Frank Pelzer
Analyst · Samik Chatterjee with J.P. Morgan. Your line is open
Thank you, François, and good afternoon, everyone. As François noted, we delivered a very strong Q3. Like last quarter, we are reporting non-GAAP revenue. Non-GAAP revenue excludes the impact of the purchase accounting write-down on Shape’s assumed deferred revenue. For transparency, we are committed to providing both GAAP and non-GAAP revenue during the period when purchase accounting will have an impact on Shape related revenue. On a GAAP basis, Q3 revenue was $583 million. Third quarter non-GAAP revenue of $586 million was up approximately 4% year-over-year and above the high end of million our $555 million to $585 million guidance range. Please note, as I review our revenue mix, I will be referring to non-GAAP revenue measures. Q3 product revenue of $256 million was up 3% year-over-year and accounted for approximately 44% of total revenue. Software revenue was $97 million, growing 43% against a particularly tough comparison of 91% growth in the prior year period. Software continues to grow as a percentage of product revenue, representing approximately 38% of product revenue in Q3, up from approximately 27% in the year ago quarter. We also continue our momentum towards a recurring revenue base with subscriptions of 73% of software revenue in the quarter. Services revenue of $330 million grew 5% year-over-year, and represented approximately 56% of revenue. Revenue from recurring sources, which includes term subscriptions as a service and utility based revenue, as well as the maintenance portion of our services revenue, totaled 66% of revenue in the quarter. Systems revenue of $159 million was down 12% year-over-year. On a regional basis in Q3, we saw strength in Americas and EMEA, with Americas delivering 11% revenue growth year-over-year and representing 57% of total revenue. EMEA delivered 6% growth, representing 24% of revenue. Against a challenging comparison in the year ago quarter, APAC was down 15% year-over-year and accounted for 19% of revenue. Looking at our bookings by vertical, enterprise customers represented 67% of product bookings and service providers accounted for 15%. Government customers represented 18% of product bookings, including 5% from U.S. Federal. Turning to our Q3 operating results. GAAP gross margin in Q3 was 81.8%, non-GAAP gross margin was 84.4%, GAAP operating expenses were $390 million, non-GAAP operating expenses were $327 million, our GAAP operating margin in Q3 was 15% and our non-GAAP operating margin was 28.6%. Our GAAP effective tax rate for the quarter was 20.4%, our non-GAAP effective tax rate was 20.2%. GAAP net income for the income for the quarter was $70 million or $1.14 per share. Non-GAAP net income was $134 million or $2.18 per share. This was above the top end of our guidance range due to our strong revenue performance, as well as disciplined operating expense management. Turning to the balance sheet, we generated $159 million in cash flow from operations. Cash and investments totaled approximately $1.2 billion at quarter end. While we have an estimated $1.3 billion remaining on our share repurchase authorization, we did not repurchase shares during the quarter, opting instead to conserve cash, given the uncertain macro environment. DSO was 47 days and capital expenditures for the quarter were $12 million. Deferred revenue increased 9% year-over-year to $1.3 billion, driven by an increase in maintenance contracts, as well as the acquired Shape deferred revenue. We ended the quarter with approximately 6,020 employees, up approximately 195 from Q2. Now let me share our guidance for fiscal Q4 of 2020. Unless otherwise stated, please note that my guidance comments reference non-GAAP metrics. Our Q4 outlook factors in the expected impact of continued global uncertainty related to COVID-19 and broader economic trends as we understand them today. Near-term we expect customers will prioritize investments that enable them to serve the immediate needs of their customers and employees. We expect to benefit from being a trusted and operationalized partner of the largest enterprises around the world. We also expect customers will scrutinize investment priorities, which could lead to longer purchasing cycles or deferred projects. With this in mind, we are targeting Q4 FY ‘20 non-GAAP revenue in the range of $595 million to $615 million. We expect gross margins between 84% and 85%. We estimate operating expenses of $326 million to $338 million. We anticipate our full year FY ‘20 effective tax rate will be in the range of 19.5% to 20.5%. This is lower than we previously estimated due to a non-recurring impact to foreign tax credits, resulting from an election we made in filing our FY ‘19 U.S. income tax return, which will impact our Q4 effective tax rate. Our Q4 earnings target is $2.30 to $2.42 per share. We expect Q4 share-based compensation expense of approximately $52 million to $53 million. Let me speak briefly on our capital allocation philosophy. With the current environment and interest rates declining, we expect to continue to prioritize building our cash position over near-term share repurchases and over paying down our Term Loan A associated with the Shape acquisition. However, consistent with what we have said previously, we also retained the option of repurchasing shares opportunistically in any open trading window. With that, I will turn the call back over to François. François?
François Locoh-Donou: Thank you, Frank. I will begin by discussing some of our business dynamics and drivers. As an organization, we remain nearly 100% work-from-home and we expect the majority of F5ers will work remotely for the rest of the calendar year 2020. We are taking a phased and cautious approach to returning to our offices globally. In certain geographies, we are allowing a very small percentage of employees to return to the office on a strictly voluntary basis. We also recently lifted travel restrictions in some geographies but we ask employees to consider carefully whether travel is essential and to quarantine for two weeks following their trip. We will revisit our approach regionally as circumstances and local advisories dictate. Despite the continued work-from-home conditions, F5ers remain very engaged and productive. My thanks to the entire F5 team for their persistence, ingenuity and resiliency in these unprecedented times. Together, we delivered a very strong third quarter, despite it also being the first quarter closed without a single face-to-face customer interaction. While we are very pleased with our third quarter performance, two quarters in we also have more perspective on COVID-19’s impact on our business. Overall, demand in our business is proving more resilient in the second half than our initial post-COVID expectations. Relative to our pre-COVID expectations for the year, we are seeing evidence of three expected COVID-related headwinds. First, similar to last quarter, while we are seeing strength from overall enterprise, we continue to see caution from the most severely impacted verticals. These include transportation, entertainment and leisure, and retail which combined represent less than 10% of our bookings. Second, our ASEAN and India sales regions were acutely impacted by COVID-19 related order delays in the last several weeks of the quarter. Third, while our sales team has kept up strong virtual engagement levels with customers, the prolong lack of face-to-face engagement is causing some delays with new strategic projects. These headwinds were in large part offset by the advantages of our strong incumbency and our alignment with customers’ investment priorities, resulting in the overall resiliency we have seen in our business. We noted last quarter that customers plan to accelerate their digital transformation because of COVID-19. Our Q3 results are evidence that they are executing against that intent. Large enterprise and service provider customers are increasing their digital engagement and boosting capacity and security on customer facing applications and on platforms that enable employee collaboration. While some customers are moving ahead with large scale transformation projects, we see an increasing number of prioritizing speed and choosing to deploy solutions they have already operationalized. F5’s incumbency, broad solutions portfolio and full hardware to software functionality are clearly an advantage in this environment. With F5, customers can deploy operationalized solutions with confidence knowing their application services can evolve in step with their application and business needs. We also continue to see broad customer demand for subscription-based consumption models across all geographies. In fact, in Q3, the team closed the largest number of subscription deals ever in a quarter. In addition, a growing number of customers are leveraging our broad application service portfolio and our ability to serve both traditional and modern applications. They are choosing F5 to cover a suite of application services using a combination of traditional F5, NGINX and Shape Solutions. As an example, this quarter, we won a hybrid cloud data center redesign with the Department of Health. Our solution delivers speed, visibility, reliability, flexibility and agility, while avoiding the management complexity that comes with multiple vendors. We delivered a detailed migration plan combining highly scalable BIG-IP access policy manager, an advanced web application firewall, global and local traffic managers, along with NGINX Controller and NGINX Plus. We also secured a win to deliver a comprehensive protection strategy for a major service provider. Our solution includes F5 WAF, NGINX, Shape and Silverline managed services. From a use case perspective, application security continues to emerge as a significant customer need for both traditional and modern applications. This is driving four kinds of opportunities for us. First, it is driving core F5 security deployments in both systems and software, including DDOS, SSL orchestration and web application firewall. In one example, during the quarter, a major video conferencing and collaboration tool provider chose F5 to provide global DDOS protection. Second, the need for application security is creating demand for the combination of F5 security on top of NGINX. The power of this combination was part of the rationale for acquiring NGINX last year and we are very pleased with our early traction. Last quarter, we mentioned an NGINX API gateway win that we combined with F5 WAF. This quarter, we secured a win with a multinational financial services corporation using NGINX API gateway and F5 app, Protect. We are enabling them to scale to 10,000 transactions per second, while securing each individual API to their third-party fintech partners. Use cases like this one, enabling best-in-class security on modern application architectures are gaining momentum and we believe will accelerate the appeal of NGINX to large enterprises. The third kind of opportunity driven by application security needs relates to strong customer interest in our Shape portfolio. Customers are looking to Shape AI and machine learning enabled defense capabilities to protect against a growing number of threats, both bots and human. For instance, this quarter, we secured a Shape defense win with a media conglomerate. We are protecting both the web and mobile deployments of their new over-the-top service against credential stuffing and other plants. Finally, we are seeing growing demand for application security as a managed service. In fact, we have layered Shape onto our Silverline managed services platform. The combination means we can provide customers the ability to protect not just the application, but also how the application works. A Shape Silverline combination is ideal for customers who either do not want to own or don’t have the expertise to manage the technology. We believe application security is a meaningful opportunity for F5 and expect demand to fuel growth for several years, but we are not stopping there. I am going to spend the remainder of our prepared remarks outlining for you where we are taking F5, how we intend to leverage and combine the respective strength and trajectories of traditional F5, NGINX and Shape to create adaptive applications and open new addressable market opportunity. We see a future where an application like a living organism will naturally adapt based on the environment. It will grow, shrink, defend and heal itself as needed. The combination of application services, telemetry and automation will enable it to become an adaptive application. Ultimately, adaptive applications will deliver increased revenue, reduce costs and better protection for application owners. We have been sharing this vision with our customers over the last several quarters and the feedback has been resoundingly positive. Our vision strongly aligns with where enterprises see the greatest opportunities for their applications and their businesses. Through our organic and inorganic investments, we are well on our way to delivering this vision for customers. We are creating an application services platform that will help customers accelerate their digital transformation and fundamentally change the way applications are delivered and secured. Let us step back a bit. To deliver engaging user experiences, many things need to happen between the applications business logic and the user. The application needs to scale as usage increases. It needs to be protected from attack and its availability must be maintained to meet end-user expectations. These are elements that are typically not in the functional requirements of the application and typically not addressed when the application was built. DevOps and site reliability engineering can help address these non-functional requirements. However, non-functional requirements are becoming more complex as the number of microservices based applications increase. Furthermore, business applications are increasingly distributed over a multi-cloud environment. They often have multiple generations of application architecture components in them namely three tier, web, mobile, micro services and even serverless. This creates the need for application services such as Ingress controller, API gateway, load balancer, web application firewall, et cetera, which need to be injected in a standard way between the application business logic and the end-user. Application services help applications operate securely at scale and distributed application services enable fast and secure digital customer experiences. While ideally, we could seamlessly insert and integrate application services in the application path, today it is not that simple. A typical enterprise IT needs to stitch together multiple application services from multiple vendors to deliver an application to customers. Our customer research showed that 59% of organizations use 10 or more application services. For most organizations, each of these application services is managed separately with its own management tools. This results in silo teams and high operational complexity. This fragmentation also creates inconsistent application security. While teams work to protect the different aspects of application behaviors, the user experience of the business service often is left under protected. Finally, this piecemeal approach limits visibility across the application delivery chain, making it impossible for enterprises to get a holistic view of the business impact. We are creating a unified platform to solve these challenges for our customers. We are delivering real value to customers, simplifying operational complexity, providing business insights and protecting the user experience end-to-end. We are also uniquely positioned to deliver a new level of application insights and automation. F5’s BIG-IP instances, along with NGINX software, support more than 400 million application workloads across the globe. We support application delivery with purpose built hardware in virtual machines, in container software and in native cloud services. Our solutions are truly multi-cloud supporting applications in customer’s data centers, in private clouds and in public clouds. This means, we are ideally positioned to help customers to collect a rich set of business telemetries through these application services, information like application latency, step information in an online purchase or the location information for end-users. The business-related telemetry we collect, combined with our proven AI-powered analytics engine from Shape, can help customers discover insights about their applications and business transactions. BIG-IP and NGINX application services translate these insights into application configuration policies to automate application delivery. With the addition of Shape, we are setting the bar higher and marching toward a multipurpose application analytics platform. Such a platform supports application insights and automation and AI ops, as well as AI-enabled security and fraud protection, end-to-end digital experience management and AI-enabled business services. For example, telemetry data about browser signature or customer credentials can help identify that a request to a retailer’s website is actually generated by a bot, not a human. This kind of information can be used to help identify fraudulent transactions. We are developing this comprehensive application analytics platform, leveraging telemetry from our rich set of application services and Shape’s AI-powered analytics. Today, we offer the most comprehensive application services along the application path, which scale and protect our customers’ mission-critical business services. Our application services support more than half of the world’s enterprise application workloads. For the future, we are doubling down on application telemetry in cloud analytics. We are leveraging machine learning and AI to help our customers to discover insights about their applications, business flows and user experiences. As a result of the investments we have made over the last several years, we have the major components required to realize our vision. We will accomplish this level of application insights and automation from multiple complementary tools designed to address specific customer challenges. The most recent of those tools is the Shape AI fraud engine or SAFE. SAFE is a cloud fraud-prevention service. We created and refined the initial version in a matter of weeks in response to fraud that first became visible in Shape’s analytics and telemetry data. SAFE and Shape recognized another analytics-based Shape Solution are both upsell propositions. SAFE enables a higher level of fraud protection than other cloud security solutions, while recognized, minimizes friction for legitimate application users and in doing so, drives increase in topline revenue for customers. Where other Shape Solutions target bot, SAFE targets human fosters, consider that a typical retailers web traffic is 95% bot traffic. Shape enterprise defense can block more of that bot traffic than other cloud security solutions, typically more than 99%. Once the bot traffic is identified and blocked, we then can zoom in and begin to analyze the much smaller volumes of human traffic and to identify very subtle, low volume, fraudulent behavior. Let me share a story about how SAFE works using a customer example. In this case, the customer is a $30 billion market cap nationwide restaurant chain, with COVID-19, more customers than ever before begin ordering food online. Bad actors were eager to take advantage of these new patterns. In one month, the chain lost $600,000 to an incredibly clever discount scam that used fake credit cards. The front stores would use social media to advertise 70% or 80% discounts on meals, if customers ordered and paid through them. The fraudsters then used fake credit cards or other payments to place orders at the restaurant. Food is prepared and picked up only later that the restaurant discovered that the payment method was invalid. With SAFE, we delivered a 90% plus reduction in fraudulent orders. With SAFE and Shape recognized, F5 delivers a complete set of application security capabilities that span high volume bot attack in the hundreds of millions per day, all the way down to ultra-sophisticated fraud scheme that number in the 10s per day. We see our journey to our journey to creating adaptive applications occurring in four acts, each of which brings with it new growth opportunities for F5. With Acts 224, we are also expanding our addressable opportunity. From a timing perspective, we are working multiple acts in parallel. In Act 1, we took steps to expand our opportunity within traditional applications. In this phase, we unlock new growth opportunity by adding automation and orchestration to our existing software solutions. We made them lighter weight. We made them easier to procure, consume and deploy. We made upgrades easier. The majority of the software growth of this year and last comes as a result of these actions and we believe there is additional growth ahead. We continue to innovate our next-generation BIG-IP software that will further differentiate F5 in traditional applications. The addition of NGINX took us into Act 2, opening a new addressable opportunity for F5. NGINX enables us to serve modern application environments and cloud native applications. In fact, half of NGINX deployments are in the public cloud. NGINX also brought us modern application services, including API gateway and API management, Kubernetes Ingress control and microservices proxy. NGINX enables us to win against competing software vendors and cloud-native services that lock customers into a specific architecture putting infrastructure and development teams at odds. We took a different approach with the new version of NGINX Controller, our orchestration and analytics platform. We expect controller will bridge the divide between dev teams building modern apps and the infrastructure team that need to secure scale and monitor them. We believe Act 2 brings significant growth opportunity and complements our existing BIG-IP footprint. Act 3 is all about application security, where the last decade was focused on network security, we believe the next opportunity is application security. We started this act organically focused on traditional applications. The ambition of NGINX gives us the opportunity to expand application security to modern applications. And the addition of Shape adds significant capabilities to serve both traditional and modern applications, doubling our application security opportunity from $4 billion to $8 billion. We are well on our way to establishing ourselves as the leading security player for our traditional application security solutions. We are very early on in our efforts to apply best-in-class security to modern applications with the combination of F5 and NGINX, and we are only beginning to tap the potential of growth for Shape. In Act 4, we will leverage analytics to drive automation and deliver business insights. We will leverage our broad application services and Shape’s powerful analytics to deliver AI-enabled security and fraud protection, digital experience management, application performance management, and AIOPS and analytics-enabled business services. Through our existing investments, we are well on our way to delivering this vision for customers. We are creating a differentiated application services platform that will enable adaptive applications, helping customers accelerate their digital transformation and fundamentally changing the way applications are delivered and secured. Let me wrap up the prepared remarks from today’s call by thanking the entire F5 team again, as well as our customers and partners. We are more confident than ever that our vision, our investments and our innovation are well aligned with both near and longer term customer demand. With that, Operator, we will now open the call to Q&A.