Q2 2019 Earnings Call
At this time all participants are in a listen only mode. Later, we will conduct a question and answer session and instructions will follow at that time, if anyone should require assistance. During the conference. Please press Star then zero on your touched on telephone also this call is being recorded.
At this time I would like to turn the call over to keep Patterson. Please go ahead.
Thank you Daniel good afternoon, and thanks to everyone on the call for joining us today to discuss Fireeyes financial results for the second quarter of 2018. This call is being broadcast.
Live over the Internet and can be accessed on the Investor Relations section of Fireeyes website at Investor stopped Fireeye Dot Com with me on today's call are Kevin Mandia virus, Chief Executive Officer, and Frank There to counter Executive Vice President Chief Financial Officer, and Chief Accounting Officer of fire eye.
After the market close today Fireeye issued a press release announcing the results for the second quarter of 2019.
Before we begin let me remind you that Fireeyes management will make forward looking statements. During the course of this call, including statements relating to <unk> guidance and expectations for certain financial results and metrics by rice priorities initiatives plans and investments drivers and expectations for growth the expansion of Fireeyes platform and the benefits capabilities and availability of new and enhanced offerings, including those from our varied and acquisition, our competitive position and market opportunities and go to market strategies and internal alignment along areas of focus. These forward looking statements involve a number of risks and uncertainties some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward looking statements apply as of today and you should not rely on them as representing our views in the future and we undertake no obligation to update these statements. After the call for a detailed description of the risks and uncertainties. Please refer to our SEC filings as well as our earnings release posted an hour ago copies of these documents may be obtained.
From the FCC or by visiting the Investor Relations section of our website.
Additionally, certain non-GAAP financial measures will be discussed on this call. We have provided reconciliations on these non-GAAP financial measures for the most directly comparable GAAP financial measures in the Investor Relations section of the website as well as the earnings release.
I'd also like to point out that we posted a supplemental slides and financial statements on the Investor Relations section of the website.
Finally, I want to remind everyone that our 2019 analyst day will be held on October 8th during this year's cyber defense summit in Washington, DC for those of you who cannot join us in person a webcast of the event will be accessible on the Investor Relations section of our website.
With that I will turn the call over to Kevin. Thank you Kate and thank you to all the investors employees customers and partners joining us on this call. We appreciate your continued interest and support as we continue to transform our company.
The second quarter of 2019 marks the 10th straight quarter, where we met or exceeded our billings and revenue guidance ranges billings was at the high end of our guidance range and revenue exceeded our guidance range. However, operating income operating margins and earnings per share were slightly below our guidance ranges. We provide you details why we did not meet these expectations, but first I'd like to share some highlights from the second quarter.
We posted year over year growth in billings categories, we generated billings of $221 million, a 13% increase year over year, and a 19% increase excluding a 10 million dollar transaction, we had in the second quarter of 2018.
Revenue was 218 million, a 7% increase year over year.
Results were especially strong in our platform cloud subscriptions and managed services category with billings growth accelerating 27% from a year ago.
Matt its defense had its best ever second quarter, and its third highest billings quarter in our history threat intelligence had a very strong quarter growing a R 20% year over year.
Mandiant services had its second highest billings quarter in our history billings for professional services were 46 million up 15% year over year.
We booked 45 transactions greater than a million dollars with customers diversified across vertical markets and geographies and nearly two thirds of these million dollar plus deals in the second quarter included services or expertise on unmanned.
Our overall transaction volume increase with both global 2000 customers as well as in the Midmarket and we added 261, new customers in the quarter.
From a sales perspective, the first half of 2019 was the best first half in Fireeyes history.
Our results this quarter, especially the strength of our platform cloud and managed defense category as well as our professional services show how far we have come as a company over the past three years Fireeyes continue to evolve from our origins as a network security product vendor to a comprehensive security platform company.
We have been taking actions to build a strong foundation for our future and extend our influence as trusted security advisors.
As we transform our company to related but different areas of focus have emerged within fireeye.
First we have products consisting of our advanced detection and protection products, such as network email and endpoint security and second we have platform and solutions that combine our helix platform security instrumentation from Baird in Mandiant services intelligence and our managed defense offerings now I'd like to provide you updates within the context of these two areas of focus.
Our products are well established and have enterprise customers worldwide over the past few years, we have dramatically improved our cost structure delivered new features and functionality and improved our cross selling upsells success within our customer base. This has enabled our products to return to billings growth.
We have seen a steady increase of customer adoption of multiple products and the number of customers with more than one product family increased to 58% from just over 50% a year ago adoption of our virtual and cloud solutions is also on the rise with nearly half of the customers purchasing in the second quarter, choosing cloud or virtual solutions.
And endpoint security, we added new when its advanced detection and response or EDI, our capabilities, we deployed new malware Garden machine learning models and made significant performance improvements to overall usability and user experience.
We also introduced a new offering that combines our managed defense and endpoint security in a single skew simplifying the purchasing and provisioning to new managed defense customers.
I'm also excited about our new innovation architecture, which enables any fireeye team such as consulting or managed defense to write custom modular extensions for endpoint software on their own this increases our ability to innovate faster and we recently, we recently released phase one of the innovation architecture and I've already released modules into the fire on market and we plan to release, a second phase and allow partners and customers to begin adding their own custom endpoint modules.
For our network security software our latest releases included virtual onex for ADW asked environments, which takes advantage of SWS is new VPC port mirroring functionality. We also improved our ability to detect the tax and encrypted traffic added new intelligence based context for our alerts and for the first time can now be tech web shells and other evidence of compromise on servers, which moves this product well beyond his previous capability to detect the tax mostly against end users. We now offer a complete network security detection and analysis capabilities for pure cloud deployments as well as hybrid environments.
And email security, we began implementing the first phase of our new architecture for cloud email designed to address our growth in customers and the increased E mail volume we are experiencing.
The burst in email buying required us to increase our cloud cost beyond original expectations and our CFO Frank will provide you the additional details in his prepared remarks.
We also released our latest email threat report showing a dramatic increase in new variants of impersonation attacks, where attackers emulate a trusted colleague dittrich victims into providing credentials are opening an attachment our ability to prevent impersonation attacks is an important competitive advantage for email security solutions.
And finally, we know that success with our products is not just about building great features our customers expect to build fireeye capability into the way they work and operate and we cannot just be a black box that you plan to roll out new developer relations capabilities to show customers, how to take advantage of our extensibility and robust a pie.
In addition, we are focused on our technical partnership network and I'd point, you to our Fireeye market to read more about the hundreds of vendor product integrations across our portfolio.
Now our vision and the value we deliver to customers goes beyond the competitiveness of those individual projects I just discussed with our world renowned mandiant expertise global threat intelligence helix platform and more recently varied and we're delivering a robust platform that significantly improves cyber resilience for our customers.
Our platform strategy is simple to provide a single platform that allows the customer to leverage all of its security technologies from any vendor and overlay, our intelligence and expertise to simplify and automate security tasks, while continuously testing and improving security controls.
Adoption of our platform results in more effective and efficient security programs Backstopped by Mandiant expertise on demand with measurable effectiveness delivered from the varied and platform and the world's best threat intelligence with respect to helix. We continue to see increased engagement as we expand the number of integrations. We have launched early adopter program for the next generation of the platform and I believe the feedback we are receiving will contribute to a successful launch later this year.
Our recent acquisition of Baird and provides a critical component to our platform and solutions with the varied and security instrumentation platform organizations can test the resiliency against cyber attacks before they are in fact attack. This delivers our customers are reliable and consistent way to measure cyber risk in a manner that is actionable for frontline technicians, yet understandable in the boardroom.
We have just completed the first phase of integrating our threat intelligence into the varied and platform and we will be showcasing this capability at the Black Hat Conference next week.
In the future we plan to combine the capabilities a burden with helix is orchestration. So also automatically adjust to security infrastructure to defend against the simulated attacks.
I believe there is no other technology with the same potential to fundamentally change the way organizations implement manage and measure their security infrastructure and the effectiveness of their spend.
In order to be as efficient as possible. We are aligning our internal structure at fireeye to reflect our evolution from a network security product vendor to a comprehensive security platform company. Accordingly, we are formally creating a new platform and solutions group within fire on this group of combined Mandiant services, our platform engineering varied in managed defense and our threat intelligence resources into a single organization I believe this new alignment will accelerate our execution towards the platform and unite the portions of our business that are accelerating in their growth.
We are also establishing products group.
Led by our current CTO Grady summers this will consolidate and streamline our products that is our network endpoint email and Sim offerings by combining product management engineering and customer success for these products into a unified customer focus team. This group will also be focused on improving release cadence enhancing our ability protect trout cloud workloads.
And bringing a data driven approach to bolster renewals were also winning new business. We look forward to discussing the changes we are making at firearm and update you on our innovation with more detail at our analyst day at the Cyber Defense Conference on October Eightth of this year.
Now for the past several years fire has been developing a comprehensive security platform for our customers the momentum in our platform cloud and managed services business is the result of our efforts.
And I believe we are taking the next steps towards accelerating our growth I want to thank all the fireeye employees for their continued efforts and focus as we seek to change the security industry and now I'd like to turn the call over to CFO Frank.
Thanks, Kevin and Hello to everyone on the call.
First I want to frame my remarks, with a few general comments on our business outlook and financial model.
First.
As it has for several quarters, our business continues to diversify across customer size product families geographic regions and verticals.
We continue to add new logo customers in every product family and many of our existing customers are deploying more product families.
These healthy demand trends are reflected in the growth in billings, which is a leading indicator.
As well as in our outlook for our billings and cash flow for the rest of the year.
Second as in any ratable model revenue is a lagging indicator because because it includes amortization from sales booked in prior periods.
We were already experiencing a headwind to our revenue growth due to the decline in appliance sales, we experienced a few years ago.
Several factors have caused us to reduce our revenue outlook for 2019 by $25 million.
This had a cascading effect on our profitability and as a result, we have also reduced our outlook for margins and earnings per share.
That said I remain confident in our strategy and long term outlook.
We are committed to balance growth and profitability long term and are continually looking for opportunities to increase our efficiency without jeopardizing growth.
You can see the inherent leverage in our business model when you compare operating expenses to billings and calculate cash flow margin on billing.
This leverage will become apparent in our revenue base metrics as revenue growth trends catch up the buildings.
Before I discuss the details of our Q2 results and our guidance for Q3 and 2019, let me remind you that I will be referring to non-GAAP metrics, except for revenue and operating cash flow.
Our non-GAAP measures exclude stock based compensation amortization of intangibles noncash interest expense on our convertible debt and other nonrecurring items.
I also want to remind you that we made a minor change to the billings and revenue breakout categories changing the name of the cloud subscription and managed services category to platform cloud subscriptions and managed services or platform for short.
The change reflects the addition of varied into this category.
There's no impact to historical metrics as helix was already included in the platform category.
For reference in the appendix in the slides we included Theres, a mapping of the product families to each of these categories.
Turning to our Q2 results total billings of $221 million were at the high end of our guidance range and increased 13% from Q2 of 18.
As expected our Q2 19 billings did not include any transactions greater than 10 million 10 million.
Platform cloud subscriptions and managed services billings were $63 million for the quarter up 27% year over year on an as reported basis.
Error for platform clouds of subs and managed services increased 27% year over year to 237 million.
Billings for our Mandiant professional services were 46 million an increase of 15% from Q2 of 18.
We continue to operate at near capacity in this highly strategic portion of our business.
Billings for the product and related subscription and support category were $113 million up 5% year over year.
Sales of appliances accounted for approximately 31% of the total product related category.
And were up 24% year over year.
Similar to Q1, we attribute some of the year over year strength in appliance sales to the end of life for our older third generation appliances, which we first introduced in 2012.
This created a wave of network and email hardware refreshes with new subscription support contracts for customers still relying on these appliances for advanced security.
Turning to revenue consistent with billings growth and platform cloud subscription and managed services billings, we've experienced over the past two years platform cloud subs and managed services revenue increased 26% year over year to a record $57 million.
Mandiant professional services revenue of $43.5 million was also a record this was the fifth consecutive record quarter for Mandiant professional services revenue.
Product and related subscription and support revenue decreased about $5 million or 4% from Q2 of 18.
The year over year decrease reflected the $24 million decline in the opening current deferred revenue balance for this category.
As we've discussed in the past the ratable recognition of product revenue under six so six means the decreases in appliance billings that occurred in 2016 in 2017 are just now flowing through our current deferred revenue and revenue.
With performance in our platform and service categories more than offsetting the decline in product and related.
Total revenue in the quarter was $218 million, an increase of 7% year over year.
$152 million or 87% of the non services revenue was recognized from current deferred revenue from the balance sheet.
Gross margin was 72% in the quarter down from Q2 18 gross margin of 75%.
The majority of the decline was due to a greater than expected increase in hosting costs as we accelerated the migration of our cloud based products from Fireeye internal data centers to a public cloud provider.
The move to a public cloud platform provides us with additional real time flexibility and scalability needed to support our growing cloud business.
The decrease in product and platform gross margin was partially offset by an increase in our services gross margin to 53% compared to 50% in Q2 of 18.
Operating expenses declined 2 million sequentially, but increased 11 million or about 8% year over year.
The increase in both operating expense and Cogs, both partially driven by an improved billing trends resulted in a small loss for the quarter.
However, as a percentage of billings operating expenses declined from 75% in Q2 of 18% to 72% in Q2 of 19.
Demonstrating continued leverage in our long term business model.
Our year over year expense growth was primarily in research and development and sales and marketing both areas with the potential to drive future growth and operating leverage.
In R&D, we invested in innovation across our product offerings and accelerated and investment in our next Gen security operations platform as we gear up for the expected launch in Q4.
Sales and marketing expense was higher year over year, reflecting increased commission expense associated with higher sales performance and accelerate growth in new business.
Finally, Q2 operating expense included one month of Baird and consistent with the financial impact we outlined on the call. We had in may to announce the acquisition.
Other income and taxes, largely offset each other resulting in a loss per share of one cents.
Turning to the balance sheet and cash flow growth in our billings and timely collections continue to drive our cash flow performance.
We typically enter Q2 with the lowest receivables balance of the year, reflecting Q1 seasonality in billings.
As a result, Q2 operating cash flow tends to be the lowest of the year.
The seasonal pattern held true this year and operating cash flow was negative $15 million in the quarter.
We continue to manage to maintain a very healthy balance sheet with cash and short term investments of almost 1 billion, even after using $127 million net cash on the Verizon acquisition.
We ended the quarter with receivables of approximately 127 million and Dsos calculated on billings of 52 days. This is slightly better than our target range of 55 to 65 days.
Ending deferred revenue was approximately $913 million, an increase of 7 million sequentially and an increase of $33 million from the end of Q2 of 18.
The current deferred and total deferred revenue balances include approximately $3 million of acquired deferred revenue from Barrington.
Ending current deferred revenue increased 4 million sequentially and $20 million year over year as increases in platform and services deferred revenue.
Offset that decline and continued decline in product and related current deferred revenue.
As a side note you will see that approximately $114 million of our convertible notes moved into current liabilities.
This is the remaining amount of the first tranche of the notes originally issued in 2015.
We currently expect that we will redeem these notes for cash in June of 2020.
With this as background lets turn now to our outlook for the third quarter and our updated 2019 guidance ranges starting with the year.
We are reiterating our 2018 guidance range for billings of 935 to 955 million.
Representing year over year growth of 10% at the midpoint.
We are reducing our 2019 revenue guidance range by $25 million to $865 million to 875 million.
There are three primary drivers for the decrease and I'll provide a little more detail on each of these factors.
First air are for the product and related subscription category declined $20 million sequentially in Q2, primarily due the expirations of subscriptions and support attached to our third generation appliances that were end of life and not refresh.
While many of our large customers refreshed uneven expanded their deployments with fifth generation appliances over the past several quarters, many smaller customers allowed their subscriptions to expire without purchasing new hardware.
The estimated decline in product and related a our reduced our expectation for the second half by approximately 10 million.
The good news is that there is less than $3 million in air are left for the third generation appliances.
We expect product and related Aer to stabilize from here and we believe we could see incremental growth from the new cloud based network security and server based detection Kevin discussed earlier.
Second we now expect the amount of upfront revenue to be less than we originally forecasted.
Upfront revenues relatively small amounts in any given quarter typically 5% to 10% of the product and related category.
There are a number of puts and takes here, but at a summary level, we expect less upfront term licenses for our Fireeye security orchestrator or effort. So that will be sold exclusively as part of helix and we also expect less upfront revenue from management appliances with the availability of the helix platform.
We estimate the impact of this revised forecast to be about $5 million to $10 million in the second half.
The third item is related to the decrease.
Third item is related to the increase in the mix of appliance billings, which we also believe is partially related to the end of life of the older third generation appliances.
A higher mix of appliance lengthens the revenue recognition period to 48 months compared to a more subscription heavy mix at an average duration of 24 to 26 months.
Additionally, customers tend to purchase multiyear subscription when buying new appliance hardware and we believe that the surge in appliance sales in Q2 was a factor in the expansion of the average contract length for the product and related subscription and support.
Overall, the increase in Hcl combined with a higher mix of appliances accounted for about $5 million to $10 million of the estimated decrease.
With lower revenue, we now expect gross margin of approximately 73%.
And an operating margin of breakeven.
Two 1% for the year this translates into earnings per share in the range of zero to four cents.
With the same billings range, but higher costs associated with them our migration to the public cloud cloud infrastructure, we are reducing our cash flow outlook by $10 million to a range of 85 to 105 million.
At the midpoint, our updated operating cash flow guidance implies a year over year increase of more than 50% and a cash flow margin of 10% on our expected 2018 Billy.
Our expectation for Capex remains the same at $40 million to $50 million.
Well, we're not we're not guiding to 2020 at this time I do expect our Capex to decline next year as we have completed all our major.
Planned facility moves and our move to the public cloud will will reduce capital investments in our data center equipment.
For Q3.
We expect billings in the range of $245 million to $255 million, which implies year over year growth of approximately 14% at the midpoint.
From a linearity perspective, this range implies 26% to 27% of our expected annual billings will be booked in Q3.
Consistent with historical annual linearity for the third quarter.
We expect revenue in the range of 217 to 221 million, implying approximately 3% year over year growth at the midpoint.
This reflects a $23 million decrease in current deferred revenue in the product and related category as we continue to work through the long tail of the impact of ratable recognition of appliances.
Given this revenue range, we expect gross margin of approximately 72% and operating margin between breakeven and 2%.
This implies operating expenses will be flat to down slightly compared with Q2.
The decrease.
Outlook for Opex was primarily related to lower payroll taxes in Q3 as more employees hit maximum withholding amounts.
We also expect interest income to offset interest expense and cash taxes of between one and a half and $2 million.
Both are consistent with prior quarters.
This yields earnings per share of plus one cents plus or minus a penny based on a weighted average diluted share count of approximately 218 million shares.
Operating cash flow is expected to be in the range of 15% to 25 million about equal to operating cash flow in Q3 of 18 at the midpoint.
Reflecting similar receivable balances for collection and relatively flat expenses on a year over year basis.
We expect capex of about $10 million.
That concludes my prepared remarks, we'll now take your questions operator.
Thank you ladies and gentlemen, if you have a question at this time. Please press. The Star then the number one key on your Touchtone telephone. If your question has been answered or you wish to remove yourself from the queue. Please press the pound key.
Again Thats Star then one to ask a question.
To prevent any background noise, we ask that you. Please place your line on mute. Once your question has been stated.
And our first question comes from Kurt helping us with Stifel. Your line is now open.
Hi, This is actually Chris spear is on for Gore.
Kevin normalized billings growth of 20% is encouraging.
Can you talk about the degree to which adoption of expertise on demand contributed to growth in Q2, and how the pace of adoption has progressed versus your internal targets.
Yes, I think expertise on demand is meeting our expectations I think Chris what we have to do to see the kind of growth I want to see there is embedded into all our technologies right now it's available in the cloud helix that we have we can press a button and interact with our experts, but when I say in bed I mean, you're inside our endpoint technology, you're looking at something you don't understand and there's a big Red button that says hey quick here to get a forensic review click here to get help so we're working on that path and I expect to see more growth as our tech and beds expertise in on demand into it well, we did see and what I did mentioned in my Directory marks was about two thirds of our million dollar plus deals have services and expertise on demand in it and I want to reiterate that the equities on demand the whole goal of that isn't to sell more services. It's that's the kind of product I want to buy.
So if I've done my thousands of hours of sit inside of security tack and every time you have a question you don't want to bouncing Paperclip, you just want to hit a button and get somebody with real expertise at scale that solves problems for dozens if not hundreds of companies at your fingertips. So right now I still think its early stages, we have the backend complete and what I mean by that.
Is when you make a request to fireeye fresh cheese on demand, it's almost like an all points bulletin, whether you email or call or click on the chat in helix. It's we're trying to get a tree arash. So that you get the right expert when you need them. Most so our Intel folks are involved our mandiant services folks are involved we have a team called tour, which is I think thread operations reverse engineering, we have an advanced practices team for detection. We just go out and find the right expert thats well oiled machine inside of Fireeye now and now it's the tech getting these I call buttons I'm sure I'm oversimplifying, it, but just making a way for our customers inside of products to seem we communicate with our experts is what we're trying to do with our nexgen helix and with future releases of our products. So that's a long answer to your short answer of it was it within my expectations of how it did.
And I think that it takes off when it's really truly embedded in our technology that said, Chris we did see.
Very nice sequential growth and we did almost double our customers on expertise on demand. So it did kind of meet our plan, where we're expecting to do but pretty good metrics there.
That's great color and Frank with all the moving pieces in a model that have.
More or less led to the topline guide down and the effects on profit of the stability in the second half the year do you believe that bared and can still contribute $70 million to billings and be accretive to both operating income and cash flows in 2020.
So a couple of things Chris one is the guide down was only on revenue again, the leading indicator of billings was we reiterated guidance there as far as varied and goes.
Bared and actually slightly better than we expected on both billings and revenue in the quarter.
Fire I still met our expectations on a standalone basis, but I think as we look at varied and throughout the remainder of 2019 and for 2020, we feel very good with the guidance we gave out in May.
All right. Thanks, guys.
Thank you Chris.
Thank you and our next question comes from Saket Kalia.
From Barclays Capital. Your line is now open.
Hey, guys. Thanks for taking my questions here.
A second maybe.
Hey, Kevin Hey, Frank if I could maybe just to start with you.
Can you just talk about the renewal rate on on attached subscription and support I know you talked to some of the generational change there and appliances on how that affected some air are there this quarter, but generally speaking how do you think about the renewal rate on that attached subscription and support line going forward.
Sure I think we'll see stabilization of it I think in the in the second quarter, we did see a $20 million sequential decline decline in air are for the product and related but again. The primary driver of that was the fact that we did end the life. The third generation appliances. So customers really only have the option of refreshing those appliances, which which did for some non renewals.
The really good news here is there is only $3 million left in our A.R.R. relating to the third generation appliances. So I don't think we see that impact going forward.
Okay. That's helpful.
Kevin maybe for you you touched on this in your prepared comments just about realigning the company into platform and products.
As you look out I don't know a year from now what are the sort of benefits you'd like to see from that free line men and and what is what sort of potential synergies could you gain from kind of separating those that platform group and that product group.
Yes.
By the way we've been on that transformation sackett since I got the job three years ago. You know I think we're doing a great job stabilizing our core products at the same time frame.
You know we took it under our wing, saying, Hey, we got to build a platform and we've got to find a way to decouple, our Intel and get it into the platform and we've got a.
We basically I wanted to create what I call. It at the time security as a service.
At a different way to transact and different way to do business with us and we're still building that.
And the bottom line as I've looked at this business and we're managing it I kept thinking we're stabilizing core products, but we got to invent something new and bring that to market.
Overlays, our Intel Decouples, our detection firmer spoke products. It enables expertise on demand power security instrumentation, all those things that's a new product for us that we started building back in.
We started adding to it but we started focusing on it back in 2016, we Gotta helix first Gen out and then we've done a full.
In organic and inorganic refresh to that product with the extra team purchase so that we can combine big data with our.
Data scientists with the command center that we call our security operations with our orchestration. So bottom line work in progress by aligning the groups you almost look at how they go to market. We have spoke products that go to market one way endpoint competes against endpoint.
Network competes against firewall in cloud and email competes against email stuff, but then we have this platform at quite frankly operates independently of the spokes. It's more spoke agnostic with Baird in it's really going to be spoke agnostic, it's genuine they're going to run the attacks and give you here's the results of it and it's not going to favor fireeye spoke products over anybody else's, it's going to be honest, it's going to have integrity, and it's going to be real and that's the same for expertise on demand I mean, we don't need to just leverage data from our products to help our customers on a daily basis, we're solving the most complex security problems and we are using a lot of tech. Besides fireeye Tech. It's whatever has been in the infrastructure of our customers for the last five to 10 years, we got to rely on that as well. So the goal of this company has always been to go from spoke network security Sandbox company to a genuine comprehensive security platform company, where would I believe every customer wants to buy is very simply.
They want somebody to back stop their capabilities and be there when you need them and at the same time frame simplify integrate and test your security architecture, let's just aligned the groups that way and get them functioning more aligned with how we go to market. So we put grady summers our CTO in charge of our that what I call core products network endpoint email and Sem and then get the expertise part of our business working more with Verizon in the platform spokes spoke agnostic and let him Ron.
Makes a lot of sense. Thanks, guys.
Thank you.
Thank you and our next question comes from Sterling Auty.
Morgan Your line is now open.
Yes, Thanks, Hi, guys.
If I just try to think about this simply.
Bill Billings as revenue plus the change in deferred revenue you reiterated billings, but the revenue is going down so that means that the deferred revenue contribution in the back half of the year has to be stronger what's the we focused on the end of life for Gen. What's the thing that's coming in much stronger than what you. Originally thought when you gave the billings guide initially.
No.
Well the two things that on the positive side, yes, I did say varied and little bit better than expectations in the second quarter.
The other major thing is our cloud our platform and cloud subscriptions and managed services grew really nicely and so we're now seeing the impact of that growth on the billing side over the last couple of years, we had in the second quarter, we had 27% year over year growth in that in that category.
Okay and then the follow up is.
You know when you were thinking about and the blood.
This always the plan in terms of the timing of the end of life in terms of third Gen and what is it that really took you guys by surprise to see the magnitude of the change.
So this was the timing of the end of life I think what caught us by surprise is really though.
The expected number of refreshes.
Was less than we saw in previous end of life.
Processes so.
We basically end of life that at the very end.
Of Q1, and the beginning of Q2 and so that really.
We anticipated some activity in Q2 that just didnt happen.
And again, it was primarily focused on smaller customers, but ultimately.
That impact has a pretty significant impact for the back half of the year.
Okay. Thank you.
Thanks.
Thank you and our next question comes from Gregg Moskowitz with Mizuho. Your line is now open.
Okay. Thank you very much and good afternoon, guys. So Frank.
Getting back.
Hey, Kevin So getting back to you know platform business and.
You know as you mentioned it was up 27% reported it was also up 65% if you back out the eight figure deal from a year ago. So my question here is how broad based the growth was in Q2 as well as if you could speak to the sustainability of significant double digit growth in the platform category going forward.
Yes, so the two things on that I think we had it we really had a great quarter across the whole category I think if you look at.
Each of the individual components of that they really had strong quarters, we had 20% air our growth in the Intel side.
We had really strong managed defense quarter as well and then just across if you look at.
Barrett and was a nice contribution obviously.
First initial contribution to the quarter and our expectation is consistent with our long term model and in that we expect that growth that group and category to be the accelerating.
Billings and revenue component.
So we do believe that base.
All right great. Thank you and then as a follow up Greg just a little color on that just tons of relevance. There you know when you look at what all the security practitioners want right now the number one question I get in every board room or even talking to assess those is how good my how good do I need to be at security.
Test it and that varied and platforms totally relevant and then Frank mentioned in his direct remarks, you may Miss I think it was the fifth quarter in a row managed services had its record revenue quarter at five quarters in a row and thats not just because we respond to breach as most people think Wow mandiant, that's what they do for eliminates respond every breach that matters.
But when you respond every breach that matters. It makes you exceptional at the strategic consulting aspects of it as well and then our threat intelligence is relevant Theres a day in my career where I.
You know I always thought maybe attribution doesn't matter right now when you are compromised or being attacked and you know at the first thing you want is the context as to who might be and what might the risk be so just the relevance of what and I can keep going but I'll stop said, we can dress everybody's questions and get the models right, but the relevance inside that category is high and Thats why I feel very confident that we can grow it at market rates are above.
Okay, that's really get perspective, thanks, Kevin and then just one other one follow up I had just on duration. So.
You guys spoke to.
And so I actually a significant increase in average term length for your product and subscription billings meet you talked about kind of more of an appliance appliance mix shift.
What are you assuming with respect to average.
Contract length for the second half of the year as part of your billings guidance. Thank you.
So Greg I think we would assume it would be a little bit more normalized to the previous few quarters. So I think overall in the recurring subscription support in that 24 to 26.
Area the product can relate it had ticked up to 29 months I think you will see that come back down probably to the 24 to 26 months.
Perfect. Thank you.
Thank you and our next question comes from Shaul Eyal with Oppenheimer. Your line is now open.
Thank you hi.
Good afternoon.
As as.
Hey, thanks.
Despite the reduced outlook.
I think one of the questions investors have in mind that the can today in light of.
The capital one sizable bleak.
It was reported earlier.
Did you guys get a cold.
On the incidence response.
Side of the equation.
We wouldn't be able to comment to that we have an anda with all our customers. We've been in the business for 20 years to help people solve complex problems quietly and discreetly.
And we're going to stay in that business.
Fair enough.
And do you think that some of the issues, so billing healthy but revenue outflow down.
Does it have to be with a super competitive arena clearly there are some new market entrants.
Playing to an extent in your domain as well.
Could that be part of the reason.
I think I'm sure some of the pressure on the renewals on.
The end of life appliances.
Has to do with the competitive landscape on the network and email side.
Those are the non renewals were pretty much focused primarily on those those two areas, but I think if you look at our continued innovation those areas as theyre become new entrants in those markets our products get more competitive as well and that's why you're seeing a lot of new businesses in network in email as well.
Got it understood. Thank you so much.
Thanks Michelle.
Thank you and our next question comes from Rob Owens with Keybanc capital markets. Your line is now open.
Great. Thanks for taking my question I think you might have answered part of it but.
You had mentioned earlier this was activity on smaller customers and it does feel like 25 million.
A lot of smaller customers are a lot of activity. So.
Those were mainly competitive losses than in your opinion or are these folks that may transition over to subscription services, maybe help me out a little bit.
Yes, I think some of them obviously on the E mail side have transitioned over to our email cloud.
Solution, but we did have if you look at the non renewals. There were there were primarily smaller customers, but absolutely there was a handful of larger customers as well and again I think the good news and the end of this is there's really only $3 million left of the air are.
As of June Thirtyth. So we just don't think we can see that big of an impact going forward.
Yeah, Rob This is Kevin speaking when I noticed the renewal pressure on Fireeyes network security, it's primarily at the smaller customers and it's an option to go to a cloud based service.
Or firewall module.
And Kevin when you look at the longer term vision of spoke and then kind of the VIP and the spoke agnostic.
Side do you think the visions built out are there other capabilities. Other spokes, you want to add in or or other thing on the other capabilities on the ignostic side.
Yeah, when I think about it.
Rob I just try to over simplify what is unique differentiator for Fireeye, we know more about the threat actors in anybody based on what about 200 threat analysts that speak 32 languages in 19 different countries in a global capacity and nearly 400 incident responders that are act very near capacity at all times. So we see when all safe guards technology people and process fail and I think our true IP should be spoken vendor agnostic.
It's nice to have the spoke so we can put our own.
Stuff into it but at the same time frame, we provide a lot more value to our customers. If we can get our platform to overlay what we know about the threat actors on a daily basis into their infrastructure, regardless of the spokes that they use so I think thats. The road that we've been on for three years takes time to build it.
And I'm going to try to accelerate us more into that platform and spoken nonstick.
Poor portion as well as.
Yeah, we'll have to Spoks, we need them when you look at what we do in our incident response.
Most 99% of the time, we need our endpoint that do the forensics, we do at scale.
But I just think our two IP is that knowledge of what's going on right now and what that knowledge can bring us to help customers instrument are they vulnerable to those attacks AK veritiv and if they are how can we orchestrate so that they're not and we see what the results of these attacks look like everybody's tech.
And then again, we do hundreds of Red teams every year and I still feel that all that knowledge.
It's just smoke agnostic, let's let let's let our customers get more value from it.
Great. Thank you.
Thank you and our next question comes from Tal Liani with Bank of America. Your line is now open.
Hi, guys.
I just want to go back.
Some of the early questions that we're asking them thinking about it in simple terms I'm focusing mostly on the gross margin.
What I'm trying to understand and I give you the background for my question. The biggest risk with your company is that you have so much legacy business still in the in the installed base.
With very high maintenance revenues of older contracts and then when these roll off.
The renewal is it much much lower revenues just because the competition right now competitive landscape is very different from two years three years ago. So.
The contract size is going to be smaller if you don't.
And how much of it is is not.
So very little Tal I think if you look at the current quarter decrease in gross margin. The the primary driver of that was the fact that we absolutely move.
All our cloud traffic from our internal data centers to a public cloud provider and we did it very quickly in the quarter and so that we're basically double paying both our internal data centers in the quarter plus from some pretty significant cloud costs, and so that that will normalize a little bit because we're optimizing on the cloud side, but were also being able to eventually turn off those data centers. So I think.
It's more of a short term impact.
But overall, if you look at our discounting overtime.
Even though the landscapes more competitive we've been able to continue to keep our pricing and discounting in line.
Got it so.
How long and I apologize if you said it before how long does it take Q.
To turn off if I can call. It this way or private data center and migrate everything to public.
Clouds.
Yes, so the migration to the public cloud is almost entirely done on on the actual product and solution side, we actually if we look at the next few quarters I think it's going to take us at least throughout the remainder of this year to get completely out of those related datacenter. So I think thats why you see it in the operating margin guidance for 2019, but I think we'll be able to.
Normalize that for 2020.
So it's nothing happened.
Nothing else happens.
And you enter 2020 by just by the fact that you decommission. The current datacenter do you think and again nothing nothing else happened in terms of mix et cetera mix of product. So I don't want to assume any other improvement.
So we only that happens will you be able to go back to your margin.
Structure that you had before or.
The attend the public cloud has some inherent lower margin that you'll have to compensate to have to offset in a different way.
No I think our belief is that with the right optimization in the public cloud, we can get margins similar to our internal operating data center costs.
And Thats kind of what our model would show.
Yes, there is obviously a level of optimization you need to do as you move that traffic over into any as you know as you partition it and work with different cloud provider and.
But I think thats, our original kind of thought process there.
So so when you say that you believe that in 2020, you'll be able to get back to this margin level do you assume anything else here, you're only assuming optimization of the public cloud.
Optimization, and then also getting out of the current data centers that were still paying on.
Yes, that's what I meant okay. Thank you great.
Thank you and our next question comes from Erik Suppiger with JMP Securities. Your line is now.
Yeah I was just wondering about your endpoint business.
How is the competitive dynamics around that and what does the pricing environment for the endpoint. These days.
Yeah, Frank and I are both jump in to answer that question.
As as the Guy who wrote our original endpoint roadmap back in 2004.
Right now our endpoint is primarily strongest when you have to do deep dive forensics at scale and as an open a pie so it's.
Pardon.
At the time.
Right.
Right.
Hi.
Okay. Thanks.
Okay and all right.
Okay.
We can.
Yes, so the business.
Right here.
So I've said this many times every endpoint evolves from different places, but we're just really really strong as an EDI, our endpoint and we're backing into as I call. It you got to start somewhere niche and you expand.
We are backing in endpoint protection, we've done that for Windows, and we're expanding that into Mac and Linux over time, but from a frantic standpoint, we work on Mac clinics windows and that's our strength and I haven't seen a lot of the pricing really hasn't seem to change much over the past few quarters I think a year ago I think it took a leg down but over the past few quarters, we really haven't seen much price pressure there.
Good thank you.
Thank you and our next question comes from Andrew Nowinski with Piper Jaffray.
Your line is now open.
Great. Thank you.
I want to ask a question on your email product. So it sounds like the increase in cloud hosting costs will may have been mostly related to your email solutions. So can you just give us any color.
On whether all your solution is now being used as a primary email solution versus just the Albert and then which vendors you're displacing.
So I think in a lot of cases were still as second line of defense, because we really just started being able to be a first line of defense in early 2019. So that process is still going I think we are winning deals as the first line of defense and I think in a lot of cases, the legacy kind of email vendors in that in that scenario, but I think we continue to innovate on the email product we continue to grow that overall business both on the on premise and cloud side.
Okay, and then just a clarification with regard to your billings I know you said you had higher than expected commission cost for your cloud hosting part and we certainly saw the strong cloud billings growth but.
Your total billings only came in toward the high end of the range. So if your cloud billings were more in line with what you're expecting.
We would total billings still have been within your guided range.
So I think Andrew what you're focusing on the higher Commission I referred to was the fact that if you look at the mix of new business versus renewals, we had a heavier mix of new business, which has a much higher commission rate than we pay on renewable business and so we are over our plan on new business under on renewable and so that had an impact on commission expense.
I see got it thank you.
Good time for one more question.
And our final question comes from Jonathan Ho with William Blair and company. Your line is now open.
Hi, Thanks for taking my question. This is John widen we're for Johnson.
A question on.
On helix.
Can you talk about the give some color on the US look availability released in the second quarter.
Give some further color on the reception there.
Yes, Kevin speaking I spoke about.
We have about a half dozen customers right now using it for many different use cases I spoke to the architect today on how that was going to very flexible platform. All installs are going very very well the amount of use cases, we're solving is exceptionally broad right now the good news on that is that every time, we solve a use case, you've got a playbook that is portable to other customers.
The last thing good news on that as my God people are using this thing to solve a whole lot of problems, we didn't foresee in the first place.
But we have a very dynamic platform and I'll reiterate this was built on the extra team platform, we did that acquisition over a year and a half ago, because what I learned is we have a lot of security expertise, where we're not a bunch of big data jockeys. So we had to buy a big data platform, we put our orchestration capabilities into the big data platform and then created a front end to it called command Center.
Marketing did not blessed that name yet, but we call command center, which is almost like a security operations platform. We've put all three together.
I left my notes on the results back in the office, but the good news.
It's up it's running its ingesting data from.
All over the place to include even the Internet one use case that we thought was pretty cool cools a customer is using the next gen helix deliveries great pace been for key words every single day and seeing if certain keywords pop up in pace been so they know if they have a problem or not and I really havent heard of any product as it does anything like that you'd have to have engineers goes code that yourselves. So they used cases very I'm happy with where it's at you can never go fast enough right I mean at the end of the day I will say on the call I'm happy where it's at.
Five minutes. After these calls I'll be walking down the hall tone engineers I want it now I want to faster so.
But the installs are going well.
And we have.
We have our.
Vast that season engineers working on it right now and I'm very pleased with what I'm, saying.
Okay. That's helpful color. Thank you very much and just last question.
The internal structure cheat.
My question the way to describe it was it was mostly that it wasn't really moving people around so much like engineers as much put us more management, having management oversight.
And particularly strategic points to to direct focus of your lease node folks to ticket item.
To to.
To match your strategic initiatives is it did I misinterpret is is there a wholesale gasoline of underlying people.
Management.
Well its management and there is some people moving underneath I mean, you always do organizational changes to get alignment for calls in a purpose that simple and the reason we're doing this one is accelerate the platform we've worked years to stabilize.
A bunch of products stabilize renewal rate show some steady growth there, but every time I set this business I want to accelerate the platform and that's you know it's time to do that and you take incremental steps along the way. So we've had ongoing sound like we just hey this quarter.
We're now focused on it we've taken incremental changes every six months to a year to focus more on the platform and the parts of our business that are accelerating the growth if I put it under different groups. It's just it's.
You just get better focus that simple so thats number one reason, we did it accelerate growth to the platform.
And by the way the prior move was let's have a platform first mentality in a decentralized way and I just want to centralize it and hall.
Okay, great. Okay got it thank you very much.
Thank you ladies and gentlemen, this concludes our question and answer session for today's call I would now like to turn the call back over to Kevin Mandia for any closing remarks.
Yes. Thank you very much folks for your interest in our company. Our transformation is not defined by single 90 day performance I believe we are proving our transformation and that we will continue on our path to provide our customers a single platform that implements security as a service overlays our intelligence Decouples, our detection and our IP from our Spok products over time enables expertise on demand and power security instrumentation and I believe the organizational changes that we've made within fireeye, one prove our pace of innovation and deliver and execute thank you very much for your time and I look forward to speaking to you in 90 days.
Ladies and gentlemen, thank you for participating in today's conference. This concludes today's program you may all disconnect everyone have a wonderful day.