don't need to do continue will remain you read teaming. So this is something that.

There's almost like you read team somebody.

They do the remediation to that and then that the amount of drills. They do gets more incremental on a little bit faster. So right now I'd say validation is something to one enterprises in the mature teams are doing for we'll be doing shortly and for the folks that are less mature they may do it once do.

You couple of quarters of remediation and then get back to doing it on a more repeated bases, but it's still you know in emerging market I'm, just confident that it's going to be one that matters.

We had a multi day CAD decade round of patch management, and let's just patch everything but this is even better than that this is unvarnished truth as an attack work or not and to me that is something you can take up to the board and have a very tangible and simple conversation rather than well, we scanned 120.

2000 posts, we had 57000 vulnerabilities, we rack and stack those into four different buckets from critical to non critical and then here's where we're at in our remediation drills nobody understands it nobody can comprehended, so I'm, giving you a longer answer from what you asked for but we like the growth that we're seeing and validation.

But I again, if you got to Gartner or you go to other analysts. They are saying this is a five years out sort of thing our goal is to let people know the value of it now that it is true just provides more value now in so many other alternatives when you're trying to tweak the knobs on your security instrumentation.

Okay. That's really helpful. Kevin Thanks for for that Thanks, and then Mandiant advantage I think it's interesting as well how should we think about the price uplift for mandiant advantage versus the Standalone threat, Intel and validation and then also will there be some sort of promotional pricing for existing customers that have already bought one service, but not the other.

Yes, Greg it will be an uplift obviously, but.

It will really depend on the level of service will be getting and how much they're going to deploy it within their environment, but we will have an opportunity for some strategic customers to actually adopted in Q3 and.

We'll have some promos that we rollout in Q4 as well to get a decent amount of existing customer base on it.

Great. Thank you.

Thank you Greg.

Thank you. Our next question comes from Jonathan Okay. There with Baird. Your line is now open.

Yes, good afternoon.

I'm wondering if you can elaborate more on the smaller number of new logos added in the quarter just the challenges you're seeing on adding new customers into the certain segment of the market you server or is it broad based is it something you expect to continue.

And Jonathan this is Frank yes, it I think in this environment there, there's pluses and minuses in this environment that you have the plus is yes, we are seeing a little bit higher renewal rates were also seeing a little bit more traction from follow on business with existing customers. One of the downside is new customer acquisition is a little bit.

More challenging this environment because in a lot of cases.

Yeah yourself for US is obviously not able to be on site and selling a new product to a new customer I think is a little bit more challenging. This environment. So you know intuitively that that was a surprise.

That we did see year over year decline, but I think if you look at kind of the large strategic customers.

No.

Every aspect of our business from pipeline to every other key metric are trending really well. So yes, all customers are created equally and so yes, new customer logos is a metric but by no means one of the more significant ones.

Okay. That's helpful.

I guess that leads into my second question just so we're on the platform adoption can you talk to us about the.

The products that are leading the charge in terms of adoption and Steve you've seen any change there related to cultivate.

Similar to Q1, we saw a little bit to a more uptick than we had seen in 2019 on.

Intel and cloud endpoint.

So those seem to to be things that I become probably a little bit more important in this environment.

Those were probably the only.

Really changes that will kind of pre cope it up we have seen to our surprise we have seen.

And in our entire services be able to be delivered remotely and pre co bid we delivered a lot of services remotely, but not everything and so it was really good to see things like training that.

Customers.

Typically like on slide to be able to deliver that remotely in Q2.

So no real change in demand trends are out the helix and managed defense.

No no I think it's pretty similar probably only negative impact in some of those areas, where we are we did see contract length come down a little bit which is not surprising that in this environment customers are oftentimes committing to.

A lot less paid upfront dollar.

Engagement.

Right. Okay. Good thank you.

Thank you Jonathan.

Thank you Sir our next question comes from the team after Ronnie.

Your line is now open.

Good evening, everyone. Thanks for taking the question, Brad maybe I'll start with you and welcome to the team.

I'm curious about the key objectives.

For you as Chief strategy Officer.

In the top initiatives that you plan to undertake in your goal.

Yes. Thank you. So first is really about taking kind of my experience and applying it to our strategies and Thats, how do we go to market with what products and when and just really being that.

In house customer representing.

Evangelize internally, what our customers want and then turning rounding evangelize in that externally.

That's helpful and Frank if I may follow up for you.

If you can help us to finer point on the geographic performance.

And certainly vertical based performance anything to call out there in terms of.

Areas of weakness in particularly.

As the pandemic has sort of traveled globally in certain geographies in areas that lets get restrictions I'm wondering how that sort of impact at the business into Q and how your shorted envisioning or or incorporating that in your outlook for the year and that's it for me. Thank you.

Sure. So for team I think from a Geo perspective.

So obviously the cobot pandemic has kind of add them flowed in different areas, but as we look at it.

From a delivery perspective from a new customer acquisition perspective really hasn't changed that much.

Kind of pre covert postcode bid I think theres been certain pockets in certain areas that probably fall a little bit more pressure at different points in the quarter, but even those areas within a full 90 day period seem to kind of ebb and flow. So I would say yeah from a Jia perspective, just not a lot of difference by Geo.

Relating specifically to co bid I think most of the you know the various impact on things like contract length has been more across the board.

And just the same question on that vertical basis and end market basis.

We've seen a probably a little bit less and the kind of though harder hit industry is like.

Oil and gas and transportation.

But other than that it really hasn't been very very much different from a vertical perspective, we had a very strong outstanding local quarter in the second quarter will have very strong fed quarter. This quarter. So it's.

Fall as kind of the typical patterns.

Very helpful. Thank you so much.

Thank you for team.

Thank you and our next question comes from.

Stifel. Your line is how open.

Hi, This is actually Chris bureaus on for Gore.

Kevin you mentioned in the prepared remarks that you were planning on adding incremental services to the Mandiant consulting business.

Can you talk about what services you plan to add and what's driving those additions.

Absolutely.

You know what are the things.

That's where we're the best remote as responding to breaches, it's really hard to forecast that even though we have 17 years the history doing it.

You tend to not know who's going to get compromise tomorrow and what to do about it. So what you start doing is saying if you want to have more predictable revenues and knowing where your folks shouldn't be working six weeks out we do a lot of that with red teaming but we got to get into what we call more strategic services.

And the interesting thing is with our especially I think last quarter over 40% of our services revenues and maybe even higher than that were from responding to breaches.

It's again hard to schedule it but when you do those things were writing these remediation plans and here's what could do about it.

And most of the time when we're the first one to the door as opposed from Dover, We are being asked to take somebody from security point, a security point B, how do we get better how do we get there and over the years, we've kind of punted on those and we said you know what that somebody else's job. They can comment and do that I believe right now.

We've got all of this incredible frontline expertise, we're responding to these breaches, we're figuring out what happened what the do about it and then we're getting on the plane flying back and we can't do that we Gotta go they extra mile and start doing those transformation services and greater volumes there more predictable.

They stabilized that the spikes that you can get in services over time to get a bunch incidence one quarter and not as many of the next.

And it also another reason why we bought in Bradley have Charles Carmichael internally running this is that mandiant over the last six or seven years, we really haven't concentrate on the top of the pyramid for consulting we hired a whole bunch of frontline responders, we have a whole bunch of directors managing it there unbelievably busy there unbelievably chargeable, but then.

Thats, what the other consulting firms would call the partner level, we don't have a lot of people and if you want scaling services, that's where you have to higher that's how you get it. So we're focusing on strategic services, we're focusing juergen cutchin or runs that on hiring at the top of the consulting pyramid.

To grow it and we're absolutely phenomenal out that's one the main thing so everybody. Thanks, while you respond to breaches that you. So tactical it means you actually have total command of the strategy around transforming security operations I believe we made right more transformation plans than anybody on the planet, We just don't help our customers.

Go through all.

So we're going to start doing.

Thank you, Kevin that's great color and one for Frank.

Can you talk about how we should expect the appliance business to trend through the back half of the year.

Yeah, I think we'll see a little bit more stabilization on the product and related business. If you looked at the first two quarters of 2020, the compares where again.

Heavy product refresh quarters in 2019, obviously recall, we did the end of life for the X 300 appliances.

At March 31st last year. So Q1, two has some pretty significant refresh activity Q3 is more of an apples to apples. So I think you're going to see stabilization there.

And like I mentioned earlier, we are seeing a little bit of an uptick in our renewal rates. So we feel like that we'll see that part of the business stabilize at the back half of the year.

Great. Thanks, guys.

Thank you Chris.

Thank you. Our next question comes from Rob Owens with Piper Stanley. Your line is now open.

Great. Thanks for taking my question I'm doing well how are you doing.

Fantastic.

Excellent Kevin could you kind of just play for us the cobot continuum relative to how the quarter played out someone on the linear many already perspective, and we went into this at the end of March which is usually a busy period, but curious as to you know your big deals are up your logos were down quarter over quarter.

Right, Yes, those looked good how did the linearity play out and how did the quarter take shape.

Yeah, and Rob you're not going to like my answer because in these 90 days the linearity was better than ever before I mean, we couldnt explain it at the time are going through it and I've seen other CEO stay the same thing it was almost like people pushed back against the cobot pressure and our linearity. We were always ahead during the quarter the whole.

Quarter, our sales professionals and what they predicted kind of fell right in line with what they said all along so we did not feel the impact in fact.

We felt almost the opposite better linearity more discipline amongst buyer and.

Yep things fall in line for us.

Well actually I'd like to answer Kevin So.

If you misinterpreted my response, so I think that got it then bags that the second question relative to tier guidance and I think the midpoint of the rain you lose about five points of growth quarter over quarter understand that this is the first full comp you have relative to varied and how much is associated with that versus Jim.

The general environments and of course, the thoughts on the federal Senate. Thanks.

I think Rob this is Frank.

Current environment, we are similar to last quarter. When we gave guidance we are expecting some level impact from co bid on the services side. So we are expecting sequential down quarter on the services side that may not happen.

But as we look at it today Q2 that team was incredibly chargeable I mean, the yes.

There is no well, it's very unlikely that the mix will be as high of incident response engagements as very unlikely we can maintain that level of charge ability in the third quarter, because the third quarter tend to be a little bit seasonal on the services side. The other there are more vacation the summer slowdown in Europe, you know all.

Kind of hits in the third quarter and so that's why you see from a revenue guidance perspective, a little bit of us sequentially potentially down.

Quarter over quarter, but as we look forward, we've been adding to the services team. So we feel very good about that longer term and I think with the growth on the platform cloud side, I think you're going to see continued contributions there and like we talked about little bit earlier on the stabilization on the product and related.

I think we'll see a little bit better.

Benefit there as well and some of the color Rob having having run that thing for 16 years now what I observed in Q2, as we said no to lot of jobs and you can't always control the inbounds when there was a breach.

I felt like our nose were a little higher in Q2 based on capacity, but when that happens you do get a little bit of burn out when you get burn out sometimes folks come come off a couple of jobs and you have to give them a week to collect themselves and that week is hitting in Q3 force and then at one of our last new hires I guess.

No. The the attendance at our last consulting Onboarding was about 77 folks when you add that many people. There was also that have step backwards. You go two steps forward. When you onboard in this environment I'm not convinced I know what the new normal is for Onboarding does it take them want engagement to be up to speed for engagements to get up to speed.

Because I do know we're working we're working remotely we're working a little bit differently, but there's no question.

Yeah, Onboarding is probably going to take a tiny bit longer with on the job training.

And then I think we're not the change you know we did fixed fee jobs you pay for US upfront I think we're one of the only consulting cores run in that way I think into coven environment, we're going have to change that a little bit and.

Our products company, we like failings billings collect upfront that's not the services business, but we've run or services in the model of it almost being a product I think one of the ways. We can continue the growth there is to start changing that payment cycle, let's do the services first and then charge for.

And that's okay, and we may have to do a little bit more of that this current environment.

Alright, Thank you guys.

Thank you Robert drop.

Thank you next question comes from Saket Kalia with Barclays Capital. Your line is now open.

Okay, Great Hey, guys. Thanks for taking my questions here how are you.

Doing great second how are you.

Good good Hey, Kevin maybe just to start with you or in your prepared commentary you touched on on some new skews that were available for network security in the public cloud you spent a lot of time with customers as well as Brad I mean, I'm wondering what your customers are telling you about their desire to put an added layer secure.

I'd like Fireeye on what they may already have in the public cloud if they have anything.

Any any thoughts on that.

Yes, it's a little early to tell but I can tell you further one enterprises fireeye has always been that second layer of Assuredness right. That's how we are in the network in a way that's how we were on endpoint with forensics and on E Mail and we're kind of building into that layer one.

So I believe this it the customers that have adopted fireeye when they go to the cloud, it's just far more probable theyre going to bring us along with them because they've learned rely on our technology to defend their networks.

May trade, some new opportunities for us as well.

And we got to do it regardless I'm glad we did the work, but right now it's a little early to tell you know we have a 15 year run of the appliance business and only a couple year run of cloud defying that capability, but now it's really cloud native and.

We'll see how how does it so that's a long winded answer sachot to tell you. This one enterprise they want to layers of defense they'll do it down market or smaller businesses may not be has relied on that.

Got it that clinics 12 cents Yep sure sure Frank maybe for my follow up for you maybe maybe derivative a question that was asked earlier just about the core products business, but.

But I'm going to focus in on sort of product or our specifically and how you think about that going forward.

I guess the question is do you feel like.

You can sort of stabilize here in that 300 million range on on product and related a Aurora and maybe you could talk about some of the dynamics and that because you mentioned the amortization of product that we that we all know can you just talking about some some of the puts and takes to that that product unrelated air on how we should sort of think about that going forward.

Yeah I thought if you look at in Q2, you did see some level of stabilization on a sequential decline of 2%.

There are obviously as some customers that migrate from on premise to cloud and so there is some movement of dollars between buckets. So I won't say will there will be stabilize forever at 300 million or so, but I think I think we'll see it in a stabilized range going forward on it and like I talked about.

A little bit earlier that.

Q3, we Didnt wasn't Q3 nights and wasn't a huge refresh quarter. So I think you'll see some product stabilization there on the year over year, where I think the important thing to keep understanding you know as you look at Fireeye as a whole the product and related business.

While stabilize it's generating a significant amount of cash that we're now able to invest in the growth areas of the business. So as we look at how as we get more efficient as a company.

More mature areas are really becoming a kind of a cash cow for us and thats really helps us invest significantly in areas that we believe will continue growing.

Got it very helpful. Thanks, guys.

Thank you and then and then next question comes from Tal Liani with Bank of America. Your line is now open.

Hey, Thanks, guys. This is actually Dan SUNS retail thanks for taking our questions here first for Kevin interesting to hear that you guys are going to be managing third party endpoints implant products going forward can you talk a little bit more about the strategy. There may be how many vendors you'd be interested in supporting or some other.

Areas of security that you think entry you guys to start managing.

Yes, so by the way it's been a plan all along I guess, maybe before fire I bought US and then you know we had a five year period, where were beholden to fireeye products.

It's that.

You're not going to own every damn account on endpoint period and the demand for our expertise in the second set of eyes to look at every single alert is something almost everybody I talk to ones and they're not going to throw out there endpoint for our endpoint just to get that so it just makes sense for us to go in and say what do you got and can we see.

For it and we should have alissa supported products one of the best things about being on the front lines of every breaches, we know exactly the detection efficacy of everybody's products granted you can have user error and you can figure I'm wrong in most products are probably only use at 60% of their potential.

But we're just sitting on the front line seeing what gets evaded how it gets evaded and we need to apply that knowledge to more than just start technology period at just it's more valuable for us to do that we can do that and it's just time, we start doing it so thats the rationale behind.

Doing it for the managed defense by the way we've been do it in services you can't always show up to a breach and say hey, no matter, what you've got we're not going to use it we're going to use our own stuff.

We do have technology enabled services, but we have responded to incidence collecting data using other technology you have to be able to do it.

It's as simple as well I was just about the have an analogy that compared Microsoft with word perfect, but I don't think were purposes around anymore, but the bottom lines, we use different technology get the dam job done and we got to elongate that so we're going to have supported products inside of managed defense, that's being run by Marshall Holman.

And we'll support other endpoint technologies and that's the number one use case for managed defense verify that we have a damn problem answer. The question every day all the time are we compromised or not and that's what managed defense does and I just think.

It should be gone faster than it is this is probably the fastest way to unlock growth.

Great Great that sounds good and then quickly from Frank.

Good to see they are growth improved to 8% I think thats the best over last year on year over year. There can you just help us break out what you attribute to Baird and in that growth if that's possible. Thanks.

Yes, so we did see obviously varied and continue growing and continuing.

Have nice traction year over year.

We did grow 27% in the platform cloud category from an overall billing perspective, the varied and growth is probably close to half of that growth.

Thanks, guys.

Thank you very much.

Thank you Sir our next question comes from Hamza Fodderwala with Morgan Stanley. Your line is now open.

Hi, Thank you for taking my question hope you're doing well.

[music].

Just a quick question.

On my end.

Clearly Q2.

Demand was really durable.

I'm wondering what you're seeing.

As far as early demand trends are concerned in July.

Particularly in.

For the high profile breaches recently is that helping to create any new pipeline.

Into the back half just any thoughts you have there.

You know the one challenge when you mentioned that I've made the went to the.

Year to 30% to 40% of our services revenue comes within quarter, sometimes you know in regard to those breaches.

We worked a bunch of big ones in Q2.

We've probably got a couple of big ones right now, but some of the headline breaches by the way aren't ones that are big headline breaches from a response standpoint, you know.

And so.

Wont comment on those specifically, but they weren't going to be big jobs for us.

Frank I'll have a good answer for that so early on I think the best way to look at it is typically when we have significant amount of breach activity. Yeah. There's typically a fair amount of pull through from those breaches over the next call. It two to two to three quarters and so.

The fact that Q2 was really significant for each quarter and incident response quarter.

That does kind of play well for the back half of the year because a lot of those engagements will have.

Significant either product or solutions kind of pull through.

What we're seeing early in Q3, yeah, we have seen some kind of high profile breaches, but.

Q2 was a really high mix of breaches so.

We'll see where Q3 and but so far.

We still see a lot activity going on there.

Yes, I think there's always adaptation, we've always done or incident response work remotely. That's just what we do you need you need to pros from Dover, we send the expertise.

In minutes and help yet, but one of things I'm certain we'll have to do is our strategic consulting has always done with some on site visits onsite interviews and things of that nature, we'd have to evolve a little bit on how we do that build a little bit more about validation, having dashboards said it we can interact with their customers remotely in a more effective.

Way.

And we're building that with the varied and platform that ability to attack test and rinse and repeat but I am certain we're going to have to look at the way, we do our strategic consulting and change some of those methodology based on a.

Our work from home environment.

Got it thank you.

Thank you. Our next question comes from Shaw with Oppenheimer. Your line is now open.

Thank you good afternoon, guys. Congrats on the strong performance and the allocated for the second half.

Thank you Kevin I wanted to focus specifically on your email related product.

Are you seeing Microsoft being more pronounced will more visible in this market and in recent quarters.

Yes, absolutely I think that you know we went though dthree hundred 65, what you're seeing in my opinion.

And solely my opinion is is the cloud suite of email like Google suite and over 365 or are definitely doing they're winning because the alternative is us doing E mail ourselves uneven as a CEO I founded far easier for us out source that capability.

Then in source said, you know and so thats a good thing so I think more and more companies are choosing third party email as as their email and then by the way once you do that as a third party you have to have security platforms as well. So we are seeing growth in our cloud.

E Mail ATP.

As we call up we we are not seeing growth in our on Prem appliance and I don't think too many people, we'll see in the future on Prem email gateways being successful so bottom line, yes, Microsoft is in my opinion.

Do an exceptional job winning enterprise email.

Period.

Got it now that's that's extremely helpful. Thank you for that and maybe on on billable hours billable rate.

Yeah, I would imagine that data relative reset or maybe have you been able to slightly up these rates expands rates a little bit.

We're not we're not increasing our rate in a lot of folks. It's kind of interesting people will think were that the rate itself can be proceed. This high when we're responding to breaches are doing other things, but the reality is as we have more experienced folks.

And the overall cost of a lot of what we do is actually less than folks at send a whole bunch of folks at a lower rate no eight eight people at 200 Bucks in hours of more than two people at $400 an hour and you had same results, but we don't really do that I mean in reality.

Different services have different rates, we over time have lowered the rate if anything although our average rate right now is high because it incident response, where we have shown a willingness to lower the rates for what I would cost strategic government work, where we just think is strategically important to be involved in different security operations.

Across the globe by the way with different Intel agencies are different.

Department of defense so.

So I think in the long run.

Because just the way we run that though our hourly rates always hovered at around the same plus or minus 2% the same thing.

I think it'll stay there, but the range of the rate.

Has grown a little bit.

Understood the time to one thank you so much.

Yes. Thank you.

One more when Mark short.

In Q and that question comes from Brian Essex with Goldman Sachs. Your line is now open.

And how our hi, guys Hey, good how are you. Thanks for squeezing me and I appreciate it.

Yes.

One quick question for you I'm, just wondering any incremental contribution progressively ibos partnership.

Just wondering how that's going on the platform and kind of what to expect there going forward.

Yeah, you know first off loved the technology vibe boss and I looked at the performance and obviously, we could probably do better there and trainer Salesforce and I think right now might be relatively specialized sale for us where our sales engineers that get it or just better at I think positioning it.

And I look at it as its legacy scalar thing right you get the fire protection, but you get to just kind of use the eyeballs agent. The route all your traffic.

We got room for improvement there, but on paper.

The partnership books, Great you know they send all the data and it can go through all our virtual appliances and Brian Yes from a timing perspective, we had trained the salesforce in Q1 on that so yes. It does take orders to build.

The pipeline, but if you look at where we sit today, we've got a lot a lot a nice deals in the pipeline for Q3 in Q4, So we're hopeful that.

We'll see some nice traction there.

Right. That's helpful. Maybe Frank just real quick follow up so thank you for that.

Cloud managed services.

Talked about you know training or Salesforce.

I understand you had some rationalization in the hardware side of the business.

How is hiring been there what does the salesforce looked like in terms of new hires and maturity and how can we expect that too.

Support growth going forward as we look at potentially stabilization on hardware side of business.

Yes, yes.

When we look at kind of hiring across the board I think given fireeyes position in the marketplace with the level of intelligence and expertise we have it's an area that we're very successful.

No I look at a lot of people that we bring a board and.

We have a lot of talented new individuals coming aboard that I think can really help take up to the next level I think that's been an area of strength for us for quite some time and I think we feel really good about.

Going to hire and our ability to kind of grow the growth areas in business.

And is there a certain percentage of the Salesforce, it's still kind of getting up to maturity or or is this kind of a steady state.

Hiring just to support growth as you go along kind of process.

No I think it's always evolving, but I think we feel really good about kind of a lot of the enablement that we've been working on for some of the newer areas of the business and I think varied and our Mandiant validation is a perfect example of if you've looked at the pipeline being built right. After the acquisition over the next time.

A couple of quarters than you looked at the pipeline being built after we went through a fall kind of enablement and training.

I think the sale force got it and I think they've built a pretty significant pipeline that I think will drive significant growth there.

So I think.

I think we've got the.

Got the right resources Board with we think there in the right level as far as enablement goes.

No.

We should be in a good spot there.

Okay. That's helpful. Thank you.

Thank you.

Thank you I'm not showing any further questions at this time and I'd like to turn the call back over to Kevin Mandia for closing remarks.

Yes, I did right a couple of closing remarks, right now I'll split them out at New Jersey auctioneer speed, because I know we've been on for over an hour, but in closing I just want to provide a quick update on the four priorities. We outlined for 2020. Our first priority was we intend to be the best wrote it incident response red teaming in threat intelligence when I reviewed the first half a 2025, we're performing more.

Our investigations at a faster pace this year than last year.

And then third party appraisals of our incident response in threat intelligence from the top right. So I feel we're doing our jobs there our second priority was to extend our dynamic threat detection and expertise to defend cloud based infrastructures. We addressed is priority with our acquisition of cloud visor in the launch of or cloud security assessment service and.

Consulting and our network security nine Dato release in the second quarter, which included our enhancements to support secure migration of workloads in the major cloud providers.

Third party what to deliver expertise on demand seamlessly through our technology, where experts are available at the point when our customers need them, most and again, we developed expertise on demand not to sell more services, but the differentiate our technology I know in my years of doing computer security at the Pentagon. It would have loved it had to button a quick on to get.

Help so we give that to our customers and we are seeing our customers take advantage of this button and our on demand capability with our expertise on demand revenue use up over 300% year over year still small number, but they're using it and thats. What we wanted and finally, we want to be the best enrolled at security validation, we intend to make the process of measuring.

Security effectiveness against the most current attacks as simple continuous and as common place as we can make it and the mandiant advantage portal that integrates a threat intelligence and validation, we'll close the security gap between the attackers emerging techniques in the safeguards that are just too slow to adapt or stop or detail.

Back these attacks.

So I'm very pleased that we're making progress and all our objectives I want to thank everybody for joining us today. Thank you for your interest in Fireeye and I look forward to speaking to all of you in 90 days until then we stay safe and healthy. Thank you very much.

Ladies and gentlemen, this concludes today's conference call. Thank you for participating you may now disconnect.

[music].