Q4 2021 Mandiant Inc Earnings Call
Speaker 1: 2022 and we expect to achieve non-GAAP operating margin profitability for the year of 2023.
We expect to achieve non-GAAP operating margin profitability for the year of 2023.
We achieved a significant milestone in Q4 divesting the fireeye products business.
Speaker 1: We achieved a significant milestone in Q4 divesting the thyroid products business.
Which I believe puts us in a stronger position to consistently deliver accelerating growth and improved operating leverage.
Speaker 1: which I believe puts us in a stronger position to consistently deliver accelerating growth and improved operating levels.
We look forward to discussing our strategy and long term model in more detail at our virtual analyst day on March 10.
Speaker 1: We look forward to discussing our strategy and long-term model in more detail at our Virtual Analyst Day on March 10th. I will now turn the call over to Dr. David A.
I will now turn the call over to the operator for questions.
Thank you <unk>.
Speaker 1: Thank you. If you'd like to ask a question, please press star followed by one on your telephone keypad. If for any reason you'd like to remove that question, please press star followed by two.
To ask a question. Please press star followed by one on your telephone keypad if for any reason you'd like to remove that question. Please press star followed by two.
As a reminder, if you are using a speakerphone. Please remember to pick up your handset before asking your question. We will now take our first question from Jonathan <unk> of Baird Jonathan.
Speaker 1: As a reminder, if you're using a speakerphone, please remember to pick up your handset before asking your question. We will now take our first question from Jonathan Lillicaver of Baird. Jonathan, your line is connected. Please proceed.
Jonathan Your line is connected please proceed.
Jonathan.
Speaker 2: Jonathan, how are you? Hello guys, and good Kevin.
Yes.
Good Kevin.
So I'm wondering if you could touch just the expectation that you talked about for fiscal 'twenty. Two when you look at it implies a net new <unk>.
Speaker 2: So I'm wondering if you could touch on just the AR expectations that you've talked about for fiscal 22. When you look at it, it implies net new AR that's basically more than what you added over the last couple of years. So just talk about your confidence in that target, maybe what you see in the pocket and sales capacity that gives you that confidence.
And Thats basically more than once you added over the last couple of years. So just talk about your confidence in that target maybe what you see in the pipe sales capacity that gives you that confidence.
Yeah. So a couple of thoughts there first and foremost comp plan absolutely matters. When you look at our billings in Q4, I remember going Wow, that's the eye popping billings, that's fantastic and then when you Peel that back it came to 23% <unk> growth and that is because our comp plan was based on billings and you see that in the extended contract length.
Speaker 1: Yeah, so a couple thoughts there. First and foremost, comp plan absolutely matters. When you look at our billings in Q4, I remember going, wow, that's eye-popping billing. That's fantastic. And then when you peeled it back, it came to 23% ARR growth. And that is because our comp plan was based on billings. And you see that in the extended contract length. So one of the things we are doing is everything that Nandiant does that scales, you can buy through subscription.
So one of the things we are doing is everything that <unk> does that scales. You can buy through subscription is make sure that our comp plan marries to driving our growth. So that's the first change we made that will make a difference period in a positive way it may shorten the contract length Thompson.
Speaker 1: is make sure that our comp plan marries to driving ARR growth. So that's the first change we made that will make a difference, period, in a positive way. It may shorten the contract length, Jonathan, but it will increase ARR a few points. So we just get a lift right there. And the second thing is we're launching several new offerings, like Active Breach Intelligence, and then a very simple, lightweight, and affordable ransomware defense validation that I like.
But it will increase a few points. So we didn't get a lift right there.
The second thing is we're launching several new offerings like active breach intelligence and then a very simple light weight and affordable ransomware defense validation that I like.
Speaker 1: I believe the partnerships matter. When you look at, that's a hot market to say, hey listen, Mandy and Scott, you're back. You get a security telemetry from supported products.
I believe the partnerships matter when you look at that as a hot market to say, Hey, listen May Indian Scott. Your back you gave us security telemetry from supported products and we've got you covered.
Speaker 1: and we've got you covered. You know, I call it the shields up. Others call it, probably more professionally, extended detection and response market. I believe in that market. I believe that's a way our Mandiant people can be a seamless extension, even though it can be 90% tech behind it. It allows people to use our...
Call it the shields up others caught probably more professionally extended detection and response market I believe in that market I believe that's the way we are managing people can be a seamless expansion, even though it can be 90% tech behind it it allows people to use our app.
Speaker 1: experts as a virtual extension of their team. So as we expand to partnerships like Sentinel One, like Microsoft, those partnerships matter. We want to go in and say you get the Mandiant brain, the Mandiant analyst to defend you regardless of the technology you're using and I'd buy that.
Experts as a virtual extension of their team so as we expand to partnerships like Sentinel won like Microsoft those partnerships matter, we want to go in and say you get the mandaean, bringing the Mandy and analysts to defend you regardless of the technology are using and I'd buy that so.
Speaker 1: That to me is what we're betting on, and I can tell you it resonates when I talk to folks. So what we've got to do is continue the innovation to support it. And I think, you know, we got Microsoft done, we're getting Sentinel One done, and we're gonna have others, you know, and that's why we're excited about that strategy.
That to me is what we're betting on and I can tell you resonates when I talk to folks. So what we've got to do is continue to innovation to support it and I think we've got Microsoft Don.
We're getting Sentinel, one done and we're going to have others.
Why we're excited about that strategy.
Speaker 2: That's helpful, Kevin. Some of your thoughts regarding the channel opportunity beyond just fulfillment. I'd be curious on the role you might see for SI.
That's helpful. Kevin.
Thoughts regarding channel opportunity beyond just fulfillment carrier on the road you might see for Si.
Systems integrators in the public cloud for lenders.
Hey, Jonathan This is Frank I think what were.
Speaker 3: One of the things that we really pivoted to with some of the newer offering is really making it fit the channel much better than some of our previous offerings that were more focused on the security professionals. I think we're trying to build products that fit the channel, things that can go down market, that are easier to demo, easier to deploy. I think some of the new offerings that Kevin mentioned will fit the channel a lot better.
One of the things that we really pivoted to with some of the newer offering is really making it fit the channel much better than some of our previous offerings that we're more focused on the security professionals I think.
We're trying to build products that fit the channel that can go down market that are easier to demo easier to deploy.
Some of the new offerings that Kevin mentioned, I think will fit the channel a lot better and if you look at where we're at from a channel leverage perspective, we only have a significant opportunity ahead of us.
Speaker 3: And if you look at where we're at from a channel leverage perspective, we only have a significant opportunity ahead of us. That's not an area that we've done great in the past on, but I think we feel pretty good about some of the new offerings and some of the new focus areas there and some of the investments we're making in the channel. OK.
That's not our area that we've done great in the past on but I think we feel pretty good about some of the new offerings and some of the new focus areas there and some of the investments we're making in the channel.
Okay very helpful.
Yes.
Speaker 1: And Jonathan, even I'm going back to revisit your question too. You know, I thought about it as well. And you know, one of the managed defense customers was they were choosing a different endpoint technology, literally by going to Microsoft or SentinelOne and other endpoint techs that we're going to be working with.
Jonathan even not going back to revisit a question to you guys thought about it as well.
One of the managed defense customers was they were choosing a different endpoint technology literally by going to Microsoft or central one another endpoint tax that we're going to be working with we save those.
Speaker 1: we say those you know and people are making decisions based on tech alone so we it will you know will be able to grow it faster and at the same time frame will be able to protect our base far better by working with other endpoint technologies and quite frankly other security technology side is that point
And people are making decisions based on tech alone. So.
It will.
We will be able to grow it faster and at the same timeframe, we will be able to protect our base far better.
By working with other endpoint technologies and quite frankly, other security technology side just endpoint.
Thank you.
Youre welcome. Thank you Jonathan.
Our next question is from the line of Hamzah Auto Waller of Morgan Stanley .
Speaker 1: Our next question is from the line of Hamza Fadawalla of Morgan Stanley . Hamza, your line is open, please proceed.
Hamzah. Your line is open. Please proceed.
Speaker 4: Hey guys, thanks for taking my question. So I thought for my first question, just real quickly, wanted to address the elephant in the room. There are obviously reports around a potential acquisition by Microsoft, any comment on that whatsoever.
Hey, guys. Thanks for taking my question.
So I think from my brief question just real quickly.
Wanted to address the elephant in the room.
Obviously, some reports around it.
Potential acquisition by Microsoft and you comment on that whatsoever.
Speaker 1: Yeah, Hamza, as a matter of policy, we're not going to comment on rumors or speculation.
Yeah, Hamzah as a matter of policy, we are not going to comment on rumors or speculation.
Okay fair enough to kind of figure out there.
Speaker 4: Okay, fair enough. Yeah, thought I'd take a shot there. Just for a second question for Frank.
The second question.
Frank.
Speaker 4: You know, when you think about the puts and takes around the acceleration of 30% ARR growth.
When you think about the puts and takes around the acceleration of 30% <unk> growth.
Speaker 4: How should we think about the underlying drivers behind that? So between things like net expansion rate, which I think is a little bit above 100% now, or customer count growth, or larger deal sizes up front, like how should we think about the past 30% ARR growth exiting this year? Yeah, I think Council, we still really...
How should we think about sort of the underlying drivers behind that so between things like net expansion rate, which I think is a little bit above, 100% now or a customer count growth or larger.
Deal sizes upfront, but how should we think about the path.
To 30% R&R growth exiting this year.
Yes, I think we feel really good about that if you look at there are to grow between 23% and 26% and if you look at the new offerings that we're launching in some of these partnerships, yes, they only benefit each quarter. Thereafter. So if you think about like the center and one partnership the real traction and new deals that will come for that well.
Speaker 3: there are to grow between 23 and 26%. And if you look at the new offerings that we're launching and some of these partnerships, they only benefit each quarter thereafter. So if you think about like the Sentinel One partnership, the real traction and new deals that will come for that will likely be in the second half of the year. And so we get an acceleration there. The tax surface management acquisition we did in August , had a great Q4 and we're really excited about kind of launching that in the year. And then if you think about kind of the stage and maturity of validation and automated defense, all those subscriptions.
Likely be in the second half of the year and so we get an acceleration there.
<unk> surface management acquisition, we did in August had a great Q4, and we're really excited about kind of launching that.
In the year and then if you think about kind of the stage of maturity of validation and automated defense all those subscriptions.
Speaker 3: can operate, kind of move forward in 2022, which should provide a pretty big boost. If you feel that we're going to have better retention on the managed defense side as we continue to add new endpoint players.
And operator kind of move forward in 2022, which should provide a pretty big boost do you feel that we're going to have better retention tension on the managed defense side as we continue to add new endpoint players.
Speaker 4: Just to clarify, it sounds like customer count growth, module upsell, that's sort of in that order is how we should think about the path to 30% error on growth.
But just to clarify so it sounds like customer count growth.
Our module up sell.
That sort of in that order, how we should think about.
The path to 30% <unk> growth.
Speaker 3: Yeah, and I think if you look at where we sit today, less than 20% of our customers have more than one module. So we have a huge cross-sell opportunity just going from one module to two modules to three modules.
Yeah, and I think if you will.
Look at where we sit today less than 20% of our customers have more than one module. So we have a huge cross sell opportunity just going from one module to two modules to three modules.
Speaker 1: Yeah, you know, and Hops, you got me realizing, you know, when I wrote my first turning script is all about all the reasons why Arrow is going to go to 30% and then I went some other direction. Here's the reality. We have more to sell.
Yes.
So you got me realizing when I wrote my first earnings script is all about all the reasons why I was going to go to 30% and then I went to some other direction here's the reality, we have more to sell and we are focused on selling at their compensation alignment of sulfur IRR. We have partnership alignment now because we're not an endpoint network cloud Sam and E mails.
Speaker 1: We have focused on selling it. We have compensation alignment to sell for ARR. We have partnership alignment now because we're not an endpoint network, cloud, sim, and email security anymore, like FireEye, when we were all one company. So we get real partner leverage.
Charity anymore like Fireeye when we're all one company. So we can get real partner leverage and we can go out and get that with that you get better retention and then we.
Speaker 1: and we can go ahead and get that. With that, you get better retention. And then we've already done the unglamorous integration of every module. So you can now have the platform and all the modules, and it's one experience. And that's something that doesn't sound like a big deal, but absolutely is, because as we deploy now.
We've already done the unglamorous integration of every module. So you can now have the platform and all the modules and it's one experience and that's something that doesn't sound like a big deal. It absolutely, yes, because as we deploy now we're working forward instead of just deploying a module we deploy.
Speaker 1: we're working for instead of just deploying a module, we deploy full platform.
<unk> platform with one module activated and it makes it very easy for us to scale. So it's a small thing, but it has a tremendous influence on the buying patterns.
Speaker 1: with one module activated, it makes it very easy for us to scale. So it's a small thing, but it has a tremendous influence on the buying patterns.
Speaker 1: just having it all integrated into a single experience.
Just having it all integrated into a single experience.
Thank you.
Okay.
Okay. Thank you hamzah.
Our next question is from Brian Essex of Goldman Sachs. Brian . Your line is connected please proceed.
Speaker 1: Our next question is from Brian Essex of Goldman Sachs. Brian , your line is connected, please proceed.
Speaker 1: Great, thank you and thank you for taking the question. Kevin, maybe if we could start by just touching on, now that you've spent some time operating with the ability to sell with the controls agnostic platform. I guess that...
Great. Thank you and thank you for taking the question.
Kevin maybe yes.
Yes, we could start by just touching on now that you've spent some time operating with the ability to sell.
All of the controls agnostic platform.
Notwithstanding but outside of endpoint, where have you seen the most success selling and other platforms.
Speaker 1: not outstanding but outside of Endpoint, where have you seen the most success selling in other platforms?
Or should we expect to see similar partnerships with broader network security vendors like maybe a Palo alto.
Speaker 1: Or should we expect to see similar partnerships with broader like network security vendors like maybe Apollo Alto?
Yes, with better integration nearly how should we think about that strategy going forward.
Speaker 1: with better integration there. How should we think about that strategy going forward?
Speaker 1: Yeah, so Brian , I'm going to do everything I can to not nerd out and then Frank's going to fix this. Never security integration is the reason.
Yes, so Brian so I'm going to do everything I can to not nerd out and then Frank is going to fix this network security integrations are eased.
Speaker 1: It's that simple. And the true differentiation force usually is endpoint interrogation. That's where Mandiant doesn't just say, hey, you may have a problem. We like to have that premium experience of, oh, you have a problem and we can fix it for you. That usually requires endpoint technology to verify.
That simple and the true differentiation for US usually is endpoint interrogation, that's where mandaean doesn't just say hey, you may have a problem. We like to have that premium experience of Oh, you have a problem and we can fix it for you that usually requires endpoint technology to verify so with the <unk>.
Speaker 1: So with the network stuff, it's just all the formats are similar. You know, the climate you get from pan versus format versus other technologies. From the most part, we can already absorb those and work with those.
Network stuff. It's just all the formats are similar the telemetry data from Pan versus Fortinet versus other technologies for the most part we can already absorbed those and work with those so technically we can already work with the network based security organizations, where we like to go deep and apply our expertise just happens to be.
Speaker 1: So technically, we can already work with the network-based security organizations. Where we like to go deep and apply our expertise just happens to be more differentiated on the endpoint. And finding the new and novel, usually what you'll get is on the network security platforms, you see the...
More differentiated on the endpoint and finding the new and novel, usually what Youll get is on the network security platforms, you see the smoke that to see what's actually causing this fire you got to go to the endpoint and figure it out so that's a long winded way of saying this with a network security stuff, we can already leverage it for the most part and we just got it.
Speaker 1: to see what's actually causing this fire, you got to go to the endpoint and figure it out. So that's a long-winded way of saying this. With the network security stuff, we can already leverage it for the most part. And we just got to, you know, we have new leadership in charge. Marshall Holman, our CTO, is leading those technical partnerships.
We have new leadership in charge Marshall Harmon, our CTO is leading those technical partnerships and he used to lead our managed defense. So he's going to go out there and we're going to get in my opinion, we're going to pursue partnerships with the security vendors that our customers are relying on to defend themselves and then what we provide with demanding an advantage is.
Speaker 1: and he used to lead our managed defense. So he's going to go out there and we're going to get, in my opinion, we're going to pursue partnerships with the security vendors that our customers are relying on to defend themselves. And then what we provide with the Mandiant Advantage is that Mandiant analyst automated. All our Intel, all our expertise, and quite frankly, a big button saying, hey, what do you think about this? We want to become part of the workflow for the security operations that are using all these different technologies. So network security will.
That mandate and analysts to automate all our Intel all our expertise and quite frankly, a big button, saying, Hey, what do you think about this we want to become part of the workflow for the security operations that are using all these different technologies, So network security will happen endpoint.
Speaker 1: Endpoint security will definitely happen. And even over time, I could see us figuring out, hey, how do we work with some of the email security folks as well to make sure we can test and kind of code that. And then by the way, obviously, cloud, got to have cloud visibility, know your assets in the cloud, be able to defend at the big infrastructure providers.
Endpoint security will definitely happen and.
Even though over time I could see us figuring out hey, how do we work with some of the E Mail security.
Folks as well to make sure we can test and kind of quote data and then by the way obviously cloud got to have cloud visibility major assets in the cloud and be able to defend.
At the big infrastructure providers.
Sure.
Speaker 1: Got it. That's helpful. And maybe kind of we can dovetail into your Sentinel-1 partnership. How practically should we think about your ability to leverage mandate advantage? How it's integrated with singularity? And is there any overlap there with what you may have had left over versus what they come to the table with in singularity that kind of makes it maybe more complementary in certain situations?
Got it that's helpful and maybe kind of we can dovetail into youre sitting on one partnership.
<unk> should we think about your ability to leverage mandaean advantage, how it integrate integrated with singularity and is there any overlap there with what you may have had leftover versus what they come to the table with singularity.
That kind of makes it maybe more complementary in certain situations. So.
Speaker 1: So the biggest thing we want to do with this is really enable our consultants to respond to breaches. That means be able to deep dive and interrogate a box when whatever security programs folks had just didn't work or process failed or the attackers were that good. So first and foremost, we like to end point security companies like Sentinel One where we can do incident response with it.
So the biggest thing we want to do with US is really enable our consultants to respond to breaches whether that means to be able to deep dive in and target a box when whatever security programs folks had just didn't work or process failed or the attackers were that good. So first and foremost we like endpoint security companies like Sentinel won where we can do.
Response with it.
Speaker 1: They'll like that because we'll get the phone call, we'll go respond, and maybe we use their tech to do it, and they get, wow, that's a nice introduction into a new customer. And we also want to be able to do compromise assessments. And there's going to be other security providers that we're going to look to partner with to do the same thing.
They'll like that because we will get the phone call. We'll go respond and maybe we use of their tech to do it and they get Wow, that's a nice introduction into a new customer and we also want to be able to do compromise assessments and theres going to be other security providers that we're going to look to partner with to do the same things. So from the incident response and consulting standpoint, we do.
Speaker 1: So from the incident response and consulting standpoint, we do want to work with the endpoint providers that allow us to successfully carry out our mission of being the best in the world at responding to breaches. Regards to managed defense and the mandate at the end of the
Want to work with the endpoint providers that allow us to successfully carry out our mission of being the best in world at responding to breaches in regards to manage defense and demanding advantage, we want to be able to take time mature in the first thing you do with any technology is can we get great detection capability with that technology.
Speaker 1: We want to be able to take time to read and the first thing you do with any technology is to get great detection capability with that technology. Hey, you've got a problem. The second step is a deeper integration to verify, hey, it's not just detection, but we have a confirmed problem. And that's where we want to go with the endpoint text.
Not a problem. The second step is a deeper integration to verify hey, it's not just detection, but we have confirmed problem and thats, where we want to go with the endpoint tax so it's a little bit more than just getting an alert from Sentinel long ago. Okay. So no. One thinks this is bad it's pellet customer that central one thinks this is bad it's going on when we get an order from San Juan and care.
Speaker 1: So it's a little bit more than just getting an alert from Sentinel One going, okay, Sentinel One thinks this is bad. Let's tell a customer that Sentinel One thinks this is bad. It's going to, when we get an alert from Sentinel One, interrogate Box and say, oh, it is bad. It worked. We got a problem. We've got a threat on the network. And I'll leave you with this thought, Brian .
Gabe box and say Oh it is Pat It worked we got a problem. We've got a threat on the network and I'll leave you with this thought Brian here.
Speaker 1: Historically, people have always said, thank God my endpoint triggered on this piece of malware. It saved the day.
Historically people have always said thank God my endpoint triggered on this piece of malware it saved the day.
Speaker 1: what it didn't do is trigger on three other things that the bag i happen to be doing and so it's it gave people false sense of all we're good to go when in reality they miss other things the attack was doing so long-winded way saying we're going to go deep on the end point we want to be able to inspect and confirm and from the end point we may not get there overnight uh... but uh... the reality is that's our intention
What it didn't do as trigger on three other things that the bag I happen to be doing and so.
Give people false sense of all we're good to go when in reality. They missed other things. The attacker was doing so long winded way of saying, we're going to go deep on the end points, we want to be able to inspect and confirm incidents on the endpoint, we may not get there overnight.
But the reality is that's our intention.
Speaker 1: Got any any of these scene a lot of traction with defender that is with you know just referencing another partnership Yeah
Got it have you seen a lot of traction with defender.
Just referencing another partnership.
Yeah.
You said a lot here's what I have seen when we first off in regards to defense. When we go in we had customers, saying, hey, we're going over to defender and we didn't have to say well, okay surrender. The account we support that too.
Speaker 1: You said a lot. Here's what I have seen. When we first off in regards to defense, when we go in, we've had customers say, hey, we're going over to Defender. And we didn't have to say, well, OK, surrender the account. We support that too. And every endpoint's a little bit different. There was a time when we used a FireEye endpoint for everything. So we'll get different things from different endpoints, but we absolutely are defending Microsoft for Defender, the Defender endpoint customers.
And every endpoints a little bit different there was a time when we use the fireeye endpoint for everything, but so we will get different things from different endpoints, but we absolutely are defending Microsoft defender defend our endpoint customers.
Got it very helpful. Thank you.
Speaker 5: Yeah.
Yes.
Thank you Brian .
Speaker 1: Our next question is from Rob Owens with Piper Sandler. Rob, your line is connected, please proceed.
Our next question is from Rob Owens with Piper Sandler Rob. Your line is connected please proceed.
Thank you and thanks for taking my question I, just want to focus on obviously, a busy fourth quarter.
Speaker 6: Thank you. Thanks for taking my question. Sort of focus on, I don't know, obviously a busy fourth quarter.
Speaker 6: with the divestiture. Anything else logistically that you guys need to get done or do you have all the pieces in place? You've got the new compensation as well to move forward from here. Just thinking of the risk profile around execution.
With the divestiture.
Thing else logistically that you guys need to get done or do you have all the pieces in place you've got the new compensation as well to move forward from here just thinking of the risk profile around execution.
Yeah, Rob I think our biggest risk I think with Q4, when we were kind of finishing out the year as two separate sales forces, but still trying to sell both sides of the fence.
Speaker 3: Yeah Rob, I think, you know, our biggest risk I think was Q4 when we were kind of finishing out the year as two separate sales forces but still trying to sell both sides of the fence. You know, as we enter 2022, we feel really good because we've got one comp plan aligned with kind of the corporate goals of really maximizing and increasing A or R. So, you know, I think the the best of your
As we enter 2022, we feel really good because we've got one comp plan aligned with kind of the corporate goals of <unk>.
Really maximizing and increasing <unk>. So yes, I think the divestiture kind of the risk of any disruptions behind us. We obviously have ongoing TSA is going well.
Speaker 3: kind of the risk of any disruption behind us. You know, we obviously have an ongoing TSA that is going well that will carry through the good part of 2022. But yeah, I don't see any real challenges that we're facing. I think we've got the right team to go tackle what we're trying to do. And I think we've got a lot more laser focus on really driving the things that are gonna take this company to the next level.
Carried through the good part of 2022, but.
Yes, I don't I don't see any real challenges that we're facing I think we've got.
The right team to go tackle what we're trying to do and I think we've got a lot more laser focus on really driving the things that are going to take this company to the next level.
And then on the services side with the guidance for 2022 any governors on growth or will you be intensely there thats kind of holding that back because it would appear that you've probably got as much business as you can.
Speaker 6: And then on the services side with the guidance for 2022, any governors on growth or anything intentionally there that's kind of holding that back? Because it would appear that, you know, you've probably got as much business as you can address from an incident response perspective.
Yes.
That response for tablets.
Yes, Rob.
Speaker 1: I always wonder if I should answer it this way, but I'm going to anyway. We're not growing services as fast as we can. We're not a services company. We don't wake up every day and go, let's maximize services growth.
I was wondering if I should answer it this way, but I'm going to anyway, we're not growing services as fast as we can we're not a services company. We don't wake up every day and go let's maximize services growth, we wake up every day, making sure we have the right people to do the right things and I think our own between 20 and 22% like we have for years is actually really performance.
Speaker 1: We wake up every day making sure we have the right people to do the right things. And I think growing between 2022 percent like we have for years is actually really performant. But you're right. I mean I guess we could look to inorganic grow or higher faster. We have it. We like the component we have because it's doing very strategic work.
But youre right I mean, I guess, we could look to inorganically grow or higher faster we have it we like the component we have because it's doing very strategic work.
Speaker 1: Does that mean we say no to the imbalance? Yes, it does. Does it mean could we grow it at higher? Yes, we could. It is not.
Does that mean, when you say noted inbounds, yes. It does does it mean can we grow it.
Higher yes, we could it is not.
Speaker 1: For us, services is strategically important abilities.
For us services are strategically important abilities.
And we just.
Speaker 1: We're happy with how it's performing. That's the best way to answer it.
We're happy with how it's performing that's the best way to answer it to.
Speaker 3: Rob, I think one of the things we're really excited about is the fact that we have been building up a services deferred revenue and ending Q4 at $139 million. It does give us a lot better visibility and gives us a little bit more opportunity to hire a little bit ahead of the curve because we have a pretty good view into
Rob I think one of the things. We're really excited about is the fact that we have been building up of services deferred revenue in ending Q4 at $139 million. It does give us a lot better visibility and it gives us a little bit.
More opportunity to hire a little bit ahead of the curve because we have a pretty good view into upcoming engagements. So similar to 2021.
Speaker 3: upcoming engagements. So, you know, similar to 2021, you know, we typically overachieve a little bit on services just because we target kind of the grow at the high teams, but we tend to grow a little bit over 20%.
We typically over achieve a little bit on services, just because we target kind of grow at the high teens, but we tend to grow a little bit over 20%.
Speaker 3: So, you know, as we look at 20.2, I think we feel really good about the demand environment and I think we feel really good about our ability to hire and a very, ability to retain. Is that over-exempt? Is that pricing or is that utilization? Uh-huh. Or you're actually getting more discount towards the end of the...
So as we look at 2022, I think we feel really good about the demand environment and I think we feel really good about our ability to hire and the ability to retain that overage then is that pricing or is that utilization.
Quarter, Youre actually anymore, I would count towards the end of <unk>.
For the year.
Speaker 1: It is bursty chargeability when you do IR. Sometimes you're in the emergency room doctors. What you see is a spike in what I call chargeability. The hours that people work, they're working them. So that's traditionally it. I think our rates are very competitive, meaning for an elite services core, we charge the right amount. But, and Rob, I'm old school when it comes to like the fastest way to have. All right guys, thank you very much. Thank you, Rob.
It is bursty charge ability when you do IRR, sometimes are emergency room doctor. So what Youll see is a spike in chart, what I call charge ability the hours that people work, they're working on so that's traditionally and I think our rates are very competitive meaning.
And then beach services core we charged the right amount.
But rob.
Rob on the old score when it comes to like the fastest way to have alright, guys. Thank you very much.
Thank you Rob.
Our next question is from John .
And your line is connected please proceed.
Hi, good evening.
Speaker 2: Hi, good evening. I just wanted to maybe start out.
I just wanted to maybe start out.
Speaker 1: And maybe what you're seeing out there in terms of either pipeline build or just opportunities that, as we said, to think about this vulnerability. Yeah, Jonathan, you know, first and foremost, I remember when it happened, I think it was like December 8th or 9th, it was a Friday. And so, the first day of webinars. We then put together our 1999 plans.
And maybe what Youre seeing out there in terms of either pipeline build or just opportunity.
I have to think about this on our body.
Yes, Jonathan.
Jonathan first and foremost I remember when it happened I think there's like December 8th or ninth was a Friday and the whole security community, both private and public sector jumped on this thing in a fashion that probably preempted a lot of problems.
Speaker 1: The whole security community, both private and public sector, jumped on this thing in a fashion that probably preempted a lot of problems.
Speaker 1: But at the same time frame, what it brought to the forefront is an immediate need to figure out where are your assets.
But at the same timeframe, what it brought to the forefront.
As an immediate need to figure out where are your assets.
Speaker 1: and where are the applications that your applications actually depend on? And so many of us have third-party providers that may have actually used Log4j that have created complications at scale that we just weren't used to solving. So I can tell you this, from our business standpoint, yes, in the first three days of Log4j, we've been able to solve the problem.
Where are the applications that your applications actually depend on and so many of US have third party providers that may have actually used log for Jay that are traded complications at scale that we just weren't used to solving so I can tell you that from our business standpoint, yes in the first few days of lock for Jay.
Speaker 1: You know the exact number I think we could track was over 70 inbounds. Hey we need some help here and we couldn't respond to all those. When you look back on log for J a month and a half later I think my hat's off to the security community both the private sector and the public sector.
Exact number I think we could track over 70, inbound hey, we need some help here and we couldnt respond all those when you look back on Mark for J, a month and a half later I think my hats off to the security community, both the private sector and the public sector.
Speaker 1: because we preempted an avalanche of significant compromise.
Because we preempted and avalanche of significant compromise.
Speaker 1: And we got everybody thinking, where are assets that matter? What are their dependencies? What's in our supply chain? So I think right now that's what the problems it brought to bear were. And so that would be a tax service management, asset management, asset management, asset management.
And we got everybody thinking where are assets that matter what other dependencies, what's in our supply chain. So I think right now thats, what the problems it brought to bear where and so that would be attack surface management asset management.
Speaker 1: third-party provider management or vendor supplied management, those sort of things, came to the forefront. And every once in a while, we'll probably see a long tail of an incident or two from this. Log4j was a big vulnerability. It seems like in our industry, every few months, one of these pops up. So you always get what I would call a...
Third party provider management, our vendor supply management, those sort of things became to the forefront and everyone's Rob we'll probably see a long tail of an incident or two from this.
<unk> was a big vulnerability it seems like in our industry every few months one of these pops up so you always get what I would call a.
And indirect lift to the business you just all of a sudden executives, it's like free marketing for cyber security at large he cyber security matters and so obviously there is more attention on it based on log project. So that's kind of how it impacted the industry from my lens you can talk to other vendors get different answers but are.
Speaker 1: an indirect list to the business. You know, you just all of a sudden executives, it's like.
Speaker 1: free marketing for cybersecurity at large. Hey, cybersecurity matters. And so obviously there's more attention on it based on Log4j. So that's kind of how it impacted the industry from my lens. You can talk to other vendors, get different answers, but our customers, most of them, almost all of them went through without a significant incident. And they probably are a heck of a lot faster right now in determining third parties and software dependence.
Customers most almost all of them went through without a significant incident and they probably are heck of lot faster right now in determining third party and.
Software dependencies.
Speaker 1: Got it. And just one for Frank. Can you maybe help us understand or just remind us if you've given us this before what the margin structure will look like after we sort of get past these post transition costs as well as stranded costs and maybe the time frame that you're thinking about to get through either the TCA or the stranded costs. Thank you.
Got it and just one for Frank can you maybe help us understand or just remind us if you've given us this before what the margin structure will look like after we sort of get past. These post transition costs as well as stranded costs and maybe the timeframe that youre thinking about to get through either the TCA or midstream.
Thank you.
Yes, Jonathan So we expect right now we're estimating in our guidance that we would.
Speaker 3: Yeah, Jonathan, so we expect right now we're estimating in our guidance that we would provide most of the TSA services through the end of Q3 of 22. And so we will have some stranded costs because it will take a little bit of time to take some of those costs out even after the TSA ends. But that's why if you look at what we gave for guidance for 2022, you do see some leverage beginning.
<unk> most of the TSA services through the end of Q3 of 'twenty two.
So we will have some stranded cost because it will take a little bit of time to take some of those cost out even after the TSA and but Thats why if you look at what we gave for guidance for 2022, you do see some leverage beginning.
Speaker 3: think is given the one-time costs that are hitting 2022 and the headwind from the validation Daniellespen, managing to world champion can rev rack change.
It gives you have given the one time.
On costs that are hitting 2022, and the headwind from the validation Rev Rec change.
Operating.
Margin.
Speaker 3: move and when we get to analyst day we'll kind of give you that walk.
Move and when we get to analyst day, we'll kind of give you that walk.
Speaker 3: from our 2022 guidance to our long-term model.
From our 2022 guidance to our long term model.
Thank you.
Thank you Jonathan Thank you Jonathan.
Speaker 1: Our next question is from Doug Bruhl of JP Morgan. Doug, your line is connected. Please proceed.
Our next question is from Doug <unk> of Jpmorgan.
Doug Your line is connected please proceed.
Yeah.
Speaker 6: Hey, this is Doug on for Sterling Audi. Um, thank you for taking my question and congratulations on the quarter.
Hey, this is Doug on for Sterling Auty.
For taking my question and congratulations on the quarter.
Speaker 6: Thank you. So I guess the biggest question of the government
Thank you so.
I guess the biggest question really.
The government vertical this quarter.
Huh.
Yeah, now I'm sitting here.
Speaker 1: Yeah, you know, now I'm sitting there going through every interaction I had with the government. You know, I'm gonna have to go back to my traditional answer, Doug. I mean, quite frankly, man, it's always had a great relationship with a lot of different governments. We are a security company, and we recognize the responsibilities that that brings and governments were formed to provide security to their citizens. So I mean, we've always had a strong relationship there. And we always want to be interacting with the folks that have the same mission that we have.
Going through every interaction they have with the government.
Im going to have to go back to my traditional answer Doug I mean, quite frankly managed has always had a great relationship with a lot of different governments.
Our security company and we recognize the responsibilities of that brings in government's reform to provide security to their citizens. So I mean, we've always had a strong relationship there and we always want to be interacting with the folks that have the same mission that we have.
Speaker 3: We give it much more color than generic. Doug, in my prepared remarks, I did talk about a couple $15 million deals, and one of which was with the government. So I think we started their new fiscal year off really strong and got a really strong pipeline with the government. I think, as Kevin mentioned, we'll continue to strengthen those ties.
So it gives you much more color than generic Doug in my prepared remarks, I did talk about a couple of $50 million deals and one of which was with the government. So I think we started their new fiscal year off really strong and got really strong pipeline with the government and I think as Kevin mentioned.
We will continue to kind of strengthen those ties.
Speaker 3: to actually embed new products into the government. We've always obviously been really strong on the services and intel side, but I think we've got some pretty big opportunities on the information side as well.
Can you too.
Actually embed new products into the government. We've always obviously had been really strong on the services and Intel side, but I think we've got some pretty big opportunities on that.
Mission side as well.
Great. Thank you appreciate your time.
Thanks.
Thank you Doug Thank you Doug.
Our next question is from socket Korea of Barclays.
Speaker 1: Our next question is from Saket Kalia of Barclays. Saket, your line is connected. Please proceed.
Your line is connected please proceed.
Okay great.
Speaker 3: Okay, great. Hey, Kevin. Hey, Frank. Thanks for taking... Hey, good, sir. How are you? Thanks for taking my questions here.
Thanks for taking hi, good Sir how are you. Thanks for taking my questions here.
Frank maybe you can maybe just to start with you.
Speaker 3: Frank, maybe just to start with you, I was wondering if you could just talk a little bit about net new ARR in the quarter. Very clear, the comp plans on billings versus ARR feels like the driver, but I'm wondering how net new ARR kind of compared against your expectations for Q4. You know, with it being down versus Q3, I wasn't sure if there was anything with just a seasonality perspective that we should keep in mind.
I was wondering if you just talk a little bit about net new <unk> in the quarter very clear that the comp plans on billings versus <unk> feels like the driver, but I'm wondering how net new IRR kind of compare it against your expectations for Q4 was it being down versus Q3 I wasn't sure. If there was anything with just a seasonality perspective.
With that we should that we should keep in mind.
Speaker 3: I don't think it's anything to do with seasonality. I think it really is to do with the last quarter of a comp plan for both the Mandiant sales reps and the FireEye sales reps that are no longer going to be selling Mandiant solutions. So I think what you saw was a maximization of the total contract value and not a maximization of ARR. So clearly, we believe that had we been on the ARR comp plan in Q4, that ARR growth rate number would have been much higher. It's hard to tell exactly what it would have been, but probably pretty similar to Q3's growth rate.
I don't think it has anything to do with seasonality I think it really has to do with the last quarter of our comp plan for both the mandate sales reps and the Fireeye sales reps that are no longer going to be selling <unk> solutions. So I think what you saw was the maximization of the total contract value and not a maximization of IRR. So clearly.
We believe that had we been on the IRR comp plan in Q4.
Our growth rate number would've been much higher.
It's hard to tell exactly what it would have been but probably pretty similar to Q3's growth rate.
Speaker 3: of 26%.
Of 26% and as we look into Q1, we're right kind of in that zone of 23% to 26% going forward.
Speaker 3: And as we look into Q1, we're right in that zone of 23 to 26 percent going forward.
Speaker 3: A lot of the new offerings we're talking about, I think, will continue to gain traction throughout the year. So we feel really good about the ending of the year at 30 percent. And Q4 is a great building quarter, yet didn't translate as well as we would have liked to in ARR. We know we've changed things for quite a while, and the way we've amendmentally changed it
Lot of the new offerings, we're talking about I think we will continue to gain traction throughout the year. So we feel really good about the ending the year at 30%.
Q4 is a great billings quarter, yet didn't translate as well as we would've liked to in <unk>.
Okay got it that makes sense.
Speaker 3: Kevin, maybe for you, it sounds like the better alignment with endpoint vendors here is very helpful, right? To your point, Microsoft's central one, maybe there's some more down the road.
Kevin maybe for you.
It sounds like the better alignment with endpoint vendors here is very helpful. Right to your point, Microsoft Central one maybe there is some more down the road.
Speaker 6: But I was wondering how you sort of think about the competitive dynamic with some of the managed offerings that some of those endpoint vendors offer themselves, as well as their own sort of XDR integrations. And maybe this touches on an earlier question, but is this complementary or is it competitive?
I was wondering if how you sort of think about the competitive dynamic with some of them managed offerings that some of those endpoint vendors offer themselves as well as well as our own sort of xdr integrations and maybe this is maybe this touches on the earlier question, but.
Is this complementary or is it or is it competitive.
Speaker 1: There may be times when there's overlap and that there's some competition there and there may be some vendors we work with on endpoint where there's far less competition. So here's what I can tell you with some we can have, you know, memorandums of understanding and have a go-to-market alignment. But here's how we'll get...
There may be times, when there is overlap and that there is some competition there and there may be some vendors that we work on end point, where there is far less competition. So here's what I can tell you with some we can have memorandums of understanding and have a go to market alignment, but here's how with different the global intelligence and Thats actually starting to work.
Speaker 1: The global intelligence, and that's actually, Saki walked into it to some extent, I was gonna go with the ARR theme or the Intel theme, and I went with the Intel theme today. No one's gonna rebuild the global intelligence capability that we have, and it does matter. You combine that with us responding to over a thousand breaches a year, and our Intel baked into our XDR capabilities is something that I don't think a controls provider or platform provider's gonna...
And to some extent I was going to go with the <unk> theme for the Intel team and I won't be insulting today no. One is going to rebuild the global intelligence capability that we have and it does matter you combine that with us responding to over 1000 breaches a year and our Intel baked into our xdr capabilities.
Something that I don't think.
Controls provider or platform providers.
Speaker 1: going to have because we have the privileges showing up when their stuff didn't work. I mean that's what incident response is. So if there's a way to circumvent a platform, we're the first ones to see it. And in security, I call it it's popping the balloon. When a needle hits the balloon, you got a problem. One attack that works against a platform is a significant problem for those users of that platform. We absolutely want vendor agnostic so that people can trust the Mandiant brand to validate it.
It's going to have because we had the privilege of showing up when their stuff didn't work.
That's what incident response is so if theres a way to circumvent our platform. We're the first ones to see it and in security I call. It it's popping the balloon when a needle hurts. The balloon you got a problem one attack that works against the platform is a significant problem for those users of that we absolutely want vendor agnostic so that people can.
Trust, the <unk> brand to validate.
Okay, and say hey, the axial.
How does work and so imagine somebody went with an endpoint vendor and.
Speaker 1: So imagine somebody went with an endpoint vendor and their program to manage it. That's fine. Use this for veteran stuff that maybe they don't detect.
Their program to manage it that's fine uses for some stuff that maybe they don't.
Speaker 1: And then our services go beyond scope because they'll be spoke at times anyway. So they'll always be.
And then our services go beyond scope, because there'll be spoke that time anyway. So they will always be.
Speaker 1: Yeah, not all you know with each partner. We're going to have to explore how we can best work together and jointly defend the customers.
Not all with each partner, we're going to have explore how we can best work together and jointly defend.
The customers.
Got it got it if I can squeeze just a third kind of housekeeping question here for you Frank.
Speaker 6: Donna, if I could squeeze just a third kind of housekeeping question in here for you Frank. I think it was asked in a different way earlier but can you just talk about sort of what the expense either annually or rather for 2022 is or on a quarterly basis is for 2022 in terms of how much expense.
I think it was I think it was asked in a different way earlier, but can you just talk about sort of what the expense either annually or rather for 2022 as or on a quarterly basis as for for for 'twenty. Two in terms of how much expense Mandy incurs to fulfill those TSA is I know I know they start to roll off after Q.
Speaker 6: Mandiant incurs to fulfill those PSAs. I know they I know they start to roll off after q3 But can you give us a sense for what the dollar amount is that that you kind of keep as stranded? Right and that will eventually go away Sorry, that makes sense about
<unk> three but can you give us a sense for what the dollar amount is that you kind of keep us trended bright and that will eventually go away.
Alright that makes sense.
Yes, it's roughly in the $20 million range.
Speaker 3: Is that 20 million for the quarter or 20 million for the year? No, for the full year.
And is that $20 million $20 million for the year, so for the full year.
Speaker 3: So various workstreams wind down throughout the year. On balance, we'd expect most of the workstreams to go through the end of Q3. Thanks. Cheers, guys.
So various work streams wind down throughout the year on balance we would expect most of the work streams to go through the end of Q3.
Sure.
Thank you Scott.
There are no additional questions waiting at this time, so I'll pass the conference back over to Kevin for closing remarks.
Speaker 1: There are no additional questions waiting at this time, so we'll pass the conference back over to Kevin for closing remarks.
Thank you very much.
Speaker 1: I believe our biggest near-term market opportunity is to offer the most preferred controls agnostic XDR solution with our threat intelligence, our validations and our services serving as our differentiators.
I believe our biggest near term market opportunities to offer the most preferred controls agnostic xdr solution with our threat intelligence, our validation and our services serving as our Differentiators third party integrations will be critical to our growth in this component of our business. Therefore, we intend to rollout a steady cadence of important partnerships.
Speaker 1: Third party integrations will be critical to our growth in this component of our business.
Speaker 1: Therefore, we intend to roll out a steady cadence of important partnerships to better protect Manion customers. And I look forward to speaking with all of you and updating on the partnerships as well as our long-term model at Analyst Day meeting on March 10th. Thank you very much.
To better protect mannaean customers and I look forward to speaking with all of you and updating on the partnerships as well as our long term model at Analyst day meeting on March 10th Thank you very much.
That concludes the <unk> fourth quarter and full year 2021 financial results Conference call. Thank you all for your participation you may now disconnect your lines.
Speaker 1: That concludes the Mandiant fourth quarter and full year 2021 financial results conference call. Thank you all for your participation. You may now disconnect your line.