Elastic N.V. (ESTC) Q1 2027 Earnings Report, Transcript and Summary

Good afternoon, and welcome to the Elastic First Quarter Fiscal 2027 Earnings Results Conference Call. [Operator Instructions] Please note, this event is being recorded. I would now like to turn the conference over to Alex Kurtz, Vice President of Investor Relations. Please go ahead.

Good afternoon, and thank you for joining us on today's conference call to discuss Elastic's first quarter fiscal 2027 financial results. On the call, we have Ash Kulkarni, Chief Executive Officer; and Navam Welihinda, Chief Financial Officer. Following the prepared remarks, we will take questions. Our press release was issued today after the close of the market and is posted on our website. Slides, which are supplemental to the call, can also be found on Elastic Investor Relations website at ir.elastic.co. Our discussion will include forward-looking statements, which may include predictions, estimates or expectations regarding the demand for our products and solutions and our future revenue and other information. These forward-looking statements are based on factors currently known to us, speak only as of the date of this call and are subject to risks and uncertainties that could cause actual results to differ materially. We disclaim any obligation to update or revise these forward-looking statements unless required by law. Please refer to the risks and uncertainties included in the press release that we issued earlier today, included in the slides posted on the Investor Relations website, and those more fully described in our filings with the Securities and Exchange Commission. We will also discuss certain non-GAAP financial measures. Disclosures regarding non-GAAP measures, including reconciliations with the most comparable GAAP measures, can be found in the press release and the slides. Unless specifically noted otherwise, all results and comparisons are on a fiscal year-over-year basis. Webcast replay of this call will be available on our company website under the Investor Relations link. Our second quarter fiscal 2027 quiet period begins at the close of business on Friday, October 16, 2026. We'll be hosting a virtual public webinar highlighting our improved metrics capability on September 22 at 8 a.m. Pacific Coast Time, which will be made available on our IR website for viewing. See the Elastic Investor Relations website for more details. With that, I'll turn it over to Ash.

Thank you, Alex. Good afternoon, everyone. Thank you for joining us to discuss our first quarter fiscal 2027 results. We are pleased to report a strong start to the year with continued strength in sales execution. We beat across all guided metrics and demonstrated the constant currency growth acceleration in revenue and sales-led subscription revenue that we called out last quarter. Q1 total revenue was $478 million, growing 15%. Sales-led subscription revenue grew 18% to $399 million and we delivered a non-GAAP operating margin of 16.2%. As we previously noted, we entered fiscal 2027 with a plan to accelerate our sales-led subscription revenue growth on a constant currency basis over the course of the year, and our Q1 results demonstrate that we are off to a good start. Customer demand was strong across all solution areas, especially in search and AI and security. We ended Q1 with more than 1,800 customers spending $100,000 or more in ACV. This is the highest quarter-over-quarter net additions to this $100,000 metric that we have ever seen. Our 21% CRPO growth and 27% RPO growth signal that customers are continuing to make multiyear commitments to our platform as long-term AI transformations are taking hold. AI is reshaping the stack that developers build upon. The focus is no longer on token maxing. It is on building agentic applications that leverage the reasoning and influencing power of LLMs on a business's proprietary data. This requires the highest possible retrieval accuracy at the lowest possible cost. That shift plays directly to Elastic's strength, and we have invested accordingly in critical areas. First, we have invested in a highly optimized data store and retrieval for AI. Our goal is for Elasticsearch to be the best store for all data that our customers care about, enabling text, vector and hybrid search across structured and unstructured data, spanning text, vectors, images, audio, video and more. We released Vector DB index mode and auto calibration this quarter giving developers a high-quality vector search experience out of the box with no manual tuning required, one platform with support for every data type AI demands. Second, in precisely accurate context, we continue to be one of the world's most powerful context platforms for AI. This quarter, we brought Jina's multimodal and multilingual semantic search capabilities, including first-party embedding and reranker models to on-premises and air-gapped environments. This extends the power of our first-party models to the world's most sensitive, regulated and security-conscious deployments. Our agent builder harness continues to mature as well, enabling developers to build agents directly on top of data in Elasticsearch. Agent Builder now offers advanced agent observability, monitoring and enhanced human-in-the-loop approval workflows, giving enterprises the control and visibility they need to deploy AI agents with confidence at scale. Our investments are translating directly into competitive wins, a Global 2000 semiconductor company selected Elasticsearch serverless in a 7-figure new logo win to power a personalized AI-driven knowledge search experience for its customers. Elasticsearch will serve as the context layer transforming the company's vast product catalog into real-time grounded AI context. When a customer queries a chip specification, compatibility requirement or part number agent builder returns an accurate answer with per user document level security, ensuring each customer sees only what's relevant to them. In a competitive RFP against pure-play vector databases and other platform players our hybrid semantic retrieval and natively integrated agent capabilities were the decisive differentiator. AI is also changing the arena of observability as organizations build and deploy more agents, it requires more scalable monitoring of the entire application stack at a lower cost. And the speed and scale of AI deployments is requiring more automation for SRE teams to streamline the process of detecting, investigating and remediating issues. We are pushing the frontier in these areas through targeted investments. This quarter, we relaunched our metrics offering. We released columnar mode in Elasticsearch 9.5, now in technical preview. Columnar mode is an entirely new index mode, purpose-built for time series data. It delivers extremely efficient compression, storage and querying of time series in a columnar data structure, pushing storage costs down 20% to approximately 3 bytes per metric sample while still using the same ES|QL query language. With these innovations, we are now an optimized engine for multiple types of data, including documents, vectors, logs, metrics and more. Columnar mode makes the Elastic platform a highly competitive solution for metrics and infrastructure monitoring, an area where we historically have not had a major presence. Additionally, we now support native Prometheus ingestion with PromQL support, simplifying the migration from Prometheus into Elastic. No new tooling or retraining is needed. We are giving teams full visibility across metrics, logs and traces at 1 unified platform, all at a very compelling price compared to incumbent competitors. We also acquired Deductive AI, a leader in the emerging space of AI SRE. Deductive has built a reinforcement learning or RL harness that automates the task of complex investigations. It pairs upstream data like code repositories and Elastic alerts with downstream signals from Slack, PagerDuty and ServiceNow to dynamically construct decision trees as it learns from past and ongoing investigations. It then uses these to drive automated investigations for new incidents based on past learnings. This allows SRE teams to significantly reduce the time to investigate and remediate problems to achieve the goal of an AI-led SRE organization. By integrating Deductive's reasoning capabilities into our Observability platform, we are building a true agentic SRE, one that can autonomously detect, investigate and guide remediation across the full signal stack. This quarter, Gartner recognized Elastic as a leader for the third consecutive year in the Gartner Magic Quadrant for Observability Platforms, reflecting the strength of where we already stand. Illustrating the power of this unified platform approach, a leading global insurance company added Elastic Observability to its existing security deployment in a 7-figure expansion win. The customer had been running a fragmented environment with application logs in Elastic and metrics and traces in another incumbent solution, preventing effective root cause analysis across tens of thousands of annual incidents half attributable to application issues. The deciding factor was Elastic's newly released native Prometheus ingestion and PromQL support, which met their heavily metrics-driven environment where it was. And combined with our migration tooling, enabled full consolidation onto a single OpenTelemetry-first platform without any costly rip and replace. Looking ahead, the ability to apply Elastic AI agents across all signal types to intelligently identify root cause was a key driver of the expansion. In a post-Mythos world, organizations are facing an increasingly challenging landscape, where vulnerabilities are being discovered at an alarming rate and weaponized at machine speed. This requires cyber defenders to detect, investigate and mitigate at speeds well beyond human capacity alone. To bridge this gap, AI-driven automation has become an absolute necessity for cyber defenders. Accordingly, we have invested in several areas to help our customers achieve their end goal of an AI-driven SOC. Attack discovery reached a new milestone this quarter. It now investigates and validates threats autonomously allowing SOC teams to move at machine speed. Attack discovery turns a wall of alerts into a prioritized list of real attacks and moving security teams closer to Alert Zero. Alert Zero is the SOC version of Inbox Zero, a queue worked down to the attacks that actually matter with agents and analysts operating together. This quarter, we were named a leader in the IDC Marketscape for worldwide SIEM and a strong performer in the Forrester Wave for extended detection and response. Forrester specifically recognized that Elastic's strategy envisions an open agentic SOC that will automate operations. Elastic XDR integrates seamlessly with our SIEM and attack discovery capabilities, enabling protection and remediation on infected systems to counter AI scale threats. And on endpoint protection, Elastic Security is the only vendor to achieve 14 consecutive months of 100% detection rates in AV-Comparatives independent testing. Our strength in security is also allowing us to rapidly grow our footprint in the U.S. public sector through the CISA SIEM-as-a-Service offering. This relationship continues to serve as a powerful channel across the U.S. government opening new opportunities. A large U.S. public sector agency chose Elastic Security and Observability to begin unifying its fragmented data estate onto a single platform, replacing disparate SIEM data. Elastic's newly achieved FedRAMP High authorization, unlocked the opportunity and our ability to monitor both on-premises and multi-cloud environments from one managed deployment made us the strongest candidate. Where the agency's previous vendor had stalled on innovation, Elastic's pace of development and LLM-agnostic AI integration gave them a clear path forward for modern threat detection and response. Our efficiency and AI features were key drivers of this win. What is exciting about this customer is that we were able to migrate their very complex data platform from their incumbent solution onto Elastic in under 1 month taking advantage of all of the automated migration tooling that we have built for this purpose. We see the same momentum in the private sector. A global semiconductor manufacturer chose Elastic Security Serverless as its security analytics platform to protect against insider threat and secure its intellectual property using our AI capabilities. The customer intends to move hundreds of dashboards from an incumbent solution into Elastic to leverage our natural language search and analytics capabilities. Now moving away from manual workflows, the customer is adopting our agent capabilities across their full data estate. When competitors offered AI as an add-on, Elastic's fully integrated platform gave the customer exactly what they needed, one product built for the age of AI. All of these innovations, combined with the consistent sales execution are driving rapid growth in AI usage within our customer base. Over 37% of our 100,000-plus ACV customers are now using Elastic for AI, up from approximately 21% a year ago. That is more than 670 high-value customers now using Elastic for AI use cases with 70 net additions quarter-over-quarter in Q1. Our ability to deliver all of this with an open platform across both cloud and self-managed deployments is proving to be an enduring advantage as AI adoption grows across AI natives, enterprises, regulated industries and government agencies around the world. This includes our support for both proprietary models and open models like GLM from Z.ai, our adherence to standards like OpenTelemetry, our ability to support sovereign deployments through our self-managed offering and our partnerships with NVIDIA and Dell around their AI factory and with Google distributed cloud. We entered this fiscal year with 7 successive quarters of strong sales execution and continuing momentum for our platform. Our pace of growth in search and AI and security has continued. And with our most recent innovations in the areas of metrics and AI SRE, we are excited about the prospects of our Observability business. As AI adoption grows across the enterprise, we expect to continue driving acceleration of our business toward our midterm revenue and profitability targets. I also want to take a moment to recognize a board transition. I want to thank Caryn Marooney, who will be stepping off our Board after a long tenure. We are grateful for her partnership and she will continue to be a friend to Elastic. I am pleased to announce that Julia Liuson has been nominated to join our Board. Julia has seen Elastic grow as a leader in the areas of search, AI, observability and security. In her prior role as President of developer tools at Microsoft, she brings a unique perspective around AI and at scale infrastructure development that will be invaluable as we continue to execute on our strategy. I want to thank our customers and partners for their trust, our shareholders for their continued partnership and our employees for their focus and execution. With that, I will turn the call over to Navam.

Thank you, Ash. On our last earnings call in May, we expressed confidence that our commitments we secured in fiscal '26, combined with our continued sales execution, will drive revenue acceleration over the course of fiscal '27 on a constant currency basis. While it's still early in the fiscal year, our Q1 results put us on track to achieve this goal. Our total revenue in the first quarter was $478 million. We grew approximately 15% as reported and on a constant currency basis. On a constant currency basis, Q1 growth accelerated quarter-over-quarter, up from 14% in Q4. Sales-led subscription revenue in the first quarter was $399 million. We grew 18% as reported and 17% on a constant currency basis. Similar to total revenue, sales-led subscription revenue accelerated quarter-over-quarter in constant currency, up from 16% in Q4. Our CRPO in the first quarter was $1.2 billion, representing 21% growth as reported and 20% on a constant currency basis. Our constant currency CRPO growth sustained 20% growth for the second consecutive quarter. Our RPO for the first quarter was $1.9 billion, representing 27% growth, both as reported and on a constant currency basis. As Ash mentioned, the continued strength in RPO reflects customers deepening their long-term commitments to Elastic as a core part of their AI infrastructure. Our Q1 revenue acceleration on a constant currency basis, both for total and for sales-led subscription revenue as well as our second straight quarter of 20% constant currency CRPO growth provides validation for acceleration trajectory. Three core dynamics are powering our fiscal '27 sales-led subscription revenue growth. First, our strategic investments in sales capacity over the past year are driving the pipeline improvements we expected. Building on 7 quarters of go-to-market improvement, we continue to see year-over-year gains in both ramp sales head count and productivity this quarter. Additionally, the strength in our second quarter pipeline and buildup of out quarter pipeline reinforce our confidence in securing new and expanded commitments as well as achieving our planned renewals. Second, as we discussed last quarter, a portion of our fiscal '27 revenue is made up of commitments from fiscal '26, now being consumed and converted into revenue. We are pleased with the healthy consumption activity we saw this quarter. The net expansion rate or NER remained strong, though it moved from 112% to 111% this quarter. As a reminder, our NER is a 4-quarter trailing metric impacted by historical growth. The NER we reported in Q1 reflects the lower constant currency growth rate in the trailing 4 quarters as compared to the 4 quarters preceding it. We expect NER to improve within 4 quarters as constant currency revenue acceleration builds through fiscal '27. Third, we saw continued improvements in our new and expansion commitments as seen in our greater than $100,000 customer count, that segment now contributing 90% of sales-led subscription revenue, up from 87% a year ago. This quarter, we added more than 80 net new customers to this tier, our largest increase to date. This reflects the effectiveness of our sales team in both winning new logos and expanding within our existing base. Now turning to Q1 margins and profitability. I will discuss all measures on a non-GAAP basis. We delivered subscription gross margins of 81%, total gross margins of 77% and an operating margin of 16.2%, exceeding our guidance from last quarter. The improvement in margins reflect the operating leverage in our model as revenue scales. We achieved an adjusted free cash flow margin of 30% despite onetime charges related to organizational changes we announced in June. These amounted to $13 million of cash paid for restructuring and other charges. As a reminder, adjusted free cash flow fluctuates quarter-to-quarter due to booking seasonality, and we manage free cash flow on a full year basis. During the first quarter, we returned approximately $40 million to shareholders, representing purchases of approximately 800,000 shares. Since the $500 million share repurchase program launched in October 2025, we used $380 million and repurchased 5.2 million shares cumulatively as of the end of last quarter. Now turning to our outlook for the second quarter and for the fiscal 2027. Building from the momentum we experienced in Q1, we are raising our previous guidance for the full year. For the second quarter of fiscal '27, we expect total revenue in the range of $486 million to $487 million representing 14.9% growth at the midpoint or 15% constant currency growth at the midpoint. We expect Sales-led subscription revenue in the range of $407.5 million to $408.5 million representing 16.9% growth at the midpoint or 17.1% in constant currency growth at the midpoint. We expect non-GAAP operating margin for the second quarter to be approximately 19%. We expect non-GAAP diluted earnings per share in the range of $0.80 to $0.82, using between 108 million and 109 million diluted weighted average ordinary shares outstanding. For fiscal '27, given our strong Q1 results, we are raising our outlook for the year. We expect total revenue in the range of $1.998 billion to $2.010 billion, representing approximately 15.2% growth at the midpoint or 15.3% constant currency growth at the midpoint. We expect Sales-led subscription revenue in the range of $1.682 billion to $1.694 billion representing 17.4% growth at the midpoint or 17.5% in constant currency growth at the midpoint. We expect non-GAAP operating margin to be approximately 19.4%. We expect non-GAAP diluted earnings per share in the range of $3.29 to $3.37, using between 108.5 million and 109.5 million diluted weighted average ordinary shares outstanding. We continue to expect our fiscal 2027 adjusted free cash flow margin to be 21.5%. We are growing revenue efficiently while maintaining disciplined investments and are making progress towards Rule of 40. Before I close, a few more financial items worth highlighting related to this year. We incurred approximately $20 million of restructuring-related charges during the first quarter, and we expect to incur an additional $2 million to $5 million of restructuring charges for the remainder of the fiscal year. We expect our GAAP operating margin to be positive in the second quarter and for the full year. We also expect to maintain GAAP operating margin profitability going forward. And last, as we said last quarter, we expect total revenue and sales-led subscription revenue growth to accelerate in the second half with Q4 having the highest year-over-year growth for the year. To summarize, we are executing well across our fiscal year priorities and are firmly on track to meet our medium-term financial targets of both accelerating our sales-led subscription revenue growth to 20% plus and improving our Rule of 40 as measured as a sum of revenue growth and adjusted free cash flow. The sustained progress we see in CRPO, sales productivity pipeline and operating leverage reinforce our confidence in our revenue growth and margin expansion plans. Elastic continues to be the essential platform for enterprises looking to derive value from their data, and we look forward to the opportunities ahead. Thank you for your continued support and for joining us today. With that, I'll open it up for Q&A.

[Operator Instructions] Our first question today comes from Matt Hedberg with RBC Capital Markets.

First of all, congrats on the quarter. The acceleration especially after a 4Q was impressive. Ash, there's a lot of things that stood out to me, the strength in 100,000 customers. I think you said the largest sequential add you've ever seen was impressive. I guess, you talked about a lot of things on the call about execution and product traction and just better sales capacity. But I'm wondering if you can put a finer point on the success there. Why now? And just kind of the sustainability of that large customer growth would be great.

Matt, thank you very much for the question. And like you said, it was a great quarter in terms of the net adds. We added 80 customers to that cohort, the highest ever number of additions that we've had. Fundamentally, the way I think about it is that our new and expand motion, especially in our enterprise and mid-market high-propensity customers is working really well. If you remember, about 2 years ago, a little over 2 years ago, we made a change to the way we did segmentation within the organization, within the sales organization. And since then, you have seen us continue to improve in this area. And what you're seeing is customers are making bigger commitments customers are making longer-term commitments. And that's resulting in this cohort really growing very nicely. By the way, this $100,000 cohort now represents 90% of our sales-led subscription revenue. So it just gives you a sense both of how important this cohort is, but also how well they are doing. And the thing that excites me the most is the AI penetration in this cohort. So 37% of this 100,000 cohort is now using our AI features. That number was about 21% in the past. And like we explained even at our Financial Analyst Day, the more this high-value customer cohort uses our AI capabilities, the more they use more and more solutions within our platform, that really becomes the enduring growth driver for us. So very excited about it, and it just shows that the go-to-market motion is working and the platform strength and differentiation is holding very well.

Well, if I could, as a follow-up, the 37% of those customers using the AI, it was another thing that stood out to me. Is there any way to think about what that means from an NRR perspective? I have to imagine it's obviously additive and maybe it's part of the NRR reacceleration. But just any way to think about what that means from like a customer ACV or NRR perspective?

That question. So net, the NRR is obviously a strong metric across the board for all our 100,000 customers. But when you think about the cohort of customers that are that are using AI, the dynamics that we talked about during the financial Analyst Day still stand, which is they have a higher growth propensity compared to customers not using AI, so that dynamic exists today among that AI cohort group the same way it existed when we talked about in the Financial Analyst Day.

The next question comes from Tyler Radke with Citi.

Tyler, can you guys hear me okay?

We can now.

Sorry about that. I was on mute there. Can you just talk a little bit, obviously, really strong cloud performance. And I know you alluded to the strength in the cloud bookings last quarter. But any one-off dynamics we should be mindful of? And can you just comment on sort of the bookings mix this quarter, how that cloud sort of looked relative to historicals? And just any color on how we should be thinking about the growth of cloud from here?

Yes. Thanks, Tyler. It's Navam here. So look, we're very pleased with the way cloud has been performing in the quarter, both in terms of the commitment volume. And also, more importantly, the consumption against the annual commitments we have, the aggregate annual commitments we have. And as a reminder, cloud is not a guided metric and there's always going to be quarter-over-quarter variability because it's consumption. But our annual cloud growth improved to 27% this quarter, up from 26% last quarter. On the monthly cloud side, that number, we expected it to remain flat and it remained roughly flat for the quarter. So the dynamics are roughly the same in terms of the growth on the sales-led cloud side and the SMB smaller customers remaining flat. At the end of the day, though, we win because we have flexibility in our deployment model, right? And we meet the customers where they are and where they want to deploy our software, and we are one of the very few players that can actually do that. And that's the reason we continue to focus on sales-led subscription revenue. In terms of bookings dynamics, we expect to, like I said, meet customers where they are. There isn't much to call out this quarter in terms of one-offs. We talked about the mix in Q4 being a good cloud quarter. Q1 remained a solid quarter with no unusual activity one way or the other.

And by the way, Tyler, just to put a finer point on what Navam said. The fact that we can deliver all the capabilities that we provide through the platform, whether it's for AI, whether it's for security, whether it's for observability in environments ranging from commercial cloud to people running it in their own data centers to air-gapped environments, we have -- we mentioned last quarter that Google Distributed Cloud has OEMed our capability as well. So that flexibility, that range is a significant enduring moat. Because if you think about the markets that we play in, there are very few vendors that have that ability to deliver across all of those form factors, and that is a big advantage for us. And that's the reason why as Navam said, sales-led subscription revenue is a very important metric. And by the way, cloud self-managed, all of those are things that we look at, and we are very happy about the performance overall.

Great. And Ash, maybe just get a follow-up for you. Obviously, some pretty remarkable events going on in security as it relates to some of the new attack vectors and agents going rogue. Like can you just talk to us about the Elastic Security business, how do you see it participating in some of these new agentic security fronts?

Yes. Our security business is something that we are very, very excited about. Even in my prepared remarks, Tyler, I talked about several customers, right, that are using us in security. I talked about the semiconductor company. I talked about the government did the very large government agency. We've talked to you in the past about our CISA SIEM-as-a-Service. I just mentioned Google Distributed Cloud. All of these are already driving our SIEM business and our XDR business. And what's great about this is we are able to help our customers because it's never been harder to be a CISO. Threats are -- vulnerabilities are being discovered faster. Threats are being activated faster. So sort of working at human speed is just not sufficient. You have to figure out how to use AI on the Defender side, to be able to detect, investigate and remediate at machine speed and you know how early we invested in sort of the AI-led capabilities like attack discovery and so on. And all of that, the maturity, the continuous innovation that we are driving there, we are already seeing all of this turn into strong commitments, and you're seeing now the consumption against those commitments. So I expect the momentum to continue for us in security.

The next question is from Miller Jump with Truist Securities.

Congrats on the strong results here. You mentioned customers choosing you for flexibility and highlighted some of the enhancements to Jina on-prem capabilities this quarter. I'm wondering if you can give any more color on how you're seeing the distribution of customer AI deployments developing specifically across cloud, on-prem and hybrid and if there's any difference versus your other use cases?

Yes. It's -- so what we are seeing is that there is still the majority of customer deployments tend to be first and foremost in cloud, that's where they typically start because that's the fastest way for customers to get started but enterprise customers and government agencies. And I say enterprise customers I'm specifically referring to customers in regulated industries, whether it's banking, whether it's telco, especially in international markets for us outside of the Americas, what we are seeing there is a greater desire to not just have data sovereignty but also to have operational sovereignty. And in those environments, they want solutions where they can run these capabilities within their own enclaves, within their own control. And again, like that's where we have such a great strength because there aren't too many companies that are able to provide that kind of functionality. And in the past, our genome models, you had availability of those of the commercial genome models through our inference service, which was cloud only, but there was no way if you're an air gap customer or a customer running things within your own enclave to take advantage of the Jina models, we didn't have a pricing model in place for sort of the commercial capabilities there. So that's what we launched. And there's a lot of interest. We launched it because we're seeing a lot of interest. So going forward, what I would expect is AI deployments are going to be based on factors like the criticality of the data, the sensitivity of the data, the kind of customer in their geo location, so those will be bigger factors, but you're going to see AI adoption both in cloud and in self-managed?

Really exciting. If I could just squeeze in a follow-up for Navam. You all highlighted the strength in the SSA deal but just given that we're coming off on the anniversary, I'm wondering if you can give any more color on how the Fed vertical is being treated in the Q2 guide and if there's any headwinds or tailwinds we should consider this year?

Nothing specific at this point in terms of guidance for the Fed vertical, Miller. The global public sector remains an important sector for us. When we think about our guidance, we obviously look at a prudent risk-adjusted view as to forward numbers. Very pleased with how the SSA contract is performing and the continued activity there. So we expect that to continue to gain momentum as more agencies come on board. But nothing specific to call out in terms of a big tailwind coming in or a big headwind coming in from the Federal segment.

The next question is from Brian Essex with JPMorgan.

Congrats from me as well on the results. It's great to see that acceleration. Maybe ask for me, I'd love to get your view on how you see your customers deploying AI and coding around AI, specifically around leveraging your platform to build their own harness in context windows to get more control around the ability to protect that context IP and proprietary data as opposed to using OEM harnesses and coding platforms? And how that -- how you're positioned for or your view on how that portion of the market is going to evolve over the next few years?

Yes. And yes, the first thing to appreciate is, at the end of the day, when you're building any kind of agenetic solution the most important element in that is going to always be the large language model; the model that does reasoning, that does inferencing and so on and so forth. But that model, unless what the agent that you're trying to build only depends on external data, only depends on like publicly available information, is going to need to somehow be coupled with your proprietary information. Now if you think about any enterprise, you think about any large agency, the biggest challenge is, now you're talking about many, many petabytes, if not exabytes of information, information that's constantly being created, information that's constantly changing and so this really ends up being a situation where you have to bring the model to the data. The data is just too much to take to the model. And more importantly, that data is your secret sauce. So you never want to have it completely exit your organization anyways. And so that's really why as you think about what people are building with harnesses and so on, the most important element in that is sort of the data retrieval or the context layer and when you are trying to get that context for your LLM, for your agent, you have to worry about accuracy. You have to worry about speed and you have to worry about cost. And what that means is you really want to try and precompute as much of that context ahead of time as possible so your model isn't just constantly trying to sift through all of the data every single time, which is a very expensive, very inefficient, very slow approach. And that's what we do. That's where we fit in. That's the reason why customers turn to us because we're able to make their agents perform better. We are able to make their agents more secure in how they operate, we are able to provide just the right context to their agents, and we are able to reduce cost and give them that balance of both using proprietary models where it makes sense, using open models where that's the best approach. So that flexibility, that deployment choice, all of this is how people are using us today. And that's why we believe that this is something that's an enduring motion for us. It's an enduring area for us to grow on.

Got it. Maybe that's super helpful color. And maybe just for a follow-up. Security as a percentage of total revenue and in a post Mythos world, how do we think about contribution from that business relative to the rest of the Elastic platform?

As a percentage of revenue, we don't disclose that, Brian. But in terms of growth, security remains a very strong growth vector for us. And we've highlighted this in the press earnings call as well as to the contracts and the customers that we have on the security side. So very pleased with how that's performing, and it remains to be a high-performing, high-growth segment for us.

Even this quarter, if I may just add to what Navam said, we had -- security was -- grew incredibly well. The order roughly was security, AI, search AI and then observability and with observability with what we're doing around metrics, the deductive acquisition, like that's the third pillar of the stool, if you will. That's what gives us a lot of optimism in the future. So really, like we feel really good about the way our platform story is evolving here.

The next question is from Rob Owens with Piper Sandler.

Thanks for the question, Alex. In your prepared remarks early on, you talked about success in the quarter. You talked about search and AI and security. And I know you've got new capabilities in observability, Ash, and you just mentioned some them, but maybe you can drill down relative to the metrics opportunities, some of the new pricing dynamics that you offer and just what customer feedback or acceptance has been at this point?

Yes. Thanks for the question. And Rob, the way we have built our absorbability business over the years is starting with logs. As you know, log analytics was where we started because the messier the logs, the more capable our solution has been in giving you the ability to do full tech search through those logs, to do analytics on those logs. And so our strength in log analytics continues. It's been a huge area for us. And over the years, we've continually made our platform more efficient for log analytics, which is another reason why we continue to do well in that area. But sort of expanding from there has been an area where, as we've looked at the market, what we realized was metrics because of AI and what's been going on in terms of people building these agents, that's an area where we didn't have that same kind of strength. We didn't have that same kind of performance. And so about 1.5 years ago or so, we started working on a completely novel back-end to Elastic Search that allowed us to have not just the regular document store model that we had in Elastic search but also a columnar store backend and all accessible through the same API because again, we want to make it easy for people to adopt this columnar backend. And this columnar backend has been really tuned for basically all kinds of time series data. So metrics, and even simple logs, and this columnar approach makes it possible for us to store the data in a much more efficient way. So the storage efficiency is massively higher. The ingest performance is better. The query performance is better. So we get a ton of benefits and it's going to show up most in metrics. And in the past, it used to take us double-digit bites to store metrics. We are now able to store a single metric in around 3 bites, which is a huge difference. And now we are incredibly competitive in the market. This is going to allow us to really take on this area head on. And we are early, like I have to say, but the early feedback that we've gotten from customers because we are going to our existing log analytics customers and upselling there, has been very good. So we are excited about the feedback that we are getting. But the way I see it is if we do this right over the next year, multiple years, this is going to be a pretty significant and meaningful area of growth for us.

Great. And speaking of early, you mentioned a number of autonomous innovations this quarter across both security and observability. So curious, just early feedback from customers. Obviously, the security landscape is changing rapidly. So for those on the bleeding edge, how are they consuming? What does overall consumption look like? Or what's that relative state of change for those that are moving to some of these autonomous capabilities?

Our AI SoC capabilities on the security end have been a big reason for our success in security. So you've been seeing us do very well in security for the last many quarters. And I attribute a lot of that to the investments that we made and the differentiation that we have in our agentic capabilities when it comes to security. And the biggest differentiation that I still hear from our customers is not only do we have a very, very complete set of capabilities out of the box, but unlike others who have a black box approach to AI we have more of an approach where we allow you to see what's under the covers. You can see the skills. You can see the tools inside the harness, inside the security harness that we built. So you can complement it, you can enhance it, you can do more with it. That is a big differentiator because at the end of the day, we believe that models are going to keep getting better and for different tasks, some tasks, you're going to prefer to use Claude, for others you're going to prefer to use Gemini, for something else you might use an open source model. Also skills will continue to evolve. Harnesses will continue to get better and we believe that giving that openness in choice to our customers will be an enduring differentiator. And that's what we are seeing so far.

And just as a reminder about our metrics webinar on September 22, that information is going to be posted on the IR website. And with that, let's go to the next question.

The next question is from Raimo Lenschow with Barclays.

Congrats from me as well, a great quarter. A couple of weeks ago, you launched Kubernetes capabilities on the observability side. Can you speak to the importance of that because that seems to be closing a really important gap in the offering? And maybe just speak to what's possible now.

Yes. A lot of it has to do, Raimo, with our focus on having a great end-to-end experience. And the areas that we want to make sure customers adopt us increasingly for is using us for metrics, using us for infrastructure monitoring. And as you know, a lot of agents are being deployed on Kubernetes environments and getting that right with a great end-to-end experience with dashboards that light up out of the box with sort of native support, not just for OpenTelemetry-based ingestion and analytics, but also support for Prometheus data and PromQL, like these are areas where we've invested a lot. Even in the prepared remarks, the customer that I talked about that chose us for metrics, that customer moved to us because we made it so easy for them to bring their Prometheus data directly into Elastic without having to transform things, without having to change things. And that's a big differentiator. So you're absolutely right to look at that and see that, that is a key element. It is one of many investments that we've been making on the observability side. And that's what is quite -- we find that to be quite exciting for the days ahead.

Perfect. Same view here. And Navam, one for you, like it's like you only had your Q1, but you raised the full year by more than the beat and Q1 nowadays in software, everyone is very conservative, et cetera. What gives you the confidence there? What are you seeing in terms of pipeline, et cetera?

Yes. Thanks, Raimo. I don't think the guidance philosophy has changed much compared to what we've done in the past. We've always taken a prudent and risk-adjusted view to guidance. But like you said, it is only Q1, but it was a good start to fiscal '27, and we got some strong data points from that quarter. Our cRPO, obviously, which was a good number and the RPO number as well as the $100,000 adds. Apart from that, there were 3 specific drivers that we saw internally as well. First is the strong pipeline build, both for the second quarter and the full year, the out quarter pipeline build is looking good. Second is the consumption against the cRPO, committed cRPO number performed well. And then third, we expected a certain productivity and capacity increase given the hiring that we did, and we're seeing that, and that's allowing us to have the confidence on the go-get number that we need to do for the net new revenue side for the rest of the year. So that's the reason we guided the way we did, and we're encouraged about the revenue trajectory for the year. So it hasn't changed. The philosophy hasn't changed, but we feel good about what we need to go achieve for the rest of the year.

Next question is from Howard Ma with Guggenheim.

I want to add my congratulations too on a strong quarter. My question is, is the acceleration that you're seeing, would you say that, that's directly attributable to higher multiproduct adoption driven by the realization that Elastic is an attractive solution for both context engineering and managing the agentic-driven proliferation in telemetry data as opposed to point solutions. And does your guidance factor in material acceleration in cross-sell among various use cases?

Yes. Maybe let me touch upon that and then Navam might -- I'll let Navam talk about all things related to guidance. But just if you think about our motion, it's always, Howard, been very similar, right? So we have a platform that allows customers to do multiple things. And what we focus on is making sure that our platform is incredibly good in each of those areas. So each of our solutions, our focus is on making sure that those solutions are able to be differentiated and stand on their own and win on their own. And that becomes the tip of the spear for us. It's our land and then expand strategy because once we land with one solution, then the goal becomes how do we get the other solution in there and the third solution in there. And obviously, like we had talked even at our Analyst Day, our last Analyst Day, the customers that grow the fastest are the ones that adopt us for all 3 solutions. So that land and expand motion has continued. And it's not that necessarily that, that has inflected in any way, but this is what you're seeing here is just the right kind of progression. This is a motion that we've been driving. Probably the biggest thing that has happened is as our focus on our enterprise selling motion, the segmentation change that we did 2 years ago, as that has matured, we are seeing the benefits of that play out very, very nicely. So our land and expand is working. In all 3 solution areas, we are seeing the right kind of movement. And look, it comes down to making sure that you are positioning your platform, your product in the right way. And then our sales teams know how to position the multiple platform -- the multiple product strategy within that platform. And that's why we feel so good about what this is going to mean for the future.

In terms of the guidance, Howard, there's nothing different implied in how our land and expand motion works. Obviously, there's a lot of our revenue comes from expand more than land. Land is the entry point and then expansion is where the dollars come in over time. And that dynamic comes from both expansion of the existing product that you bought and also cross-sell. So there isn't anything in the guidance that we've taken into account a different behavior from our customers from what we currently see.

The next question is from Radi Sultan with UBS.

Ash, in your prepared remarks, you called out a SIEM migration, which I believe you said got done under a month with some of your automated migration tooling. I just wanted to ask how much of a benefit are you seeing to cloud consumption from AI accelerating migrations on the SIEM side, but also maybe just more broadly?

Yes. So the consumption that we saw was -- the strength in consumption that we saw this quarter was broad-based. It was not related to any one customer. But what I talked about there, which is really important to understand is, at the end of the day, SIEM has never been sort of greenfield, right? SIEM as a space has been around for a long time. And our motion has been to displace the incumbents who are not innovating at the same rate. What's really changing there, to be honest, is the environment. People are really worried about what it means to protect your environment, protect your agencies and so on in a post-Mythos world. And it's not just Mythos. There are so many very, very capable models out there, not just commercial models, but open source models that give you the ability to really discover vulnerabilities and then act upon them. So you have to assume that people who are trying to do harm now have the ability to access these models. So defenders are having to move faster and so on. So that is driving the momentum for our business. and the ability with our tooling, with our automated tooling to migrate these customers from their incumbent solution to our product, our platform, we have gotten really, really good at it. This was a very significant sized agency, and we were able to move their massive real estate over in 1 month, in under 1 month. And that is just the thing that gives our field a lot of confidence. It is what gives our customers a lot of confidence because as they see these things happening over and over again, it gives them confidence that they can safely move to Elastic and that we will be able to make them successful quickly.

The next question is from Shrenik Kothari with Robert Baird. The next question is from Mike Cikos with Needham.

This is Matt Calitri on for Mike Cikos over at Needham. And you gave some great color on that $100,000 cohort and some of the AI adoption, which we appreciate. Are there any other clear underlying expansion trends you can share regarding older cohorts versus newer ones or smaller customers versus larger ones? Or is it more so just expansion across the board and you're waiting for that trailing 12-month net expansion number to catch up, as you mentioned in the prepared remarks?

Yes. Thanks, Matt. So the trailing 12-month number on the NER -- the NER side is impacted by the trailing 12-month constant currency growth. So that's a separate factor. And as constant currency growth improves alongside guidance that we've provided, it's going to take a lagged effect for the NER to catch up. So that's the comment on the NER side that I was making. But on the cohort behavior, the cohort behavior that we talk about is basically a durable land-expand motion, so we get our customers in. And there's a long period of durable expansion that we expect from every one of those cohorts, and that's continuing. And we also expect to see and we see the AI cohort show a differential in our growth, meaning the customers who are using our AI features are effectively expanding at a slightly higher rate than the ones that aren't. So those are the 2 dynamics that we see in our expansion rates. And those trends are continuing. And as I mentioned, the NERs, which is trailing, ticks up alongside the revenue growth rate that we expect to post for the year.

The next question is from Sanjit Singh with Morgan Stanley.

Ash, I see a lot of the passion on the SIEM side and obviously throughout the other core parts of the business as well. I wanted to come back to the AI search part of the business. We have a lot of data platform players trying to solve that context semantic problem. I think Palantir has said it in a proprietary way. So from the Elastic perspective, in terms of getting that agent performance and building that map for that agent, why is Elastic able to do that better than some of the other data platform peers that are trying to solve with that similar problem?

The simple answer, Sanjit, is because we've always been optimized for dealing with messy data for dealing with unstructured data. Most of the data platforms that you're talking about that you might be thinking about were all designed to work with structured information. And fundamentally, although they might have had a sort of no SQL view of the world, it was still sort of designed with strict schema structure in mind. Elastic has always been different in that sense. If you think about Elastic, we started as a document store with an inverted index that allows you to put any and all kind of information in it, which is why we were always used for search, which is why we then moved into log analytics because all of these things end up being very unstructured. The schema keeps evolving. And if you think about the kind of information that is being used primarily, a lot of it in AI is this kind of unstructured data. So our strength in terms of being able to bring in this data, being able to then analyze it, search across it, the capabilities that we've built, not just with vector search, but also around hybrid search, the harnesses that we've built on top of it, all of this, the Jina models, our ability to do reranking and so on. We are way ahead of the competition, especially when you look at things from this unstructured lens. And frankly, Sanjit, we feel that we are still very early in this overall phase of AI adoption. Most organizations are only now starting to really deploy things in a meaningful way. So as that grows, as we have more penetration within our customer base, I think that's going to be what really helps us continue this momentum for a very long time.

The next question is from Ryan MacWilliams with Wells Fargo.

One for Navam. How should we think about the gross margins in the quarter? It looks like they were just slightly lower versus previous quarter. I mean, perhaps some impact from the mix shift from cloud here, but anything else worth calling out? And maybe how should we think about gross margins for the rest of the year?

Yes. Look, we're very pleased with how our subscription gross margins are performing. It's remained above 80%. Really, there's nothing specific in terms of a trend that emerged this quarter. But over the longer term, what we expect is that these gross margins are expected to improve as we see benefits from things like serverless as it gets to scale. So there's going to be fluctuations quarter-over-quarter, but nothing specific this quarter from a trend perspective on margins.

This concludes our question-and-answer session. I would like to turn the conference back over to Ash Kulkarni for any closing remarks.

Thank you very much for joining our call today. We are pleased to report a strong start to the year. We are extremely proud of our results and very excited about the opportunity ahead. Lastly, please join us on September 22 for our public webinar on metrics. Have a great day.

The conference has now concluded. Thank you for attending today's presentation. You may now disconnect.